Configuration Manager Documentation Library
See Also
System Center Configuration Manager 2007 logo

Welcome to Microsoft System Center Configuration Manager 2007. Configuration Manager 2007 contributes to a more effective Information Technology (IT) department by enabling secure and scalable operating system and application deployment and desired configuration management, enhancing system security, and providing comprehensive asset management of servers, desktops, and mobile devices.

Post-Setup Configuration Tasks

After Setup has run, there are still a few tasks you must perform to have a functioning Configuration Manager 2007 site. For example, a functioning site must have clients and site servers. For more information, see Checklist for Required Post Setup Configuration Tasks.

Common Configuration Manager Tasks

For more information about how to do common Configuration Manager 2007 tasks, see the following topics.

  • Planning and Deploying the Server Infrastructure for Configuration Manager 2007
  • Planning and Deploying Clients for Configuration Manager 2007
  • Collect hardware and software asset information
  • Distribute software
  • Deploy software updates
  • Deploy operating systems
  • Manage desired configurations
  • Remotely administer a computer
  • Restrict non-compliant computers from accessing the network
  • Manage mobile devices like Smartphones and Pocket PCs

Version

This is the August 2008 version of the Configuration Manager Documentation Library. This version contains updated content for Configuration Manager 2007 and Configuration Manager 2007 SP1, and content for Configuration Manager 2007 R2. Please review the topic What's New in the Configuration Manager Documentation Library for August 2008 to see a list of significant changes made to the Configuration Manager 2007 since the May 2008 version of the Library. New and updated topics are marked with the following text: Topic Last Updated—August 2008.

Previously updated topics will show the month and year they were last updated. Always consider the latest update to be authoritative in case of conflicts.

Provide Feedback

If you would like to provide feedback, make a suggestion, or report an issue with Configuration Manager 2007 or with the Configuration Manager Documentation Library, you can go to the Microsoft Connect site. You can right-click any node in the Configuration Manager 2007 console and click Give Feedback, or you can go directly to the Connect site at http://go.microsoft.com/fwlink/?LinkId=67307.

See Also

Concepts

Getting Started with Configuration Manager 2007
Technical Reference for Configuration Manager 2007

Other Resources

Configuration Manager 2007 Features
How to Configure Configuration Manager 2007
Maintaining Configuration Manager 2007
Planning and Deploying Clients for Configuration Manager 2007
Planning and Deploying the Server Infrastructure for Configuration Manager 2007
Security and Privacy for Configuration Manager 2007
Troubleshooting Configuration Manager 2007


What's New in the Configuration Manager Documentation Library for August 2008

Topic Last Updated—August 2008

The following section describes what's new in the Microsoft System Center Configuration Manager 2007 Documentation Library since May 2008. The topics listed in the table are new or contain significant technical changes to Configuration Manager 2007. Topics that contain minor changes to Configuration Manager 2007 are not listed.

Planning and Deploying the Server Infrastructure for Configuration Manager 2007

Topic | Description
Overview of Internet-Based Client Management | Updated with the features and functionality from Configuration Manager 2007 SP1 and Configuration Manager 2007 R2 that are not supported when clients are managed on the Internet.
Deploying the PKI Certificates Required for Native Mode | Updated for Active Directory Certificate Services in Windows Server 2008.
Deploying the Web Server Certificates to Site System Servers | Updated for IIS 7.0 on Windows Server 2008.
Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2008 Certification Authority | New topic that contains example deployment procedures using a Windows Server 2008 certification authority (CA) with certificate templates.
Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management | Updated with the reference to the ISA Server document that contains the procedures required to configure SSL-to-SSL bridging for an Internet-based site system server (http://go.microsoft.com/fwlink/?LinkId=122350).
Determine the Ports Required for Internet-Based Client Management | Updated to include RPC, which is needed for site system installation and package installation.
Renewing or Changing the Site Server Signing Certificate | Updated to include the scenario of renewing the root certificate from the same certification authority. In this scenario, clients behave as if the root certification authority has changed, and by default, clients will reject the new site server signing certificate. This information has also been added to the troubleshooting issue “Native Mode Clients Become Unmanaged When They Use a New Site Server Signing Certificate” in the topic Configuration Manager Client Native Mode and Internet-Based Client Management Issues.
New Site System Server Wizard: General Page | Updated to include new information about name resolution requirements for server names entered in the wizard.
Site System Properties: General Tab | Updated to include new information about displayed site system name properties.
Setup Command Line Options | Updated to include new information about using the /MP and /SQL Setup Prerequisite Checker command-line options.
Configuration Manager 2007 Supported Configurations and Configuration Manager 2007 SP1 Supported Configurations | Updated to display non-support of IA 64-bit platforms to host the site database server role.
Troubleshooting Configuration Manager 2007 SP1 Setup | New topic describing issues that might be encountered when upgrading from Configuration Manager 2007 to Configuration Manager 2007 SP1.
How to Upgrade the Windows Automated Installation Kit During Site Upgrades to Configuration Manager 2007 SP1 | New topic describing the process to upgrade the Windows Automated Installation Kit when upgrading from Configuration Manager 2007 to Configuration Manager 2007 SP1.

Planning and Deploying Clients for Configuration Manager 2007

Topic Description

Client Push Installation Properties: General Tab

Updated to clarify that the site option to enable client push installation to assigned resources is independent from the Client Push Installation Wizard. Additional supporting links have also been added.

About Configuration Manager Client Installation Properties

Updated the /config:<configuration file> CCMSetup command-line property entry with the required location of the configuration file and file format information.

How to Configure Request Ports for the Configuration Manager Client

Updated to clarify when clients are automatically configured for nondefault port numbers and the circumstances in which you must reinstall them.

Decide How to Install Configuration Manager Clients for Internet-Based Client Management

Updated for clarification and includes the source location of the client installation files.

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point

Updated to include a scripting method for configuring clients with the Internet-based management point.

Configuration Manager Client Native Mode and Internet-Based Client Management Issues

The entry “Internet Clients Do Not Use New Proxy Server Details” has been updated to reflect that this issue has been resolved with the Configuration Manager 2007 SP1 client.

The entry “Native Mode Operation Fails with Version 3 Certificate Templates and Windows Server 2008” has been added because the new certificate template type introduced with Active Directory Certificate Services in Windows Server 2008 creates certificates that are not compatible with Configuration Manager native mode. This information has also been added to the following topics:

  • Determine If You Can Use Your Existing PKI (Native Mode)
  • Certificate Requirements for Native Mode

How To Configure Configuration Manager 2007

Topic | Description
How to Configure the SQL Server Publisher Computer | Updated note with new information about the increased number of replication objects necessary for site database replication for Configuration Manager 2007 SP1 installations.
How to Configure Windows Server 2008 for Site Systems | Updated with additional Windows Server 2008 configuration information required to support Configuration Manager 2007 SP1 site systems.

Configuration Manager 2007 Features

Topic Description

Prerequisites for Desired Configuration Management

Updated to clarify that the external dependency for the Microsoft .NET Framework is version 2.0 or later, rather than version 2.0 only.

About Compliance Evaluation Schedules in Desired Configuration Management

Updated with the information that although the scheduled compliance evaluation is processed in the local client time by default, this can be changed to coordinated universal time (UTC) by specifying a custom schedule. This information is also added to How to Configure the Default Compliance Evaluation Schedule for Desired Configuration Management.

Determine If You Need to Export Configuration Data for Desired Configuration Management

Updated to clarify that you cannot export configuration data that is imported or inherited from a parent site. This clarification has also been added to the following topics:

  • How to Export Configuration Items in Desired Configuration Management
  • How to Export a Configuration Baseline in Desired Configuration Management

How to Import a Configuration Baseline in Desired Configuration Management

Updated to include the failed import scenario of importing a deleted configuration baseline that hasn’t yet aged out and added a link to Import Failures with Desired Configuration Management.

AMT Provisioning Issues for Out of Band Management

Added the entry “Configuration Manager Fails to Provision Computers for AMT Because the Root Certification Authority Certificate has a Key Length of Greater than 2048 Bits”, which provides log file entries to help identify this non-supported scenario.

About Certificates for Out of Band Management

Updated with the limitation that out of band management cannot support certificates that are created with the new version 3 certificate template introduced with Windows Server 2008 Active Directory Certificate Services. This information is also added to Certificate Requirements for Out of Band Management.

Import Computer for Out of Band Management Wizard - Choose Mapping Page

Updated with the information that any manually specified passwords cannot be in clear text but must be encoded by using Base 64. This information is also added to Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

About Task Sequences

Updated to state that task sequence node, task sequence subfolders, and the task sequences those nodes and subfolders contain are replicated down the site hierarchy to child sites.

Troubleshooting General Operating System Deployment Issues

Updated with information clarifying that when users are added by using the Create a New Computer Association wizard the specified users are lost. The users must be added separately after the computer association has been successfully created.

Asset Intelligence Home Page and About the Asset Intelligence Home Page

Updated with Asset Intelligence catalog synchronization status summary information to better describe expected catalog summary behavior.

Importing Software Licenses Into the Asset Intelligence Catalog

Updated with new information about how to import Microsoft and non-Microsoft software license information into the Asset Intelligence catalog.

About Standard and Branch Distribution Points

Updated with numerous clarifications about the support requirements and operational behavior of branch distribution points.

How to Convert a Standard Distribution Point to a Branch Distribution Point

Updated so that the conversion process does not require uninstalling and reinstalling the distribution point or site system.

Choose Between a Standard and Branch Distribution Point

Updated to include the new condition that a branch distribution point should not chosen if you want to use multicast with Configuration Manager 2007 R2.

Troubleshooting Software Distribution Issues

Updated to include two new issues relating to the branch distribution point:

  • Cannot Create Branch Distribution Point Because the Option is Disabled
  • Branch Distribution Point Fails to Install Packages in a Native Mode Site

Apply Operating System and Apply Data Image Task Sequence Actions

Updated to include better guidance about the partition or hard drive installed with the operating system or data image. Apply Operating System action now includes additional information about task sequence variables for this task.

Troubleshooting PXE Initiated Operating System Deployment Issues

Updated to include two known issues:

  • PXE Service Point Remote Installation Directories Are Not Removed During PXE Service Point Uninstall
  • Remote PXE Service Points Must Be Updated After Upgrading to Configuration Manager 2007 SP1

Security and Privacy for Configuration Manager 2007

Ports Used by Configuration Manager

Updated with client to domain controller port information; missing SMB ports for management point to site server; missing RPC port 135 for Configuration Manager console to the client (remote control); clarified that ports for the reporting point are configured at installation only; and added a link to a full listing of standard Windows ports. Also added the new section “Installation Requirements for Internet-based Site Systems”.

See Also

Concepts

What's New in the Configuration Manager Documentation Library for May 2008
What's New in the Configuration Manager Documentation Library for March 2008
What's New in Configuration Manager 2007
What's New in the Configuration Manager Documentation Library for August 2007
What's New in the Configuration Manager Documentation Library for November 2007
What's New in the Configuration Manager Documentation Library for January 2008


What's New in the Configuration Manager Documentation Library for May 2008

Topic last updated—May 2008

This version of the Configuration Manager Documentation Library contains content for Configuration Manager 2007 SP1 and preliminary content for Configuration Manager 2007 R2.

Configuration Manager 2007 SP1 and Preliminary Configuration Manager 2007 R2 Content

The following sections of the documentation library contain new Configuration Manager 2007 SP1 content and Configuration Manager 2007 R2 prerelease content:

  • What's New in Configuration Manager 2007 SP1
  • What's New in Configuration Manager 2007 R2
  • Out of Band Management in Configuration Manager 2007 SP1
  • Asset Intelligence in Configuration Manager
  • Client Status Reporting in Configuration Manager 2007 R2
  • SQL Reporting Services in Configuration Manager 2007 R2
  • About Configuration Manager Client Installation Properties
    Note
    This topic lists the new behavior for a Configuration Manager 2007 SP1 client when configured for the property CCMFIRSTCERT=1, where the certificate with the longest validity period is selected instead of a random selection. This configuration might be required if you are using Network Access Protection with IPSec enforcement in a native mode environment.

The following section describes what's new in the Microsoft System Center Configuration Manager 2007 Documentation Library since March 2008. The topics listed in the table are new or contain significant technical changes to Configuration Manager 2007. Topics that contain minor changes to Configuration Manager 2007 are not listed.

Planning and Deploying the Server Infrastructure for Configuration Manager 2007

Topic | Description
Configuration Manager 2007 Supported Configurations | Windows Vista SP1 and Windows Server 2008 have been added as supported platforms.
Setup Prerequisite Checks | Additional Setup prerequisite checks for Configuration Manager 2007 SP1 Setup have been added.
How to Extend the Active Directory Schema Using ExtADSch.exe | Information about using the ExtADSch.exe utility to extend the Active Directory schema for Configuration Manager on Windows 2000–based computers has been added.

Configuration Manager 2007 Features

Topic Description

About the NAP Client Status in Network Access Protection

Updated with information about supporting Network Access Protection on the Windows XP operating system platform, by upgrading to Windows XP Service Pack 3. This replaces the previous references to the Network Access Protection (NAP) Client for Windows XP. The following topics have also been updated with this information:

  • Administrator Checklist: Configure Network Access Protection for Configuration Manager
  • About the Differences Between Software Updates and Network Access Protection
  • Determine Administrator Roles and Processes for Network Access Protection
  • Example Scenarios for Implementing Network Access Protection in Configuration Manager
  • How to Prepare the Site for Network Access Protection Clients
  • Prerequisites for Network Access Protection

See Also

Concepts

What's New in Configuration Manager 2007
What's New in the Configuration Manager Documentation Library for August 2007
What's New in the Configuration Manager Documentation Library for November 2007
What's New in the Configuration Manager Documentation Library for January 2008
What's New in the Configuration Manager Documentation Library for March 2008


What's New in the Configuration Manager Documentation Library for March 2008

Topic last updated—March 2008

This version of the Configuration Manager Documentation Library contains Configuration Manager 2007 SP1 and preliminary content for Configuration Manager 2007 R2. New content is marked with Topic last updated—January 2008 or Topic last updated—March 2008.

Configuration Manager 2007 SP1 and Preliminary Configuration Manager 2007 R2 Content

The following sections of the documentation library contain new Configuration Manager 2007 SP1 content and Configuration Manager 2007 R2 prerelease content:

  • What's New in Configuration Manager 2007 SP1
  • What's New in Configuration Manager 2007 R2
  • Out of Band Management in Configuration Manager 2007 SP1
  • Asset Intelligence in Configuration Manager
  • Client Status Reporting in Configuration Manager 2007 R2
  • SQL Reporting Services in Configuration Manager 2007 R2
  • About Configuration Manager Client Installation Properties
    Note
    This topic lists the new behavior for a Configuration Manager 2007 SP1 client when configured for the property CCMFIRSTCERT=1, where the certificate with the longest validity period is selected instead of a random selection. This configuration might be required if you are using Network Access Protection with IPSec enforcement in a native mode environment.

The tables in the following sections describe what's new in the Microsoft System Center Configuration Manager 2007 Documentation Library since January 2008. The topics listed in the tables are new or contain significant technical changes to Configuration Manager 2007. Topics that contain minor changes to Configuration Manager 2007 are not listed.

Planning and Deploying the Server Infrastructure for Configuration Manager 2007

Topic | Description
Prerequisites for Installing Configuration Manager | Changed support statement for versions of Active Directory Domain Services.
Example Scenarios for Implementing Internet-Based Client Management in Configuration Manager | Included certificate revocation list (CRL) access considerations.

Planning and Deploying Clients for Configuration Manager 2007

Topic Description

Client Status Reporting in Configuration Manager 2007 R2

New content added for the client status reporting feature in Configuration Manager 2007 R2.

Note
Primary documentation for client status reporting is located in separate documentation for the feature.

How to Configure Configuration Manager 2007

Topic | Description
How to Determine Whether Client Computers Are Ready for Native Mode | Added information about the available command-line options with examples.

Configuration Manager 2007 Features

Topic | Description
About Virtual Application Packages | Virtual application packages allow you to run software applications on Configuration Manager 2007 client computers without having to install the application on the local computer. You can stream the virtual application package to a target computer and run it from a distribution point or configure the target computer to download and run the application locally.
Package Access Flowchart for Internet-Based Clients | Updated for new client behavior in Configuration Manager 2007 SP1, and corrected the text for the last decision point.
Troubleshooting Software Distribution Issues | Updated to include new issue for advertisements that fail to run on the Internet.
SQL Reporting Services in Configuration Manager 2007 R2 | New content added for SQL Reporting Services integration in Configuration Manager 2007 R2
Supported Operating Systems and Hard Disk Configurations for Operating System Deployment | Windows Embedded for Point of Service is supported for operating system deployment (requires support of sysprep for creating and deploying images).

Security and Privacy for Configuration Manager 2007

Topic | Description
Ports Used by Configuration Manager | Reworded section 11 Client -- > System Health Validator to more accurately depict the ports required for IPsec enforcement with Network Access Protection.
Implementing IPsec in Configuration Manager 2007 | Removed the section about RPC port configuration because this was not a tested scenario.

See Also

Concepts

What's New in Configuration Manager 2007
What's New in the Configuration Manager Documentation Library for August 2007
What's New in the Configuration Manager Documentation Library for November 2007
What's New in the Configuration Manager Documentation Library for January 2008


What's New in the Configuration Manager Documentation Library for January 2008

Topic last updated—January 2008

This version of the Configuration Manager Documentation Library contains preliminary content for the Beta version of Configuration Manager 2007 SP1 and Configuration Manager 2007 R2. Beta content is marked with Topic last updated—January 2008 but is not individually listed as changed content.

The following sections of the library contain prerelease content for Beta:

  • What's New in Configuration Manager 2007 SP1
  • What's New in Configuration Manager 2007 R2
  • Out of Band Management in Configuration Manager 2007 SP1
  • Client Status Reporting in Configuration Manager 2007 R2
  • About Configuration Manager Client Installation Properties. This topic lists the new behavior for a Configuration Manager 2007 SP1 client when configured for the property CCMFIRSTCERT=1, where the certificate with the longest validity period is selected instead of a random selection. This configuration might be required if you are using Network Access Protection with IPSec enforcement in a native mode environment. This new behavior is also listed in the following topics:
    • Determine If You Need to Specify Client Certificate Settings (Native Mode)
    • How to Specify the Client Certificate Selection Criteria
    • Configuration Manager Client Native Mode and Internet-Based Client Management Issues
    • Site Properties: Site Mode Tab

The following tables describe what's new in the Microsoft System Center Configuration Manager 2007 Documentation Library as of January 2008. The topics listed in the tables are new or contain significant technical changes to Configuration Manager 2007. Topics that contain minor changes to Configuration Manager 2007 are not listed.

Getting Started

Topic | Description
Setup Prerequisite Checks | Two prerequisite rule descriptions added.

Planning and Deploying the Server Infrastructure for Configuration Manager 2007

Topic Description

Unattended Setup Overview

Updated topic lists the three parameters that must be typed in uppercase:

  • SQLServerName
  • SDKServer
  • ManagementPoint

Planning and Deploying Clients for Configuration Manager 2007

Topic Description

About Configuration Manager Client Installation Properties

Clarifies that SMSSITECODE=AUTO and CCMHOSTNAME properties must not be combined.

Client Status Reporting in Configuration Manager 2007 R2

New content added for the client status reporting feature in Configuration Manager 2007 R2.

Note
Primary documentation for client status reporting is located in separate documentation for the feature.

How to Configure Configuration Manager 2007

Topic | Description
How to Move the Site Database | Procedure steps updated.

See Also

Concepts

What's New in Configuration Manager 2007
What's New in the Configuration Manager Documentation Library for August 2007
What's New in the Configuration Manager Documentation Library for November 2007


What's New in the Configuration Manager Documentation Library for November 2007

Topic last updated—November 2007

The following table describes what's new in the Microsoft System Center Configuration Manager 2007 Documentation Library as of November 2007. The topics listed in the table are new or contain significant technical changes. Topics that contain minor changes are not listed.

Note
Many Configuration Manager 2007 files are stored under the operating system directory. On 32-bit operating systems, this is %windir%\system32, but on 64-bit operating systems, the directory is %windir%\SysWOW64. In the Documentation Library, the 64-bit directory is not always specified.

Getting Started

Topic Description

Configuration Manager Planning Phase

Additional information added to describe how to create a deployment project plan.

Configuration Manager Supported Configurations

Additional information added to describe the supported versions of Microsoft SQL Server that can be used to host the site database.

Incorrect information about Itanium based system support for the site database server note corrected.

Incorrect information about the supportability of Fast User Switching for Microsoft Windows XP and Windows Vista corrected.

Setup Prerequisite Checks

Two additional prerequisite check rules added to KB940848 and KB941132.

What's New in Software Distribution for Configuration Manager

Includes a new section with information about copying multiple packages to one distribution point.

Planning and Deploying the Server Infrastructure for Configuration Manager 2007

Topic | Description
Choose Between Primary Sites, Secondary Sites, and Branch Distribution Points | Updated topic to include considerations for branch distribution points instead of sites.
Configuration Manager in Multiple Active Directory Forests | Includes additional information about site hierarchies across forests.
Configuration Manager In-Place Upgrade | New content added to highlight the fact that upgrading existing SMS 2003 sites using the evaluation version Configuration Manager 2007 software is not supported.
Considerations for Upgrading Sites | Updated with the required Systems Management Server (SMS) 2003 service pack level required for upgrade to Configuration Manager 2007.
Example Scenarios for Implementing Internet-Based Client Management in Configuration Manager | Includes new scenario: "Support Internet-Based Clients and Intranet Clients in the Intranet on the Same Site System Server." This scenario includes information about how to specify multiple fully qualified domain names (FQDNs) for a site system server that supports intranet clients and Internet clients.
How to Deploy a Site Using Simple Setup and How to Deploy a Site Using Custom Setup | Includes new information about how to handle required setup redistributable files when installing primary sites.
How to Extend the Active Directory Schema Using an LDIF File Troubleshooting Active Directory Schema Extensions During Upgrades Configuration Manager 2007 Upgrade Checklist | Includes new information about the procedures required when using the LDIF file to extend the Active Directory schema for Configuration Manager if the Active Directory schema has already been extended for SMS 2003 sites.
How to Install a Secondary Site Using the Configuration Manager Console How to Install a Secondary Site Using Configuration Manager Setup | Includes new information about how to handle required setup redistributable files when installing secondary sites from local installation source files at the secondary site server computer.
How to Upgrade an SMS 2003 Administrator Console | Includes new information about how to connect the Configuration Manager console to the site database after upgrading an SMS 2003 Administrator console.
International Client Pack | Includes information from SMS 2003 release notes that still applies to Configuration Manager 2007.
Prerequisite Component Update Checker | A new topic that describes the process used to download updated client component prerequisite installation files.
Scripted Primary Site Installation Example Scripted Secondary Site Installation Example | New client prerequisite download scripted installation options added to unattended installation scripts.
Setup Command Line Options | Revised content to clarify the functionality of the /PREREQ /ALLSEC command-line option.
Troubleshooting the Configuration Manager Server Infrastructure Troubleshooting Management Point Communication Troubleshooting State Message Backlogs | Includes new information for troubleshooting the server infrastructure for Configuration Manager.
Unattended Setup Overview | Revised content to clarify information about the unattended setup client prerequisite download and client agent keys used in unattended setup initialization files.
Configuring Configuration Manager Sites for Best Performance | Includes new Configuration Manager performance planning and configuration information.
How to Modify a Sender Sender Properties: Advanced Tab | Revised content to clarify how to configure sending thread configurations.
Prerequisites for Native Mode | Includes additional Configuration Manager 2007 dependency for contacting a certificate revocation list (CRL) when it is used in your PKI deployment.

Planning and Deploying Clients for Configuration Manager 2007

Topic | Description
About Client Approval in Configuration Manager | Clarification that a Configuration Manager 2007 client cannot be approved before it is successfully installed and assigned to a site.
Advertised Programs Client Agent Properties: Notification Tab | Updated options displayed on the Notification tab of the Advertised Programs Client Agent Properties dialog.
Example Roaming Scenarios for Configuration Manager: Complex | Pictures added to illustrate each example scenario, as well as corrections to the scenario "Client Roams into another Configuration Manager 2007 Hierarchy."
Firewall Settings for Configuration Manager Clients | Removed reference to the Configuration Manager 2007 console requiring port 135 and unsecapp.exe. Due to console redesign in Configuration Manager 2007, these firewall exceptions are no longer required.
How to Export the Site Server Signing Certificate for Configuration Manager Client Installation | New procedural topic for exporting the native-mode site server signing certificate if you need to specify the SMSSIGNCERT CCMSetup client.msi property during client installation.
How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management | New procedural topic for using Resource Explorer to identify client configuration for native-mode and Internet-based client management. This information is stored in hardware inventory; from there, it can be used for troubleshooting, auditing, or creating query-based collections.
How to Initiate Policy Retrieval for a Configuration Manager Client | Updated to include a script to run on the client computer.
Configuration Manager Management Point Location Data Flow: Mixed Mode | New dataflow displaying the process by which Configuration Manager 2007 clients locate their default management point when their assigned site is operating in mixed mode.
Configuration Manager Management Point Location Data Flow: Native Mode | New dataflow displaying the process by which Configuration Manager 2007 clients locate their default management point when their assigned site is operating in native mode.
Configuration Manager Site Assignment Data Flow | New dataflow displaying the process by which Configuration Manager 2007 clients become assigned to a site.
Supported Localized Languages | Includes new information to confirm that DBCS characters are not supported for package or file names.
Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices | New topics providing methods for managing the Configuration Manager 2007 client on devices running the Microsoft Windows XP Embedded operating system.

Configuration Manager 2007 Features

Note
The 6A and 12A asset intelligence reports are not present in Configuration Manager 2007 installations. References to these reports in the documentation should be ignored.

Topic Description

About Collection-Specific Settings

New topic about per-collection settings for policy polling and restart intervals.

About Distribution Points

Includes several new topics about distribution points. Also, existing topics have been expanded. Updated distribution point topics include the following:

About BITS-Enabled Distribution Points

About Protected Distribution Points

About Standard and Branch Distribution Points

Choose Between a Server and Server Share Distribution Point

Choose Between a Standard and Branch Distribution Point

Decide Whether to Enable BITS on a Distribution Point

Decide Whether to Protect the Distribution Point

How to Configure a BITS-Enabled Distribution Point

How to Configure a Protected Distribution Point

How to Deploy a Branch Distribution Point

How to Convert a Standard Distribution Point to a Branch Distribution Point

About Drag-and-Drop Support in the Configuration Manager Console

New topic specifying which objects can be dragged and dropped.

About On-Demand Package Distribution

Revised a statement in this topic that implies that a branch distribution point can get content from a management point. Branch distribution points get content only from a BITS-enabled standard distribution point. Added considerations for configuring high-priority packages for on-demand package distribution.

About Resources

Clarified the types of operations you can perform on non-client resources, such as a user account or routers.

About Software Updates Compliance

New topic about software updates compliance and the scan for software updates compliance process.

About Software Updates Synchronization

Updated topic about the software updates synchronization process.

About the Package Definition File Format

Updated example of supported clients.

About Windows Installer Source Location Manager

Added topics about Windows Installer source location management. Updated the F1 help about the Windows Installer tab with more information about Windows Installer source location management. These new topics contain the same information as the SMS 2003 white paper "Windows Installer Source Location Manager." Windows Installer source location management has not changed in Configuration Manager 2007.

How To Configure Windows Installer Source Update Management

Script Sample for API-Based Triggering of the Product Source Update Manager

Program Name Properties: Windows Installer Tab

Administrator Checklist: Prepare the Configuration Manager Environment for Bare Metal Operating System Deployment

New topic describes the tasks you perform to prepare the Configuration Manager 2007 environment for bare-metal operating system deployments.

About Compliance Evaluation Schedules in Desired Configuration Management

Clarifications about how configuration baseline assignments are evaluated, including the two-hour random delay window.

Compliance Sent As State Messages and Status Messages in Desired Configuration Management

Previously titled "Changes in Compliance That Are Sent to the Site for Desired Configuration Management," this topic now clarifies when compliance information is sent in state messages or status messages.

Compliance Information Missing in Desired Configuration Management

Clarified symptoms when the prerequisite Microsoft .NET Framework version is missing on clients and includes additional information related to the client evaluation time.

Best Practices for Desired Configuration Management

New topic that lists best practice information about desired configuration management in Configuration Manager.

Best Practices for Network Access Protection

New topic that lists best practice information about Network Access Protection in Configuration Manager.

Best Practices for Software Updates

Updated topic with best practices for software updates.

Choose Between Updating and Refreshing a Package

New topic about the differences between updating and refreshing packages.

Decide Whether Clients Should Download Content If They Are on a Slow or Unreliable Network Boundary

New topic about considerations for configuring clients to not download content on slow or unreliable network boundaries.

Determine Administrator Roles and Processes for Wake On LAN

New topic that provides guidance on the various roles and processes involved with implementing Wake On LAN in Configuration Manager 2007, and some of the possible consequences of not identifying them.

Example Package Access Scenarios

New topic illustrating the security context used to access packages in various forest and domain configurations. These scenarios work with the following new flowcharts:

Package Access Flowchart When Running from Distribution Point

Package Access Flowchart When Downloading from an Intranet Distribution Point

Package Access Flowchart for Internet-Based Clients

Example Scenarios for Implementing Wake On LAN

New topic that contains three example scenarios of how Wake On LAN can be implemented in Configuration Manager 2007 to address specific business requirements.

Flowcharts for Software Updates

New flowcharts for software updates, including the following:

Software Updates Synchronization Process Flowchart

Software Update Deployment Process Flowchart

Deployment Package Process Flowchart.

Frequently Asked Questions for Discovery

New topic for frequently asked questions. This information is from the SMS 2003 Technical FAQ but still applies to Configuration Manager 2007.

Frequently Asked Questions for Software Distribution

Carried over several frequently asked questions (FAQ) from the SMS 2003 Technical FAQ that still apply to Configuration Manager 2007.

In the FAQ, called out that dependent programs are not installed when a program is run in a task sequence. The information already existed in the content for operating system deployment. Also added the content to the F1 help for programs: Program Name Properties: Advanced Tab.

Known Issues for Mobile Device Management

Updated topic that describes known issues for the mobile device management feature and solutions for issues when available.

Ports Used in Software Updates

New diagram that illustrates the ports used by software updates in a typical Configuration Manager hierarchy.

Run Query Special

Removed content because it no longer applies. In previous versions, run query special was included because large queries sometimes caused the console to stop responding. Queries are now run immediately when the query is selected.

Software Distribution Troubleshooting Flowcharts

Added a section with software distribution flowcharts.

Log Files for Software Metering

New topic listing log files that can help to troubleshoot Configuration Manager 2007 software metering.

Software Updates State Messages

New topic about the state messages created by software updates clients.

Troubleshooting Discovery

Moved the existing Discovery Troubleshooting Administrator Workflows to the troubleshooting section. Added discovery troubleshooting workflows. Includes new topic for troubleshooting common issues: Troubleshooting Discovery Issues.

Prerequisites for Operating System Deployment

Updated to include the public key infrastructure (PKI) certificates that might be required for operating system deployments if the site is configured for native mode.

Planning for Operating System Deployment in a NAP-Enabled Environment

New topic with planning information about how to configure operating system deployments with Network Access Protection (NAP).

Planning for Operating System Deployment in a Native Mode Site

New topic with planning information about the public key infrastructure (PKI) certificates that are required for operating system deployments in a native mode site.

Troubleshooting Operating System Deployment

New topics included in the operating system deployment troubleshooting section to help you identify and resolve problems related to operating system deployments.

Troubleshooting Software Metering Issues

New topic for problems and solutions related to Configuration Manager 2007 software metering.

Troubleshooting Software Updates Issues

New topics for troubleshooting software updates issues, including the following:

Troubleshooting General Software Updates Issues

Troubleshooting Software Update Point Configuration Issues

Troubleshooting Software Updates Synchronization Failures

Troubleshooting Software Update Deployment Issues

Troubleshooting Software Updates Client Issues

Troubleshooting Group Policy Configuration for Software Updates

Troubleshooting Inventory Tool for Microsoft Updates Issues

About State Messages

Includes new information about client state message behavior.

Troubleshooting Wake On LAN Issues

New topic for possible problems and solutions related to Wake On LAN failing to wake up computers as expected.

Security and Privacy for Configuration Manager 2007

Topic | Description
About Maintenance Windows | Updated to confirm that maintenance windows are not inherited by subcollections.
About the SMS Admins Group How to Assign Rights for Objects to Users and Groups | Clarified information about SMS Admins group. If the SMS Provider is not installed on the site server, Configuration Manager 2007 cannot automatically add users to the SMS Admins group.
How to Configure Windows SCW for Configuration Manager | It was previously assumed that the templates would be released on the download center. The templates are now planned to be released as part of the Configuration Manager 2007 Toolkit. The following related topics have been updated to reference the Toolkit: What's New in Security for Configuration Manager Best Practices for Securing Site Systems
How to Manage Accounts from the Command-Line | Removed Site System Installation Account as an account that can be managed using the Manage Site Accounts tool (MSAC.exe).
Overview of Configuration Manager Security | Clarified that rights do not flow down the site hierarchy and must be set at each site individually.
Ports Used by Configuration Manager | Added number 37 for PXE Service Point to the Microsoft SQL Server communication. Updated the remote control Ports section.

Technical Reference for Configuration Manager 2007

Topic Description

Custom Error Codes for Configuration Manager 2007

Includes new information mainly related to native mode in the Client Custom Error Codes section.

Computer Client Agent Properties: General Tab

Updated an incorrect value for the state message reporting cycle. This now reads 15 minutes.

Import Object Wizard

Corrected statement about duplicate objects overwriting existing objects. Reports with duplicate names overwrite existing reports, but collections and queries create duplicate object names with different IDs.

Example Configuration Manager Deployment Scenarios

  • Example Configuration Manager Installation Scenario
  • Example Configuration Manager Upgrade Scenario

Example Configuration Manager Deployment Checklists

  • Example Configuration Manager Installation Checklist
  • Example Configuration Manager Upgrade Checklist

Added Configuration Manager Setup and upgrade scenarios as well as example custom installation checklist examples to assist in planning and deploying Configuration Manager sites.

See Also

Concepts

What's New in Configuration Manager 2007
What's New in the Configuration Manager Documentation Library for August 2007


What's New in the Configuration Manager Documentation Library for August 2007

Topic last updated -- August 2007

The following table describes what's new in the Microsoft System Center Configuration Manager 2007 Documentation Library as of August 2007. The topics listed in the table are new or contain significant technical changes. Topics that contain minor changes are not listed.

Planning and Deploying the Server Infrastructure for Configuration Manager 2007

Topic | Description
Certificate Requirements for Native Mode | Updated to clarify that the site server signing certificate is only required on primary site servers, and not on secondary site servers. Certificate requirements for mobile devices have also been clarified with a separate entry from client computers.
Configuration Manager and Content Location (Package Source Files) | New conceptual topic that helps to explain how clients retrieve the source files they need for advertisements and software updates.
Configuration Manager and Network Load Balancing Clusters | New topic that explains how Configuration Manager can take advantage of site systems configured in network load balancing clusters.
Configuration Manager and Service Location (Site Information and Management Points) | Revised and updated with the corrected order in which clients find management points.
Configuration Manager Service Principal Name Requirements | New topic that explains Configuration Manager Service Principal Name (SPN) requirements.
Configuration Manager Supported Configurations | Changed free disk space required on client. This now reads 350 MB minimum.
Prerequisites for Internet-Based Client Management | Updated the external dependencies for Internet-based client management to include firewall requirements at the application level. This includes the required headers and verbs that are used with Internet-based client management traffic.

Planning and Deploying Clients for Configuration Manager 2007

Topic Description

About Client Site Assignment in Configuration Manager

Clarifications about the site compatibility check that occurs during site assignment.

Example Assignment Scenarios for Configuration Manager: Primary Sites

New technical reference topic to help explain using scenarios how site assignment works when clients reside within boundaries of primary sites.

Example Assignment Scenarios for Configuration Manager: Secondary Sites

New technical reference topic to help explain using scenarios how site assignment works when clients reside within boundaries of secondary sites.

Example Roaming Scenarios for Configuration Manager: Complex

New technical reference topic to help explain using scenarios some more complex roaming scenarios, and how a combination of factors and configuration can lead to often unwanted results.

Example Roaming Scenarios for Configuration Manager: Simple

New technical reference topic to help explain using scenarios which management point roaming clients communicate with when roaming.

How to Initiate Policy Retrieval for a Configuration Manager Client

New client procedural topic for easy reference when testing or troubleshooting.

How to Install Configuration Manager Clients Using Software Update Point Based Installation

Updated with clarifications for how to configure the Active Directory Group Policy object so that the software update point is specified in the correct format for software updates after the client is installed.

Troubleshooting Configuration Manager Client Issues

This topic has been split into the following 5 sections, with updated troubleshooting information in each section:

  • Configuration Manager Client Installation and Upgrade Issues
  • Configuration Manager Client Assignment Issues
  • Configuration Manager Client Mixed Mode Issues
  • Configuration Manager Client Native Mode and Internet-Based Client Management Issues
  • Configuration Manager Client General Issues

How to Configure Configuration Manager 2007

Topic | Description
How to Configure an SPN for NLB Management Point Site Systems | New How-To topic that explains the procedure for configuring NLB management point site system SPN requirements.
How to Configure an SPN for SQL Server Site Database Servers | New How-To topic that explains the procedure for configuring SQL Server site database server SPN requirements.
How to Configure Network Load Balancing for Configuration Manager Site Systems | New How-To topic that explains the procedure for configuring network load balancing for Configuration Manager site systems.
How to Configure the Active Software Update Point Component to Use an NLB Cluster | New How-To topic that explains the procedure for configuring NLB software update point site systems.
Management Point Component Properties: General Tab | Updated SPN requirements when configuring the management point component to use a network load balancing (NLB) cluster virtual server as the default management point for a Configuration Manager 2007 site.
Settings to Export or Transfer | Added tables that show which settings are transferred in the Transfer Site Settings wizard and whether they are transferred to Configuration Manager 2007 primary sites, secondary sites, or secondary SMS 2003 sites.

Configuration Manager 2007 Features

Topic Description

Compliance Information Missing in Desired Configuration Management

Additional items listed in this desired configuration management troubleshooting topic that helps you identify and resolve problems related to compliance results.

Configuration Manager Network Access Protection SoH Generation

Updated technical reference flow chart that shows how the Configuration Manager System Health Agent (SHA) generates a statement of health (SoH) in Configuration Manager 2007.

Configuring the Network Policy Server for Configuration Manager

Updated section so that configuration guidance for options on the Network Policy Server is more closely aligned to the Windows NAP "Step-by-Step" guides. Specifically, these topics have been revised:

  • Configuring the Network Policy Server for Configuration Manager
  • Configuring Health Policies for Configuration Manager Network Access Protection
  • Configuring Remediation Server Groups for Configuration Manager Network Access Protection
  • Configuring Connection Request Policies for Configuration Manager Network Access Protection
  • Configuring Network Policies for Configuration Manager Network Access Protection
  • Configuring Exemption Policies for Configuration Manager Network Access Protection

Error Codes in Configuration Manager Reports

New topic that explains how to interpret error codes displayed in Configuration Manager reports.

How to Downgrade the Mobile Device Client From a Newer Client Version

New topic that explains how to install an older mobile device client on a mobile device currently running a newer client.

How to Perform a Mobile Device Client Self-Test

New topic that explains how to test the communication between a mobile device and the mobile device management point.

Import Failures with Desired Configuration Management

New topic that lists the circumstances under which importing desired configuration management configuration data will fail, to help you diagnose and resolve import failures.

Known Issues for Mobile Device Management

New topic that describes known issues for the mobile device management feature and solutions for issues when available.

NAP Evaluation Conditions for Configuration Manager Clients

New technical reference topic that lists the conditions under which the Configuration Manager 2007 Network Access Protection client agent will perform a NAP evaluation rather than use cached results.

Problems Editing Configuration Data in the Configuration Manager Console

Additional items listed in this desired configuration management troubleshooting topic that helps you identify and resolve problems editing configuration data.

About Software Updates Reports

Fixed production error that prevented the list of troubleshooting reports from displaying. Added some notes to clarify how information is displayed.

Unexpected Compliance Results in Desired Configuration Management

New topic that lists known compliance evaluation results for specific scenarios, such as error conditions.

Unexpected Data in Desired Configuration Management Reports

Additional items listed in this desired configuration management troubleshooting topic that helps you identify and resolve display information in the reports.

Troubleshooting Software Updates Issues

Added topics

  • Troubleshooting Group Policy Configuration for Software Updates
  • Troubleshooting Software Updates Synchronization Failures
  • Troubleshooting General Software Updates Issues

Security and Privacy for Configuration Manager 2007

Topic Description

About the Internet Guest Account in Configuration Manager

Added a new topic about the Internet Guest (IUSR) account.

Best Practices for Securing Site Systems

Added information about using Microsoft SQL Server best practices with Configuration Manager 2007.

How to Manage Accounts from the Command-Line

Added a workaround to use the MSAC command line tool to modify the password for the Client Push Installation account.

Added a workaround to fix a known issue when using the -G -R options to set a strong password on all child sites.

How to Manually Exchange Public Keys Between Sites

This topic has been modified to correct the preinst /keyforparent command line instructions.

Security Checklists for Configuration Manager

Additional checklists have been added and the previous checklist has been updated.

Technical Reference for Configuration Manager 2007

Topic | Description
Computer Client Agent Properties: General Tab | Updated an incorrect value for the policy polling interval. This now reads 60 minutes.
Custom Error Codes for Configuration Manager 2007 | Several new topics provide detail about custom error codes. Where possible, troubleshooting topics provide possible solutions for common error codes.
Ports Used by Configuration Manager | Updated an incorrect port number for SMB ports. The correct SMB port is 445.

See Also

Concepts

What's New in Configuration Manager 2007


Getting Started with Configuration Manager 2007

Microsoft System Center Configuration Manager 2007 requires thorough planning before deploying sites and using Configuration Manager features. Configuration Manager 2007 has the potential to affect every computer in your organization. If deployed and managed with careful planning and consideration of your business needs, Configuration Manager 2007 can reduce your administrative overhead and total cost of ownership. If Configuration Manager 2007 is deployed without sufficient planning, it is possible to disrupt your entire network.

If you are new to Configuration Manager 2007, read the documentation carefully and experiment in a test network environment before deploying the product. You might also consider taking a class about Configuration Manager 2007 For more information about Microsoft training opportunities, see the Microsoft Training Overview at http://go.microsoft.com/fwlink/?LinkId=80347.

Next Steps

If you are new to Configuration Manager and Systems Management Server, start here:

Topic Title | Description | Audience
Fundamentals of Configuration Manager 2007 | Explains basic concepts and terminology | Anyone who is new to Configuration Manager, including business decision makers, technical decision makers, new Configuration Manager administrators and help desk technicians.
Configuration Manager Planning and Deployment Overview | A brief overview of all of the parts of the planning process. This section will help you decide which detailed planning and deployment information you need for your environment. | Anyone who has to plan a new deployment of Configuration Manager, or upgrade an existing implementation of Systems Management Server 2003.
Configuration Manager Supported Configurations | Provides the list of supported client and server platforms, as well as details about which scenarios are and are not supported. | Anyone who has to plan a new deployment of Configuration Manager, or upgrade an existing implementation of Systems Management Server 2003.
Configuration Manager 2007 Features | Provides information to help you plan, configure, operate, troubleshoot, and secure the features you have selected for your environment. All of the information you need about a feature is under the feature title, though some features rely on other features. Information about the feature dependencies and prerequisites is contained in the feature section. | Anyone who is using a particular feature or wants more information before deploying the feature.
Security and Privacy for Configuration Manager 2007 | Provides the security best practices you need to keep your Configuration Manager deployment as secure as possible. This section also includes important privacy considerations for using this product. | Anyone responsible for implementing the security for Configuration Manager and the rest of the network infrastructure. The Configuration Manager administrator should also discuss section with the person responsible for privacy in the organization.
Configuration Manager 2007 Release Notes (ConfigMgr07Readme.htm) in the root of the DVD | Details last-minute changes not reflected in the rest of this documentation. | Anyone responsible for installing or administering any aspect of Configuration Manager.

If you are familiar with Systems Management Server 2003, start here:

Topic Title | Description | Audience
What's New in Configuration Manager 2007 | Explains the changes between SMS 2003 and Configuration Manager 2007. | Anyone who already understands basic SMS terminology and concepts and needs a shortcut to learning Configuration Manager.
Configuration Manager Planning and Deployment Overview | A brief overview of all of the parts of the planning process. This section will help you decide which detailed planning and deployment information you need for your environment. | Anyone who has to plan a new deployment of Configuration Manager, or upgrade an existing implementation of Systems Management Server 2003.
Configuration Manager Supported Configurations | Provides the list of supported client and server platforms, as well as details about which scenarios are and are not supported. | Anyone who has to plan a new deployment of Configuration Manager, or upgrade an existing implementation of Systems Management Server 2003.
Configuration Manager 2007 Features | Provides all of the content about each feature. The "What's New" content will help you understand which features have not changed, so concentrate on new features you want to add to your environment. | Anyone who is using a particular feature or wants more information before deploying the feature.
Security and Privacy for Configuration Manager 2007 | Provides the security best practices you need to keep your Configuration Manager deployment as secure as possible. This section also includes important privacy considerations for using this product. | Anyone responsible for implementing the security for Configuration Manager and the rest of the network infrastructure. The Configuration Manager administrator should also discuss section with the person responsible for privacy in the organization.
Configuration Manager 2007 Release Notes (ConfigMgr07Readme.htm) in the root of the DVD | Details last-minute changes not reflected in the rest of this documentation. | Anyone responsible for installing or administering any aspect of Configuration Manager.

In This Section

Fundamentals of Configuration Manager 2007

What's New in Configuration Manager 2007

Configuration Manager Planning and Deployment Overview

Configuration Manager Supported Configurations

What Do You Want To Do?

See Also

Concepts

Configuration Manager Documentation Library


How to Use the Configuration Manager 2007 Documentation Library

Topic last updated—March 2008

This topic describes how the Configuration Manager 2007 Documentation Library is structured and provides examples for successfully navigating and searching this library.

Tips on Searching for Content

Your search strategies differ depending on whether you are searching for terms in the TechCenter library or in the local .chm file.

Searching the .chm

If you are in the .chm version of the help file, you can use the search tab to find the topics you need. If you type a series of words, the search default is AND. For example, searching for reporting service looks for reporting AND service. You can type in OR and NOT operators, such as reporting NOT service. You can also use the NEAR operator to find instances of reporting only when it is in proximity to service.

You have three options at the bottom of the search screen. By default, Match similar words is enabled, so reporting service looks for report and services. If you get a large number of hits, you might want to Search previous results using an additional search term. Search titles only is self-explanatory; however, if you leave that option selected, you might forget and find that you don't see the search results you expect in subsequent searches.

If you delimit the search string with quotation marks, only exact matches for the phrase are returned. For example, "About the Trusted Root Key" finds that exact string, regardless of casing.

To find the topics updated most recently, you can search for "Topic last updated" and then enter a month or year. To see the list of updates to the Configuration Manager Documentation Library (the Library), see What's New in the Configuration Manager Documentation Library for March 2008 and other related topics.

Searching on the Web

If you use the search bar on the actual TechNet page, your search results will contain many links to information not contained in the Configuration Manager Documentation Library. If you're looking to search only within the Configuration Manager Documentation Library itself, you can narrow the scope of the search by defining the site information to search by using the following syntax:

site:technet.microsoft.com "configuration manager"

Follow that up with the actual search terms you're looking for within the Configuration Manager Documentation Library to initiate the search. For example, if you're looking for service principal name requirements and you want to see only information returned that has to do with service principal name requirements for Configuration Manager, your complete search string would look something like the following:

site:technet.microsoft.com "configuration manager" SPN

or

site:technet.microsoft.com "configuration manager" service principal name

If you have Internet Explorer 7.0, you can create a custom search provider to focus only on the Configuration Manager Documentation Library.

To create a custom search provider in Internet Explorer 7.0

  1. Open the search engine of your choice, and search for site:technet.microsoft.com "configuration manager" TEST.

  2. Copy the resulting URL from the address bar.

  3. Go to http://go.microsoft.com/fwlink/?LinkId=110098.

  4. In the Create Your Own section, in step 3 of that Web page, paste the results that you copied in step 2 of this procedure.

  5. In step 4 of the Web page, type a name for your search provider. For example, you could call it ConfigMgr Library.

  6. Click Install.

  7. Open Internet Explorer 7.0.

  8. In the top right corner of the screen, type your search term and then click the arrow next to the magnifying glass button.

  9. From the drop-down list, select the name you entered for your search provider.

Organization of Topics

Microsoft System Center Configuration Manager 2007 has many features. Some implementations will use every feature while others might use only software updates or operating system deployment. Some administrators will inherit a fully functioning site while others must start from the beginning. The Library has been structured to try to eliminate redundancy and help you find just the information you need for the features you plan to use.

Planning and Deployment Information

If you need to plan and deploy Configuration Manager 2007, start with Configuration Manager Planning and Deployment Overview. Information for planning and deploying servers and clients is in two different sections. Start under Planning and Deploying the Server Infrastructure for Configuration Manager 2007, and then select the relevant sections for your environment.

Note
The server planning section is designed to give you a basic, functioning site, but it does not contain specific information about features because not all features are required or have the same prerequisites and planning considerations. For information about planning and deploying the features provided by Configuration Manager 2007, see the feature information under Configuration Manager 2007 Features.

Everyone planning a deployment should start with Configuration Manager Single Site Planning and Deployment, because even sites with multiple hierarchies must start with a single site. In the subtopics Configuration Manager Tasks for Planning a Single Site and Configuration Manager Tasks for Deploying a Single Site, you find task-based content for how to make crucial planning decisions and then deploy your site. Site deployment tasks are tasks you perform up to and including running Setup. Any tasks you perform in the Configuration Manager 2007 console after Setup is complete are documented in the section How to Configure Configuration Manager 2007.

If you will have more than one site joined in a hierarchy, read Configuration Manager Multiple Site Planning and Deployment. As with the single site section, this section contains planning tasks and deployment tasks for multiple sites. Tasks for configuring multiple sites, such as configuring the parent site, can be found in Configuration Manager Tasks for Configuring Multiple Sites.

If you are upgrading, read Configuration Manager Upgrade and Interoperability Planning and Deployment. This section assumes that you are familiar with Systems Management Server (SMS) 2003.

You should read the sections Deploying Configuration Manager Sites to Support Internet-Based Clients and Deploying Configuration Manager Sites in International and Multi-Language Environments only if they apply to your environments.

Important
If you must support Internet-based clients, you must plan carefully for native mode and your public key infrastructure (PKI) integration with Configuration Manager 2007. Do not skip the important planning and configuration information.

Configuring Your Site

Configuration tasks are things you can do in the Configuration Manager 2007 console after you run Setup and are typically tasks that you perform only a few times before you actually use the feature. The section How to Configure Configuration Manager 2007 contains configuration tasks that apply to a basic Configuration Manager 2007 installation. Feature-specific configuration information is in the corresponding feature section.

Features in Configuration Manager

In general, the main table of contents, as well as each new Configuration Manager feature listed under Configuration Manager 2007 Features, has been arranged to include the following topic areas:

  • Overview of <feature name> Contains a summary of the feature, including a description of what it is and why you might want to use it. Under this node, you'll find all the supporting conceptual topics related to that feature.
  • Prerequisites for <feature name> Discusses feature-specific prerequisites.
  • Planning for <feature name> Describes the choices you need to make before implementing or configuring the feature.
  • Configuring <feature name> Lists and describes tasks that must be performed to implement the feature.
  • Tasks for <feature name> Lists and describes the everyday tasks related to using the feature.
  • Troubleshooting <feature name> Includes information about the feature, such as the various log files that are created and how to use them.
  • Security and Privacy Best Practices for <feature name> Lists and describes any issues related to security and privacy so that you can quickly find them when you are configuring the feature.
  • Technical Reference for <feature name> Includes topics that are related to the feature or help to support it but are not essential to configuring or using it.
    Note
    You will not find the F1 help topics here that are related to the feature. Instead, all the F1 topics appear in the top-level topic Technical Reference for Configuration Manager 2007. Here they are grouped according to type: Property Pages, Wizard Pages, Dialog Pages, and Home Pages. Rather than navigating the table of contents to find these topics, it is easier to press F1 when you are using the Administrator console and need help on a displayed page or dialog box. Alternatively, you can also search for these topics by entering the exact name of the page as it appears in the Configuration Manager console—for example, “Site Properties: Site Mode Tab”.

See Also

Tasks

How to Configure the Default Compliance Evaluation Schedule for Desired Configuration Management
How to Enable or Disable the Desired Configuration Management Client Agent

Concepts

Administrator Checklist: Configuring a Site for Internet-Based Client Management
Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN
Choose the Configuration Item Type to Create for Desired Configuration Management
Determine If You Need to Create Configuration Items for Desired Configuration Management
Administrator Checklist: Enabling Wake On LAN
Technical Reference for Configuration Manager 2007

Other Resources

Security and Privacy for Configuration Manager 2007


Fundamentals of Configuration Manager 2007

Microsoft System Center Configuration Manager 2007 (ConfigMgr) provides a comprehensive solution for change and configuration management for the Microsoft platform, enabling organizations to provide relevant software and updates to users quickly and cost-effectively.

Configuration Manager 2007 provides the following features:

  • Collecting hardware and software inventory.
  • Distributing and installing software applications.
  • Distributing and installing updates to software, for example security fixes.
  • Works with Windows Server 2008 operating system Network Policy Server to restrict computers from accessing the network if they do not meet specified requirements, for example having certain security updates installed.
  • Deploying operating systems.
  • Specifying what a desired configuration would be for one or more computers and then monitoring adherence to that configuration.
  • Metering software usage.
  • Remotely controlling computers to provide troubleshooting support.

All of these features require some Configuration Manager 2007 client software to be installed on the Windows-based computers you want to manage. Configuration Manager 2007 client software can be installed on regular desktop computers, servers, portable computers like laptops, mobile devices running Windows Mobile or Windows CE, and devices running Windows XP Embedded like automated teller machines. Microsoft partners can write additional client software to manage computers running non-Windows operating systems.

Configuration Manager 2007 sites provide a way to group clients into manageable units with similar requirements for feature sets, bandwidth, connectivity, language, and security. Configuration Manager 2007 sites can match your Active Directory sites or be totally independent of them. Clients can move between sites or even be managed from remote locations like home offices.

Before deploying or administering Configuration Manager 2007, you should take some time to familiarize yourself with the basic concepts that apply to all Configuration Manager 2007 features.

In This Section

Introducing System Center Configuration Manager 2007

Understanding Configuration Manager Sites

Understanding Configuration Manager Clients

Understanding Configuration Manager Features

Understanding Configuration Manager Security

Understanding Configuration Manager Operations

Example Scenarios for Configuration Manager 2007

Customizing Configuration Manager

See Also

Concepts

Getting Started with Configuration Manager 2007


Introducing System Center Configuration Manager 2007

Microsoft System Center Configuration Manager 2007 (formerly known as Microsoft System Management Server) drives IT productivity and efficiency by reducing manual tasks and enabling you to focus on high-value projects, maximize hardware and software investments, and empower end-user productivity with the right software at the right time. Configuration Manager 2007 contributes to a more effective IT department by enabling secure and scalable operating system and application deployment and desired configuration management, enhancing system security, and providing comprehensive asset management of servers, desktops, and mobile devices.

The System Center Suite of Products

Microsoft System Center includes technologies that help automate the most common management tasks, and it also provides tools to help IT professionals detect, diagnose, and correct problems in their computing environment. With support for managing both Windows-based systems and others, System Center targets a variety of problems and a range of organizations.

The System Center Family

The products included under the System Center umbrella address the challenges of managing information technology in organizations of different sizes. In addition to Configuration Manager 2007, the System Center products include:

  • System Center Operations Manager 2007 Allows IT staff to monitor and manage the hardware and software in a modern distributed environment.
  • System Center code name “Service Desk” When released, “Service Desk” is expected to provide implementations of fundamental IT Service Management processes, including incident management, problem management, and change management.
  • System Center Data Protection Manager 2006 Provides data backup and restore for Windows file servers.
  • System Center Essentials 2007 Provides tools for less-specialized IT staff in smaller organizations to manage their environments more effectively with the three most important management functions: monitoring distributed systems, automating software updates and installing applications.
  • System Center Virtual Machine Manager Helps management staff with the process of consolidating applications onto virtualized servers.
  • System Center Capacity Planner 2006 Capacity Planner is a tool for determining what hardware resources will be required to run an application, such as Exchange Server 2003, to meet specific performance and availability goals.

For more information about Microsoft System Center, see http://go.microsoft.com/fwlink/?LinkId=93169.

Configuration Manager Scenarios

The following section describes some typical scenarios for companies using Configuration Manager 2007.

Kim is the desktop administrator at Fabrikam, Inc. His top priority is to make sure that all clients have software updates that have been determined to be critical by the security administrator. When new software updates are released, the security administrator gives Kim a list of updates to deploy and when they should be deployed by. Kim creates packages containing the required updates and uses the WSUS server integration with Configuration Manager 2007 to scan all clients in the organization and apply the updates only to clients that need them. If clients do not choose to install the updates prior to the deadline set by the security admin, Kim can force the client computers to install the updates and restart the computer, if required.

Kim's manager likes to get regular reports of the hardware and software for asset tracking. Kim has configured Configuration Manager 2007 to inventory all clients, including mobile device clients like cell phones, once a week. He is gathering information about how many Vista-capable computers are in the organization and how many computers will require upgrades prior to upgrading the operating system. Kim's manager decides that they should do a small pilot of Vista deployment using Configuration Manager 2007. Kim uses the operating system deployment feature to create a task sequence to copy a client computer's current user and computer settings up to a server, then install the new operating system, and then restore the user and computer settings to a new computer that is capable of running Vista. Kim can send the task sequence only to computers he identified using hardware inventory.

The accounting department has just purchased a new line-of-business application and wants it installed on all accounting computers as soon as possible. Kim uses the software distribution feature of Configuration Manager 2007 to send the new software only to computers in the accounting department based on their membership in an Active Directory security group. When one of the accountants has problems accessing a departmental server after the new software is deployed, Kim uses Configuration Manager 2007 to remotely administer the computer and fix a setting that had been inadvertently changed by the user. Kim gets a few more help desk calls from users who made similar configuration mistakes and he realizes he can use the desired configuration management feature in Configuration Manager 2007 to locate all client computers with the incorrect setting. Kim creates a script to fix the setting issue and configures Configuration Manager 2007 so that when computers are identified as having the incorrect configuration, they will automatically run the script to fix the configuration problem.


Understanding Configuration Manager Sites

A System Center Configuration Manager 2007 site defines the scope of administrative control. A site consists of a site server, site system roles, clients, and resources. A site always requires access to a Microsoft SQL Server database. There are several types of Configuration Manager 2007 sites. A Configuration Manager 2007 site uses boundaries to determine the clients belonging to the site. Multiple sites can be configured into site hierarchies and connected in such a way that you can manage bandwidth utilization between sites. A Configuration Manager 2007 site is identified by the three-character code and the friendly site name configured during Setup.

Types of Sites

When you install a site, you decide whether it will be a primary site or a secondary site. Then, as you install additional sites, you have the option to arrange them in hierarchical relationships so that there are parent sites that manage child sites, and a central site to collect all the site information for centralized management. Or, if you prefer, you can leave the sites without any connections and manage them separately, according to your business and administrative needs. For example, if your organization consists of independent business units, each unit might resist having centralized management.

Primary Sites

The first Configuration Manager 2007 site you install must be a primary site. A primary site stores Configuration Manager 2007 data for itself and all the sites beneath it in a SQL Server database. This is called the Configuration Manager 2007 site database. Primary sites have an administrative tool called the Configuration Manager 2007 console that enables the Configuration Manager 2007 administrator to directly manage the site.

Secondary Sites

A secondary site has no Configuration Manager 2007 site database. It is attached to and reports to a primary site. The secondary site is managed by a Configuration Manager 2007 administrator running a Configuration Manager 2007 console that is connected to the primary site.

The secondary site forwards the information it gathers from Configuration Manager 2007 clients, such as computer inventory data and Configuration Manager 2007 system status information, to its parent site. The primary site then stores the data of both the primary and secondary sites in the Configuration Manager 2007 site database.

The advantages of using secondary sites are that they do not require any additional Configuration Manager 2007 server license and do not incur the overhead of maintaining an additional database. Secondary sites are managed from the primary site they are connected to, so they are frequently used in sites with no local administrator present. The disadvantage of secondary sites is that they must be attached to a primary site and cannot be moved to a different primary site without deleting and re-creating the site. Also, secondary sites cannot have sites beneath them in the hierarchy.

Parent Sites

A parent site is a primary site that has one or more sites attached to it in the hierarchy. Only a primary site can have child sites. A secondary site is always a child site. A parent site contains pertinent information about its lower level sites, such as computer inventory data and Configuration Manager 2007 system status information, and it can control many operations at the child sites.

Child Sites

A child site is a site that is attached to a site above it in the hierarchy. The site it reports to is its parent site. A child site can have only one parent site. Configuration Manager 2007 copies all the data that is collected at a child site to its parent site. A child site is either a primary site or a secondary site.

Central Site

A central site has no parent site. Typically, a central site has child and grandchild sites and aggregates all of their client information to provide centralized management and reporting. A site with no parent and no child site is still called a central site although it is also referred to as a stand-alone site.

Site Systems

Each site contains one site server and one or more site systems. The site server is the computer on which you install Configuration Manager 2007, and it hosts services required for Configuration Manager 2007. A site system is any computer running a supported version of Microsoft Windows or a shared folder that hosts one or more site system roles. A site system role is a function required to be able to use Configuration Manager 2007 or to use a feature of Configuration Manager 2007. Multiple site roles can be combined on a single site system, including running all site roles on the site server, but this is usually appropriate only for very small and simple environments.

The following table provides a brief description of each site system role.

Site System Role | Description | Required?
Site server | The role assigned to the server on which Configuration Manager 2007 Setup has been run successfully. | Yes. Every site must have exactly one site server role.
Site database server | The role assigned to the computer running Microsoft SQL Server and hosting the Configuration Manager 2007 site database. You can use only Microsoft SQL Server 2005, Standard or Enterprise Edition, to host the site database. SQL Server 2005 Express is not a supported SQL Server 2005 version for hosting the site database. | Every primary site requires a site database server role, but secondary sites do not require them.
Configuration Manager console | Any computer running the Configuration Manager console. | No. The Configuration Manager console is automatically installed by default on primary site servers during Setup. You can install additional Configuration Manager consoles on remote computers—for example, the workstation of the Configuration Manager administrator. However, some organizations write their own user interface using the Configuration Manager software developer kit (SDK) and never use the Configuration Manager console.
SMS Provider computer | The Configuration Manager console does not access the database directly, but instead uses Windows Management Instrumentation (WMI) as an intermediary layer. The SMS Provider is the WMI Provider for Configuration Manager. | Yes, for primary sites. When you install a primary site, you select which computer will host the SMS Provider—usually, it's the site server or the site database server.
Component server | Any computer hosting a Configuration Manager 2007 site role that requires installing special Configuration Manager 2007 services. | The only site system role that does not require the installation of a special Configuration Manager 2007 service is the distribution point.
Distribution point | A site system role that stores packages for clients to install. | Required for the following features: software distribution, software updates, and advertised task sequences used in operating system deployment.
Fallback status point | A site system role that gathers state messages from clients that cannot install properly, cannot assign to a Configuration Manager 2007 site, or cannot communicate securely with their assigned management point. | Not required, but very helpful to troubleshoot issues with clients.
Management point | The site system role that serves as the primary point of contact between Configuration Manager 2007 clients and the Configuration Manager 2007 site server. | Every site with intranet clients must have one default management point, though the default management point might be a cluster of several site systems configured as management points.
PXE service point | A site system role that has been configured to respond to and initiate operating system deployments from computers whose network interface card is configured to allow PXE boot requests. | Required only for operating system deployment using PXE boot requests.
Reporting point | A site system role hosts the Report Viewer component for Web-based reporting functionality. | Required only to use the reporting feature. Reports are often helpful when diagnosing client issues.
Server locator point | A site system role that locates management points for Configuration Manager 2007 clients. | Required for some client deployment scenarios.
Software update point | A site system role assigned to a computer running Microsoft Windows Server Update Services (WSUS). | Required only for the software update feature.
State migration point | A site system role that stores user state data while a computer is being migrated to a new operating system. | Required for operating system deployment when migrating user state.
System Health Validator point | The site system role assigned to a computer running Network Policy Service. | Required only for the Configuration Manager 2007 Network Access Protection feature.

Additional Site Systems for Configuration Manager 2007 SP1

If you have upgraded to Configuration Manager 2007 SP1, you might require additional site systems, described in the following table, to support additional features added in the service pack.

Site System Role | Description | Required?
Asset Intelligence synchronization point | A site role that is used to connect to System Center Online to manage Asset Intelligence catalog information updates. | Required only to synchronize the local Asset Intelligence catalog with System Center Online by Microsoft SA license customers.
Out of band service point | A site system role that discovers, provisions, and manages desktop computers that have management controllers (such as AMT-based computers). | Required only for the out of band management feature.

Additional Site Systems for Configuration Manager 2007 R2

If you have upgraded to Configuration Manager 2007 R2, you might require additional site systems, described in the following table, to support additional features added in the R2 release.

Site System Role | Description | Required?
Reporting Services point | A site system role assigned to a computer running SQL Reporting Services. | Required only if you want to use SQL Reporting Services to report Configuration Manager 2007 R2 data. Integrating Configuration Manager 2007 R2 reports with SQL Reporting Services provides a richer reporting experience. However, the reporting point still works and does not require SQL Reporting Services or a Reporting Services point.
Client status reporting host system | Although the client status reporting host system site system role is not actually a site system configured in the Configuration Manager console, it is a role that can be added to a client or server computer to report back to the site server about the client computers it monitors. | Required only if using the client status reporting feature.

Site Communications

Clients communicate with site systems hosting site system roles. Site systems communicate with the site server and with the site database. If there are multiple sites connected in a hierarchy, the sites communicate with their parent, child or, sometimes, grandchild sites.

Sites are typically configured so that the clients and site systems have fast connectivity with each other, usually local area network (LAN) speed. However, Configuration Manager 2007 also supports clients that move between sites, mobile devices that connect over the cellular network, clients that connect to the organization's network through dial-up or virtual private networks (VPNs), and clients that connect to the Internet but don't connect directly into the organization's network.

Site Boundaries

Configuration Manager 2007 uses boundaries to determine when clients and site systems are in the site and outside of the site. Boundaries can be IP subnets, IP address ranges, IPv6 prefixes, and Active Directory sites. Two sites should never share the same boundaries. Assigning the same IP subnet, IP address range, IPv6 prefix, or Active Directory site to two different sites makes it difficult to determine which clients should be managed in the site.

The Configuration Manager 2007 administrator configures each boundary in the site to be either a fast or slow boundary, depending on the connection speed. If a client computer is connected to a fast boundary, such as a 10-MBPS LAN, it might install software; however, if the client computer is connected to a slow boundary, such as a dial-up network or a wireless network, it might install the software differently or not install the software at all. If the client computer connects to a boundary in a different site, Configuration Manager 2007 might be able to determine a closer source for installing the software.

Site-to-Site Communications

When you have separate sites, Configuration Manager 2007 uses senders to connect the two sites. Senders have sender addresses that help them locate the other site. When sending data between sites, senders provide fault tolerance and bandwidth management. For example, if the link between two sites goes down, the sender will attempt to re-establish the connection and resume sending where it was interrupted. If you want the sender to use only a certain percentage of the available bandwidth, you can configure the sender address to restrict how much bandwidth Configuration Manager 2007 uses at certain times of day. You can also configure the sender address to be available for only high-priority Configuration Manager 2007 communication at certain times of day, or to be completely unavailable during specified times.

Although there are several business, political, and security reasons that might cause you to have more than one site, you should typically install multiple sites when you need to cross a slow link because the senders let you manage how you use the slow link.

Intra-site Communications

When Configuration Manager 2007 components that are within the site boundaries communicate with each other, they use either server message block (SMB), HTTP, or HTTPS, depending on various site configuration choices you make. Because all of these communications are unmanaged—that is, they happen at any time with no consideration for bandwidth consumption—it is beneficial to make sure these site elements have fast communication channels.

See Also

Other Resources

Fundamentals of Configuration Manager 2007


Understanding Configuration Manager Clients

Microsoft System Center Configuration Manager 2007 supports many Windows-based platforms as clients. You must install Configuration Manager 2007 client software on the clients you want to manage.

Note
Configuration Manager 2007 supports only Windows-based platforms. Support for non-Windows platforms like Macintosh and Unix platforms might be provided by other software vendors as add-on products to Configuration Manager.

Types of Clients

You can install Configuration Manager 2007 client software on desktop and laptop computers, which are typically thought of as "client computers". In addition, you can install Configuration Manager 2007 client software on server computers and manage them as clients of Configuration Manager 2007. While servers often have specific operational requirements, for example the times you are allowed to reboot server computers might be more limited than desktop computers, Configuration Manager 2007 makes no functional distinction between server or client computers. Throughout the documentation, the term client computer can mean either a server in a server room or a computer on a user's desktop.

Client computers typically connect into the organization network directly, either by being attached directly to the network or by using VPN or dial-up access. In Configuration Manager 2007, client computers can also be managed by Configuration Manager 2007 sites if they have a connection to the Internet but never connect directly to the organization network. For example, a home-based worker could be managed by Configuration Manager 2007 without ever dialing into the corporate network. These clients are called Internet-based clients, and they require additional infrastructure support. For more information, see Deploying Configuration Manager Sites to Support Internet-Based Clients.

Configuration Manager 2007 also supports installing the client components on mobile devices, such as devices running Windows Mobile or Windows CE. Mobile device clients support many but not all of the features supported by standard clients. For example, you can deploy software to a client cell phone, but you cannot use remote control to provide troubleshooting assistance to the cell phone user. For more information, see Mobile Device Management in Configuration Manager.

Microsoft supports running an embedded version of Windows on devices that are not traditional desktop, laptop, or server computers. For example, Windows XP Embedded can be installed on automated teller machines or medical devices. Configuration Manager 2007 components can be installed by the manufacturer on these devices along with the embedded operating system. Devices support many but not all of the features supported by standard clients.

Throughout the documentation, the term client is used to refer to all clients that run the Configuration Manager 2007 client components, while client computer is used to refer servers, desktops, and laptops.

Discovering Clients

Configuration Manager 2007 has the ability to discover resources on the network using several different discovery mechanisms. The following table describes the available discovery methods.

Discovery Method Description

Active Directory System Discovery

Retrieves details about the computer, such as computer name, Active Directory container name, IP address, and Active Directory site.

Active Directory System Group Discovery

Cannot discover a computer that has not already been discovered by another method. If a resource has been discovered and is assigned to the site, Active Directory System Group Discovery extends other discovery methods by retrieving details such as organizational unit, global groups, universal groups, and nested groups.

Active Directory User Discovery

Retrieves information about user accounts created in Active Directory.

Active Directory Security Group Discovery

Retrieves security groups created in Active Directory.

Heartbeat Discovery

Refresh Configuration Manager client computer discovery data in the site database. Unlike the other methods, this method works only on computers that already have the Configuration Manager 2007 installed.

Network Discovery

Searches the network for resources that meet a specific profile. Network discovery can discover resources that are

  • Listed in a router's ARP cache for a specified network subnet
  • Running An SNMP agent and configured for a specified community
  • Configured as Microsoft DHCP clients

Each discovery method creates data discovery records (DDRs) for resources and sends them to the site database, even if the discovered resource is not capable of being a Configuration Manager 2007 client. For example, Network Discovery might discover routers and printers, which could be helpful for tracking purposes, but those devices will not actually be managed by Configuration Manager 2007. Mobile devices cannot be discovered until the mobile device client is installed. Computers running ActiveSync (for Windows XP clients) or Mobile Device Center (for Vista clients) to synchronize with mobile devices can be discovered and targeted to install the mobile device client on connected mobile devices.

Note
All resources for which DDRs have been created show up in the Configuration Manager 2007 console under the following part of the tree: Configuration Manager / Site Database / Computer Management / Collections / All Systems.

While it is possible to discover resources but never install a single client, usually discovery is related to locating potential clients either prior to or as part of installing the client software that makes a computer manageable by Configuration Manager 2007. Active Directory User Discovery and Active Directory Security Group Discovery allow you to target software distribution packages to users and groups instead of computers.

Installing the Client Components

Configuration Manager 2007 provides several options for installing the client software. The following table lists the client computer installation methods.

Client Computer Installation Method | Description
Software update point installation | Uses the Automatic Update configuration of a client to direct the client computer to a WSUS computer configured as a Configuration Manager 2007 software update point. The client computer installs the Configuration Manager 2007 client software as though it was a software update.
Client push installation | Uses an account with administrative rights to access the client computers and install the Configuration Manager 2007 client software. This method requires File and Print sharing and the related ports to be enabled on the client computer.
Manual client installation | A user with administrative rights can install the client software by running CCMSetup on the client computer. A variety of switches modify the installation options.
Group Policy installation | Uses Group Policy software installation to install CCMSetup.msi.
Imaging | The client software can be added to an image, including images created and deployed with Configuration Manager 2007 operating system deployment.
Software Distribution | Existing clients can be upgraded or redeployed using Configuration Manager 2007 software distribution.

Mobile devices use different installation methods. A client computer that synchronizes with a mobile device can be targeted to install the mobile device client the next time the device is docked. Mobile devices can also install the client software from a memory card.

Client Assignment

Clients must be assigned to a site before they can be managed by that site. Clients can be assigned to a site during installation or after installation. Assigning a client involves either telling it a specific site code to use, or configuring the client to automatically assign to a site based on boundaries. If the client is not assigned to any site during the client installation phase, the client installation phase completes, but the client cannot be managed by Configuration Manager 2007.

Clients cannot be assigned to secondary sites; they are always assigned to the parent primary site, but can reside in the boundaries of the secondary site, taking advantage of any proxy management points and distribution points at the secondary site. This is because clients communicate with management points and management points must communicate with a site database. Secondary sites do not have their own site database; they use the site database at their parent primary site.

Authenticating Clients

Before Configuration Manager 2007 trusts a client, it requires some manner of authentication. In mixed mode, clients must be approved, either by manually approving each client or by automatically approving all clients or all clients in a trusted Windows domain. In native mode, clients must be issued client authentication certificates prior to installing the Configuration Manager 2007 client software.

Blocking Clients

If a client computer is no longer trusted, the Configuration Manager administrator can block the client in the Configuration Manager 2007 console. Blocking applies to both native mode and mixed mode sites. Blocked clients are ignored by the Configuration Manager 2007 infrastructure. This is especially useful for laptop computers that are lost or stolen, to help prevent attackers from using a trusted client to attack the site or the network.

Client Agents

Client agents are Configuration Manager 2007 components that run on top of the base client components. If you install only the Configuration Manager Client without enabling any client agents, Configuration Manager 2007 cannot manage anything about the client. Every client agent that you enable lets you use a different feature of Configuration Manager 2007. You can configure the client agents to suit your environment. The following table describes the client agents in Configuration Manager 2007.

Client Agent | Description
Computer Client Agent Properties | Configures how often client computers retrieve the policy that gives them the rest of their configuration settings. For example, after you configure the other client agent settings, Configuration Manager puts those settings into policy and sends them to the management point and client computers poll for them on the schedule you configure. This agent also controls settings that are common to several Configuration Manager features like how often users are prompted with reminders and what customized organization names users see with the reminders.
Device Client Agent Properties | Configures all of the properties specific to mobile device clients. Mobile device clients have settings for software distribution, software inventory, hardware inventory, and file collection. This agent also controls the polling interval used by mobile device clients.
Hardware Inventory Client Agent | Enables and configures the agent that collects a wide variety of information about the client computer. Information about the computer hardware is most commonly collected, but you can inventory any information stored in the Windows Management Instrumentation (WMI) repository of the computer, such as registry keys. You can configure how often the client computer takes inventory.
Software Inventory Client Agent | Enables and configures which files Configuration Manager inventories and collects. Copies of collected files are stored in the Configuration Manager database.
Advertised Programs Client Agent | Enables and configures the software distribution feature.
Desired Configuration Management Client Agent | Enables the client agent that evaluates whether computers are in compliance with configuration baselines that are assigned to them. You can also configure the default compliance evaluation schedule for assigned configuration baselines.
Remote Tools Client Agent | Enables Configuration Manager remote control and configures Configuration Manager integration with Remote Assistance.
Network Access Protection Client Agent | Enables Configuration Manager Network Access Protection and configures how client computers are evaluated for compliance by the Windows Network Policy Server. If client computers are not in compliance with the configured policies, for example if they do not have specified software updates, NAP can prevent the client computers from access network resources until they complete remediation measures. Configuring this client agent without proper planning and deployment can prevent your client computers from accessing the network.
Software Metering Client Agent | Enables the agent that monitors which software is run and how often and configures how often software metering data is collected.
Software Updates Client Agent | Enables the agent that scans for and installs software updates on client computers. This agent allows you to configure how often clients are re-evaluated for software updates that were previously installed. Before you can use the software update feature, you must also install Windows Server Update Services (WSUS) and configure a software update point.

There is no client agent for operating system deployment.

See Also

Other Resources

Fundamentals of Configuration Manager 2007


Understanding Configuration Manager Features

Topic last updated—March 2008

If you install a Microsoft System Center Configuration Manager 2007 site but do not configure any of the features, the site is essentially useless. Features provide the actual functionality of Configuration Manager 2007. You can install just one feature or several features. Some features have dependencies on other features, for example Network Access Protection requires the software updates feature be operational first.

The following features are provided in Configuration Manager 2007:

  • The administrator console
  • Collections
  • Inventory
  • Queries
  • Reporting
  • Software distribution
  • Software updates
  • Software metering
  • Mobile Device management
  • Operating system deployment
  • Desired configuration management
  • Remote tools
  • Network Access Protection
  • Wake On LAN
  • Out of band management
  • Client Status Reporting
  • SQL Reporting Services

The Administrator Console

The Configuration Manager 2007 console is the most common way that Configuration Manager administrators use Configuration Manager 2007, although some organizations use the Software Development Kit (SDK) to build custom user interfaces and many administrators use scripting to manage repetitive tasks more efficiently.

You can run the console from the site server or install additional consoles on your desktop or help desk computers to facilitate management. One console can manage many sites or many consoles can manage a single site. The Configuration Manager 2007 console runs as a Microsoft Management Console (MMC) snap-in, although you must run Configuration Manager 2007 Setup on the computer so that the snap-in is available.

Using the Configuration Manager Console

Collections

Collections represent groups of resources and can consist not only of computers, but also of Microsoft Windows users and user groups as well as other discovered resources. Collections provide you with the means to organize resources into easily manageable units, enabling you to create an organized structure that logically represents the kinds of tasks that you want to perform. Collections also serve as targets for performing Configuration Manager operations on multiple resources at one time (such as software distribution or software updates). Collection membership can be either direct or query based. Query based collections are very powerful because they can group any resources together based on criteria. For example, if you want to deploy Microsoft Office 2007 only to computers with 1 GB of free disk space and 1 GB of RAM, you can create a collection that uses a query against the Configuration Manager 2007 inventory information in the database.

Inventory

You can configure Configuration Manager 2007 to inventory hardware and software on Configuration Manager 2007 clients. Hardware inventory gives you system information (such as available disk space, processor type, and operating system) about each computer. You can configure the information returned in hardware inventory by modifying the SMS_def.mof file. Software inventory agent gives you information such as inventoried file types and versions present on client computers. Software inventory alone just returns lists of file types, but combining software inventory with the information in the Asset Intelligence catalog allows you to create reports on which applications are used in your environment. Software inventory can also collect copies of files in the database, but this is recommended only for small files that do not change very often.

Queries

The query feature in Configuration Manager 2007 uses WBEM query language (WQL) to query the site database. Query results are returned in the Configuration Manager 2007 console, where they can be exported using the MMC export list feature. Queries can also be used to create collections of resources that meet the query criteria.

Reporting

Reporting is a supporting feature to many other Configuration Manager 2007 features. Reports are returned in Web pages in the browser. Programming is not required, but knowledge about creating SQL queries is extremely helpful. With reporting you can create reports that show the inventory you have collected or the software updates successfully deployed. You can also create dashboards, which combine several different views of information. Several pre-created reports are available to support common reporting scenarios. For more information about the reports provided for each feature, see the feature documentation.

Software distribution

Software distribution allows you to push just about anything to a client computer. Packages in software distribution can contain source files to deploy software applications and commands called programs that tell the client what executable file to run. A single package can contain multiple programs, each configured to run differently. Packages can also contain command lines to run files already present on the client, without actually containing additional source files.

Important
Configuration Manager 2007 can cause any executable file to run on the client, however it is important to understand that Configuration Manager 2007 does not actually package the executables or source files. Configuration Manager 2007 is like the delivery man; it gets the software or the command to the client, but the command must be able to run on the client independently of Configuration Manager 2007. If the software or command cannot run without Configuration Manager 2007 software distribution, it will never run with software distribution.

Configuration Manager 2007 uses advertisements to specify which collections receive the program and the package.

Software updates

The software updates feature provides a set of tools and resources that can help manage the complex task of tracking and applying software updates to client computers in the enterprise. Software updates in Configuration Manager 2007 requires a Windows Server Update Services (WSUS) server to be installed and uses that to scan the client computers for applicable software updates. The administrator views which updates are needed in the environment and creates packages and deployments containing the source files for the software updates. Clients then install the software updates from distribution points and report their status back to the site database.

Software metering

Software metering enables you to collect and report software program usage data. The data provided by these reports can be used by many groups within the organization such as IT and corporate purchasing.

Software metering in Configuration Manager 2007 supports the following scenarios:

  • Identify which software applications are being used, and who is using them.
  • Identify the number of concurrent usages of a specified software application.
  • Identify actual software license requirements.
  • Identify redundant software application installations.
  • Identify unused software applications which could be relocated.

Mobile Device management

Mobile devices are supported as Configuration Manager 2007 clients. For documentation purposes, mobile clients are treated as a separate feature. Mobile clients can run a subset of Configuration Manager 2007 features such as inventory and software distribution, but cannot be managed by remote control and cannot receive operating system deployments like desktop clients.

Operating system deployment

Operating system deployment enables you to install new operating systems and software onto a computer. You can use operating system deployment to install operating system images to new or existing computers as well as to computers with no connection your Configuration Manager 2007 site. By using task sequences and the driver catalog operating system deployment streamlines new computer installations by allowing you to install software using one dynamic image that can be installed on different types of computers and configurations.

Operating system deployment provides the following solutions for deploying operating system images to computers:

  • Provide a secure operating system deployment environment.
  • Assist with managing the cost of deploying images by allowing one image to work with different computer hardware configurations.
  • Assist with unifying deployment strategies to help provide a solid deployment foundation for future operating system deployment methods.

Desired configuration management

Desired configuration management enables you to define configuration standards and policies, and audit compliance throughout the enterprise against those defined configurations. Best practices configurations can be used from Microsoft and vendors in the form of Microsoft® System Center Configuration Manager 2007 Configuration Packs. These Configuration Packs can then be refined to meet customized business requirements. Additionally, desired configuration management supports an authoring environment for customized configurations.

This feature is designed to provide data for use by many groups within the organization, including IT and corporate security. Desired configuration management supports the following scenarios:

  • Detect production server configuration drift and confirm provisioned servers meet expected build requirements.
  • Provide the help desk with probable cause information, reducing the time-to-resolve (TTR) of incidents and provide probable cause analysis for problems
  • Report compliance with regulatory policies, and in-house security policies
  • Provide change verification and tracking
Note
If you are familiar with the Business Solution Add-on, Desired Configuration Monitoring with Systems Management 2003 Service Pack 1, see the following reference for a comparison between the two features: Comparison of SMS 2003 Desired Configuration Monitoring and Configuration Manager 2007 Desired Configuration Management.

Remote tools

Remote tools in Configuration Manager 2007 includes the remote control feature which allows an operator with sufficient access rights the ability to remotely administer client computers in the Configuration Manager 2007 site hierarchy.

You can use remote control to troubleshoot problems on client computers and to provide remote help desk support where access to the user's computer is necessary.

Network Access Protection

Network Access Protection (NAP) is a policy enforcement platform built into the Windows Vista and Windows Server 2008 operating systems that helps you to better protect network assets by enforcing compliance with system health requirements. You can configure DHCP Enforcement, VPN Enforcement, 802.1X Enforcement, IPSec Enforcement, or all four, depending on your network needs.

Note
For an overview of how Network Access Protection works in Windows, see the Webcast "Introduction to Network Access Protection" (http://go.microsoft.com/fwlink/?LinkId=68775).

Network Access Protection in Configuration Manager 2007 works with Windows Network Policy Server (NPS) on Windows Server 2008, to enforce software update compliance through client remediation. Network policies allow you to limit network access for clients until they have the software updates that you designate as required.

Important
Network Access Protection is not designed to secure a network from malicious users. It is designed to help administrators maintain the health of the computers on the network, which in turns helps maintain the network’s overall integrity. Network Access Protection does not prevent an authorized user with a compliant computer from uploading a malicious program to the network or engaging in other inappropriate behavior.

Wake On LAN

The Wake On LAN feature helps to achieve a higher success rate for scheduled Configuration Manager 2007 activities, reducing associated network traffic during business hours, and helps organizations to conserve power by not requiring computers to be left on for maintenance outside business hours.

Wake On LAN in Configuration Manager 2007 supports the following scenarios:

  • Sending a wake-up transmission prior to the configured deadline for a software update deployment.
  • Sending a wake-up transmission prior to the configured schedule of a mandatory advertisement, which can be for software distribution or a task sequence.

Out of band management

Applies only to Configuration Manager 2007 SP1.

The out of band management feature in Configuration Manager 2007 SP1 provides powerful management control for computers that have the Intel vPro chip set and Intel Active Management Technology (Intel AMT) firmware versions 3.2.1 or later.

Out of band management requires a Microsoft public key infrastructure (PKI) and supports the following scenarios:

  • Powering on one or many computers (for example, for maintenance on computers outside business hours).
  • Powering off one or many computers (for example, the operating system stops responding).
  • Restarting a nonfunctioning computer or booting from a locally connected device or known good boot image file.
  • Re-imaging a computer by booting from a boot image file that is located on the network or by using a PXE server.
  • Reconfiguring the BIOS settings on a selected computer (and bypassing the BIOS password if this is supported by the BIOS manufacturer).
  • Booting to a command-based operating system to run commands, repair utilities, or diagnostic applications (for example, upgrading the firmware or running a disk repair utility).
  • Configuring scheduled software update deployments and advertisements to wake up computers prior to running.

Client Status Reporting

Client status reporting in Configuration Manager 2007 R2 provides up-to-date information on the status of clients in a Configuration Manager 2007 hierarchy. Client status reporting is useful in situations where standard methods of client troubleshooting cannot be used.

SQL Reporting Services

SQL Reporting Services in Configuration Manager 2007 R2 provides a set of tools and resources that help you use the advanced reporting capabilities of SQL Reporting Services from the Configuration Manager console.

See Also

Concepts

What's New in Configuration Manager 2007 R2
What's New in Configuration Manager 2007 SP1

Other Resources

Fundamentals of Configuration Manager 2007


Understanding Configuration Manager Security

Security for Microsoft System Center Configuration Manager 2007 consists of several layers. First, the Windows provides security features for both the operating system and the network. For example, Windows provides the following:

  • File sharing to transfer files between Configuration Manager 2007 components
  • Access Control Lists (ACLs) to secure files and registry keys
  • IPsec for securing communications
  • Group Policy for setting security policy
  • DCOM permissions for distributed applications like the Configuration Manager 2007 console
  • Active Directory Domain Services to store security principals
  • Windows account security, including some groups that are created during Configuration Manager 2007 installation

Additional security components such as firewalls and intrusion detection help provide defense in depth for the entire environment. Certificates issued by industry standard PKI implementations help provide authentication of Configuration Manager 2007 components and signing for applications distributed to mobile device clients.

Configuration Manager 2007 controls access to the Configuration Manager 2007 console in several ways. By default, only Administrators have rights to the files and registry keys needed to run the Configuration Manager 2007 console on computers where it is in installed.

The next layer of security is access through Windows Management Instrumentation (WMI), specifically the SMS Provider. The SMS Provider is restricted by default to members of the local SMS Admins group. This group initially contains only the user who installed Configuration Manager 2007. To grant other accounts permission to the Common Information Model (CIM) repository and the SMS Provider, add the other accounts to the SMS Admins group.

The final layer of security is permissions to objects in the site database. By default, the Local System account and the user account that you used to install Configuration Manager 2007 have access to administer all objects in the site database. You can grant permissions to additional users in the Configuration Manager 2007 console.

Security Modes

There are two security modes in Configuration Manager 2007.

Native mode is the recommended site configuration for new Configuration Manager 2007 sites because it offers a higher level of security by integrating with a public key infrastructure (PKI) to help protect client-to-server communication. PKIs can help companies meet their security and business requirements, but they must be carefully designed and implemented to meet the current and future needs. Installing a PKI solely to support Configuration Manager 2007 operations could fulfill certain short term goals but could hamper a more extensive PKI rollout to support other applications at a later time. If your organization already has a well-designed, industry-standard PKI, Configuration Manager 2007 should be able to use certificates from the existing PKI.

Important
Native mode requires extensive planning and lab testing prior to implementation. If the PKI infrastructure is not implemented properly to support Configuration Manager 2007, the whole site could stop functioning. Do not implement native mode in a production environment without thoroughly understanding the requirements.

While native mode is the most secure mode available in Configuration Manager 2007, mixed mode can be considered adequate security for many organizations and requires less administrative overhead. Mixed mode is the default when upgrading from an existing Systems Management Server (SMS) 2003 site and provides backwards compatibility for hierarchies that have both SMS 2003 sites and Configuration Manager 2007 sites. It is possible to install with mixed mode and then migrate to native mode later. It is also possible to revert to mixed mode from native mode. Both migrating and reverting require thorough planning prior to implementation.

Native mode sites cannot report to mixed mode sites. When migrating from mixed mode to native mode, always convert the central site first and then work down.

Internet-based Clients

Computers that connect to the organization's network using VPN or dial-up technology can be managed as regular Configuration Manager 2007 clients. Computers that connect to the Internet but never connect to the organization network can be configured as Internet-based clients. Internet-based clients can belong only to native mode sites. Managing Internet-based clients requires carefully planning where site systems will be located. For example, you could put management points and distribution points in your perimeter network, or you could allow Internet-based clients to traverse your firewall to access site systems inside your organization's network, or you could create a separate site in the perimeter network just to support Internet-based clients.

Privacy

While network management products let you effectively manage large numbers of clients, you must also be aware of ways that this software affects the privacy of users in your organization. Configuration Manager 2007 includes many tools to gather data and monitor client computers, some of which could raise privacy concerns.

For example, when you deploy the Configuration Manager 2007 client, you enable client agents so you can use Configuration Manager 2007 features. The settings you use to configure the features apply to all clients in the site, regardless whether they are directly connected to the corporate network, connected through a remote session, or connected to the Internet but supported by the site. Client information is stored in the database and is not sent back to Microsoft. Before implementing Configuration Manager 2007, consider your privacy requirements.

Configuration Manager Accounts and Groups

Configuration Manager 2007 uses the Local System account for most site operations. Certain configurations might require creating and maintaining additional accounts. Several default groups and SQL Server roles are created during Setup, but you might have to manually add computer or user accounts to these default groups and roles.

See Also

Other Resources

Fundamentals of Configuration Manager 2007


Understanding Configuration Manager Operations

Microsoft System Center Configuration Manager 2007 interacts with many servers, client computers, and client devices, using a variety of files, services, and database operations. If any of these complex interactions are disrupted, features will not function as expected. Configuration Manager 2007 includes some mechanisms to monitor site operations and some tools to troubleshoot problems when they arise.

Maintaining Configuration Manager Site Operations

Most site operations are the result of services, files, and the site database working together. For example, when you make a change to a site setting, a service called Hierarchy Manager writes a change to a delta file. The Site Control Manager service takes the changes from delta file the to the site control file, which contains all of the site settings. Hierarchy Manager then makes the configuration change in the database. If there are parent or child sites, Site Control Manager interacts with other services to send the site settings up or down the hierarchy. Many of these site processes are documented in the technical flow charts included in the Configuration Manager Documentation Library.

Status Messages

Most of the time, site operations just work and need no intervention. To monitor operations, most services, including client services, generate status messages. Informational and success status messages indicate that the site is performing as expected. Error and Warning status messages indicate that problems exist. The status messages often contain troubleshooting information like possible causes and solutions. You can view status messages in the Configuration Manager console using the Status Message Viewer. You can also run queries for status messages in the database. For more information about status messages, see Using Status Messages for Configuration Manager Troubleshooting.

Log Files

In addition to generating status messages, Configuration Manager services write more detailed information about every action to log files. You can view the log files with any text editor. Interactive flow charts will be available for many features on the Configuration Manager TechCenter and provide samples of log file entries.

State Messages

Configuration Manager 2007 also uses state messages, which are different than status messages, to track the current state of some site operations. Unlike status messages, there is no viewer for state messages. All state messages are viewed using reports. More information about using state messages to monitor site operations is included in the features that use state messages.

Routine Maintenance

Routine monitoring operations for the site consist primarily of checking status messages, file backlogs, and key log files. Some database tasks are automated and configurable in the Configuration Manager console. For more information, see Predefined Maintenance Tasks. To facilitate administration, you can use monitoring software like System Center Operations Manager to alert you to conditions that could compromise optimal site operations.

Because Configuration Manager 2007 uses Microsoft SQL Server as the back end database, you might also need to perform routine SQL Server maintenance. It is helpful to have resources in your organization who understands SQL Server administration.

Backup and Recovery

Like any enterprise software, your site should be backed up to provide recoverability in case of unexpected events. Backing up a Configuration Manager 2007 site involves backing up the database, the file system, and the registry all at the same point in time - backing up just one of these elements is not sufficient to restore a working site. Configuration Manager 2007 uses the Volume Shadow Copy Service (VSS) to take small, frequent snapshots of the necessary components, making it easier to restore a failed site. The Site Repair Wizard walks you through the necessary steps to complete the site recovery.

See Also

Other Resources

Fundamentals of Configuration Manager 2007


Example Scenarios for Configuration Manager 2007

This scenario demonstrates how data moves within a Microsoft System Center Configuration Manager 2007 site for software distribution.

The accounting department has just purchased a new line-of-business application and wants it installed on all accounting computers as soon as possible. Kim uses the software distribution feature of Configuration Manager 2007 to send the new software only to computers in the accounting department based on their membership in an Active Directory security group.

  1. Kim enables Active Directory Security Group Discovery. Every day, Configuration Manager 2007 queries Active Directory for all computers that are members of the Accounting security group.
  2. Kim creates a query in the Configuration Manager 2007 console to find all members of the Accounting security group.
  3. Kim creates a collection based on the query to find all members of the Accounting security group. If the Active Directory administrator adds a new computer to the Accounting security group, the next time Active Directory Security Group Discovery runs it will add the new computer to the Configuration Manager 2007 database. The next time the Accounting collection is evaluated, the query will find the new computer in the database and it will be added to the collection.
  4. Kim enables the Advertised Programs Client Agent, so that all clients in his site will be able to receive software distribution packages.
  5. Kim creates several distribution points in each site. If he configured only one per site, it might not be able to service all of the clients in that site.
  6. Kim creates a package for the accounting application. He configures the package to read the source files from the CD and create a local copy of the package, because disks in his office sometimes disappear without his permission.
  7. The application has a tool to create a customized Windows Installer file that will install the software with no user intervention and using all of the accounting department's preferred defaults. Kim creates one program to run the customized Windows Installer and he creates a second program to uninstall the accounting application, just in case. Both programs are configured to run whether or not a user is logged on, and both will run with administrative rights even if the logged on user is not currently an administrator, even if the client computer is running Windows Vista with User Access Control enabled.
  8. The default package access accounts allow all users to read the package. Because only accounting members should have access, Kim removes the Users package access account and adds an account for the accounting group.
  9. Kim copies the package to all distribution points in his site. He also copies the package to all distribution points in all child sites because there are some members of accounting in every site.
  10. As soon as Kim completes the distribution point wizard, the site server immediately begins copying the files to the distribution points in his site. Kim purposefully waited until the end of the day to run the distribution point wizard so the network would be less busy. The sender controls the bandwidth utilization to the child sites, so it doesn't matter when Kim runs the distribution point wizard. The sender from the parent site copies the package to the child site in small chunks and verifies each chunk before sending the next one. After the entire package is successfully received at the child site, the child site server copies the package to all distribution points in that site.
  11. After Kim has verified in the package status that the package has been distributed to all of his distribution points, he creates an advertisement. He configures the advertisement to use the accounting package and the program to run the customized Windows Installer file. He sets the advertisement to send the package and program to the accounting collection. He configures the advertisement to run next Wednesday at 4 pm in the client's time zone. He could have configured it to run at 4 pm UTC but some of the sites in other countries don't have local administrators and Kim doesn't want to get troubleshooting calls in the middle of the night if 4 pm in his site is midnight in a different site. Even though the application is rather large, Kim configures the advertisement to run even if the client computer is connected to a slow network boundary; this means that accounting users who work from home and connect using a VPN will still have to install the program. Kim makes a note to send out an e-mail to the home-based workers to let them know the large package is coming.
  12. As soon as Kim completes the advertisement wizard, Configuration Manager 2007 creates a policy and sends it to the management points for all the sites. For the management points at the child sites, the sender at the parent site copies the policy to the site server at the child site and the child site server sends it to the site management point.
  13. The clients in all the sites have been configured to poll for new policy every two hours because it provides a nice balance between getting software out quickly enough but not saturating the network with policy requests.
  14. The next time a client in the Accounting collection polls the management point, it is told that it has software advertised to it. It asks for the location of the content and is given a list of distribution points in the site. The client sorts the list and finds three distribution points on the same subnet, so it picks one at random. The client connects to the selected distribution point and downloads the content into a local cache and then runs the program from the cache to install the accounting software.
  15. After the software is installed, the client sends a status message indicating success.
  16. Kim creates a report to show which clients have successfully installed the accounting software.

See Also

Other Resources

Fundamentals of Configuration Manager 2007


Customizing Configuration Manager

Microsoft System Center Configuration Manager 2007 functionality can be automated and extended by using the System Center Configuration Manager 2007 Software Development Kit (SDK). The Configuration Manager SDK provides the necessary information to administrators who want to automate Configuration Manager 2007 functionality and to developers who want to extend the base Configuration Manager functionality.

The Configuration Manager SDK contains the documentation, samples and reference material necessary to write applications that access and modify Configuration Manager data. In addition, the SDK contains code samples in C# and VBScript to support various Configuration Manager features.

Support for Configuration Manager Features

The following features of Configuration Manager 2007 are supported by the System Center Configuration Manager 2007 Software Development Kit (SDK):

  • Configuration Manager Console Extension
  • Configuration Manager Asset Intelligence
  • Configuration Manager Desired Configuration Management
  • Configuration Manager Device Management
  • Configuration Manager Discovery
  • Configuration Manager Inventory
  • Configuration Manager Management Point Interface
  • Configuration Manager Network Access Protection Integration
  • Configuration Manager Operating System Deployment
  • Configuration Manager Remote Tools
  • Configuration Manager Server and Client Infrastructure
  • Configuration Manager Software Distribution
  • Configuration Manager Software Metering
  • Configuration Manager Software Updates Management
  • Configuration Manager System Status
  • Configuration Manager Wake On LAN

See Also

Other Resources

Configuration Manager 2007 Features


What's New in Configuration Manager 2007
Important
This section is for users who are already familiar with Systems Management Server (SMS) 2003 and want to know what has changed in Microsoft System Center Configuration Manager 2007. If you are not already familiar with Configuration Manager 2007, start by reading Fundamentals of Configuration Manager 2007. If you don't have Configuration Manager 2007 deployed yet, you should read Configuration Manager Planning and Deployment Overview and Planning and Deploying Clients for Configuration Manager 2007. After your site is installed, see Configuration Manager 2007 Features for complete information about deploying, using, and troubleshooting each feature.

Some aspects of Configuration Manager 2007 have changed very little since SMS 2003, while some have changed a lot. Also, several new features have been added and some features have been removed.

The following features are new to Configuration Manager 2007:

  • Desired configuration management
  • Network Access Protection for Configuration Manager
  • Wake On LAN

The following features were previously available only in Feature Packs but are now incorporated into the core product:

  • Mobile device management
  • Operating system deployment
  • Transfer site settings wizard
  • Manage site accounts tool (MSAC)
  • Asset Intelligence

The following features have changed significantly from SMS 2003:

  • Backup and recovery
  • Software updates

The following features have been improved but still function very much as they did in SMS 2003:

  • The administrator console
  • Collections
  • Software distribution
  • Software metering
  • Remote tools

The following features either have not changed or have minor changes:

  • Discovery
  • Inventory
  • Queries
  • Reporting

The basic site infrastructure has not changed. You still have primary sites and secondary sites, although the new feature for software distribution called the branch distribution point might remove the need to create some child sites in your hierarchy. Site-to-site communication is still configured using senders and addresses; however, in Configuration Manager 2007 senders can be installed only on primary or secondary site server systems. Configuration Manager 2007 now supports hosting the site database on a clustered SQL Server virtual instance as well as SQL Server 2005 named instances. Several new server roles have been added to support new features.

In SMS 2003 you had two types of clients, but in Configuration Manager 2007 you have only one client type, which is similar to the SMS 2003 Advanced Client. Some of the client deployment methods have changed and some methods have been removed. A new method, software update point client installation, allows you to leverage your software update infrastructure to deploy Configuration Manager 2007 clients.

In SMS 2003 you had two security modes, but in Configuration Manager 2007 you have the equivalent of SMS 2003 advanced security. However, you now have two site modes: Configuration Manager 2007 native mode and Configuration Manager 2007 mixed mode. Although site modes are not at all related to the SMS 2003 security modes, they do involve the security of your Configuration Manager 2007 environment. Native mode is a requirement to support Internet-based client management, a new feature that allows you to manage clients that do not have a direct connection to your site.

In SMS 2003, the site server's local subnet is automatically used as the site boundary for the site during setup. In Configuration Manager 2007, there is no default boundary created during setup, and you must manually create the boundary for a site when setup has completed. In SMS 2003, there are site boundaries and roaming boundaries, but in Configuration Manager 2007, there is only one type of boundary and it is equivalent to SMS 2003 roaming boundaries. Computers are assigned as clients to Configuration Manager 2007 sites according to the site boundaries you configure in the Configuration Manager console. Boundaries can now be defined by IP subnets, Active Directory site names, IPv6 Prefix, or IP ranges.

In SMS 2003, roaming boundaries were either local or remote roaming boundaries. When creating Configuration Manager 2007 boundaries, you instead decide whether the boundary will be used for either a slow or unreliable or a fast (LAN) network connection. During upgrade, any existing remote roaming boundaries will become slow boundaries and any local roaming boundaries will become fast (LAN) boundaries.

In SMS 2003, you could not upgrade from the evaluation version of the product to the full version. Configuration Manager 2007 now supports upgrading from the evaluation version. When upgrading an evaluation version, whether it is SMS 2003 or Configuration Manager 2007, an entire setup process must be completed using the new installation source files.

In SMS 2003, the client push installation method properties used when installing clients have the default site code set to Auto. In Configuration Manager 2007, the default site code used when installing clients using the client push installation method is set to the site code of the primary site.

In Configuration Manager 2007, state messages are sent by Configuration Manager 2007 clients using a new messaging system built into the product that allows clients to send "checkpoints" of important changes of state. State messages are not the same as status messages; whereas status messages provide information about component behavior and data flow, state messages provide a snapshot of the state of a process at a specific time.

Configuration Manager 2007 also includes support for fully qualified domain names (FQDNs) and IPv6.

Note
Although the product name has officially changed, there are some programmatic elements within Configuration Manager 2007 that have not been changed to reflect the new name. For example, the provider is still called the SMS Provider because changing it would have created backward-compatibility problems for customers using WMI scripting. Many status messages still refer to SMS because the messages could apply to an SMS 2003 child site. Services, file names, shared folder names, and Configuration Manager 2007 groups still retain the SMS abbreviation in their names.

In This Section

What's New in Asset Intelligence for Configuration Manager

What's New in Client Deployment for Configuration Manager

What's New in Collections for Configuration Manager

What's New in Mobile Device Management for Configuration Manager

What's New in Operating System Deployment for Configuration Manager

What's New in Remote Tools for Configuration Manager

What's New in Security for Configuration Manager

What's New in Software Distribution for Configuration Manager

What's New in Software Updates for Configuration Manager

What's New in Software Metering for Configuration Manager

What's New in the Configuration Manager Console

See Also

Concepts

Getting Started with Configuration Manager 2007
How to Use the Configuration Manager 2007 Documentation Library
Prerequisites for Installing Configuration Manager

Other Resources

Configuration Manager Supported Configurations


What's New in Configuration Manager 2007 SP1

Topic last updated—March 2008

Microsoft System Center Configuration Manager 2007 SP1 introduces out of band management. For more information, see Overview of Out of Band Management.

Configuration Manager 2007 SP1 also provides significant enhancements to the Asset Intelligence feature introduced in Systems Management Server (SMS) 2003 and included in Configuration Manager 2007. As well as the functionality provided by Asset Intelligence in Configuration Manager 2007, the following feature enhancements have been made to Asset Intelligence in Configuration Manager 2007 SP1:

  • New catalog and license management capabilities from within the Configuration Manager console.
  • Additional reports.
  • Compatibility with Microsoft SoftGrid applications.
  • Asset Intelligence catalog synchronization to child sites.
  • Ability to import both Microsoft and non-Microsoft software licensing data.

In addition, Microsoft Software Assurance (SA) license customers, using the Asset Intelligence feature in Configuration Manager 2007 SP1, can dynamically update the Asset Intelligence catalog using the new Asset Intelligence synchronization point site system role. Using this site system role, SA customers can request on-demand catalog synchronization with System Center Online or schedule automatic catalog synchronization. The Asset Intelligence synchronization point can also be used to upload uncategorized software titles to System Center Online for identification.

For more information, see Asset Intelligence in Configuration Manager.

The length of the evaluation period has changed in Configuration Manager 2007 SP1 to be more consistent with other Microsoft products. In Configuration Manager 2007, the evaluation period is 120 days. In Configuration Manager 2007 SP1, the evaluation period is 180 days.

The Application Compatibility Toolkit (ACT) Connector and the System Center Updates Publisher are no longer included with the Configuration Manager 2007 SP1 installation media.

Microsoft System Center Configuration Manager 2007 SP1 provides support for Windows Server 2008 as clients and site systems.

Note
Windows Server 2008 does not include WebDAV by default, which is required for Configuration Manager 2007 management points and distribution points. For more information, see How to Configure Windows Server 2008 for Site Systems.

In Configuration Manager 2007 SP1, you can modify the registry to prevent the console from contacting the Internet to display the TechCenter page as the console home page. For more information, see How to Prevent the Home Page from Downloading the TechCenter Page on Microsoft.com.

In Configuration Manager 2007 SP1, a change was made to advertisements to run without being scheduled, even if the logged on user is not an administrator. For more information, see "Internet-Based Clients Running Advertisements" in Example Package Access Scenarios.

See Also

Concepts

Configuration Manager 2007 SP1 Supported Configurations
What's New in Configuration Manager 2007

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


What's New in Configuration Manager 2007 R2

Topic last updated—January 2008

The following features are new to Configuration Manager 2007 R2:

  • Application Virtualization Management. For more information about managing virtual applications created using the Microsoft Application Virtualization platform, see About Virtual Application Packages.
  • Forefront Client Security Integration. For more information, see About Forefront Client Security Integration with Configuration Manager 2007 R2.
  • SQL Reporting Services Reporting. Allows you to report on Configuration Manager activity using SQL Reporting Services.
  • Client Status Reporting. Provides a set of tools and Configuration Manager 2007 reports to assess the status of client computers, sometimes referred to as "client health." Clients that show a change in activity patterns might need administrative intervention.
  • Operating System Deployment Enhancements. The following enhancements are included in Configuration Manager 2007 R2:
    • Unknown computer support—In Configuration Manager 2007 R2, you can deploy operating systems to computers using a PXE service point without first adding the computer to the Configuration Manager database. For more information, see About Unknown Computer Support for Operating System Deployment.
    • Multicast deployment—Previously, all operating system deployments used unicast. Multicast can make more efficient use of network bandwidth when deploying large images to several computers at the same time. For more information, see About Multicast for Operating System Deployment.
    • Running command lines in task sequences with credentials other than the local system account.

See Also

Concepts

What's New in Configuration Manager 2007


What's New in Asset Intelligence for Configuration Manager

First introduced in SMS 2003 SP3, Asset Intelligence has been enhanced significantly in Microsoft System Center Configuration Manager 2007. New reports have been added to the Asset Intelligence Hardware, Software, and License Management categories.

In addition to tracking installed software, auto-start software, and browser helper objects, new software reports provide information about recently used executables. As well as the hardware reports that track USB devices, processor age, and readiness for upgrade, new reports identify computers that have software or hardware changes since the last inventory cycle. New Client Access License reports, added to the existing License Ledger reports, complete the ability to compare license usage with Microsoft License Statements.

License Management Reports

Nine new license management reports have been added, providing the means to track Client Access Licenses (CAL) in addition to the existing volume license reports. One of these new reports identifies the number of processors in computers running software that can be licensed using the per-processor licensing model. The remaining 8 new reports identify User CAL usage and Device CAL usage summaries, details, and history.

For more information, see License Management Reports.

Hardware Reports

Three new hardware reports help identify computers that have changed since the last inventory cycle. The changes identified in these reports include both hardware and software changes.

For more information, see Hardware Reports.

Software Reports

Six new software reports extend previous inventory capabilities by adding software metering. These new reports identify recently used executables, which users ran them, and the devices on which the executables were run.

For more information, see Software Reports.


What's New in Client Deployment for Configuration Manager

Client deployment in Microsoft System Center Configuration Manager 2007 introduces a number of changes and new features designed to improve the ease and security of client deployment, and to improve the identification of any problems using standard reports.

The following section details some of the new or improved features.

New Client Icon Named Configuration Manager

The Systems Management icon in the Windows Control Panel of Configuration Manager 2007 client computers has been renamed to Configuration Manager, and displays as follows:

Configuration Manager client icon The Configuration Manager client icon that replaces the Systems Management icon from SMS 2003.

Checking for Site Compatibility to Complete Site Assignment

The improved functionality from SMS 2003 means that a Configuration Manager 2007 client will not work if it is assigned to a site running SMS 2003. To prevent this situation, site assignment in Configuration Manager 2007 now includes a version check to ensure compatibility between the client and its assigned site.

For site assignment to complete in Configuration Manager 2007, you must either extend the Active Directory schema for Configuration Manager 2007 or clients must be able to communicate with a server locator point in the hierarchy. Additionally, if you have extended Active Directory but have clients from a separate forest, or clients from workgroups, you will need a server locator point.

For more information, see About Client Site Assignment in Configuration Manager and Determine If You Need a Server Locator Point for Configuration Manager Clients.

Important
If a Configuration Manager 2007 client cannot complete the check for site compatibility, site assignment will not succeed.

Client Prerequisite Checks

When CCMSetup installs the Configuration Manager 2007 client, it checks the destination computer for the correct prerequisites required by your Configuration Manager 2007 site. If these are not found, CCMSetup will install these before installing the client.

For more information, see Prerequisites for Configuration Manager Client Deployment.

Approval for Clients in Mixed Mode

A new procedure called approval helps to protect the security of a site in mixed mode. Only clients that are approved will be sent policies that might contain sensitive data. You should ensure that all client computers that you trust are approved with their assigned site.

The default site setting for approval in Configuration Manager 2007 is to automatically approve trusted computers. This means that in most circumstances you will not have to manually approve many computers, unless they are from a separate Active Directory forest or a workgroup. However, if your Configuration Manager 2007 spans multiple domains, ensure that the site's default management point (or NLB management point) is configured with an intranet fully qualified domain name (FQDN).

For more information, see About Client Approval in Configuration Manager and Determine If You Will Use FQDN Server Names.

Client Blocking

If a client computer is no longer trusted, the Configuration Manager administrator can block the client from the Configuration Manager infrastructure. Blocked clients are rejected by Configuration Manager so that they cannot communicate with site systems to download policy, upload inventory data, or send state or status messages to the site. This action is especially useful for laptop computers or mobile devices that are lost or stolen, to help prevent attackers from using a trusted client to attack the Configuration Manager 2007 site or the network. However, it does not replace the use of certificate revocation checking if this is supported in a public key infrastructure (PKI) environment.

For more information, see Determine If You Need to Block Configuration Manager Clients and How to Block Configuration Manager Clients.

Fallback Status Point

The fallback status point is a new site system role in Configuration Manager 2007 that receives state messages from client computers during the installation process, and if they cannot connect to a management point. This information is then displayed in reports to help you more easily identify computers that have failed to install the client software or that cannot communicate with their site.

The fallback status point is not published to Active Directory Domain Services as a site setting, so it must be assigned to clients during installation.

For more information, see About the Fallback Status Point in Configuration Manager and Determine If You Should Install a Fallback Status Point for Configuration Manager Clients.

Group Policy Based Installation and Assignment

Configuration Manager 2007 supports using Windows Group Policy to install or assign the client software to computers in your enterprise. You can use this method to assign new or existing clients to a Configuration Manager 2007 site. An administrative template to perform site assignment is included on the Configuration Manager 2007 installation media.

For more information, see How to Install Configuration Manager Clients Using Group Policy and How to Assign Configuration Manager Clients to a Site.

Software Update Point Based Client Installation

Software update point based client installation is a new client deployment method introduced in Configuration Manager 2007 that allows the administrator to publish the latest version of the Configuration Manager 2007 client into the WSUS catalog. This allows the latest client software to be installed using standard software update deployment methods. One of the advantages of this installation method is that it does not require local administrative rights on the target computer.

For more information, see Determine the Configuration Manager Client Installation Method to Use and How to Install Configuration Manager Clients Using Software Update Point Based Installation.

Default Management Point Published to DNS

The most secure method for a client to find its default management is through Active Directory Domain Services. However, if this is not possible either because Active Directory is not extended, or because clients are from a separate Active Directory forest or a workgroup, DNS publishing offers a recommended alternative.

This configuration requires an entry in DNS that is added either automatically or manually, and configuration on the client.

For more information, see Determine If You Need to Publish to DNS and Configuration Manager and Service Location (Site Information and Management Points).

Uninstalling the Configuration Manager Client Software

The ccmclean.exe utility provided with SMS 2003 Toolkit 2 cannot be used to uninstall the Configuration Manager 2007 client software. To successfully uninstall the Configuration Manager 2007 client software you must use the CCMSetup.exe executable together with the /uninstall property.

For more information, see How to Uninstall the Configuration Manager Client.

Client Network Access Account

The SMS 2003 client network access account is no longer used for client push installations in Configuration Manager 2007.

For more information, see How to Install Configuration Manager Clients Using Client Push.

Client Installation Properties Published in Active Directory

If you have extended the Active Directory schema for Configuration Manager 2007 and the site is configured to publish to Active Directory Domain Services, a number of client installation properties are published. These settings can remove the need to specify CCMSetup command line properties under certain circumstances, such as when you install the Configuration Manager 2007 client using software update point based installation or use Group Policy installation.

For more information, see About Configuration Manager Client Installation Properties Published to Active Directory Domain Services.

Provision Client Installation Properties Using Group Policy

You can use Windows Group Policy to provision client installation properties on computers prior to installing the Configuration Manager 2007 client. When the client is installed, these properties will be used if no other installation properties have been specified. An administrative template to provision client computers with installation properties is included on the Configuration Manager 2007 installation media.

For more information, see How to Provision Configuration Manager Client Installation Properties using Group Policy.

Low Rights Client Installation No Longer Supported

In SMS 2003, users without administrative rights to the computer could manually install the SMS advanced client. These computers would then submit a CCR to the site server which would initiate the installation. In Configuration Manager 2007, this feature is no longer supported. You can install the Configuration Manager 2007 client on computers logged on with non-administrator rights using the following methods:

  • Client push installation (if a valid client push installation account has been specified)
  • Software update point based client installation
  • Group Policy installation

For more information, see How to Install Configuration Manager Clients Using Client Push, How to Install Configuration Manager Clients Using Software Update Point Based Installation and How to Install Configuration Manager Clients Using Group Policy.

CAPINST.EXE is No Longer Supported

Capinst.exe is no longer used in Configuration Manager 2007 for logon script client installation. For information about how to install Configuration Manager 2007 clients using a logon script, see How to Install Configuration Manager Clients Using Logon Scripts.

Client Installation Files are Downloaded from the Management Point over HTTP (Mixed Mode) or HTTPS (Native Mode)

In SMS 2003, client installation files were downloaded from an SMB share on the management point. In Configuration Manager 2007, the default behavior is to download these files using a HTTP connection in a mixed mode site, or HTTPS connection in a native mode site. You can still use an SMB share to download client installation files, but you must create this share yourself and specify the CCMSetup installation property /source.

For more information, see About Configuration Manager Client Installation Properties.

Managing Client Identity

Configuration Manager 2007 manages client identity to help eliminate duplicate GUIDs. For each client computer, Configuration Manager 2007 calculates a hardware ID using a proprietary algorithm to help ensure that each client is uniquely identified. If Configuration Manager 2007 detects a duplicate hardware ID, Configuration Manager 2007 can automatically create a new client record for the duplicate record. This setting allows you to easily upgrade or deploy clients that might potentially have duplicate hardware IDs, without requiring manual intervention.

However, with this setting, if you recover a computer and it maintains the original hardware ID, Configuration Manager 2007 will create a new record and you lose the historical continuity for reporting purposes. If you want to manually resolve conflicting records, you can change the setting on the Site Properties Advanced tab so that conflicting records will be displayed in the Conflicting Records node. If you enable manual conflict resolution for all sites in a hierarchy branch, then the administrator at the top of the branch can manually resolve conflicts for all child sites.

For more information, see How to Manage Conflicting Records for Configuration Manager Clients.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties
Decide If You Should Extend the Active Directory Schema

Other Resources

Planning and Deploying Clients for Configuration Manager 2007
Software Updates in Configuration Manager


What's New in Collections for Configuration Manager

Topic last updated—November 2007

The collections feature in Configuration Manager 2007 introduces a number of new features designed to help you to manage client computers in your organization.

The following section lists some of the new or improved features.

Collection-Based Client Policy Interval

Collections in Configuration Manager 2007 can be configured with a policy polling interval that overrides the site-wide client policy interval configured in the Computer Client Agent Properties: General Tab. Computers in the collection will receive the latest client policy according to the value configured for the option Policy polling interval (minutes) in the Collection Name Settings: Advanced Tab.

When a client is member of multiple collections that have different policy polling intervals specified, the client uses the shortest configured interval.

For more information, see About Collection-Specific Settings.

Maintenance Windows

Maintenance windows in Configuration Manager 2007 allow the administrator to specify a time period in which changes can be made on computers that are members of a collection. This provides a means for the administrator to restrict changes to computers in the organization to periods when these changes will have the least impact. Maintenance windows for a collection are specified in the Collection Name Settings: Maintenance Windows Tab.

For more information, see About Maintenance Windows.

Collection Based Task Sequence Variables

You can specify task sequence variables for a collection of computers. All task sequences targeted to the collection can access the task sequence variable and its associated value. For more information about task sequence variables, see About Task Sequence Variables.

See Also

Concepts

About Collection-Specific Settings
About Maintenance Windows

Other Resources

Collections in Configuration Manager


What's New in Mobile Device Management for Configuration Manager

The Mobile Device Management feature in Microsoft System Center Configuration Manager 2007 introduces a number of changes from the version found in Microsoft Systems Management Server (SMS) 2003 Device Management Feature Pack.

Mobile device platform support added

Support for the following mobile devices has been added:

  • Windows Mobile 2003 Smartphone
  • Windows Mobile for Pocket PC 2003 Second Edition
  • Windows Mobile for Pocket PC 5.0
  • Windows Mobile for Pocket PC Phone Edition 5.0
  • Windows Mobile 6 Standard
  • Windows Mobile 6 Professional
  • Windows Mobile 6 Classic

For a complete list of supported mobile devices, see Supported Mobile Devices.

Internet-based Client Management Support for Mobile Device Clients

Internet-based client management allows you to manage Microsoft System Center Configuration Manager 2007 mobile device clients when they are not connected to your company network but have a standard Internet connection. For more information about configuring Internet-based mobile device clients, see Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management.

DMConsole removed

The Device Management Console for the mobile device client has been removed. Mobile device clients retain a Device Management view under Start / Settings.

SMS_Def.mof for hardware inventory extension now in a defined package

Microsoft System Center Configuration Manager 2007 administrators no longer have to deploy SMS_Def.mof to extend the hardware inventory. A defined Device Management Inventory Extension package now contains everything needed to target and deploy mobile devices. For more information about extending the inventory to desktop computers for mobile device management, see How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management.

DMScript removed

Device Management Scripts have been removed from Configuration Manager. Device Management Scripts will not function on a Configuration Manager client because the DMScript engine has been removed. Administrators that need this functionality are encouraged to use the .NET Compact Framework and any of the .NET languages to create command applets to perform these functions.

New Mobile Device Management Reports

The following new reports have been added to the mobile device management feature:

  • New Client Status Reports:
  • Client Agent Deployment Success
  • Client Agent Deployment – Failure
  • Client Agents – Healthy
  • Client Agents Unhealthy
  • Client Agent Health Summary
  • Client Agent Unhealthy – Local

For more information about reports for mobile devices, see How to Use Reports for Mobile Devices.

See Also

Concepts

Supported Mobile Devices

Other Resources

Configuring Mobile Device Management
Overview of Mobile Device Management
Tasks for Mobile Device Management


What's New in Operating System Deployment for Configuration Manager

Operating System Deployment (OSD) provides the Configuration Manager 2007 administrator with a tool for creating images that can be deployed to computers managed by Configuration Manager 2007, and to unmanaged computers using bootable media such as CD or DVD. The image, a Windows Image (WIM) format file, contains the desired version of a Microsoft Windows operating system and can also include any line-of-business applications that need to be installed on the computer. Operating System Deployment provides the following functionality:

  • Image capture
  • User state migration using the User State Migration Tool
  • Image deployment
  • Task sequences

Disconnected and Remote Deployment

You can deploy Windows via CD set or DVD with or without network connectivity. Windows PE, boot image, and applications can all be stored on removable media.

Advanced Task Sequencing

OSD offers a new task sequence editor with many built-in features that provide flexible operating system deployment options both with operating system deployments and for use with performing other related tasks.

See Also

Other Resources

Operating System Deployment in Configuration Manager


What's New in Remote Tools for Configuration Manager

The Remote Tools feature in Microsoft System Center Configuration Manager 2007 introduces a number of changes from the version found in Systems Management Server 2003. These changes are designed to provide the following improvements:

  • Improved security.
  • Use of the latest communications protocols.
  • Improved performance.
  • Provide compatibility with new operating systems.

New Remote Tools Agent

Configuration Manager 2007 includes a new remote tools agent which uses the Microsoft RDP protocol. This is a standard protocol used for applications such as Remote Desktop and Remote Assistance. The RDP protocol is supported on client computers running Windows XP and Windows 2003 Server and above. The following levels of access are supported by the new remote tools agent:

  • No access
  • View only
  • Full control

Windows 2000 Remote Tools Agent

The Microsoft RDP protocol is currently not supported on computers running Windows 2000. To support Configuration Manager 2007 client computers running Windows 2000, a modified version of the SMS 2003 remote tools agent is included. The following levels of access are supported by the Windows 2000 remote tools agent:

  • No access
  • Full control

Remote Tools UI

The following options are no longer included in the Configuration Manager 2007 remote tools:

  • Reboot
  • Chat
  • File transfer
  • Remote execute
  • Windows 98 diagnostics
  • Ping

See Also

Concepts

Remote Tools in Configuration Manager


What's New in Security for Configuration Manager

Microsoft System Center Configuration Manager 2007 introduces some significant security changes from Systems Management Server (SMS) 2003.

Configuration Manager 2007 Has One Security Mode

In SMS 2003, you had the option of standard security or advanced security, and advanced security was recommended. In Configuration Manager 2007, you have only one security mode and that mode is equivalent to SMS 2003 advanced security mode. In SMS 2003, some sites could not comply with the advanced security requirement that all site systems had to belong to an Active Directory domain, but this is now a requirement to run Configuration Manager 2007.

If you are installing a new site, you will not be prompted to choose a security mode. If you are upgrading from SMS 2003, you must convert your site to advanced security prior to running Setup. After converting, you should delete any accounts that will not be required. For more information, see Accounts to Delete after Upgrading from SMS 2003. You should also verify that you have the proper accounts in place for Configuration Manager 2007 to function. For more information, see Checklist for Configuration Manager Account Security.

Configuration Manager 2007 Has Two Site Modes

Configuration Manager 2007 gives you a choice between Configuration Manager 2007 native mode and Configuration Manager 2007 mixed mode. Native mode requires an existing public key infrastructure (PKI) implementation but provides mutual authentication between Configuration Manager 2007 clients and servers. It is the most secure choice. Mixed mode is provided for backward compatibility with hierarchies that must support SMS 2003 sites and for organizations without the resources to deploy a PKI. If you deploy in mixed mode, you have the option to manually approve all clients before they can join the site or you can allow all domain-joined clients to be automatically approved. It is possible to allow all clients to be automatically approved, whether or not they belong to a trusted domain, but that increases your security risk by allowing unknown clients to join your site.

Configuration Manager 2007 Supports Only One Client Type

In SMS 2003, you had a choice between the Legacy Client and the Advanced Client. Starting with SMS 2003 SP1, you could install the Legacy Client only on Windows 98 or Windows NT 4.0 clients. In Configuration Manager 2007, there is just one client called simply the Configuration Manager 2007 client, and it is similar to the SMS 2003 Advanced Client. Before upgrading to System Center Configuration Manager 2007, you must remove all Legacy Clients in the site hierarchy.

Configuration Manager 2007 Supports Only SQL Server Windows Authentication

In SMS 2003, you configure SMS to access the site database server using either SQL Server Authentication, previously known as standard security, or Windows Authentication, previously called integrated security. If you used SQL Server Authentication, you had to provide a SQL login for SMS to use when accessing the site database. Configuration Manager 2007 supports only Windows Authentication, meaning Configuration Manager 2007 uses the site server computer account to access the site database. Several database roles have been added to better control Configuration Manager 2007 access to the SQL Server.

Inter-Site Communication Security

In SMS 2003, you had the option of whether or not a site could accept unsigned data from another site. In Configuration Manager 2007, all data must be signed between sites and there is no option to disable the signing requirement.

Also, in SMS 2003, secure key exchange was not enabled by default between sites. In Configuration Manager 2007, the requirement for secure key exchange between sites is enabled by default for fresh installations.

Client Push Installation Can Use Computer$ Account

Even if your SMS 2003 site used advanced security, you had to configure a user account to perform Client Push Installation. In Configuration Manager 2007, if you do not have a user account configured, Configuration Manager 2007 will try the site server computer$ account. If no client push installation accounts are defined and if the computer$ account does not have administrative rights to the client computer, Client Push Installation will fail.

Important
Adding the site server computer$ account to the Domain Admins global group is not recommended because it breaches the principal of least privilege. A better alternative is to add the site server computer$ account to a different global group and then use Group Policy to add the global group to the local Administrators group as a restricted group. For more information, see Microsoft KB article 320065, "How to Configure a Global Group to Be a Member of the Administrators Group on all Workstations."

Security Configuration Wizard Helps Secure Site Roles

With the release of Windows Server 2003 SP1, the Security Configuration Wizard (SCW) provides server hardening based on the roles performed by the server. Configuration Manager 2007 templates can be added to SCW to provide the recommended security configuration for Configuration Manager 2007 site system roles. Running the SCW replaces the previous security recommendations to run IIS Lockdown and URLScan on Configuration Manager 2007 roles that require IIS. Because the SCW provides an automated way to help secure servers, the manual hardening checklists for IIS and SQL provided in "Scenarios and Procedures for SMS 2003: Security" are no longer provided.

Before you can run the SCW on your site server and site systems, you must install the Configuration Manager 2007 SCW template, which is scheduled to be included in the Configuration Manager 2007 Toolkit (http://go.microsoft.com/fwlink/?LinkId=93071).

Upgraded Administrators Do Not Have Access to All Objects

After upgrading, the user who ran the upgrade has access to all of the objects in the Configuration Manager 2007 console but existing administrators have access only to objects that existed prior to upgrade. This is true even for software updates objects. Users who had full rights to all SMS 2003 software updates objects will have full rights to the same objects in Configuration Manager 2007 but will not have any rights to new object types, such as templates.

Account Changes

Because standard security and the Legacy Client are not used in Configuration Manager 2007, any accounts related to those configurations are no longer needed. Configuration Manager 2007 does not create any user accounts during Setup or client installation. Several new accounts, described in the following table, are introduced in Configuration Manager 2007.

Account Name | Used for
Site System Installation account | Installing and configuring site systems
Health State Reference Publishing account | Network Access Protection publishing to Active Directory Domain Services
Health State Reference Querying account | Network Access Protection querying from Active Directory Domain Services
Capture Operating System Image account | Capturing images for operating system deployments
Software update point proxy server account | Synchronizing the software update catalog, if your proxy server requires authentication
Task Sequence Editor Domain Joining account | Task sequences in operating system deployment that require a security context to join a domain
Proxy Account for Internet-based clients | Internet-based clients that need to authenticate to a proxy server when accessing the Internet

The SMS_SiteSystemToSQLConnection group is no longer needed because database access is controlled by SQL Server roles that are automatically created during Configuration Manager 2007 Setup. For more information, see About the Database Roles for Configuration Manager.

A new group, the ConfigMgr Remote Control Users group, has been added to contain the members of the Permitted Viewers list.

See Also

Concepts

Software Distribution Security Best Practices and Privacy Information
What's New in Configuration Manager 2007

Other Resources

Accounts and Groups in Configuration Manager
Security and Privacy for Configuration Manager 2007


What's New in Software Distribution for Configuration Manager

Topic last updated -- November 2007

With this release, Microsoft System Center Configuration Manager 2007 expands the abilities of system administrators to centrally manage computers effectively. Building on the capabilities provided by System Management Server (SMS) 2003, Configuration Manager provides a refined tool set for software distribution that includes the following new characteristics:

Branch Distribution Points

A new Configuration Manager server role, the branch distribution point allows small office locations to host packages on workstation computers without requiring a secondary site to be hosted. This is particularly useful for offices with fewer than ten workstations, where maintaining a separate server for a secondary site might not be practical.

Branch distribution points function in much the same fashion as standard distribution points, but have the advantage of providing greater control over network traffic, necessary for branch offices that may have limited network bandwidth availability. Branch distribution points allow not only allow for manual content provisioning, but also provide configurable settings for scheduling and throttling network traffic, BITS (Background Intelligent Transfer Service) enabling, to help minimize network impact. Additionally, on-demand package distribution are allowed, in which packages are only downloaded to the branch distribution point when specifically requested by a client computer.

Note
Branch distribution points cannot be installed on client computers running the Windows°2000 Professional operating system or the Windows°2000 Server operating system.

For more information, see About Standard and Branch Distribution Points.

Maximum Allowed Run Time Program Attribute

A program attribute that existed in previous versions of Configuration Manager, Maximum Allowed Run Time has taken on greater significance in Configuration Manager 2007. If a program is advertised to a collection that is utilizing maintenance windows, the value of the Maximum Allowed Run Time attribute is used to determine when and if the program can be run within the allotted window. For instance, if the run time is set to 90 minutes, but the collection it is advertised to only has a maintenance window of 60 minutes, that program will not run. Exceptions to this can be set, in the form of options to disregard existing maintenance windows, but care should be taken to ensure that this attribute is accurate.

This value can be set when creating a program in the New Program Wizard, or on the Requirements tab of the Program Property page for existing programs. By default, this value is automatically set to 120 minutes.

For more information on maintenance windows and their interaction with the maximum allowed run time attribute, see About Maintenance Windows and Program Run Scenario using Maintenance Windows.

Improved Program re-run behavior

Software distribution now exposes program re-run behavior options to administrators to a greater degree than previously. The number of available behavior options has also increased. These can be seen when configuring a new or existing advertisement and allow administrators greater flexibility in determining what rerun behavior is most appropriate for each specific advertisement. Additionally, Configuration Manager prevents administrators from selecting an incompatible program re-run option.

For more information on program re-run behavior, see Advertisement Name Properties: Schedule Tab.

Greater control over program run and restart notifications

With Configuration Manager 2007, users now have greater control over many program run and notification settings. Administrators can now set bandwidth throttling, system restart countdown and restart notifications on the Computer Client Agent, advertised program notification and program run countdown settings on the Advertised Programs Client Agent, and collection-specific restart and policy polling settings on the collections themselves.

Branding support for client agent

Software distribution provides now support for customized branding through the Computer Client Agent. This allows administrators to use customized organization-specific text to be displayed on the client computer, such as with the Run Advertised Programs dialog box. Additional custom branding can be used for the software distribution, software updates, and operating system deployment features.

For more information, see Computer Client Agent Properties: Customization Tab.

Binary Delta replication

Although delta replication has existed in previous versions of System Management Server, this has previously been available only on the file level. For instance, if a file within a package or program changed, filed-based delta replication would copy the changed file to distribution points (and other destinations) instead of copying the entire package. With binary delta replication, only those specific changes within a file are copied to the destination, thereby greatly reducing the network traffic involved. This can be used on a site-to-site, site-to-distribution point, or standard distribution point-to-branch distribution point basis.

For more information about binary delta replication, see About Binary Differential Replication.

Increased Default Cache Size

With the release of Configuration Manager 2007, the size of the cache for storing packages when they're downloaded has increased dramatically, from 250 Mb in size to 5120 Mb. Because when a package must be downloaded, it competes with other, often older packages for the available space in the cache, in the past these older packages might be deleted to free enough space to place the new package in the cache. For very large packages, downloading might not have been possible at all if the size of the package (or image) exceeded the size of the cache. With the increased default cache size, however, this is far less likely to happen, and older packages will remain in the cache and available longer.

BITS-level Resume Now Available Between Distribution Points

With the release of a new version of the BITS service (Background Intelligent Transfer Service), interrupted client downloads from BITS-enabled distribution points can now resume at the point at which they stopped transferring, even if the client connects to a different distribution point. Previously, if a client download from a BITS-enabled distribution point interrupted, a download could only be resumed if the client used the same distribution point. This new functionality is particularly advantageous for computers that roam between sites, or if using Internet-based client management and clients move between the intranet and the Internet.

Advertisements Not Replicated to Secondary Sites

In SMS 2003, all advertisement information was sent to both secondary and primary sites because Legacy Clients could be assigned directly to secondary sites. However, Configuration Manager 2007 does not use Legacy Clients, and all clients can only be assigned to a primary site.

Because of this, Configuration Manager no longer replicates advertisement information to secondary sites, resulting in significant performance improvements and savings in network bandwidth.

Copying Multiple Packages to a Distribution Point

If you bring a new distribution point online, you might want to provision that distribution point with several packages. In SMS 2003, you had to either go to each package individually and copy one package at a time to the distribution point or create a script. In Configuration Manager 2007 you can use the Copy Packages Wizard to pick a distribution point and then select each package you want to copy to the distribution point. For more information, see How to Copy Multiple Packages to One Distribution Point.

See Also

Tasks

How to Configure the Advertised Programs Client Agent

Reference

Advertisement Name Properties: Schedule Tab
Collection Name Settings: Advanced Tab
Computer Client Agent Properties: Customization Tab

Concepts

About Binary Differential Replication
About Standard and Branch Distribution Points
About Maintenance Windows
Program Run Scenario using Maintenance Windows


What's New in Software Updates for Configuration Manager

The software updates feature was introduced with Systems Management Server (SMS) 2003 and provides a set of tools and resources that can help manage the complex task of tracking and applying software updates to client computers in the enterprise. The same basic objectives are achieved, but software updates in Microsoft System Center Configuration Manager 2007 provides more advanced configuration options and utilizes new components and improved technology to achieve these objectives.

Comparing SMS 2003 and Configuration Manager Software Updates

To better illustrate the changes in the software update process in Configuration Manager, the following table outlines a typical scenario for deploying new software updates to a standard set of client computers:

Feature | SMS 2003 ITMU | Configuration Manager 2007
Compliance Assessment | Multiple scan tools. Offline CAB file for scanning | Configuration Manager client agent uses the Windows Update Agent (WUA) on client computers to connect to Windows Server Update Services (WSUS) on the Configuration Manager software updates point.
Update Categories | Security updates, update rollups, service packs, and non-Microsoft updates | All Microsoft update categories and non-Microsoft updates
Scan Results | Results reported using hardware inventory | Results reported using state messages. State messages are more timely and more accurate. Does not require hardware inventory.
Deployments | Uses software distribution packages, programs, and advertisements. | Uses deployments instead of advertisements and do not use regular software distribution packages. Deployments do not require a 1:1 relationship with deployment packages. Allows multiple deployments and better reporting.
Admin Experience | Admin has to run a 17 step wizard every time an update is added or changed. Every language version of every update is listed. | Templates save common settings. Search folders group updates according to administrator criteria. Update lists facilitate reporting and deployment. Homepage provides a status summary. Language versions are bundled under a single update.
Update Binaries | Either had to download the entire package or run from the distribution point | Client selectively downloads only missing applicable updates

Software Update Point Site System Role

The software update point is installed as a site system role in the Configuration Manager console. Each site must have an active software update point before the software updates feature is enabled. A second software update point can be installed to handle the communications from Internet-based client computers. The software update point site system role must be created on a server that has Windows Server Update Services (WSUS) 3.0 already installed and configured. The software update point provides the communication with WSUS and synchronizes with the WSUS database to retrieve the latest software update metadata from Microsoft Update, as well as locally published software updates. For more information, see About the Software Update Point.

Software Updates Client Agent

The Software Updates Client Agent in Configuration Manager 2007 is enabled by default, and client agent components are installed on client computers with the other Configuration Manager client components. The Software Updates Client Agent handles scan requests for software updates compliance, software update evaluation requests, deployment policies for the client, and content download requests. Configuration Manager 2007 clients do not use the Automatic Updates client to retrieve or install updates. For more information, see About the Software Updates Client Agent.

Software Updates Compliance Data on Clients

Configuration Manager 2007 no longer uses hardware inventory to report the compliance for software updates on Configuration Manager 2007 client computers. Client computers now create state messages that contain the compliance assessment data and send these messages to the management point, which in turn sends the data to the site server. The compliance assessment data is displayed in the Configuration Manager console and in Software Updates compliance reports.

Inventory Scan Tools

Configuration Manager client computers no longer use a variety of inventory scan tools to scan for software update compliance, but instead the Windows Update Agent (WUA) on client computers. There are several inventory scan tools in SMS 2003 that scan client computers for software update compliance. When a site is upgraded to Configuration Manager 2007 and the Inventory Tool for Microsoft Updates is found on the site server, most likely the central site, the tool is automatically upgraded. After the upgrade, the Inventory Tool for Microsoft Updates is fully operational for SMS 2003 client computers at the site, the Inventory Tool for Custom Updates is supported, but with conditions, and the other scan tools have very limited support. Using the scan tools on Configuration Manager 2007 client computers is not supported. For more information, see Planning the SMS 2003 Software Updates Upgrade.

Software Update Bundles

SMS 2003 displayed the same software update multiple times in the SMS Administrator console for each language and product for the update. Configuration Manager 2007 has introduced the concept of software update bundles, where a software update is displayed only once in the Configuration Manager console. Software update deployments are initiated by selecting the bundle update, and when creating the deployment the administrator can define which language specific update files will be downloaded and made available to client computers.

Note
After upgrading from SMS 2003, software updates that existed for each language and product are still displayed in the Configuration Manager 2007 console and to the client if they are available to install, but they have the word Legacy appended to them.

Software Updates Supersedence

Supersedence is when a new software update contains the same fixes that were in a previously released software update. In the past, new and previously released software updates, which contained the same fix, might have both been marked as required when the only one that was necessary was the newer software update.

In Configuration Manager 2007, software updates uses the Windows Update Agent which partially addresses the issue of supersedence. When new software updates are released that contain fixes for previously released updates, Microsoft Update is refreshed with information relating to the new software update and any software updates that it supersedes. As client computers scan for software update compliance, any required software updates that supersede previous updates are returned with compliance state but the previously released software updates are not returned. The exception to this is when a Service Pack contains a required software update. The Windows Update Agent returns both the software update and the service pack with a required compliance state. This provides administrators with the flexibility to deploy individual software updates or full service packs.

Deploying Software Updates

Software updates are deployed to client computers using the Deploy Software Updates Wizard, much like it is in SMS 2003, but new objects have been introduced and there have been changes to the deployment process. The following sections briefly describe these changes.

Deployments

Configuration Manager 2007 no longer uses advertisements for delivering software updates. Software update deployments are now used as the vehicle that delivers software updates to client computers. The deployment properties contain the relevant information about the software updates in the deployment, the target collection, the settings that impact client behavior when running the deployment, the deployment schedule settings, and so on. When a deployment is created, client computers receive it as part of the Configuration Manager policy. For more information, see About Software Update Deployments.

Deployment Packages

Deployment packages are used to host the files for the software updates in a deployment, much like that of software distribution packages. The main difference is that the deployment package is used to get the files to the distribution points, but once that process completes, client computers will access the software update files from any package shared folder on any distribution point regardless of whether the package was defined in the deployment that targeted the client. When the client computer receives a new deployment, it determines where the software update files are located, independent of the deployment, and install from the preferred location. For more information, see About Software Update Deployment Packages.

Selective Download

Configuration Manager 2007 provides selective download technology. This technology allows a deployment package to contain a large number of files, but client computers will retrieve only the files that are required. For example, if a client receives a deployment that contains ten software updates but only two of them are required on the client computer, the client will connect to the distribution point and download only the files that it needs.

Deployment Templates

Deployment templates provide the ability to save a set of deployment properties for use in future software update deployments. When a deployment template is used in creating a new deployment, it populates the deployment with the preconfigured properties. This provides consistency among deployments with similar requirements and saves a lot of administration time. For more information, see About Deployment Templates in Software Updates.

Update Lists

Update lists provide the ability to initiate a deployment for a set of software updates contained in the list. Using the update list provides several benefits when deploying and monitoring software updates and is, therefore, part of the recommended software updates workflow. Update lists allow administrators to create a deployment from the update list instead of manually selecting the set of updates every time a new deployment is created. They allow administrators to use reports for specific update lists to monitor the compliance for the software updates and help to troubleshooting updates contained in the list. Update lists also allow administrators to create update lists with approved updates, and then delegate the responsibility to deploy the update lists. For more information, see About Update Lists in Software Updates.

Network Access Protection

Network Access Protection (NAP) is a policy enforcement platform built into the Windows Vista and Windows Server 2008 operating system that allows you to better protect network assets by enforcing compliance with system health requirements.

Configuration Manager 2007 provides Network Access Protection as a new feature, which lets you include software updates in your system health requirements. Configuration Manager NAP policies define which software updates to include, and a Configuration Manager System Health Validator point passes the client's compliant or non-compliant health state to the Network Policy Server. The Network Policy Server then determines whether the client has full or restricted network access, and whether non-compliant clients will be brought into compliance through remediation.

For more information, see Network Access Protection in Configuration Manager.

Upgraded Administrators Do Not Have Access to New Software Updates Objects

After upgrading, the user who ran the upgrade has access to all of the objects in the Configuration Manager 2007 console but existing administrators have access only to objects that existed prior to upgrade. This is true even for software updates objects. Users who had full rights to all SMS 2003 software updates objects will have full rights to the same objects in Configuration Manager 2007 but will not have any rights to new software updates object types, such as update lists and deployment templates.

Software Updates Reporting

The predefined software updates reports and underlying software updates SQL Server views have been modified in Configuration Manager 2007 to work with the new software updates infrastructure. During a site upgrade, the Systems Management Server 2003 reports are migrated, but they might fail to run or retrieve the expected data. Most of the software updates reports use state messages sent from client computers, not hardware inventory results, to report on the state for compliance or for a process. Several new reports have been created to support software updates in Configuration Manager and are grouped in the following categories:

  • Software Updates - A. Compliance
  • Software Updates - B. Deployment Management
  • Software Updates - C. Deployment States
  • Software Updates - D. Scan
  • Software Updates - E. Troubleshooting
  • Software Updates - F. Distribution Status

For a complete list of the software updates reports, see About Software Updates Reports.

See Also

Concepts

About Software Update Deployment Packages
About Deployment Templates in Software Updates
About Software Update Deployments
About the Software Update Point
About the Software Updates Client Agent
About Update Lists in Software Updates
Administrator Workflows for Software Updates
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings
Planning the SMS 2003 Software Updates Upgrade
About Software Updates Reports
What's New in Configuration Manager 2007

Other Resources

Administrator Checklists for Software Updates
Overview of Software Updates
Planning for Software Updates


What's New in Software Metering for Configuration Manager

The software metering feature in Configuration Manager 2007 introduces a number of changes from the version found in Systems Management Server 2003.

The following section lists some new features found in Configuration Manager 2007 software metering:

Automatic Software Metering Rule Generation

Configuration Manager 2007 allows you to configure software metering to automatically generate disabled software metering rules from recent usage inventory data held in the Configuration Manager 2007 database. This feature can be configured so that only applications used on a specified percentage of computers will have metering rules created. You can also specify the maximum number of automatically generated software metering rules allowed on the site.

See Also

Concepts

Software Metering in Configuration Manager


What's New in the Configuration Manager Console

The administrator console has been updated for Microsoft System Center Configuration Manager 2007. Several key features now have home pages that summarize information about that feature, including graphs and reports that you can access from the home page.

The following section lists some new features in the Configuration Manager 2007 console.

Multithreaded Console Operation

In SMS 2003, the SMS Administrator console was single threaded and you could be blocked from completing actions in one snap-in while an action completed, so it was useful to connect multiple times to the same site in one MMC window and then switch between them as needed.

In Configuration Manager 2007 you can connect only one time to the same site in an MMC window, but because the Configuration Manager 2007 console is multi-threaded, it can perform several actions simultaneously, eliminating the need to switch when an action is running.

Drag and Drop

It is now possible in Configuration Manager 2007 to drag some objects to other objects. For example, you can drop a program onto a collection to create an advertisement. For more information, see About Drag-and-Drop Support in the Configuration Manager Console.

Administration Feature Pack Integration

The Transfer Site Settings Wizard and Manage Site Accounts tool were available as part of the Administration Feature Pack for SMS 2003 but in Configuration Manager 2007 they are installed by default.

To run the Transfer Site Settings Wizard

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and then click Transfer Site Settings.

    Note
    You can also start the wizard by right-clicking the Collections or Packages nodes.

After you have exported an XML file from the Transfer Site Settings Wizard, you can use the command line version of the Transfer Site Settings Wizard, Replstcfg.exe, to import or transfer settings to a different site. Replstcfg.exe is located in <ConfigurationManagerInstallDirectory>\AdminUI\bin.

Note
In Configuration Manager 2007 if you need to transfer settings to a site in an untrusted forest, you must either log on with an account that exists in both forests with the same user name and password, or you must export the settings from the first site and then import, but not transfer, the settings on the destination site. The user name and password options available in the SMS 2003 command line tool have been removed so it is no longer possible to transfer the settings to an untrusted forest with Replstcfg.exe.

You can use the Manage Site Accounts tool (MSAC.exe) through the command-line interface to quickly and easily update, create, verify, delete, and list user-defined Windows accounts for your Configuration Manager 2007 sites. The Manage Site Accounts tool is located in <ConfigurationManagerInstallDirectory>\AdminUI\bin.

Folder Replication

When you create a folder in a parent site, it automatically replicates to the child sites.

New Wizards for Object Creation

Several new wizards have been added to facilitate object creation.

See Also

Concepts

What's New in Configuration Manager 2007


Configuration Manager Planning and Deployment Overview

Successfully implementing Configuration Manager 2007 requires detailed planning. It is important that you understand the planning process. You must allocate appropriate resources to the planning phase. You must thoroughly research, document, and test your plan before you deploy Configuration Manager 2007. Proper planning can help you ensure the greatest return on your investment. You should not rush to implement management solutions, such as Configuration Manager 2007.

In This Section

Configuration Manager Preplanning Phase

This phase involves examining and documenting your current computing environment, determining your business and technical objectives, understanding risk, assembling project plan documentation, learning Configuration Manager 2007, and building your test lab in preparation for the pilot project.

Configuration Manager Planning Phase

In this phase, you fill in your project plan documents with details for your Configuration Manager 2007 hierarchy design, pilot project, Configuration Manager 2007 deployment, use of Configuration Manager 2007 features, and security and recovery plans.

Configuration Manager Deployment Phase

In this phase, you perform a pilot deployment, validate the design, deploy your Configuration Manager 2007 sites, configure security and site settings, build your hierarchy, and deploy the Configuration Manager 2007 client software in phases.

Configuration Manager Planning Checklist

Provides a checklist for planning the implementation of Configuration Manager.

Configuration Manager Deployment Checklist

Provides a checklist for deploying Configuration Manager.

Administrator Workflow: Planning and Deployment

Provides a workflow for planning and deploying Configuration Manager 2007 sites..

See Also

Concepts

Getting Started with Configuration Manager 2007


Configuration Manager Preplanning Phase

This phase involves examining and documenting the current computing environment, determining business and technical objectives, and building a test lab in preparation for the pilot project.

During preplanning, the following steps should be performed:

Analyze and document your current network and computing environment

  • Ensure that you have a thorough understanding of your computing environment, and supporting documentation, before making planning decisions for your Configuration Manager deployment.
Analyze your needs and identify objectives

  • You need to understand exactly what your business and technical needs are and how Configuration Manager features can help you accomplish them.
Establish a test lab environment

  • Installing Configuration Manager 2007 in a production environment without first testing it on an isolated network can cause undesirable and potentially damaging results. A test lab should be used in all phases of Configuration Manager deployment, from preplanning to day-to-day operations, after fully deploying your Configuration Manager hierarchy.

Analyze and Document Your Current Environment

A thorough understanding of your computing environment helps you determine the scope of your Configuration Manager 2007 implementation project. Having accurate information about your physical network infrastructure and the issues that influence your network operations is critical to many of the decisions you make as you plan your Configuration Manager 2007 deployment.

For example, network topology greatly influences the locations, types, and number of Configuration Manager 2007 sites and site servers that will need to be deployed.

To optimally design your Configuration Manager 2007 site and site hierarchy, it is essential that you create detailed documentation of your computing environment. For an overview of the type of data you can collect, refer to the following table. As you examine your environment, review how Configuration Manager 2007 integrates into existing operational processes and the effect it will have on existing operational roles and responsibilities. Also, be sure to anticipate and track any proposed infrastructure changes.

Environment | Data needed
Previous installations | The history of your organization’s systems management solutions
Current installations | List of any existing software distribution, software update management, or other system management product currently in use
Geographic profile | Diagram of the geographic locations of your organization’s sites, including information about international operating system languages and time zones
Organizational structure | Diagram of the divisions or departments within your organization and their associated managing and reporting structures
Network topology | Diagram of your network infrastructure, including LAN and WAN architecture, physical topology, network size, bandwidth, usage, traffic patterns, network protocols, and subnets
Client environment | The number of clients at each location, software applications and operating systems in use (including logon scripts, if applicable), client mobility, and type of network connectivity (dial-up, wireless, LAN-connected)
Active Directory site structure | Diagram of the forests, domains, and Active Directory sites in your Active Directory site structure and organizational unit information for later use in Configuration Manager 2007 operations. Pay particular attention to the IP subnets defined for each Active Directory site
Server environment | Diagram of the locations of the core servers on your network, indicating their primary functionality and operating system version level (domain controllers, servers running Terminal Services, file servers, Web servers, DHCP, WINS, and DNS servers)
Security | Documentation containing your security settings, including Windows security groups, Administrator and Domain Administrator accounts, client lockdown levels, shared folder access restriction policy, account policies, account control needs, and sensitivity to security risks
Information Technology (IT) organization | Knowledge of your IT organization, the support areas defined for IT staff members, what the management control policies are and any policies that play a part in the success of the organization’s infrastructure projects

You can use the Configuration Manager Preplanning Worksheets to help collect and document this information.

Analyze Your Needs and Identify Objectives

Having a clear understanding of how you want to install and modify Configuration Manager 2007 to suit your business and technical needs is an integral part of the preplanning process.

For example, reducing the cost of software upgrades and simplifying hardware asset tracking are typical business objectives. A technical objective might be migrating from a Windows 2000 Server domain structure to a Windows Server 2003 domain structure or upgrading the operating systems currently running on workstations.

It is important to understand what you need, want, and expect from Configuration Manager 2007. A core requirement that is often stated is to distribute software, but what exactly does this mean? Which software, how often is it to be distributed, and to how many computers? What size are the application files, where are the destination computers located, and are there any language-related issues? Will software package installations be optional, mandatory, or a combination of both? The answers to these questions can have a significant impact on your design.

Identify Requirements

To establish business objectives, you must first gather specific information about your organization. This helps you determine which Configuration Manager 2007 features you want to use.

Use your organizational charts and the following table to create a list of requirements. Map each requirement to the Configuration Manager 2007 feature that you will use to meet that need. This table is meant as an example of how you can map a business requirement to a Configuration Manager 2007 feature. In many cases, you might not find a clear one-to-one map of a business requirement to a feature, and in some cases, a business requirement can map to many features.

Business Requirement | Configuration Manager Features
Configuration management Track hardware and software assets for auditing purposes and identify computers that require upgrading or replacing. | Hardware and software inventory Reporting
Allow management to view reports on current computer assets and compliance from any computer that has a Web browser. | Reporting
Centrally administer client reporting across products that can use Active Directory® Domain Services. | Active Directory discovery
Group computers so that they can be most efficiently managed as a unit. | Active Directory site boundaries Collections
Centrally deploy and manage software releases and license compliance. | Software distribution Reporting
Conserve bandwidth on slow and expensive communication links. | Delta replication
Manage computers that are on the Internet without installing and managing a virtual private network. | Internet-based client management
Compare usage of software programs against license agreements, and reconcile where necessary. | Software metering Reporting
Provide the help desk with tools to remotely diagnose and resolve computer problems. | Remote Tools Hardware and software inventory Reporting
Install Windows Vista on all new computers using corporate builds. | Operating system deployment
Decrease security risks associated with workstations operating with local administrator accounts by upgrading existing computers to Windows Vista and retaining user files and preferred settings. | Operating system deployment
Decrease support calls and stay within Service Level Agreements by proactively identifying computers that are out of compliance with best practice configurations specified by Microsoft and other vendors. | Desired configuration management
Identify "configuration drift" on production servers before it affects performance and up-time. | Desired configuration management
Audit computers for a regulatory security policy. | Desired configuration management
Reduce the risk of a security attack by keeping computers up-to-date with important security-related software updates. | Software updates
Help preserve the integrity of the network by preventing computers from accessing network resources until they have mandated software updates. | Network Access Protection
Reduce electricity costs by turning off computers at night but have the ability to wake them up for essential management tasks. | Wake On LAN

It is recommended that you list your requirements in order of priority. In situations where time is limited, the design effort must first focus on the essential requirements to ensure that key functionality is delivered. On time-limited projects, it is still important to be aware of lower priority issues, because a design that is based on only the essential requirements might prevent the implementation of other deliverables.

In accordance with Microsoft Solution Framework best practice, requirements should be

  • Specific
  • Measurable
  • Achievable
  • Results-oriented
  • Time-specific

The metrics to measure success must be known and achievable within the allowed time, budget, and other constraints. Following this guideline assists you in establishing and tracking project milestones.

Assessing Time and Budget Allotments

When you are determining your requirements, assess the amount of money and time that can be allocated for the project.

Expenses for the project can potentially include software licensing, IT staff salaries, training costs, and hardware procurement or upgrades. Identify how much money you can afford to spend on the project before you finalize your Microsoft System Center Configuration Manager 2007 hierarchy design or hire additional staff.

Knowing when you and your team must complete the project is relevant to how much work can be accomplished. It is recommended that you not move forward with planning your Configuration Manager 2007 deployment until you establish the length of time that can be dedicated to the project.

After each phase of the project, it is a good idea to review any changes in budget and time allotments and whether these allotments are appropriate for the expected scope of the project.

Establish a Test Lab Environment

Set up a test lab on an isolated network in your organization. Do not set up your test lab in your production environment, and do not install Configuration Manager 2007 on any of your production servers before you install it and work with it in your test lab. Installing Configuration Manager 2007 in a production environment without first testing it on an isolated network can cause undesirable and potentially damaging results. Later, during the deployment planning stage, you should design a pilot project in your production environment for further testing.

Note
If your test lab uses the same Active Directory forest as your production network, then do not use the same site codes in your test lab as you do in production. If you use the same site codes in both the test lab and the production network, it is possible for Configuration Manager 2007 clients in production to be incorrectly directed to Configuration Manager 2007 sites in the test lab, and for Configuration Manager 2007 clients in the test lab to be directed to Configuration Manager 2007 sites in the production environment.

Use the test lab to perform tests throughout the following steps of the planning phase:

  • Designing the Configuration Manager 2007 hierarchy
  • Planning the deployment and site configuration
  • Planning your security strategy
  • Planning for backup and recovery

Also, use the lab to perform tests throughout the following steps of the deployment phase:

  • Deploying the hierarchy
  • Deploying Configuration Manager 2007 clients

Maintain your lab for post-deployment testing.

Developing the Test Lab

Your test lab computers must use at least the minimum recommended configuration required for their Configuration Manager 2007 site system roles. The computers must contain configurations that are representative of those in your organization.

Before you deploy Configuration Manager 2007, even in a pilot, you need to test your proposed design in an environment that simulates and protects your production environment. It is critical to the success of your deployment to develop an environment specifically for testing. In this test environment, you can test hardware, operating systems, or applications designed to run together before introducing them into your production environment.

Minimum Recommended Configuration

Lab computers must meet the minimum recommended configuration for the roles they perform in Configuration Manager 2007. For example, ensure that your Configuration Manager 2007 site servers and site systems have the minimum system requirements specified in the Configuration Manager Supported Configurations document.

Standard Configurations

If your organization has standard client and server configurations, use those configurations in the lab. If it is possible, use the same hardware, software, network connectivity, and logon scripts that are used in your production environment. For example, if your production environment includes computers with nearly full disks, obsolete and possibly unused software, and an assortment of network adapter cards, ensure that your lab computers have the same characteristics.

Duplicating Network Conditions

If production networks are connected by routers or slow links, be sure to duplicate those conditions in the lab. This approach ensures that design concerns can be identified and resolved in the lab rather than during deployment.

Creating a Representative Test Environment

For the test results to be useful, ensure that the lab environment reflects your production environment as closely as possible. Use the network diagram you created at the beginning of preplanning to help you create a representative test environment. Add at least one client for each client platform that you plan to support.

Include a representative of each type of site system role, server, and client that will exist in your full Configuration Manager 2007 hierarchy. Also, the network link connecting these objects should mirror the network speed and availability in production.

Your hierarchy should contain a central site and a representative number of child primary sites and secondary sites. Include desktop and mobile clients that are based on the standard configurations of your organization. Your test data might be distorted if you create a test environment that contains computers that have only fast processors and a lot of memory, instead of less powerful, smaller computers in the hierarchy. You can gain valuable information by analyzing how your planned Configuration Manager 2007 hierarchy functions in your network as it exists today, including any outdated computers and obsolete applications.

The closer your test installation resembles your actual network design and hardware, the more valuable your results are as you plan the deployment of Configuration Manager 2007 throughout your organization. In your test lab, install all applications that are in use in the production environment so that they are available for application compatibility testing.

During testing and the pilot project, test and refine your project plan documentation regarding support and deployment. As you plan your Configuration Manager 2007 hierarchy design, you might need to add more servers or clients to your test environment, depending on your needs as the planning progresses.

Maintaining the Test Lab

After deploying Configuration Manager 2007, keep your test lab intact. Use it for future testing of Configuration Manager 2007 service pack installations, proposed site changes, software distribution scenarios, and other Configuration Manager 2007 activities. For example, you should test each software package in your test lab before you distribute it in your production environment. Continually update your test lab environment as your production environment changes. By maintaining this test lab throughout the life of Configuration Manager 2007, you will always have an isolated Configuration Manager 2007 hierarchy for testing purposes.

Because the test lab represents your production environment, it is ideal for performing periodic recovery tests. This helps you identify shortcomings in your backup and recovery plan.

See Also

Concepts

Configuration Manager Preplanning Worksheets

Other Resources

Configuration Manager Planning and Deployment Overview


Configuration Manager Preplanning Worksheets

The worksheets in this section can help you to prepare to plan for deploying and configuring Configuration Manager sites and clients.

In This Section

Organizational Data Preplanning Worksheet

Information Technology Organization Preplanning Worksheet

Geographic Profile Preplanning Worksheet

Active Directory Preplanning Worksheet

Network Topology Preplanning Worksheet

Server Environment Preplanning Worksheet

Client Environment Preplanning Worksheet

Security Preplanning Worksheet

See Also

Concepts

Configuration Manager Preplanning Phase


Organizational Data Preplanning Worksheet

It is important that you know the structure of your organization, because it can influence how you deploy, use, and support Configuration Manager 2007. It is also useful to know your organization’s long-term plans. Changes such as mergers and acquisitions can have a significant impact on IT infrastructure. Both external pressure for change and internal projects (either planned or in progress) can affect your Configuration Manager 2007 deployment.

Use the following guidelines to assist in preplanning tasks.

Organizational structure Example data needed, where applicable, and by location Collected Data

Departmental organization

You should consider including the following information:

  • High-level organization charts to help determine the divisional structure of your organization, the design of your Configuration Manager 2007 hierarchy, and your method of communicating Configuration Manager 2007 implementation updates to departments
  • Organizational structure
  • Reporting hierarchy
  • Communications methods
  • Service level agreements (SLAs)

IT organization and administrative policies

You should consider the following factors:

  • The structure and technical level of local and remote IT divisions, their reporting hierarchies, and local and global IT administrative policies
  • Organizational structure
  • Reporting hierarchy
  • Local administrative policies and SLAs
  • Global IT administrative policies and SLAs

Long-term business direction

Any major business changes planned for the future, such as mergers, acquisitions, major physical moves, or network migrations

See Also

Concepts

Configuration Manager Preplanning Worksheets


Information Technology Organization Preplanning Worksheet

It is important to determine your personnel resource needs and to assign project roles when planning your Configuration Manager 2007 deployment. To do this, you first must have an understanding of your current Information Technology (IT) organization. You need this information during your Configuration Manager 2007 preplanning, planning, and deployment phases, and also for post-deployment operational tasks.

Understand the structure of the IT staff in your organization. For example, you might have one centralized IT group with members in close communication. Or you might have many decentralized groups where communication is not optimal. Is there a central headquarters with IT responsibility, or many separate organizational units with widely varying goals and philosophies?

Use the following guidelines to assist in preplanning tasks.

IT organization | Example data needed, where applicable, and by location | Data collected
IT Organization | Collect information about your IT organization. You should also create an organization chart that maps your IT organization to your geographic profile. |
 | IT reporting hierarchy. |
 | IT departmental divisions that produce an overlap in Configuration Manager 2007 tasks (for example, a department separate from the Configuration Manager team manages all database servers, including computers running Microsoft SQL Server) |
 | Points where management control or policy issues exist. |
 | Level of technical sophistication and security clearance of IT staff members who will be working with Configuration Manager 2007 before, during, or after deployment. |
 | Auditing policies. |
 | Service level agreements for departments, end users, and IT groups. |
 | Operating systems used to support the network and end users. |
 | Sensitivity to security risks. |
 | Change control policy. |

See Also

Concepts

Configuration Manager Preplanning Worksheets


Geographic Profile Preplanning Worksheet

It is important to know the geographic profile of your organization because it affects your Configuration Manager 2007 hierarchy design. Many organizations have a central location (headquarters) with branch offices located in other regions (remote sites). Organizations that have locations in different cities will probably have one or more Configuration Manager 2007 sites in each of those cities. Also, date and time zone differences can affect how software is distributed to different locations.

Use the following guidelines to assist in preplanning tasks.

Geographic information Example data needed, where applicable, and by location Collected Data

Date and time zone information
  • List the time zone for each location, and list any date and time difference between the remote site and headquarters.
  • Time zone.
  • Date and time differences.

Operating systems and international operating system versions

List the operating systems in use and locations that use language versions that are different from those of your platform operating systems.

See Also

Concepts

Configuration Manager Preplanning Worksheets


Active Directory Preplanning Worksheet

When planning your Configuration Manager 2007 hierarchy design, consider your Active Directory logical layout (hierarchical forest arrangement and domain structure) and its physical structure (Active Directory site topology). An Active Directory site is defined as one or more well-connected TCP/IP subnets. A well-connected TCP/IP subnet has a fast, reliable network connection.

Document your physical Active Directory structure and domain structure before you begin the planning phase. Later, when planning your Configuration Manager 2007 deployment and configuration, become familiar with the more granular details of the logical structure, such as organizational units, because these can help determine how you organize collections, distribute software, and perform queries in Configuration Manager 2007.

Use the following guidelines to assist in preplanning tasks.

Active Directory preplanning | Example data needed, where applicable, and by location | Data collected
Logical Structure | The logical structure of your organization is represented by the following Active Directory components: organizational units, domains, trees, and forests. |
Physical Structure | The physical structure of your organization is represented by the following Active Directory components: Active Directory sites (physical subnets) and domain controllers. |

See Also

Concepts

Configuration Manager Preplanning Worksheets


Network Topology Preplanning Worksheet

Create high-level diagrams of your network topology that include any available information listed in the worksheet. The larger or more complicated your network topology, the more diagrams you will need. Later, after you make decisions about your Configuration Manager 2007 site structure and site system hardware requirements, you can determine whether any equipment upgrades or additions are necessary before your Configuration Manager 2007 deployment.

Network diagrams are also helpful when you create a representative test environment for a test lab or pilot project. Ensure that your network diagram is detailed and specific. If your network is large or complex, consider creating a similar but separate diagram for your domain structure and server topology.

Use the following guidelines to assist in preplanning tasks.

Network topology | Example data needed, where applicable, and by location | Data Collected
High-level WAN/LAN architecture | Links, gateways, firewalls, extranets, virtual private networks, and perimeter networks |
Network size | Number of servers and clients at each location |
Network bandwidth | Link speeds and available bandwidth, including any known bandwidth issues |
Network usage and traffic patterns | Categorize as Light, moderate, or heavy, and note times of day when network usage is heaviest (peak times) and scheduled times for backup and maintenance (nonpeak times) |
Network types | Windows NT, Windows 2000, or Novell NetWare and other third-party network operating systems |
Network protocols | TCP/IP, IPv6, NetBEUI, IPX/SPX, AppleTalk, DLC, and so on, and name resolution methods such as DNS and WINS |
IP subnet structure | The Internet Protocol (IP) subnets on your network by subnet ID |
Active Directory site structure | Active Directory organizational units, site names, trees, and forest |

See Also

Concepts

Configuration Manager Preplanning Worksheets


Server Environment Preplanning Worksheet

Use the following guidelines to assist in preplanning tasks.

Server Example data needed, where applicable, and by location Data collected

Location and function

Document the location and function of the computers that run the core services of your network, such as global catalog servers, domain controllers, DNS and WINS servers, Internet Information Services (IIS) servers, computers running Microsoft SQL Server or Terminal Services, Microsoft Exchange servers, print servers, and file servers.

Naming conventions

Document current naming conventions for products you use with Configuration Manager 2007, such as computers running Windows Server 2003 and SQL Server. This helps you establish and document naming conventions for Configuration Manager 2007 hierarchy elements. These elements include sites, site codes, servers, and the objects that are used by or created in the Configuration Manager console. Because the Configuration Manager site code is used to uniquely identify each Configuration Manager site, it is especially important that these codes be assigned and tracked by the Configuration Manager central site administrators.

Hardware, software, network

Document hardware, software, and network information for each server that might be assigned a site role in your Configuration Manager site hierarchy.

For example, you should document at least the following information from each server that will be part of your Configuration Manager 2007 hierarchy:

  • Processor type and speed
  • Amount of RAM installed
  • Disk and array controller configuration and characteristics, including size, MB of cache, and the drive models and types (for example, ultra-wide SCSI, 18 GB, 7200 RPM)
  • Platform operating system, version, and language
  • Whether the Windows Cluster service or Windows Network Load Balancing Service is enabled
  • Relevant software applications located on servers, including antivirus software

See Also

Concepts

Configuration Manager Preplanning Worksheets


Client Environment Preplanning Worksheet

Where applicable, include client information in your network diagram. This type of information can help you determine whether your client operating systems must be upgraded before deploying Configuration Manager 2007, the scope of your Configuration Manager 2007 client deployment, and which discovery and Configuration Manager 2007 client installation methods you will employ.

It is important to gather client information so that you are prepared for interoperability and connectivity issues that might prevent proper Configuration Manager 2007 client software installation. For example, suppose that all members of the Contoso Pharmaceuticals sales group use laptops. Some laptops run Microsoft Windows 98 (which is not supported as a Configuration Manager 2007 client), and others run Windows XP Professional. Sales members travel frequently from one location to another and use a special remote access application to access the sales database located at headquarters.

The Contoso Pharmaceuticals marketing group, however, uses desktop computers running Windows Vista. Although they do not travel, the marketing members have home computers that they use to remotely connect to the corporate network over a virtual private network (VPN).

Use the following guidelines to assist in preplanning tasks.

Clients | Example data needed, where applicable, and by location | Data collected
Number of clients | Total number of client computers in use on your network, and the physical and logical groupings of clients. |
IP subnet size | Number and types (operating systems) of client computers on each IP subnet, including projected number of clients in the upcoming year. |
Logon scripts | Whether or not users use logon scripts, and if those scripts are customized. Note file name and location of each script, and users and groups associated with each script. |
Security rights | Desktop security rights granted to end users |
Operating systems | Platform operating systems (including language version) in use on each IP subnet (Windows 98 and later can become Systems Management Server [SMS] 2003 clients), and the locations of Macintosh and UNIX computers (unsupported as SMS clients). |
Client stability/mobility | Computers that are shared by multiple users, those that travel from one location to another, all home-based client computers having remote access to the network, and any other client computer environments. |
Software | A database or spreadsheet of all major applications in use in the enterprise, categorized by organizational division or by IP subnet. |
Special applications | Divisions or departments that use Windows Terminal Services to run applications, or use other special applications, such as internally manufactured or obsolete applications. |
Connectivity | Types of connectivity different organizational groups are using, including remote client connection speeds (dependent on the remote access method in use, such as ADSL, wireless, dial-up, ISDN, or other). |

See Also

Concepts

Configuration Manager Preplanning Worksheets


Security Preplanning Worksheet

Use the following guidelines to assist in preplanning tasks.

Security Example data needed, where applicable, and by location Data collected

Security policies

Collect information about your organization’s security policies, such as the following:

  • Account password policies
  • Account cycling policies
  • Account rights policies
  • Client and server lockdown policies (restrictions on disks and registry, services that are stopped, whether services use Domain Administrator accounts, and hidden shared folders that are removed)
  • Auditing policies

Separation of or delegation of duties between IT divisions within the enterprise.

The degree to which users must retain control of clients, and any exceptions to such policies (such as servers, or computers used by programmers).

You should collect information about how security-related issues will be handled and supported, such as the following information:

  • Sensitivity to security risks
  • Importance of ease of administration
  • Special needs you have for secure data access and transmission
  • Service level agreements (SLAs) for applying security updates

See Also

Concepts

Configuration Manager Preplanning Worksheets


Configuration Manager Planning Phase

Topic last updated -- November 2007

In the planning phase, you plan the Configuration Manager 2007 hierarchy design and create a Configuration Manager 2007 project deployment plan and schedule.

During this phase, you should plan how your Configuration Manager 2007 site will be configured and determine how you will use Configuration Manager 2007 features to support your business and technical objectives defined in the preplanning phase. When planning how the Configuration Manager 2007 site and features will be configured, you should also plan for security, backup and recovery operations. As you perform these steps, test configuration variations and deployment scenarios your test lab environment.

Create a Deployment Project Plan and Schedule

When creating a project plan and schedule, consider the following:

  • Include all tasks. Don't assume anything.
    Include explicit recurring tasks for such items as project status reporting, team meetings, and other similar organizational and communications activities. If they are not included, they either will not take place or will impact the schedules of fully committed resources.
  • Define start and end dates for all tasks and steps in the process.
    This level of detail is important in measuring project progress and making mid-course adjustments to avoid delays. Microsoft Project can help you devise and track the schedule.
  • Prioritize tasks.
    Identify critical paths and sequences. For example, if you need to purchase equipment or software for the lab, the orders must be placed so that the equipment is available when the team is scheduled to set up the lab.
  • Schedule regular project reviews and assessments.
    This lets you fine-tune the schedule or the allotted resources, as necessary, before delays are propagated throughout the process. If things go more quickly than expected, it lets you take advantage of the extra time.
  • Plan ahead.
    Look ahead at the tasks to be completed. Think about what must be done next. Consider what might stand in the way.
  • Be flexible.
    A 100 percent accurate project plan might not be feasible at this point. Expect to revise the plan based on the information and experience gained during the lab and pilot testing tasks.

Recommended Planning Phase Considerations

It is recommended that you consider the following when creating your Configuration Manager 2007 deployment project plan.

Active Directory Planning

A single Configuration Manager 2007 site can span multiple domains within a single Active Directory forest or even multiple Active Directory forests.

Security Planning

By properly securing your management systems, you help to ensure that unauthorized persons cannot use your management systems to access or disable your organization’s computers.

Discovery Planning

You should plan for which discovery methods you will enable for your Configuration Manager 2007 sites.

Client Installation Planning

You must determine which client installation methods you will enable for your Configuration Manager 2007 sites.

Client Agent Settings Planning

Client agent settings are generally site-specific. They apply to all clients within a site.

Site Planning

You should consider the design of each Configuration Manager 2007 site or Configuration Manager 2007 site hierarchy if you will have more than one site within your organization.

Site System Planning

You should also plan to determine which site system roles you need to enable, and which servers within your site you should assign those site system roles to.

Boundary Planning

Computers are assigned as clients to Configuration Manager 2007 sites according to the site boundaries you configure in the Configuration Manager console.

Backup and Recovery Planning

This early stage of your Configuration Manager 2007 deployment, is the perfect time to consider backup and recovery requirements

Planning Guides

You can use the Configuration Manager Planning Worksheets to help you make decisions about your deployment.

Active Directory Planning

Managing Configuration Manager Sites Across Multiple Forests

A single Configuration Manager 2007 site can span multiple domains within a single Active Directory forest or even multiple Active Directory forests. Be aware of limitations across forests and considerations in the following areas when you design your Configuration Manager 2007 hierarchy.

For more information about planning for Configuration Manager 2007 sites in multiple Active Directory forests, see Configuration Manager in Multiple Active Directory Forests.

Security Planning

Computer management systems such as Configuration Manager 2007 are powerful systems, and they often involve many, if not all, of the computers in an organization. It is critical that the security of your management systems does not become compromised. By properly securing your management systems, you help to ensure that unauthorized persons cannot use your management systems to access or disable your organization’s computers.

For information about Configuration Manager 2007 security best practices, see Best Practices for Maintaining Configuration Manager Security.

Discovery Planning

You should plan for which discovery methods you will enable for your Configuration Manager 2007 sites. You can choose different combinations of discovery methods to locate resources. The discovery method you use determines the type of resources discovered and which Configuration Manager 2007 services and agents are used in the discovery process. A computer does not automatically become a Configuration Manager 2007 client through discovery. Depending on how you plan to use Configuration Manager 2007, you can choose to perform discovery without performing installation, or vice versa.

For more information about planning Configuration Manager 2007 discovery methods, see Configuration Manager Discovery Planning.

The Discovery Planning Worksheet can also help you identify which discovery methods you should plan for.

Client Installation Planning

You must determine which client installation methods you will enable for your Configuration Manager 2007 sites. Although this step might seem out of place as you plan for deploying a Configuration Manager 2007 site, you will need to know where your potential clients are located, and what type of Configuration Manager 2007 client they might be before you deploy a Configuration Manager 2007 site. In fact, information about your clients might affect your decision about the number and location of your Configuration Manager 2007 sites.

The client planning flowcharts help you identify which Configuration Manager 2007 client software is applicable to the computers or devices that you want to manage. There is no single preferred solution or best practice for choosing a client installation method. You must decide which method or combination of methods works best within your organization.

You should also complete the Client Installation Planning Worksheet.

Client Agent Settings Planning

Client agent settings are generally site-specific. They apply to all clients within a site. Understanding which client agents and client agent settings you need to apply to which clients can help you determine the number of Configuration Manager 2007 sites you might need to deploy.

Use the Client Agent Planning Worksheet to help you identify the client agents and client agent settings you plan to enable for clients within your Configuration Manager 2007 sites. If there are groups of clients within your site that require unique settings, you might need to accommodate those clients by assigning them to a different site or deploying a site specifically to manage those clients.

Site Planning

You should consider the design of each Configuration Manager 2007 site or Configuration Manager 2007 site hierarchy if you will have more than one site within your organization. The Site Planning Worksheet can help you identify the number of sites you need for managing the clients in your organization, the subnets or Active Directory sites associated with those sites, and the site names and site codes you plan to assign to those sites.

For more information about site names and site codes, see Configuration Manager Site Naming.

Site System Planning

You should also plan to determine which site system roles you need to enable, and which servers within your site you should assign those site system roles to. A Configuration Manager 2007 site system is a server that provides Configuration Manager 2007 functionality to the site. The functionality contributed by a site system is indicated by its assigned site system roles, which are tasks that a site system performs in a Configuration Manager 2007 site.

For example, the management point role provides a communication point between the Configuration Manager 2007 site and its clients. A computer hosting the management point role is a site system. The Configuration Manager 2007 administrator can assign site system roles to the primary site server or distribute them among several different site systems. You can assign some site system roles during installation, and other site system roles through the Configuration Manager console.

Fore more information about planning Configuration Manager 2007 site systems, see Configuration Manager Site System Planning.

The Site Systems Planning Worksheet can help you identify what site systems you must enable for each site and identify the planning considerations for each site system.

Boundary Planning

Computers are assigned as clients to Configuration Manager 2007 sites according to the boundaries configured in the Configuration Manager console. Boundaries can be defined by IP subnets, Active Directory site names, IPv6 Prefix, or IP ranges.

Consequently, an essential part of the deployment planning process is determining the appropriate boundaries for your Configuration Manager 2007 site. Use the Boundaries Planning Worksheet to help you identify and organize possible Configuration Manager 2007 boundaries.

Boundaries are used to assign clients to a site. They are not used to specify which computers are assigned site system roles for the site. Configuration Manager 2007 site server systems do not have to be located within a site’s boundaries. Configuration Manager 2007 Clients are able to communicate with site server systems that are members of another site in the Configuration Manager 2007 hierarchy.

Fore more information about planning for Configuration Manager 2007 boundaries, see Planning Configuration Manager Boundaries.

Important
Overlapping boundaries can produce undefined results in Configuration Manager 2007. Assign clients to only one Configuration Manager 2007 site.

Backup and Recovery Planning

This early stage of your Configuration Manager 2007 deployment, is the perfect time to consider backup and recovery requirements, to develop a recovery plan, and to incorporate backup and recovery preparation into your Configuration Manager 2007 deployment plan.

A site recovery is a complex process, and it is recommended that you plan ahead and be prepared. This helps you in the following ways:

  • You minimize the risk of failure in your site.
  • You minimize the impact of a failure on your site, if it occurs.

You should plan to simplify the recovery process, reduce the time of the recovery process, and minimize data loss, in the event of failure.

For more information about planning for backup and recovery, see Planning for Backup and Recovery.

See Also

Concepts

Configuration Manager Planning Worksheets

Other Resources

Configuration Manager Planning and Deployment Overview


Configuration Manager Planning Worksheets

The worksheets in this section can help you to prepare to plan for deploying and configuring Configuration Manager sites and clients.

In This Section

Active Directory Planning Worksheet

Discovery Planning Worksheet

Boundaries Planning Worksheet

Site Planning Worksheet

Site Planning Summary Worksheet

Site Systems Planning Worksheet

Site Systems Planning Summary Worksheet

Configuration Manager Console Planning Worksheet

Client Installation Planning Worksheet

Client Agent Planning Worksheet

See Also

Concepts

Configuration Manager Planning Phase


Active Directory Planning Worksheet

Use the following guidelines to assist in planning tasks for Configuration Manager 2007.

Site Planning Considerations

This planning worksheet is used to identify and plan for Active Directory planning considerations.

Use the following guidelines to assist in planning tasks.

Active Directory Planning | Example Data Needed, Where Applicable, and by Location | Collected Data
Do you plan on using your Active Directory Sites to define your Configuration Manager 2007 boundaries? | If yes, list the Active Directory sites that you will use. |
Do you plan on extending your Active Directory schema for Configuration Manager 2007? | If yes, determine whether you have the appropriate permissions to extend the schema. |
Do you need to manage Configuration Manager 2007 sites across multiple forests? | If yes, be aware of limitations across forests. |

See Also

Concepts

Configuration Manager Planning Worksheets
Choose Configuration Manager Boundaries
Decide If You Should Extend the Active Directory Schema


Discovery Planning Worksheet

Topic Last Updated—August 2008

It is recommended that you familiarize yourself with the discovery methods and their settings by reading Configuration Manager 2007 online help before completing this worksheet.

Use the following guidelines to assist in planning tasks.

Discovery planning Example data needed, where applicable, and by location Collected Data

Active Directory System Discovery. Active Directory System Discovery retrieves details about the computer, such as computer name, Active Directory container name, IP address, and Active Directory site. It generates a DDR for each computer it discovers in Active Directory.

Active Directory container and location (local domain, local forest, custom LDAP or GC query) Polling schedule

Active Directory System Group Discovery. Active Directory System Group Discovery works only for systems that are already discovered and assigned to the local primary site and any direct child secondary sites. Active Directory System Group Discovery is not available for secondary sites. If a resource has been discovered and is assigned to the sccmshortname site, Active Directory System Group Discovery extends other discovery methods by retrieving details such as organizational unit, global groups, universal groups, and nested groups.

Active Directory container and location (local domain, local forest, custom LDAP or GC query) Polling schedule

Active Directory User Discovery. The Active Directory User Discovery method discovers users and the user groups of which they are members. Active Directory User Discovery returns more information from Active Directory domains than Windows User Account Discovery or Windows User Group Discovery and it continues to work with those domains when you switch them to native mode.

Active Directory container and location (local domain, local forest, custom LDAP or GC query) Polling schedule

Network Discovery. The Network Discovery method can be configured to discover the topology of your network, as well as potential client computer information. By querying specified network routers, network discovery retrieves information about the network topology and routers in use. Using discovered router information, or specified Microsoft DHCP server IP address lease information, network discovery can also discover potential client computer information such as IP address and operating system version.

Note
Topology information collected depends on the number of router hops specified on the SNMP tab of network discovery properties. If you have a large network, you might want to limit the number of router hops searched to reduce your network traffic. A maximum of 5000 potential clients per discovery is recommended

In Configuration Manager 2007 SP1 sites with the out of band service point installed, management controllers for out of band management can also be discovered. For more information, see How to Discover Computers with Management Controllers.

Type of Discovery (Topology, Topology and client, Topology, client, and client operating system), IP subnets to search, and Microsoft DHCP server names to query.

See Also

Concepts

Configuration Manager Planning Worksheets


Boundaries Planning Worksheet

Computers are assigned as clients to Configuration Manager 2007 sites according to the boundaries configured in the Configuration Manager console. Boundaries can be defined by IP subnets, Active Directory site names, IPv6 Prefix, or IP ranges.

Use the following guidelines to assist in planning tasks.

Boundary Type | Example data needed, where applicable, and by location | Collected Data
IP subnet | What subnets will you assign as site boundaries for this site? |
Active Directory site name | What Active Directory sites will you use as site boundaries for this site? |
IPv6 prefix | What IPv6 prefixes will you use as boundaries for this site? |
IP range | What IP ranges will you use for this site? |

See Also

Concepts

Configuration Manager Planning Worksheets


Site Planning Worksheet

Use the following guidelines to assist in planning tasks for Configuration Manager 2007.

Site Planning Considerations

This planning worksheet is used to identify the number of sites you require to manage the computers in your organization, the subnets or Active Directory sites associated with those sites, and the site names and site codes you plan to assign to those sites.

Site Planning Consideration | Example Data Needed, Where Applicable, and by Location | Collected Data
Microsoft recommends that you install a Configuration Manager 2007 site only in a well-connected network. Usually well-connected networks correspond to geographic locations. Assume you will have one site per well-connected network for planning purposes. However, be prepared to modify this number as you collect more information about your organization. | Identify the number and location of well-connected networks you have in your network. |
Remote subnets may be too small to support their own Configuration Manager 2007 site. It is recommended that these subnets be included in the boundaries of a nearby well-connected network. | If you have any remote subnets that are too small to be Configuration Manager 2007 sites, list those IP subnets and the closest well-connected network to each. |
Client agent configuration settings are site specific and apply to all Configuration Manager clients in the site. If you will have groups of clients within a proposed site or well-connected network that require different client agent settings, you will require a separate site for each set of different client agent settings. | Identify the clients whose agent settings vary, and the IP subnets that those clients are on, and plan additional Configuration Manager 2007 sites for each unique group of client agent settings. |
It is recommended that the central site in your Configuration Manager 2007 hierarchy not have any clients assigned to it. | Provide the name and site code of the central site if it will not have clients assigned to it. |
It is recommended that you consider a separate Configuration Manager 2007 site for each language version you need to support. | If you need to accommodate different client or server language versions, indicate the number of sites affected, and the language versions, and provide names and site codes for each Configuration Manager 2007 site. |
When you upgrade from SMS 2003 and have existing SMS clients that you need to migrate to Configuration Manager 2007, you might need to implement a holding site which will remain running SMS 2003 until all clients can be upgraded to Configuration Manager 2007 clients. | Identify the names and site codes of any holding sites you have implemented. |
A Configuration Manager 2007 site can manage up to 25,000 clients when using a single management point, and up to 100,000 clients when using multiple management points configured through Network Load Balancing (NLB). However, the true number of clients that a Configuration Manager 2007 site can manage depends also on the hardware configuration and performance constraints of the Configuration Manager 2007 site server. | Do you need to configure additional sites to accommodate the number of clients you need to manage? If so, identify the number of sites you require, a logical method of grouping the clients (by IP subnet or Active Directory site, perhaps), and provide a name and site code for each site. |
As a best practice for security, it is recommended that you have as few sites as possible. | Review the data collected in this worksheet and determine whether you can consolidate sites without unduly compromising features, network performance, and server performance. Indicate the final working number of sites in the last cell of this worksheet row. |

Primary and Secondary Site Planning

Use this portion of the Site Planning Worksheet to help you determine whether your site should be a primary or a secondary site. Repeat this section for each site you identified above, and record your results in the Site Planning Summary worksheet.

Planning Question | Example Data Needed, Where Applicable, and by Location | Collected Data
Do you have the resources to install Microsoft SQL Server 2005 at this site? | If yes, you can make this site a primary site. If no, the site must be a secondary site. |
Do you need to be able to change the parent site of this site without reinstalling the site? | A child site that is a secondary site must be uninstalled from its parent site and then reinstalled to the new parent site. If you need to be able to change the parent site of this site without reinstalling the site, then this site must be a primary site. |
Do you have a dedicated Configuration Manager 2007 administrator at this site? | While it is not required that you have a Configuration Manager 2007 administrator for every primary site, you might consider making this a secondary site if you will not have a dedicated administrator. |

Site Mode Planning

Use this portion of the Site Planning Worksheet to help you determine whether your site should be running in native mode or mixed mode. Native mode is recommended because this offers a higher level of security than mixed mode for client-to-server communication within a site. For more information, see Benefits of Using Native Mode.

If you answer no to any of the following questions, you must use mixed mode. Repeat this section for each site you identified above, and record your results in the Site Planning Summary worksheet.

Note
For more information about choosing between native mode and mixed mode, see Choose between Native Mode and Mixed Mode.

Planning Question Example Data Needed, Where Applicable, and by Location Collected Data

Do you have a supporting public key infrastructure (PKI) that can deploy and manage the certificates required for native mode?

If yes, document how the certificates will be configured, deployed, and managed for site systems that require them, client computers, and client mobile devices.

For more information about the certificate requirements for native mode, see Certificate Requirements for Native Mode.

If the site has a parent site, is the parent site in native mode?

If no, will the parent site be migrated to native mode so that this child site can then be configured for native mode?

Can clients locate a management point in Active Directory Domain Services, or DNS, or a server locator point?

What is the method used by clients to locate a management point other than WINS, since this method is not supported in native mode?

Will all client computers in this site be running Windows XP Professional or Windows Server 2003 or above?

If no, identify any computers running Windows 2000 Professional or Windows 2000 Server and determine if they can be upgraded or reassigned to a mixed mode site.

Will all clients in this site be Configuration Manager clients?

If your site contains clients running SMS 2003, can you upgrade these or assign them to a mixed mode site?

See Also

Concepts

Configuration Manager Planning Worksheets
Choose between Native Mode and Mixed Mode
Benefits of Using Native Mode


Site Planning Summary Worksheet

Use this worksheet to record the name and site code you will give each Configuration Manager 2007 site, whether the site is a primary or a secondary site, whether you are planning to implement native mode or mixed mode, the number of clients that you expect to manage with each site, and the IP subnets and/or Active Directory sites associated with each site.

Use the following as a guideline to assist in planning tasks.

Site name | Site code | Primary site? (Note if the site is the central site.) | Secondary site? (Indicate parent site name and site code) | Native mode or mixed mode site? | Potential number of clients managed by this site: | IP subnet(s) or Active Directory sites associated with this site. | Comments and considerations Example: Site is on a well-connected network; site requires unique client agent settings; site requires different language version; site is needed to accommodate cross-forest issues

See Also

Concepts

Configuration Manager Planning Worksheets


Site Systems Planning Worksheet

Use this worksheet to help you identify what site systems you need to enable for each site, and the associated planning considerations for each site system.

Depending on the hardware configuration of your proposed site systems, as well as the security requirements for your organization, one server may perform one or more site system roles. The questions presented here are meant to be used as a guide. Not all questions or considerations will apply to all organizations. You may have additional planning considerations other than those suggested here.

Use the following guidelines to assist in planning tasks, and repeat this worksheet for each site.

Management Point Planning

The management point is the primary point of contact between Configuration Manager clients and the site server. A Configuration Manager 2007 site can have only one default management point that intranet-based clients will use to communicate with the site server. When clients are managed on the Internet, they do not locate a default management point but connect directly to a specified management point that is configured to accept connections over the Internet.

Planning question | Example data needed, where applicable, and by location | Collected data
What is the maximum number of clients you need to manage at this site, including clients roaming in? | If more than 25,000, depending on your server hardware, you may need to configure Windows Network Load Balancing to support more than one management point in your site. |
How often will the clients assigned to this site retrieve new policy information? | Client policy polling interval that clients will use when requesting policy from their assigned management point. |
Will you be collecting hardware inventory from clients at this site? | If you will be collecting hardware inventory from clients at this site, what will your hardware inventory frequency be? |
Will you be collecting software inventory from clients at this site? | If you will be collecting software inventory from clients at this site, what will your software inventory frequency be? |
Will you be using the heartbeat discovery method at this site? | If you will be using heartbeat discovery at this site, what will the discovery frequency be? |
Will you be using software distribution at this site? | How many advertisements will you send per week to clients at this site? |
Will you be using software metering at this site? | If you will implement software metering at this site, how many software metering rules will you implement and how often will you collect software metering data? |
Do you require fault tolerance for your management point at this site? | You may need to configure Windows Network Load Balancing to support more than one management point in your site using a replicated site database. |
Management point for a secondary site |  |
How fast is the connection between this site and its parent primary site? | Is this site connected to its parent site over a WAN? |
Do you require fault tolerance for your management point at this site? | You may need to configure Windows Network Load Balancing to support more than one management point in your site using a replicated site database. |

Site Database Server Planning

Planning question | Example data needed, where applicable, and by location | Collected data
Is this a primary site? | Primary sites must have access to a SQL Server to host the site database. |
Which version of Microsoft SQL Server do you have (including all relevant service packs)? | Ensure that the version of SQL Server is supported for hosting the Configuration Manager site database. |
Do you need to obtain or upgrade an installation of Microsoft SQL Server (including all relevant service packs)? | Verify that you have the necessary SQL Server version to host the Configuration Manager site database. |
Are you planning to maintain the Configuration Manager 2007 site database on the primary site server? | You can install the site database on a local instance of SQL Server 2005 SP2 located on the primary site server. If you install the site database using a SQL Server instance on another server, or move it to another SQL Server instance after site installation, it is supported to move the site database back to the site server at a later time. |
If you are planning to maintain the site database on a server other than the primary site server, decide where you will install the SMS Provider. | The SMS Provider cannot be located on the remote SQL Server if more than a single SMS site database is shared on the remote SQL Server, or if the site database is hosted on a virtual SQL Server cluster instance. |
Do you need to replicate the site database for a proxy management point? | Ensure that you plan how to implement SQL replication for the site database. |

Server Locator Point Planning

Server locator points are required to verify proper site assignment and also locate management points for Configuration Manager clients. You must install one server locator point at the central site. No other server locator points are required

Planning question | Example data needed, where applicable, and by location | Collected data
Will this site support clients in work groups? | Clients in work groups cannot access Active Directory to locate published management point information. |
Will this site use a management point configured to use the Windows Network Load Balancing (NLB) service? | Management points configured with the NLB service must be registered in WINS. |
Has the Active Directory schema been extended for Configuration Manager? | Client site assignment will not work without using a server locator point if the Active Directory schema has not been extended for Configuration Manager 2007 (and the sites are publishing site information to Active Directory Domain Services). |

Software Update Point Planning

A software update point is a site server that is installed on a site system that has Windows Server Update Services (WSUS) 3.0 installed on it. Before compliance assessment data is retrieved and before software updates can be deployed to Configuration Manager client computers, an active software update point must be enabled on a site system. You must also determine if a second active software update point should be enabled that handles only communications from Internet-based client computers.

Planning question Example data needed, where applicable, and by location Collected data

What is the maximum number of clients you need to manage at this site, including clients roaming in?

If there are more client computers assigned to the site, you will need to consider creating an Network Load Balancing cluster for a group of WSUS servers and then choose to use the NLB cluster as the active software update point on the site. WSUS 3.0 supports up to 25,000 client computers.

Is WSUS 3.0 installed on an existing site system? What is the computer name of the site system?

WSUS 3.0 must be installed on the site system computer prior to adding the software update point site role to the site system.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

Does this site run in native mode? If so, should Internet-based client computers access the active software update point or does an active Internet-based software update point need to be enabled? What is the computer name for the site system?

The active software update point can handle communications from both Intranet and Internet-based client computers or the active software update point can be configured to handle only Intranet-based client communication and an active Internet-based software update point can be added as a site system role to handle only Internet-based client communications.

Reporting Point Planning

A reporting point is a site server that hosts a site's reporting Web site. A reporting point obtains report information from only its Configuration Manager 2007 site database server. Before you can begin using reports in Configuration Manager, you must enable one or more of your site systems as a reporting point.

Planning question | Example data needed, where applicable, and by location | Collected data
What site information do you want to report on? | Will there be enough clients at this site, or will there be any site-specific data that must be reported that the site's parent site would not be the appropriate place to report it? |
Will this site require a reporting point? | You may need only one reporting point in a Configuration Manager 2007 hierarchy. For example, the central site may be the only site you choose to install a reporting point. Add additional reporting points lower in the hierarchy to report on subsets of data or to delegate reporting of specific site information. |

Distribution Point Planning

Planning question | Example data needed, where applicable, and by location | Collected data
Will you be using software distribution at this site? | Estimate the number and size of packages you will store on the distribution points. |
How many clients will access the distribution points at this site? | Plan for enough distribution points to service the number of clients requesting package content at the site. |
Will you need to group your distribution points? | If so, identify how you plan to group them. |
Will you use BITS-enabled distribution points? | If so, you must also enable IIS and WebDAV on the distribution point systems. |
Do you have distribution points in sites that are accessed across slow WAN links? | If so, configure those distribution points as protected distribution points and indicate the subnets that should access the distribution point. |

See Also

Concepts

Configuration Manager Planning Worksheets
Configuration Manager Site System Planning


Site Systems Planning Summary Worksheet

Use this worksheet to record information about the site systems you will deploy in your Configuration Manager 2007 site. You can use this information to help you when you assign and configure each site system.

Use the following guidelines to assist in planning tasks and repeat this worksheet for each site. Only common site system roles are listed, for more information about planning for all site system roles, see Configuration Manager Site System Planning.

Computer name | Site server? | Management point? Indicate whether it is the default or proxy. | Site database server? Primary site only. | Server locator point? Recommended for central site only. | Reporting point? Primary site only. | Distribution point? Indicate if BITs-enabled, subnets for protected distribution points, and if member of distribution point group.

See Also

Concepts

Configuration Manager Planning Worksheets


Configuration Manager Console Planning Worksheet

Use this worksheet to list all computers that will connect to this site database and run a session of the Configuration Manager console. Include any computers at secondary sites that will connect to a parent primary site's database. Identify whether any of these different computers are likely to run the Configuration Manager console concurrently.

Use the following worksheet to assist in planning tasks.

Computer name | Indicate the Configuration Manager site (by site code) that the Configuration Manager console will connect to.

See Also

Concepts

Configuration Manager Planning Worksheets
Planning for the Configuration Manager Console


Client Installation Planning Worksheet

It is recommended that you familiarize yourself with the client installation methods and their related settings before completing this worksheet.

Use the following guidelines to assist in planning tasks.

Client installation methods Explanation Configuration parameters

Install Clients Using Software Update Point Based Installation

The Software update point (SUP) client installation method installs the Configuration Manager 2007 client software on any computer that can communicate with the site's software update point.
  • To specify the setup parameter information for the client installation you will need to create the SetupParameters registry string value in the following registry key: HKey_Local_Machine \Software \Policies \Microsoft \CCMSetup
  • CCMSetup.exe will locate the setup parameters using this registry string value. For example: the registry string value information /mp:[ServerName] is read by CCMSetup.exe and the Configuration Manager client is directed to the server name specified. Specifying parameters through the registry key SetupParameters is the equivalent of specifying the installation parameters using the command line.

Client imaging

You can load client software components on the computer when it is originally prepared for service in your organization. Typically, computer preparation work is done by an IT team in a staging area. The client is installed on a computer master image by installing core client components without specifying a site code for assignment. The computer is ready to be assigned to a site when it arrives at the location where will be used in production.
  • Identify the CCMSetup.exe command line options you will use when installing the client on the master computer to be imaged.
  • Identify any registry modifications that need to be made for the preferred client type.
  • Identify the site code that the client should be assigned to.

Client Push installation

Client Push Installation is useful for installing the client software on computers that:

  • Have been discovered by Configuration Manager 2007 but do not have the client software installed.
  • Rarely log on to the network because the users lock their Windows sessions instead of logging out.
  • Log on with a user account that does not run a logon script or does not have administrative permissions on the computer.
  • Are servers that users might not log on to for a long period of time.
  • Enabled?
  • For computers running Windows Vista you must enable the remote registry service or the client push installation will fail on those clients.
  • Identify the client push installation account that will be used.
  • Identify whether you will push the client to servers, workstations, or domain controllers.

Manual installation

You can use CCMSetup.exe to manually install the Configuration Manager 2007 client software to a computer. CCMSetup.exe uses the Client.msi program to install the client software. CCMSetup.exe copies all the files necessary to complete the client installation, including the Client.msi and language-specific files and folders, to the computer.
  • Identify how and when CCMSetup.exe will be run on each client
  • Identify any specific command line options required.

Active Directory Group Policy

You can distribute the Configuration Manager 2007 client software using Active Directory Group Policy. Because of the limitations with customizing this installation method, Group Policy installations should be used for targeting small groups of computers. You can publish or assign the client installation program to computers based on their organizational unit location in Active Directory.
  • Identify the name(s) of any Group Policy objects.
  • Name(s) of OU, domain, or site the Group Policy object is linked to.
  • Identify any additional Group Policy object settings such as No Override or group filtering.
  • Identify Group Policy object security settings

Logon scripts installation

You can use the file CCMSetup.exe in a login script to trigger the client installation.

  • Logon script installations can be configured using the same method that you would configure a manual client installation. You can specify the /logon switch with CCMSetup.exe which will cause CCMSetup.exe to skip the installation if there is already a Configuration Manager Client installed.
  • If no installation source is specified using the /Source switch and no management point is specified using the /MP switch, CCMSetup.exe can locate the management point if there is a server locator point and Active Directory Services has been extended.
  • Identify any logon scripts being used and the commands being processed.

Software distribution

Software distribution can be used to upgrade existing SMS 2003 Advanced Clients.

Outline your plan to distribute CCMSetup.exe to run on each client.
  • Identify how and when CCMSetup.exe will be distributed on each client
  • Identify any specific command line options required.

See Also

Concepts

Configuration Manager Planning Worksheets

Other Resources

Tasks for Configuration Manager Client Deployment


Client Agent Planning Worksheet

Use this worksheet to help you plan for client agent settings and requirements, and to determine whether you require different settings for different groups of clients within the same site. Complete this worksheet for each site, and for each set of clients requiring unique settings within each site.

Use the following guidelines to assist in planning tasks.

Client Agent Example Data Needed, Where Applicable, and by Location Collected Data

Hardware inventory client agent
  • Enabled?
  • Scheduled frequency
  • MIF collection options

Software inventory client agent
  • Enabled?
  • Scheduled frequency
  • Inventory collection settings
  • File collection options
  • Inventory names options

Advertised programs client agent
  • Enabled?
  • General settings
  • Notification settings

Computer client agent

  • Network Access Account settings
  • Policy polling interval
  • Organization customization properties
  • Reminders properties
  • BITS properties

Desired configuration management client agent
  • Enabled?
  • Scheduled frequency

Device agent
  • Polling interval
  • Software distribution to devices enabled?
  • Software inventory of devices enabled? Schedule frequency?
  • Hardware inventory of devices enabled? Schedule frequency?
  • File collection of devices enabled? Schedule frequency and file collection properties?

Remote tools client agent
  • Enabled?
  • General options, including policy change options
  • Security options (permitted viewers)
  • Notification options
  • Remote assistance options (including level of access)

Network Access Protection (NAP) client agent
  • Enabled?
  • Evaluation options

Software metering client agent
  • Enabled?
  • Schedule options for data collection and metering rule download

Software updates client agent
  • Enabled?
  • Scheduled frequency
  • Update installation options
  • Deployment reevaluation schedule options

See Also

Concepts

Configuration Manager Planning Worksheets


Configuration Manager Deployment Phase

In this phase, the planned hierarchy design should be validated and tested in a lab, a pilot deployment performed perform a pilot deployment. After the hierarchy design has been validated, Configuration Manager 2007 sites can be fully deployed into the production environment.

The information gathered, and decisions made during the preplanning and planning phases are used to determine which of the three Configuration Manager 2007 deployment methods that will be used during the deployment phase:

  • New installation
  • In-place upgrade
  • Side-by-side upgrade

New Installation

To set up a new Configuration Manager 2007 site, you can use either the Configuration Manager 2007 Setup Wizard or perform an unattended installation using a scripted installation method.

When using the Configuration Manager 2007 Setup Wizard, there are two options for installing new Configuration Manager 2007 sites: simple setup and custom setup. In most cases, simple setup should be used for evaluation purposes only. Custom setup allows greater flexibility in configuring site system and client agent settings.

For more information performing new installations of Configuration Manager 2007, see Configuration Manager Setup Overview.

In-Place Upgrade

If you determine that you can upgrade an existing Microsoft Systems Management Server (SMS) 2003 primary site directly to Configuration Manager 2007, you can perform an in-place upgrade. When you upgrade a site to Configuration Manager 2007 using the in-place upgrade method, the site server and its site systems do not change their site server roles. Also, existing clients do not change their site assignments when the site is upgraded.

Note
In some scenarios, it is supported to upgrade a site from evaluation version software. For example, you can run Configuration Manager 2007 Setup to upgrade an existing Configuration Manager 2007 site running day evaluation version software. For more information, see the upgrade paths in the applicable version of Configuration Manager Supported Configurations.

For more information performing in-place upgrades to Configuration Manager 2007, see Configuration Manager In-Place Upgrade.

Side-By-Side Upgrade

In order to consolidate existing SMS 2003 sites, to change the existing site hierarchy reporting structure, or to upgrade server hardware during a site hierarchy upgrade, the side-by-side upgrade method should be used to upgrade SMS 2003 sites. The side-by-side upgrade method involves installing a new Configuration Manager 2007 site and possibly decommissioning the SMS 2003 site that the new site is replacing.

For more information performing side-by-side upgrades to Configuration Manager 2007, see Configuration Manager Side-By-Side Upgrade.

See Also

Concepts

Configuration Manager Deployment Checklist
Flow Chart: Installing a Configuration Manager Console


Configuration Manager Planning Checklist

This checklist outlines the steps you should take to plan Microsoft System Center Configuration Manager 2007 sites before deploying them. It is intended to provide a high-level list of items to consider during planning and before actually deploying Configuration Manager 2007 sites.

Planning for Configuration Manager 2007 sites is divided into preplanning and planning phases.

Configuration Manager Preplanning Steps

The following checklist provides the preplanning steps to plan a Configuration Manager 2007 hierarchy deployment:

Step | Reference
This phase involves examining and documenting your current computing environment, determining your business and technical objectives, and building your test lab in preparation for the pilot project. | Configuration Manager Preplanning Phase
Ensure that you have a thorough understanding of your computing environment, and supporting documentation, before making planning decisions for your Configuration Manager deployment. | Configuration Manager Preplanning Phase (Analyze and document your current network and computing environment)
It is important to understand exactly what your business and technical needs are and how Configuration Manager features can help you accomplish them. | Configuration Manager Preplanning Phase (Analyze your needs and identify objectives)
Installing Configuration Manager 2007 in a production environment without first testing it on an isolated network can cause undesirable and potentially damaging results. A test lab should be used in all phases of Configuration Manager deployment from preplanning to day-to-day operations after fully deploying your Configuration Manager hierarchy. | Configuration Manager Preplanning Phase (Establish a test lab environment)
The worksheets in this section can help you to prepare to plan for deploying and configuring Configuration Manager sites and clients. | Configuration Manager Preplanning Worksheets

Configuration Manager Planning Steps

The following checklist provides the preplanning steps to plan a Configuration Manager 2007 hierarchy deployment:

Step | Reference
In this phase, you fill in your project plan documents with details for your Configuration Manager 2007 hierarchy design, pilot project, Configuration Manager 2007 deployment, how you will use Configuration Manager 2007 features, and planning security and recovery. As you perform these steps, test configuration variations and deployment scenarios in your lab environment. | Configuration Manager Planning Phase
A single Configuration Manager 2007 site can span multiple domains within a single Active Directory forest or even multiple Active Directory forests. | Configuration Manager in Multiple Active Directory Forests
By properly securing your management systems, you help to ensure that unauthorized persons cannot use your management systems to access or disable your organization’s computers. | Configuration Manager Security and Privacy Planning
You should plan for which discovery methods you will enable for your Configuration Manager 2007 sites. | Configuration Manager Discovery Planning
You must determine which client installation methods you will enable for your Configuration Manager 2007 sites. | Planning and Deploying Clients for Configuration Manager 2007
Client agent settings are generally site-specific. They apply to all clients within a site. | Client Agent Planning Worksheet
You should consider the design of each Configuration Manager 2007 site or Configuration Manager 2007 site hierarchy if you will have more than one site within your organization. | Site Planning Worksheet
You should also plan to determine which site system roles you need to enable, and which servers within your site you should assign those site system roles to. | Configuration Manager Site System Planning
Computers are assigned as clients to Configuration Manager 2007 sites according to the boundaries you configure in the Configuration Manager console. | Planning Configuration Manager Boundaries
This early stage of your Configuration Manager 2007 deployment, is the perfect time to consider backup and recovery requirements | Planning for Backup and Recovery
The worksheets in this section can help you to prepare to plan for deploying and configuring Configuration Manager sites and clients. | Configuration Manager Planning Worksheets

See Also

Other Resources

Configuration Manager Planning and Deployment Overview


Configuration Manager Deployment Checklist

This checklist outlines the steps that should be taken to deploy Configuration Manager 2007 sites. It is intended to provide a high-level list of items to consider when deploying Configuration Manager 2007 sites.

Configuration Manager Deployment Steps

The following checklist provides the steps to deploy a Configuration Manager 2007 site hierarchy:

Step | Reference
Review the planning information and decisions made during the preplanning and planning phases. | Configuration Manager Preplanning Phase Configuration Manager Planning Phase
Verify the planned hierarchy design. | The test lab created during the planning phase.
Pilot deployment. | Small, controlled segment of the production network.
After the hierarchy design has been validated, deploy the first Configuration Manager 2007 site, and if planned, the Configuration Manager 2007 hierarchy. The information gathered, and decisions made during the preplanning and planning phases are used to determine which of the three Configuration Manager 2007 deployment methods that will be used. | Decide If You Should Upgrade or Perform a New Installation

See Also

Concepts

Configuration Manager Deployment Phase
Flow Chart: Installing a Configuration Manager Console

Other Resources

Configuration Manager Planning and Deployment Overview


Administrator Workflow: Planning and Deployment

This administrator workflow displays the recommended steps to use when planning and deploying Microsoft® System Center Configuration Manager sites.

The workflow should be used in conjunction with the following topics:

Configuration Manager Preplanning Phase

Configuration Manager Planning Phase

Configuration Manager Deployment Phase

Configuration Manager Planning Checklist

Configuration Manager Deployment Checklist

Planning and Deployment Work Flow

See Also

Other Resources

Configuration Manager Planning and Deployment Overview


Configuration Manager Supported Configurations

Topic last updated— January 2008

This section specifies the hardware and software requirements necessary to implement and maintain Microsoft Microsoft System Center Configuration Manager 2007 in your environment. Each service pack and feature release has a separate topic.

For information about installation prerequisites required for Configuration Manager sites, see Prerequisites for Installing Configuration Manager.

In This Section

Configuration Manager 2007 Supported Configurations

Describes the supported configurations for the version of the product with no service pack.

Configuration Manager 2007 SP1 Supported Configurations

Describes the supported configurations for Configuration Manager 2007 with Service Pack 1.

Configuration Manager 2007 R2 Supported Configurations

Describes the supported configurations for Configuration Manager 2007 R2.

See Also

Concepts

Getting Started with Configuration Manager 2007

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Prerequisites for Installing Configuration Manager

Topic last updated—March 2008

After reviewing the Configuration Manager supported configurations, you should next ensure that you have the proper prerequisites for installing a Microsoft System Center Configuration Manager 2007 site or site system. Knowing what the prerequisites are ahead of time will enable you to efficiently deploy Configuration Manager sites and features to most effectively support the clients assigned to the site.

The Configuration Manager 2007 Setup program verifies required prerequisites for installation and helps you determine how to prepare your environment to install or upgrade a Configuration Manager 2007 primary site, secondary site, or Configuration Manager console. For more information about setup prerequisite checks, see Setup Prerequisite Checks.

Note
The Configuration Manager Setup prerequisite check rules verify that software and settings required for setup are installed. In some cases, the required software itself might require additional software updates not verified by Configuration Manager Setup. Before beginning setup, you should ensure that the computer operating system and the additional installed software components that Configuration Manager Setup relies on have been updated with all relevant software updates.

Before installing Configuration Manager 2007 or implementing new features, ensure that you have verified that your computing environment meets the following prerequisites:

  • General site server prerequisites
  • Configuration Manager primary site server prerequisites
  • Site database server prerequisites
  • SMS Provider prerequisites
  • Configuration Manager secondary site server prerequisites
  • Configuration Manager console
  • Configuration Manager feature prerequisites

General Site Server Prerequisites

Following are general site server prerequisites for hosting the various Configuration Manager 2007 site server roles:

  • All site servers must be a member of an Active Directory domain.
    Note
    It is not supported to change the domain membership or computer name of a Configuration Manager 2007 site system after it is installed.

  • Internet Information Services (IIS) 6.0 or later is required if the system will perform any of the following site system roles:
    • Background Intelligent Transfer Service (BITS)-enabled distribution point. This role requires BITS server extensions and Web Distributed Authoring and Versioning (WebDAV) extensions. IIS is not required if the distribution point will not be BITS-enabled.
      Important
      The WebDAV component is not included in Windows Server 2008 operating system. You must download, install, and configure WebDAV manually on BITS-enabled distribution points running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

    • Management point. This role requires BITS server IIS extensions and WebDAV IIS extensions.
      Important
      The WebDAV component is not included in Windows Server 2008 operating system. You must download, install, and configure WebDAV manually on management points running Windows Server 2008. For more information, see.

    • Reporting point. This role requires Active Server pages.
      Note
      When you install ASP and ASP.NET on a Windows Server 2008 operating system reporting point, you must also manually enable Windows Authentication. For more information, see.

    • Software Update Point
    • Server locator point.
  • All Configuration Manager distribution point systems using BITS bandwidth throttling require BITS 2.0 or later.
  • Management points and server locator points configured to be part of a Network Load Balancing (NLB) cluster are supported.
  • All site servers require Internet Explorer 5.0 or later.
  • Windows Server 2008 is the only supported operating system for hosting the System Health Validator point site system role.
  • Site servers and branch distribution points require Remote Differential Compression (RDC) to generate package signatures and perform signature comparison.
    Important
    RDC is not installed by default on computers running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

Configuration Manager Primary Site Server Prerequisites

The following software must be installed before running Setup on a server to support the primary site server role:

  • Microsoft Management Console (MMC) 3.0. MMC 3.0 is available for download at http://go.microsoft.com/fwlink/?LinkID=55423.
  • .NET Framework 2.0. .NET Framework 2.0 is available for download at http://go.microsoft.com/fwlink/?LinkID=56407.
  • If applicable, the following update should also be applied to the system before running Setup:
    • MS06-030: Vulnerability in Server Message Block could allow elevation of privilege (http://go.microsoft.com/fwlink/?LinkId=79239).

Site Database Server Prerequisites

Configuration Manager 2007 primary sites require access to a SQL Server database to host the site database. The site database can be hosted on a SQL Server instance installed on the same server as the primary site, on a remote computer, or on a virtual SQL Server cluster instance. The following conditions apply:

  • SQL Server 2005, Service Pack 2 is the only version of SQL Server supported for hosting the Configuration Manager 2007 site database.
  • SQL Server 2005 Express is not a supported SQL Server 2005 version for hosting the Configuration Manager 2007 site database.
  • The SQL database service is the only SQL Server component required to be installed to host the site database.

SMS Provider Prerequisites

Because Configuration Manager 2007 allows you to install the SMS Provider on a computer other than the site server or site database server, you should check to ensure that the computer you have identified to install the SMS Provider on meets the following prerequisites:

  • The SMS Provider must be installed on a computer in the same domain as the site server and site database server site systems.
    Important
    The SMS Provider must be installed on a computer with the same operating system language as the site server's operating system language when a site contains site servers or clients with different language operating systems installed.

  • The SMS Provider cannot be installed on a virtual SQL Server cluster computer or a physical computer hosting a virtual SQL Server cluster node.
  • The SMS Provider cannot be installed on a computer already hosting the SMS Provider for another site.
  • If applicable, the following updates should also be applied to the system before installing the SMS Provider:
    • MS06-030: Vulnerability in Server Message Block could allow elevation of privilege (http://go.microsoft.com/fwlink/?LinkId=79239).
    • Availability of Windows Server 2003 Post-Service Pack 1 COM+ 1.5 Hotfix Rollup Package 6 (http://go.microsoft.com/fwlink/?LinkId=79240).

Configuration Manager Secondary Site Server Prerequisites

If applicable, the following updates should be applied to the system before installing a secondary site server:

  • "A custom program that uses the RegConnectRegistry function can no longer access the registry of a remote computer in Windows Server 2003 with Service Pack 1 or in an x64-based version of Windows Server 2003", described in Knowledge Base article 906570 (http://go.microsoft.com/fwlink/?LinkID=60872).
  • "MS06-030: Vulnerability in Server Message Block could allow elevation of privilege" (http://go.microsoft.com/fwlink/?LinkId=79239).

Configuration Manager Console Prerequisites

Before installing the Configuration Manager console on a remote computer, you should ensure that it meets the minimum requirements outlined in the Configuration Manager supported configurations, as well as the following installation prerequisites:

  • Microsoft Management Console (MMC) 3.0. MMC 3.0 can be downloaded from http://go.microsoft.com/fwlink/?LinkID=55423.
  • .NET Framework 2.0. .NET Framework 2.0 can be downloaded from http://go.microsoft.com/fwlink/?LinkID=56407.

Configuration Manager Feature Prerequisites

Some Configuration Manager 2007 features have specific prerequisites for installation or use. Before implementing the following features, ensure that you meet their specific prerequisite requirements as described in the following topics:

  • Prerequisites for Native Mode
  • Prerequisites for Internet-Based Client Management
  • Prerequisites for Reporting
  • Prerequisites for Software Distribution
  • Prerequisites for Software Updates
  • Prerequisites for Desired Configuration Management
  • Prerequisites for Network Access Protection
  • Prerequisites for Wake On LAN
  • Prerequisites for Out of Band Management

See Also

Concepts

How to Start the Setup Prerequisite Checker
Setup Prerequisite Checks

Other Resources

Configuration Manager Supported Configurations


What Do You Want To Do?

Topic Last Updated—August 2008

Microsoft System Center Configuration Manager 2007 offers many features to manage your computers and mobile devices. If you haven't already deployed the Configuration Manager 2007 client software to your computers, read Planning and Deploying Clients for Configuration Manager 2007. After you have client software installed on your computers, you might want to perform the following common tasks.

In This Section

Collect hardware and software asset information

Provides a list of resources about how to collect Configuration Manager 2007 hardware inventory, software inventory, and analyze data from Asset Intelligence to map your software inventory to a list of known programs.

Configure the site to manage clients over the Internet

Provides a list of references about how to configure the site to manage clients over the Internet.

Distribute software

Provides a list of resources about how to create packages, programs, and advertisements to send software to clients.

Deploy software updates

Provides a list of resources about how to configure software updates such as security updates.

Deploy operating systems

Provides a list of resources about how to deploy operating systems such as Windows Vista to all of your client computers.

Manage mobile devices like Smartphones and Pocket PCs

Provides a list of resources about how to deploy Configuration Manager 2007 client software and applications to mobile devices.

Manage desired configurations

Provides a list of resources about how to create configuration items and configuration baselines and then compare client computers to these configurations to see if they match.

Remotely administer a computer

Provides a list of resources about how to use remote control to remotely administer a computer, including ways to integrate Configuration Manager 2007 with Windows Remote Desktop.

Restrict non-compliant computers from accessing the network

Provides a list of resources about how to integrate Configuration Manager 2007 with Windows Network Access Protection to check computers before they are allowed to access network resources.

Wake up computers that are in sleep mode

Provides a list of resources about how to configure Wake On LAN in Configuration Manager 2007.

Troubleshoot computers when the operating system has stopped responding

Applies only to Configuration Manager 2007 SP1.

Provides a list of resources about how to configure and use out of band management in Configuration Manager 2007 SP1.

Report on the status of client computers

The information in this topic applies only to Configuration Manager 2007 R2.

Provides a list of resources about how to configure and use client status reporting in Configuration Manager 2007 R2.

Use SQL Reporting Services in place of the Configuration Manager reports.

The information in this topic applies only to Configuration Manager 2007 R2.

Provides a list of resources about how to configure and use SQL Reporting Services in Configuration Manager 2007 R2.

See Also

Concepts

Getting Started with Configuration Manager 2007

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007
Planning and Deploying Clients for Configuration Manager 2007
How to Configure Configuration Manager 2007
Configuration Manager 2007 Features
Security and Privacy for Configuration Manager 2007
Maintaining Configuration Manager 2007
Troubleshooting Configuration Manager 2007


Collect hardware and software asset information

You can use Configuration Manager 2007 to collect hardware and software inventory from Configuration Manager 2007 clients. Hardware and software client inventory agents are enabled on a site-wide basis.

When the hardware inventory client agent is enabled for Configuration Manager 2007 sites, hardware inventory data gives you system information (such as available disk space, processor type, and operating system) about each computer. Software inventory agent gives you information such as inventoried file types and versions present on client computers.

When the software inventory client agent is enabled for Configuration Manager 2007 sites, software inventory data gives you information about the installed applications and file properties inventoried on client systems.

To configure hardware and software inventory in Configuration Manager 2007, use the following resources:

Getting Started

  • Planning for Inventory
  • Overview of Inventory

Tasks

  • Tasks for Collecting Inventory

Basic Troubleshooting

  • Troubleshooting Inventory

See Also

Other Resources

Inventory in Configuration Manager


Configure the site to manage clients over the Internet

This task requires Deploying Configuration Manager Sites to Support Internet-Based Clients in Configuration Manager 2007.

To configure the site to manage clients over the Internet, use the following resources:

Getting Started

  • Administrator Workflow: Configuring a Site for Internet-Based Client Management
  • Administrator Checklist: Configuring a Site for Internet-Based Client Management

Tasks

  • Planning for Internet-Based Client Management
  • Configuring Internet-Based Client Management

See Also

Concepts

Overview of Internet-Based Client Management


Distribute software

Before distributing software packages using Configuration Manager 2007, you should review the software distribution concepts as well as those of collection (particularly concerning maintenance windows), configure the software distribution components and infrastructure, en sure you have collections that meet the needs of your enterprise. and so on. The following sections provide information about getting started, procedures for configuring and using software distribution, and information about how to troubleshoot software distribution.

Getting Started

The following topics provide information about getting started with software distribution:

  • Software Distribution Overview
  • Prerequisites for Software Distribution
  • Administrator Workflows for Software Distribution
  • Administrator Checklists for Software Updates

Tasks

The following topics provide information about the procedures for configuring and using software distribution:

  • Configuring Software Distribution
  • Tasks for Software Distribution

Troubleshooting

For software distribution troubleshooting information, see Troubleshooting Software Distribution.


Deploy software updates

Before deploying software updates, you should review the software updates concepts, plan for the software updates infrastructure, configure the software updates and external components, and so on. The following sections provide information about getting started, procedures for configuring and using software updates, and information about how to troubleshoot software updates.

Getting Started

The following topics provide information about getting started with software updates:

  • Administrator Workflows for Software Updates
  • Administrator Checklists for Software Updates
  • Overview of Software Updates
  • Prerequisites for Software Updates
  • Planning for Software Updates

Tasks

The following topics provide information about the procedures for configuring and using software updates:

  • Configuring Software Updates
  • Tasks for Software Updates

Troubleshooting

For software updates troubleshooting information, see Troubleshooting Software Updates.


Deploy operating systems

This requires configuring Operating System Deployment in Configuration Manager in Configuration Manager 2007.

To configure Operating System Deployment in Configuration Manager 2007, use the following resources:

Getting Started

  • Administrator Workflows for Operating System Deployment
  • Operating System Deployment Checklists

Tasks

  • Tasks for Operating System Deployment

Basic Troubleshooting

  • Troubleshooting Operating System Deployment

Online Resources

For planning, scenarios, security considerations and concepts, see Deploying Operating Systems with Configuration Manager 2007 from the Configuration Manager 2007 Library online resource (http://go.microsoft.com/fwlink/?LinkId=66752).

See Also

Other Resources

What Do You Want To Do?


Manage mobile devices like Smartphones and Pocket PCs

Mobile devices like Smartphones and Pocket PCs can be managed with Microsoft System Center Configuration Manager 2007. With mobile device management administrators can:

  • Configure settings such as password policy and network settings
  • Advertise and distribute software
  • Inventory hardware and software
  • Collect files such as log files

To manage mobile devices, one or more Configuration Manager 2007 servers are configured to support mobile device management and the Configuration Manager 2007 mobile device client software is installed on managed mobile devices. The following sections provide information about getting started using mobile device management.

Getting started

The following topics provide information about getting started with mobile device management:

  • Overview of Mobile Device Management
  • Prerequisites for Mobile Device Management
  • Checklist for Mobile Device Management
  • Configuring Mobile Device Management

Tasks

  • Tasks for Mobile Device Management
  • How to Install or Upgrade the Mobile Device Management Client

Basic Troubleshooting

  • Troubleshooting Mobile Device Management

See Also

Concepts

Mobile Device Clients Security Best Practices and Privacy Information

Other Resources

Technical Reference for Mobile Device Management
Troubleshooting Mobile Device Management


Manage desired configurations

Managing a desired configuration requires enabling the desired configuration management client agent and assigning configuration baselines to collections so that computers can assess compliance with the configuration data you want to monitor.

To configure desired configuration management in Configuration Manager 2007, use the following resources:

Getting Started

  • Desired Configuration Management Administrator Workflows
  • Desired Configuration Management Checklists

Tasks

  • Tasks for Desired Configuration Management

Basic Troubleshooting

  • Troubleshooting Desired Configuration Management

Online Resources

To download best practices configuration data from Microsoft and other software vendors, visit the Microsoft® System Center Configuration Manager 2007 Configuration Pack Web page (http://go.microsoft.com/fwlink/?LinkId=71837).

See Also

Other Resources

Overview of Desired Configuration Management


Remotely administer a computer

To remotely administer computers in Configuration Manager 2007, the remote tools client agent must be enabled.

To configure remote tools in Configuration Manager 2007, use the following resources:

Getting Started

Overview of Remote Tools

Tasks

Configuring Remote Tools

Tasks for Remote Tools

See Also

Concepts

Remote Tools in Configuration Manager


Restrict non-compliant computers from accessing the network

This requires setting up Network Access Protection (NAP) on a Microsoft Windows Network Policy Server, and configuring Network Access Protection in Configuration Manager in Configuration Manager 2007.

To configure Network Access Protection in Configuration Manager 2007, use the following resources:

Getting Started

  • Administrator Workflow: Configure Network Access Protection for Configuration Manager
  • Administrator Checklist: Configure Network Access Protection for Configuration Manager

Tasks

  • Tasks for Network Access Protection

Basic Troubleshooting

  • Troubleshooting Network Access Protection

Online Resources


Wake up computers that are in sleep mode

This task requires the feature Wake On LAN in Configuration Manager in a Configuration Manager 2007 site.

To configure Wake On LAN in Configuration Manager 2007, use the following resources:

Getting Started

  • Administrator Workflow: Enabling Wake On LAN
  • Administrator Checklist: Enabling Wake On LAN

Tasks

  • Configuring Wake On LAN
  • How to Configure Wake On LAN Activities
  • How to Monitor Wake On LAN

Basic Troubleshooting

  • Troubleshooting Wake On LAN

See Also

Other Resources

Overview of Wake On LAN


Troubleshoot computers when the operating system has stopped responding

Topic last updated—March 2008

This task requires the out of band management feature in Configuration Manager 2007 SP1. For more information, see Out of Band Management in Configuration Manager 2007 SP1.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To troubleshoot computers when the operating system has stopped responding and to manage computers when the computer is turned off, does not have the Configuration Manager 2007 client installed, or does not have an operating system installed, use the following resources.

Getting Started

The following topics provide information about getting started with out of band management.

  • Prerequisites for Out of Band Management
  • Administrator Checklist: Enabling Out of Band Management

Tasks

The following topics provide information about the procedures for planning, configuring, and using out of band management.

  • Planning for Out of Band Management
  • Configuring Out of Band Management
  • Tasks for Out of Band Management

Troubleshooting

For out of band management troubleshooting information, see Troubleshooting Out of Band Management.

See Also

Concepts

Example Scenarios for Implementing Out of Band Management
Example Scenarios for Using Out of Band Management
Overview of Out of Band Management


Report on the status of client computers

Topic Last Updated—August 2008

This task requires the client status reporting feature in Configuration Manager 2007 R2. For more information, see Client Status Reporting in Configuration Manager 2007 R2. Full documentation for client status reporting is located in a separate help file, which is available after you install the feature.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To report on the status of client computers in your Configuration Manager 2007 R2 hierarchy, use the following resources.

Getting Started

The following topics provide information about getting started with client status reporting.

  • Overview of Client Status Reporting
  • Prerequisites for Client Status Reporting

Tasks

The following topics provide information about procedures for planning and installing client status reporting.

  • Planning for Client Status Reporting
  • How to Install Client Status Reporting

See Also

Concepts

Overview of Client Status Reporting

Other Resources

Client Status Reporting in Configuration Manager 2007 R2


Use SQL Reporting Services in place of the Configuration Manager reports.

Topic Last Updated—August 2008

This task requires the SQL Reporting Services feature in Configuration Manager 2007 R2. For more information, see SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Getting Started

The following topics provide information about getting started with SQL Reporting Services.

  • Prerequisites for SQL Reporting Services
  • Administrator Checklist for SQL Reporting Services

Tasks

The following tasks provide information about the procedures for planning, configuring, and using SQL Reporting Services.

  • Planning for SQL Reporting Services
  • Configuring SQL Reporting Services
  • Tasks for SQL Reporting Services

Troubleshooting

For SQL Reporting Services troubleshooting, see Troubleshooting SQL Reporting Services.

See Also

Concepts

Example Scenario for Implementing SQL Reporting Services

Other Resources

Overview of SQL Reporting Services


Planning and Deploying the Server Infrastructure for Configuration Manager 2007

There are a number of different deployment configurations that Configuration Manager 2007 supports. Use the following sections to help you plan your deployment by gathering the information you will need to formulate a deployment plan that best meets your business requirements.

In This Section

Configuration Manager Single Site Planning and Deployment

Configuration Manager Multiple Site Planning and Deployment

Configuring Configuration Manager Sites for Best Performance

Configuration Manager Upgrade and Interoperability Planning and Deployment

Deploying Configuration Manager Sites to Support Internet-Based Clients

Deploying Configuration Manager Sites in International and Multi-Language Environments

Configuration Manager Tasks for Decommissioning Sites and Hierarchies

See Also

Concepts

Configuration Manager Documentation Library


Configuration Manager Single Site Planning and Deployment

The goal of single site planning and deployment is to properly deploy a Configuration Manager 2007 site successfully and efficiently, with minimum interruption to your users and the network. A proper planning and deployment strategy can help you achieve this.

In This Section

Configuration Manager Supported Configurations

Prerequisites for Installing Configuration Manager

Configuration Manager Site Naming

SMS Provider Overview

Configuration Manager Site Database Overview

Planning Configuration Manager Boundaries

Configuration Manager in Multiple Active Directory Forests

Extending the Active Directory Schema for Configuration Manager

Configuration Manager and Name Resolution

Configuration Manager and Service Location (Site Information and Management Points)

Configuration Manager Site Modes

Configuration Manager Custom Web Site Overview

Configuration Manager Discovery Planning

Configuration Manager Site System Planning

Configuration Manager Service Principal Name Requirements

Configuration Manager and Network Load Balancing Clusters

Configuration Manager Security and Privacy Planning

Configuration Manager Setup Overview

Configuration Manager Post Setup Considerations

Configuration Manager Planning and Deployment Flowcharts

Configuration Manager Tasks for Planning a Single Site

Configuration Manager Tasks for Deploying a Single Site

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Configuration Manager 2007 Supported Configurations

Topic Last Updated—August 2008

This topic specifies the hardware and software requirements necessary to implement and maintain Microsoft System Center Configuration Manager 2007 in your environment. For information about installation prerequisites required for Configuration Manager sites, see Prerequisites for Installing Configuration Manager.

Note
The following information applies only to Configuration Manager 2007 with no service pack.

Supported Upgrade Paths

Client System Requirements

Site Server System Requirements

Unsupported Operating Systems

Configuration Specifics

Interoperability Between Configuration Manager and SMS 2003 Sites

Changes in Support from SMS 2003

Supported Upgrade Paths

Configuration Manager 2007 is available in the following forms:

  • As an evaluation release, which expires 180 days after installation
  • As a complete release, to perform a new or upgrade installation

The following table shows which versions can be upgraded to Configuration Manager 2007.

 | Configuration Manager 2007 Evaluation Release | Configuration Manager 2007 Complete Release
SMS 2003 SP1 | No | No
SMS 2003 SP2 | No | Yes
SMS 2003 SP3 | No | Yes
Configuration Manager 2007 Evaluation Release | n/a | Yes

Configuration Manager 2007 Client System Requirements

Configuration Manager 2007 introduces changes to supported Windows client system requirements from previous versions of Systems Management Server (SMS) 2003.

Client Hardware Requirements

The following table lists the minimum and recommended hardware requirements for Configuration Manager 2007 computer clients. For information about device client requirements, see the "Mobile Device Client" section later in this section.

Hardware Component | Requirement
Processor | 233 MHz minimum (300-MHz or faster Intel Pentium/Celeron family or comparable processor recommended).
RAM | Minimum operating system requirement or at least 128 MB minimum (256 MB or more recommended; 384 MB required if using operating system deployment).
Free Disk Space | 350 MB minimum for a new installation; 265 MB minimum to upgrade an existing client. (By default, the temporary program download folder on clients is preconfigured at client installation to automatically increase to 5 GB if necessary and if 5 GB or more is available.)

Supported Client Platforms

Supported Configuration Manager 2007 client installation requires at least Windows 2000 Professional SP4.

The following table lists the minimum Configuration Manager 2007 supported client operating systems.

Note
Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, visit the Lifecycle Supported Service Packs Web site at http://go.microsoft.com/fwlink/?LinkId=31975. For additional information about Microsoft’s support lifecycle policy, visit the Microsoft Support Lifecycle Support Policy FAQ Web site at http://go.microsoft.com/fwlink/?LinkId=31976.

Key:

√ = Supported

Ø = Unsupported

Operating System | x86 | x643 | Itanium based
Windows 2000 Professional2 SP4 | √ | Ø | Ø
Windows XP Professional SP2 | √ | Ø | Ø
Windows XP Professional for 64-bit Systems | Ø | √ | Ø
Windows Vista Business Edition | √ | √ | Ø
Windows Vista Enterprise Edition | √ | √ | Ø
Windows Vista Ultimate Edition | √ | √ | Ø
Windows Vista Business Edition SP1 | √ | √ | Ø
Windows Vista Enterprise Edition SP1 | √ | √ | Ø
Windows Vista Ultimate Edition SP1 | √ | √ | Ø
Windows 2000 Server SP4 | √ | Ø | Ø
Windows 2000 Advanced Server SP4 | √ | Ø | Ø
Windows 2000 Datacenter1 SP4 | √ | Ø | Ø
Windows Server 2003 Web Edition SP1 | √ | Ø | Ø
Windows Server 2003 Standard Edition SP1 | √ | √ | Ø
Windows Server 2003 Enterprise Edition SP1 | √ | √ | √
Windows Server 2003 Datacenter Edition1 SP1 | √ | √ | √
Windows Server 2003 R2 Datacenter Edition1 | √ | √ | Ø
Windows Server 2003 Web Edition SP2 | √ | Ø | Ø
Windows Server 2003 Standard Edition SP2 | √ | √ | Ø
Windows Server 2003 Enterprise Edition SP2 | √ | √ | √
Windows Server 2003 Datacenter Edition1 SP2 | √ | √ | √
Windows Server 2003 R2 Datacenter Edition1 | √ | √ | √
Windows Server 2003 R2 Standard Edition | √ | √ | Ø
Windows Server 2003 R2 Enterprise Edition | √ | √ | √
Windows Server 2008 Standard Edition | √ | √ | √
Windows Server 2008 Enterprise Edition | √ | √ | √
Windows Server 2008 Datacenter Edition1 | √ | √ | √
Windows Embedded for Point of Service (WEPOS)4 | √ | Ø | Ø
Windows Fundamentals for Legacy PCs (WinFLP) | √ | Ø | Ø
Windows XP Embedded SP24 | √ | Ø | Ø
Windows XP Tablet PC SP2 | √ | Ø | Ø

1Datacenter releases are supported but not certified for Configuration Manager 2007. Hotfix support is not offered for issues specific to Windows Datacenter Server edition.

2Windows 2000 clients cannot run in Configuration Manager 2007 native mode.

3Configuration Manager 2007 SP1 support for x64 and Itanium-based systems is through 32-bit code running on 64-bit operating systems.

4Windows XP Embedded is supported; however, for information about known limitations, see Known Limitations in Configuration Manager Support for Windows XP Embedded.

Mobile Device Client

The Mobile Device Client requires 0.78 MB of storage space to install. In addition, mobile device management logging on the mobile device can require 256 KB of storage space. The mobile device client is supported on the following platforms:

  • Windows Mobile for Pocket PC 2003
  • Windows Mobile for Pocket PC 2003 Second Edition
  • Windows Mobile for Pocket PC Phone Edition 2003
  • Windows Mobile for Pocket PC Phone Edition 2003 Second Edition
  • Windows Mobile Smartphone 2003
    Note
    Password management is not supported for Windows Mobile Smartphone 2003.

  • Windows Mobile for Pocket PC 5.0
  • Windows Mobile for Pocket PC Phone Edition 5.0
  • Windows Mobile 5.0 Smartphone
  • Windows CE 4.2 (ARM processor only)
  • Windows CE 5.0 (ARM and x86 processors)
  • Windows Mobile 6 Standard
  • Windows Mobile 6 Professional
  • Windows Mobile 6 Classic
    Note
    Password management on Windows Mobile for Pocket PC 5.0, Windows Mobile for Pocket PC Phone Edition 5.0, and Windows Mobile 5.0 Smartphone requires the Messaging and Security Feature Pack (MSPF). For more information, see the Windows Mobile Messaging and Security Feature Pack Web page (http://go.microsoft.com/fwlink/?LinkId=80392).

Some Configuration Manager 2007 client features, such as operating system deployment, are not supported for the mobile device client. For more information about managing devices with Configuration Manager, see Overview of Mobile Device Management.

Configuration Manager 2007 Site Server System Requirements

Configuration Manager 2007 introduces changes to supported site system requirements from previous versions.

Site System Hardware Requirements

The following table lists the minimum and recommended hardware requirements for Configuration Manager 2007 site systems.

Hardware Component | Requirement
Processor | 733-MHz Pentium III minimum (2.0 GHz or faster recommended)
RAM | 256-MB minimum (1024 MB or more recommended)
Free Disk Space | 5-GB minimum (15 GB or more free recommended if using operating system deployment)

Supported Site System Platforms

Supported Configuration Manager 2007 site system role installation, for roles other than the branch distribution point and Configuration Manager console, requires at least Windows Server 2003 SP1. Configuration Manager 2007 does not support site system role installation on servers running Windows 2000 Server or Windows 2003 Server with no service pack installed.

The following table lists the minimum operating systems required to support the various Configuration Manager 2007 site system roles.

Note
Microsoft provides support for the current service pack and, in some cases the immediately preceding service pack. To find the support timelines for your product, visit the Lifecycle Supported Service Packs Web site at http://go.microsoft.com/fwlink/?LinkId=31975. For additional information about Microsoft’s support lifecycle policy, visit the Microsoft Support Lifecycle Support Policy FAQ Web site at http://go.microsoft.com/fwlink/?LinkId=31976.

Key:

√ = Supported

Ø = Unsupported

Operating System | Primary Site Server | Secondary Site Server | Management Point | State Migration Point | Distribution Point | Reporting Point | Server Locator Point | Site Database Server | Software Update Point | Fallback Status Point | PXE Service Point | Configuration Manager Console2
Windows XP Professional SP2 | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows XP Professional for 64-bit Systems | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Vista Business Edition | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Vista Enterprise Edition | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Vista Ultimate Edition | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Vista Business Edition SP1 | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Vista Enterprise Edition SP1 | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Vista Ultimate Edition SP1 | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Server 2003 Web Edition SP1 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Server 2003 Standard Edition SP1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Standard Edition SP1 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition SP1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition SP1 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Datacenter Edition SP1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Datacenter Edition SP1 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Storage Server Edition SP1 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Server 2003 Standard Edition R2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Standard Edition R2 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition R2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition R2 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Web Edition SP2 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Server 2003 Standard Edition SP2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Standard Edition SP2 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition SP2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition SP2 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Datacenter Edition SP2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Datacenter Edition SP2 64-bit | √ | √ | √ | √ | √ | √3 | √ | √ | √ | √ | √ | √
Windows Server 2003 Storage Server Edition SP2 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Server 2008 Standard Edition | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Server 2008 Enterprise Edition | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √
Windows Server 2008 Datacenter Edition | Ø | Ø | Ø | Ø | √1 | Ø | Ø | Ø | Ø | Ø | Ø | √

1Only the branch distribution point role is supported for this operating system.

2It is not supported to install the Configuration Manager 2007 console on computers running any site system role except the site server.

3To use graphs in reports, Office Web Components (Microsoft Office 2000 SP2, Microsoft Office XP, or Microsoft Office 2003) must be installed. However, Office Web Components is not supported on 64-bit operating systems. If you want to use graphs in reports, use 32-bit operating systems for your reporting points.

Note
It is supported to host the site database on both 32-bit and 64-bit versions of SQL Server 2005 SP2 Standard and Enterprise editions. However, installing the site database on Itanium 64-bit platforms is not supported.

Unsupported Operating Systems

The operating system versions described in this section are not supported by Configuration Manager 2007.

Unsupported Client Platforms

The Configuration Manager client is not supported on any operating system prior to Windows 2000 SP4. Installing the Configuration Manager client is explicitly not supported on the following operating system versions:

  • Windows 95
  • Windows 98
  • Windows Millennium Edition
  • Windows XP Media Center Edition
  • Windows XP Starter Edition
  • Windows XP Home Edition
  • Windows XP Professional, with less than SP2 applied
  • Windows Vista Starter Edition
  • Windows Vista Home Basic Edition
  • Windows Vista Home Premium Edition
  • Windows Vista Starter Edition SP1
  • Windows Vista Home Basic Edition SP1
  • Windows Vista Home Premium Edition SP1
  • Windows NT Workstation 4.0
  • Windows NT Server 4.0
  • Windows 2000 Server SP3 and earlier
  • Windows 2003 Server, with no service pack installed
  • Windows CE 3.0
  • Windows Mobile Pocket PC 2002
  • Windows Mobile SmartPhone 2002

Unsupported Site Server Platforms

Configuration Manager 2007 site server roles are not supported on any operating system prior to Windows Server 2003 SP1. Configuration Manager 2007 site roles are explicitly not supported on the following operating system versions:

  • Windows NT 4.0 Server
  • Windows 2000 Server
  • Windows 2003 Server, with no service pack installed
  • Windows Server 2008, with the exception of the System Health Validator
  • Windows Server 2008 server core installation option

Configuration Specifics

This section describes specific configuration options and requirements for Configuration Manager 2007.

Active Directory Schema Extensions

Configuration Manager 2007 Active Directory schema extensions provide many benefits for Configuration Manager 2007 sites, but they are not required. If you have extended your Active Directory schema for SMS 2003, you should update your schema extensions for Configuration Manager 2007. For more information about extending the Active Directory schema for Configuration Manager 2007, see How to Extend the Active Directory Schema for Configuration Manager.

SQL Server Site Database Configurations

When installing Configuration Manager 2007, the SQL Server site database can be installed on either the default instance or a named instance of SQL Server 2005 SP2. The instance used to host the site database can also be configured as a SQL Server failover cluster instance.

It is not supported to install Configuration Manager 2007 site servers or any site system server role other than the site database server on a Windows Server cluster instance. However, physical node computers of a Windows server cluster instance can be managed as Configuration Manager 2007 clients.

Note
SQL Server 2005 database mirroring is not supported for the Configuration Manager 2007 site database.

In SMS 2003, the mppublish.vbs script, supplied with the SMS 2003 installation files, was used to configure Microsoft SQL Server site database replication between the site database server and SQL Server site database replicas used to support management points and server locator points. Because Configuration Manager 2007 introduces new site database views and functions that are not replicated by the mppublish.vbs script, it is not supported for configuring SQL Server site database replication in Configuration Manager 2007 sites. For information about how to configure replication to support management points and server locator points, see How to Configure SQL Server Site Database Replication.

Multi-Site Clients

Configuration Manager 2007 clients can be assigned and report to only one site. When auto assignment is used to assign clients to a site during client installation and more than one site has the same boundary configured, the actual site assignment of a client cannot be predicted. If boundaries overlap across multiple Configuration Manager 2007 or SMS 2003 site hierarchies, clients might not get assigned to the correct site hierarchy or might not even get assigned to a site at all.

Note
Physical node computers of a Windows server cluster instance can be managed as Configuration Manager 2007 clients.

Support for Specialized Storage Technology

This section describes storage technologies that are supported, or not supported, in Configuration Manager 2007.

Storage Area Network Support

Using a Storage Area Network (SAN) is supported as long as a supported Windows server is attached directly to the volume hosted by the SAN.

Configuration Manager 2007 is designed to work with any hardware that is certified on the Windows Hardware Compatibility List (HCL) for the version of the operating system that the Configuration Manager component is installed on.

Configuration Manager 2007 site server roles require NTFS file systems so that directory and file permissions can be set. Because Configuration Manager 2007 assumes it has complete ownership of a logical drive when it uses naming conventions, site systems running on separate computers can’t share a logical partition on any storage technology, but they could each use their own logical partition on a physical partition of a shared storage device.

For more information about the use of System Area Networks and Configuration Manager 2007, see the following related Knowledge Base articles:

  • For information about System Area Networks, see Knowledge Base article 260176 at http://go.microsoft.com/fwlink/?LinkId=66170.
  • For information about the differences between System Area Networks and Storage Area Networks, see Knowledge Base article 264135 at http://go.microsoft.com/fwlink/?LinkId=66171.
  • For information about Systems Management Server and Storage Area Networks, see Knowledge Base article 307813 at http://go.microsoft.com/fwlink/?LinkId=66172.

Single Instance Storage Support

Configuring distribution point package and signature folders to be configured on a Single Instance Storage (SIS)-enabled volume is not supported. It is also not supported for a Configuration Manager 2007 client's cache to be configured on a SIS-enabled volume.

Note
Single Instance Storage (SIS) is a feature of the Windows Storage Server 2003 R2 operating system.

Removable Disk Drive Support

It is not supported to install Configuration Manager 2007 site system or client components on a removable disk drive.

Computers in Workgroups

All site systems must be members of an Active Directory domain. This requirement includes site systems that support Internet-based client management in a perimeter network.

Note
It is not supported to change the domain membership or computer name of a Configuration Manager 2007 site system after it is installed.

Configuration Manager 2007 provides support for clients in workgroups. It is also supported for a client to be moved from a workgroup to a domain or from a domain to a workgroup.

To support workgroup clients, the following requirements must be met:

  • During client installation, the logged-on user must possess local administrator rights on the workgroup system. The only account that Configuration Manager 2007 can use to perform activities that require local administrator privileges is the account of the user that is logged on to the computer.
  • The Configuration Manager client must be installed from a local source on each client machine. This requirement ensures that a local source for repair and client update application will be available for the client.
  • Workgroup clients must be able to locate a server locator point for site assignment because they cannot query Active Directory Domain Services. The server locator point can be manually published in Windows Internet Naming Service (WINS), or it can be specified in the CCMSetup.exe installation command-line parameters.
  • Workgroup clients must use the Network Access Account to access package source files on distribution points. If a Network Access Account is not configured, clients cannot access content on the distribution point. For more information, see Example Package Access Scenarios.

Although workgroup computers can be Configuration Manager 2007 clients, there are inherent limitations in supporting workgroup computers, including the following:

  • Workgroup clients cannot reference Configuration Manager 2007 objects published to Active Directory Domain Services. For workgroup clients to locate their default management point computer, it must be registered and accessible to workgroup clients in either WINS or DNS.
  • Active Directory system, user, or user group discovery is not possible.
  • User targeted advertisements are not possible.
  • The client push installation method is not supported for workgroup client installation. For more information about installing the Configuration Manager client on workgroup computers, see How to Install Configuration Manager Clients on Workgroup Computers.
  • Global roaming is not possible. For more information about client roaming capabilities and behavior, see About Client Roaming in Configuration Manager.
  • Using a workgroup client as a branch distribution point is not supported. Configuration Manager 2007 requires that all site systems, including branch distribution point computers, are members of an Active Directory domain.

Remote Assistance Console Sessions

Console sessions controlled by Remote Assistance are supported, except for simultaneous use of Configuration Manager Remote Tools.

Invoking Remote Assistance from the Configuration Manager console requires that the Configuration Manager console computer and the client computer are running one of the following operating systems:

  • Windows XP SP2
  • Windows Server 2003 SP1 or later
  • Windows Server 2003 R2
  • Windows Server 2008)
  • Windows Vista (supported editions)
  • Windows Vista SP1 (supported editions)

Fast User Switching

Fast User Switching, which is available in Windows XP editions not joined to a domain and in Windows Vista editions, is not supported in Configuration Manager 2007.

Dual Boot Computers

Configuration Manager 2007 cannot manage more than one operating system on a single computer. If there is more than one operating system on a computer that must be managed, tailor the discovery and installation methods used to ensure that the Configuration Manager client is installed only on the operating system that needs to be managed.

Virtual Machines

Configuration Manager 2007 support for virtual machine guest operating systems includes all supported client operating systems running on Microsoft Virtual PC or Virtual Server 2005 R2.

Note
Configuration Manager 2007 does not support Virtual PC or Virtual Server guests running on Macintosh.

Configuration Manager 2007 cannot manage Virtual PC or Virtual Server guest operating systems unless they are running. A static Virtual PC image cannot be updated, nor can inventory be collected using the Configuration Manager client on the host computer.

No special consideration is given to virtual machines. For example, Configuration Manager 2007 might not determine that an update needs to be re-applied to a virtual machine image if it is stopped and restarted without saving the version of the image to which the update was applied.

Configuration Manager 2007 supports all site server roles running as virtual machines only on Microsoft Virtual Server 2005 R2.

Interoperability Between Configuration Manager and SMS 2003 Sites

The Configuration Manager console cannot be used to fully manage an SMS 2003 primary site. You can use an SMS 2003 Administrator console snap-in to manage SMS 2003 primary sites on a computer that does not have the Configuration Manager console installed, or you can install the Configuration Manager console on a computer that already has the SMS 2003 Administrator console installed on it. There are planning considerations when hosting both consoles on the same computer, which should be considered before installing a Configuration Manager 2007 console on a computer that already has the SMS 2003 Administrator console installed on it. For more information about planning for Configuration Manager 2007 console installations, see Planning for the Configuration Manager Console.

The Configuration Manager console can manage an SMS 2003 secondary site connected to a Configuration Manager 2007 primary parent site, with the following limitations:

  • You cannot change the accounts or passwords of SMS 2003 secondary sites in the Configuration Manager console.
  • You cannot create or configure RAS sender addresses on SMS 2003 secondary sites.
  • You cannot configure Active Directory Security Group Discovery on an SMS 2003 secondary site.

SMS 2003 clients can be assigned to a Configuration Manager 2007 site, and they will be fully interoperable. However, assigning Configuration Manager clients to SMS 2003 sites is not supported, and they will not function properly.

Ensure that the boundaries defined for your Configuration Manager site are set properly. When installing Configuration Manager clients by using auto assignment, ensure that Configuration Manager clients are not within the boundaries of an SMS 2003 site.

Changes in Support from SMS 2003

Support changes in Configuration Manager 2007 include the following:

  • SQL Server 2005 SP2 is now required to host the site database. SQL Server 7.0 and SQL Server 2000 are no longer supported to host the site database.
  • The site database can be installed on the default or a named instance of SQL Server 2005, and it is supported to move the site database back to a local installation of SQL Server 2005 installed on the site server computer if it has been moved off of the site server computer previously.
  • Windows Vista Business, Windows Vista Enterprise, and Windows Vista Ultimate editions are now fully supported client operating systems.

See Also

Concepts

Configuration Manager 2007 SP1 Supported Configurations
Prerequisites for Installing Configuration Manager


Configuration Manager 2007 SP1 Supported Configurations

Topic Last Updated—August 2008

This topic specifies the hardware and software requirements necessary to implement and maintain Microsoft System Center Configuration Manager 2007 Service Pack (SP1) in your environment. For information about installation prerequisites required for Configuration Manager sites, see Prerequisites for Installing Configuration Manager.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Supported Upgrade Paths

Client System Requirements

Site Server System Requirements

Unsupported Operating Systems

Configuration Specifics

Interoperability Between Site Versions

Changes in Support from SMS 2003

Supported Upgrade Paths

Configuration Manager 2007 SP1 will be available in the following forms:

  • As an evaluation release, which expires 180 days after installation
  • As a service pack release, to be applied to an existing Configuration Manager 2007 site
  • As a complete release, to perform a new or upgrade installation

The following table shows which versions can be upgraded to Configuration Manager 2007 SP1.

 | Configuration Manager 2007 SP1 Evaluation Release | Configuration Manager 2007 SP1 Service Pack Release | Configuration Manager 2007 SP1 Complete Release
SMS 2003 SP1 | No | No | No
SMS 2003 SP2 | No | No | Yes
SMS 2003 SP3 | Yes | No | Yes
Configuration Manager 2007 (no service pack) | Yes | Yes | Yes
Configuration Manager 2007 Evaluation Release | No | No | No
Configuration Manager 2007 SP1 Evaluation Release | n/a | No | Yes

Configuration Manager 2007 SP1 Client System Requirements

Configuration Manager 2007 SP1 does not introduce any significant change from Configuration Manager 2007, though the following table has been updated to include some operating systems that were previously omitted. There are no changes to the hardware requirements or operating systems for mobile device clients or embedded operating systems.

Client Hardware Requirements

The following table lists the minimum and recommended hardware requirements for Configuration Manager 2007 SP1 computer clients. For information about device client requirements, see the "Mobile Device Client" section later in this section.

Hardware Component | Requirement
Processor | 233-MHz minimum (300-MHz or faster Intel Pentium/Celeron family or comparable processor recommended).
RAM | Minimum operating system requirement or at least 128 MB minimum (256 MB or more recommended; 384 MB required if using operating system deployment).
Free Disk Space | 350-MB minimum for a new installation; 265-MB minimum to upgrade an existing client. (By default, the temporary program download folder on clients is preconfigured at client installation to automatically increase to 5 GB if necessary and if 5 GB or more is available.)

Supported Client Platforms

Supported Configuration Manager 2007 SP1 client installation requires at least Windows 2000 Professional Service Pack 4.

The following table lists the minimum Configuration Manager 2007 SP1 supported client operating systems.

Note
Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, visit the Lifecycle Supported Service Packs Web site at http://go.microsoft.com/fwlink/?LinkId=31975. For additional information about Microsoft’s support lifecycle policy, visit the Microsoft Support Lifecycle Support Policy FAQ Web site at http://go.microsoft.com/fwlink/?LinkId=31976.

Key:

√ = Supported

Ø = Unsupported

Operating System | x86 | x643 | Itanium based3
Windows 2000 Professional Service Pack 4 | √ | Ø | Ø
Windows XP Professional Service Pack 2 | √ | √ | Ø
Windows XP Professional Service Pack 3 | √ | √ | Ø
Windows XP Professional for 64-Bit Systems | Ø | √ | Ø
Windows Vista Business Edition | √ | √ | Ø
Windows Vista Enterprise Edition | √ | √ | Ø
Windows Vista Ultimate Edition | √ | √ | Ø
Windows Vista Business Edition Service Pack 1 | √ | √ | Ø
Windows Vista Enterprise Edition Service Pack 1 | √ | √ | Ø
Windows Vista Ultimate Edition Service Pack 1 | √ | √ | Ø
Windows 2000 Server Service Pack 4 | √ | Ø | Ø
Windows 2000 Advanced Server Service Pack 4 | √ | Ø | Ø
Windows 2000 Datacenter1 Service Pack 4 | √ | Ø | Ø
Windows Server 2003 Web Edition, Service Pack 1 | √ | Ø | Ø
Windows Server 2003 Standard Edition Service Pack 1 | √ | √ | Ø
Windows Server 2003 Enterprise Edition Service Pack 1 | √ | √ | √
Windows Server 2003 Datacenter Edition1 Service Pack 1 | √ | √ | √
Windows Server 2003 Web Edition, Service Pack 2 | √ | Ø | Ø
Windows Server 2003 Standard Edition Service Pack 2 | √ | √ | Ø
Windows Server 2003 Enterprise Edition Service Pack 2 | √ | √ | √
Windows Server 2003 Datacenter Edition1 Service Pack 2 | √ | √ | √
Windows Server 2003 R2 Datacenter Edition1 | √ | √ | Ø
Windows Server 2003 R2 Standard Edition | √ | √ | Ø
Windows Server 2003 R2 Enterprise Edition | √ | √ | Ø
Windows Server 2008 Standard Edition2 | √ | √ | Ø
Windows Server 2008 Enterprise Edition2 | √ | √ | Ø
Windows Server 2008 Datacenter Edition1 2 | √ | √ | Ø
Windows Server®°2008 for Itanium-Based Systems operating system | Ø | Ø | √
Windows Embedded for Point of Service (WEPOS)4 | √ | Ø | Ø
Windows Fundamentals for Legacy PCs (WinFLP) | √ | Ø | Ø
Windows XP Embedded SP24 | √ | Ø | Ø
Windows XP Tablet PC SP2 | √ | Ø | Ø

1Datacenter releases are supported but not certified for Configuration Manager 2007 SP1. Hotfix support is not offered for issues specific to Windows Datacenter Server edition.

2Clients are supported on both Server Core installations of Windows Server°2008 and full installations of Windows Server°2008; however, desired configuration management and out-of-band management work only on a full installation of Windows Server°2008.

3Configuration Manager 2007 SP1 support for x64 and Itanium-based systems is through 32-bit code running on 64-bit operating systems.

4Windows XP Embedded is supported; however, for information about known limitations, see Known Limitations in Configuration Manager Support for Windows XP Embedded.

Mobile Device Client

The Mobile Device Client requires 0.78 MB of storage space to install. In addition, mobile device management logging on the mobile device can require 256 KB of storage space. The mobile device client is supported on the following platforms:

  • Windows Mobile for Pocket PC 2003
  • Windows Mobile for Pocket PC 2003 Second Edition
  • Windows Mobile for Pocket PC Phone Edition 2003
  • Windows Mobile for Pocket PC Phone Edition 2003 Second Edition
  • Windows Mobile Smartphone 2003
    Note
    Password management is not supported for Windows Mobile Smartphone 2003.

  • Windows Mobile for Pocket PC 5.0
  • Windows Mobile for Pocket PC Phone Edition 5.0
  • Windows Mobile 5.0 Smartphone
  • Windows CE 4.2 (ARM processor only)
  • Windows CE 5.0 (ARM and x86 processors)
  • Windows Mobile 6 Standard
  • Windows Mobile 6 Professional
  • Windows Mobile 6 Classic
    Note
    Password management on Windows Mobile for Pocket PC 5.0, Windows Mobile for Pocket PC Phone Edition 5.0, and Windows Mobile 5.0 Smartphone requires the Messaging and Security Feature Pack (MSPF). For more information, see the Windows Mobile Messaging and Security Feature Pack Web page (http://go.microsoft.com/fwlink/?LinkId=80392).

Some Configuration Manager 2007 SP1 client features, such as operating system deployment, are not supported for the mobile device client. For more information about managing devices with Configuration Manager, see Overview of Mobile Device Management.

Configuration Manager 2007 Site Server System Requirements

Configuration Manager 2007 SP1 introduces support for server roles with the Windows Server 2008 operating system operating system.

Site System Hardware Requirements

The following table lists the minimum and recommended hardware requirements for Configuration Manager 2007 SP1 site systems.

Hardware Component | Requirement
Processor | 733-MHz Pentium III minimum (2.0 GHz or faster recommended)
RAM | 256-MB minimum (1024 MB or more recommended)
Free Disk Space | 5-GB minimum (15 GB or more free recommended if using operating system deployment)

Supported Site System Platforms

Supported Configuration Manager 2007 SP1 site system role installation, for roles other than the branch distribution point and Configuration Manager console, requires at least Windows Server 2003 Service Pack 1. Configuration Manager 2007 SP1 does not support site system role installation on servers running Windows 2000 Server or Windows 2003 Server with no service pack installed.

The following tables list the minimum operating systems required to support the various Configuration Manager 2007 SP1 site system roles.

Note
Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, visit the Lifecycle Supported Service Packs Web site at http://go.microsoft.com/fwlink/?LinkId=31975. For additional information about Microsoft’s support lifecycle policy, visit the Microsoft Support Lifecycle Support Policy FAQ Web site at http://go.microsoft.com/fwlink/?LinkId=31976.

Core Site System Roles

The site systems listed in the following table support basic site operations.

Key:

√ = Supported

Ø = Unsupported

Operating System | Primary Site Server | Secondary Site Server | Management Point | Standard Distribution Point | Branch Distribution Point | Server Locator Point | Site Database Server | Fallback Status Point | Configuration Manager Console2 | SMS Provider Computer
Windows XP Professional Service Pack 2 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows XP Professional Service Pack 3 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows XP Professional for 64-Bit Systems | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows Vista Business Edition | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows Vista Enterprise Edition | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows Vista Ultimate Edition | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows Vista Business Edition Service Pack 1 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows Vista Enterprise Edition Service Pack 1 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows Vista Ultimate Edition Service Pack 1 | Ø | Ø | Ø | Ø | √ | Ø | Ø | Ø | √ | Ø
Windows Server 2003 Web Edition Service Pack 1 | Ø | Ø | Ø | √ | √ | Ø | Ø | Ø | √ | Ø
Windows Server 2003 Standard Edition Service Pack 1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition Service Pack 1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Standard Edition Service Pack 1 64 Bit | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition Service Pack 1 64 Bit | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Datacenter Edition Service Pack 1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Storage Server Edition Service Pack 1 | Ø | Ø | Ø | √ | √ | Ø | Ø | Ø | √ | Ø
Windows Server 2003 Web Edition Service Pack 2 | Ø | Ø | Ø | √ | √ | Ø | Ø | Ø | √ | Ø
Windows Server 2003 Standard Edition Service Pack 2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition Service Pack 2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Standard Edition Service Pack 2 64 Bit | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Enterprise Edition Service Pack 2 64 Bit | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Datacenter Edition Service Pack 2 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 Storage Server Edition Service Pack 2 | Ø | Ø | Ø | √ | √ | Ø | Ø | Ø | √ | Ø
Windows Server 2003 R2 Standard Edition | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2003 R2 Enterprise Edition | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2008 Standard Edition1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2008 Enterprise Edition1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2008 Standard Edition 64 Bit1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2008 Enterprise Edition 64 Bit1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √
Windows Server 2008 Datacenter Edition1 | √ | √ | √ | √ | √ | √ | √ | √ | √ | √

1Site system roles are not supported on a Server Core installation of Windows Server°2008. Also, you must perform some manual configuration on some site roles running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

Note
It is supported to host the site database on both 32-bit and 64-bit versions of SQL Server 2005 SP2 Standard and Enterprise editions. However, installing the site database on Itanium 64-bit platforms is not supported.

2It is not supported to install the Configuration Manager 2007 console on computers running any site system role except the site server.

Upgrading the operating system on the site server from Windows Server 2003 to Windows Server 2008 is not supported. If you want to run your Configuration Manager 2007 SP1 site on a Windows Server 2008 operating system, you must use a new installation of Configuration Manager 2007 SP1.

Feature-Specific Site System Roles

In Configuration Manager 2007 SP1, Network Access Protection is fully supported. Network Access Protection in Configuration Manager 2007 requires a System Health Validator Point running Windows Server 2008 operating system.

The out-of-band service point role has been added for Configuration Manager 2007 SP1. For more information, see Out of Band Management in Configuration Manager 2007 SP1.

The Asset Intelligence synchronization point has been added for Configuration Manager 2007 SP1. For more information, see Asset Intelligence in Configuration Manager.

The site systems listed in the following table are required for specific features.

Key:

√ = Supported

Ø = Unsupported

Operating System | State Migration Point | Reporting Point | System Health Validator Point | PXE service Point | Out of Band Service Point | Asset Intelligence Synchronization Point
Windows XP Professional Service Pack 2 | Ø | Ø | Ø | Ø | Ø | Ø
Windows XP Professional Service Pack 3 | Ø | Ø | Ø | Ø | Ø | Ø
Windows XP Professional for 64-Bit Systems | Ø | Ø | Ø | Ø | Ø | Ø
Windows Vista Business Edition | Ø | Ø | Ø | Ø | Ø | Ø
Windows Vista Enterprise Edition | Ø | Ø | Ø | Ø | Ø | Ø
Windows Vista Ultimate Edition | Ø | Ø | Ø | Ø | Ø | Ø
Windows Vista Business Edition Service Pack 1 | Ø | Ø | Ø | Ø | Ø | Ø
Windows Vista Enterprise Edition Service Pack 1 | Ø | Ø | Ø | Ø | Ø | Ø
Windows Vista Ultimate Edition Service Pack 1 | Ø | Ø | Ø | Ø | Ø | Ø
Windows Server 2003 Web Edition Service Pack 1 | Ø | Ø | Ø | Ø | Ø | Ø
Windows Server 2003 Standard Edition Service Pack 1 | √ | √ | Ø | √ | Ø | √
Windows Server 2003 Enterprise Edition Service Pack 1 | √ | √ | Ø | √ | Ø | √
Windows Server 2003 Standard Edition Service Pack 1 64 Bit | √ | √2 | Ø | √ | Ø | √
Windows Server 2003 Enterprise Edition Service Pack 1 64 Bit | √ | √2 | Ø | √ | Ø | √
Windows Server 2003 Datacenter Edition Service Pack 1 | √ | √ | Ø | √ | Ø | √
Windows Server 2003 Storage Server Edition Service Pack 1 | Ø | Ø | Ø | Ø | Ø | Ø
Windows Server 2003 Web Edition Service Pack 2 | Ø | Ø | Ø | Ø | Ø | Ø
Windows Server 2003 Standard Edition Service Pack 2 | √ | √ | Ø | √ | √3 | √
Windows Server 2003 Enterprise Edition Service Pack 2 | √ | √ | Ø | √ | √3 | √
Windows Server 2003 Standard Edition Service Pack 2 64 Bit | √ | √2 | Ø | √ | √3 | √
Windows Server 2003 Enterprise Edition Service Pack 2 64 Bit | √ | √2 | Ø | √ | √3 | √
Windows Server 2003 Datacenter Edition Service Pack 2 | √ | √ | Ø | √ | √3 | √
Windows Server 2003 Storage Server Edition Service Pack 2 | Ø | Ø | Ø | √ | √3 | Ø
Windows Server 2003 R2 Standard Edition | √ | √ | Ø | √ | √ | √
Windows Server 2003 R2 Enterprise Edition | √ | √ | Ø | √ | √ | √
Windows Server 2008 Standard Edition1 | √ | √ | √ | √ | √ | √
Windows Server 2008 Enterprise Edition1 | √ | √ | √ | √ | √ | √
Windows Server 2008 Standard Edition 64 Bit1 | √ | √2 | √ | √ | √ | √
Windows Server 2008 Enterprise Edition 64 Bit1 | √ | √2 | √ | √ | √ | √
Windows Server 2008 Datacenter Edition1 | √ | √ | √ | √ | √ | √

1Site system roles are not supported on a Server Core installation of Windows Server°2008. Also, you must perform some manual configuration on some site roles running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

Note
It is supported to host the site database on both 32-bit and 64-bit versions of SQL Server 2005 Standard and Enterprise editions.

2To use graphs in reports, Office Web Components (Microsoft Office 2000 SP2, Microsoft Office XP, or Microsoft Office 2003) must be installed. However, Office Web Components is not supported on 64-bit operating systems. If you want to use graphs in reports, use 32-bit operating systems for your reporting points.

3Out of band service points running Windows 2003 Server SP2 require KB 942841.

Unsupported Operating Systems

The list of unsupported platforms has not changed for Configuration Manager 2007 SP1, although additional operating systems can be past the service pack support dates. To find the support timelines for your product, visit the Lifecycle Supported Service Packs Web site at http://go.microsoft.com/fwlink/?LinkId=31975. For additional information about Microsoft’s support lifecycle policy, visit the Microsoft Support Lifecycle Support Policy FAQ Web site at http://go.microsoft.com/fwlink/?LinkId=31976.

Unsupported Client Platforms

The Configuration Manager 2007 SP1 client is not supported on any operating system prior to Windows 2000 Service Pack 4. Installing the Configuration Manager 2007 SP1 client is explicitly not supported on the following operating system versions:

  • Windows 95
  • Windows 98
  • Windows Millennium Edition
  • Windows XP Media Center Edition
  • Windows XP Starter Edition
  • Windows XP Home Edition
  • Windows XP Professional, with less than Service Pack 2 applied
  • Windows Vista Starter Edition
  • Windows Vista Home Basic Edition
  • Windows Vista Home Premium Edition
  • Windows NT Workstation 4.0
  • Windows NT Server 4.0
  • Windows 2000 Server, Service Pack 3 and earlier
  • Windows 2003 Server, with no service pack installed
  • Windows CE 3.0
  • Windows Mobile Pocket PC 2002
  • Windows Mobile SmartPhone 2002

Unsupported Site Server Platforms

Configuration Manager 2007 SP1 site server roles are not supported on any operating system prior to Windows Server 2003 Service Pack 1. Configuration Manager 2007 SP1 site roles are explicitly not supported on the following operating system versions:

  • Windows NT 4.0 Server
  • Windows 2000 Server
  • Windows 2003 Server, with no service pack installed

Configuration Specifics

The following configuration specifics have not changed in Configuration Manager 2007 SP1, though some of the following content has been reorganized and re-edited for clarity.

Active Directory Schema Extensions

Configuration Manager Active Directory schema extensions provide many benefits for Configuration Manager sites, but they are not required. If you have extended your Active Directory schema for SMS 2003, you should update your schema extensions for Configuration Manager 2007. If you have already extended your schema for Configuration Manager 2007, no additional schema extensions are required for Configuration Manager 2007 SP1. For more information about extending the Active Directory schema for Configuration Manager 2007, see How to Extend the Active Directory Schema for Configuration Manager.

Configuring SQL Server Site Database Replication in Configuration Manager 2007

In SMS 2003, the mppublish.vbs script, supplied with the SMS 2003 installation files, was used to configure Microsoft SQL Server site database replication between the site database server and SQL Server site database replicas used to support management points and server locator points. Because Configuration Manager 2007 introduces new site database views and functions that are not replicated by the mppublish.vbs script, it is not supported for configuring SQL Server site database replication in Configuration Manager 2007 sites. For information about how to configure replication to support management points and server locator points, see How to Configure SQL Server Site Database Replication.

Support for Windows Server Clustering

It is supported to install the site database server site system role on a Windows server failover cluster instance. It is not supported to install Configuration Manager 2007 SP1 site servers or any other site system server role on a Windows Server cluster instance.

Note
Physical node computers of a Windows server cluster instance can be managed as Configuration Manager 2007 SP1 clients

Multi-Site Clients

Configuration Manager 2007 SP1 clients can be assigned and report to only one site. When auto assignment is used to assign clients to a site during client installation and more than one site has the same boundary configured, the actual site assignment of a client cannot be predicted. If boundaries overlap across multiple Configuration Manager 2007, Configuration Manager 2007 SP1, and SMS 2003 site hierarchies, clients might not get assigned to the correct site hierarchy or might not even get assigned to a site at all.

Support for Specialized Storage Technology

This section describes storage technologies that are supported, or not supported, in Configuration Manager 2007 SP1.

Storage Area Network Support

Using a Storage Area Network (SAN) is supported as long as a supported Windows server is attached directly to the volume hosted by the SAN.

Configuration Manager 2007 SP1 is designed to work with any hardware that is certified on the Windows Hardware Compatibility List (HCL) for the version of the operating system that the Configuration Manager component is installed on.

Configuration Manager 2007 SP1 site server roles require NTFS file systems so that directory and file permissions can be set. Because Configuration Manager 2007 SP1 assumes it has complete ownership of a logical drive when it uses naming conventions, site systems running on separate computers can’t share a logical partition on any storage technology, but they could each use their own logical partition on a physical partition of a shared storage device.

For more information about the use of System Area Networks, see the following related Knowledge Base articles:

  • For information about System Area Networks, see Knowledge Base article 260176 at http://go.microsoft.com/fwlink/?LinkId=66170.
  • For information about the differences between System Area Networks and Storage Area Networks, see Knowledge Base article 264135 at http://go.microsoft.com/fwlink/?LinkId=66171.
  • For information about Systems Management Server and Storage Area Networks, see Knowledge Base article 307813 at http://go.microsoft.com/fwlink/?LinkId=66172.

Single Instance Storage Support

Configuring distribution point package and signature folders to be configured on a Single Instance Storage (SIS)-enabled volume is not supported. It is also not supported for a Configuration Manager 2007 SP1 client's cache to be configured on a SIS-enabled volume.

Note
Single Instance Storage (SIS) is a feature of the Windows Storage Server 2003 R2 operating system.

Removable Disk Drive Support

It is not supported to install Configuration Manager 2007 SP1 site system or client components on a removable disk drive.

Computers in Workgroups

All site systems must be members of an Active Directory domain. This requirement includes site systems that support Internet-based client management in a perimeter network.

Note
It is not supported to change the domain membership or computer name of a Configuration Manager 2007 SP1 site system after it is installed.

Configuration Manager 2007 SP1 provides support for clients in workgroups. It is also supported for a client to be moved from a workgroup to a domain or from a domain to a workgroup.

To support workgroup clients, the following requirements must be met:

  • During client installation, the logged-on user must possess local administrator rights on the workgroup system. The only account that Configuration Manager 2007 SP1 can use to perform activities that require local administrator privileges is the account of the user that is logged on to the computer.
  • The Configuration Manager client must be installed from a local source on each client machine. This requirement ensures that a local source for repair and client update application will be available for the client.
  • Workgroup clients must be able to locate a server locator point for site assignment because they cannot query Active Directory Domain Services. The server locator point can be manually published in Windows Internet Naming Service (WINS), or it can be specified in the CCMSetup.exe installation command-line parameters.
  • Workgroup clients must use the Network Access Account to access package source files on distribution points. If a Network Access Account is not configured, clients cannot access content on the distribution point. For more information, see Example Package Access Scenarios.

Although workgroup computers can be Configuration Manager 2007 SP1 clients, there are inherent limitations in supporting workgroup computers, including the following:

  • Workgroup clients cannot reference Configuration Manager 2007 SP1 objects published to Active Directory Domain Services. For workgroup clients to locate their default management point computer, it must be registered and accessible to workgroup clients in either WINS or DNS. For more information, see Configuration Manager and Service Location (Site Information and Management Points).
  • Workgroup clients must use the trusted root key to establish trust with a management point. For more information, see About the Trusted Root Key.
  • Active Directory system, user, or user group discovery is not possible.
  • User-targeted advertisements are not possible.
  • The client push installation method is not supported for workgroup client installation. For more information about installing the Configuration Manager client on workgroup computers, see How to Install Configuration Manager Clients on Workgroup Computers.
  • Global roaming is not possible. For more information about client roaming capabilities and behavior, see About Client Roaming in Configuration Manager.
  • Using a workgroup client as a branch distribution point is not supported. Configuration Manager 2007 SP1 requires that all site systems, including branch distribution point computers, are members of an Active Directory domain.

Remote Assistance Console Sessions

Console sessions controlled by Remote Assistance are supported, except for simultaneous use of Configuration Manager Remote Tools.

Invoking Remote Assistance from the Configuration Manager console requires that the Configuration Manager console computer and the client computer are running one of the following operating systems:

  • Windows XP SP2
  • Windows XP SP3
  • Windows Server 2003 SP1
  • Windows Server 2003 SP2
  • Windows Vista (supported editions, as described in the "Supported Client Platforms" section earlier in this topic)
  • Windows Vista SP1
  • Windows Server 2008

Fast User Switching

Fast User Switching, which is available in Windows XP editions not joined to a domain and in Windows Vista editions, is not supported in Configuration Manager 2007 SP1.

Dual Boot Computers

Configuration Manager 2007 SP1 cannot manage more than one operating system on a single computer. If there is more than one operating system on a computer that must be managed, tailor the discovery and installation methods used to ensure that the Configuration Manager client is installed only on the operating system that needs to be managed.

Virtual Machines

Configuration Manager 2007 SP1 support for virtual machine guest operating systems includes all supported client operating systems running on Microsoft Virtual PC or Virtual Server 2005 R2.

Note
Configuration Manager 2007 SP1 does not support Virtual PC or Virtual Server guests running on Macintosh.

Configuration Manager 2007 SP1 cannot manage Virtual PC or Virtual Server guest operating systems unless they are running. A static Virtual PC image cannot be updated, nor can inventory be collected using the Configuration Manager client on the host computer.

No special consideration is given to virtual machines. For example, Configuration Manager 2007 SP1 might not determine that an update needs to be re-applied to a virtual machine image if it is stopped and restarted without saving the version of the image to which the update was applied.

Configuration Manager 2007 SP1 supports all site server roles running as virtual machines only on Microsoft Virtual Server 2005 R2 and Virtual Server 2005 R2 SP1.

Interoperability Between Site Versions

The Configuration Manager console cannot be used to fully manage an SMS 2003 primary site. You can use an SMS 2003 Administrator console snap-in to manage SMS 2003 primary sites on a computer that does not have the Configuration Manager console installed, or you can install the Configuration Manager console on a computer that already has the SMS 2003 Administrator console installed on it. There are planning considerations when hosting both consoles on the same computer that should be considered before installing a Configuration Manager 2007 SP1 console on a computer that already has the SMS 2003 Administrator console installed on it. For more information about planning for Configuration Manager 2007 SP1 console installations, see Planning for the Configuration Manager Console.

The Configuration Manager console can manage an SMS 2003 secondary site connected to a Configuration Manager 2007 SP1 primary parent site, with the following limitations:

  • You cannot change the accounts or passwords of SMS 2003 secondary sites in the Configuration Manager console.
  • You cannot create or configure RAS sender addresses on SMS 2003 secondary sites.
  • You cannot configure Active Directory Security Group Discovery on an SMS 2003 secondary site.

SMS 2003 clients can be assigned to a Configuration Manager 2007 SP1 site, and they will be fully interoperable. However, assigning Configuration Manager clients to SMS 2003 sites is not supported, and they will not function properly. Configuration Manager 2007 SP1 clients are not supported when reporting to Configuration Manager 2007 sites. However, there is no version checking at installation to prevent a Configuration Manager 2007 SP1 client from being assigned to a Configuration Manager 2007 site.

Ensure that the boundaries defined for your Configuration Manager site are set properly. When installing Configuration Manager clients using auto assignment, ensure that Configuration Manager clients are not within the boundaries of an SMS 2003 site.

Changes in Support from SMS 2003

In addition to changes in supported platforms, including support for Windows Vista clients and Windows Server 2008 clients and site systems, the following changes are significant in the supported configurations from SMS 2003:

  • SQL Server 2005 Service Pack 2 is required to host the site database. SQL Server 7.0 and SQL Server 2000 are no longer supported to host the site database.
  • The site database can be installed on the default or a named instance of SQL Server 2005, and it is supported to move the site database back to a local installation of SQL Server 2005 installed on the site server computer if it has been moved off of the site server computer previously.

For more information about new features in Configuration Manager 2007 SP1, see What's New in Configuration Manager 2007 SP1.

See Also

Concepts

Configuration Manager 2007 Supported Configurations
Prerequisites for Installing Configuration Manager


Configuration Manager 2007 R2 Supported Configurations

Topic last updated—January 2008

This topic specifies the hardware and software requirements necessary to implement and maintain Microsoft System Center Configuration Manager 2007 R2 in your environment. Configuration Manager 2007 R2 is not a full product version; Configuration Manager 2007 R2 requires that Configuration Manager 2007 SP1 already be installed on your site server before running Configuration Manager 2007 R2 Setup. For information about installation prerequisites required for Configuration Manager sites, see Prerequisites for Installing Configuration Manager.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This topic also describes supported configurations for a basic site with clients and site systems but with no specific features enabled. For information about prerequisites for Configuration Manager 2007 features, see the feature under Configuration Manager 2007 Features.

Upgrade Paths

Configuration Manager 2007 R2 installation media is available in the following forms:

  • As an evaluation release, which expires 180 days after installation
  • As a feature update release to be applied to an existing Configuration Manager 2007 SP1 site

The following table shows which product versions that the Configuration Manager 2007 R2 feature update release can be installed on.

 | Configuration Manager 2007 R2 Evaluation Release | Configuration Manager 2007 R2 Feature Update Release
SMS 2003 SP1 | No | No
SMS 2003 SP2 | No | No
SMS 2003 SP3 | No | No
Configuration Manager 2007 (with no service pack applied) | No | No
Configuration Manager 2007 Evaluation Release | No | No
Configuration Manager 2007 SP1 | No | Yes
Configuration Manager 2007 SP1 Evaluation Release | Yes | Yes

Configuration Manager 2007 R2 Client System Requirements

The Configuration Manager 2007 R2 client requirements and supported platforms are the same as the Configuration Manager 2007 SP1 client requirements. For details, see Configuration Manager 2007 SP1 Supported Configurations.

Configuration Manager 2007 Site Server System Requirements

The hardware requirements are the same for Configuration Manager 2007 R2 and Configuration Manager 2007 SP1. The core site system roles have the same supported operating systems, but there are additional site system roles in Configuration Manager 2007 R2.

Key:

√ = Supported

Ø = Unsupported

Operating System | Distribution Point for Application Virtualization | Reporting Services Point | Client Status Reporting Host System
Windows XP Professional Service Pack 2 | Ø | Ø | √
Windows XP Professional Service Pack 3 | Ø | Ø | √
Windows XP Professional for 64-Bit Systems | Ø | Ø | √
Windows Vista Business Edition | Ø | Ø | √
Windows Vista Enterprise Edition | Ø | Ø | √
Windows Vista Ultimate Edition | Ø | Ø | √
Windows Vista Business Edition Service Pack 1 | Ø | Ø | √
Windows Vista Enterprise Edition Service Pack 1 | Ø | Ø | √
Windows Vista Ultimate Edition Service Pack 1 | Ø | Ø | √
Windows Server 2003 Web Edition Service Pack 1 | Ø | Ø | √
Windows Server 2003 Standard Edition Service Pack 1 | √ | √ | √
Windows Server 2003 Enterprise Edition Service Pack 1 | √ | √ | √
Windows Server 2003 Standard Edition Service Pack 1 64 Bit | √ | √2 | √
Windows Server 2003 Enterprise Edition Service Pack 1 64 Bit | √ | √2 | √
Windows Server 2003 Datacenter Edition Service Pack 1 | Ø | √ | √
Windows Server 2003 Storage Server Edition Service Pack 1 | Ø | Ø | √
Windows Server 2003 Web Edition Service Pack 2 | Ø | Ø | √
Windows Server 2003 Standard Edition Service Pack 2 | √ | √ | √
Windows Server 2003 Enterprise Edition Service Pack 2 | √ | √ | √
Windows Server 2003 Standard Edition Service Pack 2 64 Bit | √ | √2 | √
Windows Server 2003 Enterprise Edition Service Pack 2 64 Bit | √ | √2 | √
Windows Server 2003 Datacenter Edition Service Pack 2 | Ø | √ | √
Windows Server 2003 Storage Server Edition Service Pack 2 | Ø | Ø | √
Windows Server 2003 R2 Standard Edition | √ | √ | √
Windows Server 2003 R2 Enterprise Edition | √ | √ | √
Windows Server 2008 Standard Edition1 | √ | √ | √
Windows Server 2008 Enterprise Edition1 | √ | √ | √
Windows Server 2008 Standard Edition 64 Bit1 | √ | √2 | √
Windows Server 2008 Enterprise Edition 64 Bit1 | √ | √2 | √
Windows Server 2008 Datacenter Edition1 | Ø | √ | √

1Site system roles are not supported on a Server Core installation of Windows Server°2008.

Other Supported Configuration Information

No features of Configuration Manager 2007 R2 are supported on Windows XP Embedded devices.

See Also

Concepts

Configuration Manager 2007 SP1 Supported Configurations


Setup Prerequisite Checks

Topic last updated—May 2008

The Configuration Manager 2007 setup prerequisite check helps you determine what you have to do in order to prepare your environment to install or upgrade a Configuration Manager 2007 primary site, secondary site, or Configuration Manager console. The prerequisite checker notifies you of any warnings or errors encountered that would cause setup or an upgrade to fail. Tests that result in a warning do not prevent you from successfully upgrading to Configuration Manager 2007. However, it is recommended that you resolve the condition that generated the warning before continuing the setup or upgrade process. Tests that result in an error do prevent you from continuing the setup or upgrade process. You must resolve the condition that generated the error before continuing Configuration Manager 2007 Setup.

Setup will make no changes to your system until after the prerequisite check process has successfully completed. If necessary, you can temporarily leave the setup process to correct prerequisite warnings and errors after the check has completed. Once any error conditions have been resolved, you can return to, and re-run, the prerequisite check process. Until all errors have been resolved, you will not be able to proceed with setup.

Note
The Configuration Manager Setup prerequisite check rules verify that software and settings required for setup are installed. In some cases, the required software itself may require additional software updates not verified by Configuration Manager Setup. Before beginning setup, you should ensure that the computer operating system, and additional installed software components Configuration Manager Setup relies on, have been updated with all relevant software updates.

Prerequisite Check Rule Descriptions

The prerequisite check rule name, severity, description and details for each Configuration Manager 2007 Setup prerequisite check rule are listed in the following table.

Note
Depending on the type of installation or upgrade being performed by Configuration Manager Setup, you may or may not see all tests listed in the table.

Prerequisite Check Rule Severity Rule Description Rule Details

Administrative rights

(Management point)

Failure

Verifies that the logged on user and site server computer accounts possess administrative rights on the management point computer.

Configuration Manager Setup requires that the logged on user and site server computer account possess administrative rights on the management point computer.

Administrative rights

(Site system)

Failure

Verifies that the logged on user possesses administrative rights on the site system computer.

Configuration Manager Setup requires that the logged on user possess administrative rights on the site server computer.

Administrative rights

(SQL Server)

Failure

Verifies that the logged on user and site server computer account possess administrative rights to the SQL Server computer.

Configuration Manager Setup requires that the logged on user and site server computer possess administrative rights to the SQL Server computer.

Note
If installing the site database on a SQL Server cluster instance, the logged on user and site server machine account require administrative rights to all SQL Server cluster instance node computers

Administrative shares

(Site system)

Failure

Verifies that the required administrative shares are present on the site system computer.

Configuration Manager Setup requires that the Admin$ administrative share is present on the site system.

Backlogged inboxes

Warning

Verifies that the site server is processing critical inboxes in a timely fashion, and that inboxes do not contain files older than one day.

To ensure that data is not lost during the upgrade process, critical inboxes should be performing as expected and have no backlogged files waiting to be processed. If this test does not pass, this could indicate that a component has stopped, has stopped processing data, or is unable to keep up with incoming traffic.

Child Sites

(Pre-SMS 2003 SP2 direct child sites)

Failure

Verifies that the site server to be upgraded and all of its direct child sites are running SMS 2003 SP2 or later.

SMS site servers to be upgraded, and all direct child sites of Configuration Manager primary sites must be running SMS 2003 SP2 or later.

Child Sites

(Pre-SMS 2003 SP2 indirect child sites)

Warning

Verifies that all the sites below the direct child sites of the site to be upgraded are running SMS 2003 SP2 or later.

SMS site servers to be upgraded, and all indirect child sites of Configuration Manager primary sites should be running SMS 2003 SP2 or later.

Client activity

Warning

Verifies that all clients assigned to the site to be upgraded have recently communicated successfully with their assigned management point.

Inactive clients cannot be managed by Configuration Manager. Inactive client records should be removed from the site database before continuing the upgrade process.

Client Duplicate IDs

Warning

Verifies that the Configuration Manager 2007 site database to be upgraded does not contain duplicate client IDs.

Duplicate client IDs can cause unexpected results in collection evaluation and software distribution to clients. Duplicate client IDs should be resolved before continuing the upgrade process.

Client GUID consistency

Warning

Verifies that the Configuration Manager 2007 site database to be upgraded does not contain inconsistent client GUIDs.

Inconsistent client GUIDs can lead to SQL Server errors and should be resolved before continuing the upgrade process.

Client version

Warning

Verifies that there are no SMS 2003 Legacy Client records existing in the site database before upgrade.

Configuration Manager hierarchies do not support SMS 2003 Legacy Clients. Any existing Legacy Clients in the site to be upgraded should be upgraded to the SMS 2003 Advanced Client before continuing the upgrade process.

Distribution point package version

Warning

Verifies that all distribution points in the site have the latest version of software distribution packages.

All distribution points in the site to be upgraded should have the latest version of software distribution packages before beginning the upgrade process.

Domain membership

Failure

Verifies that the computer specified for installation is a member of a Windows domain.

Configuration Manager site server components can only be installed on computers that are members of a Windows domain.

FAT Drive on Site Server

Warning

Checks for the existence of a FAT drive on the Configuration Manager 2007 Site Server computer.

Installing Configuration Manager components on FAT formatted disk drives does not provide the recommended level of security for site server installations. It is recommended that you only install site server components on NTFS formatted disk drives.

Hardware inventory group map

Warning

Verifies that the hardware inventory definitions for the site to be upgraded have not been extended in a way that will conflict with the default inventory definitions for Configuration Manager.

Some custom hardware inventory modifications may conflict with the default hardware inventory settings provided by Configuration Manager. If there are conflicting hardware inventory settings, they should be resolved before continuing with the upgrade process.

IIS Configuration

(BITS installed)

Failure

Verifies that Background Intelligent Transfer Service (BITS) is installed in Internet Information Services (IIS).

Background Intelligent Transfer Service (BITS) is required for the management point and BITS-enabled distribution point site system roles.

IIS Configuration

(BITS enabled)

Failure

Verifies that Background Intelligent Transfer Service (BITS) is enabled in Internet Information Services (IIS).

Background Intelligent Transfer Service (BITS) is required for the management point and BITS-enabled distribution point site system roles.

IIS Configuration

(IIS service running)

Failure

Verifies that Internet Information Services (IIS) is running.

Internet Information Services (IIS) is required for some site system roles. If you have selected to install a site system role requiring IIS, and the IIS service is not running, this rule will fail.

IIS Configuration

(WebDAV installed)

Failure

Verifies that Web-based Distributed Authoring and Versioning (WebDAV) is installed.

Web-based Distributed Authoring and Versioning (WebDAV) is required for the management point and distribution point site system roles. If you have selected to install a site role requiring WebDAV, and it is not installed, this rule will fail.

IIS Configuration

(WebDAV enabled)

Failure

Verifies that Web-based Distributed Authoring and Versioning (WebDAV) is enabled.

Web-based Distributed Authoring and Versioning (WebDAV) is required for the management point and distribution point site system roles. If you have selected to install a site role requiring WebDAV, and it is not enabled, this rule will fail.

IIS Configuration

(WWW Service installed)

Failure

Verifies that the World Wide Web (WWW) Publishing Service is installed.

The WWW Service is a core component of IIS and is required to allow Configuration Manager clients to communicate with management points and BITS-enabled distribution points.

Management Point NLB Configuration

Warning

Verifies that the management point is not configured as part of a Network Load Balancing (NLB) cluster.

To enable Configuration Manager client approval when the default management point is configured as an NLB cluster, a Service Principal Name (SPN) must be registered in Active Directory Domain Services to enable Kerberos authentication.

Microsoft Management Console (MMC) version

Failure

Verifies that Microsoft Management Console (MMC) version 3.0 or later is installed.

MMC 3.0 is required to run the Configuration Manager console and must be installed before primary site or Configuration Manager console installations or upgrades. MMC 3.0 is available for download at: http://go.microsoft.com/fwlink/?LinkID=55423.

Microsoft XML Core Services 6.0 (MSXML60)

Failure

Verifies that the Microsoft Core XML Services (MSXML) version 6.0 or later libraries are installed.

MSXML 6.0 or later libraries are required for Configuration Manager console and site server installations.

Minimum .NET Framework version

Failure

Verifies that the Microsoft .NET Framework version 2.0 or later is installed.

The Microsoft .NET 2.0 framework or later is required for Configuration Manager site server installations. The Microsoft.NET Framework 2.0 is available for download at: http://go.microsoft.com/fwlink/?LinkID=56407

Schema extensions

Warning

Determines if the Active Directory Domain Services schema has been extended, and if extended, what version of the schema extensions were used to extend it.

Configuration Manager Active Directory schema extensions are not required, for site server installation, but are recommended to fully support the use of all Configuration Manager features.

Secure key exchange

Warning

Verifies that the site to be upgraded is configured to require secure key exchange.

By default, Configuration Manager sites require secure key exchange. It is recommended that you enable secure key exchange on sites to be upgraded before beginning the upgrade process.

Security rights

(Class Security Rights)

Warning

Verifies that any of the user names specified for Class Security Rights are less than 350 bytes long.

Class Security Rights user names must be less than 350 bytes long for a primary site upgrade to succeed.

Security rights

(Instance Security Rights)

Warning

Verifies that any of the user names specified for Instance Security Rights are less than 350 bytes long.

Instance Security Rights user names must be less than 350 bytes long for a primary site upgrade to succeed.

Short file name (8.3) support

(Site system)

Failure

Verifies that short file name support (8.3) is enabled on the site system computer.

Configuration Manager Setup requires that short file name (8.3) support is enabled on site system computers.

More information about enabling short file name (8.3) support is available at http://go.microsoft.com/fwlink/?LinkId=106183.

Site control file processing backlog

Warning

Verifies that site control file changes are being processed in a timely fashion.

To ensure that data is not lost during the upgrade process, site control file changes should be being processed in a timely fashion. If this test does not pass, it could indicate that a component has stopped, has stopped processing data, or is unable to keep up with incoming traffic.

Site security mode

Failure

Verifies that the SMS 2003 site to be upgraded, and all of its direct child sites, is configured for advanced security.

Configuration Manager sites have only one security mode. That mode is equivalent to SMS 2003 advanced security mode. All SMS 2003 sites to be upgraded should be functioning in advanced security mode before beginning the upgrade process.

SMS 2003 Feature Packs (Inventory Tool for Custom Updates)

Failure

Verifies that the SMS 2003 Inventory Tool for Custom Updates Feature Pack is not installed.

All SMS 2003 feature packs must be uninstalled before upgrading SMS 2003 sites to Configuration Manager.

SMS 2003 Feature Packs (Inventory Tool for Dell Updates)

Failure

Verifies that the SMS 2003 Inventory Tool for Dell Updates Feature Pack is not installed.

All SMS 2003 feature packs must be uninstalled before upgrading SMS 2003 sites to Configuration Manager.

SMS 2003 Feature Packs (SMS Inventory Tool for HP ProLiant and Integrity)

Failure

Verifies that the SMS 2003 SMS Inventory Tool for HP ProLiant and Integrity Feature Pack is not installed.

All SMS 2003 feature packs must be uninstalled before upgrading SMS 2003 sites to Configuration Manager.

SMS 2003 Feature Packs (IBM Systems Update Tool for Microsoft SMS)

Failure

Verifies that the SMS 2003 IBM Systems Update Tool for Microsoft SMS Feature Pack is not installed.

All SMS 2003 feature packs must be uninstalled before upgrading SMS 2003 sites to Configuration Manager.

SMS 2003 Feature Packs (Operating System Deployment)

Failure

Verifies that the SMS 2003 Operating System Deployment Feature Pack is not installed.

All SMS 2003 feature packs must be uninstalled before upgrading SMS 2003 sites to Configuration Manager.

SMS 2003 Feature Packs (SMS Device Management)

Failure

Verifies that the SMS 2003 SMS Device Management Feature Pack is not installed.

All SMS 2003 feature packs must be uninstalled before upgrading SMS 2003 sites to Configuration Manager.

Software distribution package hash

Warning

Verifies that the hash value for software distribution package files is not blank or MD5 which is no longer supported

Configuration Manager clients will not download and run package files that are not properly signed. If this rule does not pass, you should update distribution points that host affected package source files to create or update the package security hash before proceeding with the upgrade process.

Software updates

(KB911897)

Warning

Verifies that the software update associated with KB911897 has been installed.

An SMB file copy issue may occur if you have installed Internet Protocol version 6 (IPv6) on a computer running Windows Server 2003 SP1. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=88863

Note
You do not have to restart the computer after you apply this update.

Software updates

(KB913538)

Warning

Verifies that the software update associated with KB913538 has been installed.

Configuration Manager site systems and clients may encounter WMI enumeration errors without this update. This update applies to Windows Server 2003 and Windows XP computers. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=88864

Note
You must restart the computer after you apply this update.

Software updates

(KB914389)

Warning

Verifies that the software update associated with KB914389 has been installed.

This software update addresses several Server Message Block (SMB) vulnerabilities and should be applied before beginning Configuration Manager Setup. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=79239

Note
You must restart the computer after you apply this update.

Software updates

(KB925335)

Warning

Verifies that the software update associated with KB925335 has been installed.

This update should only be applied to SQL Server 2005 SP1 database servers experiencing a specific error and is available by contacting Microsoft Online Customer Services. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=88865

Note
You do not have to restart the computer after you apply this update.

Software updates

(KB925903)

Warning

Verifies that the software update associated with KB925903 has been installed.

Replication of large files across slow network links may result if this update is not applied to computers running Windows Server 2003 SP1. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=88866

Note
You must restart the computer after you apply this update.

Software updates

(KB932303)

Warning

Verifies that the software update associated with KB932303 has been installed.

The WMI service may stop responding on Configuration Manager site systems with the .NET 2.0 framework installed. This update should only be applied to computers experiencing a specific error and is available by contacting Microsoft Online Customer Services. More information about this update is available at:

http://go.microsoft.com/fwlink/?LinkId=93927

Note
You do not have to restart the computer after you apply this update.

Software updates

(KB940848)

Warning

Verifies that the software update associated with KB940848 has been installed.

A hotfix rollup package is available for Microsoft Management Console (MMC) in Windows Server 2003 that resolves an issue that can cause the MMC snap-in to exit unexpectedly or repairs drag and drop functionality. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=98349.

Note
You must restart the computer after you apply this update.

Software updates

(KB941132)

Warning

Verifies that the software update associated with KB941132 has been installed.

This update resolves an exception error on Configuration Manager site systems with the .NET 2.0 framework installed using 64-bit processors. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=98350

Note
You do not have to restart the computer after you apply this update.

SQL Server

(Database collation)

Failure

Verifies that the SQL Server database collation settings of the tempdb database and site database to be upgraded are the same.

Configuration Manager requires that the SQL Server database collation settings of the tempdb database and site database are the same for daily site database operations.

SQL Server

(Replication objects)

Failure

Verifies that the site database is not configured for replication and checks for replicated objects in the database.

Site databases cannot be upgraded when they are configured for replication. Before beginning the upgrade process, you should disable SQL Server replication if it is enabled.

SQL Server

(Security mode)

Warning

Verifies that SQL Server is configured for Windows authentication security.

It is recommended to configure the SQL Server that will host the Configuration Manager site database to operate using Windows authentication security.

SQL Server

(SQL Server version)

Failure

Verifies that the version of Microsoft SQL Server installed on the computer selected to host the site database meets the minimum requirement of SQL Server 2005 SP2.

Configuration Manager sites require SQL Server 2005 SP2 for site database operations to succeed.

SQL Server (Sysadmin rights)

Failure

Verifies that the user account running Configuration Manager Setup has been granted sysadmin SQL Server role permissions on the SQL Server instance targeted for site database installation. SOL Server sysadmin role permissions are required in order to create the site database and configure necessary database role and login permissions for Configuration Manager sites.

A SQL Server best practice is to remove the Builtin\Administrators group from the sysadmin role on installed SQL Server instances. If the Builtin\Administrators group has been removed from the sysadmin role, the user account running Configuration Manager Setup must be granted sysadmin role permissions for setup to succeed.

Unsupported client operating system version

Warning

Verifies that all of the clients assigned to the site to be upgraded meet the minimum operating system requirement of Windows 2000 Professional SP4 or later.

Configuration Manager clients are only supported on Windows 2000 SP4 or later operating systems.

Unsupported Configuration Manager console operating system

Failure

Verifies that the computer specified for Configuration Manager console installation is running at least Windows XP Professional SP2.

Configuration Manager consoles can only be installed on systems running Windows XP Professional SP2 or later.

Unsupported site server operating system version for setup

Failure

Verifies that the site server operating system meets the minimum requirement of Windows Server 2003 SP1 for site server installation.

Configuration Manager site systems can only be installed on systems running Windows Server 2003 SP1 or later.

Unsupported site server operating system version for upgrade

Failure

Verifies that the site server to be upgraded meets the minimum operating system requirement of Windows Server 2003 SP1 for site server installation.

Configuration Manager site systems can only be installed on systems running Windows Server 2003 SP1 or later.

Unsupported SMS database version

Failure

Verifies that the site database version to be upgraded is at least SMS 2003 SP2.

For the site database upgrade to succeed, the database version must be SMS 2003 SP2 or later.

WSUS client installation package version

Warning

Verifies that the client installation package version published to WSUS is correct.

Note
This prerequisite check rule is not run during Configuration Manager 2007 SP1 Setup.

WSUS SDK on site server

Warning

Determines if the Windows Server Update Services (WSUS) administrator console is installed on the site server.

Configuration Manager software update points require Windows Server Update Services (WSUS) version 3.0 or later.

Configuration Manager 2007 SP1 Prerequisite Check Rule Descriptions

The prerequisite check rule name, severity, description, and details for additional setup prerequisite checks included in Configuration Manager 2007 SP1 Setup are listed in the following table.

Prerequisite Check Rule Severity Rule Description Rule Details

SMS Provider communication

Failure

Verifies that the SMS Provider computer can communicate successfully with the site database computer.

Successful communication between the SMS Provider computer and the site database computer is required for site operations. A failure in this required communication can occur when the site database server is offline or if a valid SPN has not been registered in Active Directory Domain Services for the SQL Server instance hosting the site database. For more information about specifying an SPN for the SQL Server instance hosting the site database, see How to Configure an SPN for SQL Server Site Database Servers.

Installed version of WAIK

Failure

Verifies that the correct version of the Windows Automated Installation Kit (WAIK) is installed on the SMS Provider computer for the site.

Configuration Manager 2007 SP1 sites require that WAIK version 1.1 or higher is installed on the SMS Provider computer for the site. To resolve this error, uninstall WAIK from the SMS Provider computer, restart the SMS Provider computer, and run Setup again to have it automatically install WAIK 1.1. WAIK 1.1 can also be manually installed on the SMS Provider computer for the site and is available at http://go.microsoft.com/fwlink/?LinkId=115680.

WSUS 3.0 SP1 SDK installed on site server

Failure

Verifies that the Windows Server Update Services (WSUS) administrator console installed on the site server is at the WSUS 3.0 SP1 level.

If the WSUS administration console is installed on the primary site server computer, this check verifies that the WSUS configuration manager console installed is at the WSUS 3.0 SP1 level. Configuration Manager 2007 SP1 software update points require Windows Server Update Services (WSUS) version 3.0 SP1 or later. WSUS 3.0 SP1 is available for download at http://go.microsoft.com/fwlink/?LinkId=115678.

FQDN specified for site systems

Warning

Verifies that an FQDN is specified for site systems during site upgrade to Configuration Manager 2007 SP1.

During site upgrades to Configuration Manager 2007 SP1, installed site systems are checked to ensure that an FQDN has been specified. Not specifying an FQDN for site systems in mixed mode sites might prevent cross-domain client auto approval processes. When mixed mode sites are migrated to native mode, not specifying FQDN for site systems might cause client to management point communication errors.

Windows Server 2003–based schannel hotfix

Warning

Determines if the Windows Server 2003–based schannel hotfix is installed on the site server.

Without this update, a Windows Server 2003–based computer cannot make a Secure Sockets Layer (SSL) connection or a Transport Layer Security (TLS) connection to the out-of-band interface on an Intel Active Management Technology (AMT)–enabled computer. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=116110.

Note
You must restart the computer after you apply this update.

Windows Remote Management (WinRM) v1.1

Warning

Verifies that Windows Remote Management (WinRM) version 1.1 or later is installed.

This update adds a new feature to Windows Remote Management (WinRM) for Windows Server 2003 and Windows XP Professional. This update also updates the version of WinRM that is included with Windows Server 2003 R2. WinRM improves hardware management in a network environment in which various devices run various operating systems. More information about this update is available at: http://go.microsoft.com/fwlink/?LinkId=116108.

Note
You do not need to restart the computer after you apply this update unless it is applied to a Windows Server 2003 R2 computer.

Microsoft Remote Differential Compression (RDC) library registered

Error

Verifies that the Microsoft Remote Differential Compression (RDC) library is registered on the computer specified for Configuration Manager site server installation.

Site servers and branch distribution points require Remote Differential Compression (RDC) to generate package signatures and perform signature comparison. RDC is not installed by default on computers running Windows Server 2008 and is not installed automatically during Configuration Manager Setup. For information about installing RDC on Windows Server 2008 computers, see How to Configure Windows Server 2008 for Site Systems.

Share Name in Package

Warning

Verifies that the # character has not been used in software distribution package share names.

The # character is not a valid character for software distribution package share names and is not supported as a virtual directory share name character by IIS 7.0 included with Windows Server 2008.

Share Name in Distribution Point

Warning

Verifies that the # character has not been used in software distribution point share names.

The # character is not a valid character for software distribution point share names and is not supported as a virtual directory share name character by IIS 7.0 included with Windows Server 2008.

See Also

Concepts

Prerequisites for Installing Configuration Manager
How to Start the Setup Prerequisite Checker
Configuration Manager 2007 Upgrade Checklist

Other Resources

Configuration Manager Supported Configurations


Configuration Manager Site Naming

Site codes and site names are used to identify and manage the sites in a Configuration Manager 2007 hierarchy. In the Configuration Manager console, the site code and site name are displayed in the <site code> - <site name> format. Site codes should be used only once in a Configuration Manager 2007 hierarchy. If Active Directory is extended for Configuration Manager, and sites are publishing data, the site codes used within an Active Directory forest must be unique even if they are being used in a different Configuration Manager hierarchy. Be sure to carefully plan your site codes and site names before deploying the Configuration Manager 2007 hierarchy.

Specifying Site Codes and Site Names

During Configuration Manager 2007 Setup, you are prompted for a site code and site name for each primary and secondary site installation. The site code must uniquely identify each Configuration Manager 2007 site in the hierarchy. Because some Configuration Manager 2007 components use the site code in folder names, you should not specify Microsoft Windows reserved names such as AUX, CON, NUL, or PRN as the site code during Configuration Manager 2007 Setup.

Important
Configuration Manager Setup does not verify that the site code entered is not already in use.

To enter the site code for a site during Configuration Manager 2007 Setup, you must enter three alphanumeric characters. Only the letters A through Z, numbers 0 through 9, or combinations of the two are allowed when specifying site codes. The sequence of letters or numbers has no effect on the communications between sites. For example, it is not necessary to name a primary site ABC and a secondary site DEF.

The site name is a friendly name identifier for the site. Use only the standard characters A through Z, a through z, 0 through 9, and the hyphen (-) in site names.

Important
Changing the site code or site name after installation is not supported.

Re-Using Site Codes

Site codes should never be used more than once in a Configuration Manager 2007 hierarchy for active sites. If you have uninstalled a site that was publishing site data to Active Directory Domain Services in preparation for installing a new Configuration Manager 2007 site with the same site code, you should ensure that the previous site's information has been removed from Active Directory Domain Services, and possibly WINS, before attempting to re-use the old site code for a new Configuration Manager 2007 site. All references to the original site need to be removed from all other sites in the hierarchy, and you need to clean up any objects previously replicated to potential child sites of the new site. If this is not done, any newly replicated objects from the newly created site could overwrite objects already replicated to the child sites by the previous installation.


SMS Provider Overview

The SMS Provider is a WMI provider that allows both read and write access to the Configuration Manager 2007 site database. The SMS Provider is used by the Configuration Manager console, Resource Explorer, tools, and custom scripts used by Configuration Manager 2007 administrators to access site information stored in the site database. The SMS Provider also helps ensure that Configuration Manager 2007 object security is enforced by only returning site information that the user account running the Configuration Manager console is authorized to view.

The SMS Provider can be installed on the site database server computer, site server computer or another server class third computer during Configuration Manager 2007 Setup. After setup has completed, the current installed location of the SMS Provider is displayed on the site properties general tab.

Important
If the SMS Provider computer is offline, all Configuration Manager 2007 consoles for the site will not function.

In multi-language Configuration Manager 2007 site hierarchies, the SMS Provider determines the installed operating system language of the requesting computer and formats data returned from the site database to the requesting computer in a matching language format. The SMS Provider is not capable of translating information from one language to another, but it is capable of providing data stored in different languages in the site database to requesting computers. For example, if you are requesting site data from the site database on a computer with a Japanese language operating system installed, and the stored information in the site database is formatted in the same language codepage, the SMS Provider would return information formatted for the Japanese language code page instead of English. If you requested the same Japanese language code page information from the site database from an English based operating system Configuration Manager console installation, the resulting information returned would not be readable.

Windows Automated Installation Kit Requirements

The Windows Automated Installation Kit (WAIK) is installed as a component of SMS Provider installation to enable Configuration Manager console operating system deployment task functionality.

Important
During Configuration Manager 2007 installation, WAIK 1.0 is installed on the SMS Provider computer. Because WAIK 1.1 is required for Configuration Manager 2007 SP1 sites, you must manually uninstall WAIK 1.0 from the SMS Provider computer, and restart it, before beginning the site upgrade process to allow WAIK 1.1 to be installed on the SMS Provider computer for the site by Configuration Manager 2007 SP1 Setup.

Specifically, WAIK allows the SMS Provider to complete operating system deployment database access tasks including:

  • View WIM file details
  • Add driver files to existing boot images
  • Create boot .ISO files
Note
WAIK installation may require up to 650MB of additional free space on the computer specified for SMS Provider installation. Windows PE boot images are installed as part of WAIK installation and account for the large size of the WAIK installation

The SMS Provider Namespaces

A WMI schema exists to describe the structure of the SMS Provider. Schema namespaces describe the location of Configuration Manager 2007 data within the SMS Provider schema. The following table contains the common namespaces used by the SMS Provider.

Namespace | Description
Root\SMS\site_<site code> | The SMS Provider, which is extensively used by the Configuration Manager 2007 console, Resource Explorer, Configuration Manager 2007 tools, and scripts.
Root\SMS\SMS_ProviderLocation | Provides the location of the SMS provider server for a site.
Root\CIMv2 | Location inventoried for WMI namespace information during hardware and software inventory.
Root\CCM | Configuration Manager 2007 client configuration policies and client data.
root\CIMv2\SMS | Location of inventory reporting classes that are collected by the inventory client agent. These settings compiled by clients during computer policy evaluation and are based on the contents of the SMS_def.mof file.

See Also

Tasks

How to Move the SMS Provider

Concepts

Choose the SMS Provider Installation Location


Configuration Manager Site Database Overview

A Microsoft System Center Configuration Manager 2007 primary site must have access to a Microsoft SQL Server 2005 database server to host the site database. You can install SQL Server on the server that is used as the primary site server, on a remote server, or even on a clustered SQL Server instance in the Configuration Manager 2007 site.

In This Section

Using a Remote SQL Server to Host the Site Database

Describes how to use a remote SQL Server to host the site database.

Using a Clustered SQL Server Instance to Host the Site Database

Describes how to use a clustered SQL Server database to host the site database.

About Windows Authentication in SQL Server

Describes Windows Authentication in SQL Server.

See Also

Concepts

SQL Server Preparation for Setup


Using a Remote SQL Server to Host the Site Database

Configuration Manager 2007 primary sites must constantly communicate with the Microsoft SQL Server hosting the site database. Typically, performance is better if the Configuration Manager 2007 site server and the site database are installed on the same server. However, if the intervening network connection is a high-availability, high-bandwidth network connection you might be able to install SQL Server on a remote server from the Configuration Manager 2007 site server. You might also consider installing a second network adapter in both the site server and the computer running SQL Server and then dedicating this second card for communications between the site server and the computer running SQL Server.

Note
When using a remote SQL Server to host the site database, TCP/IP network protocol communication is required for SQL Server network connections to support Kerberos authentication. The named pipes communication protocol is not required, but can be used to troubleshoot Kerberos authentication issues. SQL Server 2005 network protocol communication settings are configured in SQL Server Configuration Manager under SQL Server 2005 Network Configuration.

See Also

Tasks

How to Install Configuration Manager Using a Remote SQL Server


Using a Clustered SQL Server Instance to Host the Site Database

Using a virtual Microsoft SQL Server cluster instance to host the Configuration Manager 2007 site database is supported. Clustered SQL environments allow for failover support for the virtual SQL server, and therefore, they provide greater reliability for the site database. Hosting the site database on a clustered SQL server configured for failover support does not provide additional processing or load balancing benefits. Only active/passive SQL Server cluster configurations are supported for hosting the site database. Configuring the SQL Server cluster in an active/active cluster configuration or in a Network Load Balancing (NLB) cluster configuration is not supported.

Configuration Manager 2007 Setup will not create or configure the SQL cluster. The clustered SQL environment must already be configured, and functional, before it can be used to host the site database. Configuration Manager 2007 will automatically check once an hour for SQL cluster node configuration changes. Changes in the SQL node configuration affecting Configuration Manager 2007 component installation, such as a node failover or the introduction of a new node to the SQL cluster, will be managed by Configuration Manager 2007 with no action by the administrator necessary.

Note
When using a clustered SQL Server instance to host the site database, TCP/IP network protocol communication is required for each SQL Server cluster node network connection to support Kerberos authentication. The named pipes communication protocol is not required, but can be used to troubleshoot Kerberos authentication issues. SQL Server 2005 network protocol communication settings are configured in SQL Server Configuration Manager under SQL Server 2005 Network Configuration.

Performance Considerations

When using a clustered SQL database to host the Configuration Manager 2007 site database, degradation in performance often occurs. This is because the site server must find the active node of the SQL cluster before it can connect to the site database. For Configuration Manager 2007 sites supporting a large number of clients, or if the primary site server CPU usage is too great, the site database can be moved to a remote SQL Server, or SQL Server cluster instance to reduce primary site computer CPU usage. Although Configuration Manager 2007 supports using a SQL cluster for hosting the site database, it will not support using SQL database mirroring technology or peer-to-peer replication.

SMS Provider Considerations

When using a clustered SQL Server database to host the site database, the SMS Provider should be located locally on the site server or on a third machine not hosting a SQL cluster node. Installing the SMS Provider on a SQL Server cluster or a computer acting as a clustered SQL Server node is not supported.

See Also

Tasks

How to Install Configuration Manager Using a Clustered SQL Server Instance


About Windows Authentication in SQL Server

Windows Authentication, previously called integrated security, is the minimum administration overhead option for Microsoft SQL Server. This type of security maps the Configuration Manager 2007 primary site server's machine account to the SQL Server database, and it passes the Configuration Manager 2007 primary site server's machine account to SQL Server for validation and data access.


Planning Configuration Manager Boundaries

Configuration Manager 2007 boundaries are defined in the Configuration Manager console and are defined by IP subnet, Active Directory site name, IPv6 Prefix, IP ranges or any combination of these. When creating Configuration Manager 2007 boundaries, you must also specify the type of network connection that the boundary will operate on. You must decide if the boundary will be used for either a Slow or unreliable or Fast (LAN) network connection. An example of a slow boundary would be one defined by an IP subnet connected to the site over a WAN. Fast boundaries should be made up of faster, more reliable, connections such as a corporate LAN.

Note
In order for clients located on IP subnets configured as VPN scopes to install software updates and software distribution packages, the IP subnets defined as VPN scopes must be added as Configuration Manager 2007 boundaries and, if the VPN connection is fast and reliable enough, configured as fast boundaries. If VPN scopes are not added as boundaries, the VPN scope subnets will be treated as slow boundaries and clients located on VPN scope subnets will be unable to download software updates or software distribution packages without specifying slow boundary behavior in the software update or software distribution advertisement.

Boundaries are used to assign clients to a specific Configuration Manager 2007 site and should be unique to each site. When defining site boundaries for sites, ensure that you do not define the same boundary for more than one Configuration Manager 2007 site. Doing so leads to a situation called overlapping site boundaries. Overlapping site boundaries are not supported and can lead to undefined results in Configuration Manager client behavior.

While Configuration Manager 2007 boundaries are used to assign clients to a site, they are not used to specify which computers are assigned site system roles for a site. Configuration Manager 2007 site systems do not need to be located within a site’s boundaries.

Configuration Manager clients are able to communicate with site systems that are members of another site in the Configuration Manager 2007 hierarchy when they roam. Roaming is the ability to move a computer that is running the Configuration Manager 2007 client from the designated boundaries of a Configuration Manager 2007 site to within the assigned boundaries of another Configuration Manager 2007 site or to a network location not defined as a boundary for a Configuration Manager 2007 site at all.

An essential part of the deployment planning process is determining the appropriate boundaries for your Configuration Manager 2007 site. Use the Choose Configuration Manager Boundaries planning task to help you identify and organize possible Configuration Manager 2007 boundaries.

See Also

Reference

New Boundary Dialog Box

Concepts

About Client Roaming in Configuration Manager


Configuration Manager in Multiple Active Directory Forests

Topic last updated -- November 2007

Configuration Manager primary sites can be configured to span multiple Active Directory forests. It is not supported to install secondary sites in a remote Active Directory forest from their parent primary site. It is supported for a Configuration Manager 2007 site hierarchy to have primary sites or clients in a remote Active Directory forest.

When deploying Configuration Manager 2007 across multiple Active Directory forests, plan for the following considerations when designing your Configuration Manager 2007 hierarchy:

  • Communications within a Configuration Manager 2007 site
  • Communications between Configuration Manager 2007 sites
  • Support for clients across forests
    • Configuring clients across Active Directory forests
    • Approving clients (mixed mode) across Active Directory forests
    • Roaming support across Active Directory forests

Cross-Forest Communications within a Configuration Manager Site

There are only two supported scenarios in which site systems within a single site are supported across Active Directory forests:

  • The System Health Validator point, used with Network Access Protection.
  • Internet-based client management, which supports the following site systems installed in a separate forest to the site server:
    • Management point
    • Distribution point
    • Software update point
    • Fallback status point
    Note
    The following site systems are also supported if they are installed in a separate forest, but it is not the security best practice: server locator point and PXE service point.

In either supported scenario, even if there is a two-way trust between the two forests, or external trusts between the site server's domain and the site system domain, you must specify a Windows user account for installation and configuration of the site system.

There is an additional cross-forest configuration that applies to the site systems that support Internet-based client management. When these site systems are installed in a different forest than the site server, and you want to ensure that communication is only ever initiated from the site server to the site systems, and never from the site systems to the site server, enable the site system option Allow only site server initiated data transfers from this site system. In an Internet-based client management scenario where these site systems are installed in a perimeter network, this configuration ensures that all connections between these site systems and the intranet are only initiated from the intranet, and not from the untrusted network. It is therefore a more secure solution than accepting connections into the intranet that are initiated from the perimeter network. However, if you choose this cross-forest configuration, be aware of the following considerations:

  • You must configure a Windows user account for installation, even if there is a trust relationship between the two forests.
  • This configuration results in some latency in sending status messages to the site, with a decrease in performance on the site server.
Important
All other site systems within a site that are not listed above must reside within the same Active Directory forest. They can be installed in different domains within the forest, with the exception of the site server, SMS Provider computer, reporting point, and site database server which must all reside in the same domain.

Cross-Forest Communications between Configuration Manager Sites

Data is sent between sites in a Configuration Manager 2007 hierarchy to enable central administration within a distributed model. For example, advertisements and packages flow down from a primary site to a child primary site, and inventory data from child primary sites are sent up to the central primary site. This information is sent between site servers in the hierarchy when the site communicates with a parent or child site. Data sent between sites is signed by default, and because sites in different Active Directory forests cannot automatically retrieve keys from Active Directory, manual key exchange using the hierarchy maintenance tool (Preinst.exe) is required to configure inter-site communication.

When one or more primary sites in the Configuration Manager 2007 site hierarchy are located within different Active Directory forests, an Active Directory forest trust is not required to enable site-to-site communication as long as domain user accounts are properly configured in the sender address properties for each site. If you do not configure domain user accounts as site address accounts in the sender address properties of each site, the site server computer accounts will be used. If the site server computer accounts are used as the site address accounts, all Active Directory forests must be configured for the Windows Server 2003 forest functional level and have a two-way trust to enable site-to-site communication to succeed.

Cross-Forest Client Support

If you have clients that are in a different forest than their assigned site server's forest, use the following information to ensure that they are configured correctly.

Configuring Clients across Active Directory Forests

Configuration Manager 2007 clients on the intranet use Active Directory Domain Services as their primary method of service location and configuration. If you have clients that reside in a separate forest, they will not be able to retrieve information that is published to Active Directory Domain Services by their assigned site server.

For these clients to be managed, you must ensure that alternative methods are available for the following:

  • Site compatibility check to complete site assignment
  • Service location for management points, and the server locator point if this is not directly assigned
  • Native mode configuration

Configure these clients as if Active Directory Domain Services is not extended for Configuration Manager 2007. The information that these clients will need, together with additional configuration steps is listed in the section "Feature and Function Considerations for Extending the Active Directory Schema for Configuration Manager" in the following topic: Decide If You Should Extend the Active Directory Schema.

Approving Clients (Mixed Mode) Across Active Directory Forests

If the site is in mixed mode and you are using the site configuration of Automatically approve computers in trusted domains, you must configure the management point with an intranet fully qualified domain name (FQDN).

For more information about approval, see About Client Approval in Configuration Manager and for procedural information about how to specify the management point's FQDN, see How to Configure the Intranet FQDN of Site Systems.

Roaming Support across Active Directory Forests

Clients can perform global roaming within the forest of their assigned site if all sites within the hierarchy publish site information to Active Directory Domain Services. Roaming allows clients to download software distribution package content from distribution points closest to them when they roam within the boundaries of a sibling site, a site higher in the hierarchy than their assigned site, or are otherwise not within the boundaries of their assigned site.

If the Active Directory schema has not been extended for Configuration Manager 2007, or sites are not publishing site data to Active Directory Domain Services, clients can use a server locator point to perform regional roaming. Regional roaming allows clients to find local software distribution package content when the site that they roam into is lower in the hierarchy than their assigned site. If a server locator point is not deployed, regional roaming is supported if all management points are registered in WINS or DNS.

See Also

Tasks

How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers
How to Automatically Publish the Default Management Point to DNS

Concepts

About Network Access Protection and Multiple Active Directory Forests
Determine If You Need a Server Locator Point for Configuration Manager Clients
Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management


Extending the Active Directory Schema for Configuration Manager

Extending the Active Directory schema is not required for installing Configuration Manager 2007 or using most of the product features; however, by extending the schema for Configuration Manager you can use all Configuration Manager features and with the least amount of administrative overheads. Extending the schema for Configuration Manager 2007 also offers the most secure solution for storing configuration information.

The Active Directory schema can be extended for Configuration Manager 2007 before or after running Configuration Manager 2007 Setup. However, to take advantage of publishing information to Active Directory Domain Services from the outset, extend the schema before beginning Configuration Manager 2007 Setup and allow sufficient time for the schema changes to replicate through the Active Directory forest.

Note
When upgrading an SMS 2003 site that is publishing site information to Active Directory Domain Services, upgrade the Active Directory schema extensions for Configuration Manager 2007 before upgrading the site. Proceeding without upgrading the schema extensions will result in some Configuration Manager features being unavailable after installation. Additionally, until the schema is extended for Configuration Manager 2007, you will need to install a server locator point for client assignment to succeed.

See Also

Concepts

Decide If You Should Extend the Active Directory Schema
Determine If You Need a Server Locator Point for Configuration Manager Clients

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


Configuration Manager and Name Resolution

To enable Configuration Manager 2007 clients on the intranet to resolve the computer names of site systems to IP addresses, they can use either WINS or DNS. DNS is the recommended solution because it provides security features to help protect against name resolution attacks, and it provides a robust distributed service.

Note
Configuration Manager clients that are managed on the Internet must use Internet DNS servers to resolve fully qualified domain names (FQDNs) of Internet-based site systems to public IP addresses. For more information about Internet-based client management, see Overview of Internet-Based Client Management.

Additionally, if the site is in mixed mode and clients are in a different domain to the site server computer's domain, you must configure the management point with a FQDN if you are using the default approval option: Automatically approve computers in trusted domains (recommended).

Although you can use a mixture of short names and FQDNs for site systems in Configuration Manager, adhering to a single naming system will greatly aid troubleshooting if clients experience connection issues.

WINS

If you are not using FQDNs for your site systems, WINS can be used to resolve short computer names (NetBIOS names) to IP addresses.

In addition to name resolution, WINS might be required for clients to find the following Configuration Manager services:

  • Management points (default or network load balanced)
  • Server locator point
Note
For more information about using WINS for locating management points and server locator points, see Configuration Manager and Service Location (Site Information and Management Points).

Even if you are using short names for your site systems, you can still use DNS for name resolution if either of the following conditions is true:

  • Your Configuration Manager hierarchy is contained within a single domain.
  • Your Configuration Manager hierarchy spans multiple domains but all clients are configured with a DNS search suffix so that a client in one domain can resolve a server name in a different domain.
Note
For more information about using WINS for locating management points, see Configuration Manager and Service Location (Site Information and Management Points).

DNS

If you are using FQDNs for your site systems, DNS must be used to resolve the FQDN server names to IP addresses.

In addition to name resolution, DNS might be required for clients to find their default management point if Configuration Manager is configured to publish to DNS.

Note
For more information about using DNS for locating a management point, see Configuration Manager and Service Location (Site Information and Management Points).

See Also

Tasks

How to Manually Add Configuration Manager Site Information to WINS
Configuring DNS for Configuration Manager Site System Roles

Concepts

Determine If You Will Use FQDN Server Names
Overview of Internet-Based Client Management

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


Configuration Manager and Service Location (Site Information and Management Points)

Topic last updated -- August 2007

Service location in Configuration Manager 2007 refers to the requirement of clients to dynamically locate site information and management points. This information is needed for clients when they assign to a site, and when they download client policy and send client information back to the site.

Service location is independent from name resolution, which maps a computer name to an IP address. Name resolution is performed by WINS and DNS. However, WINS and DNS can also be used for service location. For more information about name resolution in Configuration Manager, see Configuration Manager and Name Resolution.

Note
Configuration Manager clients that are configured for Internet-based client management do not need to locate site information from Active Directory Domain Services or server locator points, and do not need to locate their Internet-based management points.

For more information about Internet-based client management, see Deploying Configuration Manager Sites to Support Internet-Based Clients.

All Configuration Manager 2007 clients that are not configured for Internet-based client management need to locate site information when they are assigned to a site, and they need to locate management points when they are first installed and on a regular basis.

Site Information: Active Directory Domain Services

Intranet clients use Active Directory Domain Services as their primary method of service location for both site information, and management points. Configuration Manager 2007 clients can use Active Directory Domain Services for service location if all the following conditions are met:

  • The Active Directory schema is extended for Configuration Manager 2007
  • All sites in the hierarchy are published to Active Directory Domain Services
  • Clients belong to the same Active Directory forest as the site server's forest

If any of these conditions cannot be met, clients must have an alternative method of service location. For site information, the only alternative is to use a server locator point. For management points, alternatives include DNS, a server locator point, or WINS.

Important
If clients fail to locate site information during site assignment, they will be unmanaged. Make sure that clients can access site information from Active Directory Domain Services, or a server locator point.

Site Information: Server Locator Point

A server locator point in a Configuration Manager 2007 hierarchy is used for two purposes when Active Directory Domain Services cannot be used:

  • Site assignment for clients
  • Locating default management points for clients

If clients cannot locate site information when they are installed and are either directly assigned to a site or configured to automatically locate a site (auto-site assignment), assignment will fail. Although the client might be installed, it cannot complete site assignment, and in this scenario it will be unmanaged.

If the Active Directory schema has not been extended for Configuration Manager 2007, site information required to complete client site assignment cannot be published to Active Directory Domain Services and clients must have an alternative mechanism to complete site assignment. Additionally, if you have clients that are not in the same Active Directory forest as the site servers (such as workgroup clients or clients from a different Active Directory forest), these clients will not be able to locate the site information they require to complete site assignment, and they must have an alternative mechanism to locate this site information. In either of these scenarios, a server locator point is required.

A server locator point is also required if clients cannot locate the default management point from Active Directory Domain Services, DNS, or WINS.

How Clients Find a Server Locator Point

If clients require a server locator point, this site system's IP address, short name, or fully qualified domain name (FQDN) can be specified when the client is installed using the client.msi property SMSSLP=<server locator point name>. Make sure that a specified short name or FQDN can be resolved using WINS or DNS. For more information about client installation command line options, see About Configuration Manager Client Installation Properties.

If the server locator point is not directly assigned during client installation, clients can locate it through Active Directory Domain Services or WINS:

  • Clients can automatically find a server locator point through Active Directory publishing if they are in the same Active Directory forest as the site server. This scenario applies if the Active Directory schema has been extended for SMS 2003 but not extended for Configuration Manager 2007. When these conditions apply, there is no requirement to specify the server locator point during installation or manually publish it in WINS.
  • If you have not extended the Active Directory schema for either SMS 2003 or Configuration Manager 2007, clients can automatically find a server locator point if it is manually published in WINS and if clients have not been installed with the SMDDIRECTORYLOOKUP installation property. For more information about manually publishing the server locator point in WINS, see How to Manually Add Configuration Manager Site Information to WINS.
    Note
    Although native mode clients cannot locate management points through WINS, they can locate server locator points through WINS. Clients cannot locate server locator points using DNS publishing.

Clients first try to use the server locator point if it is specified on the command line, and if this fails they then try to locate a server locator point from Active Directory Domain Services, and if this fails they then try WINS.

Native Mode Clients Need Additional Configuration to Use Server Locator Points

Server locator points use HTTP as their client communication method even when the site is configured for native mode.

If native mode clients must use a server locator point for site assignment or for locating their default management point, clients must also be configured for HTTP communication for roaming and site assignment.

For more information about this configuration, see the following topics:

  • Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)
  • How to Configure HTTP Communication for Roaming and Site Assignment.

Management Points

Configuration Manager clients need to find their assigned site's default management point when they are first installed and assigned to a site. If they cannot find their site's default management point, they cannot be managed.

After clients find their site's default management point, it then becomes their assigned management point. This assignment is always made by the client as a result of finding its assigned site's default management point; administrators cannot assign a specific management point to a client to use as its default management point.

When Clients Find Their Default Management Point

Even after clients have an assigned management point, they periodically perform the same service location request for their site's default management point in case it has changed.

This service location request for a default management point also happens in the following scenarios:

  • When the client starts up or the service SMS Agent Host is restarted.
  • When the client detects a network change:
    • If the client gets a new or renewed IP address (for example, through DHCP).
    • If the network adapter is disconnected and reconnected.
  • If you specify a new site code, or click Discover on the Advanced tab of Configuration Manager in the client computer's Control Panel, and then click OK or Apply.

How Clients Find Their Site's Default Management Point

Clients locate their default management point using the following mechanisms in the order specified:

  • Active Directory Domain Services
  • DNS
  • Server locator point
  • WINS

Active Directory Domain Services

When the Active Directory schema has been extended for Configuration Manager 2007 and all sites in the Configuration Manager hierarchy are configured to publish to Active Directory Domain Services, the default management point for each site is published to Active Directory.

In this scenario, Configuration Manager clients that belong to the same Active Directory forest as the site systems will automatically find their default management point through Active Directory publishing using an LDAP query to a global catalog server, and they will not use the other mechanisms to find their default management point. However, if this service location fails (for example, because of unreliable network connectivity), clients will automatically try the next service location method.

If the Active Directory schema has not been extended for Configuration Manager 2007, management points cannot be published to Active Directory Domain Services and clients must have an alternative mechanism to locate their default management point.

Additionally, if you have clients that are not in the same Active Directory forest as the site servers (such as workgroup clients or clients from untrusted domains), these clients will not be able to locate the published management points and must use one of the following alternative mechanisms to locate their default management points.

DNS Publishing

Clients can find their default management point in DNS if the following two conditions are met:

  • The DNS zone that contains the management point entry (SRV record) must contain a host record for the computer assigned with the management point role. This record can be entered manually, or automatically if the site is configured to automatically publish the default management point in DNS.
    For more information, see How to Automatically Publish the Default Management Point to DNS and How to Manually Publish the Default Management Point to DNS.
  • Clients must be configured with a DNS suffix for site assignment.
    For more information, see How to Configure Configuration Manager Clients to Find their Management Point using DNS Publishing.

DNS is the preferred method by which clients locate their default management point if they cannot locate it using Active Directory, and so is suitable for the following clients:

  • Workgroup clients and clients from another forest
  • All clients if the Active Directory schema is not extended for Configuration Manager 2007 and the site is not publishing to Active Directory Domain Services.

Using DNS publishing for service location of the default management point is more reliable and scalable than using the next service location methods of WINS or a server locator point. However, if the three conditions for DNS publishing cannot be met, you can use WINS as the mechanism by which clients locate their default management points if the Configuration Manager site is operating in mixed mode.

Server Locator Point

If clients cannot locate management points through Active Directory Domain Services or DNS, they next attempt to locate their default management point with a server locator point.

If you have assigned a server locator point role to a site system in the Configuration Manager hierarchy, management points are automatically published to this server locator point when they are in the same site as the server locator point, or lower in the same branch of the hierarchy. Clients in these sites can use the server locator point to find their default management point.

Server locator points can be assigned to clients by short name or IP address using CCMSetup installation properties. If a server locator point is not directly assigned to clients, clients can locate it, using WINS if the client has not been installed with the SMSDIRECTORYLOOKUP installation property.

WINS

When a site system computer assigned the management point role is configured to use WINS through its TCP/IP configuration, it will automatically publish the management point to WINS, which clients can then use if all other mechanisms to locate their site's default management point has failed.

However, if the site is operating in native mode, clients cannot use WINS to locate management points.

Note
Because WINS does not provide a secure method of storing management point information, a CCMSetup command line property can be used to prevent clients from using WINS for locating management points, even in mixed mode. More information about this SMSDIRECTORYLOOKUP property can be found in the topic About Configuration Manager Client Installation Properties.

Important
An exception to the default management point location mechanism is if you are using a network load balanced (NLB) management point on the intranet. An NLB management point automatically publishes to Active Directory Domain Services and a server locator point, but it must be manually published to WINS. An NLB management point does not publish to DNS.

For more information about manually publishing an NLB management point in WINS, see How to Manually Add Configuration Manager Site Information to WINS

How Clients Find Resident Management Points When Roaming

When roaming to other sites, Configuration Manager clients find resident management points from Active Directory Domain Services if both of the following conditions are met:

  • Active Directory has been extended for Configuration Manager 2007 and the site the client roams into is published to Active Directory Domain Services.
  • Clients are in the same forest as the site server's forest.

If either of these two conditions does not apply, clients do not contact management points outside their own site. For more information about roaming, see About Client Roaming in Configuration Manager and Example Roaming Scenarios for Configuration Manager: Simple.

Proxy Management Points

If a client's IP address falls within the boundaries of a secondary site that is attached to their assigned site, and it contains a proxy management point, a client can locate this proxy management point in Active Directory Domain Services if both of the following conditions are met:

  • Active Directory has been extended for Configuration Manager 2007 and the site is publishing to Active Directory.
  • Clients are in the same forest as the site server's forest.

If either of these two conditions does not apply, clients ask their assigned management point if the secondary site has a proxy management point that they should use.

When clients are using a proxy management point from one of their assigned site's secondary sites, this effectively becomes their resident management point and clients contact it to request client policy, upload inventory data, request content location, and upload status messages. For more information, see Determine If a Proxy Management Point is Needed at a Secondary Site.

When clients roam into a secondary site that is not attached to their assigned site, and has a proxy management point, clients do not use the proxy management point as a resident management point to request client policy, upload inventory data, and upload status messages. For more information about this scenario, see Example Roaming Scenarios for Configuration Manager: Simple.

See Also

Tasks

Configuring DNS for Configuration Manager Site System Roles
How to Create a Server Locator Point in Configuration Manager

Concepts

About Client Site Assignment in Configuration Manager
Determine If You Need to Publish to DNS
Determine If You Need a Server Locator Point for Configuration Manager Clients
Service Location Flowchart for Distribution Point Selection

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


Configuration Manager and Content Location (Package Source Files)

Topic last updated—March 2008

Content location in Configuration Manager 2007 refers to how Configuration Manager 2007 clients find package source files for advertisements and software updates. When a client needs to locate content, it sends a content location request to a management point:

  • When a client is located within the boundaries of its assigned site, the client requests content location from its default management point.
  • When a client is located within the boundaries of a secondary site that is attached to its assigned site, and the secondary site has a proxy management point, the client requests content location from the proxy management point. If no proxy management point is installed in this secondary site, the client requests content location from its default management point.
  • When a client is located within the boundaries of a site that isn't its assigned site or a secondary site that is attached to the client's assigned site, a client that can access site information from Active Directory Domain Services (global roaming capability) will request content location from the resident management point in the site into which it has roamed. If the resident management point cannot provide this information (the content is not available in that site), the client falls back to asking its default management point.
  • When a client is located within the boundaries of a primary site lower in the hierarchy than its assigned site or a secondary site attached to its assigned site, a client that cannot access site information from Active Directory Domain Services (regional roaming capability), will continue to request content location from its default management point in its assigned site.

For more information about how clients find management points, see Configuration Manager and Service Location (Site Information and Management Points). For example scenarios, see Example Roaming Scenarios for Configuration Manager: Simple.

How Management Points Return Available Distribution Points to Clients

When a management point receives a content location request from a client, it identifies distribution points that host the content requested by clients. For requested advertisements, the package ID and version number is used to identify the requested content. For software updates, the software update configuration item UniqueID value and configuration item version is used to identify the requested content.

The distribution points searched first will be the distribution points in the client's current site. The current site might be the client's assigned site, or a secondary site attached to its assigned site, or another site into which the client has roamed. If the content is not available in the client's current site, distribution points are searched in the client's assigned site. In this way, clients can access content only from distribution points from their current site, or their assigned site.

The management point then sorts the list of identified distribution points in relation to the client's current boundary location.

First, the management point looks for protection distribution points:

  • If the content is on protected distribution points, and the client's current boundary location is included in the protected boundary configuration on protected distribution points, these distribution points only are returned to the client.
  • If the content is not on protected distribution points, but the client's current boundary location is included in the protected boundary configuration, by default management points continue to provide the client with a list of non-protected distribution points that do host the content. However, when the following option is deselected on the advertisement or software update deployment setting, no distributions points are returned to clients and the client will not be able to download the content until it is added to the protected distribution points: Allow clients to fallback to unprotected distribution points when the content is not available on the protected distribution point.

For more information about protected distribution points, see About Protected Distribution Points.

Next, the management point sorts the distribution points according to whether the client is currently in a fast network boundary that is configured for the management point's site:

  • If the client is on a fast network boundary, the management point identifies the distribution points from its own site and marks them as "local".
  • The remaining distribution points are marked as "remote".
  • If there are both local and remote distribution points, the local distribution points are ordered before the remote distribution points.

The list of available distribution points is returned to the client after the filtering process (for protected distribution points) and sorting process (local and remote).

How Clients Choose Distribution Points from the List

Clients receive the list of distribution points, perform their own selection criteria, and then attempt to connect with the first distribution point. If that connection fails, clients try the next on the list. If the connection succeeds but clients experience transient errors, clients retry for up to 8 hours before moving onto the next distribution point on the list.

The order in which clients try to connect to distributions point is the following, first for distribution points marked local (if any) and then for distribution points marked remote:

  • Distribution points on the same IP subnet as the client
  • Distribution points in the same Active Directory site as the client
  • Remaining distribution points

Within each sorting category, the client prefers distribution points that are enabled with the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS. Without this option enabled, client connections to distribution points are over server message blocks (SMB).

As an example, a client will choose a distribution point with this option enabled located on the same IP subnet over a distribution point without this option enabled. However, the client will choose a distribution point that is not enabled with this option and that is located on the same IP subnet as the client over a distribution point that is enabled with this option but located on a different IP subnet as the client.

Within each sorting category, the order of distribution points is nondeterministic, which provides a level of load-balancing for the servers. So, a client would attempt to connect to any of the distribution points that are enabled with the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS on the same IP subnet as the client, and then attempt to connect to any of the distribution points that are not enabled with this option when they are on the same IP subnet as the client.

Internet-Based Distribution Points

When the client is being managed over the Internet, and requesting content from a site configured for Internet-based client management, all Internet-based distribution points in that site will be returned to the client if they contain the content requested by the client.

In this scenario, distribution points must be configured with the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS, and the selection of a distribution point by the client is nondeterministic.

Content Availability

When clients successfully connect to a distribution point on the intranet to access content, the content will always be available to clients that are located within fast network boundaries for the site on which the distribution point is located.

For clients that are not located within fast network boundaries for the site (they are located within slow network boundaries, or within boundaries defined for another site, or outside all configured boundaries on the intranet), the availability of the content depends on the configuration of the advertisement or software update deployment. In this scenario, the default configuration is to prevent access to the content, in order to preserve network bandwidth.

You can change this default setting so that advertisements and software update deployments download and install locally when the client is connected over a slow network boundary. This will ensure that clients can always install the content, but at the expense of network bandwidth over potentially slow and expensive WAN links.

These settings are configurable in the following places:

  • For an advertisement: When a client is connected within a slow or unreliable network boundary: Do not run program on the Advertisement Name Properties: Distribution Points Tab.
  • For a software update deployment: When a client is connected within a slow or unreliable network boundary: Do not install software updates on the Deployment Name Properties: Download Settings Tab and When no distribution point is available locally: Do not run update installation on the Deployment Name Properties: SMS 2003 Settings Tab.

For more information about how clients find management points and content when they move from one location in the hierarchy to another, see About Client Roaming in Configuration Manager.

For example scenarios of how clients access content according to boundary configuration, their network location, and the configuration of advertisements and software update deployments, see Example Roaming Scenarios for Configuration Manager: Complex.

See Also

Concepts

About Distribution Points
Content Location Flowchart for Distribution Point Selection

Other Resources

Software Distribution in Configuration Manager
Configuration Manager Single Site Planning and Deployment


Configuration Manager Site Modes

Site modes are used to configure client-to-server communication. Two site modes are available for Configuration Manager sites: native mode and mixed mode.

Native mode was introduced in Configuration Manager 2007 to provide a higher level of security between clients and servers than mixed mode provides. Mixed mode exists to provide a supported site mode for networking environments without an existing PKI infrastructure and backward compatibility with SMS 2003 clients and sites.

Native mode should be used if you need the highest level of security inConfiguration Manager, or must support Internet-based clients. Before you configure native mode, you must have all of the following configured:

  • An existing public key infrastructure (PKI)
  • A site server signing certificate installed on the site server
  • Web certificates on certain site system roles
  • Client authentication certificates on all Configuration Manager clients, and the management point.
Important
Native mode secures client-to-server communications only.

To protect server-to-server communication, implement IPSec. For more information, see Implementing IPsec in Configuration Manager 2007.

To protect site-to-site communication, use secure key exchange between sites. For more information, see How to Require Secure Key Exchange Between Sites.

Mixed mode should be if any of the following are true:

  • The site will support SMS 2003 clients
  • The site has a parent site configured for mixed mode
  • You have an existing PKI but have not yet installed the site server signing certificate on the site server.

Mixed mode sites cannot use client certificates to authorize clients and so uses a configurable approval setting. For more information, see About Client Approval in Configuration Manager.

In This Section

Benefits of Using Native Mode

Describes the benefits of using native mode and compares native mode with mixed mode with regard to the security benefits.

Prerequisites for Native Mode

Describes both the external dependencies and dependencies within the product.

Certificate Requirements for Native Mode

Lists the certificates required for native mode.

Client Communication in Mixed Mode and Native Mode

Describes how the site configuration affects the client-to-server communication, both within its assigned site and when roaming between sites in different modes.

Configuration Manager Mixed Mode

Describes Configuration Manager mixed-mode site operations.

Administrator Workflow: Migrating a Site to Native Mode

Displays the high-level recommended steps to migrate a Configuration Manager 2007 mixed mode site to native mode.

Administrator Checklist: Migrating a Site to Native Mode

Lists the recommended steps required to migrate a Configuration Manager 2007 mixed mode site to native mode.

Administrator Workflow: Deploying the PKI Requirements for Native Mode

Displays the high-level recommended steps to deploy the public key infrastructure (PKI) requirements for native mode in Configuration Manager 2007.

Administrator Checklist: Deploying the PKI Requirements for Native Mode

Lists the recommended steps required to deploy the public key infrastructure (PKI) requirements before a Configuration Manager 2007 site can operate in native mode.


Benefits of Using Native Mode

Native mode is the recommended site configuration for new Configuration Manager 2007 sites because it offers a higher level of security by integrating with a public key infrastructure (PKI) to help protect client-to-server communication. Native mode is also a requirement for Internet-based client management.

In native mode, clients communicate over HTTPS to the following site systems:

  • Management points:
    • Default management point
    • Network load balanced management points
    • Proxy management point
    • Internet-based management point
  • Standard distribution points (not branch distribution points)
  • Software update points
  • State migration point
Note
There are some situations on the intranet where native mode clients can communicate with standard distribution points over server message blocks (SMB). These scenarios include if advertisements are configured for the option Run program from distribution point, if HTTPS fails, or if the distribution point is not configured with the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients).

In native mode, clients continue to communicate over HTTP to the fallback status point, so that any communication issues related to certificates can be reported back to the site so that the administrator can identify and resolve client communication problems. Additionally, if a native mode client is configured with the option Configure HTTP communication for roaming and site assignment, the client can communicate over HTTP to the following site systems:

  • Server locator point
  • Resident management point and distribution points in a mixed mode site
Important
Native mode does not affect communication between site severs, or between sites in a Configuration Manager 2007 hierarchy. To help secure this communication, use IPsec. For more information, see Implementing IPsec in Configuration Manager 2007.

In native mode, client policies are signed by the site server, which adds an additional layer of defense to the Configuration Manager 2007 hierarchy to mitigate the security risk of a compromised management point sending policies that have been tampered with. This safeguard is particularly relevant if you are using Internet-based client management because this environment requires a management point that is exposed to Internet communication.

Mixed mode offers a lower level of security to support SMS 2003 clients, providing self-signed certificates if you do not have a supporting public key infrastructure (PKI) that can provide the certificates that are required for Configuration Manager 2007.

You cannot upgrade a SMS 2003 site directly to native mode, although you can migrate to native mode after the upgrade is complete.

When you migrate a primary site to native mode, this procedure automatically migrates any secondary sites that are attached to the primary site. It does not automatically migrate child primary sites.

Comparison of Mixed Mode and Native Mode

The following table compares the two site modes and the security features they offer.

Configuration Manager Operation Mixed Mode Native Mode

Use of certificates

Self-signed certificates that are generated and managed by Configuration Manager, and are used only within Configuration Manager.

Industry standard PKI certificates that are created and managed independently from Configuration Manager, and can be integrated with other business solutions.

Mutual authentication between client and site systems

Proprietary authentication between the client and management point, and between the client and state migration point. No other site systems use mutual authentication with clients.

SSL authentication between the client and following site systems:

  • Management point
  • Distribution point (if not a server share or branch distribution point)
  • Software update point
  • State migration point

Site system to site system authentication and encryption of traffic

No - IPsec is recommended to help secure this communication.

See Implementing IPsec in Configuration Manager 2007.

No - IPsec is recommended to help secure this communication.

See Implementing IPsec in Configuration Manager 2007.

WINS can be used for name resolution and service location.

Yes

Although WINS can be used for name resolution and locating a server locator point, WINS cannot be used in native mode to locate the default management point.

Default management points are located in Active Directory, DNS, or the server locator point. However, network load balanced management points can only be located in Active Directory or with a server locator point.

For more information about service location in native mode, see Configuration Manager and Service Location (Site Information and Management Points).

Policy is signed

Yes - by the management point

Yes - by the site server, and the management point.

Policy is encrypted over SSL

No

Yes

Content is signed

Yes, if advertisements are using the option of Download content from distribution point and run locally.

No, if advertisements are using the option Run program from distribution point.

Yes, if advertisements are using the option of Download content from distribution point and run locally

No, if advertisements are using the option Run program from distribution point (this option is not supported when the client is managed on the Internet)

Content is encrypted

No

Yes, using SSL if advertisements are using the option of Download content from distribution point and run locally. However, if HTTPS fails in the intranet, content is sent over SMB which is not encrypted.

No if advertisements are using the option Run program from distribution point because SMB will be used (this option is not supported when the client is managed on the Internet).

Inventory data and state messages are signed

Yes, using SHA1 if clients are running at least SMS 2003 Service Pack 1.

Yes. The one exception is state messages to the fallback status point, which are not signed.

Inventory data and state messages are encrypted

Optional, using 3DES

Yes, using SSL. The one exception is state messages to the fallback status point, which are not encrypted.

Status messages from clients are signed

No

Yes.

Status messages from clients are encrypted

No

Yes, using SSL.

Metering data from clients is signed

No

Yes

Metering data from clients is encrypted

No

Yes, using SSL

Client approval to be fully managed in the site

Requires configuration with one of the following options:

  • Manually approve each client
  • Automatically approve clients from trusted domains
  • Automatically approve all clients
  • Automatic because clients are authenticated through PKI

If the operating system deployment feature is used, state migration data is signed and encrypted

Yes

Yes, using SSL

See Also

Concepts

Prerequisites for Native Mode
Overview of Internet-Based Client Management
Certificate Requirements for Native Mode
Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)
Client Communication in Mixed Mode and Native Mode
Configuration Manager and Service Location (Site Information and Management Points)
Implementing IPsec in Configuration Manager 2007

Other Resources

How to Configure Native Mode


Prerequisites for Native Mode

Topic last updated—November 2007

Running Configuration Manager 2007 in native mode creates both external dependencies and dependencies within the product.

Dependencies External to Configuration Manager 2007

Dependency More Information

You must have a supporting public key infrastructure (PKI) that can deploy and manage the certificates required for native mode.

The site server, specific site systems, computers, and devices in the Configuration Manager site must have a certificate that is managed independently from Configuration Manager.

For more information, see

Certificate Requirements for Native Mode

If you are using fully qualified domain names (FQDNs) for Configuration Manager site systems (required for Internet-based client management and recommended on the intranet), all clients and servers must have access to Domain Name System (DNS) to resolve the computer names of servers.

DNS can also be used by clients to locate their default management point if Configuration Manager is configured for DNS publishing. DNS publishing is appropriate for the following scenarios:

  • Active Directory Domain Services is not extended for Configuration Manager.
  • Clients are from an untrusted domain or a workgroup.
Note
Network load balancing (NLB) management points cannot be published to DNS.

Windows Internet Name Service (WINS) is not supported in native mode as the means by which clients locate management points.

WINS is supported in native mode for clients that need to find a server locator point.

For more information, see Configuration Manager and Name Resolution and

Configuration Manager and Service Location (Site Information and Management Points)

Configuration Manager 2007 Dependencies

Note
Extending the Active Directory schema for Configuration Manager is not a requirement for native mode. However, it is much easier to configure clients for native mode when Configuration Manager is publishing to Active Directory Domain Services, which requires that the schema is extended for Configuration Manager 2007.

Dependency More Information

The site must be running Configuration Manager 2007, and the primary site server must be configured with the site server signing certificate.

Native mode is the default for all new sites when running Configuration Manager 2007 Setup. You can also migrate the site to native mode after installation.

How to Configure the Site Server with its Site Server Signing Certificate

How to Migrate the Site Mode from Mixed Mode to Native Mode

If the site is a child site, the parent site must be in native mode.

When upgrading a Configuration Manager hierarchy, upgrade sites from top to bottom, and ensure that a parent site is successfully running in native mode before migrating a child site to native mode.

If the native mode primary site has secondary sites, the secondary sites will automatically be configured for native mode.

Secondary sites inherit these site settings from their primary site:

  • Site mode
  • Port configuration for client requests
  • Custom Web site

If your site system servers have PKI certificates with their fully qualified domain names (FQDN) in the certificate subject name, you must configure the same fully qualified domain names of site systems in Configuration Manager 2007.

How to Configure the Intranet FQDN of Site Systems

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

Configuring DNS for Configuration Manager Site System Roles

If your PKI deployment uses a certificate revocation list (CRL), ensure that Configuration Manager clients and native mode site systems can locate it. This requirement has the following considerations:

  • The CRL is published where computers have network connectivity to it. (For example, you might need additional CRL distribution points in the perimeter network for Internet-based clients, which clients contact by using an http connection.)
  • Intervening network devices, such as firewalls, are configured to allow connectivity to the CRL distribution point.
  • Computers can successfully resolve the name of the CRL distribution points.

Certificate revocation checking is enabled by default for native mode Configuration Manager clients, but it can be disabled. For more information, see Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode).

Certificate revocation checking is enabled by default with IIS and cannot be disabled with Configuration Manager. Ensure that native mode site systems can connect to a CRL distribution point that is listed in their site system certificate.

Note
For more information about CRL distribution points (CDPs), see the following Windows PKI information about configuring CDP and AIA extensions: http://go.microsoft.com/fwlink/?LinkId=103608

Clients must be running the Configuration Manager 2007 client.

Clients running Systems Management Server (SMS) 2003 are not supported.

Important
Client computers running Windows 2000 Professional or Windows 2000 Server cannot support native mode and will be unmanaged if they are assigned to a site that is configured for native mode.

See Also

Concepts

Benefits of Using Native Mode
Configuration Manager Site Modes


Certificate Requirements for Native Mode

Topic Last Updated—August 2008

The public key infrastructure (PKI) certificates required for a Configuration Manager 2007 site to run in native mode are listed in the following tables. This information assumes basic knowledge of PKI certificates. For more information about PKI, use the PKI references and deployment topics listed in Deploying the PKI Certificates Required for Native Mode.

When you are using a Microsoft PKI solution, the use of certificate templates can ease the management of these certificates. Template-based certificates can be issued only by an enterprise certification authority running on the Enterprise Edition or on the Datacenter Edition of Windows Server 2003 or Windows Server 2008. However, do not use version 3 templates (Windows Server 2008, Enterprise Edition). These certificate templates create certificates that are not compatible with Configuration Manager. To see how certificate templates can be used for deploying the certificates required by Configuration Manager in native mode, see the following:

  • Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2008 Certification Authority
  • Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority
Important
The certificates must be in place before the site can operate in native mode. Configuration Manager will attempt to validate the site server signing certificate when native mode is selected during Setup or when the site is migrated to native mode after Setup. However, Configuration Manager is unable to validate the other certificates that are required for native mode operation.

You can manually run the Configuration Manager Native Mode Readiness Tool utility to verify whether client computers are ready for native mode. For more information about this tool, see How to Determine Whether Client Computers Are Ready for Native Mode.

Certificates Required for Native Mode

Configuration Manager Component Certificate Use Microsoft Certificate Template to Use Specific Information in Certificate How the Certificate Is Used in Configuration Manager

Primary site server

Document signing

There is no default template for document signing. You can use any version 2 (v2) template, removing the intended usages if these are not required and adding the document-signing capability.

Enhanced Key Usage value must contain Document Signing (1.3.6.1.4.1.311.10.3.12).

The Subject Name field must contain the following string: The site code of this site server is <XXX>. Replace <XXX> with the site code of the site server.

Note
This exact text string in English must be used, in the same case, without a trailing period, and the site code must be specified at the end of the string in the same case as it appears in the Configuration Manager console.

Maximum supported key length is 8096 bits.

This certificate must reside in the Personal store in the Computer certificate store.

The site server signing certificate signs the policies that clients download from their management point so that clients know the policies originate from their assigned site.

This certificate is not required on secondary site servers.

Clients must have a copy of this certificate before they can accept policies signed with it. For more information, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode).

Site system roles:

  • Management point
  • Proxy management point
  • Distribution point
  • Software update point
  • State migration point

Server authentication

Web server

Enhanced Key Usage value must contain Server Authentication (1.3.6.1.5.5.7.3.1).

If the site system accepts connections from the Internet, the Subject Name or Subject Alternative Name must contain the Internet fully qualified domain name (FQDN).

If the site system accepts connections from the intranet, the Subject Name or Subject Alternative Name must contain either the intranet FQDN (recommended) or the computer's NetBIOS name, depending on how the site system is configured.

If the site system accepts connections from both the Internet and the intranet, both the Internet FQDN and the intranet FQDN (or computer NetBIOS name) must be specified using the ampersand (&) symbol delimiter between the two names.

Configuration Manager does not specify a maximum supported key length for this certificate. Consult your PKI and IIS documentation for any key-size–related issues for this certificate.

This certificate must reside in the Personal store in the Computer certificate store.

This Web server certificate is used to authenticate these servers to the client and to encrypt all data transferred between the client and these servers using Secure Sockets Layer (SSL).

Client computers

Client authentication

Computer or Workstation

Enhanced Key Usage value must contain Client Authentication (1.3.6.1.5.5.7.3.2).

Client computers must have a unique value in the Subject Name field or in the Subject Alternative Name field (if you are using Microsoft certificate templates, the Subject Alternative Name is available with the workstation template only).

Note
If you are using multiple values for the Subject Alternative Name, only the first will be used.

Maximum supported key length is 2048 bits.

By default, Configuration Manager looks for computer certificates in the Personal store in the Computer certificate store. To change this default, see How to Specify the Client Certificate Store.

This certificate authenticates the client to the following servers:

  • Management point
  • Proxy management point
  • Distribution point
  • Software update point
  • State migration point

This certificate is also required on management points and state migration points, even if the Configuration Manager 2007 client is not installed on these site systems, so that the health of these roles can be monitored and reported to the site server. This certificate for these site systems must reside in the Personal store of the Computer certificate store.

Mobile device clients

Client Authentication

Authenticated session

Enhanced Key Usage value must contain Client Authentication (1.3.6.1.5.5.7.3.2).

Maximum supported key length is 2048 bits.

Important
These certificates must be in Distinguished Encoding Rules (DER) encoded binary X.509 format.

Base64 encoded X.509 format is not supported.

This certificate must reside in the Personal store.

This certificate authenticates the mobile device client to the following servers:

  • Mobile device management point
  • Mobile device proxy management point
  • Distribution point

Components Requiring Additional Certificates for Native Mode

You will need additional certificates if the native mode site supports the following optional components:

  • Network load balancing management points or network load balancing software update points.
  • Proxy servers for Internet-based client management.
  • The operating system deployment feature.
  • Mobile devices

The following sections provide information about the certificates that are required for each of these additional components.

Network Load Balancing Management Points or Network Load Balancing Software Update Points

If the site supports a network load balancing management point or a network load balancing software update point, there are additional certificate requirements, as listed in the following table.

Configuration Manager Component Certificate Use Microsoft Certificate Template to Use Specific Information in Certificate How the Certificate Is Used in Configuration Manager

Network Load Balancing (NLB) cluster for a management point or a software update point

Server authentication

Web server
  1. The FQDN of the NLB cluster in the Subject Name field, or Subject Alternative Name field:
    • For network load balancing servers that support Internet-based client management, this will be the Internet NLB FQDN.
    • For network load balancing servers that support intranet clients, this will be the intranet NLB FQDN.
  2. The computer name of the site system in the NLB cluster in the Subject Name field or Subject Alternative Name field. This server name must be specified after the NLB cluster name and the ampersand (&) symbol delimiter:
    • For site systems on the intranet, this will be the intranet FQDN if specified (recommended) or the computer NetBIOS name.
    • For site systems supporting Internet-based client management, this will be the Internet FQDN.

This certificate is used to authenticate the network load balancing management point or the network load balancing software update point to the client, and to encrypt all data transferred between the client and these servers using SSL.

Proxy Web Servers for Internet-Based Client Management

If the site supports Internet-based client management and you are using a proxy Web server with SSL termination (bridging) for incoming Internet connections, the proxy Web server has the certificate requirements listed in the following table.

Note
If you are using a proxy Web server without SSL termination (tunneling), no additional certificates are required on the proxy Web server.

For more information about using proxy Web servers for Internet-based client management, see Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management.

Network Infrastructure Component Certificate Use Microsoft Certificate Template to Use Specific Information in Certificate How the Certificate Is Used in Configuration Manager

Proxy Web server accepting client connections over the Internet

Server authentication and client authentication
  1. Web server
  2. Computer or Workstation

Internet FQDN in the Subject Name field or in the Subject Alternative Name field (if you are using Microsoft certificate templates, the Subject Alternative Name is available with the workstation template only).

This certificate is used to authenticate the following servers to Internet clients and to encrypt all data transferred between the client and this server using SSL:

  • Internet-based management point
  • Internet-based distribution point
  • Internet-based software update point

The client authentication is used to bridge client connections between the Configuration Manager 2007 clients and the Internet-based site systems.

Operating System Deployment Feature

If the site supports the operating system deployment feature, the certificates listed in the following table are required in addition to the server certificate and the client certificate required for the state migration point.

For more information about the certificates related to operating system deployment in a native mode site, see How to Manage Native Mode Certificates and Operating System Deployment.

Configuration Manager Component Certificate Use Microsoft Certificate Template to Use Specific Information in Certificate How the Certificate Is Used in Configuration Manager

Operating system client deployment, if client certificates are required to complete the deployment.

Client authentication

Computer or Workstation

Enhanced Key Usage value must contain Client Authentication (1.3.6.1.5.5.7.3.2).

Unique value in the Subject Name or in the Subject Alternative Name field (if you are using Microsoft certificate templates, the Subject Alternative Name is available with the workstation template only).

Maximum supported key length is 2048 bits.

The certificate is used if task sequences in the operating system deployment process include client actions such as client policy retrieval or sending inventory information.

The client certificate must be exported in a Public Key Certificate Standard (PKCS #12) format, and the password must be known so that it can be imported into Configuration Manager boot images or supplied by the PXE service point. These certificates are used for the duration of the operating system deployment process only and are not installed on the client. Because of this temporary use, the same certificate can be used for every operating system deployment if you do not want to use multiple client certificates.

PKCS #12 files have a .PFX extension.

For more information:

  • How to Export Certificates For Use With Operating System Deployment

Root certification authority certificates for operating system deployment clients.

Root authority for the site server's certificate and management point's server certificate.

Not applicable.

Standard root certification authority certificate.

The root certification authority certificate must be provided so that the client can communicate with the management point to complete the operating system deployment. Each primary site in native mode that uses the operating system deployment feature must be configured with root CA certificates. However, secondary sites will automatically use the root certification authority certificates specified on their primary site.

For more information:

  • How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients
  • How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients

Mobile Devices

For additional information about the certificates required for mobile devices, see About Native Mode Certificates for Mobile Device Clients.

Certificate Deployment Information

Refer to the following section for guidance on how to install the PKI certificates required for Configuration Manager 2007 native mode:

  • Deploying the PKI Certificates Required for Native Mode

Use the following administrator workflow and checklist to guide you through the PKI deployment steps for the PKI certificates required for Configuration Manager 2007 native mode:

  • Administrator Workflow: Deploying the PKI Requirements for Native Mode
  • Administrator Checklist: Deploying the PKI Requirements for Native Mode

When the PKI certificates are deployed and you are ready to migrate a Configuration Manager 2007 mixed mode site to native mode, use the following administrator workflow and checklist:

  • Administrator Workflow: Migrating a Site to Native Mode
  • Administrator Checklist: Migrating a Site to Native Mode

See Also

Tasks

How to Determine Whether Client Computers Are Ready for Native Mode
How to Identify Client Certificate Issues in Native Mode
How to Enable or Disable Certificate Revocation Checking (CRL) on Clients
Configuring DNS for Configuration Manager Site System Roles

Concepts

Benefits of Using Native Mode
Determine If You Can Use Your Existing PKI (Native Mode)
Renewing or Changing the Site Server Signing Certificate
Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)
Determine If You Will Use FQDN Server Names
Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode)

Other Resources

How to Configure Native Mode


Client Communication in Mixed Mode and Native Mode

The site mode configuration in a Configuration Manager 2007 site affects the client-to-server communication, both within its assigned site and when roaming between sites in different modes.

Client-to-Server Communication Within a Site

The following table displays the change of protocol communication from HTTP to HTTPS for the different site modes when a client is communicating with site systems in its assigned site.

Site System | Mixed Mode | Native Mode
Management point | HTTP | HTTPS
Standard distribution point | HTTP | HTTPS
Software update point | HTTP or HTTPS | HTTPS
State migration point | HTTP | HTTPS
Fallback status point | HTTP | HTTP
Server locator point | HTTP | HTTP
Note
In native mode, client computers must be configured for HTTP communication for roaming and site assignment to communicate with a server locator point. If native-mode client computers are not configured with this option, they cannot communicate with a server locator point in native mode. Mobile device clients do not communicate with a server locator point, and do not support roaming capability.

The following picture shows this change of protocol communication from HTTP to HTTPS for the different site modes when a client is communicating with site systems in its assigned site.

Mixed mode client-to-server protocols Native mode client-to-server protocols

The following site system communications are not affected by the by site mode, because these are initiated by the Microsoft Windows operating system or browser rather the Configuration Manager 2007 client:

  • System Health Validator point: The computer sends statement of health messages to the System Health Validator point, using the Network Access Protocol communication established with the Network Policy Server.
  • PXE Service point: The computer uses the PXE protocol to boot the computer and install an operating system.
  • Reporting point: The computer uses the selected Web browser to connect to the reporting point. You can configure the reporting point for HTTP or HTTPS independently from the site mode.

Additionally, branch distribution points will always use the server message block (SMB) protocol in both mixed mode and native mode, and standard distribution points will also use SMB if they are not configured with the following option: Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients.

There are also some situations where clients can communicate with standard distribution points over SMB rather than HTTP or HTTPS, such as when advertisements are configured with the option Run program from distribution point, and also if HTTP fails in mixed mode or HTTPS fails on the intranet in native mode.

Client-to-Server Communication When Roaming Between Sites in Different Modes

For an overview of roaming in Configuration Manager 2007, see About Client Roaming in Configuration Manager.

When a mixed mode client roams into a native mode site, the mixed mode client will not be able to communicate with the resident native mode management point or with any native mode distribution points in that site. In this scenario, roaming does not work, and the client will communicate with its assigned management point and download content from distribution points in its own site.

When a native mode client computer roams into a mixed mode site, the behavior varies depending on whether the native mode client computer is configured for HTTP communication for roaming and site assignment. The following table displays this difference.

Site System | Client communication if HTTP communication for roaming and site assignment is not configured | Client communication if HTTP communication for roaming and site assignment is configured
Client’s assigned (native mode) management point | Yes, using HTTPS | Yes, using HTTPS
Client’s assigned site (native mode) distribution point | Yes, using HTTPS | Yes, using HTTPS
Mixed mode resident management point | No | Yes, using HTTP
Mixed mode distribution point | No | Yes, using HTTP

The following picture shows the roaming behavior for a native-mode client computer if the option for HTTP communication for roaming and site assignment is not configured.

Native mode roaming without HTTP option enabled

The following picture shows the roaming behavior for a native-mode client computer if the option for HTTP communication for roaming and site assignment is configured.

Native mode roaming with HTTP option enabled

See Also

Tasks

How to Configure HTTP Communication for Roaming and Site Assignment

Concepts

Configuration Manager Site Modes
Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)
Determine If You Need a Server Locator Point for Configuration Manager Clients
Roaming Between Sites in Different Modes
Supported Scenarios for Internet-Based Client Management
Understanding Configuration Manager Sites


Configuration Manager Mixed Mode

When Configuration Manager 2007 sites are operating in mixed mode, self-signed certificates are used to secure client-to-server communications and client-to-server data encryption is optional.

Supported Site Hierarchy Configurations for Mixed Mode

The supported parent-child configurations for Configuration Manager 2007 sites operating in mixed mode are as follows:

  • A Configuration Manager 2007 site operating in mixed mode reporting to a Configuration Manager 2007 site operating in mixed mode.
  • A Configuration Manager 2007 site operating in mixed mode reporting to a Configuration Manager 2007 site operating in native mode.
  • An SMS 2003 site operating in advanced security reporting to a Configuration Manager 2007 site operating in mixed mode.
    Note
    If you choose to install a Configuration Manager 2007 site in mixed mode during setup, you can migrate the site to native mode after installation.

See Also

Tasks

How to Encrypt Client to Management Point Data in Mixed Mode


Administrator Workflow: Migrating a Site to Native Mode

This administrator workflow displays the recommended steps to migrate a Configuration Manager 2007 site to native mode.

For information about each step of the workflow, see the following topic: Administrator Checklist: Migrating a Site to Native Mode.

Migrating a ConfigMgr site to native mode workflow

See Also

Concepts

Certificate Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Administrator Checklist: Migrating a Site to Native Mode

Topic Last Updated—August 2008

The following checklist provides the steps required to migrate a Configuration Manager 2007 mixed mode site to native mode.

Step Reference

Confirm the decision to configure the site for native mode.

Choose between Native Mode and Mixed Mode

Confirm the site meets all the native mode prerequisites.

Prerequisites for Native Mode

Confirm all the public key infrastructure (PKI) certificates are in place.

Administrator Checklist: Deploying the PKI Requirements for Native Mode

How to Determine Whether Client Computers Are Ready for Native Mode

If the policy polling interval on the computer client agent properties is configured for a value higher than the default of 60 minutes, consider reducing this value.

Although this increases the network traffic, the benefit is client computers can more quickly learn about the new site mode communication.

Note
If you reduce the polling interval, do not configure it for less than 60 minutes. Configuring it for less than 60 minutes has no benefit in terms of clients automatically switching to native mode.

Configure Your Client Agents

Optional but recommended: Create a custom Web site.

Determine If You Will Use a Custom Web Site

How to Configure Custom Web Sites for Configuration Manager Sites

How to Configure a Configuration Manager Site to Use a Custom Web Site

Ensure you have configured both HTTP and HTTPS ports for client requests.

How to Configure Request Ports for the Configuration Manager Client

Optional but recommended: Ensure that you have a fallback status point for the site, and assign clients to it.

Determine If You Should Install a Fallback Status Point for Configuration Manager Clients

How to Create a Fallback Status Point in Configuration Manager

How to Assign the Fallback Status Point to Configuration Manager Client Computers

If you are using a network load balancing management point, you will probably need a server locator point for the hierarchy because clients will no longer be able to locate their management point by using WINS.

Determine If You Need a Server Locator Point for Configuration Manager Clients

How to Create a Server Locator Point in Configuration Manager

If Active Directory Domain Services is not extended with Configuration Manager 2007 schema extensions, or the site contains clients from workgroups or another Active Directory forest, reinstall these clients with a command-line option to operate in native mode.

You might need additional options for the following:

  • CRL checking.
  • Allow HTTP communication for roaming and site assignment.
  • Nondefault certificate store.
  • Certificate selection criteria.
  • Behavior if more than one certificate is found.
  • Fallback status point.
  • Site server signing certificate.

Extending the Active Directory Schema for Configuration Manager

About Configuration Manager Client Installation Properties

If you have mobile client devices assigned to the site, these clients must be reinstalled with settings for native mode.

Configuring Mobile Device Management

Open the Configuration Manager console in the primary site you are migrating to native mode, select native mode as the site property, and then select the site server signing certificate or enter the thumbprint.

How to Configure the Site Server with its Site Server Signing Certificate

If you are using the operating system deployment feature, import root CAs for clients.

How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients

If you are publishing the site to Active Directory Domain Services, or will use client push as a client installation method, configure the following options, if required:

  • CRL checking.
  • Allow HTTP communication for roaming and site assignment.
  • Nondefault certificate store.
  • Certificate selection criteria.
  • Behavior if more than one certificate is found.

How to Enable or Disable Certificate Revocation Checking (CRL) on Clients

How to Configure HTTP Communication for Roaming and Site Assignment

How to Specify the Client Certificate Store

How to Specify the Client Certificate Selection Criteria

Verify that native mode migration is complete for the site.

How to Verify Native Mode Migration Is Complete

Verify that clients have migrated to native mode.

How to Monitor Changes in Configuration Manager Client Site Modes

How to Determine the Site Mode for a Configuration Manager Client

Identify and resolve certificate issues with unmanaged clients.

How to Identify Client Certificate Issues in Native Mode

See Also

Tasks

How to Migrate the Site Mode from Mixed Mode to Native Mode

Concepts

Administrator Workflow: Migrating a Site to Native Mode


Administrator Workflow: Deploying the PKI Requirements for Native Mode

This administrator workflow displays the recommended steps to deploy the public key infrastructure (PKI) requirements for native mode in Configuration Manager 2007.

For information about each of the steps in the workflow, see the following topic: Administrator Checklist: Deploying the PKI Requirements for Native Mode.

Administrator workflow for deploying PKI

See Also

Concepts

Administrator Checklist: Deploying the PKI Requirements for Native Mode
Certificate Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Administrator Checklist: Deploying the PKI Requirements for Native Mode

The following checklist provides the steps required to deploy the public key infrastructure (PKI) requirements before a Configuration Manager 2007 site can operate in native mode.

Step Reference

Confirm your PKI can support the various certificates required by Configuration Manager 2007.

Certificate Requirements for Native Mode

Ensure the following computers in the Configuration Manager 2007 site have a trusted root certification authority in common and intermediate certification authorities as needed:

  • The site server.
  • Management points (the default management point, proxy management point, Internet-based management point, network load balanced management points).
  • Distribution points.
  • Software update points.
  • State migration points.
  • All client computers and mobile client devices.
Note
Distribution points that are configured as site system shares rather than site system servers, as well as branch distribution points, do not use Internet Information Services (IIS) and therefore do not require certificates.

Deploying a Trusted Root Certification Authority to Configuration Manager Computers

Deploying the Intermediate Certification Authority Certificates to Configuration Manager Computers

If you will use a Certificate Revocation List (CRL), publish it where all computers can locate it.

Certificate revocation checking is enabled by default for Configuration Manager clients, but it can be disabled. For more information, see Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode).

Certificate revocation checking is enabled by default with IIS and cannot be disabled with Configuration Manager. Ensure that native mode site systems can connect to a CRL distribution point that is listed in their site system certificate.

Note
For more information about CRL distribution points (CDPs), see the following Windows PKI information about configuring CDP and AIA extensions: http://go.microsoft.com/fwlink/?LinkId=103608.

Deploy the site server signing certificate to the site server, and determine how clients will retrieve it.

Deploying the Site Server Signing Certificate to the Site Server

Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)

Deploy the Web server certificates to the following site systems, and then configure IIS with the certificate:

  • Management points (the default management point, proxy management point, Internet-based management point, network load balanced management points).
  • Distribution points.
  • Software update points.
  • State migration points.

Deploying the Web Server Certificates to Site System Servers

Optional but recommended: On the site systems with the deployed Web server certificates, create or modify a certificate trust list (CTL) in IIS to contain the root certification authorities used by clients.

Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode)

Deploy client certificates to clients and management points.

Deploying the Client Computer Certificates to Clients and the Management Point

If you have mobile client devices, deploy the client device certificates.

Deploying Certificates to Mobile Device Clients

If you are using the operating system deployment feature, perform the following tasks:

  1. Export root certification authority certificates that operating system clients will use during the deployment process so that these can be imported into the Configuration Management console as a site setting.
  2. Prepare and export one or more client certificates into a PKCS #12 file so that these can be included in the operating system deployment.

How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients

How to Export Certificates For Use With Operating System Deployment

See Also

Tasks

How to Configure the Site Server with its Site Server Signing Certificate
How to Migrate the Site Mode from Mixed Mode to Native Mode

Concepts

Administrator Checklist: Migrating a Site to Native Mode
Administrator Workflow: Deploying the PKI Requirements for Native Mode
Prerequisites for Native Mode


Configuration Manager Custom Web Site Overview

Configuration Manager 2007 allows you to host Configuration Manager site system services in a dedicated virtual Web site instead of sharing the default Web site on computers hosting site systems that require Microsoft Internet Information Services (IIS) to be configured for client communication. This provides the ability to share the IIS services with applications such as Microsoft Windows® SharePoint® Services or other Web sites hosted by Configuration Manager 2007 site systems.

Important
Using Configuration Manager site systems to run additional applications increases the attack surface on those site systems and is not recommended. The best practice for Configuration Manager site systems requiring IIS is to use a server solely dedicated to providing Configuration Manager services.

Using a custom Web site might be a requirement if you are running native mode, which exclusively requires https communication, and have site systems requiring IIS to be configured so that the default Web site still responds to http communications.

Configuring the use of a custom Web site for client communication is a site-wide setting. When the use of a custom Web site is enabled for a site, all client communications within the site will be directed to the custom Web site of site systems instead of the default Web site in IIS.

Important
Because secondary sites inherit custom Web site settings from their parent sites, configuring a custom Web site at a site with secondary child sites requires custom Web site creation for each attached secondary site.

Before enabling the use of a custom Web site for client communication in the Configuration Manager console, you must manually create a custom Web site named SMSWEB on all site systems that require Internet Information Services (IIS) in the site. For information about which site systems require IIS, see Configuration Manager Supported Configurations.

Important
The custom Web site must be configured to respond to the same port configured for Configuration Manager client communication.

If you choose to enable the use of a custom Web site for your site, it is recommended that you implement the use of a custom Web site at every site within the hierarchy to support client roaming within the hierarchy.

See Also

Tasks

How to Configure a Configuration Manager Site to Use a Custom Web Site
How to Configure Custom Web Sites for Configuration Manager Sites


Configuration Manager Discovery Planning

To discover possible Configuration Manager 2007 client systems, you must determine which discovery methods you will enable for your Configuration Manager 2007 sites. You can choose different combinations of discovery methods to locate resources. The discovery method you use determines the type of resources discovered and which Configuration Manager 2007 services and agents are used in the discovery process. A computer does not automatically become a Configuration Manager 2007 client through discovery. Depending on how you plan to use Configuration Manager 2007, you can choose to perform discovery without performing installation, or vice versa.

See Also

Concepts

Discovery Planning Worksheet


Configuration Manager Site Capacity Planning

Topic Last Updated—August 2008

The following recommendations can be used as a baseline to help determine site capacity planning information that is appropriate to your organization’s infrastructure. For information about Configuration Manager performance recommendations, see Configuring Configuration Manager Sites for Best Performance.

Actual site capacity requirements may vary from the listed recommendations depending on your specific networking environment and how Configuration Manager 2007 features are implemented. The hardware used to host Configuration Manager 2007 site systems also contributes to the performance of Configuration Manager 2007. The number of Configuration Manager 2007 component servers, number of clients installed, and the features enabled also affect server performance.

Capacity Planning Recommendations

The following recommendations can be used as a baseline for Configuration Manager 2007 site system capacity planning. These recommendations can be used to determine capacity planning criteria relevant to your specific networking environment.

Note
These recommendations are based on using the default site settings for all Configuration Manager 2007 features and the deployment of hardware suitable for the site system role and number of clients that it will support. For more information about common Configuration Manager 2007 performance related questions and sample configurations, see the technical whitepaper at http://go.microsoft.com/fwlink/?LinkID=113136.

Site System Maximum recommended number per site

Clients

Up to 200,000 per hierarchy

Primary Site Server

Up to 100,000 directly assigned clients

Secondary Site Server

Up to 500 secondary sites per primary

Note
The number of secondary sites recommended per primary site is based on reasonably well connected and reliable WAN network connections. Unreliable server hardware or network connections can dramatically reduce this number.

Management Point

Up to 25,000 clients

Note
To support more than 25,000 clients in one site, management point site systems can be configured to use Network Load Balancing (NLB).

Distribution Point

Up to 4,000 clients

Note
The number of clients that one distribution point can support is dependent on network speed, disk performance, and software distribution package size.

Branch distribution point

Up to 2,000 per site, each capable of supporting up to 100 clients.

Note
These numbers apply whether the branch distribution point is installed on a workstation-class operating system or a server-class operating system.

Software update point

Up to 25,000 clients

Note
To support more than 25,000 clients in one site, software update point site systems can be configured to use Network Load Balancing (NLB).

System Health Validator point

Up to 100,000 clients (or one per hierarchy if less than 100,000 clients)

Fallback status point

Up to 100,000 clients (or one per site)

See Also

Concepts

Configuration Manager Site System Planning

Other Resources

Configuration Manager Single Site Planning and Deployment


Configuration Manager Site System Planning

Topic last updated—March 2008

Each Configuration Manager 2007 site contains a site server and one or more site systems. A site system is a server or server share that provides functionality to the Configuration Manager 2007 site. A site system role is a function that a site system performs within a Configuration Manager 2007 site. For example, the management point site system role provides a communication point between the Configuration Manager 2007 site server and Configuration Manager clients.

All Configuration Manager 2007 site systems must be members of a Windows 2000 or Windows 2003 Active Directory domain. It is not supported to change the domain membership or computer name for a Configuration Manager 2007 site system once it is installed.

Although a site server can perform multiple site system roles simultaneously, this configuration is not recommended for production sites with large numbers of resources. To decrease the load on your primary or secondary site server, you might want Configuration Manager 2007 to perform some server tasks on computers other than the site server. Some site system roles are assigned during installation, while others must be assigned after site setup has completed. After setup has been completed, the Configuration Manager console can be used to assign site system roles to the primary site server or distribute them among several different site systems.

Note
Configuration Manager site system role servers are often referred to by their site system role name. For example, a server that performs the distribution point role is often called a distribution point.

Basic Site System Roles

The basic site system roles that you can assign to site systems within a site are described in the following table.

Site System Description

Configuration Manager component server role

Any site system that runs the SMS Executive service component provides the component server role. A component server can run only selected threads of the SMS Executive. Use this role to lessen the processing burden on the site server or to provide duplicate threads.

This role is required to support other roles, such as a management point, and is installed and removed with the other server roles.

Configuration Manager site server

The site server role is automatically filled by the Windows Server computer where Configuration Manager 2007 Setup has been run.

This role is assigned during Configuration Manager 2007 installation.

Configuration Manager site system

Site systems are computers or server shares that provide Configuration Manager functionality to a site. Each site system hosts one or more site system roles. Some site system roles can be assigned to site systems within the site by using the Configuration Manager console. Other site system roles are automatically assigned to a site system and cannot be configured.

Configuration Manager site database server

The site database server is a computer running Microsoft SQL Server 2005 that stores information for Configuration Manager 2007 sites, such as discovery data, hardware and software inventory data, and configuration and status information. Every primary site in the Configuration Manager 2007 hierarchy contains a site database and a server assigned the site database server role. You can install SQL Server on the primary site server or reduce the site server's processing load by installing SQL Server on a computer other than the primary site server.

Note
Hosting the site database for more than one Configuration Manager 2007 site on a single SQL Server computer is supported. However, installation of more than one site on the same computer is not supported for the SMS Provider.

The site database can be installed on the default or on a named instance on a single SQL Server computer, or it can be installed on a named instance on a clustered SQL Server instance. For more information about installing Configuration Manager sites using a clustered SQL Server instance, see How to Install Configuration Manager Using a Clustered SQL Server Instance.

Note
The only SQL service required to host the Configuration Manager site database is the SQL database service.

This role is assigned during Configuration Manager 2007 primary site installation.

SMS Provider

The SMS Provider is the interface between the Configuration Manager console and the site database. The SMS Provider can be installed on the site server, the site database server (unless the site database is hosted on a clustered SQL Server instance), or on another computer. The SMS Provider can also be moved to another computer after installation by running Setup again.

Note
It is not supported for the SMS Provider for more than one site to be installed on the same computer.

This role is assigned during Configuration Manager 2007 primary site installation.

Important
The SMS Provider must be installed on a computer with the same operating system language as the site server's operating system language when a site contains site servers or clients with different language operating systems installed.

For more information about the SMS Provider, see SMS Provider Overview. For more information about choosing where to install the SMS Provider, see Choose the SMS Provider Installation Location.

Management point

The management point is the primary point of contact between Configuration Manager clients and the site server. Management points can provide clients with installation prerequisites, client installation files, configuration details, advertisements, and distribution point locations. Additionally, management points receive inventory data, software metering information, and status and state messages from clients.

A Configuration Manager 2007 site can have only one default management point that intranet-based clients will use to communicate with the site server. When clients are managed on the Internet, they do not locate a default management point but connect directly to a specified management point that is configured to accept connections over the Internet.

Multiple site systems hosting the management point site server role can be configured with the Windows Network Load Balancing (NLB) Service to provide high availability and can then be designated as the default management point for the site.

This role can be assigned during Configuration Manager 2007 primary site installation or at any time after setup has completed.

Note
By default, management points are automatically registered in WINS and can also be registered in DNS. If you are using WINS to register the default management point as an NLB cluster, you must manually register this in WINS. For more information about registering management points configured as members of an NLB cluster in WINS, see How to Manually Add Configuration Manager Site Information to WINS. For more information about registering management points in DNS, see Determine If You Need to Publish to DNS.

Server locator point

The server locator point stores site information and locates management points for Configuration Manager clients. The primary purpose of the server locator point is to support client deployment. Only one server locator point is required for a Configuration Manager site hierarchy, and this site role is typically installed on the central site server. The server locator point performs the following functions:

  • Provides client site assignment information when this information is not available in Active Directory Domain Services.
  • Locates a management point for clients if this information is not available in Active Directory Domain Services, DNS, or WINS.

This role can be assigned at any time after setup has completed.

Note
By default, server locator points are not automatically registered in WINS. If the Active Directory schema has not been extended for Configuration Manager, you must manually add the server locator point information into WINS. For more information about registering server locator points in WINS, see How to Manually Add Configuration Manager Site Information to WINS.

Reporting point

A reporting point is a site server that hosts the site's reporting Web site. A reporting point obtains report information from its Configuration Manager 2007 site database server. Before you can begin using reports in Configuration Manager, you must enable one or more of your site systems as a reporting point.

This role can be assigned at any time after setup has completed.

Fallback status point

A fallback status point is an optional site system role that receives state messages from Configuration Manager 2007 client computers. State messages are primarily sent to a fallback status point when a client installation or site assignment failure has occurred but are also sent when the client initially installs or assigns to the Configuration Manager 2007 site. The fallback status point also receives state messages from clients when they fail to communicate with their assigned management point. State messages received by the fallback status point are forwarded to the site server and can be reviewed by running client deployment success and failure reports from the Configuration Manager reporting point configured for the site.

The fallback status point site system role can be assigned to multiple site systems within a Configuration Manager 2007 site; however, client computers will send state messages only to their assigned fallback status point. For more information about the fallback status point, see About the Fallback Status Point in Configuration Manager. For more information about assigning a fallback status point to client computers, see How to Assign the Fallback Status Point to Configuration Manager Client Computers.

Feature-Specific Site System Roles

In addition to the basic site system roles, some site system roles are required only when specific Configuration Manager features are used.

Device Management

Site System Description

Device management point

The device management point is the primary point of contact between Configuration Manager 2007 mobile device clients and the site server. Device management points provide mobile device clients with policy. Additionally, device management points receive inventory data, software metering information, and status and state messages from clients.

Mobile device clients are configured with their device management point during installation. Administrators can configure the mobile device client to allow users to change the device management point. For more information about how to enable device management points, see How to Enable a Mobile Device Management Point.

Fallback status point

A fallback status point receives state messages from Configuration Manager 2007 mobile device clients. State messages are primarily sent to a fallback status point when a client installation or site assignment failure has occurred but are also sent when the client initially installs or assigns to the Configuration Manager 2007 site. The fallback status point also receives state messages from mobile device clients when they fail to communicate with their assigned device management point. State messages received by the fallback status point are forwarded to the site server and can be reviewed by running device client deployment success and failure reports from the Configuration Manager reporting point configured for the site.

For more information about the device management feature, see Mobile Device Management in Configuration Manager.

Network Access Protection for Configuration Manager

Site System | Description
System Health Validator point | This site system must be installed in sites where you have a Windows Network Policy Server installed and configured with policies for Network Access Protection to enforce compliance with software updates.

For more information about Network Access Protection for Configuration Manager, see Network Access Protection in Configuration Manager.

Operating System Deployment

Site System | Description
State Migration Point | The state migration point (SMP) is a Configuration Manager 2007 site role that provides a secure location to store user state information before an operating system deployment. You can store the user state on the SMP while the operating system deployment proceeds and then restore the user state to the new computer from the SMP. Each SMP site server can only be a member of one Configuration Manager 2007 site.
PXE Service Point | This site system must be installed to initiate the operating system deployment process for PXE deployments. The PXE service point must be configured to respond to PXE boot requests made by Configuration Manager 2007 clients on the network and then interact with Configuration Manager 2007 infrastructure to determine the appropriate deployment actions to take.

For more information about the Operating System Deployment feature, see Operating System Deployment in Configuration Manager.

Software Distribution

Site System Description

Distribution point

A site system that stores package source files received from a site server performs the distribution point role. Client computers contact distribution points to obtain programs and files after they have received software distribution advertisements. A distribution point can be a Windows Server or a Windows Server share. If you plan to provide a large number of packages to a site's client computers, consider assigning this role to one or more computers other than the site server.

Server distribution point site systems can be BITS-enabled to allow Configuration Manager 2007 clients to throttle network usage during package downloads. To install a BITS-enabled distribution point, IIS must first be installed on the site system computer and BITS-enabled in IIS.

Note
It is not supported for the same computer to be assigned the distribution point site system role for more than one Configuration Manager 2007 site.

This role can be assigned at any time after Configuration Manager Setup has completed.

Note
A distribution point site system role is automatically created during primary or secondary site setup. To install a site without a distribution point site system role, you can use a scripted installation method and specify the DistributionPoint=0 parameter.

Mobile device clients contact distribution points to obtain programs and files after they have received policy indicating content is available.

For more information about enabling distribution point support of mobile devices, see How to Enable Distribution Points to Support Mobile Devices

Branch distribution point

The branch distribution point site system role allows smaller or distributed offices to host a distribution point on an existing client computer without requiring a secondary site to be set up. Branch distribution points provide an option for efficient package distribution to a small office with limited bandwidth. Branch distribution points function like standard distribution points, but can be installed on workstation-class computers and usually have a very limited number of client computers (often 10 or less).

For more information about the software distribution feature, see Software Distribution in Configuration Manager.

Software Updates

Site System Description

Software update point

The software update point site system role is created on a server that has Windows Server Update Services (WSUS) 3.0 installed. The software update point is required before software updates can be synchronized, assessed for compliance on clients, and deployed. There can be multiple site system servers with the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in native mode, an additional active Internet-based software update point can be assigned to a remote site system server that allows communication from only Internet-based client computers.

This role can be assigned at any time after Configuration Manager Setup has completed. For more information about planning for and configuring the software update point, see Planning for the Software Update Point Installation.

For more information about the Software Updates feature, see Software Updates in Configuration Manager.

Out of Band Management

Site System Description

Out of band service point

Applies only to Configuration Manager 2007 SP1.

A site system role that discovers, provisions, and manages desktop computers that have management controllers (such as AMT-based computers). This site system role works in concert with the out of band management component.

This role can be assigned at any time after Configuration Manager Setup has completed. For more information about planning for and configuring the out of band service point, see the following topics:

  • Determine Whether You Should Install the Out of Band Service Point
  • How to Install the Out of Band Service Point

For more information about the out of band management feature, see Out of Band Management in Configuration Manager 2007 SP1.

Asset Intelligence

Site System Description

Asset Intelligence synchronization point

Applies only to Configuration Manager 2007 SP1.

Using this site system role, Microsoft Software Assurance license customers can request on-demand Asset Intelligence catalog synchronization with System Center Online or schedule automatic catalog synchronization to occur.

The Asset Intelligence synchronization point site system role must be installed at the central site of a Configuration Manager 2007 SP1 site hierarchy and on a computer in the same forest as the central site server computer.

For more information about the Asset Intelligence synchronization point site system role, see About the Asset Intelligence Synchronization Point.

SQL Reporting Services

Site System | Description
Reporting services point | Applies only to Configuration Manager 2007 R2. A site system role that is installed on a server running Microsoft SQL Server with the Reporting Services component installed. A reporting services point must be configured in order to use SQL Reporting Services with Configuration Manager 2007 R2.

This role can be configured at any time after Configuration Manager R2 setup has been completed. For more information about the reporting services point site system role, see How to Create a Reporting Services Point for SQL Reporting Services.

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment


Configuration Manager Service Principal Name Requirements

Topic last updated -- August 2007

A Service Principal Name (SPN) is the name by which a client uniquely identifies an instance of a service and allows it to authenticate the account running the service using Kerberos authentication. Kerberos is a mutual authentication mechanism used to verify user or host identity in Windows networks.

Configuration Manager site database servers and management point site systems configured as part of network load balancing (NLB) clusters in mixed mode sites require an SPN to be registered in Active Directory Domain Services to allow clients to authenticate them to perform Configuration Manager processes. Without registering an SPN for these site systems, clients and other site systems will not be able to perform Kerberos authentication and communication may fail.

Note
SQL Server computers configured to use the local system account to run the SQL Server service automatically register an SPN in Active Directory Domain Services.

See Also

Tasks

How to Configure an SPN for SQL Server Site Database Servers
How to Configure an SPN for NLB Management Point Site Systems


Configuration Manager and Network Load Balancing Clusters

Topic last updated -- August 2007

Network Load Balancing (NLB) clusters enable the management of a group of independent servers as a single system for greater scalability, increased availability, and easier manageability. You can use network load balancing to increase the number of clients supported by management point, server locator point, and software update point site systems.

Windows Server 2003 network load balancing supports up to 32 computers, or hosts, running Windows Server 2003 in a single cluster and distributes client requests across the cluster hosts. Hosts can be added or removed without interrupting cluster availability. NLB clusters are particularly useful for ensuring that stateless applications, such as Web pages from a server running Internet Information Services (IIS), are highly available and can be scaled out by adding additional servers as the load increases. The ease with which network load balancing allows you to replace a malfunctioning server or add a new server provides scalability.

Important
Management point site systems configured as part of NLB clusters in Configuration Manager 2007 sites configured to operate in mixed mode require registration of a Service Principal Name (SPN) in Active Directory Domain Services for the user name configured to run the CCM Windows Auth Server Framework Pool IIS application pool to allow mixed mode client approval processes.

See Also

Tasks

How to Configure Network Load Balancing for Configuration Manager Site Systems
How to Configure an SPN for NLB Management Point Site Systems


Configuration Manager Security and Privacy Planning

Microsoft System Center Configuration Manager 2007 security controls are flexible and can be implemented or changed at any time. Several security-related configurations, such as changing default port numbers and using custom Web sites, are easier to implement if they are planned for in advance. Privacy is also an important planning consideration when using Configuration Manager 2007.

Recommended Security Configuration

The following configuration is considered the most secure Configuration Manager 2007 environment possible.

  • Use native mode throughout the hierarchy.
  • Extend the Active Directory schema for Configuration Manager 2007 and enable Active Directory publishing. Configure clients in the same forest so that they can query Active Directory.
  • Use IPsec to secure communications between site systems.

Even if you have already installed Configuration Manager 2007 with a different configuration, you can upgrade to this configuration at any time.

Use native mode

Native mode requires you to upgrade all of your sites and clients to Configuration Manager 2007 and to use certificates from a Public Key Infrastructure (PKI) to authenticate site systems and clients. While it increases administrative overhead, the mutual authentication and encryption between clients and site systems eliminates many attack vectors. For example, in native mode, the management point authenticates the client before accepting inventory information but in mixed mode, the client is not authenticated. For more information, see Choose between Native Mode and Mixed Mode.

Note
In mixed mode, if the check box This site contains only ConfigMgr 2007 clients is selected, only clients that are approved can receive policies containing sensitive data. However if the check box is not selected, then policies containing sensitive data can be sent to any client.

Use schema extensions and Active Directory publishing

Schema extensions are not required to run Configuration Manager 2007, but they do create a more secure environment. You should enable Active Directory Configuration Manager 2007 schema extensions and Configuration Manager 2007 publishing to Active Directory so that management points can publish their certificates and their location in Active Directory. You should also plan your sites so that all clients are in the same forest as the site server; this allows clients in the forest to identify authorized management points from a trustworthy source. You should not use clients in workgroups because they cannot query Active Directory for site information.

Active Directory can also store the public key used for signing intersite data transfer. When the public key changes during a recovery operation, the new key automatically propagates to child and parent sites. If you are upgrading from SMS 2003 you should also upgrade your schema extensions for Configuration Manager 2007. For more information about schema extension, see Decide If You Should Extend the Active Directory Schema.

Use IPsec to secure communications between site systems

Neither native mode nor mixed mode secure the communication channel between the site server and the site systems. If you do not use some method like IPsec to secure these channels, attackers can use various spoofing and man-in-the-middle attacks against site systems. For more information, see Implementing IPsec in Configuration Manager 2007.

Port Planning

Using non-default ports is often beneficial from a security standpoint because it makes it harder for attackers to explore the environment in preparation for an attack. If you are going to use non-default ports, it is easiest to plan for them at the beginning and use them consistently across all sites in the hierarchy, especially if you will support roaming. If you do not deploy clients with the chosen non-default ports, you will have to go back and reconfigure them later.

Custom Web Site Planning

Configuration Manager 2007 allows you to use custom Web sites instead of the default Web site for IIS. While using site systems to host non-Configuration Manager 2007 applications in IIS is not recommended, if you do choose to co-locate applications you should always use a custom Web site. Custom Web sites are a site -wide setting, not a site systems setting; you must configure all site systems in your organization to use custom Web sites.

Account Planning

Configuration Manager 2007 primarily uses the Local System account for most site operations, but there are several optional accounts that can be created and configured in the Configuration Manager 2007 console to perform specific functions. During the planning phase, decide which optional accounts you will need to configure and work with the accounts administrator in your organization to have them created. For more information, see the detailed description of each account in Accounts and Groups in Configuration Manager.

Security Rights Planning

System Center Configuration Manager 2007 grants access to its functionality based on security rights. One part of configuring Configuration Manager 2007 security is creating various security rights so that Configuration Manager 2007 administrators have access to certain functionality and data.

You should determine the roles you will use in your environment and plan to assign the least possible security rights to perform the role. For more information, see Overview of Configuration Manager Object Security and WMI.

Privacy Planning

While configuration management products let you effectively manage large numbers of clients, you must also be aware of ways that this software could impact the privacy of users in your organization. Configuration Manager 2007 includes many tools to gather data and monitor client computers, some of which could raise privacy concerns. Before deploying Configuration Manager 2007, consider your privacy requirements. For more information, see Overview of Configuration Manager Privacy.

Permission Consideration

If you installed a new Configuration Manager 2007 site server, a site reset sets the access control lists (ACLs) back to the original settings. If you upgrade an existing Systems Management Server (SMS) 2003 site, Setup does not change the permissions on the upgraded directories. Also, if you do a site reset of a site that was upgraded from SMS 2003, the site reset does not reset the ACLs on the upgraded directories.

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment
Security and Privacy for Configuration Manager 2007


Configuration Manager Setup Overview

Topic last updated -- November 2007

Before you begin installing Configuration Manager 2007, be sure that your systems meet the supported configurations for installing Configuration Manager 2007. For more information about Configuration Manager 2007 supported configuration requirements, see Configuration Manager Supported Configurations.

It is recommended that you complete the planning and deployment checklists for Configuration Manager 2007 before beginning the installation process to ensure that you are fully prepared to complete the configuration steps during the setup process. For more information about the planning and deployment checklists for Configuration Manager 2007, see Configuration Manager Planning Checklist and Configuration Manager Deployment Checklist.

Important
Installing Configuration Manager in your production environment without proper planning is unlikely to result in a functioning site that meets your business needs and security requirements, and is therefore not recommended.

For more information about setup option planning considerations, see Configuration Manager Single Site Planning and Deployment.

To set up a new Configuration Manager 2007 site, you can use either the Configuration Manager 2007 Setup Wizard or perform an unattended installation using a scripted installation method.

When using the Configuration Manager 2007 Setup Wizard, there are two options for installing new Configuration Manager 2007 sites: simple setup and custom setup. In most cases, simple setup should be used for evaluation purposes only. Custom setup allows greater flexibility in configuring site system and client agent settings. Regardless of the installation option you choose, you can review all of the information that you enter at the Setup Wizard summary page before any changes are made to your system. After you have verified that the setup options are correct, the system will be checked to verify that all installation prerequisites are met. For a complete list of installation prerequisite rules and descriptions, see Setup Prerequisite Checks.

To perform unattended installations of new Configuration Manager 2007 primary or secondary sites and Configuration Manager consoles, you can create an initialization file and use the Setup command /script option. The initialization file supplies the same kind of information that the Setup Wizard prompts for except that there are no default settings. All values must be specified for the setup keys that apply to the type of installation you are using.

Important
It is not supported to change the program files installation directory, site code or site description for the site after Setup has completed. To change the installation directory, site code, or site name, the site must be uninstalled and installed using the new values.

In This Section

Prerequisite Component Update Checker

About the Setup Prerequisite Checker

Simple Setup Overview

Custom Setup Overview

Unattended Setup Overview

Setup Command Line Options

SQL Server Preparation for Setup

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment


Prerequisite Component Update Checker

Topic last updated—November 2007

The Prerequisite Component Update Checker is started during Configuration Manager 2007 Setup to ensure that the latest external component files required for Configuration Manager 2007 client installation are available during Configuration Manager 2007 Setup.

When using the Configuration Manager 2007 Setup Wizard to install new Configuration Manager 2007 sites or to upgrade existing Systems Management Server (SMS) 2003 sites to Configuration Manager 2007, the Prerequisite Component Update Checker is started automatically. In some cases, such as when the planned site system computer does not have Internet access, the Prerequisite Component Update Checker must be started on a different computer with Internet access.

To start the Prerequisite Component Update Checker to download updated client installation prerequisite components, use the Setup command-line option of Setup /download <path>. When downloading prerequisite update files from a different computer, ensure that the download path specified will be accessible to planned site system computers when the Setup Wizard is run and that an alternate path is used to obtain client prerequisite component files.

Important
If you have a custom or manually authenticated firewall that prevents downloading the client component files, you must download the files from a different computer without those restrictions and copy the client component prerequisite files to the alternate path specified during Configuration Manager Setup.

Prerequisite Component Download Options

When the Prerequisite Component Update Checker is started during Configuration Manager Setup, you are prompted to either check for new component updates using the Internet or specify that the updates have already been downloaded and specify the alternate path to the downloaded files.

If the computer that Setup is being run on is connected to the Internet, Setup can check for updated prerequisite components and download them automatically to a path you specify.

If the computer that Setup is being run on is not connected to the Internet or if you have recently downloaded the component updates to an alternate path, you can specify the alternate path to the downloaded files location.

After downloading updated prerequisite component files, you can use the same alternate path to install multiple sites. When installing sites, always verify that the alternate path contains the most recent updates.

Important
To ensure the highest level of functionality and compatibility, you should always download the latest available components before running Configuration Manager Setup.

See Also

Other Resources

Configuration Manager Setup Overview


About the Setup Prerequisite Checker

Topic last updated—November 2007

The Setup Prerequisite Checker is started automatically during Configuration Manager 2007 Setup and is used to verify that required installation prerequisites have been installed before beginning the setup process. You can also use the stand-alone version of the Setup Prerequisite Checker on site systems as a planning tool before beginning Configuration Manager 2007 Setup to ensure successful installation or upgrade processes.

The Setup Prerequisite Checker can be started automatically during Configuration Manager 2007 Setup or directly from the autorun splash screen (splash.hta) located in the root of the installation media. For more information about starting the Setup Prerequisite Checker, see How to Start the Setup Prerequisite Checker.

Using the Setup Prerequisite Checker

The Setup Prerequisite Checker can be used to verify that required setup prerequisites are installed using the following options:

  • Primary site. This option is used to verify that setup prerequisites are installed for new Configuration Manager 2007 primary site installations. This option requires the Microsoft SQL Server name, and the instance name if using a named instance of SQL Server, that will be used to host the site database. If a management point site system role will be installed during Setup, a computer name for the computer that will host the management point site system role can be entered to verify installation prerequisites.
  • Secondary site. This option is used to verify that setup prerequisites are installed for new secondary site installations.
  • Configuration Manager console. This option is used to verify that setup prerequisites are installed for new Configuration Manager console installations.

If Systems Management Server (SMS) 2003 or Configuration Manager 2007 components are already installed, the Setup Prerequisite Checker can be used with the following options to verify that all required Setup prerequisites are installed before beginning the upgrade process:

  • Upgrade. This option is used to verify that setup prerequisites are installed for upgrading primary sites, secondary sites, and SMS 2003 Administrator Consoles or Configuration Manager consoles.
  • All secondary sites. This option is used to verify that upgrade prerequisites are installed on all secondary sites attached to a primary site being upgraded.
    Important
    When using the All secondary sites option and a failure is encountered when checking a secondary site for required prerequisites, all sites evaluated after the failed site will have a failed value stored in their registry and will be unable to upgrade successfully. If this happens, you can either remediate the failures for the sites that failed the prerequisite checking process and re-run the prerequisite checker to properly set all the registry keys or run the prerequisite checker locally on all secondary sites.

See Also

Other Resources

Configuration Manager Setup Overview


Simple Setup Overview

The simple setup installation option installs a Configuration Manager 2007 primary site in mixed mode and configures a single computer to host all the necessary site server roles. In most cases, simple setup should be used for evaluation purposes only. By default, the simple setup option does the following:

  • Installs a primary site.
  • Installs the Configuration Manager 2007 site database on a local SQL Server default instance.
  • Boundaries are not created.
  • Installs and enables the management point and distribution point site server roles on the site server.
  • Enables the Client Push installation method.
  • Common Configuration Manager 2007 client agents are enabled. By default, the following client agents are enabled:
    • Software inventory
    • Hardware inventory
    • Advertised Programs
    • Software update
    • Software metering
    • Desired configuration management
    • Remote tools
  • Enables all discovery methods, except Network Discovery.

See Also

Tasks

How to Deploy a Site Using Simple Setup

Other Resources

Configuration Manager Setup Overview


Custom Setup Overview

The custom setup installation option allows you to customize all of the setup options available depending on the type of installation you have selected. Setup options available when installing Configuration Manager 2007 using custom setup option include the following:

  • Installation of a primary site, secondary site, or Configuration Manager console.
  • Whether to install a primary site in mixed mode or native mode.
  • A custom Configuration Manager 2007 installation directory.
  • The Configuration Manager 2007 client agents to enable for the site. By default, the following client agents are enabled:
    • Software inventory
    • Hardware inventory
    • Advertised Programs
    • Software update
    • Software metering
    • Desired configuration management
    • Remote tools
  • SQL Server name to host the site database or SQL Server named instance to host the site database for a SQL Server cluster.
  • The location in which to install the provider (site server, SQL Server, or other computer).
Important
It is not supported to install the SMS Provider on a virtual SQL Server cluster instance.

  • Whether or not to install a management point site server role. If you choose to install a management point, you can also enter the location for the management point site server role installation (either local or remote).
  • Ports that clients will use to communicate with Configuration Manager 2007 site systems.
  • A distribution point will automatically be created on the site server during Configuration Manager 2007 Setup.
Note
When a Configuration Manager 2007 site is installed using custom settings, a default boundary is not created.

See Also

Tasks

How to Deploy a Site Using Custom Setup

Other Resources

Configuration Manager Setup Overview


Unattended Setup Overview

Topic last updated—January 2008

You can run Configuration Manager Setup unattended by supplying setup.exe with an initialization file using the /script setup command-line option. Unattended setup is supported only for new installations of Microsoft System Center Configuration Manager 2007 primary sites, secondary sites, and Configuration Manager consoles.

To use the /script setup command-line option, you must create an initialization file and specify the initialization file name after the /script setup command-line option. The name of the file is unimportant as long as it has the .ini file name extension. When referencing the setup initialization file from the command line, you must give the full path to the file. For example, if your setup initialization file is named setup.ini and it is stored in the C:\setup directory, your command line would be:

setup /script c:\setup\setup.ini.

The setup initialization file supplies the same kind of information that the Configuration Manager Setup Wizard prompts for during attended installations, except that there are no default settings; all values must be specified for the setup keys that apply to the type of installation you are performing.

Note
This document describes how to use a separate instruction file to automate Configuration Manager 2007 Setup. For information about command-line options available when running Configuration Manager 2007 Setup, see Setup Command Line Options.

The scripted installation initialization file contains section names, key names, and values. Required section key names vary depending on the installation type you are scripting. The order of the keys within sections, and the order of sections within the file, is not important. The keys are not case sensitive; some data is case sensitive as indicated in the following tables. When supplying values for keys, the name of the key should be followed by an equals sign (=) and the value for the key.

The following tables describe each of the setup initialization file keys, their corresponding values, whether or not they are required, which type of installation they are used for, and a short description of the key:

For examples of unattended Setup initialization files, see Scripted Installation Examples.

Unattended Setup Initialization File Keys

Unattended Setup Initialization File Keys for the [Identification] Section

Key Name | Required | Values | Installation Type | Description
Action | Yes | InstallPrimarySite | Primary site | Installs a primary site
 |  | InstallAdminUI | InstallAdminUI | Installs a Configuration Manager console
 |  | InstallSecondarySite | Secondary site | Installs a secondary site

Unattended Setup Initialization File Keys for the [Options] Section

Key Name Required Values Installation Type Description

ProductID

Yes

Primary site

ConfigMgr console

xxxxx-xxxxx-xxxxx-xxxxx-xxxxx format.

PrerequisiteComp

Yes

0 or 1 (0 for no, 1 for yes)

Primary site

Secondary site

Indicates whether or not updated client prerequisite files have already been downloaded.

PrerequisitePath

Yes

<path to files>

Primary site

Secondary site

Path to either the location of pre-downloaded updated client prerequisite files or where to store files to be downloaded.

SiteCode

Yes

Primary site

Secondary site

Three alpha-numeric characters that will uniquely identify the site in your hierarchy.

SiteName

Yes

Primary site

Secondary site

Description for this site.

ParentSiteCode

Yes

Secondary site

ConfigMgr console

Site code of the parent site of the secondary site to be installed.

ParentSiteServer

Yes

Secondary site

Server name of the parent site of the secondary site to be installed.

AddressType

Yes

MS_ASYNC_RAS

MS_ISDN_RAS

MS_LAN

MS_SNA_RAS

MS_X25_RAS

Secondary site

Specifies the type of address to be used as the default address to the parent site.

LanUser

No

Secondary site

The account name for the Standard Sender account to be used at this site.

LanUserPassword

No

Secondary site

The password for the account specified for LanUser.

RasUser

No

Secondary site

The account name for the RAS Sender account to be used at this site.

RasUserDomain

No

Secondary site, if installing a RAS Sender

The domain in which the RasUser account was created.

RasUserPassword

No

Secondary site, if installing a RAS Sender

The password for the account specified for RasUser.

RasPhoneBook

No

Secondary site, if installing a RAS Sender

A RAS phone book name for the RAS Sender to use.

SMSInstallDir

Yes

Primary site

Secondary site

ConfigMgr console

Directory to install the Configuration Manager program files.

ManagementPoint

No1

Primary site

Server name of the computer to be used as the default management point for this site.

Important
The server name must be in upper case.

DistributionPoint

No

0 or 1 (0 for no, 1 for yes)

Primary site

Secondary site

Specifies whether or not to install a distribution point on the site server during setup.

SDKServer

Yes

Primary site

Computer to install the SMS Provider on for primary site installations and the computer name hosting the SMS Provider for ConfigMgr console installations.

Important
The server name must be in upper case.

ClientAgents2

No

SINV

Primary site

Software inventory client agent.

No

HINV

Primary site

Hardware inventory client agent.

No

ADPROG

Primary site

Advertised programs client agent.

No

NAP

Primary site

Network Access Protection (NAP) client agent.

No

SUM

Primary site

Software update management client agent.

No

SWM

Primary site

Software metering client agent.

No

DCM

Primary site

Desired configuration management client agent.

No

RT

Primary site

Remote tools client agent.

SiteSecurityMode

No3

Native

Primary site

Installs the site in native mode.

No

Mixed

Primary site

Installs the site in mixed mode.

Port

No

[user defined custom port]

Primary site

Specifies if the site will use a custom TCP/IP port. If the SiteSecurityMode option is set to Native, the port specified will be set to https. If SiteSecurityMode option is set to Mixed, the port specified will be set to http.

SiteServerSignCert

Yes4

Primary site

Site server signing certificate thumbprint (spaces must be removed if you are copy and pasting the thumbprint from the certificate properties).

1 If this setting is not provided for unattended primary site installations, the site will not have a management point installed when setup completes and will be unable to manage clients until a management point is installed.

2If the ClientAgents key is omitted, default Setup client agent settings are used (all client agents are enabled except for NAP). This setting is used to enable less client agents than are enabled by default as part of Configuration Manager Setup. When using the ClientAgents key to enable multiple client agent settings during an unattended Setup, each client agent value should be separated by a comma. For example, ClientAgents=SINV,HINV,ADPROG,NAP,SUM,SWM,DCM,RT.

3 The site will be installed in mixed mode if this key is not specified.

4 This key is required only if the SiteSecurityMode key is set to native mode.

Unattended Setup Initialization File Keys for the [SQLConfigOptions] Section

Key Name Required Values Installation Type Description

SQLServerName

Yes

Primary site

The name of the server, or clustered instance name, running SQL Server that will host the site database.

Important
The server name must be in upper case.

CreateSQLDevice

Yes

0 or 1 (0 for no, 1 for yes)

Primary site

Indicates whether or not Setup should create the database.

DatabaseName

Yes

<site database name>

Primary site

The name of the SQL Server database to create or use to install the primary site database.

See Also

Tasks

How to Deploy a Site Using Scripted Installation Methods

Concepts

Setup Command Line Options

Other Resources

Scripted Installation Examples
Configuration Manager Setup Overview


Setup Command Line Options

Topic Last Updated—August 2008

There are many options available for running Configuration Manager 2007 Setup.exe from the command line. These options can be used to test a site's ability to be upgraded, perform an unattended upgrade or site reset, or allow setup to use an initialization file for performing new, unattended installations.

Note
This document describes using command-line options for Setup.exe. For information about using setup initialization files for performing unattended installations, see Unattended Setup Overview.

Setup Command Line Options

Command-Line Option Description

/TRACING:OFF

Disables logging of setup actions.

/NODISKCHECK

Disables verification of disk space requirement checking.

/UPGRADE

Performs an unattended upgrade. When using the /UPGRADE command, you must also type the product key for the Configuration Manager 2007 installation in the format:

Setup /UPGRADE xxxxx-xxxxx-xxxxx-xxxxx-xxxxx

Important
When using the /UPGRADE command line option to upgrade an SMS 2003 primary site with the SMS 2003 Inventory Tool for Microsoft Updates (ITMU) installed, you should not also use the /HIDDEN or /NOUSERINPUT command line options. Using these options with the /UPGRADE command line option might cause the Inventory Tool for Microsoft Updates upgrade to fail. For more information, see About the Inventory Tool for Microsoft Updates.

/DEINSTALL

Uninstalls the site.

/DONTSTARTSITECOMP

Installs a site, but does not start the Site Component Manager service. This will cause the site to be installed, but not active.

/NOUSERINPUT

Disables user input, but displays the Setup Wizard interface.

/NODEFAULTCOLL

Disables the creation of Configuration Manager default collections except for the All Systems collection.

/ALLCLIENTOPTIONSON

Enables all client agents.

/RESETSITE

Performs a site reset by resetting the database and service accounts for the site.

/HIDDEN

Does not display the Setup Wizard interface. This command-line option should be used with the /SCRIPT option.

/TESTDBUPGRADE

Performs testing on the site database to ensure that it is capable of an upgrade. It is recommended that you run this command-line option on a backup of the site database instead of on your production site database itself.

/SCRIPT

Used to perform unattended installations. A setup initialization file is required when using the /SCRIPT option.

/ICPUNATTENDED

Used for International Client Pack unattended setup.

Prerequisite Check Command Line Options Available When Using Setup.exe from the Command Line

Command-Line Option Description

/PREREQ

The command-line option /PREREQ is only used by itself when upgrading existing installations. The machine being checked for prerequisites must already have a primary or secondary site or the SMS 2003 Administrator Console already installed.

/PREREQ /PRI /SQL <SQL Server name or SQL Server named instance name> /SDK <SMS Provider machine name> /MP <FQDN of management point computer>

Used together, these command-line options do the following:

  • Run the prerequisite checker on the computer the command is run on (/PREREQ).
  • Check for primary site installation prerequisites on the computer the /PRI command is run on (/PRI).
  • Check for site database installation prerequisites on the computer name following the /SQL command-line option.
    Note
    The SQL Server instance name is required if not using the default instance. When checking for site database installation prerequisites for a SQL Server named instance, the command line option should be similar to /SQL <machine name>\<instance name>.

  • Check for connectivity between the SMS Provider computer and the SQL Server site database computer (/SDK).
  • Check for management point installation prerequisites on the computer name specified for management point installation following the /MP command-line option (this is optional). When using the /MP command line option, the FQDN of the management point computer should be used.

/PREREQ /SEC

Used together, these command line options will check for secondary site installation prerequisites on the computer the command is run on.

/PREREQ /ALLSEC

Used together, these command line options will check all secondary child sites of the primary site computer the command is run on for required Setup prerequisites.

Important
When using the All secondary sites option, and a failure is encountered when checking a secondary site for required prerequisites, all sites evaluated after the failed site will have a failed value stored in their registry and will be unable to upgrade successfully. If this happens, you can either remediate the failures for the sites that failed the prerequisite checking process and re-run the prerequisite checker to properly set all the registry keys or run the prerequisite checker locally on all secondary sites.

/PREREQ /UI

Used together, these command line options will check for Configuration Manager console installation prerequisites on the computer the command is run on.

See Also

Concepts

Unattended Setup Overview

Other Resources

Configuration Manager Setup Overview


SQL Server Preparation for Setup

Topic last updated -- January 2008

Configuration Manager 2007 primary sites must have access to Microsoft SQL Server to host the site database. You can install SQL Server on the computer that is used as the primary site server or, to separate the data input/output (I/O) load and Configuration Manager 2007 server resource demands, you can install SQL Server on a different server in the site. Configuration Manager 2007 site databases must be installed on a supported version of SQL Server. For more information about Configuration Manager 2007 supported configurations, see Prerequisites for Installing Configuration Manager.

Important
If installing the site database on a remote SQL Server computer, the logged on user and site server machine account require administrative rights to the remote SQL Server computer.

If installing the site database on a SQL Server cluster instance, the logged on user and site server machine account require administrative rights to all SQL Server cluster instance node computers.

SQL Server Setup Considerations

When installing SQL Server 2005 in preparation to host the site database, you should consider the following information to ensure proper site installation and function:

  • The only SQL Server component required to host the Configuration Manager 2007 site database is SQL Server Database Services. Installing the optional SQL Server Workstation components allows the SQL Server instance to be managed from the site database server computer. These components are not necessary if the site database will be managed from a different computer with the Workstation components installed.
  • You can install either a default instance or named instance during SQL Server Setup to host the site database.
  • If you configure a domain user account to run the SQL Server service instead of the local system account (SQL Server best practice), a Service Principal Name (SPN) must be configured for the domain user account in Active Directory Domain Services. For more information about configuring a SQL Server service account SPN in Active Directory Domain Services, see How to Configure an SPN for SQL Server Site Database Servers.
  • SQL Server Windows Authentication Mode (default) is recommended because Configuration Manager site systems require Windows authentication to SQL Server hosting the site database. Because both authentication methods that can be selected when installing SQL Server 2005 support Windows authentication, either can be used.
  • Dictionary order, case-insensitive, for use with 1252 Character Set (default) should be selected as the SQL Server collation if possible. While using a case-sensitive SQL Server collation is supported, it is recommended to use a case-insensitive collation to avoid any possible future case sensitivity issues during site database operations.
    Important
    SQL Server Service Pack 2 must be installed for the SQL Server instance that will host the site database before beginning Configuration Manager 2007 Setup.

Required Communication Protocols

The TCP/IP protocol is required for SQL Server network communications to allow Kerberos authentication. The named pipes protocol is not required for Configuration Manager 2007 site database operations and should only be used to troubleshoot any Kerberos authentication issues encountered when using TCP/IP protocol communication.

By default, SQL Server uses TCP (not UDP) port 1433 to listen on TCP/IP. To change the port, or network communication protocol used, start the SQL Server Configuration Manager, and click Protocols for <instance name>.

Site Database Creation

Configuration Manager 2007 Setup automatically creates the site database, using SQL Server defaults, on the SQL Server computer and instance specified during setup. If the configured SQL Server default settings are not sufficient to manage your site database, it is recommended that you pre-create the database and set the required settings. If you are using a remote SQL Server to host the site database, you should ensure that the site server's computer account has sufficient privileges on the SQL Server computer to create the site database before beginning the installation process.

Performance Considerations

Typically, performance is better if the Configuration Manager 2007 site server and the site database are installed on the same computer. However, if the intervening network connection is a high-availability, high-bandwidth network connection you might be able to install SQL Server on a remote server from the Configuration Manager 2007 site server. You might also consider installing a second network adapter in both the site server and the computer running SQL Server and then dedicating this second card for communications between the site server and the computer running SQL Server.

File Format Considerations

Although SQL Server can be installed on a FAT32 formatted partition, it is recommended that the site database be installed on an NTFS formatted partition. Installing the site database on a FAT32 formatted partition does not allow the proper file and folder permissions to be applied to the site's database, and they are required to secure the site's database information.

SQL Server Named Instance Support

Configuration Manager 2007 supports hosting the site database on the default instance or a named instance of SQL Server. The instance name can be entered during Configuration Manager 2007 installation for primary sites.

SQL Server Cluster Support

Configuration Manager 2007 supports hosting the site database on a clustered SQL Server instance configured for active/passive or failover support. The SQL Cluster must configured before beginning Configuration Manager 2007 setup. A clustered SQL Server instance can be entered during Configuration Manager 2007 installation for primary sites.

SQL Server Replication Support

SQL Server database replication can be used to improve performance on the Configuration Manager 2007 site database server. If you plan to implement SQL Server database replication, ensure that you plan to deploy a server that is running SQL Server to host the replicated tables. You can configure a server locator point or management point to connect to the SQL Server computer hosting the site database replica instead of the Configuration Manager 2007 site database server. For more information about configuring SQL Server database replication, see How to Configure SQL Server Site Database Replication.

See Also

Other Resources

Configuration Manager Setup Overview
Configuration Manager Site Database Overview


Configuration Manager Post Setup Considerations

After installing a new Configuration Manager 2007 site, it should be checked for general health and configured for daily operations.

Post setup tasks include:

Review Site Status

Site system and site component status should be reviewed to ensure that the site, and its site systems, has been properly upgraded to Configuration Manager 2007.

After upgrading a site to Configuration Manager 2007, some system components may report initialization errors. This is caused by Site Component Manager reinstallation during the upgrade process. These initialization errors are temporary and will be resolved during the next site component status summarization cycle.

Note
To manually refresh site system status before the next site component status summarization cycle occurs, you can manually stop and restart SMS_SITE_SYSTEM_STATUS_SUMMARIZER.

Check Site Database Integrity

Using a SQL Server backup of the site database should be checked using SQL Server database consistency checks to ensure the site database is operating successfully. The SQL Server 2005 DBCC CHECKDB stored procedure can be used to check the logical and physical integrity of all the objects in the site database. The DBCC CHECKDB stored procedure, performs the following operations:

  • Runs DBCC CHECKALLOC on the database.
  • Runs DBCC CHECKTABLE on every table and view in the database.
  • Runs DBCC CHECKCATALOG on the database.
  • Validates the contents of every indexed view in the database.
  • Validates the Service Broker data in the database.

Configure Site Settings

In general, perform post-upgrade tasks in the following order:

  • Assign new site system roles
  • Configure site maintenance tasks
  • Configure boundaries
  • Configure discovery methods
  • Configure client agent settings and schedules
  • Configure client installation methods

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment


Configuration Manager Planning and Deployment Flowcharts

The flow charts in this section can be used to determine the required Setup steps to install a Configuration Manager 2007 site or Configuration Manager 2007 console.

In This Section

Flow Chart: Installing a Configuration Manager Site

This flow chart can be used to determine the Setup steps required to install a Configuration Manager 2007 primary or secondary site that will operate in either native mode or mixed mode.

Flow Chart: Installing a Configuration Manager Console

This flow chart can be used to determine the Setup steps required to install a Configuration Manager 2007 console.

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment


Flow Chart: Installing a Configuration Manager Site

This flow chart can be used to determine the Setup steps required to install a Configuration Manager 2007 primary or secondary site that will operate in either native mode or mixed mode.

Install ConfigMgr Site Diagram

See Also

Concepts

Configuration Manager Planning and Deployment Flowcharts


Flow Chart: Installing a Configuration Manager Console

This flow chart can be used to determine the Setup steps required to install a Configuration Manager 2007 console.

Install ConfigMgr Console Diagram

See Also

Concepts

Configuration Manager Planning and Deployment Flowcharts


Configuration Manager Tasks for Planning a Single Site

When planning to deploy a Configuration Manager 2007 site, you should carefully consider the following planning tasks in this section.

In This Section

Decide If You Should Have Multiple Sites in Your Hierarchy

Helps you decide if you should plan for multiple sites in your Configuration Manager hierarchy.

Decide If You Should Extend the Active Directory Schema

Helps you decide if you should extend the Active Directory schema for Configuration Manager.

Decide If You Should Upgrade or Perform a New Installation

Helps you decide if you should upgrade an existing SMS 2003 site or perform a new installation of Configuration Manager.

Choose Between Simple or Custom Setup

Helps you choose between simple or custom Configuration Manager Setup.

Determine If You Will Use a Custom Web Site

Helps you decide if you should use a custom Web site for Configuration Manager sites.

Determine If You Will Use FQDN Server Names

Helps you to determine if you should use fully qualified domain names (FQDNs) for site system servers.

Choose Configuration Manager Boundaries

Helps you choose boundaries for Configuration Manager sites.

Choose a Configuration Manager Client Installation Method

Helps you choose a client installation method for Configuration Manager client installation.

Choose Which Configuration Manager Features You Need

Help you to determine which features you require in Configuration Manager.

Choose Between Local and Remote Configuration Manager Site Database Servers

Helps you choose where to install the Configuration Manager site database.

Choose the SMS Provider Installation Location

Helps you choose where to install the SMS Provider for a Configuration Manager site.

Configuring DNS for Configuration Manager Site System Roles

Provides guidance on how to configure DNS for site systems on the intranet, or for site systems that support Internet-based client management.

Determine If You Need to Publish to DNS

Helps you determine if you should publish the default management point to DNS.

Choose between Native Mode and Mixed Mode

Helps you determine which site mode you should configure for the site.

Determine If You Can Use Your Existing PKI (Native Mode)

Helps you determine if you can use your existing public key infrastructure (PKI) when configuring a site for native mode.

Determine If You Need to Specify Client Certificate Settings (Native Mode)

Helps you determine if you need to specify client certificate settings for native mode, or whether you can use the defaults.

Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)

Provides guidance on the different options for deploying the site server signing certificate to clients when the site is configured for native mode.

Renewing or Changing the Site Server Signing Certificate

Provides information on whether you need to take additional steps when the site server signing certificate is renewed or changed in a native mode site.

Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)

Provides guidance on whether you should configure native mode clients to use certificate revocation checking (CRL).

Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode)

Provides guidance on whether you should configure a certificate trust list with IIS when the site is configured for native mode.

Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)

Provides guidance on whether you should enable the option for HTTP communication on a native mode site.

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment


Decide If You Should Have Multiple Sites in Your Hierarchy

Configuration Manager 2007 site hierarchies created by using multiple sites provide a means of extending and scaling Configuration Manager 2007 support across a wide variety of organizational structures. A single site is the easiest to configure and manage, but there are circumstances in which it is beneficial to create a hierarchy of Configuration Manager 2007 sites. Consider using multiple sites to support optimal data flow and ease of administration.

It is important during the design phase to consider your need for additional sites. These needs might belong to one of the following categories:

  • Network performance
  • Number of resources
  • Features required by users
  • Site mode considerations
  • International considerations
  • Number of sites
  • Corporate structure
  • Active Directory considerations

Network Performance with Clients

Slow network connectivity between the site server and some clients might indicate a need to set up and manage those clients in their own site if the group of clients is well-connected.

Number of Resources

If there are more resources than can be supported by a single site using the Configuration Manager 2007 features you have chosen, consider creating additional sites.

Site Mode Considerations

Some Configuration Manager 2007 features require that the site is configured for native mode while most only require mixed mode site operations. If you are planning on supporting Internet-based clients, you must plan for native mode sites. For more information about site modes, see Configuration Manager Site Modes.

Important
Sites configured to operate in native mode cannot be child sites of mixed mode sites; however, mixed mode sites can report to sites operating in native mode. If the site hierarchy will contain sites operating in different site modes, the central site must be configured for native mode.

Features Required by Users

You might have groups of users that require different Configuration Manager 2007 features or client agent settings. For example, if your IT administrators need remote access to servers residing in a locked room and you want to disable the permission-required feature of the remote tools client agent for just those computers, you might assign those servers to a separate site. For more information about Configuration Manager 2007 features, see Configuration Manager 2007 Features.

International Considerations

You might need to install an international version of Configuration Manager 2007 in the same hierarchy that contains an English language or other localized version of Configuration Manager 2007. For more information about international considerations when deploying Configuration Manager 2007 sites, see Deploying Configuration Manager Sites in International and Multi-Language Environments.

Number of Sites

If a hierarchy plan becomes large, you might need to add an additional tier of primary sites to help manage and organize the large number of sites that would otherwise report to the central site.

If, in your test lab environment, the site server response in a parent site degrades to unacceptable levels, you might consider creating additional levels in the hierarchy. The main factors to consider before adding sites in the hierarchy are server performance, the number of clients per site, and administrative requirements. Remember that the more tiers you have in the hierarchy, the longer it takes for site-to-site communication information to traverse the hierarchy. For more information about Configuration Manager 2007 site-to-site communications, see Configuration Manager Site to Site Communications.

Corporate Structure

In some cases, an organization's policies can play a role in site definition. There might be multiple system administration groups within an organization that require administration of their own resources.

Active Directory Considerations

Your existing Active Directory forest or domain model might dictate the use of certain discovery methods, or you might choose to organize the hierarchy design (although single sites can span multiple domains). For more information about Configuration Manager 2007 in multiple Active Directory forests, see Configuration Manager in Multiple Active Directory Forests.

See Also

Concepts

Configuration Manager Tasks for Planning a Single Site


Decide If You Should Extend the Active Directory Schema

Extending the Active Directory schema for Configuration Manager 2007 allows clients to retrieve many types of information related to Configuration Manager from a trusted source. In some cases, there are workarounds for retrieving the necessary information if the Active Directory schema is not extended, but they are all less secure than querying Active Directory. The best practice for configuring a secure site is to always extend the Active Directory schema.

Additionally, not extending the schema for features where it is recommended might incur significant workload on other administrators who will need to create and maintain the workaround solutions such as logon scripts and Group Policy objects (GPO) for systems and users in your organization.

Note
Extending the schema for Configuration Manager does not automatically publish site information to Active Directory Domain Services.

Using SMS 2003 Active Directory Schema Extensions for Configuration Manager Sites

It is supported to deploy Configuration Manager 2007 sites using SMS 2003 Active Directory schema extensions. There are important considerations when deciding whether or not to extend the Active Directory schema for Configuration Manager 2007. Even if the Configuration Manager 2007 site is publishing site data to Active Directory Domain Services, the required Active Directory schema attributes to store the published data will not exist in some cases if the Active Directory schema has only been extended for SMS 2003.

If the Active Directory schema has been extended for SMS 2003, but not for Configuration Manager, the following limitations apply:

  • A Configuration Manager 2007 server locator point must be used to allow clients to verify assigned site compatibility to complete client assignment. Clients can automatically locate a server locator point through Active Directory Domain Services if the schema is extended for SMS 2003.
  • Because Network Access Protection for Configuration Manager requires Configuration Manager 2007 Active Directory schema extensions, this feature is unsupported for sites using SMS 2003 Active Directory schema extensions.
  • Site mode changes require manual workarounds on clients.
  • Client communication port changes require manual workarounds.
  • The management point dNSHostName attribute is no longer published to Active Directory Domain Services.

Feature and Function Considerations for Extending the Active Directory Schema for Configuration Manager

The following table lists the specific Configuration Manager 2007 features or functions that use Active Directory schema extensions, and any related workarounds if the schema is not extended for Configuration Manager 2007.

Feature or function Schema extension requirement Requirement details

Client installation and site assignment

Recommended

Requirement: If the Active Directory schema has not been extended for Configuration Manager, client installation using Ccmsetup.exe will not be able to automatically retrieve client deployment parameters from Active Directory Domain Services.

Workaround: Provide client installation properties using CCMSetup installation command line options. For more information, see About Configuration Manager Client Installation Properties.

Workaround: A Configuration Manager 2007 server locator point that is published to Active Directory Domain Services using SMS 2003 schema extensions can be automatically located by Configuration Manager 2007 clients if they belong to the same Active Directory forest.

Workaround: Provide server locator point information using the client.msi property SMSSLP=<server locator point name> on the CCMSetup command line during client installation. For more information, see About Configuration Manager Client Installation Properties.

Workaround: Publish the management point in DNS, and publish the server locator point in WINS. For more information, see Configuration Manager and Service Location (Site Information and Management Points).

Site mode setting, and related settings such as client certificate selection and CRL checking

Recommended

Requirement: If the Active Directory schema has not been extended for Configuration Manager, site mode information and client settings related to native mode configuration cannot be published to Active Directory Domain Services.

Workaround: Use CCMSetup.exe client installation command line properties, or client push installation.

Port configuration for client-to-server communication.

Recommended

Requirement: If the Active Directory schema has not been extended for Configuration Manager, clients will not be able to communicate with site systems if the default communication port is changed after client installation.

Workaround: Reinstall all affected clients or deploy a script to manually change the ports used by clients to communicate with site systems within the site.

Global roaming

Required

Requirement: If the Active Directory schema has not been extended for Configuration Manager or SMS 2003, a roaming client cannot request content for advertisements and software updates from resident management points. This scenario produces additional network traffic to request content location from the client's default management point, and the client will not be able to locate content from sibling sites in the hierarchy, or sites that are higher in the hierarchy than the client's assigned site. For more information about client behavior when roaming, see About Client Roaming in Configuration Manager.

Workaround: None.

Network Access Protection (NAP) for Configuration Manager

Required

Requirement: If the Active Directory schema has not been extended for Configuration Manager, sites enabled for Network Access Protection will be unable to publish Configuration Manager health state references to Active Directory Domain Services. If health state references are not published to Active Directory Domain Servers, the System Health Validator point is unable to validate client statements of health.

Workaround: None.

Secure key exchange between sites1

Recommended

Requirement: If the Active Directory schema has not been extended for Configuration Manager, sites configured to require secure key exchange will be unable to automatically exchange public keys to enable site-to-site communication.

Note
Secure key exchange between Configuration Manager sites is enabled by default.1

Workaround: Manually exchange the parent and child site’s public keys before attaching a child site using the hierarchy maintenance tool (Preinst.exe). For more information about the hierarchy maintenance tool see Hierarchy Maintenance Tool (Preinst.exe).

Verifying a trusted management point

Recommended

Requirement: If Active Directory schema has not been extended for Configuration Manager, clients must use the trusted root key to establish trust with a site. Unless clients have been pre-provisioned with the trusted root key, they will trust the first management point they communicate with.

Workaround: Pre-provision the clients with the trusted root key. For more information, see How to Manage the Trusted Root Key in Configuration Manager.

Workaround: Use native mode. In native mode, the management point certificate must still be signed by the trusted root key at the central site, but the management point uses a PKI-issued certificate. As long as the PKI has not been compromised, the client can trust the first management point it contacts that has a valid server authentication certificate. For more information about the PKI certificate requirements for native mode, see Certificate Requirements for Native Mode.

Recovering from the failure of a central site server hosting the management point role

Recommended

Requirement: If Active Directory schema has not been extended for Configuration Manager, and if clients report to a central site server that also functions as the management point for the site, clients have no way to automatically establish trust with the site after a new central site server and management point is restored.

Workaround: Remove the trusted root key from every client in the site and re-provision it. For more information, see How to Manage the Trusted Root Key in Configuration Manager.

Workaround: Move the management point role to a different server. As long as the clients in the central site lose only the management point or only the central site server, they can re-establish the trust relationship. For more information, see About the Trusted Root Key.

1 By default, Configuration Manager primary sites will not accept child site connections unless the public key of the child site is known to the parent site or published in Active Directory Domain Services. However, in an upgrade scenario, Configuration Manager Setup will not change the site’s original secure key exchange settings. Another method to allow child sites to attach without requiring schema extensions is to not require secure key exchange between sites, but this is not recommended because it would allow any rogue child site to attach to that site and start passing up untrusted data.

See Also

Concepts

About Configuration Manager Client Installation Properties Published to Active Directory Domain Services
About the Secure Key Exchange Parameters
Configuration Manager and Service Location (Site Information and Management Points)

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


Decide If You Should Upgrade or Perform a New Installation

There are two deployment paths that you can take to deploy Configuration Manager sites: a new installation of Configuration Manager 2007 or an upgrade of an existing SMS 2003 installation. There are two typical upgrade scenarios: an in-place upgrade or a side-by-side upgrade. These deployment paths are designed to be flexible. Except for certain explicit cases, you can apply them to any portion of your Configuration Manager 2007 hierarchy in addition to the hierarchy as a whole.

New deployment

This scenario represents a new installation of Configuration Manager 2007 in an organization where no previous SMS deployment exists or where you plan to remove any previous installations of SMS. Use this scenario, if the following conditions apply:

  • You do not have to consider any existing SMS 2003 hierarchy.
  • You can develop and implement a new Configuration Manager 2007 site hierarchy.

It is still important to evaluate the existing environment properly and design the Configuration Manager 2007 hierarchy appropriately.

In-place upgrade of SMS 2003

This scenario represents an upgrade of an existing SMS 2003 hierarchy. Use this scenario, if you plan to do the following:

  • Maintain the structure of the existing SMS hierarchy.
  • Maintain the existing distribution point roles and SMS site boundaries.
  • Have Configuration Manager 2007 clients remain assigned to their current sites.

In this scenario, you must consider whether a new Configuration Manager 2007 site can manage your current SMS client computers. It might be that Configuration Manager 2007 cannot support some of your existing client computers. In this case, you might choose to indefinitely maintain an SMS 2003 site—called a holding site—to support those clients. Consequently, you must also be aware of any interoperability issues between the SMS 2003 site and the Configuration Manager 2007 site that can affect your Configuration Manager 2007 hierarchy.

Side-by-side upgrade of SMS 2003

This scenario represents an implementation of a new Configuration Manager 2007 hierarchy that you plan to migrate existing SMS clients to. You can choose to implement a side-by-side upgrade to do the following:

  • Use new or updated server hardware.
  • Reflect changes that have been made in your organizational structure.
  • Compartmentalize the usage of different Configuration Manager 2007 features (for example, managing mobile clients in a Configuration Manager 2007 site separate from that which is managing desktop clients).
  • Reduce the overall number of sites in your hierarchy.
  • Maintain a functioning SMS site and managed clients while rolling out a new Configuration Manager 2007 infrastructure.

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Choose Between Simple or Custom Setup

Two options are available when installing new sites using Configuration Manager 2007 Setup:

  • Simple setup
  • Custom setup

Simple Setup

The simple setup installation option installs a Configuration Manager 2007 primary site in either mixed or native mode and configures a single computer to host all the necessary site server roles. In most cases, simple setup should be used for evaluation purposes only. For more information about simple setup, see Simple Setup Overview.

Custom Setup

Custom setup allows greater flexibility in configuring site system and client agent settings. For more information about custom setup, see Custom Setup Overview.

Default Setup Installation Behavior

The following table describes which Configuration Manager 2007 software components are available with each setup option. This information can help you plan which setup method to use.

Component | Simple primary site installation | Custom primary site installation | Secondary site installation | Configuration Manager console installation
Site Server | Installed | Installed | Installed | Not available
Configuration Manager console | Installed | Installed | Available | Installed
Local SQL Server database | Installed | Available | Not available | Not available
Remote SQL Server database | Not available | Available | Not available | Not available
Clustered SQL Server database | Not available | Available | Not available | Not available
Local management point | Installed | Available | Not available | Not available
Remote management point | Not available | Available | Not available | Not available
Remote provider location | Not available | Available | Not available | Not available
Distribution point | Installed | Installed | Installed | Not available

See Also

Other Resources

Configuration Manager Setup Overview


Determine If You Will Use a Custom Web Site

Configuration Manager 2007 sites can be configured to use custom Web sites for client to site system communications for interoperability with other server services installed on Configuration Manager site systems that require Internet Information Services (IIS).

It is important to decide if custom Web sites will be implemented during the deployment of Configuration Manager 2007 sites early in the planning stages. The use of a custom Web site is a sitewide operation and requires the manual creation of a custom Web site on every site system within the site that requires IIS for normal operations. Because Configuration Manager 2007 clients can roam from site to site, it may also be necessary to implement custom Web sites for every site in the hierarchy.

Custom Web Site Considerations

The following table lists the pros and cons of using a custom Web site:

Pro Con
  • Using a custom Web site would be beneficial if there are site systems within the site that also host other server services requiring IIS and require the use of the default Web site, such as Microsoft Windows® SharePoint® Services.
  • By creating a custom Web site for Configuration Manager 2007 use and setting it to accept client connections on the port that you specify for client communications, you can allow other applications to continue to function using the default Web site. For information about which Configuration Manager 2007 site systems require IIS, see Configuration Manager Supported Configurations.
    Important
    Using Configuration Manager site systems to run additional applications increases the attack surface on those site systems and is not recommended. The best practice for Configuration Manager site systems requiring IIS is to use a server solely dedicated to providing Configuration Manager services.
  • Configuring a custom Web site is a sitewide operation. If you choose to use a custom Web site, custom Web sites should be implemented at every site in the hierarchy.
  • When you create and enable custom Web site use, the site roles installed on the server computer will automatically be uninstalled and reinstalled by site component manager.
  • When creating a custom Web site, you must define custom ports for the new Web site that are different from those in use on the default Web site. The default Web site and the custom Web site cannot be started at the same time if both are configured to operate on the same TCP/IP ports.
    Important
    When configuring the custom Web site to use https ports to support native mode site operations, the custom Web site must be configured to use a Web server certificate issued by a trusted certification authority. For more information about certificate requirements for native mode, see Certificate Requirements for Native Mode.

See Also

Tasks

How to Configure Custom Web Sites for Configuration Manager Sites
How to Configure a Configuration Manager Site to Use a Custom Web Site

Concepts

Configuration Manager Custom Web Site Overview


Determine If You Will Use FQDN Server Names

Configuration Manager 2007 supports fully qualified domain names (FQDNs) for site system servers, as well as supporting short names such as the NetBIOS name or the host name.

A fully qualified domain name (FQDN) is a hierarchical naming format used with Domain Name System (DNS) to denote the location of a computer or resource in the DNS tree hierarchy. You can find more information about FQDNs and supported naming structures in the publicly available RFC 1035 ("Domain names: implementation and specification").

Note
Configuration Manager supports RFC 1123 for FQDNs, which excludes double-byte character sets for host names. The host name in the FQDN can include ASCII letters, digits, and the hyphen or dash character ('-'). Host names cannot be all numbers, but can have a leading digit. Host names must end and begin only with a letter or digit.

Before you install Configuration Manager 2007 site system servers, determine whether you will configure them with FQDNs or short names. Refer to the following 4 conditions under which you should use FQDN server names:

  • Native mode and Internet-based client management
  • Mixed mode and automatically approving trusted clients
  • IPv6 and other environments that do not use WINS
  • Best practices for server name configuration

Native Mode and Internet-Based Client Management

You must use FQDNs for the site system servers that use PKI certificates that have only an FQDN in the Subject field or in the Subject Alternative Name field, as documented in Certificate Requirements for Native Mode.

Mixed Mode and Automatically Approving Trusted Computers

You must configure the site system server with the default management point role to use an FQDN if both of the following conditions apply:

  • The site has clients that are in a different domain to the site server's domain
  • Approval is configured with the option Automatically approve computers in trusted domains (recommended), which is the default configuration.

For more information, see About Client Approval in Configuration Manager.

IPv6 and Other Environments That Do Not Use WINS

You must use FQDNs for all site systems if you do not use WINS for name resolution. For more information, see Configuration Manager and Name Resolution.

Best Practices for Server Name Configuration

If you do not require FQDNs for server names in Configuration Manager 2007, the best practice is to use FQDN server names for the following benefits:

  • Name resolution will use DNS rather than WINS, and DNS can be more securely managed than WINS.
  • Authentication that requires name resolution will use the more secure authentication protocol of Kerberos, rather than NTLM.
  • Name resolution that uses DNS is more reliable than WINS when using a distributed infrastructure, multiple domains, or a disjointed namespace.

Registering CNAME (DNS Alias) FQDNs as Kerberos Service Principal Names (SPNs)

When Configuration Manager 2007 site systems are configured with an FQDN that is a CNAME (DNS alias) rather than the computer name registered in Active Directory Domain Services, the CNAME must be configured with a Kerberos service principal name (SPN) so that IIS authentication succeeds when required.

Use the Setspn tool included in Windows Server 2003 Support Tools to register the CNAMEs you configure for Configuration Manager 2007 site systems on the intranet (this procedure is not required for Internet FQDNs). For more information, see the following article that explains how to use SPNs when you configure Web applications that are hosted on IIS 6.0: http://go.microsoft.com/fwlink/?LinkId=94785.

If you using a network load balancing management point with an FQDN in a mixed mode environment, see How to Configure an SPN for NLB Management Point Site Systems.

See Also

Tasks

Configuring DNS for Configuration Manager Site System Roles
How to Automatically Publish the Default Management Point to DNS
How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management
How to Configure the Intranet FQDN of Site Systems
How to Manually Publish the Default Management Point to DNS

Concepts

Certificate Requirements for Native Mode
Configuration Manager Service Principal Name Requirements
Determine If You Need to Publish to DNS
Configuration Manager and Name Resolution


Choose Configuration Manager Boundaries

Computers are assigned as clients to Configuration Manager 2007 sites according to the boundaries you configure in the Configuration Manager console. Boundaries are defined by IP subnets, Active Directory site names, IPv6 Prefix, or IP ranges.

When creating Configuration Manager 2007 boundaries, you must specify the type of network connection that the boundary will operate on. You must also decide if the boundary will be used for either a Slow or unreliable or Fast (LAN) network connection.

Configuration Manager 2007 clients have the ability to roam. Roaming is the ability to move a computer that is running the Configuration Manager 2007 Client, from the designated boundaries of a Configuration Manager 2007 site to within the assigned boundaries of another Configuration Manager 2007 site or another network location not defined as a Configuration Manager boundary for any site at all. Ensure that you plan for client communications and manageability when clients roam from one Configuration Manager 2007 site to another. For more information about Configuration Manager 2007 client roaming, see About Client Roaming in Configuration Manager.

Advantages and Disadvantages of Site Boundary Types

Evaluate the advantages and disadvantages of each Configuration Manager 2007 boundary type before choosing which type you will use to assign clients.

Site Boundary Type Advantage Disadvantage

IP Subnets

Using IP subnets to define the boundaries of Configuration Manager 2007 sites allows you to be very specific about which clients will be assigned to which Configuration Manager 2007 sites based on their individual subnets. This also allows you to assign computers residing in the same Active Directory sites, but on different subnets, to different Configuration Manager 2007 sites.

Important
When adding IP subnets as boundaries for a site, you should ensure that the IP subnet being added as a boundary has not been added to an existing Active Directory site defined as a boundary for a different Configuration Manager site.

Each IP subnet you want to be part of your Configuration Manager 2007 boundaries must be entered individually in the Configuration Manager console. IP subnet changes or additions will require additional Configuration Manager 2007 boundary administration.

Active Directory Sites

Because Active Directory sites are based on physical network segments, the easiest method of defining Configuration Manager 2007 boundaries is to base them on Active Directory sites. This allows Configuration Manager 2007 administrators to split up or combine IP subnet boundaries based on logical, not physical, criteria. One advantage to using Active Directory sites as Configuration Manager boundaries is that subnet changes to Active Directory sites are automatically reflected within Active Directory boundaries.

Important
Active Directory discovery methods can only be used to discover computers located within the boundaries defined by Active Directory site names.

Before assigning clients using Active Directory sites, you must ensure that the Active Directory administrators have included all of the subnets you expect to be present in the Active Directory site. If the Active Directory sites are not properly configured, and you use them for Configuration Manager 2007 boundaries, you will have unmanaged clients on those subnets.

IPv6 Prefix

IPv6 allows for many more addresses to be assigned and many current and future operating system releases will support its use.

Note
The IPv6 architecture is detailed in RFC 4291.

IPv4-only systems cannot communicate directly with IPv6 computers and may require IP translation, such as NAT, to communicate.

IP Ranges

In some cases, you may not want to add an entire IP subnet as a boundary. In these cases it may be advantageous to specify only an IP range to use for client site assignment.

Entering IP ranges can result in more planning to ensure that the IP ranges used are not configured as part of an IP subnet boundary for a different Configuration Manager site.

See Also

Reference

New Boundary Dialog Box

Concepts

About Client Site Assignment in Configuration Manager
Planning Configuration Manager Boundaries


Choose a Configuration Manager Client Installation Method

There are a number of different methods you can use to install the Configuration Manager 2007 client software. You can use one, or any combination of these methods which are suitable for your needs. Available client installation methods include:

  • Client Push Installation
  • Software update Point Based
  • Group Policy Installation
  • Logon Script Installation
  • Manual Installation
  • Upgrade Installation (Software Distribution)

For help on choosing a suitable client installation method, see Determine the Configuration Manager Client Installation Method to Use.

See Also

Concepts

Determine the Configuration Manager Client Installation Method to Use
Overview of Configuration Manager Client Deployment


Choose Which Configuration Manager Features You Need

Topic last updated—March 2008

Configuration Manager 2007 provides a rich set of features to help you manage resources across an enterprise. Use the following table to help you determine which features you need.

Feature Description

Internet-based client management

Internet-based client management allows you to manage Configuration Manager 2007 clients when they are not connected to your company network but have a standard Internet connection.

For more information about Internet-based client management in Configuration Manager 2007, see Overview of Internet-Based Client Management.

Collections

Collections gather resources into logical, manageable groups in ways that best enable you to manage your Configuration Manager site.

For more information about collections in Configuration Manager 2007, see Collections in Configuration Manager.

Discovery

Discovery is a process that allows Configuration Manager 2007 to search your network for computers that can be managed as clients.

For more information about discovery in Configuration Manager 2007, see About Configuration Manager Discovery.

Inventory

Hardware inventory provides system information (such as available disk space, processor type, and operating system) about each computer. Software inventory provides information such as file types and versions present on client computers.

For more information about inventory, see Overview of Inventory.

Queries

Queries define and store the criteria for sets of database objects that you want to find. They can then be used to search the database for information about the objects that match the query criteria.

For more information about queries, see Queries in Configuration Manager.

Reporting

Reporting helps you to gather, organize, and present information about client computers and devices, site status, and other Configuration Manager operations in your organization.

For more information about reporting, see Reporting in Configuration Manager.

Software distribution

Software distribution allows you to create packages and programs to install software and run scripts on clients.

For more information about software distribution, see Software Distribution Overview.

Software updates

Software updates provide a set of tools and resources that can help manage the complex task of tracking and applying software updates to client computers in an enterprise.

For more information about software updates in Configuration Manager 2007, see Overview of Software Updates.

Software metering

Software metering allows you to collect detailed information about the programs that you choose to monitor. This includes program and usage information, such as user name, file description, start time, and end time.

For more information about software metering, see Software Metering in Configuration Manager.

Device management

Device management enables mobile device discovery and management for mobile devices running Windows Mobile software for Pocket PC and Smartphone platforms and Windows CE.

For more information about device management in Configuration Manager 2007, see Overview of Mobile Device Management.

Operating system deployment

Operating system deployment enables you to create images that can be deployed to computers using bootable media such as CD set or DVD. The image, in a WIM format file, contains the desired version of a Windows operating system and can also include any line-of-business applications that need to be installed on the computer.

For more information about operating system deployment in Configuration Manager 2007, see Overview of Operating System Deployment.

Task sequences

Task sequences provide the mechanism for performing multiple steps or tasks on a computer without requiring user intervention. Although task sequences do not represent a full scripting language, they do provide a simple building block approach for sequencing multiple tasks together at the command-line level.

For more information about task sequences in Configuration Manager 2007, see About Task Sequences.

Desired configuration management

Desired configuration management allows you to assess the compliance of computers with regard to a number of configurations, such as whether the correct Windows operating system versions are installed and configured appropriately, whether all required applications are installed and configured correctly, whether optional applications are configured appropriately, and whether prohibited applications are installed. Additionally, you can check for compliance with software updates and security settings.

For more information about desired configuration management in Configuration Manager 2007, see Overview of Desired Configuration Management.

Network Access Protection

Network Access Protection (NAP) works with health policies and network policies on a Network Policy Server, allowing you to select which software updates will be evaluated for compliance. The policies on the Network Policy Server then determine whether clients are granted full or limited network access and whether non-compliant clients are made compliant (remediated).

For more information about Network Access Protection in Configuration Manager 2007, see Overview of Network Access Protection.

Wake On LAN

Wake On LAN can send wake-up transmissions prior to the configured deadline for a software update deployment or at the configured schedule of a mandatory advertisement (which can be for software distribution or a task sequence).

For more information about Wake On LAN in Configuration Manager 2007, see Overview of Wake On LAN.

Remote tools

Remote tools allow you to remotely access and operate client computers that have the remote tools client agent components installed.

For more information about remote tools in Configuration Manager 2007, see Overview of Remote Tools.

Out of band management

Applies only to Configuration Manager 2007 SP1.

Out of band management allows you to manage desktop computers independently from the Configuration Manager client or the computer operating system. It requires computers that have the Intel vPro chip set and Intel Active Management Technology (Intel AMT) firmware versions 3.2 or later.

For more information about out of band management in Configuration Manager 2007 SP1, see Overview of Out of Band Management.

See Also

Concepts

Configuration Manager Tasks for Planning a Single Site

Other Resources

Configuration Manager 2007 Features
Deploying Configuration Manager Sites to Support Internet-Based Clients


Choose Between Local and Remote Configuration Manager Site Database Servers

The Configuration Manager 2007 site database must be installed on a SQL Server 2005 instance. Either the default instance or a named instance can be used. The site database can also be installed on a named instance of a virtual SQL Server cluster instance.

The most important aspects to plan for when choosing where to install the site database are disk I/O operations and network bandwidth considerations. Installing the site database on the local primary site server computer enables constant access to site database data, but depending on the disk array configuration of the site server, it may be slowed by disk I/O operations. Conversely, installing the site database on a remote SQL Server relies on a reliable, and fast, network connection.

Once installed, the site database can be moved to another SQL Server computer by running Configuration Manager Setup and choosing the site maintenance option.

Note
If the Configuration Manager 2007 site database is moved off the local site server computer, it is supported to move it back to the primary site server computer at a later time.

See Also

Tasks

How to Move the Site Database

Concepts

Configuration Manager Tasks for Planning a Single Site


Choose the SMS Provider Installation Location

The SMS Provider is a component of Configuration Manager 2007 primary sites and is used by Configuration Manager consoles to access site database information from the SQL Server hosting the site database.

The SMS Provider is a dynamic-link library file (smsprov.dll) and is installed or moved by running Configuration Manager 2007 Setup. You can install the SMS Provider on the primary site server computer, computer hosting the site database server, or another computer not hosting the primary site or site database. A server class operating system is required to install the SMS Provider on a computer other than the site server or site database server computers.

Important
The SMS Provider must be installed on a computer with the same operating system language as the site server's operating system language when a site contains site servers or clients with different language operating systems installed.

Pros and Cons of SMS Provider Installation Locations

You should evaluate the pros and cons of each SMS Provider installation location choosing the location that will be used to install it.

Location Pro Con

Configuration Manager site server
  • The SMS Provider does not use resources on the site database server which allows better site database performance.
  • The SMS Provider uses system and network resources that could be dedicated to site server operations to provide site database information to remote Configuration Manager console displays.

SQL Server hosting the site database
  • The SMS Provider is always in contact with the SQL Server hosting the site database which allows direct communication with Configuration Manager console installations from the site database server.
  • Faster Configuration Manager console performance than installing the SMS Provider on the site server.
  • The SMS Provider uses system and network resources that could be dedicated to site database operations to provide site database information to remote Configuration Manager console displays.
  • The SMS Provider cannot be installed on a clustered SQL Server virtual instance.

Computer other than the site server or site database server
  • Highest performance increase for site operations because the SMS Provider does not use site system resources on the primary site server or site database server.
  • The SMS Provider must be installed on a server operating system there is a higher chance it will use system resources that would otherwise be dedicated to other services.
  • Must be constantly accessible to both the site database server and all computers with the Configuration Manager console installed.

See Also

Concepts

Configuration Manager Tasks for Planning a Single Site


Configuring DNS for Configuration Manager Site System Roles

When a Configuration Manager 2007 site is configured to use fully qualified domain names (FQDNs), you must ensure that these are configured in DNS as host entries (A records for IPv4 addresses, or AAA records for IPv6).

To ensure DNS is configured with the appropriate entries, follow this guidance.

To configure DNS for Configuration Manager site system roles

  1. On your intranet DNS servers, ensure you have A records (for IPv4 addresses) or AAA records (for IPv6 addresses) for all the intranet FQDNs specified in Configuration Manager. These might be entered manually, or if you are using the same DNS name as the server name, the records might be automatically registered. These DNS entries must be configured with the intranet IP addresses of your site systems on the intranet.

  2. If the site is configured for Internet-based client management, public Internet DNS servers must also be configured. Ensure that public Internet DNS servers have A records (for IPv4 addresses) or AAA records (for IPv6 addresses) for all the Internet FQDNs specified in Configuration Manager. These DNS entries must be configured with the public Internet IP addresses of your Internet-based site servers.

See Also

Tasks

How to Automatically Publish the Default Management Point to DNS
How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management
How to Configure the Intranet FQDN of Site Systems
How to Manually Publish the Default Management Point to DNS

Concepts

Determine If You Need to Publish to DNS


Determine If You Need to Publish to DNS

Publishing the Configuration Manager 2007 default management point to DNS adds a service location resource record (SRV RR) for this site system role in the management point's DNS zone. Enabling this option would be appropriate for the following scenario:

  • Active Directory Domain Services is not extended with the Configuration Manager 2007 schema extensions, or the site supports clients from another forest that are managed on the intranet.
  • You are not using WINS, and Configuration Manager 2007 is configured to use intranet fully qualified domain names (FQDNs) for site systems.

To publish to DNS, the following two conditions must be met:

  • Your DNS servers support service location resource records, using a version of BIND that is 8.1.2 or higher.
  • The specified FQDNs in Configuration Manager 2007 have host entries (A records) in DNS.
Note
DNS publishing in Configuration Manager 2007 does not support network load balanced management points, so you should not enable DNS publishing in Configuration Manager 2007 if you are using network load balancing management points. Instead, network load balancing management points are located through Active Directory Domain Services with Configuration Manager 2007 schema extensions, WINS (with a manual entry) if the site is in mixed mode, or through a server locator point.

You can automatically publish the default management point to DNS if your DNS servers support automatic updates, or you can manually publish the default management point.

Important
For clients to find their default management point in DNS, you must assign the clients to a specific site (rather than use auto-site assignment) and configure these clients to use the site code with the domain suffix of their management point. For more information, see How to Configure Configuration Manager Clients to Find their Management Point using DNS Publishing.

See Also

Tasks

How to Automatically Publish the Default Management Point to DNS
How to Configure the Intranet FQDN of Site Systems
How to Manually Publish the Default Management Point to DNS

Concepts

Configuration Manager and Service Location (Site Information and Management Points)


Choose between Native Mode and Mixed Mode

If you install a new Configuration Manager 2007 site, you must choose between native mode and mixed mode during Setup. If you have an existing Configuration Manager 2007 site, you can choose to migrate the site to native mode after Setup or keep the site in mixed mode.

Choose native mode if any of the following conditions apply:

  • You require the highest security controls, using industry-standard protocols.
  • You require Internet-based client management.

Choose mixed mode if any of the following conditions apply:

  • You do not have the supporting public key infrastructure (PKI).
  • You have not installed the specific certificates required by Configuration Manager 2007.
  • The site contains SMS 2003 clients.
  • The site contains clients running Windows 2000 Professional or Windows Server 2000.
  • The parent site is configured for mixed mode.
  • Site systems running Internet Information Services (IIS) are not dedicated to Configuration Manager, and you cannot configure a custom Web site.
  • You must use WINS as the means by which clients can find their default management point.
  • You do not want the site's secondary sites to be automatically migrated.

Advantages and Disadvantages of the Two Site Modes

If you cannot choose the site mode based on these conditions, you should consider the advantages and disadvantages of both site modes to best meet your business requirements.

The following table outlines the advantages and disadvantages of native-mode and mixed-mode site configuration to help you choose which site mode to configure.

Site Mode Advantage Disadvantage

Native Mode

More secure solution than mixed mode because it provides better authentication, encryption, and signing using standard industry security protocols.

Supports Internet-based client management.

Does not use WINS as the means by which clients locate their default management point.

Can integrate with existing PKI deployment, and the security controls can be managed independently from the product.

Requires a PKI deployment and specific certificates.

The parent site (if applicable) must be in native mode.

Clients that roam into this site from a mixed-mode site will not be able to download content from the site's distribution points.

Must configure a custom Web site if the site systems running Internet Information Services (IIS) are not dedicated to Configuration Manager.

Might require registering fully qualified domain names (FQDNs) in DNS (FQDNs are a requirement for Internet-based client management, and recommended for native mode on the intranet).

If a mixed-mode client roams into the site, it will not be able to download local content.

Mixed Mode

Does not require a PKI deployment, so it has no external dependencies.

Supports clients running SMS 2003.

Supports WINS for the means by which clients locate their default management point if Active Directory and DNS cannot be used.

Provides less comprehensive signing, encryption, and authentication.

Does not support Internet-based client management.

Requires approval of clients before they can receive policies that might contain sensitive data.

Clients that roam into this site from a native-mode site will not be able to download local content unless their site is configured with the option: Allow HTTP Communication for Roaming and Site Assignment.

See Also

Concepts

Certificate Requirements for Native Mode
Prerequisites for Native Mode
Administrator Checklist: Migrating a Site to Native Mode
Client Communication in Mixed Mode and Native Mode
Configuration Manager and Service Location (Site Information and Management Points)


Determine If You Can Use Your Existing PKI (Native Mode)

Topic Last Updated—August 2008

Configuration Manager 2007 uses standard public key infrastructure (PKI) certificates, supporting version 3 of the x.509 certificate format. If your existing PKI deployment can create, deploy, and manage the certificates that Configuration Manager 2007 requires for native mode, you can use your existing PKI.

It is recommended, but not required, that Microsoft Certificate Services using an Enterprise certification authority be used because doing so provides the following features, which can make it easier to support Configuration Manager 2007 in native mode:

  • Automatic publishing of trusted root authorities, intermediate certification authorities, and the certificate revocation list (CRL) through Active Directory Domain Services.
  • Certificate templates to ease certificate creation.
  • Automatic deployment and renewal of certificates with Group Policy.
  • Automatic approval for online requested certificates.
  • Web enrollment for clients in workgroups or from another Active Directory forest, and the deployment of specialized certificates.
Important
If you are using Active Directory Certificate Services with Windows Server 2008, do not use version 3 templates (Windows Server 2008, Enterprise Edition). These certificate templates result in creating certificates that are not compatible with Configuration Manager.

See Also

Concepts

Certificate Requirements for Native Mode
Administrator Workflow: Deploying the PKI Requirements for Native Mode
Administrator Checklist: Deploying the PKI Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Determine If You Need to Specify Client Certificate Settings (Native Mode)

Topic last updated—January 2008

When Configuration Manager 2007 clients connect to their management points, they use a client certificate for authentication.

A Configuration Manager 2007 client uses a certificate located in the Computer certificate store. By default, the client identifies a certificate in the Personal store that includes client authentication in the intended purpose field and it will use this certificate for native mode communication. If a client computer has only one valid certificate that matches this requirement, there are no certificate settings to configure in Configuration Manager 2007.

However, you will have to configure client certificate settings if either of the following conditions applies:

  • The client certificate to use with Configuration Manager 2007 is not stored in the Personal store, but in a different location in the Computer certificate store.
  • There is more than one certificate that is valid and contains the client authentication purpose. In this scenario, Configuration Manager will not know which certificate should be used.

When clients have more than one certificate that can be used for native mode communication, there are two available selection methods that can be configured for multiple clients to determine which certificate will be used:

  • A partial string match on the client certificate Subject Name. This is a case-insensitive match that is appropriate if you are using the fully qualified domain name (FQDN) of a computer in the subject field and want the certificate selection to be based on the domain suffix, for example contoso.com. However, you can use this selection method to identify any string of sequential characters that differentiate the certificate from others in the client certificate store.
  • A match on the client certificate Subject Name attribute values or the Subject Alternative Name attribute values. This is a case-sensitive match that is appropriate if you are using an X500 distinguished name or equivalent OIDs (Object Identifiers) in the Subject field in accordance with RFC 3280, and you want the certificate selection to be based on the attribute values. You can specify only the attributes and their values that you require to uniquely identify or validate the certificate and differentiate the certificate from others in the certificate store.

The attribute values that are supported in Configuration Manager 2007 for certificate selection criteria are listed in the following table.

OID Attribute | Distinguished Name Attribute | Attribute Definition
0.9.2342.19200300.100.1.25 | DC | Domain component
1.2.840.113549.1.9.1 | E or E-mail | E-mail address
2.5.4.3 | CN | Common name
2.5.4.4 | SN | Subject name
2.5.4.5 | SERIALNUMBER | Serial number
2.5.4.6 | C | Country code
2.5.4.7 | L | Locality
2.5.4.8 | S or ST | State or province name
2.5.4.9 | STREET | Street address
2.5.4.10 | O | Organization name
2.5.4.11 | OU | Organizational unit
2.5.4.12 | T or Title | Title
2.5.4.42 | G or GN or GivenName | Given name
2.5.4.43 | I or Initials | Initials
2.5.29.17 | (no value) | Subject Alternative Name

If more than one suitable certificate is located even after the selection criteria is applied, you can specify the client behavior with regard to certificate selection. When a certificate cannot be uniquely selected, the default setting is that no certificate is selected, which results in failed communication with the management point. In this scenario, the client will send an error message to its assigned fallback status point to alert you to the certificate selection failure so that you can modify or refine your certificate selection criteria.

Alternatively, you can configure clients to select any of the suitable and matching certificates. If the client is running Configuration Manager 2007 SP1, the certificate with the longest validity period is selected, which might be required if you are using Network Access Protection and IPsec enforcement. This setting might result in successful native mode communication but is a less reliable configuration because there is no control over which client certificate will be used.

See Also

Tasks

How to Specify the Client Certificate Selection Criteria
How to Specify the Client Certificate Store

Concepts

Certificate Requirements for Native Mode
How to Install Configuration Manager Clients Manually


Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)

The Configuration Manager 2007 site server uses the site server signing certificate in native mode to sign policies that are downloaded by clients from the management point. To verify the signature, clients require a copy of this certificate. After clients receive the certificate, it is stored in the client registry and used whenever new policies are sent from the management point.

Note
The site server signing certificate is not stored in the Certificate store on clients; instead, it is stored in a protected area of the registry.

There are three methods to deploy the site server signing certificate to client computers:

  • Automatically through Active Directory Domain Services.
  • Manually when the client is installed.
  • Automatically from the management point.

The recommended solution is to deploy the site server signing certificate to client computers through Active Directory Domain Services, because this method does not require any additional administration and the certificate is stored in a secured location independently from Configuration Manager 2007. However, this method has the following prerequisites:

  • The Active Directory schema is extended for Configuration Manager 2007.
  • The site is published to Active Directory Domain Services.
  • Clients can locate the published site information in Active Directory Domain Services.
    Note
    Clients that cannot read published information include computers from another Active Directory forest, clients from workgroup computers, and clients that are managed from the Internet.

If clients cannot retrieve a copy of the site server signing certificate from Active Directory Domain Services, consider deploying it to these clients with the client setup utility, CCMSetup.exe, using the client.msi parameter SMSSIGNCERT with the path and filename of the exported certificate. The disadvantage of this method is that it requires more administrative overhead, which might need to be repeated if the site server signing certificate changes or is renewed. For more information about CCMSetup options, see About Configuration Manager Client Installation Properties. For procedural information to export the certificate, see How to Export the Site Server Signing Certificate for Configuration Manager Client Installation.

If a copy of the site server signing certificate is not already installed on Configuration Manager 2007 clients when they connect to their management point and they cannot locate it from Active Directory Domain Services, the management point will automatically download it so that clients can verify the signed policies.

Of the three solutions, automatically deploying it with the management point is the least secure solution and should not be used if you have any doubts about the security of your management point. For example, a management point that resides in a perimeter network to accept connections from the Internet for Internet-based client management is considered less secure than a management point within your intranet that accepts only connections from intranet clients. However, automatically deploying a copy of the site server signing certificate through the management point might be an appropriate solution if the management point accepts only connections from intranet clients and you do not want the administrative overhead of manual deployment.

Choose the deployment method that best meets your business requirements. To help you determine how to deploy to clients a copy of the site server signing certificate, use the following guidelines.

Use Active Directory Domain Services to automatically deploy a copy of the site server signing certificate when all of the following conditions apply:

  • Active Directory Domain Services is extended with Configuration Manager 2007 schema extensions, and the site is published to Active Directory Domain Services.
  • Clients can read the published site information, which excludes clients from untrusted domains, clients from workgroups, and clients on the Internet.

Manually deploy a copy of the site server signing certificate if any of the following conditions apply:

  • You cannot use Active Directory Domain Services to deploy a copy of the site server signing certificate.
  • Clients connect to a management point that is configured for Internet-based client management.
  • The security risk of automatically installing a copy of the site server signing certificate from the management point outweighs the additional administrative overhead of manual deployment.

Automatically deploy a copy of the site server signing certificate using the management point if all of the following conditions apply:

  • You cannot use Active Directory Domain Services to deploy a copy of the site server signing certificate.
  • The management point is secured within your intranet and is not configured for Internet-based client management.
  • The administrative overhead of manual deployment outweigh the security risk of automatically installing a copy of the site server signing certificate from the management point.

See Also

Tasks

How to Export the Site Server Signing Certificate for Configuration Manager Client Installation

Concepts

Certificate Requirements for Native Mode
About Configuration Manager Client Installation Properties

Other Resources

Deploying the PKI Certificates Required for Native Mode


Renewing or Changing the Site Server Signing Certificate

Topic Last Updated—August 2008

The site server signing certificate in a native mode Configuration Manager 2007 site signs the policies that are downloaded to Configuration Manager clients so that clients know their policies come from a trusted source. Configuration Manager clients need a copy of the site server signing certificate, and they retrieve this from Active Directory or their management point. Alternatively, you can provision the client with the site server signing certificate on installation by using a CCMSetup command-line option. For more information about deploying the site server signing certificate to clients, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode).

Configuration Manager checks the validity of the site server signing certificate before using it, and if it detects that expiry is within 10 days, it raises the status message ID of 5112 with the component of SMS_POLICY-PROVIDER. This status message will be repeated once a day with a count of how many days remain until expiry.

If you renew or need to change the site server signing certificate that is deployed to the Configuration Manager site server, you must configure Configuration Manager to use this new certificate. Selecting a new site server signing certificate has some consequences with regard to the following situations:

  • Renewing the Site Server Signing Certificate or Issuing a New Certificate from the Same Root Certification Authority
  • Issuing a New Site Server Signing Certificate from a Different Root Certification Authority

Renewing the Site Server Signing Certificate or Issuing a New Certificate from the Same Root Certification Authority

If you configure the Configuration Manager site to use a new site server signing certificate that has a new key pair (a recommended best practice), all client policies are re-signed by the site server. When clients download their policies that have been signed by the new site server signing certificate, they will not immediately validate the signature because their copy of the site server signing certificate does not match the certificate that was used to sign the policies. If the new site server signing certificate chains to the same trusted root certificate as the previous site server signing certificate, Configuration Manager clients will automatically download a copy of the new site server signing certificate from either Active Directory Domain Services or the management point. They then validate their policy signed by the new site server signing certificate.

Note
Renew the site server signing certificate during a quiet period when it is acceptable that there will be an interruption to Configuration Manager site operation, together with an increase in network activity and processing on the management point or domain controllers. Re-signing a high number of policies by the site server and then the retrieval of the new certificate by clients can require a sustained period of time to complete.

Issuing a New Site Server Signing Certificate from a Different Root Certification Authority or After Renewing the Root Certificate

If you configure the Configuration Manager site to use a new site server signing certificate that chains to a different root certificate (either by using a different certification authority or by using the same certification authority but with a new root certificate that has a new key pair), clients will not accept the new site server signing certificate when they receive policies signed with the new certificate. This behavior provides security prevention against clients accepting a new site server signing certificate from a compromised management point. In this scenario, clients will not attempt to download the new site server signing certificate and will reject the policy they have downloaded, sending an error to the management point to alert the administrator to the fact that policy authorization failed. In this scenario, clients are unmanaged and the administrator must take remedial action.

If you have changed the root certificate and need to install a new site server signing certificate, you must first delete the copy of the current site server signing certificate on Configuration Manager clients that is stored in the registry, by running a script on clients (for example, by running a task sequence in Configuration Manager or by using Group Policy). The client copy of the site server signing certificate is stored in the following registry key for 32-bit operating systems: HKLM\SOFTWARE\Microsoft\CCM\Security. It is stored in the following registry key for 64-bit registry systems: HKLM\SOFTWARE\Microsoft\CCM\Security

To remove the client copy of the site server signing certificate if you change the root certification, locate the value named AllowedRootCAHashCode (type REG_SZ) and delete the associated value data that appears as a string of hexadecimal numbers.

Alternatives to editing the client registry are the following:

  • Uninstall the client and reinstall it.
  • Reinstall the client using a CCMSetup command-line option to provision the client with a copy of the new site server signing certificate.

See Also

Tasks

How to Configure the Site Server with its Site Server Signing Certificate

Concepts

Certificate Requirements for Native Mode
Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)
Deploying the Site Server Signing Certificate to the Site Server


Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)

The certificate revocation list (CRL) is an optional component of a public key infrastructure (PKI) deployment. It is a file that is created and signed by a certification authority and contains a list of certificates that it has issued but revoked. Certificates can be revoked by a certification authority administrator, for example, if an issued certificate is known or suspected to be compromised.

When a CRL is used with a PKI deployment, applications can check the revocation status of the certificates they are using and of the certificates that chain to the trusted root certification. This check is made by ensuring all certificates in the chain are not listed on the CRL. If any of these certificates are listed on the CRL, the certificate used by the application is considered invalid, even though it comes from a trusted source and is within its validity period.

If certificate revocation checking is enabled on a Configuration Manager 2007 native mode site, native mode client computers will check the CRL whenever they communicate with one of the following site systems configured for native mode:

  • Management points
  • Distribution points that are not using a site system share, or configured as branch distribution points
  • Software update points
  • State migration points

If certificate revocation checking is enabled on a Configuration Manager 2007 native mode site but clients fail to locate the CRL, they behave as if all certificates in the certification chain are revoked because their absence from the list cannot be verified. In this scenario, all connections that require certificates and use a CRL will fail, and the Configuration Manager 2007 client will send an error message to its fallback status point.

Checking the CRL each time a certificate is used offers more security against using a certificate that has been revoked, but it introduces a connection delay and additional processing on the client. You are more likely to require this additional security check for Internet-based client management than for native mode sites that are contained within the intranet.

You should consult your PKI administrators before deciding whether to enable certificate revocation checking on clients, and then consider enabling this option in Configuration Manager 2007 if both of the following conditions apply:

  • Your PKI infrastructure supports a CRL, and it is published where all Configuration Manager 2007 clients can locate it (including clients on the Internet if you are using Internet-based client management).
  • The requirement to check the CRL for each connection to a site system configured with a certificate is greater than the requirement for faster connections and efficient processing on the client, and is also greater than the risk of clients failing to connect to servers if they cannot locate the CRL.
Note
For more information about certificate revocation, see the section on managing certificate revocation in the Windows Server 2003 product help (http://go.microsoft.com/fwlink/?LinkId=78786).

Certificate revocation checking is enabled by default in IIS, so if you are using a CRL with your PKI deployment, there is nothing additional to configure on the Configuration Manager site systems.

Native mode mobile device clients do not use certificate revocation lists, although their certificates can be revoked and checked by native mode site systems.

See Also

Tasks

How to Enable or Disable Certificate Revocation Checking (CRL) on Clients
How to Block Configuration Manager Clients

Other Resources

Deploying the PKI Certificates Required for Native Mode


Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode)

A certificate trust list (CTL) is a defined list of trusted root certification authorities. When used with Group Policy and a PKI deployment, a CTL allows you to supplement the existing trusted root certification authorities that are configured on your network, such as those automatically installed with Microsoft Windows or added through Windows enterprise root certification authorities. However, when a CTL is configured in Internet Information Services (IIS), a CTL defines a subset of those trusted root certification authorities.

This subset provides administrators with more control over security because the CTL restricts the client certificates that are accepted to only those that are issued from the list of certification authorities in the CTL. For example, Windows ships with a number of well-known third-party certification authority certificates, such as VeriSign and Thawte. By default, the computer running IIS trusts certificates that chain to these well-known certification authorities. Without configuring IIS with a CTL, any computer that has a client certificate issued from these certification authorities are accepted as a valid Configuration Manager client. If you configure IIS with a CTL that did not include these certification authorities, client connections are refused if the certificate chained to these certification authorities. However, for Configuration Manager clients to be accepted in the native mode site, you must configure IIS with a CTL that specifies the certification authorities used by Configuration Manager clients.

A CTL in IIS is defined as a Web site property, so you must configure the CTL for each site server in a Configuration Manager 2007 native mode site that is configured for Secure Sockets Layer (SSL) communication; it cannot be configured and maintained with Group Policy. The site system roles that use SSL communication are the following:

  • Management points:
    • Default management point
    • Network load balanced management points
    • Proxy management point
    • Internet-based management point
  • Distribution points that are not branch distribution points or using site system shares
  • Software update points
  • State migration points

To use a CTL with Configuration Manager 2007 in native mode, edit the properties of the Web site (the Default Web site, or the custom web site named SMSWeb) after you have configured the Web site with its native mode certificate. Use the Certificate Trust List Wizard to create or edit the CTL, and then specify the root certification authorities used by clients in the native mode site. For more information about creating and editing CTLs in IIS 6.0, see the IIS 6.0 documentation on CTLs (http://go.microsoft.com/fwlink/?LinkId=80247).

It is recommended, but not required, that you use a CTL in IIS for Configuration Manager 2007 native mode because this provides a higher level of security than if you do not explicitly define which certification authorities are used by Configuration Manager clients.

Using a CTL with IIS and Configuration Manager 2007 native mode provides the following advantage:

  • This is a more secure solution because only the trusted root certification authorities specified in the CTL, rather than all trusted root certification authorities used on the network, will be trusted by Configuration Manager, including the certification authorities installed by default in Windows.

Using a CTL with IIS and Configuration Manager 2007 native mode has the following disadvantages:

  • This configuration has additional administrative overhead associated with creating and maintaining the CTL on IIS for each Configuration Manager site system server that communicates with Configuration Manager clients over SSL.
  • Failing to correctly configure and maintain the CTL can result in unmanaged clients.

See Also

Concepts

Administrator Checklist: Deploying the PKI Requirements for Native Mode
Benefits of Using Native Mode
Configuration Manager Custom Web Site Overview
Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)


Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)

When the Configuration Manager 2007 site is configured for native mode on the intranet, you must decide whether to enable the option Allow HTTP communication for roaming and site assignment.

Note
This option is not used with Internet-based client management, or with mobile device clients.

This setting configures the roaming behavior of client computers and determines whether clients can communicate with a server locator point for site assignment and to locate a network load balancing management point.

For more information about roaming, see About Client Roaming in Configuration Manager.

For more information about the server locator point, see Determine If You Need a Server Locator Point for Configuration Manager Clients.

If the Configuration Manager 2007 site hierarchy contains some sites that are configured for mixed mode, and clients roam between sites in different modes, you must determine the roaming behavior you require.

Do not enable this option if the following condition applies:

  • The security risk of a native-mode roaming client downloading content over HTTP (data is unencrypted) has a higher priority than the roaming client downloading remote content using HTTPS (data is encrypted) from the client's assigned site. If the remote content is over a low bandwidth connection, remote content retrieval will be considerably slower than if it is downloaded locally.

Enable this option if the following condition applies:

  • The security risk of a native-mode roaming client downloading content over HTTP (data is unencrypted) has a lower priority than the roaming client downloading remote content using HTTPS (data is encrypted) from the client's assigned site. If the remote content is over a low bandwidth connection, local content retrieval will be considerably faster than if it is downloaded remotely.

Additionally, this option is required for the following scenario:

  • The Active Directory schema is not extended for Configuration Manager 2007, or the native-mode site manages clients on the intranet from workgroups or another Active Directory forest.

See Also

Tasks

How to Configure HTTP Communication for Roaming and Site Assignment

Concepts

About Client Site Assignment in Configuration Manager
Client Communication in Mixed Mode and Native Mode


Configuration Manager Tasks for Deploying a Single Site

There are many tasks associated with deploying Configuration Manager 2007 sites. Some tasks are mandatory and must be accomplished for all sites. Other tasks are optional and vary depending on your specific site setup requirements. Because individual site setup requirements depend on many factors (including server hardware, server software, or even network configurations), individual site setup will not be the same in every situation.

In This Section

Mandatory Tasks

You must perform one or more of the tasks described in the following table to deploy a Configuration Manager site:

Deploying the PKI Certificates Required for Native Mode

Provides information and references to help you deploy the certificates required by Configuration Manager 2007 native mode.

How to Deploy a Site Using Simple Setup

Describes how to deploy a Configuration Manager site using simple setup settings.

How to Deploy a Site Using Custom Setup

Describes how to deploy a Configuration Manager site using custom setup settings.

How to Deploy a Site Using Scripted Installation Methods

Describes how to deploy a Configuration Manager site using scripted installation methods.

How to Verify Successful Site Installation

Describes how to verify that your site has been successfully installed.

Optional Tasks

Although you do not need to perform the tasks described in the following table before you use Configuration Manager (because they are set to usable defaults), you might want to modify their default settings for specific purposes:

How to Install a Management Point

Management point site systems are required for Configuration Manager sites that will have clients assigned to them.

How to Extend the Active Directory Schema for Configuration Manager

Describes the steps involved in successfully extending the Active Directory schema for Configuration Manager.

How to Manually Add Configuration Manager Site Information to WINS

Describes the steps to manually add Configuration Manager site information to Windows Internet Name Service (WINS).

How to Install Configuration Manager Using a Remote SQL Server

Describes how to install a Configuration Manager site using a remote SQL Server to host the site database.

How to Install Configuration Manager Using a Clustered SQL Server Instance

Describes how to install a Configuration Manager site using a clustered SQL Server instance to host the site database.

How to Specify a Server Share Site System Installation Drive

Describes how to create a server share site system.

How to Prevent Configuration Manager From Installing Files on a Specific Drive

Describes how to prevent Configuration Manager from installing files on specific drives by using the no_sms_on_drive.sms file.


Deploying the PKI Certificates Required for Native Mode

Topic Last Updated—August 2008

The public key infrastructure (PKI) certificates that are required for native mode in Configuration Manager 2007 must be created, installed, and managed independently from Configuration Manager 2007. This means that there is no single method of deployment for the required certificates and you will need to consult your particular PKI deployment documentation for the necessary procedures and best practices.

The following table lists some Web references to help you deploy the certificates required by Configuration Manager 2007 if you are using a Microsoft PKI.

Description | Reference
Microsoft home page for Windows Server 2008 PKI, which has many links to all aspects of using the latest Microsoft PKI, including technical overviews, step-by-step guides, troubleshooting information, knowledge base articles, and links to other resources. | Windows Server 2008 Active Directory Certificate Services (http://go.microsoft.com/fwlink/?LinkId=115018)
Microsoft home page for Windows Server 2003 PKI, which has links to PKI introductory and technical overviews, step-by-step guides, and other resources. | Public Key Infrastructure for Windows Server 2003 (http://go.microsoft.com/fwlink/?LinkId=78389)
The Microsoft Windows guide to designing a public key infrastructure, from the Windows Server 2003 Deployment Guide. | Designing a Public Key Infrastructure (http://go.microsoft.com/fwlink/?LinkId=78391)
The Microsoft Windows Server 2003 public key infrastructure best practices, which lists many relevant white papers, examples, and sample scripts to help deploy a Microsoft PKI. | Best Practices for Implementing a Microsoft Windows Server 2003 Public Key Infrastructure (http://go.microsoft.com/fwlink/?LinkId=78390)

In addition to using your PKI documentation, you can consult the following sections for some general guidance on each of the certificate deployment steps required for Configuration Manager 2007 to operate in native mode:

  • Deploying a Trusted Root Certification Authority to Configuration Manager Computers
  • Deploying the Intermediate Certification Authority Certificates to Configuration Manager Computers
  • Deploying the Site Server Signing Certificate to the Site Server
  • Deploying the Web Server Certificates to Site System Servers
  • Deploying the Web Server Certificate to Network Load Balanced Site Systems
  • Deploying the Client Computer Certificates to Clients and the Management Point
  • Deploying Certificates to Mobile Device Clients

The following step-by-step guides provide walkthrough examples of how you can deploy the PKI certificates that are required for native mode, using a Microsoft enterprise certification authority:

  • Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2008 Certification Authority
  • Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority

See Also

Concepts

Administrator Checklist: Deploying the PKI Requirements for Native Mode
Administrator Workflow: Deploying the PKI Requirements for Native Mode
Certificate Requirements for Native Mode


Deploying a Trusted Root Certification Authority to Configuration Manager Computers

A root certification authority (CA) is the most trusted certification authority, which is at the top of a public key infrastructure (PKI) certification hierarchy. For native mode communication to be successful in a Configuration Manager 2007 site, the PKI certificates that are used for authentication, encryption, and signing must be issued by a root certification authority that is trusted by the other computers and devices in the site.

Each computer and device that communicates using certificates must have a root certificate in common. If all the computers in your Configuration Manager 2007 hierarchy use certificates from the same certification authority, you need to deploy only a single trusted root certification authority. However, there is no requirement to use the same certification authority, so you might have to install multiple root CAs.

Microsoft Windows computers and some devices are automatically configured with some well-known third-party root certificates. However, if you are using your own PKI, you need to install the root certificate. There are various ways to achieve this, including the following methods:

  • If you are using a Microsoft Enterprise root certification authority, the root certificate is automatically installed on computers in the forest, using Active Directory Domain Services.
  • If you are not using a Microsoft Enterprise root certification authority but want all computers in the forest to automatically trust the root certification authority, you can publish the root certificate in the Enterprise Trust Store, using Group Policy or the Certutil command.
  • If you not using a Microsoft Enterprise root certification authority and want only groups of computers in the forest to automatically trust the root certification authority, you can publish the root certificate to domains or organizational units (OUs) using Group Policy. Only computers that have the Group Policy applied will automatically trust the root certification authority. Add the root certificate to the Group Policy object Trusted Root Certification Authorities under the Public Key Policies folder for the Computer Configuration container.
  • If you are using Microsoft Certificate Services with Internet Information Services (IIS), you can request and install the root certificate with the Web enrollment service.
  • You can request and retrieve the certificate using the Microsoft Certreq command-line utility.
  • You can export the certificate to a file and import it if exporting the public key is enabled within the certificate.

If you are using the operating system deployment feature, root CAs must be specified in Configuration Manager 2007 as a site property. For more information, see How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients.

See Also

Concepts

Certificate Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Deploying the Intermediate Certification Authority Certificates to Configuration Manager Computers

An intermediate certification authority (CA) is a CA that is subordinate to the root CA by one or more levels and typically issues certificates to other CAs in the public key infrastructure (PKI) hierarchy. The other type of subordinate CA is an issuing CA. For native mode communication to be successful in a Configuration Manager 2007 site, the PKI certificates that are used for authentication, encryption, and signing must successfully chain to a trusted root. Certificate chaining is a native process of the Microsoft Windows operating system that involves collecting all the subordinate CAs up to the root CA and validating each certificate in the path. If one certificate in the chain cannot be located or is found to be invalid (for example, expired), the entire chain will be deemed invalid and Configuration Manager 2007 communication will fail.

Windows computers and some devices are automatically configured with some well-known third-party intermediate CAs. However, if you are using a third-party PKI solution, it is best practice to install computer and server certificates with the chain of intermediate CA certificates. Intermediate CAs can be dynamically downloaded during the certificate chaining process if the issued certificate includes URLs to the intermediate CAs in the Authority Information Access (AIA) field, the applications using the certificate allow this behavior, and clients have network access to the intermediate CAs.

In Configuration Manager 2007 native mode, clients can dynamically download the certificates for intermediate CAs as needed if they are not already present in the local computer store. However, Configuration Manager 2007 site systems do not dynamically download intermediate CA certificates.

If you are using Microsoft Enterprise subordinate CAs, you do not need to install intermediate CA certificates on the site systems because these are automatically replicated throughout the forest using Active Directory Domain Services. However, if you are using a third-party PKI solution, ensure the certificate chain is installed with the server certificate.

Check with your PKI documentation for deployment options to install intermediate CA certificates for Configuration Manager 2007 computers that require them.

See Also

Concepts

Certificate Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Deploying the Site Server Signing Certificate to the Site Server

The site server in a Configuration Manager 2007 native mode site requires a custom public key infrastructure (PKI) certificate before the site can operate in native mode.

Important
Every site in the Configuration Manager 2007 hierarchy that is configured for native mode requires that each site server has its own site server signing certificate. This includes a central site that is used for reporting and has no clients assigned to it.

You can deploy the site server signing certificate in a number of ways, including the following methods:

  • If you are using a Microsoft PKI with an Enterprise certification authority using the Enterprise edition of Microsoft Windows Server 2003, you can modify a version 2 (v2) certificate template to create a site server signing certificate that can be requested online from the site server. Configure the template so that only site servers have read and enroll permissions and the subject name is supplied when the certificate is requested by each site server. For additional security, configure the template for manual approval.
  • If you are using a Microsoft PKI with Web enrollment, you can request a custom certificate using the Web enrollment pages. If you are using the Enterprise edition of Windows Server 2003 with a modified v2 certificate template, you can request a certificate based on this template on the Web enrollment page, with the benefit of having the certificate requirements automatically configured with the template.
  • If you are running Internet Information Services (IIS) on the site server, you can request this certificate through IIS as either an online request or a file request.
  • You can request and retrieve the certificate using the Microsoft Certreq command-line utility.
  • If you can create the certificate with your certificate management tools, you can export it and import it on the site server.

When the site server signing certificate is installed in the local certificate store on the site server, you need to configure Configuration Manager 2007 to use it. You do this either with Setup when you are installing the site or by configuring the site for native mode after Setup is complete.

See Also

Concepts

Certificate Requirements for Native Mode
Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)
Renewing or Changing the Site Server Signing Certificate

Other Resources

Deploying the PKI Certificates Required for Native Mode


Deploying the Web Server Certificates to Site System Servers

Topic Last Updated—August 2008

The following site systems require Web server certificates when a Configuration Manager 2007 site is configured for native mode:

  • Management points (default management point, proxy management point, network load balanced management point, and Internet-based management point)
  • Standard distribution points (servers and shares) that are configured with the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients).
  • Software update points
  • State migration points
Note
Branch distribution points do not require a Web server certificate. However, they do require a client certificate.

Deploying the Web server certificates is a two-step process:

  1. Install the Web server certificate on the server.
  2. Configure Internet Information Services (IIS) to use the Web server certificate.

Installing the Web Server Certificate on a Server

There are a number of ways that you can install the Web server certificates, including the following methods:

  • If you are using a Microsoft public key infrastructure (PKI) with an enterprise certification authority, you can create the certificates based on the Web server template and assign them to the servers using Group Policy and auto-enrollment.
  • If you are using a Microsoft PKI with Web enrollment that supports storing certificates into the local computer store, you can request a Web server certificate from each server by using the Web enrollment pages.
  • You can request the certificate from each server through Internet Information Services (IIS) and running a wizard. For example, if you are using IIS 7.0 on Windows Server 2008, select Server Certificates from the home page, and then click Create Certificate Request to create a certificate request file. If you are using IIS 6.0 on Windows Server 2003, edit the Web site properties, click the Directory Security tab, and then click Server Certificate to create an online request or a certificate request file.
  • You can request and retrieve the certificate using the Microsoft Certreq command-line utility.
  • If you can create the certificate with your certificate management tools, you can export it and import it on each server.
Note
For information about how to specify more than one fully qualified domain name (FQDN) in the certificate Subject Alternative Name field (for example, if the site system supports intranet and Internet client connections, or is a network load balancing site system), see the following article about how to add a subject alternative name to a secure LDAP certificate: http://go.microsoft.com/fwlink/?LinkId=93692.

Configure IIS to Use the Web Server Certificate on a Server

When you have installed the Web server certificate, you then need to configure Internet Information Services (IIS) so that the Configuration Manager 2007 Web site uses the certificate for authentication and encryption. You can script this installation or use the Internet Information Services (IIS) Manager console.

To configure IIS to use the Web server certificate using the Internet Information Services (IIS) Manager console, perform one of the following steps, depending on the version of IIS that you are using:

  • For IIS 7.0 on Windows Server 2008: Expand Sites, select the Web site that is being used by Configuration Manager (Default Web Site or SMSWEB), select Edit Bindings, and then configure https to use the Web server certificate.
  • For IIS 6.0 on Windows Server 2003: Edit the properties of the Web site that is being used by Configuration Manager (Default Web Site or SMSWEB), and select the Web server certificate to use by clicking Server Certificate on the Directory Security tab. This launches the Web Server Certificate Wizard, which prompts you to select the Web server certificate to use.
Note
SMSWEB is the name of the Web site if you are using a custom Web site for Configuration Manager 2007. For more information about using custom Web sites in Configuration Manager 2007, see Configuration Manager Custom Web Site Overview and How to Configure Custom Web Sites for Configuration Manager Sites.

See Also

Concepts

Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode)

Other Resources

Deploying the PKI Certificates Required for Native Mode


Deploying the Web Server Certificate to Network Load Balanced Site Systems

Network load balancing (NLB) management points and NLB software update points in a Configuration Manager 2007 native mode site require public key infrastructure (PKI) Web server certificates to authenticate the servers to clients and secure data using Secure Sockets Layer (SSL).

The process for deploying a Web server certificate for NLB management points and NLB software update points is identical to deploying Web server certificates for site system servers with the following addition:

  • A new Web server certificate must be created for the network load balancing cluster server, and it must be deployed in the same way as the other Web server certificates:
    • The Web server certificate must be installed on the network load balancing cluster server.
    • The default Web site on the network load balancing cluster server must be configured to use the Web server certificate.

See Also

Other Resources

Deploying the PKI Certificates Required for Native Mode


Deploying the Client Computer Certificates to Clients and the Management Point

Client computers in a Configuration Manager 2007 native mode site require public key infrastructure (PKI) computer certificates to authenticate them to the management point. Without this authentication, Configuration Manager 2007 clients in a native mode site are unmanaged and will send a status message to their fallback status point. Additionally, the management point requires a client certificate so that it can be monitored and send its status to the site server. If you are using the operating system deployment feature, the state migration point also requires a client certificate for monitoring purposes.

Important
The management point and state migration point requires a client certificate even if these site systems do not have installed on them the Configuration Manager 2007 client.

You can install the client computer certificates in a number of ways. Refer to your PKI documentation for more information. The recommended method if you are using a Microsoft PKI is to create the certificates using the version 1 (v1) computer template, or the version 2 (v2) client workstation template, and then automatically auto enroll the certificates to computers using Group Policy.

Other deployment methods include the following:

  • If you are using a Microsoft PKI with Web enrollment, you can request the certificate from each computer, using the Web enrollment pages.
  • If you are using a Microsoft PKI with an enterprise CA, you can use the Certificates Microsoft Management Console snap-in from each computer to import a certificate or request the certificate. Use the Request New Certificate task or Import task from the Personal certificate store on the local computer.
  • You can request and retrieve the certificate using the Microsoft Certreq command-line utility.
  • If you can create the certificate with your certificate management tools, you can export it and import it on each computer.
Note
If you are installing clients using the operating system deployment feature, a client certificate might be required to complete the deployment process. The certificate must be created and then exported to a .PFX file so that it can be imported in Configuration Manager 2007 when configuring the operating system deployment. For more information about this scenario, see How to Export Certificates For Use With Operating System Deployment.

See Also

Concepts

Certificate Requirements for Native Mode
Determine If You Need to Specify Client Certificate Settings (Native Mode)

Other Resources

Deploying the PKI Certificates Required for Native Mode
How to Manage Native Mode Certificates and Operating System Deployment


Deploying Certificates to Mobile Device Clients

Microsoft System Center Configuration Manager 2007 can be used to deploy certificates to mobile devices. Common scenarios for certificate deployment to mobile devices include the following:

  • Deploying root certificates and any required intermediate certification authority certificates for native mode or server authentication mode mobile device client installation
  • Deploying client certificates when migrating from mixed mode to native mode
  • Deploying certificates for third-party applications
  • Deploying the Configuration Manager 2007 site server signing certificate

Before deploying certificates, you must acquire exported certificates for your root certification authority and any intermediate certification authorities in the form of X.509 .cer files.

Configuration Manager 2007 can deploy certificates using the following methods:

  • Certificate Installation configuration item
  • Mobile device client installation or upgrade

For more information about certificate installation on mobile devices, see Deploying the PKI Certificates Required for Native Mode.

Deploying Certificate Using the Certificate Installation Configuration Item

Certificates can be deployed to Configuration Manager 2007 managed mobile device clients using the Certificate Installation configuration item. For more information about using the Configuration Items Wizard, see How to Create Configuration Items for Mobile Devices.

Certificate Stores on Mobile Devices

Windows Mobile devices include the following stores for certificates:

  • Root—The root certificates for the mobile device. Root stores are primarily used to validate that a presented certificate successfully chains to a trusted root authority. This store is not used for code execution. A copy of the site server signing certificate is stored here.
  • Software Publishing Certificate (SPC)—SPC certificates define the level of privilege for third-party software programs. There are two types of SPC certificates:
    • Privileged—Privileged certificates have manager rights on the mobile device and unrestricted access to the registry.
    • Unprivileged—Unprivileged certificates have restricted rights on the mobile device and cannot access certain portions of the registry.
  • Intermediate—Intermediate certificates authenticate an uninterrupted chain of authority to the root authority.

Deploying Certificates During Mobile Device Client Installation or Upgrade

The Configuration Manager 2007 mobile device client installation or upgrade process uses an enroller program to deploy certificates to mobile devices. For more information about certificates required by mobile devices in native mode, see About Native Mode Certificates for Mobile Device Clients.

Deploying certificates during mobile device client installation or upgrade requires the following:

  • If certificates are required and not already present on the mobile device, they can be deployed as part of the mobile device client installation. Include the .cer file or files in the mobile device management client deployment folder. These certificate files must be in Distinguished Encoding Rules (DER)-encoded binary X.509 format. Base64-encoded X.509 format is not supported for mobile devices. For more information, see How to Edit the DMCommonInstaller.ini File for Mobile Device Management or How to Edit the ClientSettings.ini File for Mobile Device Management.
  • A properly configured DMCommonInstaller.ini file or ClientSettings.ini file. Set ImportCerts=True in the DMCommonInstaller.ini file or ClientSettings.ini file. For more information, see How to Edit the DMCommonInstaller.ini File for Mobile Device Management or How to Edit the ClientSettings.ini File for Mobile Device Management.

For more information about mobile device client installation or upgrade, see How to Install or Upgrade the Mobile Device Management Client.

Certificate Values in DMCommonInstaller.ini and ClientSettings.ini

The DMCommonInstaller.ini and ClientSettings.ini files define values for certificate deployment and must be edited for your specific environment. The following are categories of values for deploying certificates to devices:

  • Certificate enroller
  • Importing certificates
  • Renewing the site server signing certificate

Certificate enroller values

The following values in the DMCommonInstaller.ini file or the ClientSettings.ini file are used to define certificate enrollment during client installation or upgrade. Define these values for the site environment if certificates are to be enrolled:

  • CertEnrollAction=Enroll
  • CertEnrollServer=certserver.contoso.com
  • CertEnrollServerPort=80
    Note
    HTTPS is not supported by the Configuration Manager 2007 mobile device certificate enroller.

  • CertRequestPage=/certsrv/certfnsh.asp
  • CertDownloadPage=/certsrv/certnew.cer
  • CertChainDownloadPage=/certsrv/certnew.p7b

If the CertEnrollAction value is Enroll, the enroller application (Enroll_ARM.exe, Enroll_WinCE5.0_x86.exe, or Enroll_WinCE5.0_ARM.exe) will check for a valid client authentication certificate on the mobile device in the personal store. If no client authentication certificate is found, the mobile device user will be prompted to authenticate and a client authentication certificate is enrolled in the personal store of the mobile device. Additional values in the DMCommonInstaller.ini file or ClientSettings.ini file define the parameters for the enrollment process. For more information, see How to Edit the DMCommonInstaller.ini File for Mobile Device Management or How to Edit the ClientSettings.ini File for Mobile Device Management.

Importing certificates values: ImportCerts

If the ImportCerts value in the DMCommonInstaller.ini file or ClientSettings.ini file is set to True, the setup program will import certificate files (.cer) located in the client transfer directory into the root store on the mobile device. This option is not required to set up native mode if the necessary certificates are already on the mobile device. Certificates to be imported must be in distinguished encoding rules (DER)-encoded binary X.509 format. Base64-encoded X.509 certificates are not supported.

Renewing site server signing certificates

The EnableSSSCRenewal value in the DMCommonInstaller.ini file or ClientSettings.ini file specifies whether a site server signing certificate should be downloaded and installed when a new certificate becomes available on the site server. If EnableSSCRenewal is set to false, the administrator will need to deploy an updated site server signing certificate manually.

See Also

Concepts

About Native Mode Certificates for Mobile Device Clients
Deploying the Intermediate Certification Authority Certificates to Configuration Manager Computers
How to Edit the ClientSettings.ini File for Mobile Device Management
How to Edit the DMCommonInstaller.ini File for Mobile Device Management
How to Install or Upgrade the Mobile Device Management Client

Other Resources

Certificate Installation Properties


Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2008 Certification Authority

Topic Last Updated—August 2008

This step-by-step example deployment, which uses a Windows Server 2008 certification authority (CA), contains procedures that guide you through the process of creating and deploying the public key infrastructure (PKI) certificates that Configuration Manager 2007 requires to operate in native mode. Native mode offers the highest level of security for a Configuration Manager 2007 site, and it is a requirement for Internet-based client management. For more information about native mode in Configuration Manager, see Benefits of Using Native Mode.

The procedures in this example refer to a Microsoft PKI solution, using an enterprise certification authority (CA) and certificate templates. The steps are appropriate for a test network only, as a proof of concept.

Because there is no single method of deployment for the required certificates, you will need to consult your particular PKI deployment documentation for the necessary procedures and best practices to deploy the required certificates for a production environment. For more information about the possible deployment methods, see Deploying the PKI Certificates Required for Native Mode.

Note
The use of a Microsoft PKI solution is recommended to support Configuration Manager 2007, but it is not required. Configuration Manager 2007 uses standard PKI certificates, supporting version 3 of the x.509 certificate format. If your existing PKI deployment can create, deploy, and manage the certificates that Configuration Manager 2007 requires for native mode, you can use your existing PKI infrastructure. Consult your PKI documentation for deployment details.

In This Section

This example contains the following sections, which cover creating and deploying the basic certificates that are required for a Configuration Manager 2007 site to operate in native mode for intranet connectivity:

Test Network Requirements

Overview

Deploying the Site Server Signing Certificate

Deploying the Web Server Certificate

Deploying the Client Certificate

Test Network Requirements

The example has the following requirements:

  • The test network is running Active Directory Domain Services with Windows Server 2008, and it is installed as a single domain, single forest.
  • You have a domain controller running Windows Server 2008 Enterprise Edition, which has installed on it the Active Directory Certificate Services role, and it is configured as an enterprise root certification authority (CA).
  • You have one computer that has Windows Server 2008 (Standard Edition or Enterprise Edition) installed on it and that is designated as a member server, and you have Internet Information Services (IIS) installed on it.
  • You have one Windows Vista client with the latest service pack installed, and this computer is configured with a computer name that comprises ASCII characters and is joined to the domain.
  • You can log in with a root domain administrator account or an enterprise domain administrator account and use this account for all procedures in this example deployment.

Overview

PKI certificates must be installed prior to configuring Configuration Manager 2007 to operate in native mode. This example does not include installing and configuring Configuration Manager 2007, but it provides the steps to provision computers with the certificates they require to operate in Configuration Manager 2007 native mode.

The following table lists the three types of PKI certificates that are required and describes how they are used in a native mode Configuration Manager 2007 site:

Certificate Requirement | Certificate Description
Site server signing certificate | This certificate is installed on the server that will be the Configuration Manager 2007 site server. It is used to sign client policies.
Web server certificate | This certificate is installed on servers that will be Configuration Manager 2007 site systems, with roles such as the management point and distribution point. It is used to encrypt data and authenticate the server to clients.
Client certificate | This certificate is installed on computers that will be Configuration Manager 2007 clients, and it is installed on the management point. It is used to authenticate the client to site systems; on the management point it is used to monitor the server's operational status.

For more information about the certificates, see Certificate Requirements for Native Mode.

Follow the steps in this example to achieve the following goals:

  • Provision the member server with a Configuration Manager 2007 site server signing certificate so that it can operate as a Configuration Manager 2007 site server in native mode.
  • Provision the member server with a Web server certificate so that it can operate as a Configuration Manager 2007 site system server in native mode that can run any of these Configuration Manager site system roles: management point, distribution point, software update point, and state migration point.
  • Provision a workstation and the member server with a client certificate so that the workstation can operate as a Configuration Manager 2007 native mode client, and so that the management point can report its status to the site server.

Deploying the Site Server Signing Certificate

This step has four procedures:

  • Creating and Issuing the Site Server Signing Certificate Template on the Certification Authority
  • Requesting the Site Server Signing Certificate for the Server That Will Run the Configuration Manager 2007 Site Server
  • Approving the Site Server Signing Certificate on the Certification Authority
  • Installing the Site Server Signing Certificate on the Server That Will Run the Configuration Manager 2007 Site Server

Creating and Issuing the Site Server Signing Certificate Template on the Certification Authority

To create and issue the site server signing certificate template

  1. On the domain controller running the Windows Server 2008 console, click Start, click Programs, click Administrative Tools, and then click Certification Authority.

  2. Expand the name of your certification authority (CA), and then click Certificate Templates.

  3. Right-click Certificate Templates, and then click Manage to load the Certificates Templates Console.

  4. In the results pane, right-click the entry that displays Computer in the Template Display Name column, and then click Duplicate Template.

  5. In the Duplicate Template dialog box, ensure that Windows 2003 Server, Enterprise Edition is selected, and then click OK.

    Important
    Do not select Windows 2008 Server, Enterprise Edition.

  6. In the Properties of New Template dialog box, on the General tab, enter a template name for the site server signing certificate template, such as ConfigMgr Site Server Signing Certificate.

  7. Click the Issuance Requirements tab, and then select CA certificate manager approval.

  8. Click the Subject Name tab, and then click Supply in the request.

  9. Click the Extensions tab, make sure Application Policies is selected, and then click Edit.

  10. In the Edit Application Policies Extension dialog box, select Client Authentication, press Shift and select Server Authentication, and then click Remove.

  11. In the Edit Application Policies Extension dialog box, click Add.

  12. In the Add Application Policy dialog box, select Document Signing as the only application policy, and then click OK.

  13. In the Properties of New Template dialog box, you should now see listed as the description of Application policies: Document Signing.

  14. Click OK, click OK to close the Properties of New Template, and then close the Certificate Templates Console.

  15. In the Certification Authority console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  16. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Site Server Signing Certificate, and then click OK.

    Note
    If you cannot complete steps 15 or 16, check that you are using the Enterprise Edition of Windows Server 2008. Although you can configure certificate templates with Windows Server Standard Edition and Active Directory Certificate Services, you cannot deploy certificates using modified certificate templates unless you are using the Enterprise Edition of Windows Server 2008.

  17. Do not close the Certification Authority console.

Requesting the Site Server Signing Certificate for the Server That Will Run the Configuration Manager 2007 Site Server

To request the site server signing certificate

  1. On the member server, create a folder to contain your certificate files.

  2. Open Notepad, or a similar text file of your choice. Copy and paste the following text into the file:

    Copy Code
    [NewRequest]
Subject = “CN=The site code of this site server is <site-code>”
MachineKeySet = True
[RequestAttributes]
CertificateTemplate = ConfigMgrSiteServerSigningCertificate

  3. Replace the text <site-code> with your own site code. For example, if your site code is A01, the line will become: Subject = “CN=The site code of this site server is A01”.

    Important
    Both the site code and the name of the template are case sensitive. Make sure that you specify the site code exactly as it appears in the Configuration Manager console, and that you specify the site server signing certificate template exactly as it appears as the Template name (not the Template display name) in the certificate template properties.

  4. Save the file with the name sitesigning.inf, and save it in the certificates folder that you created.

  5. Open a command window in the certificates folder that you created, type the following command, and then press Enter:

    certreq –new sitesigning.inf sitesigning.req

  6. Type the following command, and then press Enter:

    certreq –submit sitesigning.req sitesigning.cer

  7. You are prompted to select the issuing CA in the Select Certification Authority dialog box. Select the CA, and then click OK. When the certificate is issued, you see RequestId: <number> displayed, where <number> is the next sequential certificate request to the issuing CA. Make a note of this number.

  8. Do not close the command prompt.

Approving the Site Server Signing Certificate on the Certification Authority

To approve the site server signing certificate

  1. On the domain controller, in Certification Authority, click Pending Requests.

  2. In the results pane, you will see the requested certificate with the Request ID that was displayed with the last Certreq command.

  3. Right-click the requested certificate, click All Tasks, and then click Issue.

  4. Do not close the Certification Authority console.

Installing the Site Server Signing Certificate on the Server That Will Run the Configuration Manager 2007 Site Server

To retrieve and install the site server signing certificate

  1. On the member server, in the command window, type the following command, and then press Enter:

    certreq –retrieve <number> sitesigning.cer

    For example, if the request number previously displayed was 12, type: certreq –retrieve 12 sitesigning.cer

  2. You are prompted to select the issuing CA in the Select Certification Authority dialog box. Select the CA, and then click OK.

  3. Type the following command, and then press Enter:

    certreq –accept sitesigning.cer

The member server is now provisioned with a Configuration Manager 2007 site server signing certificate.

Deploying the Web Server Certificate

This step has four procedures:

  • Creating a Windows Security Group for the Site System Servers
  • Creating and Issuing the Web Server Certificate Template on the Certification Authority
  • Requesting the Web Server Certificate
  • Configuring IIS to Use the Web Server Certificate

Creating a Windows Security Group for the Site System Servers (Management Point, Distribution Point, Software Update Point, State Migration Point)

To create a Windows security group for the site system server

  1. On the domain controller, click Start, click Administrative Tools, and then click Active Directory Users and Computers.

  2. Right-click the domain, click New, and then click Group.

  3. In the New Object – Group dialog box, enter ConfigMgr IIS Servers as the Group name, and then click OK.

  4. In Directory Users and Computers, right-click the group you have just created, and then click Properties.

  5. Click the Members tab, and then click Add to select the member server.

    Note
    In our test environment, there is only one server to add. However, in a production environment, it is likely that various servers will host the Configuration Manager 2007 site systems that require certificates, such as the site's management point and distribution points. It is therefore good practice to assign permissions to a group and add the site systems that require the same type of certificate. Creating a security group for these servers enables you to assign permissions so that only these servers can use these certificates.

  6. Click OK, and then click OK again to close the group properties dialog box.

  7. Restart your member server (if running) so that it can pick up the new group membership.

Creating and Issuing the Web Server Certificate Template on the Certification Authority

To create and issue the Web server certificate template on the certification authority

  1. On the domain controller, while still running the Certification Authority console, right-click Certificate Templates and click Manage to load the Certificate Templates console.

  2. In the results pane, right-click the entry that displays Web Server in the column Template Display Name, and then click Duplicate Template.

  3. In the Duplicate Template dialog box, ensure that Windows 2003 Server, Enterprise Edition is selected, and then click OK.

    Important
    Do not select Windows 2008 Server, Enterprise Edition.

  4. In the Properties of New Template dialog box, on the General tab, enter a template name to generate the Web certificates that will be used on Configuration Manager site systems, such as ConfigMgr Web Server Certificate.

  5. Click the Subject Name tab, click Build from this Active Directory information is selected, and then select one of the following for the Subject name format:

    • Common name: Select this option if you will use fully qualified domain names for site systems in Configuration Manager (required for Internet-based client management, and recommended for clients on the intranet).
    • Fully distinguished name: Select this option if you will not use fully qualified domain names in Configuration Manager.

  6. Clear the option User principal name (UPN).

  7. Click the Security tab, and remove the Enroll permission from the security groups Domain Admins and Enterprise Admins.

  8. Click Add, enter ConfigMgr IIS Servers in the text box, and then click OK.

  9. Select the Enroll permission for this group, and do not clear the Read permission.

  10. Click OK, and close the Certificate Templates Console.

  11. In the Certification Authority console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  12. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Web Server Certificate, and then click OK.

  13. Do not close the Certification Authority console.

Requesting the Web Server Certificate

To request the Web server certificate

  1. Restart the member server to ensure it can access the certificate template with the configured permission.

  2. Click Start, click Run, and type mmc.exe. In the empty console, click File, and then click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, select Certificates from the list of Available snap-ins, and then click Add.

  4. In the Certificate snap-in dialog box, select Computer account, and then click Next.

  5. In the Select Computer dialog box, ensure Local computer: (the computer this console is running on) is selected, and then click Finish.

  6. In the Add or Remove Snap-ins dialog box, click OK.

  7. In the console, expand Certificates (Local Computer), and then click Personal.

  8. Right-click Certificates, click All Tasks, and then click Request New Certificate.

  9. On the Before You Begin page, click Next.

  10. On the Request Certificates page, select ConfigMgr Web Server Certificate from the list of displayed certificates, and then click Enroll.

  11. On the Certificates Installation Results page, wait until the certificate is installed, and then click Finish.

  12. Close Certificates (Local Computer).

Configuring IIS to Use the Web Server Certificate

To configure IIS to use the Web server certificate

  1. On the member server, click Start, click Programs, click Administrative Tools, and then click Internet Information Services (IIS) Manager.

  2. Expand Sites, right-click Default Web Site, and then select Edit Bindings.

  3. Click the https entry, and then click Edit.

  4. In the Edit Site Binding dialog box, select the certificate that you requested by using the ConfigMgr Web Server Certificates template, and then click OK.

    Note
    If you are not sure which is the correct certificate, select one, and then click View. This allows you to compare the selected certificate details with the certificates that are displayed with the Certificates snap-in. For example, the Certificates snap-in displays the certificate template that was used to request the certificate. You can then compare the certificate thumbprint of the certificate that was requested with the ConfigMgr Web Server Certificates template with the certificate thumbprint of the certificate currently selected in the Edit Site Binding dialog box.

  5. Click OK in the Edit Site Binding dialog box, and then click Close.

  6. Close Internet Information Services (IIS) Manager.

The member server is now provisioned with a Configuration Manager 2007 Web server certificate.

Deploying the Client Certificate

This step has three procedures:

  • Creating and Issuing the Workstation Authentication Certificate Template on the Certification Authority
  • Configuring Autoenrollment of the Workstation Authentication Template Using Group Policy
  • Automatically Enrolling the Workstation Authentication Certificate and Verifying Its Installation on Computers

Creating and Issuing the Workstation Authentication Certificate Template on the Certification Authority

To create and issue the Workstation Authentication certificate template on the certification authority

  1. On the domain controller, while still running the Certification Authority console, right-click Certificate Templates, and then click Manage to load the Certificate Templates management console.

  2. In the results pane, right-click the entry that displays Workstation Authentication in the column Template Display Name, and then click Duplicate Template.

  3. In the Duplicate Template dialog box, ensure that Windows 2003 Server, Enterprise Edition is selected, and then click OK.

    Important
    Do not select Windows 2008 Server, Enterprise Edition.

  4. In the Properties of New Template dialog box, on the General tab, enter a template name to generate the client certificates that will be used on Configuration Manager client computers, such as ConfigMgr Client Certificate.

  5. Click the Security tab, select the Domain Computers group, and select the additional permissions of Read and Autoenroll. Do not clear Enroll.

  6. Click OK and close Certificate Templates Console.

  7. In the Certification Authority console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  8. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Client Certificate, and then click OK.

  9. Close the Certification Authority console.

Configuring Autoenrollment of the Workstation Authentication Template Using Group Policy

To configure autoenrollment of the workstation authentication template using Group Policy

  1. On the domain controller, click Start, click Administrative Tools, and then click Group Policy Management.

  2. Navigate to your domain, right-click the domain, and then select Create a GPO in this domain, and Link it here.

    Note
    This step uses the best practice of creating a new Group Policy for custom settings rather than editing the Default Domain Policy that is installed with Active Directory Domain Services. By assigning this Group Policy at the domain level, you will apply it to all computers in the domain. However, on a production environment, you can restrict the autoenrollment so that it enrolls on only selected computers by assigning the Group Policy at an organizational unit level, or you can filter the domain Group Policy with a security group so that it applies only to the computers in the group. If you restrict autoenrollment, remember to include the server that is configured as the management point.

  3. In the New GPO dialog box, enter a name for the new Group Policy, such as Autoenroll Certificates, and click OK.

  4. In the results pane, on the Linked Group Policy Objects tab, right-click the new Group Policy, and then click Edit.

  5. In the Group Policy Management Editor, expand Policies under Computer Configuration, and then navigate to Windows Settings / Security Settings / Public Key Policies.

  6. Right-click the object type named Certificate Services Client – Auto-enrollment, and then click Properties.

  7. From the Configuration Model drop-down list, select Enabled, select Renew expired certificates, update pending certificates, and remove revoked certificates, select Update certificates that use certificate templates, and then click OK.

  8. Close Group Policy Management.

Automatically Enrolling the Workstation Authentication Certificate and Verifying Its Installation on Computers

To automatically enroll the workstation authentication certificate and verify its installation on the client computer

  1. Restart the workstation computer, and wait a few minutes before logging on.

    Note
    Restarting a computer is the most reliable method of ensuring success with certificate autoenrollment.

  2. Log on with an account that has administrative privileges.

  3. In the search box, type mmc.exe., and then press Enter.

  4. In the empty management console, click File, and then click Add/Remove Snap-in.

  5. In the Add or Remove Snap-ins dialog box, select Certificates from the list of Available snap-ins, and then click Add.

  6. In the Certificate snap-in dialog box, select Computer account, and then click Next.

  7. In the Select Computer dialog box, ensure that Local computer: (the computer this console is running on) is selected, and then click Finish.

  8. In the Add or Remove Snap-ins dialog box, click OK.

  9. In the console, expand Certificates (Local Computer), expand Personal, and then click Certificates.

  10. In the results pane, confirm that a certificate is displayed that has Client Authentication displayed in the Intended Purpose column, and that ConfigMgr Client Certificate is displayed in the Certificate Template column.

  11. Close Certificates (Local Computer).

  12. Repeat steps 1 through 11 for the member server to verify that the server that will be configured as the management point also has a client certificate.

The workstation and member server are now provisioned with a Configuration Manager 2007 client certificate.

See Also

Tasks

How to Migrate the Site Mode from Mixed Mode to Native Mode

Concepts

Administrator Workflow: Deploying the PKI Requirements for Native Mode
Administrator Checklist: Deploying the PKI Requirements for Native Mode
Benefits of Using Native Mode
Certificate Requirements for Native Mode
Overview of Internet-Based Client Management
Prerequisites for Native Mode


Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority

Topic Last Updated—August 2008

This step-by-step example deployment, which uses a Windows Server 2003 certification authority (CA), contains procedures that guide you through the process of creating and deploying the public key infrastructure (PKI) certificates that Configuration Manager 2007 requires to operate in native mode. Native mode offers the highest level of security for a Configuration Manager 2007 site, and it is a requirement for Internet-based client management. For more information about native mode in Configuration Manager, see Benefits of Using Native Mode.

The procedures in this example refer to a Microsoft PKI solution, using an enterprise certification authority (CA) and certificate templates. The steps are appropriate for a test network only, as a proof of concept.

Because there is no single method of deployment for the required certificates, you will need to consult your particular PKI deployment documentation for the necessary procedures and best practices to deploy the required certificates for a production environment. For more information about the possible deployment methods, see Deploying the PKI Certificates Required for Native Mode.

Note
The use of a Microsoft PKI solution is recommended to support Configuration Manager 2007, but it is not required. Configuration Manager 2007 uses standard PKI certificates, supporting version 3 of the x.509 certificate format. If your existing PKI deployment can create, deploy, and manage the certificates that Configuration Manager 2007 requires for native mode, you can use your existing PKI infrastructure. Consult your PKI documentation for deployment details.

In This Section

This example contains the following sections, which cover creating and deploying the basic certificates that are required for a Configuration Manager 2007 site to operate in native mode for intranet connectivity:

Test Network Requirements

Overview

Deploying the Site Server Signing Certificate

Deploying the Web Server Certificate

Deploying the Client Certificate

Test Network Requirements

The example has the following requirements:

  • The test network is running Active Directory Domain Services with Microsoft Windows Server 2003, and it is installed as a single domain, single forest.
  • You have a domain controller running Windows Server 2003 Enterprise Edition, Service Pack 1, which has the following items installed on it:
    • Group Policy Management Console
    • Internet Information Services (IIS)
    • Certificate Services installed as an enterprise root certification authority (CA)
    Note
    Ensure IIS is installed before installing Certificate Services so that Web enrollment is configured.

  • You have one computer that has Windows Server 2003 (Standard Edition or Enterprise Edition) Service Pack 1 installed on it and designated as a member server, and you have Internet Information Services (IIS) installed on it.
  • You have one Windows Professional XP client with the latest service pack installed, and this computer is configured with a computer name that comprises ASCII characters and it is joined to the domain.
  • You can log in with a root domain administrator account or an enterprise domain administrator account and use this account for all procedures in this example deployment.
Note
The Group Policy Management Console (GPMC) is the recommended add-on for managing Group Policy in Active Directory Domain Services. For more information on GPMC and to download the latest version, see the Web page "Enterprise Management with the Group Policy Management Console" (http://go.microsoft.com/fwlink/?LinkId=79386).

Overview

PKI certificates must be installed prior to installing Configuration Manager 2007 in native mode. This example does not include installing and configuring Configuration Manager 2007, but it provides the steps to provision computers with the certificates they require to operate in Configuration Manager 2007 native mode.

The following table lists the three types of PKI certificates that are required and describes how they are used in a native mode Configuration Manager 2007 site:

Certificate Requirement | Certificate Description
Site server signing certificate | This certificate is installed on the server that will be the Configuration Manager 2007 site server. It is used to sign client policies.
Web server certificate | This certificate is installed on servers that will be Configuration Manager 2007 site systems, with roles such as the management point and distribution point. It is used to encrypt data and authenticate the server to clients.
Client certificate | This certificate is installed on computers that will be Configuration Manager 2007 clients, and on the management point. It is used to authenticate the client to site systems, and on the management point it is used to monitor the server's health.

For more information about the certificates, see Certificate Requirements for Native Mode.

Follow the steps in this example to achieve the following goals:

  • Provision the member server with a Configuration Manager 2007 site server signing certificate so that it can operate as a Configuration Manager 2007 site server in native mode.
  • Provision the member server with a Web server certificate so that it can operate as a Configuration Manager 2007 site system server in native mode that can run any of these Configuration Manager site system roles: management point, distribution point, software update point, and state migration point.
  • Provision a workstation and the member server with a client certificate so that the workstation can operate as a Configuration Manager 2007 native mode client, and so that the management point can report its status to the site server.

Deploying the Site Server Signing Certificate

This step has four procedures:

  • Creating and Issuing the Site Server Signing Certificate Template on the Certification Authority
  • Requesting the Site Server Signing Certificate for the Server That Will Run the Configuration Manager 2007 Site Server
  • Approving the Site Server Signing Certificate on the Certification Authority
  • Installing the Site Server Signing Certificate on the Server That Will Run the Configuration Manager 2007 Site Server

Creating and Issuing the Site Server Signing Certificate Template on the Certification Authority

To create and issue the site server signing certificate template

  1. On the domain controller running the Windows Server 2003 console, click Start, Programs, Administrative Tools, Certification Authority.

  2. Expand the name of your certification authority (CA), and then click Certificate Templates.

  3. Right-click Certificate Templates, and click Manage to load the Certificates Templates management console.

  4. In the results pane, right-click the entry that displays Computer in the Template Display Name column, and then click Duplicate Template.

  5. In the Properties of New Template dialog box, on the General tab, enter a template name for the site server signing certificate template, such as ConfigMgr Site Server Signing Certificate.

  6. Click the Subject Name tab, and then click Supply in the request.

  7. Click the Extensions tab, make sure Application Policies is selected, and then click Edit.

  8. In the Edit Application Policies Extension dialog box, select Client Authentication, press Shift and select Server Authentication, and then click Remove.

  9. In the Edit Application Policies Extension dialog box, click Add.

  10. In the Add Application Policy dialog box, select Document Signing as the only application policy, and then click OK.

  11. In the Properties of New Template dialog box, you should now see listed as the description of Application Policies: Document Signing.

  12. Click the Issuance Requirement tab, and select CA certificate manager approval.

  13. Click OK and close the Certificate Templates administrator console, certtmpl – [Certificate Templates].

  14. In Certification Authority, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  15. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Site Server Signing Certificate, and then click OK.

    Note
    If you cannot complete steps 14 or 15, check that you are using the Enterprise Edition of Windows Server 2003. Although you can configure templates with Windows Server Standard Edition and Certificate Services, you cannot deploy certificates using modified certificate templates unless you are using the Enterprise Edition of Windows Server 2003.

  16. Do not close Certification Authority.

Requesting the Site Server Signing Certificate for the Server That Will Run the Configuration Manager 2007 Site Server

To request the site server signing certificate

  1. On the member server, load Internet Explorer and connect to the Web enrollment service with the address http://<server>/certsrv where <server> is the name or IP address of the Enterprise CA.

  2. On the Welcome page, select Request a certificate.

  3. On the Request a Certificate page, select Advanced certificate request.

  4. On the Advanced Certificate Request page, select Create and submit a request to this CA.

  5. On the Advanced Certificate Request page, specify the following:

    • Under the Certificate Template section, select ConfigMgr Site Server Signing Certificate for the Certificate Template.
      Note
      If you cannot see this certificate template displayed, check that you restarted the member server (if it was running) after you configured the security group in the earlier procedure.

    • Under the section Identifying Information for Offline Template, in the Name text box enter the following: The site code of this site server is <xxx>, where <xxx> is the site code of the site, and there is no punctuation at the end of the text string. It is very important that this exact wording is used, because this forms the certificate Subject name, which is used to identify the site server signing certificate.
    • Under the section Key Options, enable Store certificate in the local computer certificate store.
      Note
      If you do not see this option displayed, it is likely that you have installed the hotfix for KB 922706 to support Web enrollment for Windows Vista and Windows Server 2008. This hotfix removes the option to store an advanced certificate request in the computer store, so if this option is not available on your Web enrollment pages, you must use an alternative certificate deployment method for the site server signing certificate. For example, you can install the certificate into the user store and then export it and import it into the computer store, or you can use the command-line utility Certreq.exe to request the certificate. The Certreq.exe method is used in the following topic: Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2008 Certification Authority.

    • Under the section Additional Options, enter your choice for Friendly Name, such as ConfigMgr site server certificate.

  6. Click Submit.

  7. On the Certificate Pending page, you will see that your certificate request has been received but requires an administrator to issue the certificate. Make a note of the displayed Request ID.

  8. Do not exit Internet Explorer.

Approving the Site Server Signing Certificate on the Certification Authority

To approve the site server signing certificate

  1. On the domain controller, in Certification Authority, click Pending Requests.

  2. In the results pane, you will see the requested certificate with the Request ID that was displayed on the Web enrollment page.

  3. Right-click the requested certificate, click All Tasks, and then click Issue. Do not close Certification Authority.

Installing the Site Server Signing Certificate on the Server That Will Run the Configuration Manager 2007 Site Server

To install the site server signing certificate

  1. On the member server, on the Microsoft Certificate Services Web page, click Home on the top right side to return to the Welcome page.

  2. On the Welcome page, click View the status of a pending certificate request.

  3. On the View the Status of a Pending Certificate Request page, click the hyperlink that displays the friendly name you supplied for the site server signing certificate, and the date and time in parentheses it was requested.

  4. On the Certificate Issued Web page, click Install this certificate.

  5. If you are prompted with a Potential Scripting Violation warning message, click Yes.

  6. The final page should display that your new certificate has been successfully installed.

  7. Close Internet Explorer.

The member server is now provisioned with a Configuration Manager 2007 site server signing certificate.

Deploying the Web Server Certificate

This step has four procedures:

  • Creating a Windows Security Group for the Site System Servers
  • Creating and Issuing the Web Server Signing Certificate Template on the Certification Authority
  • Requesting the Web Server Certificate
  • Configuring IIS to Use the Web Server Certificate

Creating a Windows Security Group for the Site System Servers (Management Point, Distribution Point, Software Update Point, State Migration Point)

To create a Windows security group for the site system server

  1. On the domain controller, click Start, Programs, Administrative Tools, Active Directory Users and Computers.

  2. Right-click the domain, click New, and then click Group.

  3. In the New Object – Group dialog box, enter ConfigMgr IIS Servers as the Group name and then click OK.

  4. In Directory Users and Computers, right-click the group you have just created and then click Properties.

  5. Click the Members tab, and then click Add to select the member server.

    Note
    In our test environment, there is only one server to add. However, in a production environment, it is likely that various servers will host the Configuration Manager 2007 site systems that require certificates, such as the site's management point and distribution points. It is therefore good practice to assign permissions to a group and add the site systems that require the same type of certificate. Creating a security group for these servers enables you to assign permissions so that only these servers can use these certificates.

  6. Click OK, and then click OK again to close the group properties dialog box.

  7. Restart your member server (if running) so that it can pick up the new group membership.

Creating and Issuing the Web Server Signing Certificate Template on the Certification Authority

To create and issue the Web server signing certificate template on the certification authority

  1. On the domain controller, while still running the Certification Authority management console, right-click Certificate Templates, and then click Manage to load the Certificate Templates management console.

  2. In the results pane, right-click the entry that displays Web Server in the column Template Display Name, and then click Duplicate Template.

  3. In the Properties of New Template dialog box, on the General tab, enter a template name to generate the Web certificates that will be used on Configuration Manager site systems, such as ConfigMgr Web Server Certificate.

  4. Click the Subject Name tab, select Build from this Active Directory information, and then select one of the following for the Subject name format:

    • Common name: Select this option if you will use fully qualified domain names for site systems in Configuration Manager (required for Internet-based client management, and recommended for clients on the intranet).
    • Fully distinguished name: Select this option if you will not use fully qualified domain names in Configuration Manager.

  5. Click the Security tab, and remove the Enroll permission from the security groups Domain Admins and Enterprise Admins.

  6. Click Add, enter ConfigMgr IIS Servers in the text box, and then click OK.

  7. Select the following Allow permissions for this group: Read, Enroll, and Autoenroll.

  8. Click OK and close the Certificate Templates management console, certtmpl – [Certificate Templates].

  9. In the Certification Authority management console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  10. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Web Server Certificate, and then click OK.

  11. Close Certification Authority.

Requesting the Web Server Certificate

To request the Web server certificate

  1. Restart the member server to ensure it can access the certificate template with the configured permission.

  2. Click Start, click Run, and type mmc.exe. In the empty console, click File and then click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, click Add, click Certificates, and then click Add.

  4. In the Certificate snap-in dialog box, select Computer account and then click Next.

  5. In the Select Computer dialog box, ensure Local computer: (the computer this console is running on) is selected, and then click Finish.

  6. In the Add Standalone Snap-in dialog box, click Close.

  7. In the Add/Remove Snap-in dialog box, click OK.

  8. In the console that now displays Certificates (Local Computer), expand Certificates (Local Computer), and then expand Personal.

  9. Right-click Certificates, click All Tasks, and then click Request New Certificate.

  10. On the Welcome to the Certificate Request Wizard page, click Next.

  11. On the Certificate Types page, select ConfigMgr Web Server Certificate from the list of displayed certificates, and then click Next.

  12. On the Certificate Friendly Name and Description page, optionally enter a friendly name and description to help you identify this certificate, and then click Next.

  13. On the Completing the Certificate Request Wizard page, click Finish.

  14. You should see the Certificate Request Wizard dialog box informing you that the certificate request was successful.

  15. Close Certificates (Local Computer).

Configuring IIS to Use the Web Server Certificate

To configure IIS to use the Web server certificate

  1. On the member server, click Start, click Programs, click Administrative Tools, and then click Internet Information Services (IIS) Manager.

  2. Expand Web Sites, right-click Default Web Site, and then select Properties.

  3. Click the Directory Security tab, and then click Server Certificate.

  4. On the Welcome to the Web Server Certificate Wizard page, click Next.

  5. On the Server Certificate page, click Assign an existing certificate and then click Next.

  6. On the Available Certificates page, select the Web server certificate you have just requested, identifying it by the Intended Purpose field that has a value of Server Authentication and the Friendly Name you supplied, and then click Next.

  7. On the SSL Port page, accept the default port number of 443 and then click Next.

  8. On the Certificate Summary page, click Next.

  9. On the Completing the Web Server Certificate Wizard page, click Finish.

  10. Click OK to close the Default Web Site Properties.

  11. Close Internet Information Services (IIS) Manager.

The member server is now provisioned with a Configuration Manager 2007 Web server certificate.

Deploying the Client Certificate

This step has two procedures:

  • Configuring Autoenrollment of the Computer Template Using Group Policy
  • Automatically Enrolling the Computer Certificate and Verifying Its Installation on Computers

Configuring Autoenrollment of the Computer Template Using Group Policy

To configure autoenrollment of the computer template using Group Policy

  1. On the domain controller, click Start, click Administrative Tools, and then click Group Policy Management.

  2. Right-click the domain, and then select Create and Link a GPO Here.

    Note
    This step uses the best practice of creating a new Group Policy for custom settings rather than editing the Default Domain Policy that is installed with Active Directory Domain Services. By assigning this Group Policy at the domain level, you will apply it to all computers in the domain. However, on a production environment you can restrict the autoenrollment so that it enrolls on only selected computers by either assigning the Group Policy at an organizational unit (OU) level, or you can filter the domain Group Policy with a security group so that it applies only to the computers in the group. If you restrict autoenrollment, remember to include the server that is configured as the management point.

  3. In the New GPO dialog box, enter a name for the new Group Policy, such as Autoenroll Certificates, and then click OK.

  4. In the results pane, on the Linked Group Policy Objects tab, right-click the new Group Policy, and then click Edit.

  5. In the Group Policy Object Editor, navigate to Computer Configuration / Windows Settings / Security Settings / Public Key Policies.

  6. Right-click Automatic Certificate Request Settings, click New, and then click Automatic Certificate Request.

  7. In the Welcome to the Automatic Certificate Request Setup Wizard, click Next.

  8. On the Certificate Template page, select Computer from the list of available certificate templates, and then click Next.

  9. On the Completing the Automatic Certificate Request Setup Wizard page, click Finish.

  10. Close Group Policy Management.

Automatically Enrolling the Computer Certificate and Verifying Its Installation on Computers

To automatically enroll the computer certificate and verify its installation on the client computer

  1. Restart the workstation computer, and wait a few minutes before logging on.

    Note
    Restarting a computer is the most reliable method of ensuring success with certificate autoenrollment.

  2. Log on with an account that has administrative privileges.

  3. Click Start, click Run, and then type mmc.exe.

  4. In the empty management console, click File, and then click Add/Remove Snap-in.

  5. In the Add/Remove Snap-in dialog box, click Add, click Certificates, and then click Add.

  6. In the Certificate snap-in dialog box, select Computer account and then click Next.

  7. In the Select Computer dialog box, ensure Local computer: (the computer this console is running on) is selected and then click Finish.

  8. In the Add Standalone Snap-in dialog box, click Close.

  9. In the Add/Remove Snap-in dialog box, click OK.

  10. In the console that now displays Certificates (Local Computer), expand Certificates (Local Computer) and then click Personal.

  11. In the results pane, confirm a certificate is displayed that has Client Authentication displayed in the Intended Purpose field and Computer displayed in the Certificate Template field.

  12. Close Certificates (Local Computer).

  13. Repeat steps 1 through 12 for the member server to verify that the server that will be configured as the management point also has a client certificate.

The workstation and member server are now provisioned with a Configuration Manager 2007 client certificate.

See Also

Tasks

How to Migrate the Site Mode from Mixed Mode to Native Mode

Concepts

Administrator Checklist: Deploying the PKI Requirements for Native Mode
Administrator Workflow: Deploying the PKI Requirements for Native Mode
Benefits of Using Native Mode
Certificate Requirements for Native Mode
Overview of Internet-Based Client Management
Prerequisites for Native Mode
Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2008 Certification Authority


How to Extend the Active Directory Schema for Configuration Manager

Extending the Active Directory schema is a forest-wide action and must only be done once per forest. Extending the schema is an irreversible action and must be done by a user who is a member of the Schema Admins Group or by someone who has been delegated sufficient permissions to modify the schema. If you choose to extend the Active Directory schema, it may be done before or after setup.

While some Configuration Manager features are dependent on extending the schema, such as Network Access Protection in Configuration Manager and global roaming, there may be workarounds for not extending the schema to enable other Configuration Manager features. For more information about the affected features, and the workarounds for not extending the Active Directory schema for Configuration Manager 2007, see Decide If You Should Extend the Active Directory Schema.

Four actions need to be taken in order to successfully enable Configuration Manager clients to query Active Directory Domain Services to locate site resources:

  • Extend the Active Directory schema.
  • Create the System Management container.
  • Set security permissions on the System Management container.
  • Enable Active Directory publishing for the Configuration Manager site.

When extending the schema for Configuration Manager, several classes and attributes are added that any Configuration Manager site in the Active Directory forest can use. Because the global catalog is replicated throughout the forest, you must consider the network traffic that might be generated as a result. In Windows 2000 forests, extending the schema causes a full synchronization of the entire global catalog. For Windows 2003 forests, only the newly added attributes are replicated. You should plan to extend the schema during a time when the replication traffic will not adversely affect other network-dependent processes.

The Active Directory schema can be extended for Configuration Manager 2007 by running the ExtADSch.exe utility or by using the LDIFDE command-line utility to import the contents of the ConfigMgr_ad_schema.ldf LDIF file. Both the utility and the LDIF file are located in the SMSSETUP\BIN\i386 directory of the Configuration Manager 2007 installation files. Regardless of the method used to extend the schema, two conditions must be met:

  • The Active Directory schema must allow updates. On domains running Windows Server 2003, the schema is enabled for updates by default. For domains running Windows 2000 Server, you must manually enable updates on the schema master for the Active Directory forest.
  • The account used to update the schema must either be a member of the Schema Admins group or have been delegated sufficient permissions to modify the schema.
Note
It is recommended to use the ConfigMgr_ad_schema.ldf LDIF file to extend the Active Directory schema for Configuration Manager 2007. Using an LDIF file to extend the Active Directory schema instead of the ExtADSch.exe utility provides greater transparency about the changes being made to the Active Directory schema and also makes it easier to diagnose any problems encountered during the schema extension process.

See the following tasks for more information about extending the schema:

How to Extend the Active Directory Schema Using an LDIF File

How to Extend the Active Directory Schema Using ExtADSch.exe

How to Enable Schema Modifications for a Windows 2000 Server Domain

After the schema has been extended with the classes and attributes required for Configuration Manager, you must create the System Management container within the System container in the site server's domain partition in Active Directory Domain Services.

Because domain controllers do not replicate their System Management container to other domains in the forest, a System Management container must be created for each domain that hosts a Configuration Manager site.

Although each domain maintains its own System Management container in the domain partition, the Configuration Manager information is published to the global catalog for the forest. This makes the information for each site publishing to Active Directory available to every client in the forest regardless of domain membership. This is another reason that overlapping site boundaries are not recommended. See the following task for creating the System Management container:

How to Create the System Management Container in Active Directory Domain Services

After creating the System Management container, the primary site server’s computer account must be granted full control to the System Management container, and all of its child objects, in order to successfully publish information. See the following task for more information about setting security on the System Management container:

How to Set Security on the System Management Container in Active Directory Domain Services

When Configuration Manager site information is published to Active Directory Domain Services, Configuration Manager clients can automatically detect server locator points and management points without generating Windows Internet Name Service (WINS) traffic. If Configuration Manager site information is not published to Active Directory Domain Services, you must manually add Configuration Manager site role information in WINS. For more information about publishing Configuration Manager information to Active Directory Domain Services, see the following tasks:

How to Publish Configuration Manager Site Information to Active Directory Domain Services

How to Verify Site Information is Published to Active Directory Domain Services

How to Stop Publishing Site Information to Active Directory Domain Services

How to Manually Add Configuration Manager Site Information to WINS

See Also

Concepts

LDIF File for Extending the Active Directory Domain Services Schema for Configuration Manager

Other Resources

Configuration Manager Tasks for Deploying a Single Site


How to Extend the Active Directory Schema Using an LDIF File

Topic last updated -- November 2007

You can use the LDIFDE command-line utility to import directory objects into Active Directory® Domain Services using LDAP Data Interchange Format (LDIF) files.

For greater visibility of the changes being made to the Active Directory schema than the ExtAdSch.exe utility provides, you can use the LDIFDE utility to import schema extension information using the ConfigMgr_ad_schema.ldf file is included on the Configuration Manager installation media in the .\SMSSETUP\BIN\i386 directory.

Extending the Active Directory Schema for Configuration Manager Using the LDIFDE Command Line Utility

The following procedure can be used to extend the Active Directory schema for Configuration Manager by importing schema extension information stored in the ConfigMgr_ad_schema.ldf file using the LDIFDE command line utility.

Important
If the Active Directory schema has been previously extended for SMS 2003, use the second procedure in this topic before importing schema extension information using the LDIFDE command line utility.

To extend the Active Directory schema using the ConfigMgr_ad_schema.ldf file

  1. Create a backup of the schema master domain controller’s system state using the NTBACKUP utility.

  2. Disconnect the schema master domain controller from the network.

  3. Open the ConfigMgr_ad_schema.ldf file, located in the \SMSSETUP\BIN\I386 directory of the Configuration Manager 2007 installation files, and edit the file to define the Active Directory root domain to extend. All instances of the text DC=x in the file must be replaced with the full name of the domain to extend.

    For example, if the full name of the domain to extend is named widgets.microsoft.com then all references to DC=x in the file should be changed to DC=widgets, DC=microsoft, DC=com.

  4. Use the LDIFDE command-line utility to import the contents of the ConfigMgr_ad_schema.ldf file into Active Directory® Domain Services.

    For example, this command line will import the schema extensions into Active Directory Domain Services, turn on verbose logging, and create a log file during the import process:
    ldifde –i –f ConfigMgr_ad_schema.ldf –v –j <location to store log file>.

  5. To verify that the schema extension was successful, you can review the log file created by the command line used in step 3.

  6. If the extension procedure was successful, reconnect the schema master domain controller to the network and allow it to replicate the schema extensions to the global catalog servers throughout the Active Directory forest.

  7. If the schema extension procedure was not successful, restore the previous system state using the NTBACKUP utility to reverse the schema extension actions before reconnecting the schema master domain controller to the network.

    Note
    To restore the system state on a Microsoft Windows domain controller, the system must be restarted in Directory Services Restore Mode. For more information about Directory Services Restore Mode, see "Restart the domain controller in Directory Services Restore Mode locally" at http://go.microsoft.com/fwlink/?LinkId=75622.

Updating Previously Extended Active Directory Schema Extension Information

If the Active Directory schema was previously extended for SMS 2003 sites, you must modify the ConfigMgr_ad_schema.ldf file shipped with the Configuration Manager installation source files.

The modifications provided in this procedure will allow the following Configuration Manager management point object attributes to be added to the Active Directory schema successfully:

  • mSSMSCapabilities
  • mSSMSVersion
  • mSSMSSourceForest
Note
If the Active Directory schema was previously extended for SMS 2003, and the default ConfigMgr_ad_schema.ldf file was used to extend the Active Directory schema for Configuration Manager without these modifications, Configuration Manager 2007 client site assignment will fail. The Active Directory schema can be re-extended after modifying the ConfigMgr_ad_schema.ldf file to ensure all management point object attributes are added.

To upgrade existing SMS 2003 schema extensions using the ConfigMgr_ad_schema.ldf file

  1. In the ConfigMgr_ad_schema.ldf file supplied in the Configuration Manager installation source files, locate the section in the file beginning with the following text:

    Copy Code
    # ---------------------------------------------------------------------
# This section updates an existing MS-SMS-Management-Point class
# by adding four new attributes to the class.  This section
# should always succeed whether the Schema is already extended for SMS
# 2003 or if it is updated using this file.
# ---------------------------------------------------------------------

  2. Replace the following text from that section with the text provided in step 3 of this procedure.

    Copy Code
    dn: CN=MS-SMS-Management-Point,CN=Schema,CN=Configuration,DC=x
changetype: modify
add: mayContain
mayContain: mSSMSCapabilities
mayContain: mSSMSVersion
mayContain: mSSMSSourceForest
mayContain: dNSHostName
-

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1

  3. To allow the existing management point object information stored in the Active Directory schema to be extended for Configuration Manager, the following text should be used to overwrite the existing text in the ConfigMgr_ad_schema.ldf file that was shipped with the Configuration Manager installation source files and displayed in step 2 of this procedure:

    Copy Code
    dn: CN=MS-SMS-Management-Point,CN=Schema,CN=Configuration,DC=x
changetype: modify
add: mayContain
mayContain: dNSHostName
-

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

dn: CN=MS-SMS-Management-Point,CN=Schema,CN=Configuration,DC=x
changetype: modify
add: mayContain
mayContain: mSSMSCapabilities
mayContain: mSSMSVersion
mayContain: mSSMSSourceForest
-

dn:
changetype: modify
replace: schemaupdatenow

  4. Save the modified LDIF file and use it to update the existing SMS 2003 schema extensions using the LDIFDE utility.

See Also

Tasks

How to Extend the Active Directory Schema Using ExtADSch.exe

Concepts

LDIF File for Extending the Active Directory Domain Services Schema for Configuration Manager

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Extend the Active Directory Schema Using ExtADSch.exe

Topic last updated—May 2008

You can extend the Active Directory schema by running the ExtADSch.exe file located in the SMSSETUP\BIN\I386 folder on the Configuration Manager 2007 installation media. The ExtADSch.exe file does not display output when it runs; however, it does generate a log file in the root of the system drive called extadsch.log, which will indicate whether the schema update completed successfully or any problems were encountered while extending the schema.

When using ExtADSch.exe to extend the Active Directory schema for Configuration Manager, you should be aware of the following limitations.

  • It is not supported to run the ExtADSch.exe utility locally on Windows 2000–based computers. To extend the Active Directory schema locally on a Windows 2000–based computer, the ConfigMgr_ad_schema.ldf file should be used. For more information about extending the Active Directory schema for Configuration Manager using an .ldf file, see How to Extend the Active Directory Schema Using an LDIF File.
  • When extending the Active Directory schema by running ExtADSch.exe from a Windows Vista workstation, you must be logged in with an account with local administrator permissions on the workstation for the extadsch.log to be created in the root of the system drive.

To extend the Active Directory schema using ExtADSch.exe

  1. Create a backup of the schema master domain controller’s system state using the NTBACKUP utility. To start the NTBACKUP utility, click Start, click Run and type ntbackup.

  2. Ensure that you are logged on to the schema master domain controller with an account that is a member of the Schema Admins security group.

    Important
    You must be logged on as a member of the Schema Admins security group in order to successfully extend the schema. Running the ExtADSch.exe file using the Run As command to attempt to extend the schema using alternate credentials will fail.

  3. Disconnect the schema master domain controller from the network.

  4. Run extadsch.exe, located at \SMSSETUP\BIN\I386 on the installation media, to add the new classes and attributes to the Active Directory schema.

  5. Verify that the schema extension was successful by reviewing the extadsch.log located in the root of the system drive.

  6. If the schema extension procedure was successful, reconnect the schema master domain controller to the network and allow it to replicate the schema extensions to the global catalog servers throughout the Active Directory forest.

  7. If the schema extension procedure was unsuccessful, restore the schema master's previous system state from the backup created in step 1. This will reverse the schema extension actions before reconnecting the schema master domain controller to the network.

    Note
    To restore the system state on a Windows domain controller, the system must be restarted in Directory Services Restore Mode. For more information about Directory Services Restore Mode, see Restart the Domain Controller in Directory Services Restore Mode Locally http://go.microsoft.com/fwlink/?LinkId=75622

See Also

Tasks

How to Extend the Active Directory Schema Using an LDIF File

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Enable Schema Modifications for a Windows 2000 Server Domain

The schema is enabled for updates by default on Windows Server 2003 domains. For Windows 2000 Server domains, you must manually enable updates on the schema master for the Active Directory forest.

Enabling Schema Modifications for Windows 2000 Server Domains Using the Active Directory Schema MMC Snap-In

To enable schema modifications for Windows 2000 Server domains using the Active Directory Schema MMC snap-in

  1. At a command prompt, type regsvr32 schmmgmt.dll to register the schema snap-in. A success dialog box is displayed if the schema snap-in is registered successfully.

  2. On the taskbar, click the Start button, and then click Run.

  3. Type mmc, and then click OK.

  4. On the File menu, click Add/Remove Snap-in.

  5. Click Add.

  6. Under Snap-in, select Active Directory Schema, and then click Add.

  7. Click Close.

  8. Click OK.

  9. In the console tree, right-click Active Directory Schema, and then select Operations Master.

  10. Select the Schema may be modified on this Domain Controller check box, and then click OK.

  11. On the File menu, click Exit.

  12. Click No when prompted to save changes to the console.

Enabling Schema Modifications for Windows 2000 Server Domains Using the Registry Editor

Enabling schema modifications for Windows 2000 Server domains can also be done by editing the registry on the schema master domain controller computer for Windows 2000 Server domains. This procedure should only be performed on a domain controller that is running Windows 2000 Server and also holds the schema master role.

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority.

Caution
Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied.

To enable schema modifications for Windows 2000 Server domains using the Registry Editor

  1. Open the Registry Editor.

  2. In the Registry Editor, navigate to the Parameters registry key: HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/NTDS/Parameters

  3. On the Edit menu, click New, and then click DWORD Value.

  4. Type Schema Update Allowed, and then press ENTER.

  5. Double-click the Schema Update Allowed registry key that you just created, and in Value data, type 1 to enable schema changes.

  6. Close the Registry Editor.

See Also

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Create the System Management Container in Active Directory Domain Services

Configuration Manager does not automatically create the System Management container in Active Directory Domain Services when the schema is extended. The container needs to be created once for each domain that includes a Configuration Manager site server that will publish site information to Active Directory Domain Services.

Note
It is possible to grant the site server’s computer account full control permissions to the System container in Active Directory Domain Services and allow it to create the System Management container when it first publishes site information to Active Directory Domain Services. However, it is more secure to manually create the System Management container.

The ADSIEdit MMC console can be used to create the System Management container in Active Directory Domain Services. To create an ADSIEdit MMC console, you must first install the Windows Server support tools. These tools are included in the support tools folder on both Windows 2000 Server and Windows Server 2003 CDs. To install the Windows Server support tools, navigate to \SUPPORT\TOOLS\ on the installation CD and run suptools.msi.

To create the ADSIEdit MMC console

  1. On the taskbar, click Start, and then click Run.

  2. Type mmc and click OK.

  3. On the File menu, click Add/Remove Snap-in.

  4. Click Add.

  5. Under Snap-in, select ADSI Edit.

  6. Click Close.

  7. Click OK.

To manually create the System Management container

  1. Log on as an account that has the Create All Child Objects permission on the System container in Active Directory Domain Services.

  2. Open the ADSIEdit MMC console, and connect to the domain in which the site server resides.

  3. In the console pane, expand Domain [computer fully qualified domain name], expand <distinguished name>, and right-click CN=System. On the context menu, click New and then click Object.

  4. In the Create Object dialog box, select Container and click Next.

  5. In the Value field, type System Management and click Next.

  6. Click Finish.

See Also

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Set Security on the System Management Container in Active Directory Domain Services

After you have created the System Management container in Active Directory® Domain Services, you must grant the primary site server's computer account the permissions necessary to publish site information to the container.

Important
The primary site server computer account must be granted full control permissions to the System Management container and all of its child objects.

You can grant the necessary permissions by using the Active Directory Users and Computers administrative tool or the ADSIEdit MMC console.

Note
To open an ADSIEdit MMC console, you must first install the Microsoft Windows Server support tools. These tools are included in the support tools folder on both Windows 2000 Server and Windows Server 2003 CDs. To install the Windows Server support tools, navigate to \SUPPORT\TOOLS\ on the server's installation CD and run suptools.msi.

To apply permissions to the System Management container using the Active Directory Users and Computers administrative tool

  1. Click Start, click Run, and then enter dsa.msc to open the Active Directory Users and Computers administrative tool.

  2. Click View, and then click Advanced Features.

  3. Expand the System container.

  4. Right-click System Management. On the context menu, click Properties.

  5. In the System Management Properties dialog box, click the Security tab.

  6. Click Add to add the site server computer account and grant the account Full Control permissions.

  7. Click Advanced, select the site server’s computer account, and click Edit.

  8. In the Apply onto list, select This object and all child objects.

  9. Click OK.

To apply permissions to the System Management container using the ADSIEdit MMC console

  1. Click Start, click Run, and enter adsiedit.msc to launch the ADSIEdit MMC console.

  2. If necessary, connect to the site server's domain.

  3. In the console pane, expand the site server's domain, expand DC=<server distinguished name>, expand CN=System, and right-click CN=System Management. On the context menu, click Properties.

  4. In the CN=System Management Properties dialog box, click the Security tab.

  5. Click Add to add the site server computer account and grant the account Full Control permissions.

  6. Click Advanced, select the site server’s computer account, and click Edit.

  7. In the Apply onto list, select This object and all child objects.

  8. Click OK.

See Also

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Publish Configuration Manager Site Information to Active Directory Domain Services

Before Configuration Manager can publish site data to Active Directory Domain Services, the Active Directory schema must be extended to create the necessary classes and attributes, the System Management container must be created, and the primary site server’s computer account must be granted full control of the System Management container and all of its child objects. Each site publishes its own site-specific information to the System Management container within its domain partition in the Active Directory schema.

Note
During Configuration Manager primary site setup, the Active Directory schema is queried to determine if it has been extended for Configuration Manager. If the schema has been extended for Configuration Manager, the site will be automatically configured to publish site information and will publish site information to Active Directory Domain Services at the completion of setup. If the Active Directory schema has not been extended for Configuration Manager, the site will not be configured to publish site data to Active Directory Domain Services.

To enable a Configuration Manager site to publish site information to Active Directory Domain Services

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name>, and click Properties.

  3. On the Advanced tab of site properties, select the Publish this site in Active Directory Domain Services check box.

See Also

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Verify Site Information is Published to Active Directory Domain Services

To verify that site information is published to Active Directory® Domain Services after enabling a Configuration Manager site to publish site information, you can use the Active Directory Users and Computers administrative tool. To view the values associated with the individual Configuration Manager Active Directory classes and attributes, you can use the ADSIEdit MMC console.

Note
To open an ADSIEdit MMC console, you must first install the Microsoft Windows Server support tools. These tools are included in the support tools folder on both Windows 2000 Server and Windows Server 2003 CDs. To install the Windows Server support tools, navigate to \SUPPORT\TOOLS\ on the server's installation CD and run suptools.msi.

You can also verify that hierarchy manager has created the site code object by reviewing the hman.log file, and you can verify that site component manager has created the management point and server locator point information by reviewing the sitecomp.log file.

Verifying Site Information is Published to Active Directory® Domain Services Using the Active Directory Users and Computers Administrative Tool

To verify site information is published to Active Directory® Domain Services using the Active Directory Users and Computers Administrative tool.

  1. Click Start, Click Run, and enter dsa.msc to open the Active Directory Users and Computers administrative tool.

  2. Click View, and then click Advanced Features.

  3. In the console pane, expand the System container.

  4. Click the System Management container.

  5. In the details pane, verify that the site object and the management point and server locator point information has been published for each site in the domain that has publishing enabled:

    SMS-Site-xxx

    SMS-MP-<site code>-<site server name>

    SMS-SLP-<site code>-<site server name>

    Note
    If a site does not contain a site system hosting the management point or server locator point server roles, there will be no information published to Active Directory® Domain Services for those roles. For example, a secondary site with publishing enabled, but without a management point server role enabled, will publish only its site code object to Active Directory® Domain Services.

Verifying Site Information is Published to Active Directory® Domain Services Using the ADSIEdit MMC Console.

To verify creation of the site code object

  1. Click Start, click Run, and enter adsiedit.msc to launch the ADSIEdit MMC console.

  2. If necessary, connect to the site server's domain.

  3. In the console pane, expand the site server's domain, expand DC=<server distinguished name>, expand CN=System, and click CN=System Management.

  4. In the results pane, right-click CN=SMS-Site-xxx and click Properties.

  5. Verify that the following attributes appear:

Attribute Property | Syntax | Value
msSMSAssignmentSiteCode | Case-Insensitive String | <sitecode>
msSMSRoamingBoundaries | Case-Insensitive String | <ADsite or subnets>
msSMSSiteBoundaries | Case-Insensitive String | <ADsite or subnets>
msSMSSiteCode | Case-Insensitive String | <sitecode>
Note
If the site object is not published or contains incorrect data, review the hman.log file in the \sms\logs folder to identify the failure.

To verify creation of the management point information

  1. Click Start, click Run, and enter adsiedit.msc to launch the ADSIEdit MMC console.

  2. If necessary, connect to the site server's domain.

  3. In the console pane, expand the site server's domain, expand DC=<server distinguished name>, expand CN=System, and click CN=System Management.

  4. Verify that for each management point there is a
    CN=SMS-MP-<sitecode>-<management point computer name> object.

  5. Right-click CN=SMS-MP-<sitecode>-<default management point computer name> and click Properties.

  6. Verify that the following attributes appear:

Attribute Property | Syntax | Value
msSMSDefaultMP | Boolean | TRUE
msSMSMPName | Case-Insensitive String | <default management point computer name>
msSMSSiteCode | Case-Insensitive String | <sitecode>
Note
If you do not have an object published for each management point or if the information for the default management point is not correct, review the sitecomp.log file in the <ConfigMgrInstallDir>\logs folder to identify the failure.

To verify creation of the server locator point information

  1. Click Start, click Run, and enter adsiedit.msc to launch the ADSIEdit MMC console.

  2. If necessary, connect to the site server's domain.

  3. In the console pane, expand the site server's domain, expand DC=<server distinguished name>, expand CN=System, and click CN=System Management.

  4. Verify that for each server locator point there is a
    CN=SMS-SLP-<sitecode>-<server locator point computer name> object.

  5. Right-click CN=SMS-SLP-<sitecode>-<server locator point computer name> and click Properties.

  6. Verify that the following attributes appear:

Attribute Property | Syntax | Value
msSMSMPName | Case-Insensitive String | <default management point computer name>
msSMSSiteCode | Case-Insensitive String | <sitecode>
Note
If you do not have an object published for the server locator point or if the information for the server locator point is not correct, review the sitecomp.log file in the \sms\logs folder to identify the failure.

See Also

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Stop Publishing Site Information to Active Directory Domain Services

Topic Last Updated—August 2008

Any existing Configuration Manager objects in Active Directory Domain Services are not automatically removed by Configuration Manager when the site stops publishing site data. The objects need to be removed manually. Failure to remove Configuration Manager objects from Active Directory Domain Services can cause problems for client auto-assignment and roaming. To determine site information published to Active Directory Domain Services, see How to Verify Site Information is Published to Active Directory Domain Services.

To stop a Configuration Manager site from publishing site data to Active Directory Domain Services

  1. In the Configuration Manager console, navigate to System Center Configuration Manager \ Site Database\ Site Management\<server name>.

  2. Right click <site name>, and select Properties.

  3. From the site properties Advanced tab, clear the Publish this site in Active Directory Domain Services check box.

  4. Click OK to close the site properties dialog box.

See Also

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Start the Setup Prerequisite Checker

The prerequisite checker program is run automatically during Configuration Manager 2007 Setup Wizard site installations. It can be run stand-alone from either the Configuration Manager 2007 Setup autorun screen, during a scripted installation or from a command prompt.

Starting the Prerequisite Checker From the Autorun Screen

You can start the prerequisite checker from the Configuration Manager 2007 Setup autorun screen by clicking the Start prerequisite checker option. When this option is selected, you can configure the prerequisite checker to check prerequisites that only apply to your specific setup scenario by selecting Primary site, Secondary site, Administrator console or Upgrade. When Primary site is selected, you can also enter the name of the remote SQL Server to host the site database and management point computer (if applicable). You can also check all secondary sites below a primary site for Configuration Manager 2007 Setup prerequisites by selecting the All Secondary sites option.

Starting the Prerequisite Checker from a Command Prompt

The prerequisite checking program can be run either from within the Setup wizard, during a scripted installation or stand-alone from a command prompt using the following Setup command line syntax:

Note
The user account running the prerequisite checker must have administrative rights to the secondary site computer when secondary sites are checked for Configuration Manager 2007 Setup prerequisites.

Command line syntax When used

Setup.exe /prereq

To verify prerequisites when upgrading.

Setup.exe /prereq /nouserinput

Closes prerequisite check user interface when prerequisite checking has completed.

Note
The /nouserinput command line switch can be used at the end of all supported prerequisite commands.

Setup.exe /prereq /pri /sql <Sql server name>

To verify prerequisites when installing a new primary site. These options will verify that the primary site server computer, and SQL Server meet installation prerequisites.

Setup.exe /prereq /pri /sql <Sql server name> /mp <MP server name>

To verify prerequisites when installing a new primary site. These options will verify that the primary site server computer, SQL Server, and management point computer meet installation prerequisites.

Setup.exe /prereq /sec

To verify prerequisites when installing a secondary site.

Setup.exe /prereq /allsec

To verify prerequisites on all attached secondary sites of a primary site when preparing to upgrade the secondary sites.

Setup.exe /prereq /ui

To verify prerequisites when installing a new Configuration Manager console.

See Also

Concepts

Prerequisites for Installing Configuration Manager
Setup Prerequisite Checks


How to Deploy a Site Using Simple Setup

Topic last updated -- November 2007

The simple setup installation option installs a Configuration Manager 2007 primary site in mixed mode, and it configures a single computer to host all the necessary site server roles for basic site operations. In most cases, simple setup should be used for evaluation purposes only.

To deploy a site using simple setup

  1. Before running setup, ensure that you have properly prepared your computing environment to install Configuration Manager. If you are planning to deploy the site in native mode, ensure you have deployed the necessary certificates before starting Configuration Manager Setup. Fore more information about deploying the certificates required for native mode sites, see Deploying the PKI Certificates Required for Native Mode. For more information about Configuration Manager prerequisites, see Prerequisites for Installing Configuration Manager.

  2. Select Configuration Manager 2007 from the autorun screen, or start Setup.exe, from the Configuration Manager installation media or from a copy of the installation media located on a network share or other storage media to start the Configuration Manager Setup Wizard.

  3. Click Next on the Welcome page.

  4. On the Available Setup Options page, select the Install a Configuration Manager site server option.

  5. Agree to the licensing terms on the License Agreement page.

  6. On the Installation Settings page, select to install Configuration Manager using Simple Settings.

  7. On the Customer Experience Improvement Program page, you must choose a participation selection.

  8. On the Configuration Manager Product Key page, you must enter a valid product key.

  9. On the Site Information page, enter a valid site code and site name.

  10. On the Updated Prerequisite Components page, select the appropriate option for obtaining client prerequisite component files. Files can either be downloaded as part of Setup, an alternate location where the client prerequisite component files have already been downloaded to can be used.INCLUDE c:\\smsopalus\\us\\print\\getstart\\art\\artmanuscript\\SMS_art06.doc art_sms_f14_eps \!

  11. On the Updated Prerequisite Component Path page, specify the path to store client prerequisite component files downloaded during Setup or the path to the alternate location where client prerequisite component files have previously been downloaded to.

    Note
    The Setup command line option Setup /download <path to files> can be used to download client prerequisite component files without running the complete Configuration Manager Setup wizard.

  12. On the Settings Summary page, review the summary details for the installation before continuing. To make changes to any details, click Previous until you return to the page in the wizard where you set the detail. Once you are finished, return to the Summary page.

  13. When prerequisite checking has completed, review any messages in the results pane of the Prerequisite Check page to verify that all prerequisites have been met or that Configuration Manager Setup can resolve any prerequisites that have not been met for installation to continue. If Configuration Manager Setup cannot resolve issues found, review the ConfigMgrPrereq.log file located in the root of the system drive for more information about how to resolve any issues manually. When all discovered prerequisite check failures have been resolved, return to the Prerequisite Check page and re-run the setup prerequisites check.

    Important
    Configuration Manager Setup cannot continue until all prerequisite checks have completed with no errors.

  14. Review the installation steps on the Installation Status page to verify the actions taken and their status as Configuration Manager is installing.

  15. The Completion page displays whether or not the installation was successful and the details of the primary site installation as well as the options to view the setup log file (ConfigMgrSetup.log) and launch the Configuration Manager console.

See Also

Concepts

Configuration Manager Site Modes
Configuration Manager Site Naming
Setup Prerequisite Checks
Simple Setup Overview


How to Deploy a Site Using Custom Setup

Topic last updated -- November 2007

The custom setup installation option allows you to customize all the setup options available depending on the type of installation you have selected.

To deploy a site using custom setup

  1. Before running setup, ensure that you have properly prepared your computing environment to install Configuration Manager. If you are planning to deploy the site in native mode, ensure that you have deployed the necessary certificates before starting Configuration Manager Setup. For more information about the certificate requirements, see Certificate Requirements for Native Mode. For more information about Configuration Manager prerequisites, see Prerequisites for Installing Configuration Manager.

  2. Select Configuration Manager 2007 from the autorun screen (splash.hta), or start Setup.exe, from the Configuration Manager installation media, or from a copy of the installation media located on a network share or other storage media to start the Configuration Manager Setup Wizard.

  3. Click Next on the Welcome page.

  4. On the Available Setup Options page, select the Install a Configuration Manager Site Server option.

  5. Agree to the licensing terms on the License Agreement page.

  6. On the Installation Settings page, select the Custom Settings option.

  7. On the Site Type page, select Primary site.

  8. On the Customer Experience Improvement Program page, select a participation selection.

  9. On the Configuration Manager Product Key page, you must enter a valid product key.

  10. On the Destination Folder page, choose whether to accept the default, or specify an alternate installation directory for Configuration Manager program files.

  11. On the Site Settings page, enter a valid, and unique in the hierarchy, site code and site name.

  12. On the Configuration Manager Site Mode page, select the mode that the site will operate in after installation has completed.

    Note
    If you select native mode, you must also select a site server signing certificate.

  13. On the Configuration Manager Client Agents page, select the client agents to enable, with their default settings.

  14. On the Configuration Manager Database Server page, specify the Microsoft SQL Server NetBIOS name and database name or instance for setup to install the site database. The site database can be installed on a locally configured SQL Server instance on the site server, on a remote computer running SQL Server, or on a remote, clustered virtual SQL Server instance.

  15. On the SMS Provider Settings page, enter the NetBIOS name of the computer to install the SMS Provider on. The SMS Provider can be installed on the site server, on a remote computer running SQL Server and hosting the site database (except for clustered SQL Server instances), or on a third computer.

  16. On the Configuration Manager Management Point page, choose whether or not to install a management point during setup. The management point can be installed on the site server itself or on a remote server. If you choose to install a management point, you must specify the NetBIOS name of the server to install the management point site system role on.

  17. On the Configuration Manager Port Settings page, specify whether to use the default or an alternate port to be used for client-to-site-system communications.

    Note
    When specifying alternate ports for client-to-site-system communication, you must select an appropriate TCP/IP protocol for the site mode previously selected on the Configuration Manager Site Mode page. If you select to install the site in mixed mode, you must specify an http port. If you select to install the site in native mode, you must specify an https port.

  18. On the Updated Prerequisite Components page, select the appropriate option for obtaining client prerequisite component files. Files can either be downloaded as part of Setup, an alternate location where the client prerequisite component files have already been downloaded to can be used.

  19. On the Updated Prerequisite Component Path page, specify the path to store client prerequisite component files downloaded during Setup or the path to the alternate location where client prerequisite component files have previously been downloaded to.

    Note
    The Setup command line option Setup /download <path to files> can be used to download client prerequisite component files without running the complete Configuration Manager Setup wizard.

  20. On the Settings Summary page, review the summary details for the site installation before continuing. To make changes to any details, click Previous until you return to the page in the wizard where you set the detail. After making any necessary changes, return to the Summary page.

  21. When prerequisite checking has completed, review any messages in the results pane of the Prerequisite Check page to verify that all prerequisites have been met or that Configuration Manager Setup can resolve any prerequisites that have not been met for installation to continue. If Configuration Manager Setup cannot resolve issues found, review the ConfigMgrPrereq.log file located in the root of the system drive for more information about how to resolve any issues manually. When all discovered prerequisite check failures have been resolved, return to the Prerequisite Check page and re-run the setup prerequisites check.

    Important
    Configuration Manager Setup cannot continue until all prerequisite checks have completed with no errors.

  22. Review the installation steps on the Installation Status to verify the actions taken and their status as Configuration Manager is installing.

  23. The Completion page displays whether or not the installation was successful and the details of the primary site installation as well as the options to view the setup log file (ConfigMgrSetup.log) and launch the Configuration Manager console.

See Also

Concepts

Configuration Manager Site Modes
Configuration Manager Site Naming
Setup Prerequisite Checks
Simple Setup Overview
Prerequisites for Installing Configuration Manager

Other Resources

Deploying the PKI Certificates Required for Native Mode


How to Deploy a Site Using Scripted Installation Methods

Before you perform an unattended Configuration Manager 2007 installation, you should ensure that you have properly prepared your computing environment according to the Configuration Manager 2007 supported configurations. For more information about Configuration Manager 2007 supported configurations, see Configuration Manager Supported Configurations. Configuration Manager 2007 requires that you preinstall Microsoft SQL Server 2005. See your SQL Server documentation for more information.

Note
Unattended setup using the /Script setup command-line option is supported only for new installations of primary sites, secondary sites, or Configuration Manager consoles.

To deploy a site using scripted installation methods

  1. Use a text editor, such as Notepad.exe, to create an initialization file. The file name is not significant as long as it is in the format <filename>.ini. For example, you could create a file that is named ConfigMgrUnattend.ini.

  2. Customize the initialization file for your specific setup requirements.

  3. Open a command prompt, and navigate to the directory where Setup.exe is located. Setup.exe is located in the SMSSetup\Bin\I386 directory on the Configuration Manager 2007 installation media. To open a command prompt, click Start, click Run, type cmd in the Run Dialog Box, and then click OK. Alternatively, you could use a batch file (.bat) to launch Setup.exe using the /Script command-line option.

  4. At the command prompt, or from within a batch file, run Setup.exe using the /Script command-line option and specify the path to the initialization file that you created. For example, if you named your setup initialization file ConfigMgrUnattend.ini and saved it in the C:\temp directory of the computer you are running setup on, the command would look like this: Setup /script C:\temp\ConfigMgrUnattend.ini

  5. Review the ConfigMgrSetup.log file, located in the root of the system drive, after installation has completed to verify successful installation, or look for possible causes for installation failures.

See Also

Concepts

Unattended Setup Overview

Other Resources

Scripted Installation Examples


How to Verify Successful Site Installation

After you install Configuration Manager 2007, apply a service pack (or upgrade a site), or perform a site reset, you can check the Configuration Manager 2007 setup log file (ConfigMgrSetup.log) located at the root of the system drive for the string Configuration Manager Setup completed successfully. This entry indicates that Configuration Manager 2007 Setup successfully completed the required installation tasks. However, this does not necessarily mean that other Configuration Manager 2007 processes have completed their own tasks associated with setup or site reset. To review installation tasks performed by site component manager, after initial Setup tasks have completed, you can review the ComponentSetup.log file located at the root of the system drive. In addition, the following logs, located in the <ConfigMgr install directory>\logs directory, should also be reviewed for specific activity:

Sitecomp.log

This log verifies that Configuration Manager 2007 components have been installed (or in the case of a site reset, were reinstalled) successfully.

Inboxmgr.log

This log verifies that inboxes have been successfully created on the Configuration Manager 2007 site server and the management point.

Procedures

To verify Configuration Manager components have been installed correctly by reviewing the Sitecomp.log file

  1. Search for Processing site shutdown transaction. In the case of a site reset, this entry represents the first occurrence of the site being shut down. Subsequent lines in the log indicate that other individual services were stopped and status messages were generated to indicate that the service stopped.

  2. Search for Site shutdown complete. In the case of a site reset, this entry represents the first occurrence of the site shut down having completed. This should have occurred when the update installation signaled Configuration Manager 2007 to perform the site reset. Subsequent lines in the log indicate that other individual services were being reinstalled. This might take several minutes to complete.

  3. Search for Waiting for changes to the “<ConfigMgr install directory>\Inboxes\Sitectrl.box” or “<ConfigMgr install directory>\Inboxes\Sitecomp.box” directories. This entry indicates that Site Component Manager has completed its work for the site installation or reset.

 To verify that site information has been published to Active Directory Domain Services by reviewing the Hman.log file

  1. Search for Wait for site control changes for maximum 3600 seconds. This entry indicates that Hierarchy Manager has completed its work for the site installation or reset.

  2. In the lines previous to this entry, you should see entries related to publishing Configuration Manager 2007 site data to Active Directory Domain Services (if the Active Directory schema has been extended for Configuration Manager 2007 and the site is configured to publish site data to Active Directory Domain Services).

 To verify the successful creation of inboxes by reviewing the Inboxmgr.log file

  • Search for Waiting for changes inbox definition, inbox rules and inbox replication files, max wait = 3600 seconds. This entry indicates that Configuration Manager 2007 Inbox Manager has completed its work for the site installation or reset.


How to Install a Management Point

Microsoft System Center Configuration Manager 2007 sites that have clients assigned to them must have a management point to enable client communication. The management point is the primary point of contact between Configuration Manager clients and the site server. Management points can provide clients with installation prerequisites, client installation files, configuration details, advertisements, and software distribution package source file locations. Additionally, management points receive inventory data, software metering information, and status and state messages from clients.

Regardless of the number of management point site system roles installed on site systems within a site, clients will only communicate with either the default management point (intranet clients) or their assigned management point (Internet based clients).

Note
Multiple site systems hosting the management point site server role can be configured with the Windows Network Load Balancing (NLB) Service to provide high availability, and then designated as the default management point for the site.

Important
You must download, install, and configure WebDAV manually on management points running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

To install a management point

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. Right-click <site system name>, and click New Roles to start the New Site Systems Role Wizard.

  3. On the General tab, you have the options to do the following:

    • Specify a Fully Qualified Domain Name (FQDN) for intranet-based clients to communicate with this site system. This configuration is recommended, but not required.
    • Specify a Fully Qualified Domain Name (FQDN) for Internet-based clients to communicate with this site system. This option is required for supporting Internet-based client systems.
    • Select the account to install the site system files. The site server machine account is used if a Windows domain user account is not specified.
    • Enable the site system as a protected site system (responding to client requests only from specifically configured site boundaries).
    • Configure communication between the site system and site server to be initiated only by the site server.

  4. On the System Role Selection page, select Management point.

    Note
    If there is no default management point defined for the site, you can configure the new management point as the default management point for the site by clicking Yes on the Default Management Point Configuration dialog box.

  5. On the Management Point page, you can configure the new management point site system to support device clients. If the site is in native mode, you can specify whether the management point will support Internet-based clients, or both intranet and Internet-based client connections (management point site systems in native mode sites require a Web server signing certificate). This page is also used to specify whether the management point will use the site database or a site database replica when querying for site database information. Additionally, you can specify the Management Point Connection Account. This account is used by the management point to access site database information and can either be the management point computer account (default) or a domain user account in the form of Domain\User.

    Important
    The management point connection account must be configured to use a domain user account if the management point needs to access a site database in a different domain, whether or not the domain is in the same Active Directory forest as the site database server.

  6. On the Summary page, review the settings for the site system and the roles assigned to the site system before continuing. To make changes to any settings or site roles assigned to the site system, click Previous until you return to the page in the wizard where you set the detail. Once you are finished, return to the Summary page. To begin site system role installation, click Next.

  7. The Progress page displays the progress of saving the site system settings to the site server.

  8. The Confirmation page displays whether or not the site system settings were successfully saved in the site database.

See Also

Tasks

How to Configure the Default Management Point for a Site
How to Configure Network Load Balancing for Configuration Manager Site Systems

Other Resources

Deploying the PKI Certificates Required for Native Mode
How to Configure SQL Server Site Database Replication


How to Manually Add Configuration Manager Site Information to WINS

If you do not extend the Active Directory schema for Configuration Manager, or you do not enable publishing site data to Active Directory Domain Services, your site's clients will not be able to query Active Directory Domain Services for the services these servers provide. The default management point computer will register automatically in Windows Internet Name Service (WINS) if it is available, but you must manually register the server locator point and any management points operating in a Network Load Balancing (NLB) cluster in WINS.

Note
Management points are automatically registered in WINS with the entry MP_sitecode and 1A as the ending character. One server locator point can be registered as SMS_SLP with 1A as the ending character. Registering more than one server locator point requires extending the Active Directory schema.

Adding Server Locator Point Information to WINS

To manually add the server locator point entry to WINS

  1. Click Start, click Run, type cmd in the Run Dialog Box and then click OK.

  2. At the command prompt, type netsh, and then press Enter.

  3. Type wins, and then press Enter.

  4. Type server, and then press Enter. To manage a remote WINS server, type server <\\servername or XXX.XXX.XXX.XXX>.

  5. Type the appropriate command, as in the following example:

add name Name=SMS_SLP endchar=1A rectype=0 ip={<server locator point IP address>}

To verify that the server locator point entry was added correctly to WINS

  1. Click Start, click Run, enter cmd in the Run dialog box and then click OK.

  2. At the command prompt, type netsh, and then press Enter.

  3. Type wins, and then press Enter.

  4. Type server, and then press Enter. To manage a remote WINS server, type server <\\servername or XXX.XXX.XXX.XXX>.

  5. Type the appropriate command, as in the following example:

show name Name=SMS_SLP endchar=1A

Adding Management Point Network Load Balancing (NLB) Cluster Information to WINS

Management points are automatically registered in WINS. However, if you are using a Network Load Balancing cluster, you must manually add the WINS entry.

To manually add the Network Load Balancing cluster entry to WINS

  1. Click Start, click Run, enter cmd in the Run dialog box and then click OK.

  2. At the command prompt, type netsh, and then press Enter.

  3. Type wins, and then press Enter.

  4. Type server, and then press Enter. To manage a remote WINS server, type server <\\servername or XXX.XXX.XXX.XXX>.

  5. Type the appropriate command, as in the following example:

add name name=NLB_<site code > endchar=1A rectype=0 ip={<NLB virtual IP Address>}

To verify that the Network Load Balancing cluster entry was added correctly to WINS

  1. Click Start, click Run, enter cmd in the Run dialog box and then click OK.

  2. At the command prompt, type netsh, and then press Enter.

  3. Type wins, and then press Enter.

  4. Type server, and then press Enter. To manage a remote WINS server, type server <\\servername or XXX.XXX.XXX.XXX>.

  5. Type the appropriate command, as in the following example:

show Name name=NLB_<site code> endchar=1A

The output is as follows:

Name : NLB_<site code> [1Ah]

NodeType : 1

State : ACTIVE

Expiration Date : Infinite

Type of Rec : UNIQUE

Version No : 0 29c

RecordType : STATIC

IP Address : NLB Virtual IP Address

Command completed successfully.

See Also

Other Resources

Configuration Manager Tasks for Deploying a Single Site


How to Install Configuration Manager Using a Remote SQL Server

Depending on your environment or deployment considerations, it might be necessary to use a remote server running Microsoft SQL Server 2005 to host the site database. It is possible to select a remote SQL Server instance to host the site database during Configuration Manager 2007 custom setup. When selecting a remote SQL Server instance to host the site database during setup, the site database is created by setup using the default values for SQL Server 2005.

Note
During Configuration Manager 2007 Setup, the Volume Shadow Copy Service (VSS) writer will be installed on the remote SQL Server computer to support the Backup Site Server maintenance task.

To install Configuration Manager using a remote SQL Server

  1. Add the machine account of the primary site server machine to the local Administrators group of the remote SQL Server computer. This is required to allow the site server to install and configure settings later.

  2. If the user account running Configuration Manager Setup does not have administrative rights on the remote SQL Server, you must assign the sysadmin SQL Server role to the user account in the SQL Server 2005 Management Studio console on the remote SQL Server computer.

  3. Start Configuration Manager Setup, and select to install Configuration Manager using custom settings.

  4. On the Configuration Manager Database Server page of the Configuration Manager Setup Wizard, enter the NetBIOS name of the remote SQL Server and instance name to host the site database, and the name for the site database to be created on that server by setup.

To verify that the site database was installed successfully

  1. Verify that Configuration Manager 2007 Setup completed successfully by reviewing the ConfigMgrSetup.log file located at the root of the system drive on the primary site server computer.

  2. In the SQL Server 2005 Management Studio console, verify that the site database was created successfully.

  3. In the SQL Server 2005 Management Studio console, verify that the following roles were created for the site database:

    • smsdbrole_MP
    • smsdbrole_SLP
    • smsdbrole_RP
    • smsdbrole_PSP
    • smsdbrole_DMP
    • smsdbrole_siteprovider
    • smsdbrole_siteserver

  4. Verify that the following SQL Server database roles for the site database have been assigned with the appropriate machine accounts:

    • smsdbrole_MP (if management point installation was selected)
    • smsdbrole_siteprovider (the site server or remote provider that was specified)
    • smsdbrole_siteserver (the primary site server computer)

See Also

Concepts

Custom Setup Overview
SQL Server Preparation for Setup


How to Install Configuration Manager Using a Clustered SQL Server Instance

The Configuration Manager 2007 site database can be installed using a clustered virtual Microsoft SQL Server instance during setup by using the following procedures.

Note
During Configuration Manager 2007 Setup, the Volume Shadow Copy Service (VSS) writer will be installed on each physical computer node of the Microsoft Windows Server cluster to support the Backup Site Server maintenance task.

To install Configuration Manager using a clustered SQL Server instance to host the site database

  1. Create the virtual SQL Server cluster to host the site database on an existing Windows Server cluster environment.

  2. Add the machine account of the primary site server machine to the Local Administrators group of each Windows Server cluster node computer. This is required to allow the site server to install and configure settings later.

  3. In the virtual SQL Server instance, assign the sysadmin SQL Server role to the user account running Configuration Manager Setup.

  4. Start Configuration Manager Setup, and select to install Configuration Manager using custom settings.

  5. On the Configuration Manager Database Server page of the Configuration Manager Setup Wizard, enter the name of the clustered virtual SQL Server instance to host the site database and the name for the site database to be created on that instance by setup.

    Important
    During setup, you must enter the name of the virtual SQL Server cluster instance, and not the virtual Windows Server name created by the Windows Server cluster. Installing the site database using the Windows Server cluster virtual instance name will result in the site database being installed on the local hard drive of the active Windows Server cluster node, and it will prevent successful failover if that node fails.

To verify that the site database was installed successfully

  1. Verify that Configuration Manager 2007 Setup completed successfully by reviewing the ConfigMgrSetup.log file located at the root of the system drive on the primary site server computer.

  2. In the SQL Server 2005 Management Studio console, verify that the site database was created successfully.

  3. In the SQL Server 2005 Management Studio console, verify that the following roles were created for the site database:

    • smsdbrole_MP
    • smsdbrole_SLP
    • smsdbrole_RP
    • smsdbrole_PSP
    • smsdbrole_DMP
    • smsdbrole_siteprovider
    • smsdbrole_siteserver

  4. Verify that the following SQL Server database roles for the site database have been assigned with the appropriate machine accounts:

    • smsdbrole_MP (if management point installation was selected)
    • smsdbrole_siteprovider (the site server or remote provider that was specified)
    • smsdbrole_siteserver (the primary site server computer)

See Also

Concepts

Custom Setup Overview
Using a Clustered SQL Server Instance to Host the Site Database


How to Specify a Server Share Site System Installation Drive

By creating a server share site system to host the distribution point site system role, you can control the installation drive used by Configuration Manager to install site system files.

To specify the site system installation drive

  1. Create a share on the NTFS drive that you want to install the optional site system on.

  2. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Sytems.

  3. Right click Site Systems, click New, and then click Server Share to start the New Site System Server Share wizard.

  4. When you create the server share site system, specify the server and server share path for Configuration Manager 2007 to use.

  5. Assign the site system roles to the site system as required.

See Also

Other Resources

Configuration Manager Tasks for Deploying a Single Site


How to Prevent Configuration Manager From Installing Files on a Specific Drive

By default, the Configuration Manager 2007 site server role component installation files are installed on the first available NTFS formatted disk drive with the most available free disk space. However, some files are not installed in the default installation folder. For example, files are installed in the following folders:

  • The SMS_CCM folder (if the management point site system role is enabled on the computer)
  • The Inetpub\wwwroot\SMSComponent and Inetpub\wwwroot\SMSReporting_sitecode folders (if the reporting point role is enabled on the computer)
  • The %Windir%\System32 folder

Configuration Manager 2007 will not install site role component files on a drive that contains a file named no_sms_on_drive.sms. Instead, site role components will be installed on a different NTFS formatted disk drive that does not contain the no_sms_on_drive.sms file.

The no_sms_on_drive.sms file prevents site system role component installation, on a drive with this file present, for all site systems that are installed by site component manager. If site role installation files are already present on the drive before placing the no_sms_on_drive.sms file on the drive, the installation files are not moved.

To prevent Configuration Manager from installing files on a specific drive

  1. Create an empty file named no_sms_on_drive.sms.

  2. Place the no_sms_on_drive.sms file at the root folder of any drive that you want to prevent Configuration Manager 2007 from installing files on.

    Note
    You can create a no_sms_on_drive.sms file in the root folder of all drives except for drives that you have specified as server share site systems.

See Also

Other Resources

Configuration Manager Tasks for Deploying a Single Site


How to Manually Publish the Default Management Point to DNS

If your DNS servers do not support automatic updates but do support service location records, and you want to publish the Configuration Manager 2007 default management point to DNS, you can manually publish the default management point. To accomplish this, you must manually specify the service location resource record (SRV RR) in DNS.

Configuration Manager 2007 supports RFC 2782 for service location records, which have the following format:

_Service._Proto.Name TTL Class SRV Priority Weight Port Target

For guidance on entering this DNS record for a site's default management point, follow this procedure.

To manually publish the default management point to DNS

  1. In the Configuration Manager console, specify the intranet FQDNs of site systems.

  2. In DNS, configure the DNS zone for the site's default management point, and enter host (A) records for the intranet FQDNs of the site systems.

  3. Enter an SRV record with the following fields:

    • _Service: Enter _mssms_mp_<sitecode>, where <sitecode> is the management point's site code.
    • ._Proto: Specify ._tcp.
    • .Name: Enter the DNS suffix of the management point, for example contoso.com.
    • TTL: Enter 14400, which is four hours.
    • Class: Specify IN (in accordance with RFC 1035).
    • Priority: This field is not used because there is only one management point published for each site.
    • Weight: This field is not used because there is only one management point published for each site.
    • Port: Enter the port configured for Configuration Manager 2007 client requests, for example 80 for a mixed mode site and 443 for a native mode site.
    • Target: Enter the intranet fully qualified domain name specified for the site system configured with the default management point site role.

See Also

Tasks

How to Configure the Intranet FQDN of Site Systems

Concepts

Determine If You Need to Publish to DNS


How to Automatically Publish the Default Management Point to DNS

To automatically publish a service location resource record (SRV RR) in Domain Name System (DNS) for the default management point in a Configuration Manager 2007 site, follow the procedure below. Publishing to DNS requires a version of DNS running BIND 8.1.2 or higher, which is configured to allow automatic updates.

Note
The published name will use the intranet fully qualified domain name (FQDN) specified for the site system that is configured as the default management point. If no intranet FQDN is specified, the computer's NetBIOS name will be used.

To publish the default management point to DNS:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site name> - <site code> and then click Properties.

  3. On the Advanced tab in the site properties dialog box, select Publish the default management point in DNS (intranet only).

  4. Click OK.

See Also

Tasks

How to Configure the Intranet FQDN of Site Systems

Concepts

Determine If You Need to Publish to DNS


How to Configure the Intranet FQDN of Site Systems

Specify the intranet fully qualified domain name (FQDN) of site systems if you want to use DNS name resolution for computers. This is recommended for native mode site configuration, and if you are publishing the default management point to DNS.

Note
If the site is operating in native mode, most server certificates will use a FQDN as the subject name. If the certificate is using an intranet FQDN as the subject name, enter the same intranet FQDN in Configuration Manager. However, if the certificate is using a NetBIOS name for intranet communication, do not enter an intranet FQDN for site systems in Configuration Manager.

To configure the intranet FQDN of site systems:

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Select the first server displayed.

  3. Right-click ConfigMgr site system, and then select Properties.

  4. On the General tab, click Specify a fully qualified domain name (FQDN) for this site system on the intranet.

  5. In the Intranet FQDN text box, enter the intranet FQDN that is registered in the intranet DNS for the server.

  6. Click OK.

  7. Repeat steps 3 to 6 for any remaining servers that require configuration of intranet FQDNs.

See Also

Tasks

How to Automatically Publish the Default Management Point to DNS


How to Configure the Intranet FQDN of an NLB Management Point

If you are using a network load balancing (NLB) cluster in Configuration Manager 2007 for a management point on the intranet, you can specify it using an IP address or fully qualified domain names (FQDN). You must specify a FQDN if the site is in native mode.

Additionally, the FQDN of NLB management points in mixed mode must be registered to use a Service Principal Name (SPN). For more information, see How to Configure an SPN for NLB Management Point Site Systems.

Important
Configuration Manager clients locate FQDN NLB management points through Active Directory publishing, or with the server locator point. If you are configuring an NLB management point with an FQDN, and you have not extended your Active Directory schema for Configuration Manager 2007, or you have clients that can't access the Active Directory information, ensure that you have a server locator point installed in the Configuration Manager 2007 hierarchy and that clients can locate it. For more information, see Configuration Manager and Service Location (Site Information and Management Points).

To configure the intranet FQDN of an NLB management point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. Right-click Management Point Component, and then select Properties.

  3. On the General tab, select Network Load Balancing cluster virtual server.

  4. Click FQDN, and then enter the intranet FQDN in the text box Private DNS.

  5. Click OK.

See Also

Tasks

How to Configure the Intranet FQDN of Site Systems

Concepts

Configuration Manager and Service Location (Site Information and Management Points)
Determine If You Will Use FQDN Server Names
Determine If You Need a Server Locator Point for Configuration Manager Clients
Configuration Manager Service Principal Name Requirements


How to Configure DCOM Permissions for Configuration Manager Console Connections

The user account running the Configuration Manager console requires permissions to access the site database through the SMS Provider. Any administrators who will use a remote Configuration Manager console require Remote Activation DCOM permissions on both the site server computer and the SMS Provider computer.

The SMS Admins security group is used to grant access permissions to the SMS Provider. User accounts for administrators that will run the Configuration Manager console must be a member of the SMS Admins group and the following procedure must be performed to grant the necessary DCOM activation permissions to the SMS Admins group.

Note
If during Configuration Manager 2007 installation you installed the SMS Provider on a remote computer, you must perform this procedure on both the site server and on the remote SMS Provider computer. If you installed the SMS Provider on the site server computer, you only need to perform this procedure on the site server.

Important
The Configuration Manager console uses WMI to connect to the SMS Provider, and WMI internally uses DCOM. Therefore, Configuration Manager requires permissions to activate a DCOM server on the provider computer if the Configuration Manager console is running on a computer other than the SMS Provider. By default, Remote Activation is granted only to the members of a built-in Administrators group. Allowing the SMS Admins group to have Remote Activation permission would allow a member of SMS Admins to attempt DCOM attacks against the SMS Provider computer, and also increases the attack surface of the computer. You can mitigate this threat by carefully monitoring who is a member of the SMS Admins group. For more information regarding risk associated with allowing remote activation, see "DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1" at http://go.microsoft.com/fwlink/?LinkId=86101.

To grant Remote Activation permissions to the SMS Admins group

  1. From the Start menu, click Run and type Dcomcnfg.exe.

  2. In Component Services, click Console root, expand Component Services, expand Computers, and then click My Computer. On the Action menu, click Properties.

  3. In the My Computer Properties dialog box, on the COM Security tab, in the Launch and Activation Permissions section, click Edit Limits.

  4. In the Launch Permissions dialog box, click Add.

  5. In the Select User, Computers, or Groups dialog box, in the Enter the object names to select (examples): box, type SMS Admins and click OK.

  6. In the Permissions for SMS Admins section, select the check box to allow Remote Activation.

  7. Click OK twice, and then close Computer Management.

See Also

Other Resources

Configuration Manager Tasks for Deploying a Single Site


Configuration Manager Multiple Site Planning and Deployment

Multiple site hierarchical structures provide a means of extending and scaling Configuration Manager 2007 support across a wide variety of organizational structures. A single site is the easiest to configure and manage, but there are circumstances in which it is beneficial to set up multiple sites in a hierarchy.

Configuration Manager site hierarchies consists multiple individual sites which are joined into a hierarchy by setting up communication between the sites, using site addresses and senders, to create parent-child reporting structure relationships. This reporting structure determines how data flows between the sites. Because this data flow can significantly affect the efficiency of your site systems, plan the hierarchy before you begin installing Configuration Manager sites.

While the most important considerations when planning for Configuration Manager hierarchies are data flow and ease of administration, it is important during the design phase to consider your need for additional sites. These needs might belong to one of the following categories:

  • Network performance with clients
  • Number of resources
  • Features required by users
  • International considerations
  • Number of sites
  • Corporate structure
  • Domain structure

In This Section

Administering Multi-Site Hierarchies

Roaming Between Sites in Different Modes

Configuration Manager Site to Site Communications

About Data Priorities

Administrator Workflow: Configuration Manager Hierarchy Planning and Deployment

Configuration Manager Tasks for Planning Multiple Sites

Configuration Manager Tasks for Deploying Multiple Sites

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Administering Multi-Site Hierarchies

Configuration Manager 2007 sites are typically arranged in hierarchies. The site at the top of a hierarchy is called the central site. Relative positions within a hierarchy are denoted by the terms parent site and child site.

All sites below a central site can be managed from within the Configuration Manager 2007 console installed at the central site (or connected to it). Collections and software distribution objects created at primary sites replicate down the hierarchy to each child site. Collections and software distribution objects created at parent sites are locked in lower site Configuration Manager 2007 consoles unless the parent-child relationship is broken.

Note
Child SMS 2003 primary site administration is limited from within a Configuration Manager 2007 console. If you will be managing SMS 2003 primary child sites, consider installing a dedicated SMS 2003 Administrator Console. For more information about console interoperability for SMS 2003 sites, see Planning for the Configuration Manager Console.

Client information sent to parent sites is always replicated up the hierarchy. However, depending on site-to-site communication settings and the number of tiers in the Configuration Manager 2007 hierarchy the data must travel up, it may be some time before client data is replicated up the hierarchy.

You should plan to create custom collections or software distribution objects at the appropriate hierarchy location to ensure the desired collection and software distribution object replication behavior to child sites is accomplished.

See Also

Other Resources

Configuration Manager Multiple Site Planning and Deployment


Roaming Between Sites in Different Modes

When the Configuration Manager 2007 hierarchy contains sites that are configured for different site modes, roaming between these sites is supported with the following behavior.

A client from a mixed-mode site roams into a site configured for native mode:

  • The client continues to communicate with its default management point over HTTP, and will not communicate with the resident management point.
  • The client will not download content from distribution points in the native mode site, but it will download content from its own site using HTTP.

A client from a native mode site roams into a site configured for mixed mode:

  • The client continues to communicate with its default management point over HTTPS.
  • If the native mode client is not enabled for HTTP communication for roaming and site assignment, the client will not communicate with the mixed-mode resident management point or download content from distribution points in the mixed-mode site. Instead, it will communicate only with its assigned management point and download content from its own site using HTTPS. This is a more secure solution, but it might result in content retrieval over a remote link.
  • If the client's site is enabled for HTTP communication for roaming and site assignment, the client will communicate with the mixed-mode resident management point and download available content from distribution points in the mixed-mode site, using HTTP. This is a less secure solution, but it minimizes data being sent over a remote link.

See Also

Tasks

How to Configure HTTP Communication for Roaming and Site Assignment

Concepts

Client Communication in Mixed Mode and Native Mode


Configuration Manager Site to Site Communications

In a Configuration Manager 2007 site hierarchy, each site must be able to communicate with its parent site and all of its child sites. Communication between sites is accomplished by using the Server Message Block (SMB) protocol (TCP/IP port 445) and is independent of the Configuration Manager 2007 site mode (native mode or mixed mode).

For sites to communicate, they must have a connectivity system (LAN protocols, RAS, or SNA Server) installed and configured according to the connectivity system's product documentation on all site servers in the Configuration Manager 2007 hierarchy. Then, for each site in the Configuration Manager 2007 hierarchy, you must configure the site-to-site communications by creating and configuring the required addresses and senders.

Configuration Manager 2007 sites communicate using package routing. During package routing, communications are passed up and down a hierarchy from site to site. This means that a site needs addresses only for its parent sites and child sites, but not for other upper-level, lower-level, or sibling sites.

Note
By default, site-to-site communication is secured by secure key exchange. For greater site-to-site communications security, consider implementing IP Security (IPSec) in your environment.

Windows Server 2003 and Cross Forest Site Communications

Communications across forests work in Configuration Manager 2007 if the following conditions are met:

  • You are using the Windows Server 2003 family.
  • The forest functional level is set to Windows Server 2003.
  • The forests are configured with a transitive trust.
  • The Domain Admins group from the trusted Domain are added to the local administrators group on the Configuration Manager 2007 primary site servers spanning the trust.
Important
Only the System Health Validator point site system role, site systems configured to support Internet based client management, and Configuration Manager 2007 primary sites are supported across forest boundaries. It is not supported to configure secondary sites in separate Active Directory forests from their parent primary site server

In This Section

Configuration Manager Senders

Configuration Manager 2007 sites must have one or more senders to communicate.

Configuration Manager Addresses

Configuration Manager 2007 addresses are used by senders to find the site servers of destination sites.


Configuration Manager Addresses

Configuration Manager 2007 addresses are used by senders to find the site servers of destination sites. You can create several types of addresses, each of which corresponds to a different type of sender. Before you can use a particular sender to contact another site, you must create an address to that site for that sender type. For example, to contact another site through a standard sender, you must create a standard sender address to that site after creating the standard sender. To contact the site through one of the Remote Access Service (RAS) senders, you must create an appropriate RAS sender address to the site after creating the RAS sender.

Controlling Network Load

To control network load, you can schedule when Configuration Manager 2007 can use an address and the amount of network bandwidth that can be used when it sends to the address. Also, to provide increased throughput or to act as a backup if some addresses are unavailable, you can define multiple addresses to each destination site. If you define more than one address to a site, you can specify the priority for Configuration Manager 2007 to attempt to use the addresses for that site. The results pane of the Configuration Manager console lists multiple addresses to a destination site in priority order.

You can also limit the amount of data sent between sites to a fine level of granularity. This allows you to specify the size of the data blocks that are sent, and also to specify a time delay between sending each data block. This is called pulse mode. Pulse mode can be configured in the properties of an address on the Rate Limits tab, and it is useful when you have a very low network bandwidth available between sites. For example, you might have constraints to send 1 KB of data every five seconds, but not 1 KB every three seconds, regardless of the speed of the link or its usage at a given time.

Configuration Manager Addresses

Standard Sender Address

For communication over a local area network (LAN), and over a wide area network (WAN) when routers connect multiple LANs.

Asynchronous RAS Sender Address

For RAS communication over an asynchronous line.

Courier Sender Address

For communication over a courier sender connection.

ISDN RAS Sender Address

For RAS communication over an ISDN line.

SNA RAS Sender Address

For RAS communication over a Systems Network Architecture (SNA) link.

X25 RAS Sender Address

For RAS communication over an X.25 line.

See Also

Tasks

How to Create Configuration Manager Site Addresses


Configuration Manager Senders

Configuration Manager 2007 sites must have one or more senders to communicate and can only be installed on primary or secondary site server systems. The sender itself does not provide connectivity to sites. Instead, senders use existing network connectivity to manage the connection, ensure the integrity of transferred data, recover from errors, and close the connection when it is no longer needed.

Configuration Manager 2007 supports the following connectivity systems:

  • Network communication protocols that are supported by Microsoft Windows operating systems.
  • Windows Remote Access Service (RAS) systems that use NetBIOS-based transport protocols, including asynchronous, X.25, and ISDN lines.
  • Windows RAS systems that use Systems Network Architecture (SNA).
Note
The Remote Access Service is provided with Windows Server operating systems. For information about how to install and use Windows RAS, see your Windows RAS product documentation.

Types of Configuration Manager Senders

Standard Sender

The standard sender is installed and configured by default on all primary and secondary sites. If your site-to-site communications occur over a LAN that uses a supported protocol, you do not need to install another sender.

Courier Sender

The courier sender is installed and configured by default on all primary and secondary sites. It is not displayed, and cannot be created, in the Configuration Manager console because it must be manually started from the Configuration Manager programs folder on the Start menu. Courier senders are used only for software distribution to send package data to other sites by using physical media instead of sending data over the network. To use the courier sender, you must first create a standard sender connection between the parent site and the child site. Once the standard sender is created, you then create a courier sender address for each site to use the courier sender functionality.

When you have large packages that require excessive time or bandwidth to be sent over the network, this sender can be useful. You can use courier sender at the source Configuration Manager 2007 site to create a parcel (that is, a collection of files transferred from one site to another using courier sender); write the parcel to a tape, CD, or other physical medium; and then ship the tape or CD to the destination site by mail or a courier service. At the destination site, you can then use courier sender at that site to receive the parcel and import the package data into the site.

Asynchronous RAS Sender

Used for communication over an asynchronous line.

ISDN RAS Sender

Used for communication over an ISDN line.

X25 RAS Sender

For RAS communication over an X.25 line.

SNA RAS Sender

For RAS communication over an SNA link.

Courier Sender Configuration

The courier sender is installed and configured by default on all primary and secondary sites. It is not displayed in the results pane because it must be manually started from the Configuration Manager 2007 program files on the start menu.

RAS Sender Configuration

The sending site must have a RAS Sender installed and a RAS Sender address for the receiving site. The RAS Sender address specifies a RAS-related phone number, account, and password used to dial in and connect to the RAS server at the receiving site.

To enable two-way RAS communications, you must create a RAS Sender on each site and a RAS Sender address for the other site on each site. Then both sites can send and receive Configuration Manager 2007 data and instructions on RAS.

See Also

Tasks

How to Prepare Servers for Senders

Concepts

How to Install Configuration Manager Senders


About Data Priorities

You can prioritize various types of Microsoft System Center Configuration Manager 2007 data that is passed from site to site. The three priorities (low, medium, and high) are used in two ways:

  • As relative rankings by Configuration Manager 2007 Replication Manager to determine which data is sent first. High-priority data is sent before medium, which is sent before low. For example, you can configure Configuration Manager 2007 to replicate the site control file at high priority, status messages at medium priority, and MIF files at low priority, which causes Configuration Manager 2007 to send site control files first, status messages second, and MIF files last.
  • As restrictions by sender addresses. You can configure sender addresses to pass data with a specific priority during certain times of the day. For example, you can modify an address to pass only high-priority data between 8:00 A.M. and 5:00 P.M. Medium- and low-priority data would wait during those hours and would be passed only between 5:00 P.M. and 8:00 A.M.

See Also

Other Resources

Configuration Manager Multiple Site Planning and Deployment


Administrator Workflow: Configuration Manager Hierarchy Planning and Deployment

This administrator workflow displays the recommended steps to plan and deploy Microsoft® System Center Configuration Manager 2007 site hierarchies.

Hardware Planning Deployment Diagram

See Also

Other Resources

Configuration Manager Multiple Site Planning and Deployment
Configuration Manager Tasks for Planning Multiple Sites
Configuration Manager Tasks for Deploying Multiple Sites


Configuration Manager Tasks for Planning Multiple Sites

When planning for a multiple site Configuration Manager 2007 hierarchy deployment, you should carefully consider the following planning tasks in this section.

In This Section

Plan the Configuration Manager Site Hierarchy

Describes the process used to plan a Configuration Manager site hierarchy.

Choose Between Primary Sites, Secondary Sites, and Branch Distribution Points

Describes the process used to choose between primary or secondary child sites.

Choose Which Method to Use to Install a Secondary Site

Describes the possible methods to deploy secondary sites and the process used to choose between them.

Choose Which Configuration Manager Sender to Use

Describes the process used to choose which Configuration Manager sender to use.

Design the Address Structure for Configuration Manager Hierarchies

Describes the process used to design the address structure for Configuration Manager site hierarchies.

Determine If a Proxy Management Point is Needed at a Secondary Site

Describes the process used to determine if a proxy management point is needed at a secondary site.

See Also

Other Resources

Configuration Manager Multiple Site Planning and Deployment


Plan the Configuration Manager Site Hierarchy

The task of designing your Microsoft System Center Configuration Manager 2007 sites and hierarchy is done during the planning phase, before deploying Configuration Manager 2007 in a production environment. Before beginning the planning phase, you should complete the preplanning phase and preplanning checklists to help identify how many sites you will have and where you will deploy them. After completing the preplanning phase, you can create an appropriate hierarchy design. The design should provide the ability for server hardware to scale up as your organization grows. For more information about the preplanning phase, see Configuration Manager Preplanning Phase.

Designing the Configuration Manager hierarchy involves identifying a central site, primary sites, and if necessary, secondary sites. To do this, you must understand parent-child relationships, how many clients each site will have, and how the sites communicate with each another. By determining the locations of your primary and secondary sites, you are effectively designing the hierarchy itself.

When designing the hierarchy, you should consider how you will link sites together to form the hierarchy reporting structure based on how each site fits into your design scope and objectives. Carefully balancing usage patterns against available hardware resources is critical to a successful hierarchy design.

Note
When planning for primary site installations, you should decide which Microsoft SQL Server you will install the site database on and which computer will host the SMS Provider before beginning Configuration Manager 2007 Setup.

The benefits and required resources that are associated with each Configuration Manager feature, and the effects of those features on the hierarchy design, are complex and can be difficult to understand. The design process requires reviewing the technical and business considerations that can affect the design. Prioritize the business requirements to ensure the hierarchy design and site system placement will meet your business requirement goals.

To design a Configuration Manager hierarchy, complete the following tasks:

  • Determine the type of site (primary or secondary) to deploy in each location based on the number of present (and planned) clients. For more information about determining the type of site to deploy, see Choose Between Primary Sites, Secondary Sites, and Branch Distribution Points.
  • Determine the administrative requirements for each location and whether or not onsite administration will be required. This can help to determine the type of site to deploy.
  • Establish the logical relationships between sites, and determine the hierarchy reporting structure.
  • Determine the network connectivity speeds, and the acceptable amount of Configuration Manager site traffic that will be created, between sites and the types of senders and address properties that will be used to control it.
  • Determine a site naming strategy for planned and future Configuration Manager 2007 sites to ensure each site has a unique site code and future sites can be named according to the site naming strategy. For more information about site naming, see Configuration Manager Site Naming.
  • Define unique boundaries for each Configuration Manager primary and secondary site. For more information about Configuration Manager boundaries, see Choose Configuration Manager Boundaries.
  • Establish the Configuration Manager site systems to be deployed within the sites, and their physical locations, to enable the features required to support your business requirements. For more information about site system planning, see Configuration Manager Site System Planning.

After the Configuration Manager hierarchy has been designed, it should be reviewed in a test lab to ensure it will fit your current and future needs. Identify any risks in the hierarchy design, and make changes to the design or plan how to mitigate them. Making modifications to your hierarchy design during this phase is easier and entails less risk than if you make changes after deploying Configuration Manager sites.

See Also

Concepts

Configuration Manager Tasks for Planning a Single Site

Other Resources

Configuration Manager Tasks for Planning Multiple Sites


Choose Between Primary Sites, Secondary Sites, and Branch Distribution Points

Topic last updated—November 2007

Primary sites are used in Configuration Manager 2007 site hierarchies to manage clients located within the boundaries of the primary site and any of its child secondary sites.

Secondary sites are used in Configuration Manager 2007 site hierarchies to lessen the processing load on primary site systems and to ease client administration and network bandwidth usage to more efficiently manage Configuration Manager clients at remote locations. In general, secondary sites are used to control network bandwidth utilization across slow links for client information generated by clients and to support software distribution operations across slow network links.

In some cases, branch distribution points can be used instead of creating additional sites. Branch distribution points can help reduce network utilization for package downloads; however, they do not manage other types of client traffic, such as inventory, policy downloads, and status messages.

When choosing between primary sites, secondary sites, and branch distribution points, you should consider the amount of network traffic that the planned and future site clients will generate. It might be beneficial to install a secondary site if the amount of network traffic generated by clients across a slow link would be greater than the site-to-site communication traffic generated by a secondary site. Clients generate uncompressed network traffic when they request policies and send information—such as inventory, discovery, and status message information—to their management point based on the policy polling interval and client agents settings you define in the primary site's Configuration Manager console. Site-to-site communication between primary and secondary sites is compressed and can be scheduled and throttled by configuring site address settings.

Note
If a proxy management point is installed at a secondary site, the clients located within the boundaries assigned to the secondary site will request policies from the proxy management point. When the proxy management point receives a client request for a policy, it requests any new policies from the default management point for the primary site that the client is assigned to and returns the policy body to the requesting client. To conserve network bandwidth, the policy body returned by the default management point is cached on the proxy management point and returned to other clients at the secondary site when the same policy version is requested. For more information, see About Client Policy in Configuration Manager.

When supporting many clients at remote locations across slow network links, it might be beneficial to install a secondary site and configure distribution site systems that are local to clients within the secondary site's boundaries. When distribution points are installed within secondary sites, package source files are sent only once across the slow link from the primary site to secondary site distribution points instead of each time a client within the secondary site's boundaries requests software distribution package content. However, branch distribution points might also be beneficial in this scenario.

Other Secondary Site Deployment Planning Considerations

The following table lists additional pros and cons to consider when determining whether to install a primary or secondary site.

Pro Con
  • Secondary sites do not require additional Configuration Manager 2007 server licenses.
  • Secondary sites do not require an additional SQL Server database at the secondary site.
  • Clients can be managed across a slow network connection link, such as a wide area network (WAN) connection between sites, without the need to configure client agent settings.
  • Secondary sites can have management points (called proxy management points) to help prevent client reporting information, such as inventory reports and status messages, from traversing slow network connections to the primary site.
  • Remote sites can be managed centrally from a parent primary site without the need for an on-site administrator at the secondary site.
  • Parent sites for secondary sites cannot be changed without uninstalling them and installing a new secondary site.
  • Secondary sites cannot be upgraded to primary sites. To replace a secondary site with a primary site, you must uninstall the secondary site and install a primary site.
  • Because Configuration Manager clients are always assigned to primary sites, client agent settings cannot be configured differently from the secondary site's parent site for clients located within the boundaries of secondary sites.

Considerations for Using a Branch Distribution Point Instead of a Site

If you have a location that is so small that it does not have a server, you should at least install a branch distribution point to provide a local package source.

If the location is large enough to have a server or if there are several users, consider the pros and cons listed in the following table when deciding whether to use a branch distribution point instead of creating a new site.

Pro Con
  • Reduces site hierarchy complexity.
  • Allows package to be copied out of band to a distribution point within the site.
  • Does not require a server operating system.
  • Provides on-demand package distribution, in which packages are downloaded to the branch distribution point only when specifically requested by a client computer.
  • Branch distribution points download content from standard distribution points using BITS (Background Intelligent Transfer Service).
  • Supports all packages, including software update packages and operating system deployment packages.
  • Does not manage traffic uploaded from clients to management points.
  • Does not manage traffic when downloading policies from management points to clients.
  • Does not provide a local software update point to scan for software updates.
  • Does not provide precise time and bandwidth controls between sites, as a Sender does.
  • Restricts available connections to 10 or fewer if using a client operating system.

See Also

Concepts

About Client Policy in Configuration Manager
About Standard and Branch Distribution Points
Determine If a Proxy Management Point is Needed at a Secondary Site
Understanding Configuration Manager Sites

Other Resources

Configuration Manager Tasks for Planning Multiple Sites


Choose Which Method to Use to Install a Secondary Site

Before you install a secondary site, you must first install a parent primary site. You can install a secondary site from the primary site by using the New Secondary Site Creation Wizard from the parent site's Configuration Manager console or by running Configuration Manager 2007 Setup at the local secondary site computer. For more information about methods used to install secondary sites, see How to Install a Secondary Site.

Using the New Secondary Site Creation Wizard

To install a new secondary site from the primary site, right-click the primary site name in the Configuration Manager console and click New Secondary Site to start the New Secondary Site Creation Wizard. Completing the New Secondary Site Creation Wizard will install the secondary site on the computer specified in the wizard. When using this secondary site installation method, Configuration Manager Setup files can either be transferred across the network connection to the secondary site computer or started from setup files located on a local drive on the remote secondary site computer. This method enables secondary sites to be installed without requiring an administrator at the secondary site server computer.

Using Configuration Manager Setup

Starting Configuration Manager Setup locally on the secondary site computer and selecting to install a secondary site can be helpful when there is an administrator at the remote secondary site computer or you want to avoid transferring the setup files across the network. This method requires that an address to the secondary site is manually created in the Configuration Manager console at the primary site.

See Also

Tasks

How to Install a Secondary Site Using the Configuration Manager Console
How to Install a Secondary Site Using Configuration Manager Setup


Choose Which Configuration Manager Sender to Use

The choice of sender used for site to site communication depends on the existing network connectivity system between sites. If there are reliable, high-speed network connections between sites, plan to use the Standard Sender. If you have RAS connections between sites, select the appropriate type of RAS sender for your connection. If you want to send large amounts of package data for software distribution to sites using physical media instead of over the network, you can configure software distribution packages to use the Courier Sender.

Note
When Configuration Manager 2007 sites are installed, the Standard Sender and Courier Sender are installed by default.

Choosing Configuration Manager Senders

Use the following table to choose the appropriate sender to use when configuring site to site communications.

Existing network connectivity between sites | Sender
LAN or WAN | Use Standard Sender, the most commonly used sender, for sending to other sites on the same LAN, or on a WAN using routers, switches, or bridges.
Asynchronous line | Use Asynchronous RAS Sender for RAS communications over an asynchronous line.
ISDN line | Use ISDN RAS Sender for RAS communications over an ISDN line.
X.25 line | Use X25 RAS Sender for RAS communications over an X.25 line.
SNA | Use Systems Network Architecture (SNA) RAS Sender in RAS communications over an SNA link.
None | Use Courier Sender to send packages between the sites by using removable media instead of network wiring and protocols if you have a slow or unreliable link between a site and its parent. Courier Sender is used only for package distribution, not site-to-site communications.

See Also

Other Resources

Configuration Manager Tasks for Planning Multiple Sites


Design the Address Structure for Configuration Manager Hierarchies

In a Configuration Manager 2007 site hierarchy, each site must be able to communicate with its parent site and all of its child sites. Communication between sites is accomplished by using the Server Message Block (SMB) protocol (TCP/IP port 445) and is independent of the Configuration Manager 2007 site mode (native mode or mixed mode).

For sites to communicate, they must have a connectivity system (LAN protocols, RAS, or SNA Server) installed and configured according to the connectivity system's product documentation on all site servers in the Configuration Manager 2007 hierarchy. Then, for each site in the Configuration Manager 2007 hierarchy, you must configure the site-to-site communications by creating and configuring the required senders and addresses to be used with each sender.

When designing the address structure for Configuration Manager 2007 hierarchies, there are two main considerations:

  • Network load between sites
  • Site-to-site data transfer latency

Network Load Between Sites

Design the site reporting structure to provide planned controls over the amount of network load used between sites to avoid excessive network bandwidth use during normal business hours. This is especially important when configuring site address properties for secondary sites located across a slow link connection or WAN.

It is possible to create more than one address for a specific sender to communicate with the same site. Address properties also allow prioritization of site-to-site communications. For example, you can set one address to a site to throttle low-priority data transfers, and another address to the same site to schedule high-priority site-to-site data transfers at different times of the day.

Software distribution package source file transfers are controlled by site-to-site sender address properties. When distributing software packages to remote distribution points, ensure that you consider the impact on the network bandwidth between sites. To help mitigate network bandwidth used when transferring software distribution package source files between sites, consider using binary differential replication. For more information about binary differential replication, see About Binary Differential Replication.

You can also limit the amount of data sent between sites to a fine level of granularity using pulse mode. Pulse mode allows you to specify the size of the data blocks that are sent, and also to specify a time delay between sending each data block. Pulse mode can be configured in the properties of an address on the Rate Limits tab, and it is useful when you have a very low network bandwidth available between sites.

Site-to-Site Data Transfer Latency

When configuring site address properties for site-to-site communication, sufficient planning must be done to provide for latency in the communication process. If site communications have been throttled or configured to only transfer data after normal business hours, administrators at either the parent site or child site will not be able to view new site configuration or client reporting data until the site-to-site communication has taken place. For example, if the central site administrator has created new collections at the central site, the child sites beneath the central site will not be able to view the new collections until the sites have communicated according to their site sender address property schedule. Conversely, if child site clients have conducted inventory or sent status messages to a child primary site, the central site will not receive the client information until site-to-site communication has taken place successfully.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Configuration Manager Tasks for Planning Multiple Sites


Determine If a Proxy Management Point is Needed at a Secondary Site

A proxy management point is a management point installed at a secondary site which acts as a proxy for the default management point at the secondary site's parent primary site. In general, proxy management points are used to avoid excessive bandwidth usage over slow network links between clients located within the boundaries of a secondary site and the default management point located at the parent, primary site.

As the number of clients located with the secondary site's boundaries increases, so does the amount of network bandwidth used by clients to communicate with the primary site's default management point. Depending on the network links in place, there may be a point at which the traffic becomes too much for a slow link to handle without installing a proxy management point at the secondary site.

When a proxy management point is installed at a secondary site, clients located within the secondary site's boundaries send information such as software distribution package content location requests, inventory data, discovery data, and status messages to the proxy management point. The proxy management point forwards the client information to the secondary site server's inboxes and the client data is compressed and sent to the primary site as part of normal site to site communication. When a proxy management point is not installed at a secondary site, all client information is sent uncompressed directly to the default management point at the primary site.

Proxy management points do not directly respond to client policy requests. All client policy requests are sent to the default management point at the primary site. However, proxy management points do cache policy bodies downloaded by clients. If the policy body for a requested client policy has already been downloaded by a secondary site client, the policy body will be sent from the proxy management point to the secondary site client. Otherwise, the client will download the policy body from the default management point at the primary site and the proxy management point will cache it for future client policy body requests.

See Also

Other Resources

Configuration Manager Tasks for Planning Multiple Sites


Configuration Manager Tasks for Deploying Multiple Sites

You deploy multiple Configuration Manager 2007 sites to create a hierarchical structure. Plan the order in which you will deploy and attach sites, thereby creating data flow between the sites in a hierarchy branch. Before you install a secondary site, you must first install the parent primary site. After installing primary sites, you must configure site-to-site communications and then join the sites into a hierarchy. The site communication between a secondary site and its parent primary site is configured during secondary site installation.

When deploying multiple sites to create the Configuration Manager 2007 site hierarchy, you must first properly configure site-to-site communications and then set the parent site for child primary sites.

In This Section

Mandatory Tasks

You must perform the following tasks when deploying multiple Configuration Manager 2007 sites:

Configure Site Communications:

How to Prepare Servers for Senders

Network connectivity, such as local area network (LAN) protocols or Microsoft Remote Access Service, must already be installed and configured correctly before installing senders.

How to Install Configuration Manager Senders

Describes how to install Configuration Manager senders.

How to Create Configuration Manager Site Addresses

Describes how to create Configuration Manager addresses.

Create the Configuration Manager Site Hierarchy

How to Join Primary Sites into a Hierarchy

Describes how to join primary sites into a hierarchy.

Optional Tasks

Although you do not need to perform the following tasks when deploying multiple site hierarchies, depending on your environment, you might choose to do so:

How to Connect the Configuration Manager Console to a Different Site

Describes how to start the Site Database Connection Wizard to connect a Configuration Manager console to a specified Configuration Manager primary site.

How to Install a Secondary Site

Describes the various methods used to install secondary sites.

How to Manually Exchange Public Keys Between Sites

Describes the process used to manually exchange public keys between sites.

How to Verify Successful Secondary Site Installation

Describes how to verify that a secondary site installation has been successful.

How to Install a Proxy Management Point at a Secondary Site

Describes how to configure a proxy management point at a secondary site to aid in client communications.

How to Verify Successful Proxy Management Point Installation

Describes how to verify successful proxy management point installation for a secondary site.


How to Prepare Servers for Senders

Senders can only be installed on the primary or secondary site server computer. Before you install a sender, the connectivity system between the sites must already be installed and configured on the server on which you install the sender.

Note
The standard and courier senders are automatically installed on Configuration Manager site server systems and cannot be installed manually.

Preparing Servers for RAS Senders

For Remote Access Service (RAS) senders, install Microsoft RAS on the source and destination sites. Create RAS phone book entries for the RAS servers on each destination site. On each destination site, create a user account that the RAS sender on the site server can use and then grant the account Dial in and Dial out permissions in the RAS Administrator.

Before creating an Systems Network Architecture (SNA) RAS sender on a site server system, you must ensure that the site server system is configured correctly. This procedure is performed outside of Configuration Manager 2007, using Microsoft SNA Server. For detailed information about the steps and terms in this procedure, see your SNA Server product documentation.

To prepare a server for an SNA RAS sender

  1. Check that Microsoft SNA Server is installed on computers in both the sending and destination sites. Make logical unit-pair connections between these installations of SNA Server.

  2. On the server running SNA Server that you will install SNA sender on, create an advanced program-to-program communications (APPC) local logical unit that the SNA sender and SNA receiver will use.

  3. On the destination sites, create an APPC local logical unit.

  4. The logical units on these sites are used by the current site’s SNA sender.

  5. Create a connection between the current site server SNA sender logical unit (the local logical unit) and all destination site SNA sender logical units (remote logical units). Create the connection on both sites.

    Note
    The logical unit pair for both connections can use either #BATCH (batch) or #INTER (interactive) modes. For more information about local logical units, remote logical units, modes, and connections, see the SNA Server product documentation.

Before creating any of the three types of non-SNA RAS senders (Asynchronous, ISDN, or X.25) on a site system, ensure that the site system is configured correctly. To do so, use Microsoft Windows administration tools to complete the following procedures. For detailed information about the steps and terms in this procedure, see your Windows server product documentation.

To prepare a server for a non-SNA RAS sender

  1. Ensure that Microsoft Windows RAS software is installed on a site system in the current site and in all destination sites. (The site systems on which RAS software is installed are RAS servers.)

  2. On the RAS servers where you will install the RAS sender, create RAS phone book entries for the RAS servers at each destination site.

    The types of phone book entries determine the types of senders and sender addresses you create. For example, if you create an ISDN phone book entry for a destination site, you must create an ISDN RAS sender address and an ISDN RAS sender on the RAS server.

  3. At each destination site, create a user account that the RAS sender on the current site can use.

  4. In RAS Administrator, grant the account Dial in and Dial out permissions.

See Also

Concepts

How to Install Configuration Manager Senders


How to Install Configuration Manager Senders

Configuration Manager senders can only be installed on site server computers with only one sender of each type installed on a single site server system. Network connectivity, such as local area network (LAN) protocols or Microsoft Remote Access Service (RAS), must already be installed and configured correctly before installing senders.

Note
To install a sender, you must have Modify permissions for the site object type or for the individual site where you want to install the sender.

Procedures

To install a Configuration Manager sender

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Senders.

  2. Right-click Senders and then click New.

  3. Select the type of sender that you want to install.

  4. To finish installing the sender, complete the General and Advanced tabs of the sender properties.

A courier sender is installed and configured by default on all primary and secondary sites. The courier sender cannot be installed from the Configuration Manager console. To use the courier sender for software distribution package transfers, you must choose the courier sender as the preferred sender on the Distribution Settings tab of the Package Properties dialog box to send parcels using this sender.

To use the courier sender

  1. On the Start menu, click Programs.

  2. Click Configuration Manager 2007, and then click Configuration Manager Courier Sender.

See Also

Tasks

How to Prepare Servers for Senders


How to Create Configuration Manager Site Addresses

When you create secondary sites, the New Secondary Site Wizard prompts you to create a sender address for the secondary site on the primary site, and for the primary site on the secondary site. To configure primary-site-to-primary-site communications, you must manually create the addresses that will be used.

Before you create an address, make sure that you know the proper information to complete the New Address Wizard. You should know the type of sender that will be used to communicate with the site, the site code for the destination site, the destination site server name, and the site address account that will be used for the connection between sites. The site address account should be a domain user account in the form <domain>\<user>. If no site address account is specified, the local computer account of the sending site server will be used.

Note
The FQDN or NetBIOS name, and not the IP Address, of the site server must be used in the sender address. Using the IP address in place of the FQDN or NetBIOS name in the sender address will result in a communication failure to the destination site.

Important
If you specify a Site Address Account for an address and then later decide you want to use the computer account as the Site Address Account, you must either delete the address and re-create it, or use the Manage Site Accounts tool (MSAC.exe). Changing the account name is not sufficient when switching from a user account to the computername$ account.

To create a Configuration Manager site address

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. Right-click Addresses and then click New.

  3. Select the type of address that you want to create to start the appropriate New Address Wizard.

  4. To finish installing the address, complete the General, Schedule, and Rate Limits pages of the New Address Wizard.

See Also

Concepts

About the Site Address Account

Other Resources

Secondary Site Creation Wizard


How to Connect the Configuration Manager Console to a Different Site

The Site Database Connection Wizard connects a Configuration Manager console to a specified Configuration Manager primary site database. You can reconnect to a site database you have previously connected to, or you can create a new connection to a new site database.

Note
You do not require any Site security object class or instance permission to perform this procedure. However, you must have permission to the security objects for the target Configuration Manager site database.

To start the Site Database Connection Wizard

  • In the Configuration Manager console, right-click Configuration Manager and then click Connect to Site Database.

See Also

Other Resources

Configuration Manager Tasks for Deploying Multiple Sites


How to Join Primary Sites into a Hierarchy

Configuration Manager 2007 site hierarchies are made up of sites joined together in parent-child relationships. You connect sites by changing a site's parent. You can connect sites to form any kind of hierarchy you prefer, but no site can have more than one parent site. A primary site that has no parent is known as the central site. Every Configuration Manager 2007 site hierarchy must have a central site.

By creating the parent-child primary site relationships, you create the hierarchical reporting structure used by Configuration Manager 2007. Plan the order in which you will attach sites, thereby creating data flow between sites in a hierarchy branch. If a primary site contains a large amount of client data, for example, and you attach the site to another site, be aware that such client data propagates up the hierarchy to the primary parent site. Be sure to plan for this, and configure the appropriate address schedule and rate limits based on the amount and type of data you expect to flow up to the parent primary site.

Note
It is not supported to attach a native mode child site to a parent primary site configured for mixed mode operations.

Do not confuse the terms "child site" and "secondary site." You can configure parent sites for primary sites only by using this procedure. Secondary sites are attached to a primary site when they are created.

Important
Before joining Configuration Manager 2007 sites, you must first configure the site-to-site communication between them by creating the appropriate addresses between sites.

To set the parent site for a primary site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and click Properties.

  3. On the General tab, click Set Parent Site.

  4. Select the Report to parent site option.

  5. Using the drop-down selection list, select the site that you want this site to report to as its parent.

See Also

Tasks

How to Create Configuration Manager Site Addresses

Concepts

How to Install Configuration Manager Senders


How to Install a Secondary Site

Before you install a secondary site, you must first install a parent primary site. You can install a secondary site from the primary site by using the Configuration Manager console or using the Configuration Manager 2007 Setup program.

Note
Because Configuration Manager 2007 clients can only be managed by primary sites, there are no configurable client agent settings displayed for secondary sites in the parent site's Configuration Manager console.

After the secondary site has been installed and the site control file has been passed to the parent site, you can see the new secondary site displayed in the Configuration Manager console under its parent site.

Note
You must have Create permission for the site security object class to perform the following procedures. Also, the computer account of the primary site server must have administrative rights on the new secondary site server computer for primary site server initiated secondary site installations.

In This Section

How to Install a Secondary Site Using the Configuration Manager Console

Describes how to deploy a secondary site from the Configuration Manager console using the Secondary Site Wizard.

How to Install a Secondary Site Using Configuration Manager Setup

Describes how to deploy a secondary site using the Configuration Manager Setup program from the installation media.


How to Install a Secondary Site Using the Configuration Manager Console

Topic Last Updated -- November 2007

To install a secondary site from the primary site using the New Secondary Site Creation Wizard from within the Configuration Manager console, complete the following procedure.

Note
You must add the computer account of the primary site server to the local Administrators group on the new secondary site server computer before performing this procedure. Alternatively, you can use an account with administrative permissions in the address properties to the secondary site server computer.

To deploy a secondary site using the Configuration Manager console

  1. Ensure that the computer you want to use as the secondary site meets all the hardware and software requirements for Configuration Manager site systems. For more information about Configuration Manager supported configurations, see Configuration Manager Supported Configurations.

  2. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  3. Right-click the <site code - site name> of the primary site, and then click New Secondary Site to launch the New Secondary Site Creation Wizard.

  4. On the Welcome page, click Next.

  5. On the Site Identity page, you must enter a site code and site name for the new secondary site. You can also optionally enter a comment for this installation.

  6. On the Site Server page, you must specify the server name for the new secondary site installation. Enter the computer name to install the secondary site on, and the installation directory on that computer to install the Configuration Manager program files.

    Caution
    Ensure that you type the server name correctly. The New Secondary Site Creation Wizard does not verify that the server exists.

  7. On the Installation Source Files page, you must specify the location of the installation source files that will be used to install the secondary site. You can either copy the installation source files over the network from the parent site server or install the source files from the installation media or copy of the installation source files located in the data disk drive or at the root of a local drive at the secondary site server computer.

    Important
    If you install the source files from a location at the secondary site server computer, you must create a sub folder called \Redist under the SMSSetup directory at the secondary site and then copy to that location all of the prerequisite files that you previously downloaded. If you are installing a secondary site but select the option to copy the installation source files over the network from the parent site server, no additional action is required for the secondary site to obtain the prerequisite files.

  8. On the Address to Secondary Site page, specify one or more existing addresses to the new secondary site or create a new address to the secondary site. By default, the account used for the address is the primary site server's computer account. Alternatively, you can set a Microsoft Windows domain user account in the form of <domain\user> by clicking Set.

    Note
    If you specify one or more existing addresses on this page, skip to step 10.

  9. On the New Address to Secondary Site page, specify a new standard or asynchronous RAS sender address for the primary site to use when contacting the new secondary site.

    Note
    If you can contact the site only by using a different type of address, you must create the new address in the Configuration Manager console.

  10. On the New Address to Parent Site page, specify a new standard or asynchronous RAS sender address for the secondary site to use when contacting the parent site. Because secondary sites must be in the same forest as their parent site, you cannot configure a Site Connection Account for a standard sender address between a secondary child and a primary parent. The secondary site server's computer account is used.

    Note
    If you can contact the site only by using a different type of address, you must create the new address in the Configuration Manager console.

    Important
    The addresses to each site created during this process are open for all traffic twenty four hours a day, seven days a week using unlimited bandwidth between sites. You can adjust the address properties in the primary site's Configuration Manager console for each site after the secondary site installation has completed.

  11. On the Summary page, review the summary details for the secondary site installation before continuing. To make changes to any details, click Previous until you return to the page in the wizard where you set the detail. Once you are finished, return to the Summary page. To begin the secondary site installation, click Next.

  12. The Progress page displays the progress of the installation as it is installing the secondary site.

  13. The Confirmation page displays whether or not the installation was successful and the details of the secondary site installation.

See Also

Tasks

How to Create Configuration Manager Site Addresses

Concepts

Hierarchy Maintenance Tool Syntax
How to Install a Secondary Site


How to Install a Secondary Site Using Configuration Manager Setup

Topic Last Updated -- November 2007

You can install a secondary site from the Configuration Manager 2007 installation media, or you can connect to the installation files from a mapped network drive, hard disk drive, or another removable storage media at the secondary site.

To install a secondary site using Configuration Manager Setup

  1. Ensure that the computer you want to use as the secondary site meets all the hardware and software requirements for Configuration Manager site systems. For more information about Configuration Manager supported configurations, see Configuration Manager Supported Configurations.

  2. Log on to the new secondary site server computer with an account that has local administrative permissions.

  3. Insert the Configuration Manager 2007 installation media into the server’s drive, or click spash.hta, located at the root of the installation files directory, on source files copied to a local drive on the server.

  4. Click Configuration Manager 2007.

  5. On the Welcome page, click Next.

  6. On the Configuration Manager Setup Options page, click Install a Configuration Manager Site Server.

  7. On the Microsoft Software License Terms page, click I accept these terms, and then click Next.

  8. On the Configuration Manager Settings Configuration page, select to install Configuration Manager with Custom settings.

  9. On the Configuration Manager Site Type page, select Secondary Site.

  10. On the Destination Folder page, click Next to install the secondary site installation files in the default directory, or enter a custom installation directory.

  11. On the Configuration Manager Site Information page, enter a unique three-digit site code and the site name for this site, and then click Next.

  12. On the Configuration Manager Parent Site Settings page, enter the site code of the parent site and the name of the primary site server to which the secondary site will connect.

  13. On the Updated Prerequisite Components page, select the appropriate option for obtaining client prerequisite component files. Files can either be downloaded as part of Setup, an alternate location where the client prerequisite component files have already been downloaded to can be used.INCLUDE c:\\smsopalus\\us\\print\\getstart\\art\\artmanuscript\\SMS_art06.doc art_sms_f14_eps \!

  14. On the Updated Prerequisite Component Path page, specify the path to store client prerequisite component files downloaded during Setup or the path to the alternate location where client prerequisite component files have previously been downloaded to.

    Note
    The Setup command line option Setup /download <path to files> can be used to download client prerequisite component files without running the complete Configuration Manager Setup wizard.

  15. On the Summary page, review the summary details for the secondary site installation before continuing. To make changes to any details, click Previous until you return to the page in the wizard where you set the detail. Once you are finished, return to the Summary page. To begin the secondary site installation, click Next.

  16. When prerequisite checking has completed, review any messages in the results pane of the Prerequisite Check page to verify that all prerequisites have been met or that Configuration Manager Setup can resolve any prerequisites that have not been met for installation to continue. If Configuration Manager Setup cannot resolve issues found, review the ConfigMgrPrereq.log file located in the root of the system drive for more information about how to resolve any issues manually. When all discovered prerequisite check failures have been resolved, return to the Prerequisite Check page and re-run the setup prerequisites check.

    Important
    Configuration Manager Setup cannot continue until all prerequisite checks have completed with no errors.

  17. Review the Installation Summary page to determine what installation steps Configuration Manager 2007 is taking as it installs the secondary site.

  18. The Confirmation page displays whether or not the installation was successful and the details of the secondary site installation.

    Note
    After the secondary site has been successfully installed, you must manually create the address to the secondary site in the parent site Configuration Manager console and ensure that the secondary site server computer account has been added to the local SMS_SiteToSiteConnection_<site code> group on the primary site server computer to enable site-to-site communications.

See Also

Concepts

Hierarchy Maintenance Tool Syntax
How to Install a Secondary Site


How to Manually Exchange Public Keys Between Sites

Topic last updated -- August 2007

By default, the Require secure key exchange option is enabled for Configuration Manager 2007 sites. When secure key exchange is required, there are three situations in which you must manually perform the initial key exchange between sites:

  • If the Active Directory schema has not been extended for Configuration Manager 2007.
  • Configuration Manager 2007 sites are not publishing site data to Active Directory.
  • You are configuring site-to-site communications between two primary sites in different Active Directory forests.

To manually exchange the public keys for each site, you can use the hierarchy maintenance tool (Preinst.exe). The Preinst.exe tool is automatically installed with Configuration Manager 2007 and can be found in the \SMS_<sitecode>\bin\i386\<language code> share directory on the site server, and also in the \SMSSETUP\BIN\I386\<language code> directory of the Configuration Manager 2007 installation files.

The Preinst.exe utility can be used to export the public keys for each site. Once they have been exported, you must manually exchange the keys between the sites by following the procedures in this topic.

Note
After the public keys are manually exchanged, you can review the hman.log log file (which records site configuration changes and site information publication to Active Directory Domain Services) on the parent site server to ensure that the primary site has processed the new public key.

To manually transfer the child site public key to the parent site

  1. While logged on to the child site, open a command prompt and navigate to the location of Preinst.exe.

  2. Run the following command to export the child site’s public key: Preinst /keyforparent

  3. The Preinst /keyforparent command places the public key of the child site in the <site code>.CT4 file located at the root of the system drive.

  4. Move the <site code>.CT4 file to the parent site's <install directory>\inboxes\hman.box directory.

To manually transfer the parent site public key to the child site

  1. While logged on to the parent site, open a command prompt and navigate to the location of Preinst.exe.

  2. Run the following command to export the parent site’s public key: Preinst /keyforchild.

  3. The Preinst /keyforchild command places the public key of the parent site in the <site code>.CT5 file located at the root of the system drive.

  4. Move the <site code>.CT5 file to the <install directory>\inboxes\hman.box directory on the child site.

See Also

Concepts

About the Secure Key Exchange Parameters
Hierarchy Maintenance Tool (Preinst.exe)
Troubleshooting Secure Key Exchange


How to Verify Successful Secondary Site Installation

Regardless of the method used to deploy a secondary site, you should verify that the secondary site was installed successfully.

To verify successful secondary site installation

  1. On the secondary site computer, verify that the installation was successful by reviewing the ConfigMgrSetup.log and ConfigMgrPrereq.log log files. These files are located at the root of the system drive on the secondary site computer.

  2. On the primary site server computer, open the Configuration Manager console and navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  3. In the results pane, verify that the secondary site's information is displayed.


How to Install a Proxy Management Point at a Secondary Site

A proxy management point is a management point installed at a secondary site. The proxy management point is used by Configuration Manager Clients to retrieve policy at secondary sites attached to their assigned primary site. The proxy management point receives inventory data and status messages and sends them to the secondary site server to be forwarded to the parent site. Using a proxy management point increases bandwidth usage efficiency for clients at secondary sites.

Note
Proxy management points can be installed only at secondary sites.

To install a proxy management point at a secondary site

  1. In the Configuration Manager console of the secondary site's parent primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <primary site site code> - <site name>/ <secondary site site code> - <site name> / Site Settings / Site Systems / <server name>.

  2. Right-click the name of the server that you want to install the proxy management point on.

  3. Click New Roles and then complete the New Site System Roles Wizard to install the management point on the server.

See Also

Tasks

How to Add New Site System Roles


How to Verify Successful Proxy Management Point Installation

You can verify the successful installation of a proxy management point at a secondary site by reviewing the MPSetup.log file at the secondary site server computer, or by reviewing the status messages generated by the installation from the Configuration Manager console installed on the secondary site server's primary site server parent.

To verify successful proxy management point installation by reviewing the MPSetup.log file

  1. On the secondary site server computer, navigate to the <Configuration Manager program files directory>\Logs directory.

  2. Open the MPSetup.log file, and review its contents to determine if the proxy management point installation was successful. For a successful proxy management point installation, you should see the following lines in the MPSetup.log file:

    • mp.msi exited with return code 0
    • Installation was successful.

To verify successful proxy management point installation by reviewing status messages in the Configuration Manager console

  1. In the Configuration Manager console of the secondary site's parent primary site server, navigate to System Center Configuration Manager / Site Database / System Status / Site Status / <secondary site code - <site name> / Component Status.

  2. In the results pane, right-click the SMS_MP_CONTROL_MANAGER component, click Show Messages, and then click All.

  3. If Configuration Manager 2007 was able to install the management point site system role on the site system, a status message with the ID: 1015 for MP_CONTROL_MANAGER will be generated and displayed in the Status Message Viewer.

  4. If Configuration Manager 2007 was unable to install the management point site system role on the site system, a status message with the ID: 1016 for MP_CONTROL_MANAGER or SMS_EXECUTIVE will be generated and displayed in the Status Message Viewer. In this case, further status messages might also be generated detailing the specific reason why the proxy management point site system role could not be installed on the site system.


Configuring Configuration Manager Sites for Best Performance

Topic last updated—November 2007

The topics in this section provide performance recommendations that are the result of testing scenarios based on data processing for a central site, with the maximum number of 200,000 supported clients in a Configuration Manager hierarchy, and 2 child primary sites, with the maximum number of 100,000 supported assigned clients each in a Configuration Manager site.

For more information about capacity planning for Configuration Manager site systems, see Configuration Manager Site Capacity Planning.

Note
This is not a complete listing of every feature and function implemented during performance testing but rather an example of general performance testing objectives. For more information about common Configuration Manager 2007 performance related questions and sample configurations, see the technical whitepaper at http://go.microsoft.com/fwlink/?LinkID=113136.

  • Assigned clients were divided between 2 child primary sites with each supporting 100,000 assigned clients.
  • 200 boundaries were defined to manage client site assignment.
  • Computer collections for these sites were created ranging from 1,000 clients to 200,000 clients.
  • Client hardware inventory, including asset intelligence data, was collected (for both full and delta inventory report information).
  • Client software inventory was collected (both for full and delta inventory report information).
  • Active Directory discovery methods were used both for computers and for users.
  • The heartbeat discovery method was enabled.
  • Software distribution performance was tested using 100 distribution points with software distribution advertisements targeting 2,000, 60,000, and 200,000 clients.
  • Software metering was implemented using 1,000 software metering rules.

Before performance testing began, to obtain realistic performance metrics, the Configuration Manager site database was populated with a representative set of Configuration Manager objects.

For each primary site, supporting 100,000 clients, the database size was approximately 40 GB after the initial Configuration Manager object data was imported into the site database.

Note
Production Configuration Manager site databases can be expected to average approximately 3 MB for each client.

In This Section

Performance Considerations When Designing Configuration Manager Sites

Best Practices for Central and Primary Site Hardware and Software Configuration

Performance Configuration Recommendations

Expected Server Resource Usage for Configuration Manager Sites

Monitoring Site Performance

Troubleshooting Configuration Manager Performance

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Performance Considerations When Designing Configuration Manager Sites

The performance considerations described in this topic are based on the testing scenarios of a central site supporting the hierarchy maximum of 200,000 clients. The clients are divided equally between 2 child primary sites, with the maximum supported number of 100,000 assigned clients at each, with the features and configurations previously defined.

There is no exact definition of small, medium, or large site hierarchies to be used when planning for performance considerations. Each individual environment and feature implementation must be considered when determining your performance planning requirements. For example, a site with 10,000 clients could be considered a medium-sized site but might produce a larger client data processing load than a site or site database server with more assigned clients but less aggressive feature implementation or client agent scheduling.

Important
The performance considerations outlined in this topic are general considerations only. When planning for performance considerations during Configuration Manager site design, individual environments and performance expectations should be considered using these baseline testing results.

Co-Locating SQL Server Site Database with the Primary Site Server Computer

Installing the site database on the computer on which the primary site is installed generally results in good site performance if adequate hardware is used.

However, because Configuration Manager is more database processing intensive than previous versions of SMS, if there is a high speed connection between the site server computer and a remote SQL Server computer used to host the site database, site performance might be better than co-locating the site database on a local SQL Server instance to the site server computer.

Using a remote SQL Server to host the site database, with a fast network connection to the site server, allows two computers to more effectively process site information by working in parallel. For data processing intensive sites, this configuration results in less resource contention than using a single computer to host both the site and site database server installations.

Site Settings and Client Agent Configuration Considerations

When configuring site settings, the impact on site performance should be considered. For example, enabling Active Directory system or user discovery at multiple sites in the hierarchy can create a decrease in the performance of discovery data record (DDR) processing for discovered resources. If Active Directory discovery methods are run on multiple sites, it is possible that machines might be discovered multiple times. As each site discovers a resource, the resulting DDR is processed and sent to sites higher in the hierarchy. The processing impact of DDR records at higher sites is increased because each site must determine which discovery record for a resource discovered at multiple sites is the most recent.

The client agents enabled during Custom Setup were used in testing using their default schedules. If the default client agents enabled, or their schedules, are modified from their default settings, the performance impact should be considered during planning site designs.

Enabled Configuration Manager client agent schedules can greatly increase the amount of data the site server must process. Verifying that the agent schedules are as infrequent as possible, while still meeting your business and technical needs, will increase the data processing capabilities of the Configuration Manager site server and site database server.

In particular, planning for client features that generate state messages should be considered to avoid state message processing backlogs. For more information about troubleshooting state message backlogs, see Troubleshooting State Message Backlogs.

Virtualization Considerations

While it is supported to host Configuration Manager site systems as virtual computers using Virtual Server 2005 R2, the performance impact of using virtual computers instead of physical computers should be considered during performance planning.

The use of virtual computer site systems for Configuration Manager sites that must process a large amount of data is not recommended. The amount of client data processing that virtual site systems will process should be considered when deciding whether to use virtual or physical site system computers.

See Also

Other Resources

Configuring Configuration Manager Sites for Best Performance


Best Practices for Central and Primary Site Hardware and Software Configuration

Configuration Manager site servers use extensive amounts of server hard disk, CPU, and memory resources. It is very important to have the right configuration to achieve optimal performance for your individual environment and performance expectations.

The recommended server configuration described in this topic is applicable both for the central site servers as well as the primary site servers used in the previously defined testing scenario configuration of a central site supporting two child sites, with 100,000 clients assigned to each using default client agents and schedules. Subsystem performance can be improved by increasing the hardware specifications defined by the following recommendations.

Note
The Configuration Manager supported configurations documentation outlines the minimum hardware and software recommended for Configuration Manager site systems and clients. However, the minimum recommendations should not be used for data processing intensive sites. For more information about the minimum supported hardware and software recommended for Configuration Manager, see Configuration Manager Supported Configurations.

Hardware Recommendations

The following table lists the recommended hardware recommendations for Configuration Manager central or primary site servers managing large numbers of assigned clients.

Server Resource Specifications

CPU

An eight core CPU configuration, with fastest available CPU speed, is recommended.

Using dual core quad processor computers or quad core dual processor configurations can provide similar performance.

Memory

16 GB recommended.

Disk Array Configuration

For best performance, each logical volume should be implemented as a minimum of two 15,000 RPM hard disks configured in RAID 0. For better reliability and similar performance, four 15,000 RPM hard disks can be configured in RAID 10.

In general, hard disk arrays used for Configuration Manager installations should be configured so that separate volumes are used for each of the following:

Site server computer:

  • Operating System
  • Configuration Manager installation directory
  • Site and site database backup storage
  • Volume Shadow Copy (VSS) storage association for shadow copy temporary storage of the site and site database backup snapshots
Note
If the VSS storage association is not configured properly during site backup operations, performance can be severely impacted if the disk drive specified to store the site and site database backup files becomes full. For more information, see Troubleshooting Backup and Recovery Issues.

SQL Server hosting the site database:

  • SQL Server tempdb database
  • SQL Server database logs
  • SQL Server database

Selecting 64-Bit or 32-Bit Hardware for Configuration Manager Installations

The recommended operating system for Configuration Manager installations is Windows Server 2003 R2 (32-bit or 64-bit).

Note
Because Windows Server 2008 was still under development, it was not tested for Configuration Manager support.

Configuration Manager is a 32-bit application, so performance will not be as great on a 64-bit hardware as a native 64-bit application would provide. To ensure best results, install the 32-bit version of the Operating System even when working with 64-bit capable hardware.

The reduction in performance capabilities when using 64-bit hardware to host Configuration Manager installations (a 32-bit application) is small compared to using 32-bit hardware but should be anticipated before implementing this software and hardware combination.

Enabling Write Caching on Site System Hardware

When a site supports an extremely large number of clients, you should enable write caching on site system hardware RAID controllers. Configuration Manager site performance will be greatly impacted if the RAID controller cache option is set to read only. If RAID controller write caching is not enabled when supporting the maximum number of supported clients, poor site performance might result.

Note
In some cases, a battery backup module must be installed and configured for the RAID controller cache memory to be used when write caching is enabled. Consult the server manufacturer’s documentation for data reliability issues with write caching enabled before enabling this option on site system hardware.

See Also

Other Resources

Configuring Configuration Manager Sites for Best Performance


Performance Configuration Recommendations

This topic describes actions that can be taken to increase the performance of Configuration Manager 2007 sites.

Exclude Configuration Manager Inbox Directories from Antivirus Scanning Software

Because antivirus scanning of Configuration Manager inbox files can significantly reduce site performance, it is recommended that you exclude Configuration Manager inbox directories from antivirus scanning software.

Use a Consistent SMS_def.mof Hardware Inventory Reporting File Throughout the Site Hierarchy

In Configuration Manager 2007, hardware inventory has been enhanced to use multiple processing threads to process inventory reports quicker than previous versions of SMS. However, to take advantage of this capability, a consistent SMS_def.mof must be used throughout the site hierarchy.

When using inconsistent SMS_def.mof files in a site hierarchy, the site database schema is changed when processing hardware inventory reports that contain new information. When the site database schema is changed, all hardware inventory processing threads have to stop, wait for the schema to be changed, and then restart.

If inconsistent SMS_def.mof files are used in a site hierarchy, the only way to improve hardware inventory processing performance is to change the number of worker threads for the hardware inventory subsystem to 1. This will cause the Configuration Manager site to use a single processing thread to process hardware inventory reports.

Use Network Load Balancing Site Systems and a Replicated SQL Server Site Database

Configuration Manager management point site systems can support up to 25,000 clients, so if your site exceeds that number of assigned clients, the default management point site system must be configured as a network load balancing (NLB) virtual server.

When the default management point has been configured in an NLB configuration, it should be configured to access a replicated site database hosted by a different SQL Server instance than the actual site database. Using NLB site systems accessing a replicated SQL Server site database reduces the load on the site database and improves site performance. If the default management point is configured as an NLB and configured to access the site database directly, it will cause degraded site server performance. For more information about configuring network load balancing for Configuration Manager site systems, see How to Configure Network Load Balancing for Configuration Manager Site Systems.

See Also

Other Resources

Configuring Configuration Manager Sites for Best Performance


Expected Server Resource Usage for Configuration Manager Sites

Although every site performs differently based on hardware and software configurations, as well as client data processing loads, there are some general guidelines that can be used to help monitor and tune Configuration Manager site servers for best performance.

Disk Utilization in Configuration Manager Sites

On a Configuration Manager central site server computer, disk utilization is very high because of the high read/write nature of Configuration Manager site processes.

In general, the basic flow of data from child sites to a parent site in a Configuration Manager site hierarchy is as follows:

  • Data files received from clients and child sites during site-to-site communication are stored in the appropriate site server inbox directory.
  • The site server reads the data stored in the inboxes and processes it. As part of the data processing, some of the data is committed to the SQL Server site database.
  • The data operations conducted by the SQL Server are a combination of deletes, updates, and inserts.

During Configuration Manager performance testing the disk volumes with the highest levels of processing activity were the SQL database volume and the Configuration Manager installation (inboxes) volume. More moderate levels of disk activity should be expected on the SQL Server log volume, SQL Server tempdb volume, and Operating System volume.

Important
Improving the performance of the SQL Server database volume should be the first step in planning or improving the overall performance of Configuration Manager sites.

Performance Degradation Caused by Disk Fragmentation

Disk fragmentation will affect the performance of Configuration Manager site systems. Regular disk maintenance should be performed to maintain high Configuration Manager site system performance.

SQL Server index fragmentation of the site database also affects the performance of Configuration Manager sites. The built-in Rebuild Indexes Configuration Manager predefined site maintenance task can be used to regularly rebuild site database table indexes.

CPU Usage in Configuration Manager Sites

Configuration Manager has been designed to effectively maximize overall CPU processing. It is not unusual to see 85% or greater CPU usage on Configuration Manager site server computers.

When a local SQL Server instance is co-located with site server installation, CPU processing is load balanced between the following processes:

  • The SMS Executive service (SMSEXEC)
  • The SQL Server service (MSSQL)

SQL 2005 has a more aggressive query optimizer that consumes more CPU processing than previous versions of SQL server. When co-locating the SQL Server site database with the site server installation, it consumes more resources than previous versions of SMS utilizing SQL Server 2000. In sites performing large amounts of client data processing, SQL Server will normally consume about two-thirds of the processing usage, with SMSEXEC using the remaining available CPU resources.

See Also

Other Resources

Configuring Configuration Manager Sites for Best Performance


Monitoring Site Performance

Many performance counters available when monitoring performance on Windows servers and Configuration Manager sites. The following table lists a set of counters that have been identified as useful in monitoring and diagnosing Configuration Manager-related performance issues.

Note
This list is not all-inclusive and should be used as a general guideline only.

Configuration Manager Performance Counters

Performance Counter Category Performance Counter : Instance Data to be Monitored

Processor

% Processor Time : Total

Average CPU for all cores.

Process

% Processor Time : smsexec

Configuration Manager main process CPU usage.

Process

% Processor Time : sqlservr

SQL Server instance CPU usage.

Physical Disk

Avg. Disk Queue Length : Volume

Select one of these counters for each volume that is involved in Configuration Manager processes. This includes the operating system installation volume, ConfigMgr installation (inbox) volume, as well as the SQL Server tempdb, site database, and log volumes.

Physical Disk

% Disk Time

Select one of these counters for each volume that is involved in Configuration Manager data processing. This includes the operating system installation volume, ConfigMgr installation (inbox) volume, as well as the SQL Server tempdb, site database, and log volumes.

SqlServer:General Statistics

Temp Tables Creation Rate

General SQL Server statistics.

SqlServer:General Statistics

Logouts/sec

General SQL Server statistics.

SqlServer:General Statistics

Logins/sec

General SQL Server statistics.

SqlServer:SQL Statistics

SQL Re-Compilations/sec

General SQL Server statistics.

SqlServer:SQL Statistics

SQL Compilations/sec

General SQL Server statistics.

SqlServer:SQL Statistics

Batch Requests/sec

General SQL Server statistics.

SqlServer:Memory Manager

Lock Memory

General SQL Server statistics.

SQLServer:Locks

Lock Requests/sec

General SQL Server statistics.

SQLServer:Locks

Number of Deadlocks/sec

General SQL Server statistics.

SqlServer:Databases

Transactions/sec : SCCM db

General SQL Server statistics.

SqlServer:Databases

Transactions/sec : Wsus Db

General SQL Server statistics.

SMS Discovery Data Manager

Total DDRs Processed

Configuration Manager discovery data record processing rates.

SMS Discovery Data Manager

DDRs Processed/min

Current discovery data record processing rate.

SMS Discovery Data Manager

Total Client Registration requests Processed

Client registrations processed.

SMS Discovery Data Manager

Total Bad DDRs Processed

Bad Configuration Manager discovery data record processing rates.

SMS Inbox

File Current Count

Provides a count of the files in each inbox that are queued for processing. This counter is updated every 15 minutes by default.

List of Instances for this performance counter:

  • Auth\statesys.box>incoming (state system)
  • Auth\sinv.box (software inventory)
  • Auth\ddm.box (DDRs)
  • Auth\ddm.box>regreq (client registration requests)
  • Auth\dataldr.box (hardware inventory)
  • Statmgr.box\statmsgs (status messages)
  • Distmgr.box\incoming (distribution manager)
  • Colleval.box (collection evaluator)
  • Swmproc.box\usage (software metering usage)

SMS Inventory Data Loader

Total MIFs processed

Hardware inventory report processing.

SMS Inventory Data Loader

MIFs Processed/min

Hardware inventory report processing.

SMS Inventory Data Loader

Total Bad MIFs Processed

Hardware inventory report processing.

SMS Software Inventory Processor

Total SINVs Processed

Software inventory report processing.

SMS Software Inventory Processor

SINVs Processed/Min

Software inventory report processing.

SMS Software Inventory Processor

Total Bad SINVs Processed

Software inventory report processing.

SMS Software Metering Processor

SWM Usage Records Processed/min

Software metering data processing.

SMS Software Metering Processor

Total SWM Usage Records Processed

Software metering data processing

SMS Software Metering Processor

Total Bad SWM Usage Files Processed

Software metering data processing.

SMS State System

Summary Task Running

State system processing.

SMS State System

Message Files Processed/min

State system processing.

SMS State System

Message records processed/min

State system processing.

SMS State System

Total Bad Message Files Processed

State system processing.

SMS State System

Total Invalid Message Records Processed

State system processing.

SMS Status System

Processed/sec : Total

Status message processing.

SMS Status System

Corrupt : Total

Status message processing.

SMS Status System

Written to SMS Database : Total

Status message processing.

See Also

Other Resources

Configuring Configuration Manager Sites for Best Performance


Troubleshooting Configuration Manager Performance

Before troubleshooting Configuration Manager site performance, the first step should be to capture the actual site performance.

Collected performance counter information will give you a good overall view of how the site server is processing site information, any backlog of files for each Configuration Manager subsystem, and any other site system operations. For more information about using the Configuration Manager performance counters, see Monitoring Site Performance.

To assist in diagnosing a possible performance problem with a particular type of data, it is possible to stop Configuration Manager inbox file processing for different subsystems to have the server focus on one message type. This can assist you in determining whether the server is just very busy at this time or whether one type of data is processing slower than expected.

A number of system configuration issues can manifest themselves with slower server processing. Some of the most common causes and diagnosis are covered in this topic.

General Site System Slow Processing

If Configuration Manager site system performance appears to be running slowly, careful diagnosis of your disk system may be required.

Solution

Verify the following if you suspect a site server processing slow down:

  • That disk-intensive operations are not running.
  • That antivirus software is not scanning the site server inbox directories.
  • That a system backup is not running during periods of perceived site system performance slow downs.

If none of the preceding conditions exist, consider the following:

  • Restarting the Configuration Manager site server and running a disk benchmark program to verify the performance of your disk subsystem.
  • If you have a SAS Raid controller, look carefully at the configuration of your write caching settings. If write caching is not enabled, Configuration Manager site system performance will be severely impacted.

General SQL Performance Troubleshooting Reference

The following information should be considered if the Configuration Manager site database or site database server system performance appears to be running slowly.

Solution

Ensure that the following items have been configured and scheduled to maintain site database performance goals:

  • The SQL Server site database, SQL Server tempdb, and SQL Server log files are installed on different disk volumes.
  • General SQL Server site database maintenance is performed and that the Rebuild Indexes predefined site maintenance task is scheduled to run regularly.
  • Consider dividing the SQL Server tempdb database into multiple database files. For best performance, the SQL Server tempdb database should be divided into a number of files corresponding to half the number of processors installed on the SQL Server computer. When the tempdb SQL Server database is installed using only one file, collisions with multiple processors might occur. For more information, see "PRB: Concurrency enhancements for the tempdb database" at http://go.microsoft.com/fwlink/?LinkId=103713.
  • For general SQL performance investigations, see the "Troubleshooting Performance Problems in SQL Server 2005" whitepaper at http://go.microsoft.com/fwlink/?LinkId=103718.

Client Deployment Impact on Site Server Processing

During Configuration Manager client deployment, a lot of information is sent from the newly installed client to the site server, including the following:

  • Fallback status point state messages during the installation process.
  • Configuration Manager client registration.
  • Full hardware and software inventory reports.
  • Full WSUS software update compliance scan and state message reports.

Solution

When planning to deploy or upgrade a substantial number of Configuration Manager clients, ensure that their configured client agent schedules and the performance impact of other site processes are taken into consideration. Deploying or upgrading Configuration Manager clients during a large software updates deployment is not recommended.

When installing Configuration Manager clients, it might take a considerable amount of time for the site server to process all of the client installation generated information. During this time, site system performance might be degraded until all of the client deployment data has been processed.

Slow Hardware Inventory Processing

The following information should be considered if you suspect that hardware inventory report processing for the Configuration Manager site is slow.

Solution

If you suspect that hardware inventory report processing is slow for a Configuration Manager 2007 site, the following actions should be taken:

  • Inspect the client inventoryagent.log log file to determine whether the client is sending delta hardware inventory reports or full reports. After initial client deployment, a very high percentage of hardware inventory reports should be deltas, which contain much less data than full inventory reports. If you are seeing a significant number of full inventory reports, this could be caused by inconsistent inventory report processing by the site server. For example, a delta hardware inventory report could be processed before a full inventory report for the same system has been processed. In this situation, a hardware inventory resynchronization request will be sent to the client and an additional full inventory report will be generated. To determine whether this is happening, review the dataldr.log log file on the site server.
  • Inspect the size of the hardware inventory files in the site server's inbox directory to determine whether the software inventory files have grown significantly from previous inventory reports. If hardware inventory report file sizes have grown beyond an initial hardware inventory report file size baseline, you should determine the cause and whether the larger inventory report files are expected to be larger. One possibility is that the site’s SMS_def.mof file has been modified to collect more inventory information from clients.
    Note
    The performance counters monitor only the file processing rate, not the size of the files.

  • Determine whether there is a consistent SMS_def.mof hardware inventory reporting file in use throughout the hierarchy. If not, the hardware inventory processor might be running very slowly because of changes in the database schema caused by the different SMS_def.mof files throughout the hierarchy. The dataloader.log log file will record instances of database schema changes and should be reviewed when investigating this issue. For more information about using a consistent SMS_def.mof hardware inventory reporting file throughout the hierarchy, see Performance Configuration Recommendations.

Slow Software Inventory Processing

The following information should be considered if you suspect that software inventory report processing is slow.

Solution

If you suspect that software inventory report processing is slow for a Configuration Manager 2007 site, the following actions should be taken:

  • Inspect the site sinvproc.log log file on the site server to determine whether you are processing delta software inventory reports or full reports. After initial client deployment, a very high percentage of software inventory reports should be deltas, which contain much less data than full inventory reports. If you are seeing a significant number of full inventory reports, this could be caused by inconsistent inventory report processing by the site server. For example, a delta hardware inventory report could be processed before a full inventory report for the same system has been processed. In this situation, a software inventory resynchronization request will be sent to the client and an additional full inventory report will be generated.
  • Inspect the size of the software inventory files in the site server's inbox directory to determine whether the software inventory files have grown significantly from previous inventory reports. If software inventory report file sizes have grown beyond an initial software inventory report file size baseline, you should determine the cause and whether the software inventory report files are expected to be larger. One possibility is that the software inventory information to be collected from clients has been modified by an administrator.
    Note
    The performance counters monitor only the file processing rate, not the size of the files.

Slow DDR Processing

The following information should be considered if the Configuration Manager site discovered data resource (DDR) file performance processing appears to be running slowly.

Solution

If you suspect that DDR message processing is slow for a Configuration Manager 2007 site, the following actions should be taken:

  • Inspect the DDR related logs to see whether you are processing heartbeat DDRs or Active Directory system or user discovery DDRs.
  • If there is a large percentage of Active Directory discovery DDRs over time, you might need to carefully review the Active Directory discovery settings throughout the site hierarchy to ensure that multiple sites are not discovering the same resources. If multiple sites are discovering the same resources, certain site database tables can become very large, which will slow down DDR processing.

Slow State Message Processing

The following information should be considered if the Configuration Manager site state message processing performance appears to be running slowly.

There are several classes of data that are processed by the Configuration Manager 2007 state system. In general, the largest generators of state messages are as follows:

  • Software updates information.
  • Desired configuration management report information.
  • Asset intelligence Client Access License (CAL) reporting information.
  • Fallback status point messages.

If the state message processing for a site appears to be slower than expected, the following solution might help resolve the slow message processing condition.

Solution

There is no way to identify the type of data being processed by the state system at any given time by inspecting the state system performance counters. If you suspect that state message processing is slow for a Configuration Manager 2007 site, the following actions should be taken:

  • Check the state system logs for errors.
  • Check the state system logs for re-sync reports from clients. If the site server thinks data is missing from a client, it will generate a re-sync request to the client. The client will respond with a large amount of historical data, which can cause extra processing on the server.
  • Rebuild indexes on your Configuration Manager 2007 site database. The state system interacts heavily with SQL Server site database, and fragmented indexes can affect performance.
  • Check the schedules of site operations that generate state messages. In particular, you should check the following:
    • Software update schedules.
    • Configuration baseline assignment schedule for desired configuration management.
    • Asset intelligence Client Access License (CAL) reporting schedules.
    • The impact of any current client deployment operations.

See Also

Other Resources

Configuring Configuration Manager Sites for Best Performance


Configuration Manager Upgrade and Interoperability Planning and Deployment

When preparing to upgrade a Microsoft Systems Management Server (SMS) 2003 site hierarchy, or preparing to administer a mixed SMS 2003 and Configuration Manager site hierarchy, you should carefully consider the information in this section.

In This Section

Planning to Upgrade to Configuration Manager

Configuration Manager 2007 Upgrade Checklist

Configuration Manager In-Place Upgrade

Configuration Manager Side-By-Side Upgrade

Upgrading Secondary Sites

Configuration Manager Post-Upgrade Considerations

Configuration Manager Tasks for Upgrade and Interoperability

Configuration Manager Upgrade Flowcharts

Configuration Manager Upgrade Administrator Workflows

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Planning to Upgrade to Configuration Manager

You should complete the necessary planning required before beginning the upgrade process. Before you can create an upgrade plan, you must determine what goals and results you want to achieve by upgrading to Configuration Manager 2007.

When planning to upgrade your SMS 2003 hierarchy, consider how the new features available with Configuration Manager may influence the overall design of your hierarchy. For example, by using the branch distribution point Configuration Manager 2007 feature, you can reduce the amount of secondary sites from the hierarchies which were used solely for software distribution to remote sites with few clients. A complete understanding of Configuration Manager 2007 features, and how they can support your business needs, may influence you to decide to make major design changes to your existing SMS 2003 hierarchy before or during the upgrade process.

In order to begin the upgrade process, all SMS 2003 sites to be upgraded must be at the SMS 2003 SP2 level or above. The upgrade process must begin with the central site in your SMS 2003 site hierarchy and then you can upgrade child sites using a top-down approach. Configuration Manager 2007 Setup does not provide an automated upgrade process for secondary sites, so you must manually upgrade each secondary site. You must upgrade the SMS 2003 sites to Configuration Manager 2007 before upgrading the clients assigned to those sites.

In This Section

Considerations for Upgrading Sites

Prerequisites for Upgrading to Configuration Manager

Decide If You Should Perform an In-Place or Side-By-Side Upgrade

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Considerations for Upgrading Sites

Topic last updated -- November 2007

As you plan your upgrade strategy, consider the following:

  • In order to begin the upgrade process, all SMS 2003 sites to be upgraded must be at the SMS 2003 SP2 level or above.
  • Regardless of the method used to upgrade a Microsoft Systems Management Server (SMS) 2003 hierarchy, you must always begin at the central site. It is not supported to have a Configuration Manager 2007 site reporting to an SMS 2003 parent site.
  • SMS 2003 primary sites cannot be managed using a Configuration Manager console. You must install a remote SMS 2003 Administrator console to manage any SMS 2003 child primary sites when the SMS 2003 primary site's parent site is upgraded to Configuration Manager 2007.
    Note
    SMS 2003 secondary sites can be managed from within the Configuration Manager 2007 console.

  • When upgrading SMS 2003 Administrator consoles using the Configuration Manager Setup Wizard, a new Configuration Manager console is installed side-by-side with the existing SMS 2003 Administrator console. After the Configuration Manager console is installed, there is no option to separately uninstall the SMS 2003 Administrator console and both consoles will be uninstalled when the Configuration Manager console is uninstalled. If you will not need an SMS 2003 Administrator console to manage an existing SMS 2003 primary site, you should uninstall the SMS 2003 Administrator console before installing the Configuration Manager console.
    To uninstall the SMS 2003 Administrator console during the upgrade process, the /upgrade Setup command line option can be used instead of the Configuration Manager Setup Wizard. When the command Setup /upgrade is used to upgrade an SMS 2003 Administrator console, the existing SMS 2003 Administrator console is uninstalled before the new Configuration Manager console is installed.
    Note
    After upgrading an SMS 2003 Administrator console, the new Configuration Manager console might not be connected to the site database. To connect the Configuration Manager console to the Configuration Manager site database, use the Connect to Site Database Wizard. For more information about the Connect to Site Database Wizard, see Connect to Site Database Wizard.

  • Site boundaries created in SMS 2003 sites cannot be modified from within a Configuration Manager console after an SMS 2003 site is upgraded. When an SMS 2003 site is upgraded, the pre-existing SMS 2003 site boundaries for the upgraded site will become read only in the Configuration Manager console and cannot be modified. To change the site boundaries for a site after an upgrade, the existing SMS 2003 site boundary must be deleted and a new site boundary created.
  • During the upgrade process, existing default collections are not recreated. If custom membership rules were created for default collections before upgrading the site, the membership rules for default collections will remain using the customized query values. If any of the default Configuration Manager 2007 collections are not present on the site to be upgraded, they will be created during the upgrade process.
  • Any non-SMS files or folders that are in the SMS 2003 folder structure will be deleted when SMS 2003 is upgraded. To avoid removing non-SMS data when SMS is upgraded or removed, install SMS in a folder that does not contain other application or data files.
  • If you have extended your Active Directory schema for SMS 2003, you should update your schema extensions for Configuration Manager 2007. Schema extensions are not required but are strongly recommended and provide many benefits to Configuration Manager 2007 sites. For more information about deciding whether or not to extend the Active Directory schema for Configuration Manager 2007, see Decide If You Should Extend the Active Directory Schema. For more information about how to extend the Active Directory schema for Configuration Manager 2007, see How to Extend the Active Directory Schema for Configuration Manager.
  • Determine whether you want to upgrade all or some of your SMS 2003 sites to Configuration Manager 2007. Although SMS 2003 sites can report to a Configuration Manager parent site, it is not supported for a Configuration Manager site to report to an SMS 2003 parent site.
  • Determine which SMS 2003 features you want to use. Configuration Manager 2007 has many useful features. Some features have requirements that must be met before you can use them. Keep your goals in mind as you determine which upgrade strategy helps you achieve the desired results, because feature requirements might conflict with your desired results.
  • Due to changes in hardware inventory between SMS 2003 and Configuration Manager 2007, clients assigned to upgraded sites will perform an inventory resynchronization, sending full hardware inventory reports instead of delta reports. If many clients perform resynchronization at the same time, these inventory resynchronizations might cause excessive load on the network and might cause the site systems in your Configuration Manager 2007 hierarchy to take a long time to process hardware inventory data. To reduce the load on your network and Configuration Manager 2007 site servers, consider performing site upgrades in stages to prevent too many clients from resynchronizing at the same time.
  • SMS 2003 hardware inventory customizations are not migrated when you upgrade to Configuration Manager 2007. You must manually include those customizations in the configuration.mof file (custom data classes) and the SMS_def.mof file (custom reporting classes) that are created during the upgrade process after the site upgrade has completed.
    Important
    The default SMS_def.mof located in the Configuration Manager installation source files should not be modified before beginning the site upgrade process. During site installation, the SMS_def.mof hardware inventory reporting file is updated depending on the configuration of the site to be upgraded. Modifying the default SMS_def.mof file before beginning the upgrade process might cause the upgrade to be unsuccessful.

  • When you upgrade a site, customized inventory names are migrated from SMS 2003 and default inventory collection names are installed. If you have previously removed any default inventory collection names, the collection names reappear in Software Inventory Client Agent Properties after the upgrade.
  • Upgrading a site to a different language is not supported. When upgrading sites, ensure that the site to be upgraded is running in the same localized language as the version you are upgrading to.
  • Software updates metadata is migrated during a site upgrade, but there are some limitations when scanning for software updates compliance using SMS 2003 inventory scan tools and deploying software updates to SMS 2003 clients. For more information, see Planning the SMS 2003 Software Updates Upgrade.
    Important
    Configuration Manager 2007 does not support upgrading sites with the SMS 2003 R2 Vulnerability Assessment Tool installed. You should first uninstall the Vulnerability Assessment Tool before upgrading an SMS 2003 R2 site to Configuration Manager 2007. After upgrading the site to Configuration Manager 2007, the desired configuration management vulnerability assessment configuration items can be downloaded.

  • Parcels created with Courier Sender Manager in Configuration Manager 2007 cannot be read on SMS 2003 child sites.
  • If you installed a new Configuration Manager 2007 site server, a site reset sets the access control lists (ACLs) back to the original settings. If you upgrade an existing Systems Management Server (SMS) 2003 site, Setup does not change the permissions on the upgraded directories. Also, if you do a site reset of a site that was upgraded from SMS 2003, the site reset does not reset the ACLs on the upgraded directories.

See Also

Concepts

Planning to Upgrade to Configuration Manager


Prerequisites for Upgrading to Configuration Manager

When preparing to upgrade an existing SMS 2003 site, consider the following information before beginning the upgrade process:

  • In order to begin the upgrade process, all SMS 2003 sites to be upgraded must be at the SMS 2003 SP2 level or above.
  • In SMS 2003, you had the option of standard security or advanced security, and advanced security was recommended. In Configuration Manager 2007, you have only one security mode and that mode is equivalent to SMS 2003 advanced security mode. Before upgrading an SMS 2003 site, ensure that the site has been configured to use advanced security. Also verify that all of its direct child sites are using advanced security before upgrading the site to Configuration Manager 2007.
  • Before you upgrade your SMS site, upgrade any SMS 2003 Legacy Clients deployed to computers running the Windows 2000 Service Pack 4 operating system, or later, to the SMS 2003 Advanced Client.
  • When performing an upgrade to Configuration Manager 2007 from SMS 2003, it is important that you first verify that all site systems meet any new prerequisite requirements. For instance, Web-based Distributed Authoring and Versioning (WebDAV) was not a requirement for management points in SMS 2003, but it is for Configuration Manager management points. If upgrading a site with a remote management point, you must ensure that the remote management point meets the WebDAV prerequisite requirement. The Configuration Manager 2007 Setup prerequisite checker does not verify that remote site system prerequisites are met. For more information about Configuration Manager 2007 prerequisites, see Prerequisites for Installing Configuration Manager.
  • Disable Microsoft® SQL Server™ replication of the SMS site database, if you enabled it. For more information about disabling SQL Server replication, see How to Disable SQL Server Database Replication
  • Uninstall any installed SMS 2003 feature packs, except for the Inventory Tool for Microsoft Updates.
  • During the upgrade process, existing default collections are not recreated. If custom membership rules were created for default collections before upgrading the site, the membership rules for default collections will remain using the customized query values. If any of the default Configuration Manager 2007 collections are not present on the site to be upgraded, they will be created during the upgrade process. To disable the creation of default collections during Setup, the /NODEFAULTCOLL Setup command line option can be used.
  • When upgrading to Configuration Manager 2007 , immediately following the Configuration Manager 2007 site server upgrade, the installed inventory tools must be upgraded. The SMS 2003 inventory tools (including any third-party inventory scan tools) do not run properly on Configuration Manager sites. The new version of the Inventory Tool for Microsoft Updates (SMSITMU.MSI) is located in \SMSSETUP\SUMSCANTOOLS\I386 on the Configuration Manager 2007 installation CD. When the inventory tool upgrade completes, the synchronization task initiates as a separate process and runs in the background. When synchronization completes, the new catalog displays in the Software Updates Catalog node of the Configuration Manager console and the associated software update information is available.

See Also

Concepts

Planning to Upgrade to Configuration Manager


Decide If You Should Perform an In-Place or Side-By-Side Upgrade

The upgrade strategies you choose directly affect how long an upgrade takes to complete, the effect an upgrade has on your network, and the fundamental structure of your site hierarchy.

Upgrade strategies are divided into two major categories:

  • In-place upgrades
  • Side-by-side upgrades

You are not limited to a single upgrade strategy for the entire site hierarchy. Because of the complex nature of Configuration Manager 2007, you might decide to employ a mixture of upgrade strategies that best fit your needs.

In-Place Upgrades

In-place upgrades offer the following benefits:

  • Generally easier to do and require less planning than side-by-side upgrades.
  • Better suited for use when you do not want to modify any computer hardware currently in use in your Microsoft Systems Management Server (SMS) 2003 sites.
  • Do not require the purchase of new hardware.
  • Do not require site boundary changes between sites.
  • Do not require clients to be reassigned to new sites.

Side-by-Side Upgrades

Side-by-side upgrades offer the following benefits:

  • Better suited to upgrade sites when new hardware will be used.
  • Easier to revise the existing SMS 2003 site hierarchy.
  • Allow you to rearrange sites and clients within the site hierarchy.

See Also

Concepts

Planning to Upgrade to Configuration Manager
Configuration Manager In-Place Upgrade
Configuration Manager Side-By-Side Upgrade


Configuration Manager 2007 Upgrade Checklist

Topic last updated—January 2008

This checklist outlines the steps you should take to upgrade SMS 2003 Service Pack 2, or above, sites to Microsoft System Center Configuration Manager 2007. It is intended to provide a high-level list of items to consider when upgrading or to provide guidance for new installations of Configuration Manager 2007. For information about performing a new installation of Configuration Manager 2007, see Planning and Deploying the Server Infrastructure for Configuration Manager 2007.

Upgrading from SMS 2003 Sites to Configuration Manager 2007

The following checklist provides the recommended steps to upgrade a Microsoft Systems Management Server (SMS) 2003 Service Pack 2, or above, sites to Configuration Manager 2007:

Step Reference

Complete the necessary planning required before beginning the upgrade process. Understand your business needs and how you will use Configuration Manager features to support them. This planning process might cause you to decide to make major design changes to your existing SMS 2003 hierarchy before or during the upgrade process.

Planning to Upgrade to Configuration Manager

Ensure your computing environment meets the supported configurations required for upgrading to Configuration Manager 2007.

Configuration Manager Supported Configurations

Review the prerequisites and considerations for upgrading to Configuration Manager 2007 before beginning the upgrade process.

Considerations for Upgrading Sites

Prerequisites for Upgrading to Configuration Manager

Determine readiness for upgrading. Verify that each primary site, secondary site, Configuration Manager 2007 provider computer, and SMS 2003 Administrator Console has the necessary prerequisite software installed and configured in preparation for upgrade to Configuration Manager 2007.

Prerequisites for Installing Configuration Manager

Setup Prerequisite Checks

There are two prerequisites that are not detected by the prerequisite checker and are not listed in other prerequisite documentation. You must manually apply the following hotfixes prior to running Setup:

  • 940848
  • 941132

http://go.microsoft.com/fwlink/?LinkID=98349 http://go.microsoft.com/fwlink/?LinkID=98350.

Test the database upgrade process on a copy of the most recent SMS 2003 site database back up. During the upgrade process, the site database may be modified. If the upgrade fails or is cancelled for any reason, you should create a new copy of the back up to ensure a valid site database backup is available for testing.

How to Test the Site Database Upgrade Process

If you have extended your Active Directory schema for SMS 2003, it is recommended that you update the schema extensions for Configuration Manager 2007. Schema extensions are not required, but they do provide many benefits.

If you have previously extended the Active Directory schema for SMS 2003, and will be using the ConfigMgr_ad_schema.ldf file to extend the Active Directory schema for Configuration Manager, review the manual procedures necessary for successfully storing all required attributes.

You can extend the schema before or after running Configuration Manager Setup, but it is recommended that you extend the schema before running setup.

Decide If You Should Extend the Active Directory Schema

How to Extend the Active Directory Schema for Configuration Manager

How to Extend the Active Directory Schema Using an LDIF File

Because Configuration Manager sites require secure key exchange by default, it is recommended that you configure SMS 2003 sites to be upgraded to also require secure key exchange before beginning the upgrade process. Secure key exchange requirements are configured for a site on the advanced tab of the site properties.

If the Active Directory schema has not been extended (either for SMS 2003 or Configuration Manager) or the site is not configured to publish site data to Active Directory, you must manually exchange public keys between sites when secure key exchange is required.

Site Properties: Advanced Tab

How to Manually Exchange Public Keys Between Sites

If the planned site server computer does not have Internet access, the Prerequisite Component Update Checker must be started on a different computer with Internet access. To start the Prerequisite Component Update Checker to download updated client installation prerequisite components, use the Setup command-line option of Setup /download <path>. When downloading prerequisite update files from a different computer, ensure that the download path specified will be accessible to planned site system computers when the Setup Wizard is run and that an alternate path is used to obtain client prerequisite component files.

Prerequisite Component Update Checker

Upgrade the hierarchy. Begin by upgrading the central site, and then upgrade from the top of the hierarchy down. After the primary sites are upgraded, begin upgrading their associated secondary sites, administrator consoles, and finally, clients.

Important
SMS 2003 primary sites cannot be managed by a Configuration Manager console installed on a Configuration Manager primary site server. If the site to be upgraded is a parent site to one or more SMS 2003 primary sites, ensure that you have installed a remote SMS 2003 Administrator Console to manage those sites.

Configuration Manager Tasks for Upgrade and Interoperability

After upgrading each site, you must manually grant permissions to administrators who need access to the site's Configuration Manager console and site objects.

When you upgrade from SMS 2003, the user performing the upgrade receives administrator rights for all of the objects in the Configuration Manager 2007 console. However, if you had additional users configured with Configuration Manager rights, they do not receive rights to new objects.

For more information about Configuration Manager object security, see Overview of Configuration Manager Object Security and WMI.

How to Assign Rights for Objects to Users and Groups

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Configuration Manager 2007 SP1 Upgrade Checklist

Topic last updated—March 2008

This checklist outlines the steps you should take to upgrade Microsoft System Center Configuration Manager 2007 sites to Configuration Manager 2007 Service Pack 1 (SP1). It is intended to provide a high-level list of items to consider when applying the service pack. For information about performing a new installation of Configuration Manager 2007, see Planning and Deploying the Server Infrastructure for Configuration Manager 2007. For information about upgrading Systems Management Server (SMS) 2003 Service Pack 2, or above, sites to Configuration Manager 2007, see Configuration Manager 2007 Upgrade Checklist.

Note
It is not necessary to re-extend the Active Directory schema for Configuration Manager 2007 SP1 if it has already been extended for Configuration Manager 2007.

Upgrading Configuration Manager Sites to Configuration Manager 2007 SP1

The following checklist provides the recommended steps to upgrade Configuration Manager 2007 sites to Configuration Manager 2007 SP1.

Step Reference

Ensure your computing environment meets the supported configurations required for upgrading to Configuration Manager 2007 SP1.

Configuration Manager 2007 SP1 Supported Configurations

Verify that you do not have any unresolved issues with the site by checking the site status messages.

Using Status Messages for Configuration Manager Troubleshooting

Install any critical Microsoft Windows updates on your site servers and site systems.

http://go.microsoft.com/fwlink/?LinkId=105851

Install any critical Microsoft SQL Server updates on your site database servers.

http://go.microsoft.com/fwlink/?LinkId=105851

The Windows Automated Installation Kit (WAIK) version 1.0 must be uninstalled from the SMS Provider computer and the computer must be restarted before beginning the upgrade process.

Note
WAIK 1.1 will be installed on the SMS Provider computer as part of the service pack installation.

Internal process that is company-specific.

If you are using SQL Server Database Replication, disable it before upgrading.

How to Disable SQL Server Database Replication

Back up your sites.

Tasks for Backing Up a Site

If you have SMS 2003 clients in the site, apply hotfix 945635.

http://go.microsoft.com/fwlink/?LinkId=107344

If you are using the software updates feature, upgrade Windows Server Update Services (WSUS) to WSUS SP1 on your software update points.

http://go.microsoft.com/fwlink/?LinkId=110111

Run the Setup Prerequisite Checker.

How to Start the Setup Prerequisite Checker

Verify that all site systems, including the primary site, secondary site, Configuration Manager 2007 provider computer, and Configuration Manager 2007 consoles, meet any new prerequisite requirements. For example, Web-based Distributed Authoring and Versioning (WebDAV) is required for Configuration Manager management points and BITS-enabled distribution points, but Windows Server 2008 operating system does not automatically install WebDAV. Site servers and branch distribution points require Remote Differential Compression (RDC) to generate package signatures and perform signature comparison. RDC is not installed by default on computers running Windows Server 2008.

Important
The Configuration Manager 2007 SP1 Setup Prerequisite Checker does not verify that remote site system prerequisites are met. The Setup Prerequisite checker does not verify that WebDAV is installed on any BITS-enabled distribution points, including the site server.

Prerequisites for Installing Configuration Manager

How to Configure Windows Server 2008 for Site Systems

Test the database upgrade process on a copy of the most recent Configuration Manager 2007 site database backup. During the upgrade process, the site database might be modified. If the upgrade fails or is cancelled for any reason, you should create a new copy of the backup to ensure a valid site database backup is available for testing.

How to Test the Site Database Upgrade Process

If the planned site server computer does not have Internet access, the Prerequisite Component Update Checker must be started on a different computer with Internet access. To start the Prerequisite Component Update Checker to download updated client installation prerequisite components, use the Setup command-line option of Setup /download <path>. When downloading prerequisite update files from a different computer, ensure that the download path specified will be accessible to planned site system computers when the Setup Wizard is run and that an alternate path is used to obtain client prerequisite component files.

Important
Ensure that the directory used to store prerequisite update files does not contain previously downloaded files. Configuration Manager 2007 prerequisite update files cannot be used for Configuration Manager 2007 SP1 site installations.

Prerequisite Component Update Checker

Restart the site server and site systems to ensure that there are no pending actions from installing updates or prerequisites.

Select Configuration Manager 2007 from the autorun screen, or start Setup.exe from the Configuration Manager installation media or from a copy of the installation media located on a network share or other storage media to start the Configuration Manager Setup Wizard.

Configuration Manager Tasks for Upgrade and Interoperability

After upgrading the central site, upgrade the rest of the hierarchy from the top down. After the primary sites are upgraded, begin upgrading their associated secondary sites, administrator consoles, and clients.

Configuration Manager Tasks for Upgrade and Interoperability

If you are using SQL Server Database Replication, reconfigure it after upgrading.

How to Configure SQL Server Site Database Replication

Verify that the site installed successfully.

How to Verify Successful Site Installation

Effects on Boot Images when Upgrading to Configuration Manager 2007 SP1

When a Microsoft System Center Configuration Manager 2007 site is upgraded to Configuration Manager 2007 SP1, the Windows Automated Installation Kit (Windows AIK) is not automatically upgraded from version 1.0 to version 1.1. Before upgrading the site to Configuration Manager 2007 SP1, WAIK 1.0 must be uninstalled from the SMS Provider computer and the computer must be restarted.

Existing default boot images named Boot image (x86) and Boot image (x64) are recreated under the Boot Images node. The boot images are based on the Windows PE that is included in the Windows AIK version 1.1. If you have customized the default boot images but kept the default names, the customizations will be lost as part of the upgrade process. The device driver additions from the Configuration Manager Drivers node will continue to be included in the recreated boot images and will not be lost.

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Configuration Manager 2007 R2 Upgrade Checklist

Topic Last Updated—August 2008

The following checklist is intended to provide a high-level list of items to consider and outlines the steps you should take to install the Configuration Manager 2007 R2 feature update release on a Microsoft System Center Configuration Manager 2007 SP1 site. For information about performing a new installation of Configuration Manager 2007, see Planning and Deploying the Server Infrastructure for Configuration Manager 2007.

Note
It is not necessary to extend the Active Directory schema for Configuration Manager 2007 R2.

Step Reference

Ensure your computing environment meets the supported configurations required for installing the Configuration Manager 2007 R2 feature update release.

Configuration Manager 2007 R2 Supported Configurations

Verify that you do not have any unresolved operational issues with the site by checking the site status messages.

Using Status Messages for Configuration Manager Troubleshooting

Install any critical Windows updates on the site server and site systems.

http://go.microsoft.com/fwlink/?LinkId=105851

Install any critical Microsoft SQL Server updates on the site database server.

http://go.microsoft.com/fwlink/?LinkId=105851

If you are using SQL Server Database Replication, disable it before upgrading.

How to Disable SQL Server Database Replication

Back up the site to be upgraded.

Tasks for Backing Up a Site

No additional schema updates are required for Configuration Manager 2007 R2. However, if you have not already extended your schema for Configuration Manager 2007, you should consider the benefits of extending it.

Decide If You Should Extend the Active Directory Schema

Restart the site server and site systems to ensure that there are no pending actions from installing updates or prerequisites.

Run Configuration Manager 2007 R2 Setup from the Configuration Manager installation media, from a copy of the installation media located on a network shared folder, or other storage media to start the Configuration Manager R2 Setup Wizard.

Important
When installing Configuration Manager 2007 R2 in multi-site hierarchies, the central site should always be the first site Configuration Manager 2007 R2 is installed on.

Configuration Manager Tasks for Upgrade and Interoperability

After installing the Configuration Manager 2007 R2 feature update release on the primary site server, Configuration Manager 2007 R2 Setup must be run on any associated Configuration Manager consoles to allow Configuration Manager 2007 R2 features to be displayed.

Note
The displayed product version number for Configuration Manager console installations does not change after running Configuration Manager 2007 R2 Setup to add additional R2 feature support.

Configuration Manager Tasks for Upgrade and Interoperability

If you are using SQL Server Database Replication, reconfigure it after upgrading.

How to Configure SQL Server Site Database Replication

Verify that the site installed successfully.

How to Verify Successful Site Installation

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Configuration Manager In-Place Upgrade

Topic last updated—January 2008

If you determine that you can upgrade an existing Microsoft Systems Management Server (SMS) 2003 primary site directly to Microsoft System Center Configuration Manager 2007, you can perform an in-place upgrade. When you upgrade a site to Configuration Manager 2007 using the in-place upgrade method, the site server and its site systems do not change their site server roles. Also, existing clients do not change their site assignments when the site is upgraded.

Note
In some scenarios, it is supported to upgrade a site from evaluation version software. For example, you can run Configuration Manager 2007 Setup to upgrade an existing Configuration Manager 2007 site running evaluation version software. However, you cannot upgrade an existing SMS 2003 site with the Configuration Manager 2007 evaluation version software.. For more information, see the supported upgrade paths in the applicable version of Configuration Manager Supported Configurations.

After upgrading the primary site, you must upgrade each remote SMS Administrator console to the Configuration Manager console. You cannot access a Configuration Manager 2007 site using an SMS 2003 Administrator console.

Important
SMS 2003 primary sites cannot be managed by a Configuration Manager console installed on a Configuration Manager primary site server. If the site to be upgraded is a parent site to one or more SMS 2003 primary sites, ensure that you have installed a remote SMS 2003 Administrator console to manage those sites.

See Also

Tasks

How to Perform an In-Place Upgrade

Concepts

Administrator Workflow: Upgrading Sites
Administrator Workflow: In-Place Upgrade


Configuration Manager Side-By-Side Upgrade

In order to consolidate existing SMS 2003 sites, change the existing site hierarchy reporting structure, or upgrade server hardware during a site hierarchy upgrade, the side-by-side upgrade method should be used to upgrade SMS 2003 sites. The side-by-side upgrade method involves installing a new Configuration Manager 2007 site and possibly decommissioning the SMS 2003 site that the new site is replacing.

Site hierarchy upgrades must always begin with the central site. You can either upgrade the existing SMS 2003 central site to Configuration Manager 2007 or you can attach the existing SMS 2003 central site as a child site of a new Configuration Manager 2007 central site.

Note
If the existing central site is used to centrally manage custom collection or software distribution package creation for the hierarchy, you should consider upgrading the central site using the in-place upgrade.

Side-by-Side Upgrade Considerations

When using the side-by-side upgrade method to upgrade SMS 2003 sites and hierarchies, there are important considerations that must be planned for in your upgrade plan.

Site Boundary Considerations

Site boundaries should not be configured in such a way as to create an overlapping boundary situation. Site boundaries should always be deleted from the site to be decommissioned, and the site boundaries changes allowed to replicate throughout the hierarchy, before adding site boundaries to the new Configuration Manager 2007 site.

Site System Considerations

When preparing to begin the client upgrade and reassignment process, clients must not attempt to contact any SMS 2003 site systems still in operation. Before beginning the client upgrade process, ensure that SMS 2003 site systems are no longer published to Active Directory or still registered in WINS or DNS.

Distribution points need to be updated at the new site and distribution points from the old site removed from existing package properties.

Replicated Object Considerations

Custom computer collections and software distribution objects are replicated from Configuration Manager 2007 parent sites to their child sites. In order to migrate custom collections and software distribution objects from an existing SMS 2003 site to a new Configuration Manager 2007 site utilizing the side-by-side upgrade method, you must upgrade the existing SMS 2003 site to Configuration Manager 2007 first. After the existing site has been upgraded, install the new Configuration Manager 2007 site and attach it as a child site to the previously upgraded site.

When all of the required objects have replicated down to the new site, and if the newly installed Configuration Manager 2007 site will become the central site for the hierarchy, the parent-child site relationship can be broken and the original site can be decommissioned.

Because the site codes will be different, replicated collection and software distribution objects will have different unique IDs than objects created by the new Configuration Manager 2007 site.

Note
Even though the unique IDs for replicated objects will be different than new objects created at the new Configuration Manager 2007 site, this does not affect collection evaluation or client software distribution operations at the new site.

Retaining Historical Client Data

Because client data flows up the site hierarchy, you can retain client historical data during the upgrade process by attaching the SMS 2003 site as a child site of the new Configuration Manager 2007 site. After client data has been replicated to the new Configuration Manager 2007 site, the parent-child site connection can be broken.

Client Installation and Upgrade Considerations

Client management must be maintained throughout the upgrade process. To ensure that clients are always assigned to a site and properly managed, you should maintain their existing SMS 2003 site assignment until the Configuration Manager 2007 site is fully functional. Reassigning and upgrading the SMS 2003 clients to Configuration Manager 2007 clients can be accomplished using client installation methods that do not require site boundary assignment. For example, you can use software distribution methods from the SMS 2003 site to simultaneously upgrade and reassign existing clients to the new Configuration Manager 2007 site. Another option is to enable a discovery method at the new Configuration Manager 2007 site (without assigning boundaries to the site itself) and use the client push installation method to upgrade and reassign clients.

See Also

Concepts

Administrator Workflow: Upgrading Sites
Administrator Workflow: Side-By-Side Upgrade

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Upgrading Secondary Sites

Secondary sites can be upgraded by either starting the Upgrade Secondary Site Wizard from within the parent site's Configuration Manager console or by running Configuration Manager Setup and selecting to upgrade the existing Microsoft Systems Management Server (SMS) 2003 secondary site.

Regardless of the method used to upgrade the secondary site, the primary site that the secondary site reports to should be upgraded to Configuration Manager 2007 before upgrading any attached secondary sites.

See Also

Tasks

How to Upgrade a Secondary Site Using Configuration Manager Setup
How to Upgrade a Secondary Site Using the Configuration Manager Console


Configuration Manager Post-Upgrade Considerations

After upgrading a site to Configuration Manager 2007, the site should be checked for general health and configured for daily operations.

Post upgrade tasks include:

Review Site Status

Site system and site component status should be reviewed to ensure that the site, and its site systems, has been properly upgraded to Configuration Manager 2007.

After upgrading a site to Configuration Manager 2007, some system components may report initialization errors. This is caused by Site Component Manager reinstallation during the upgrade process. These initialization errors are temporary and will be resolved during the next site component status summarization cycle.

Check Site Database Integrity

Using a SQL Server backup of the upgraded site database should be checked using SQL Server database consistency checks to ensure the site database has upgraded successfully. The SQL Server 2005 DBCC CHECKDB stored procedure can be used to check the logical and physical integrity of all the objects in the site database. The DBCC CHECKDB stored procedure, performs the following operations:

  • Runs DBCC CHECKALLOC on the database.
  • Runs DBCC CHECKTABLE on every table and view in the database.
  • Runs DBCC CHECKCATALOG on the database.
  • Validates the contents of every indexed view in the database.
  • Validates the Service Broker data in the database.

Update Custom Hardware Inventory Modifications

Differences between the SMS_def.mof files at different sites of the same version in the hierarchy can lead to conflicting hardware inventory data. To prevent conflicts, you should make sure that each site of the same version in the hierarchy uses the same hardware inventory definitions.

Because SMS 2003 sites use only the SMS_def.mof to customize hardware inventory, the hardware inventory customizations made to the SMS_def.mof previously should be added to the appropriate Configuration Manager 2007 hardware inventory MOF file: Configuration.mof file for data classes and the SMS_def.mof for reporting classes. For more information about MOF files used in Configuration Manager 2007 hardware inventory, see About MOF Files Used by Hardware Inventory.

Configure Site Settings

Configuration settings from SMS 2003 sites are preserved during an upgrade. Existing site configurations should be reviewed to ensure that the site is configured for Configuration Manager 2007 operations. Site setting requirements may have changed due to site hierarchy configuration changes or because of new features introduced by Configuration Manager 2007.

In general, perform post-upgrade tasks in the following order:

  • Assign new site system roles
  • Configure site maintenance tasks
  • Update boundaries as needed
  • Configure discovery methods
  • Configure client agent settings and schedules
  • Configure client installation methods

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Configuration Manager Tasks for Upgrade and Interoperability

Follow the procedures in this section to perform the tasks necessary to properly upgrade to Configuration Manager 2007.

In This Section

How to Perform an In-Place Upgrade

How to Perform a Side-By-Side Upgrade

How to Test the Site Database Upgrade Process

How to Upgrade a Secondary Site Using the Configuration Manager Console

How to Upgrade a Secondary Site Using Configuration Manager Setup

How to Upgrade an SMS 2003 Administrator Console


How to Perform an In-Place Upgrade

If you determine that you can upgrade an existing Microsoft Systems Management Server (SMS) 2003 primary site directly to Microsoft System Center Configuration Manager 2007, you can perform an in-place upgrade. When you deploy Configuration Manager 2007 using the in-place upgrade method, the site server and its site systems do not change their site server roles. Also, existing clients do not change their site assignments when the site is upgraded.

In some scenarios, it is supported to upgrade a site from evaluation version software. For example, you cannot run Configuration Manager 2007 Setup to upgrade an existing SMS 2003 Service Pack 3 site running the evaluation version software, but you can upgrade SMS 2003 Service Pack 3 to the Configuration Manager 2007 SP1 evaluation version. For more information, see the upgrade paths section of the applicable Configuration Manager Supported Configurations.

Important
SMS 2003 primary sites cannot be managed by a Configuration Manager console installed on a Configuration Manager primary site server. If the site to be upgraded is a parent site to one or more SMS 2003 primary sites, ensure that you have installed a remote SMS 2003 Administrator console to manage those sites.

To perform an in-place upgrade to Configuration Manager 2007

  1. Before running Configuration Manager Setup to upgrade a site, ensure that you have properly prepared your computing environment to install Configuration Manager and have reviewed the Configuration Manager Upgrade Checklist. For more information about Configuration Manager prerequisites and the Configuration Manager Upgrade Checklist, see Prerequisites for Installing Configuration Manager and Configuration Manager 2007 Upgrade Checklist.

  2. Select Configuration Manager 2007 from the autorun screen, or start Setup.exe from the Configuration Manager installation media or from a copy of the installation media located on a network share or other storage media to start the Configuration Manager Setup Wizard.

  3. Click Next on the Welcome page.

  4. On the Setup Options page, select the Upgrade existing SMS 2003 or Configuration Manager installation option.

  5. On the Microsoft Software License Terms page, click I accept these terms and then click Next.

  6. On the Customer Experience Improvement Program page, you must choose a participation selection.

  7. On the Updated Prerequisite Components page, select the appropriate option for obtaining client prerequisite component files. Files can either be downloaded as part of Setup, an alternate location where the client prerequisite component files have already been downloaded to can be used.

  8. On the Updated Prerequisite Component Path page, specify the path to store client prerequisite component files downloaded during Setup or the path to the alternate location where client prerequisite component files have previously been downloaded to.

    Note
    The Setup command line option Setup /download <path to files> can be used to download client prerequisite component files without running the complete Configuration Manager Setup wizard.

  9. On the Configuration Manager Product Key page, you must enter a valid product key.

  10. On the Installation Summary page, review the summary details for the site installation before continuing. To make changes to any details, click Previous until you return to the page in the wizard where you set the detail. After making any necessary changes, return to the Summary page.

  11. When prerequisite checking has completed, review any messages in the results pane of the Installation Prerequisite Check page to verify that all prerequisites have been met for installation to continue. If no prerequisite errors are found, you can click Begin Install to begin the upgrade process. If prerequisite errors are found, you can review the ConfigMgrPrereq.log file located in the root of the system drive for more information about how to resolve any issues found. When all discovered prerequisite check failures have been resolved, return to the Prerequisite Check page and re-run the setup prerequisites check.

    Important
    Configuration Manager Setup cannot continue until all prerequisite checks have completed with no errors.

  12. Review the installation steps on the Installation Status to verify the actions taken and their status as Configuration Manager is installing.

See Also

Other Resources

Configuration Manager Tasks for Upgrade and Interoperability


How to Perform a Side-By-Side Upgrade

If during the site hierarchy upgrade process you intend to consolidate some or all of your existing Microsoft Systems Management Server (SMS) 2003 sites, to change the structure of your existing SMS 2003 hierarchy, or to upgrade some or all of your server hardware, you should use the side-by-side upgrade method to upgrade your hierarchy.

Use the following procedure to perform a side-by-side hierarchy upgrade.

To perform a side-by-side upgrade

  1. Hierarchy upgrades must begin at the central site. Begin by either upgrading your existing SMS 2003 central site to Configuration Manager 2007, or create a new Configuration Manager site and configure the original SMS 2003 central site as child site of it.

  2. Begin transitioning the site boundaries from the SMS 2003 sites to the new central site or new Configuration Manager primary sites as they are installed and the SMS 2003 sites are consolidated or decommissioned.

  3. Upgrade SMS 2003 Advanced Clients by installing the Configuration Manager client on assigned computers.

See Also

Concepts

Configuration Manager Side-By-Side Upgrade
Administrator Workflow: Side-By-Side Upgrade

Other Resources

Configuration Manager Tasks for Upgrade and Interoperability


How to Test the Site Database Upgrade Process

Before beginning the site upgrade process, you should test the site database upgrade process on a copy of the Microsoft Systems Management Server (SMS) 2003 site database to be upgraded. To test the database for an upgrade, you use the /testdbupgrade setup command-line switch, as in the following example:

Copy Code
Setup /testdbupgrade SMS_<sitecode>

When this command is run, the setup Prerequisite Checker will launch and verify that the database to be tested meets the requirements for the test. The test must be run on a supported version of Microsoft SQL Server 2005, and SQL Server database replication must not have been configured for the database before it was copied or backed up in preparation for the test. The results of the prerequisite check can be viewed in the ConfigMgrPrereq.log log file created in the root of the system drive.

Note
The database upgrade test fails on SMS site databases that are copied or restored from an SMS 2003 site database with SQL Server database replication enabled. This is because when SQL Server database replication is enabled for the SMS 2003 site database, the computer running SQL Server modifies the SQL Server tables that are included in the publication. When the database is restored to another database, the setup /testdbupgrade fails on that restored SMS site database.

After the setup Prerequisite Checker has successfully verified that all prerequisites for the test are met, the database is tested for upgrade. The actions taken, and their results, can be viewed in the ConfigMgrSetup.log log file created in the root of the system drive.

If the database upgrade test is successful, you can be assured that the database portion of the upgrade process will be successful. Any problems you encounter during the test must be corrected before you upgrade your production site database. If this test fails, the database is incompatible with Configuration Manager 2007, and a clean installation will be required.

Caution
After running the Setup /testdbupgrade setup switch, your SMS site database will not be compatible with earlier versions of SMS if you do not complete the upgrade. Be sure to run this test on a copy of your SMS 2003 site database rather than on the original.

Use one of the procedures below to test the site database for upgrade, depending on the version of SQL Server hosting the site database to be tested.

To test an SMS 2003 site database hosted by SQL Server 2005 for upgrade by copying the database

  1. Record the size of the SQL Server data and log files. You will need to compare these sizes to the sizes of the files after the database upgrade test has completed.

  2. On the SQL server hosting the site database, log in to Microsoft SQL Server Management Studio and ensure that the SQL Server Agent is running.

    Note
    The SQL Server Workstation Components must be installed on the SQL server to start SQL Server Management Studio.

  3. Ensure that SQL Server is configured to autogrow and that sufficient disk space is available on the computer running SQL Server to complete the test successfully. (Depending on the size of your current site database, the required disk space amount will vary.)

  4. If required, disable SQL Server replication for the site database.

  5. Use the Copy Database Wizard to copy the site database. To start the Copy Database Wizard in SQL Server Management Studio, right-click <site database name>, click Tasks, and then click Copy Database.

    Note
    You can schedule the copy to run immediately or at a later time. You can also copy the database to the local database server or a different SQL Server machine. It is recommended to copy the database to a remote SQL Server machine not hosting a site database to perform this procedure.

  6. Open a command prompt, navigate to the Configuration Manager setup files directory on the SQL Server computer hosting the database copy, and enter the following text: setup.exe /testdbupgrade <copied database name>.

  7. Review the ConfigMgrPrereq.log and ConfigMgrSetup.log log files, located at the root of the system drive, to verify that the test database upgrade was successful. Any problems encountered during the test upgrade must be corrected before you upgrade your production site database.

  8. Record the size of the SQL Server data and log files, and compare them to the sizes you recorded in step 1. This will determine the amount of disk space required for a successful site database upgrade.

To test an SMS 2003 site database hosted by SQL Server 2000 for upgrade by restoring a site database backup to a remote computer running SQL Server 2005

  1. Record the size of the SQL Server data and log files. You will need to compare these sizes to the sizes of the files after the database upgrade test has completed.

  2. Ensure that SQL Server is configured to autogrow and that sufficient disk space is available on the computer running SQL Server to complete the test successfully. (Depending on the size of your current site database, the required disk space amount will vary.)

  3. If required, disable SQL Server replication for the site database.

  4. Back up your SMS 2003 site database using the SMS site backup maintenance task. To force an immediate site backup, run the command net start sms_site_backup from a command prompt.

    Note
    Alternatively, you can stop all SMS services on the SMS site server and SQL Server, and then use SQL Server Enterprise Manager to back up the SMS site database.

  5. Copy the site database backup to a different computer running SQL Server 2005.

  6. Manually create a new database on the SQL Server 2005 computer with the same name as the one you backed up, and restore the database backup to it.

  7. Open a command prompt, navigate to the Configuration Manager setup files directory, and enter the following text: setup.exe /testdbupgrade <database name>.

  8. Review the ConfigMgrPrereq.log and ConfigMgrSetup.log log files, located at the root of the system drive, to verify that the test database upgrade was successful. Any problems encountered during the test upgrade must be corrected before you upgrade your production site database.

  9. Record the size of the SQL Server data and log files, and compare them to the sizes you recorded in step 1. This will determine the amount of disk space required for a successful site database upgrade.

See Also

Tasks

How to Disable SQL Server Database Replication

Other Resources

Configuration Manager Tasks for Upgrade and Interoperability


How to Upgrade a Secondary Site Using the Configuration Manager Console

Before following the procedure in this topic, ensure that you have upgraded the primary site that the secondary site reports to. Also, ensure that the secondary site to be upgraded has run, and passed with no errors, the Configuration Manager Setup prerequisite checks within the past seven days.

To upgrade a secondary site from within the Configuration Manager console, you must use the Upgrade Secondary Site Wizard. To start the Upgrade Secondary Site Wizard, use the following procedure.

Note
You must have Modify permissions for the Site security object class or instance to perform this procedure.

To start the Upgrade Secondary Site Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> for the parent primary site for the secondary site to be upgraded.

  2. Right-click <site code> - <site name> and click Upgrade Secondary Site to launch the Upgrade Secondary Site Wizard.

See Also

Concepts

Upgrade Secondary Site Wizard

Other Resources

Configuration Manager Tasks for Upgrade and Interoperability


How to Upgrade a Secondary Site Using Configuration Manager Setup

Before following the procedure in this topic, ensure that you have upgraded the primary site that the secondary site reports to.

Note
You must have Modify permissions for the Site security object class or instance to perform this procedure.

To upgrade a secondary site using Configuration Manager Setup

  1. Before running Configuration Manager Setup to upgrade a secondary site, ensure that you have properly prepared your computing environment to install Configuration Manager and have reviewed the Configuration Manager Upgrade Checklist. For more information about Configuration Manager prerequisites and the Configuration Manager Upgrade Checklist, see Prerequisites for Installing Configuration Manager and Configuration Manager 2007 Upgrade Checklist.

  2. Select Configuration Manager 2007 from the autorun screen, or start Setup.exe from the Configuration Manager installation media or from a copy of the installation media located on a network share or other storage media to start the Configuration Manager Setup Wizard.

  3. Click Next on the Welcome page.

  4. On the Setup Options page, select the Upgrade existing SMS 2003 or Configuration Manager installation option.

  5. On the Microsoft Software License Terms page, click I accept these terms and then click Next.

  6. On the Updated Prerequisite Components page, select the appropriate option for obtaining client prerequisite component files. Files can either be downloaded as part of Setup, an alternate location where the client prerequisite component files have already been downloaded to can be used.

  7. On the Updated Prerequisite Component Path page, specify the path to store client prerequisite component files downloaded during Setup or the path to the alternate location where client prerequisite component files have previously been downloaded to.

    Note
    The Setup command line option Setup /download <path to files> can be used to download client prerequisite component files without running the complete Configuration Manager Setup wizard.

  8. On the Installation Summary page, review the summary details for the site installation before continuing. To make changes to any details, click Previous until you return to the page in the wizard where you set the detail. After making any necessary changes, return to the Summary page.

  9. When prerequisite checking has completed, review any messages in the results pane of the Installation Prerequisite Check page to verify that all prerequisites have been met for installation to continue. If no prerequisite errors are found, you can click Begin Install to begin the upgrade process. If prerequisite errors are found, you can review the ConfigMgrPrereq.log file located in the root of the system drive for more information about how to resolve any issues found. When all discovered prerequisite check failures have been resolved, return to the Prerequisite Check page and re-run the setup prerequisites check.

    Important
    Configuration Manager Setup cannot continue until all prerequisite checks have completed with no errors.

  10. Review the installation steps on the Installation Status to verify the actions taken and their status as Configuration Manager is installing.

See Also

Other Resources

Configuration Manager Tasks for Upgrade and Interoperability


How to Upgrade an SMS 2003 Administrator Console

Topic last updated -- November 2007

After you have upgraded the primary site that the Microsoft Systems Management Server (SMS) 2003 Administrator console connects to, you should upgrade any remote administrator consoles used to administer the site using the following procedure.

When upgrading SMS 2003 Administrator consoles using the Configuration Manager Setup Wizard, a new Configuration Manager console is installed side-by-side with the existing SMS 2003 Administrator console. After the Configuration Manager console is installed, there is no option to separately uninstall the SMS 2003 Administrator console and both consoles will be uninstalled when the Configuration Manager console is uninstalled. If you will not need an SMS 2003 Administrator console to manage an existing SMS 2003 primary site, you should uninstall the SMS 2003 Administrator console before installing the Configuration Manager console.

To uninstall the SMS 2003 Administrator console during the upgrade process, the /upgrade Setup command line option can be used instead of the Configuration Manager Setup Wizard. When the command Setup /upgrade is used to upgrade an SMS 2003 Administrator console, the existing SMS 2003 Administrator console is uninstalled before the new Configuration Manager console is installed.

Note
After upgrading an SMS 2003 Administrator console, the new Configuration Manager console might not be connected to the site database. To connect the Configuration Manager console to the Configuration Manager site database, use the Connect to Site Database Wizard. For more information about the Connect to Site Database Wizard, see Connect to Site Database Wizard.

To upgrade an SMS 2003 Administrator console using Configuration Manager Setup

  1. Before running Configuration Manager Setup to upgrade an Administrator Console, ensure that you have properly prepared your computing environment to install a Configuration Manager console. For more information about Configuration Manager prerequisites, see Prerequisites for Installing Configuration Manager.

  2. Select Configuration Manager 2007 from the autorun screen, or start Setup.exe from the Configuration Manager installation media or from a copy of the installation media located on a network share or other storage media to start the Configuration Manager Setup Wizard.

  3. Click Next on the Welcome page.

  4. Select the Install or upgrade an administrator console option.

  5. On the Microsoft Software License Terms page, click I accept these terms and then click Next.

  6. On the Customer Experience Improvement Program page, you must choose a participation selection.

  7. On the Installation Summary page, review the summary details for the site installation before continuing. To make changes to any details, click Previous until you return to the page in the wizard where you set the detail. After making any necessary changes, return to the Summary page.

  8. When prerequisite checking has completed, review any messages in the results pane of the Installation Prerequisite Check page to verify that all prerequisites have been met for installation to continue. If no prerequisite errors are found, you can click Begin Install to begin the upgrade process. If prerequisite errors are found, you can review the ConfigMgrPrereq.log file located in the root of the system drive for more information about how to resolve any issues found. When all discovered prerequisite check failures have been resolved, return to the Prerequisite Check page and re-run the setup prerequisites check.

    Important
    Configuration Manager Setup cannot continue until all prerequisite checks have completed with no errors.

  9. Review the installation steps on the Installation Status page to verify the actions taken and their status as Configuration Manager is installing.

See Also

Concepts

Prerequisites for Installing Configuration Manager

Other Resources

Configuration Manager Tasks for Upgrade and Interoperability


How to Upgrade the Windows Automated Installation Kit During Site Upgrades to Configuration Manager 2007 SP1

Topic Last Updated—August 2008

Because Configuration Manager 2007 SP1 sites require Windows AIK version 1.1 to be installed on the SMS Provider computer, the Windows AIK must be upgraded to version 1.1 from version 1.0 during primary site upgrades to Configuration Manager 2007 SP1. If a PXE service point site system has not been installed for the site to be upgraded, Configuration Manager 2007 SP1 Setup will automatically upgrade the Windows AIK 1.0 installation on the SMS Provider computer to version 1.1 during the upgrade process. However, if a PXE service point has been installed for the site to be upgraded, the Windows AIK should be manually uninstalled from the SMS Provider computer for the site before beginning service pack installation. If the Windows Deployment Services (WDS) Server service is running and if the wimgapi.dll file is in use, an unexpected restart can occur while upgrading the site to Configuration Manager 2007 SP1.

For more information about troubleshooting unexpected system restarts during Configuration Manager 2007 SP1 Setup, see Troubleshooting Configuration Manager 2007 SP1 Setup.

If a PXE service point site system is installed on a computer other than the SMS Provider computer for a site, the wimgapi.dll file used by PXE service point components is not updated to the newest version. Because the updated wimgapi.dll file version is required for Configuration Manager 2007 SP1 PXE service points, operating system deployments using the remote PXE service point will fail until the file is replaced with the new version.

The following procedures can be used to upgrade the Windows AIK during site upgrades to Configuration Manager 2007 SP1 when a PXE service point site system has been installed for the site.

To upgrade Windows AIK when a PXE service point site system role is installed on the SMS Provider computer for a site

  1. On the computer hosting both the PXE service point role and SMS Provider site system role for the site to be upgraded, manually uninstall Windows AIK 1.0 from Add or Remove programs and restart the operating system to complete the uninstallation.

  2. Stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer. Then run Configuration Manager 2007 SP1 Setup to upgrade the site and allow Windows AIK 1.1 to be installed.

  3. After the site has been successfully upgraded, restart the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to start the service: net start WDSServer.

To upgrade Windows AIK files on remote PXE service point site systems after Configuration Manager 2007 Service Pack 1 installation

  1. On the computer hosting the PXE service point site system role, stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer.

  2. On the PXE service point computer, navigate to the .\sms\wim directory and run the wimgapi.msi file to install the new version of wimgapi.dll.

    Note
    A new version of this file is distributed to the site system as part of the Configuration Manager 2007 SP1 upgrade process.

  3. After successfully upgrading wimgapi.dll to the correct version, restart the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to start the service: net start WDSServer.


Configuration Manager Upgrade Flowcharts

The flowcharts in this section can be used to determine the required Setup steps required to upgrade an SMS 2003 primary site, secondary site, or Administrator Console to Configuration Manager 2007.

In This Section

Flowchart: Upgrade a Primary Site

Flowchart: Upgrade a Secondary Site

Flowchart: Upgrade an Administrator Console

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Flowchart: Upgrade a Primary Site

This flow chart can be used to determine the Setup steps required to upgrade an SMS 2003 primary site to Configuration Manager 2007.

Upgrade Primary Site Worklow

See Also

Concepts

Configuration Manager Upgrade Flowcharts


Flowchart: Upgrade a Secondary Site

This flow chart can be used to determine the Setup steps required to upgrade an SMS 2003 secondary site to Configuration Manager 2007.

Upgrade Secondary Site Workflow

See Also

Concepts

Configuration Manager Upgrade Flowcharts


Flowchart: Upgrade an Administrator Console

This flow chart can be used to determine the Setup steps required to upgrade an SMS 2003 Administrator Console to a Configuration Manager 2007 console.

Upgrade Administrator Console Workflow

See Also

Concepts

Configuration Manager Upgrade Flowcharts


Configuration Manager Upgrade Administrator Workflows

The administrator workflows in this section can be used to determine the required administrative steps required to perform in-place and side-by-side SMS 2003 upgrades to Configuration Manager 2007. Begin with the steps outlined in the first Upgrading Sites administrator workflow, which outlines steps required for either upgrade method, and then follow the appropriate administrator workflow for the type of upgrade you will perform.

In This Section

Administrator Workflow: Upgrading Sites

Administrator Workflow: In-Place Upgrade

Administrator Workflow: Side-By-Side Upgrade

See Also

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment


Administrator Workflow: Upgrading Sites

This administrator workflow displays the recommended steps to perform when upgrading SMS 2003 sites to Configuration Manager 2007. These steps should be performed before beginning the upgrade method specific steps outlined in the other workflows in this section.

Upgrade ConfigMgr Site worklow

See Also

Concepts

Configuration Manager Upgrade Administrator Workflows


Administrator Workflow: In-Place Upgrade

This administrator workflow displays the recommended steps to perform an in-place upgrade from SMS 2003 to Configuration Manager 2007.

In Place Upgrade Workflow

See Also

Concepts

Configuration Manager Upgrade Administrator Workflows


Administrator Workflow: Side-By-Side Upgrade

This administrator workflow displays the recommended steps to perform a side-by-side upgrade from SMS 2003 to Configuration Manager 2007.

Side by Side Upgrade planning diagram

See Also

Concepts

Configuration Manager Upgrade Administrator Workflows


Deploying Configuration Manager Sites to Support Internet-Based Clients

To deploy Configuration Manager 2007 to support Internet-based client management, you must carefully plan and configure the site so that you can manage Configuration Manager 2007 clients when they are connected to the Internet.

Click the associated link in the following section for detailed information about the planning and configuring procedures required to deploy a Configuration Manager 2007 site for Internet-based client management.

In This Section

Overview of Internet-Based Client Management

Provides an overview of Internet-based client management.

Prerequisites for Internet-Based Client Management

Lists the external and product dependencies for Internet-based client management.

Planning for Internet-Based Client Management

Provides planning information for deploying a site for Internet-based client management.

Configuring Internet-Based Client Management

Provides the configuration checklist and tasks to configure a site for Internet-based client management.

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007
Tasks for Configuration Manager Internet-Based Client Management


Overview of Internet-Based Client Management

Topic Last Updated—August 2008

Internet-based client management allows you to manage Configuration Manager 2007 clients when they are not connected to your company network but have a standard Internet connection. This arrangement has a number of advantages, including the reduced costs of not having to run virtual private networks (VPNs) and being able to deploy software updates in a more timely manner.

Because of the higher security requirements of managing client computers on a public network, Internet-based client management requires that the site is in native mode. This ensures that connections to the management point, software update point, and distribution points are mutually authenticated by an independent authority, and that data to and from these site systems are encrypted using Secure Sockets Layer (SSL).

Features that Are Not Supported on the Internet

Not all Configuration Manager 2007 features are appropriate for the Internet, and so they are not supported when clients are managed on the Internet. The features that are not supported for Internet management typically rely on Active Directory Domain Services (which is not accessible from the Internet) or are not appropriate for a public network (such as network discovery and Wake On LAN).

The following features are not supported when clients are managed on the Internet:

  • Software distribution that is targeted to users (either directly or through Microsoft Windows security groups).
  • Branch distribution points (a branch distribution point cannot support Internet clients, and clients on the Internet cannot be configured as a branch distribution point).
  • Client deployment over the Internet.
  • Auto-site assignment.
  • Network Access Protection (NAP).
  • Wake On LAN.
  • Operating system deployment.
  • Remote control.
  • Out of band management in Configuration Manager 2007 SP1.
  • The client ping functionality used with the client status reporting feature in Configuration Manager 2007 R2.

Additionally, Internet-based client management does not support roaming, which allows clients to always find the closest distribution points to download content. Clients that are managed on the Internet have a fixed Internet-based management point and communicate with that management point only when they are on the Internet, and with site systems in the site that are configured for Internet-based client management.

Clients connecting over the Internet will download content from any of the Internet-based distribution points in the site, regardless of bandwidth or physical location. For this reason, you cannot configure a protected site system to support Internet-based client management.

Configuring Site Systems for Internet-Based Client Management

There are no new site system roles required to support clients on the Internet. Instead, existing site system roles in a native mode, primary site are configured for Internet-based client management and placed appropriately on the network. The following site systems can support client management over the Internet:

  • Management point (with and without a network load balancing cluster)
  • Distribution points
  • Fallback status point
  • Software update point (with and without a network load balancing cluster)

A number of supported scenarios determine the location of servers in the Configuration Manager 2007 primary site. These range from having the complete Configuration Manager 2007 site contained within the perimeter network (also known as a screened subnet or DMZ) to having the site divided between the perimeter network and the intranet. The configuration of firewalls and Web proxies will depend on the server placement you choose. If you are using a proxy Web server, such as Microsoft ISA Server 2006, it must also have an appropriate certificate and support SSL termination so that the proxy Web server can authenticate client connections.

Configuring Clients for Internet-Based Management

Client computers and mobile client devices can be configured for one of the following management methods:

  • Internet-only management
  • Intranet-only management

Clients that are managed over the Internet must be configured to use their site's Internet-based management point. This configuration can be specified with command-line properties during installation, or specified in the Internet tab of Configuration Manager from the Control Panel of a client computer.

Note
The Internet tab displays only if the client is communicating in native mode.

Clients configured for Internet-only management only communicate with the site systems that are configured to support Internet-based client management. This would be appropriate for computers and devices that you know will never connect to your company intranet, with an example being point of sale computers in remote locations.

Clients configured for intranet-only management are not configured to use the Internet management point, and they do not have a requirement to connect to site systems that are configured for Internet-based client management.

Client computers can have a third configuration that is not available for mobile client devices:

  • Internet or intranet management

To support this mode of operation, clients must be domain-joined and have a trust relationship to the site server's Active Directory forest. For example, they must be in the same Active Directory forest as their site server's forest, or they must be authenticated through an external trust or forest trust. Workgroup clients do not support Internet or intranet management but must be configured for intranet-only management or for Internet-only management.

Client computers configured for Internet or intranet management can automatically switch between Internet-based client management and intranet client management whenever they detect a change of network.

When this network change is detected, the client computer will first attempt to communicate with its assigned management point on the intranet. If this succeeds, the client computer behaves as a standard intranet client. However, if the client computer cannot connect to its assigned management point, it then attempts communication with its configured Internet management point, using the Internet fully qualified domain name that is configured on the management point and registered with Internet DNS servers. When the Internet management point responds, the client computer then uses as required, the distribution points and software updates point that are also configured for Internet-based client management.

The benefit in automatic switching between Internet-based client management and intranet client management is that client computers can use the full range of Configuration Manager features when they reconnect to the intranet. Additionally, a download that began on the Internet can seamlessly resume on the intranet.

Important
If you have clients that cannot support both intranet and Internet client management (such as workgroup clients) and you want to manage them on the Internet, they must be configured for Internet-only management. This means that when they connect to the intranet, they continue to communicate with the Internet-based site systems. Additionally, they will not support the full Configuration Manager feature range associated with intranet client management, as listed in the previous section "Features that Are Not Supported on the Internet".

How Internet Clients Use the Fallback Status Point

If you are using a fallback status point in the Internet-based client management site, the client must be configured with the Internet-based fallback status point when it is installed. If the client fails to connect to its Internet-based management point when it is on the Internet (for example, because its certificate has expired), it will send a failure status message to its configured Internet-based fallback status point using HTTP.

When a client computer is configured for both Internet and intranet-based client management and configured with an Internet-based fallback status point, it will not use the fallback status point on the intranet. This means that if a client computer moves onto the intranet and cannot connect to its assigned management point on the intranet, the client computer will send its failure status message to the Internet-based fallback status point from the intranet.

How Internet Client Computers Use the Proxy Server Settings

In addition to specifying the client's Internet-based management point, client computers can also specify proxy Web server settings. Specify proxy Web server settings if the client computer needs to connect to the Internet using a proxy Web server.

Important
If you are using a site port number for HTTPS client requests other than the industry default of 443, Internet connections that require a proxy Web server are unlikely to work because, typically, proxy Web servers are configured to use the default HTTPS port of 443.

The ability to specify a proxy Web server configuration is particularly useful for users, such as consultants, who have laptops that connect to another company’s intranets. Specifying the proxy Web server details as a Configuration Manager property means that computers remain managed even when users are not logged on. However, if the proxy Web server settings are not specified as a Configuration Manager property, Configuration Manager client computers will try the following proxy Web server discovery methods to connect to the specified Internet-based management point :

  1. The proxy Web server settings configured in the default browser
  2. The system context
  3. The currently logged-on user's credentials

In This Section

Site System Roles that Support Internet-Based Client Management

Supported Scenarios for Internet-Based Client Management

Network Diagram for Internet-Based Servers - Scenario 1 with no SQL Server Replica

Network Diagram for Internet-Based Servers - Scenario 1 with SQL Server Replica

Network Diagram for Internet-Based Servers - Scenario 2 with Child Site

Network Diagram for Internet-Based Servers - Scenario 2 with Complete Hierarchy

Network Diagram for Internet-Based Servers - Scenario 3 with No SQL Server Replica

Network Diagram for Internet-Based Servers - Scenario 3 with SQL Server Replica

Network Diagram for Internet-Based Servers - Scenario 4 with Two Network Cards

Network Diagram for Internet-Based Servers - Scenario 4 with Internet Connections into the Intranet

Network Diagram for Internet-Based Servers - Scenario 4 with Intranet Connections into the Perimeter Network

Example Scenarios for Implementing Internet-Based Client Management in Configuration Manager

See Also

Concepts

Prerequisites for Internet-Based Client Management

Other Resources

Configuring Internet-Based Client Management
Planning for Internet-Based Client Management


Site System Roles that Support Internet-Based Client Management

The following site system roles in a native mode primary site support Internet-based client management, and they can be located in a different forest than the site server:

  • Management point
  • Fallback status point
  • Software update point
  • Distribution point, if it is not a site system share, or protected site system, or branch distribution point
Important
If these site systems are located in a perimeter network and the site server is located in the intranet, these site system servers should be configured to accept data retrieval from the site server. In this scenario, the site server initiates a connection to the site systems to retrieve information such as status messages from the site systems. Configuring data retrieval from the site server is a more secure configuration than the default configuration in which site systems initiate connections to the site server.

Only the management point is required for Internet-based client management (for example, to send machine policy and receive client information such as inventory results). The other site system roles are optional for Internet-based client management and depend on the Configuration Manager features you require.

See Also

Tasks

How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers

Concepts

Determine Server Placement for Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients


Supported Scenarios for Internet-Based Client Management

There are four basic supported scenarios for Internet-based client management, and within these there are some supported variations:

  • Scenarios 1 and 2 are suitable if the Internet-based client management site supports only Internet-based clients on the Internet and does not need to also support clients on the intranet.
  • Scenarios 3 and 4 are suitable if the Internet-based client management site supports clients that are on the Internet and clients that are on the intranet.

Scenarios for Sites that Do Not Need to Also Manage Intranet Clients

If the Configuration Manager 2007 site only supports clients over the Internet, Scenarios 1 and 2 are applicable.

Note
When the site does not support clients on the intranet, the site should not be configured with a default management point.

Scenario 1: Configuration Manager site that doesn't support intranet clients and spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network, and accept connections for clients connecting over the Internet. The site server is in the intranet.

There are two variations of this scenario:

  • The management point that supports Internet-based clients communicates directly with the SQL server in the intranet.
    See Network Diagram for Internet-Based Servers - Scenario 1 with no SQL Server Replica.
  • The management point that supports Internet-based client communicates with a SQL server replica in the perimeter network.
    See Network Diagram for Internet-Based Servers - Scenario 1 with SQL Server Replica.

Scenario 2: Configuration Manager site that doesn't support intranet clients and is in the perimeter network only.

There are two variations of this scenario:

  • The Configuration Manager 2007 site that is configured for Internet-based client management is a child site of your Configuration Manager 2007 hierarchy.
    See Network Diagram for Internet-Based Servers - Scenario 2 with Child Site.
  • The Configuration Manager 2007 site that is configured for Internet-based client management is the only site in your Configuration Manager 2007 hierarchy.
    See Network Diagram for Internet-Based Servers - Scenario 2 with Complete Hierarchy.

Scenarios for Sites that Manages Clients on the Internet and the Intranet

If the Configuration Manager 2007 site needs to support clients on the Internet and support clients on the intranet, Scenarios 3 and 4 are applicable.

Scenario 3: Configuration Manager site that supports both Internet clients and intranet clients and spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. There is a second management point (and second software update point and fallback status point, and additional distribution points) and other site systems that are in the intranet for clients connecting on the intranet.

There are two variations of this scenario:

  • The management point that supports Internet-based clients communicates directly with the SQL server in the intranet.
    See Network Diagram for Internet-Based Servers - Scenario 3 with No SQL Server Replica.
  • The management point that supports Internet-based client communicates with a SQL server replica in the perimeter network.
    See Network Diagram for Internet-Based Servers - Scenario 3 with SQL Server Replica.

Scenario 4: Configuration Manager site that supports both Internet clients and intranet clients and bridges the perimeter network and intranet. The single management point is both the site's default management point and the Internet-based client management point.

There are three variations of this scenario:

  • The Configuration Manager 2007 site bridges the perimeter network and intranet by having two network cards in the site systems that support Internet-based client management.
    See Network Diagram for Internet-Based Servers - Scenario 4 with Two Network Cards.
  • The Configuration Manager 2007 site is contained on the intranet, and the site systems that are configured for Internet-based client management can accept both Internet connections and intranet connections. This solution requires a reverse proxy solution (for example, using Microsoft ISA Server) to publish the Internet-based site systems on the intranet to the Internet.
    See Network Diagram for Internet-Based Servers - Scenario 4 with Internet Connections into the Intranet.
  • The Configuration Manager 2007 site bridges the perimeter network and intranet with the Internet-based site systems in the perimeter network, and it is configured to accept both Internet connections and intranet connections. The site server is in the intranet. This solution requires that the intranet FQDN of the Internet-based site systems are registered in the intranet DNS servers with the public IP addresses of the servers in the perimeter network.
    See Network Diagram for Internet-Based Servers - Scenario 4 with Intranet Connections into the Perimeter Network.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Determine Site Placement for Internet-based Client Management
Example Scenarios for Implementing Internet-Based Client Management in Configuration Manager
Prerequisites for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 1 with no SQL Server Replica

Topic Last Updated—August 2008

This network diagram shows server placement and firewall configuration for the following operational scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 1: A Configuration Manager 2007 site that doesn't support intranet clients and spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network, and they accept connections for clients connecting over the Internet. The site server is in the intranet. The management point that supports Internet-based clients communicates directly with the SQL server in the intranet.
Internet-based diagram: Scenario 1a

Note
For additional information relating to the installation requirements for the site systems, see the section “Installation Requirements for Internet-Based Site Systems” in Ports Used by Configuration Manager.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 1 with SQL Server Replica

Topic Last Updated—August 2008

This network diagram shows server placement and firewall configuration for the following supported scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 1: A Configuration Manager 2007 site that doesn't support intranet clients and spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. The site server is in the intranet. The management point that supports Internet-based client communicates with a SQL server replica in the perimeter network.
Internet-based diagram: Scenario 1b

Note
For additional information relating to the installation requirements for the site systems, see the section “Installation Requirements for Internet-Based Site Systems” in Ports Used by Configuration Manager.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 2 with Child Site

This network diagram shows server placement and firewall configuration for the following supported scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 2: A Configuration Manager 2007 site that doesn't support intranet clients and is in the perimeter network only. The Configuration Manager 2007 site that is configured for Internet-based client management is a child site of your Configuration Manager 2007 hierarchy.
Internet-based diagram: Scenario 2a

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 2 with Complete Hierarchy

This network diagram shows server placement and firewall configuration for the following supported scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 2: A Configuration Manager 2007 site that doesn't support intranet clients and is in the perimeter network only. The Configuration Manager 2007 site that is configured for Internet-based client management is the only site in your Configuration Manager 2007 hierarchy.
Internet-based diagram: Scenario 2b

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 3 with No SQL Server Replica

Topic Last Updated—August 2008

This network diagram shows server placement and firewall configuration for the following operational scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 3: A Configuration Manager 2007 site that supports both Internet clients and intranet clients and spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. There is a second management point (and second software update point and fallback status point, as well as additional distribution points) and other site systems that are in the intranet for clients connecting on the intranet. The management point that supports Internet-based clients communicates directly with the SQL server in the intranet.
Internet-based diagram: Scenario 3a

Note
For additional information relating to the installation requirements for the site systems, see the section “Installation Requirements for Internet-Based Site Systems” in Ports Used by Configuration Manager.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 3 with SQL Server Replica

Topic Last Updated—August 2008

This network diagram shows server placement and firewall configuration for the following operational scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 3: A Configuration Manager 2007 site that supports both Internet clients and intranet clients and spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. There is a second management point (and second software update point and fallback status point, as well as additional distribution points) and other site systems that are in the intranet for clients connecting on the intranet. The management point that supports Internet-based client communicates with a SQL server replica in the perimeter network.
Internet-based diagram: Scenario 3b

Note
For additional information relating to the installation requirements for the site systems, see the section “Installation Requirements for Internet-Based Site Systems” in Ports Used by Configuration Manager.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 4 with Two Network Cards

This network diagram shows server placement and firewall configuration for the following supported scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 4: A Configuration Manager 2007 site that supports both Internet clients and intranet clients and bridges the perimeter network and intranet. The single management point is both the site's default management point and the Internet-based client management point. The Configuration Manager 2007 site bridges the perimeter network and intranet by having two network cards in the site systems that support Internet-based client management.
Internet-based diagram: Scenario 4a

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 4 with Internet Connections into the Intranet

This network diagram shows server placement and firewall configuration for the following supported scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 4: A Configuration Manager 2007 site that supports both Internet clients and intranet clients and bridges the perimeter network and intranet. The single management point is both the site's default management point and the Internet-based client management point. The Configuration Manager 2007 site is contained on the intranet, and the site systems that are configured for Internet-based client management can accept Internet connections and intranet connections. This solution requires a reverse proxy solution (for example, using Microsoft ISA Server) to publish the Internet-based site systems on the intranet to the Internet.
Internet-based diagram: Scenario 4b

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Network Diagram for Internet-Based Servers - Scenario 4 with Intranet Connections into the Perimeter Network

Topic Last Updated—August 2008

This network diagram shows server placement and firewall configuration for the following operational scenario for Internet-based client management in Configuration Manager 2007:

  • Scenario 4: A Configuration Manager 2007 site that supports both Internet clients and intranet clients and bridges the perimeter network and intranet. The single management point is both the site's default management point and the Internet-based client management point. The Configuration Manager 2007 site bridges the perimeter network and intranet with the Internet-based site systems in the perimeter network and is configured to accept both Internet connections and intranet connections. The site server is in the intranet. This solution requires that the intranet fully qualified domain name (FQDN) of the Internet-based site systems be registered in the intranet Domain Name System (DNS) servers with the public IP addresses of the servers in the perimeter network.
Internet-based diagram: Scenario 4c

Note
For additional information relating to the installation requirements for the site systems, see the section “Installation Requirements for Internet-Based Site Systems” in Ports Used by Configuration Manager.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Example Scenarios for Implementing Internet-Based Client Management in Configuration Manager

Topic last updated—March 2008

The following sections provide example scenarDiios of how Internet-based client management in Configuration Manager 2007 can be implemented to solve the following business requirements:

  • Continue to Manage Laptops that Regularly Move out of the Intranet and On to the Internet
  • Manage Home Computers That Never Connect to the Intranet
  • Support Internet-Based Clients and Intranet Clients in the Intranet on the Same Site System Server

Continue to Manage Laptops That Regularly Move Out of the Intranet and on to the Internet

This scenario demonstrates how you can extend an existing Configuration Manager site to support clients when they move from the intranet to the Internet, using Internet-based client management. The network design chosen incorporates the supported scenario of adding Internet-based site systems into the perimeter network and using a SQL Server replica in the perimeter network for additional security: Network Diagram for Internet-Based Servers - Scenario 1 with SQL Server Replica.

A. Datum Corporation has a number of sales people who regularly travel to see customers and only periodically return to the office. Managing their laptops so that they have all the required software updates and the latest applications is difficult, because either the sales staff have to find the time to come back into the office or they attempt a connection using the in-house VPN solution, which is slow and unreliable. Additionally, the audit department is requesting up-to-date weekly inventory reports to record application usage, and this requirement cannot be met for the laptops because their inventory data is not always returned every week.

To continue to manage these laptops when they leave the intranet, A. Datum Corporation decides on the course of action described in the following table.

Process Reference

Tommy Hartono is the Configuration Manager administrator who manages a Configuration Manager 2007 site. He reads about Internet-based client management and how clients can continue to be managed when they move from the intranet to the Internet.

Overview of Internet-Based Client Management

Weighing up the advantages and disadvantages of implementing Internet-based client management or upgrading their existing VPN solution, he decides that Internet-based client management is the better solution because it does not rely on users making the connection.

Determine If You Should Use Internet-Based Client Management

Tommy discusses his proposal with his manager, who asks him to look into what dependencies Internet-based client management has, to make sure that these can be met, and engage the necessary people within the company that will be needed to support the implementation.

Tommy checks the dependencies and identifies the people to contact who will be needed to be involved.

Prerequisites for Internet-Based Client Management

Determine Administrator Roles and Processes for Internet-Based Client Management

Tommy realizes that Internet-based client management requires native mode, and the site is currently configured for mixed mode.

The company already has a PKI solution for computers on the intranet and Internet, so he immediately talks to this team first to ensure that this requirement can be met and, if so, to initiate the process for deploying the required certificates.

Determine If You Can Use Your Existing PKI (Native Mode)

Administrator Checklist: Deploying the PKI Requirements for Native Mode

Tommy then initiates design meetings with the company's networking infrastructure team to decide how the Internet connectivity will fit in with the existing networking infrastructure.

They discuss supported scenarios, how many sites need to support Internet-based clients, and where servers should be placed.

Supported Scenarios for Internet-Based Client Management

Determine Site Placement for Internet-based Client Management

Determine Server Placement for Internet-Based Client Management

They decide to extend one site such that it has the following additional site systems in the perimeter network:

  • Management point
  • Software update point
  • Fallback status point
  • Distributions points

Network Diagram for Internet-Based Servers - Scenario 3 with No SQL Server Replica

They discuss the design with the company's security team, who approves it on condition that SQL connections initiated from the perimeter network do not traverse the security boundary into the intranet.

The design is revised so that a SQL Server replica will be used in the perimeter network, and the database administrators are informed of this requirement.

Network Diagram for Internet-Based Servers - Scenario 3 with SQL Server Replica

When the network design is approved, Tommy involves the networking team that looks after firewalls and network devices in the perimeter network.

They identify the network ports that will be used so they can make changes as required.

Note
This solution requires careful design for PKI certificate revocation, so that Configuration Manager clients can always locate the CRL listed in the site system native mode certificates and native mode site system servers can locate the CRL listed in the native mode client certificates. The PKI design of the CRL can require additional infrastructure configuration. For example, a Configuration Manager client on the Internet will make an http connection to access the CRL, which might require configuration on firewalls, proxy servers, and DNS.

Determine the Ports Required for Internet-Based Client Management

See the Configuration Manager CRL dependency listed in the following topic: Prerequisites for Native Mode.

The company's Internet DNS servers are managed by an external company, so Tommy submits a Request for Change (RFC) to publish the Internet FQDNs of the Internet-based site systems in DNS. He supplies the information required.

Configuring DNS for Configuration Manager Site System Roles

With the PKI certificates now deployed, Tommy migrates the site to native mode and monitors it for a period of time to ensure that there are no problems.

How to Migrate the Site Mode from Mixed Mode to Native Mode

How to Identify Client Certificate Issues in Native Mode

Additional servers are installed and hardened with security policies suitable for computers in the perimeter network.

Tommy confirms that the networking infrastructure is configured as required.

Internal process that is company-specific

Tommy installs the Internet-based site system roles on the servers with the following configuration:

  • Installation account that resides on the server.
  • The Internet FQDN of the site system.
  • The option Allow only site server initiated data transfers from this site system.

How to Configure the Site System Installation Account

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers

Tommy configures the Internet-based software update point to synchronize software updates.

How to Synchronize Software Updates

The database administrators install and configure a SQL Server replica in the perimeter network.

How to Configure SQL Server Site Database Replication

Tommy configures the Internet-based site systems to accept connections from Internet clients only.

How to Configure a Management Point for Internet-Based Client Connections

How to Configure a Distribution Point for Internet-Based Client Connections

How to Configure a Fallback Status Point for Internet-Based Client Connections

How to Configure a Software Update Point for Internet-Based Client Connections

Tommy configures the Internet-based distribution points so that they can transfer content over the Internet.

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

Tommy runs a test pilot with a few machines, specifying the Internet-based management point FQDN on the client, using the Internet tab in Configuration Manager from the Control Panel.

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point

When the preliminary tests are successful, Tommy then extends the pilot by sending a script to a few computers that reinstalls them with the following installation parameters:

  • Assignment to the Internet site.
  • Native mode communication and CRL checking.
  • The FQDN of the Internet-based management point.
  • The FQDN of the Internet-based fallback status point.

About Configuration Manager Client Installation Properties

Laptop users are informed about the changes that will be implemented, and the Help Desk is updated and given information on how to troubleshoot clients that experience problems installing applications or software updates when they are on the Internet.

Internal process that is company-specific

Satisfied with the pilot test results, Tommy sends the same installation script to the laptops.

He monitors when the script is successfully sent to each client and tracks client deployment by using the reports generated by the fallback status point. He also identifies client configuration details by using the client hardware inventory data.

About the Fallback Status Point in Configuration Manager

How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management

After six weeks, Tommy notes that 95 percent of laptop computers have received the script, and inventory data from these computers are being sent as regularly as computers on the intranet.

Additionally, the laptops are reporting the same level of compliance with software updates that are reported by computers on the intranet.

Report category of Software - Companies and Products report:

  • Count all inventoried products and versions

About Software Updates Reports

Tommy solicits feedback from the Help Desk and users to review the process for improvements or changes.

Internal process that is company-specific

Tommy is able to deliver the timely inventory reports as requested.

Internal process that is company-specific

This deployment of Internet-based client management might impact users in the following ways when their computers are configured for Internet and intranet client management:

  • Laptop moves from intranet to the Internet:
    Whenever the sales person has an Internet connection, the laptop continues to send inventory data and compliance information back to its site. Applications and software updates that are required are installed automatically, although they can sometimes take a while to download first. However, if the connection is broken, the download resumes when it next has an Internet connection.
    The sales person does not receive software distributions that are targeted to her Windows user account, but these applications are optional and not required.
  • Laptop moves from Internet to intranet:
    A sales person returns to the office after an absence of four weeks. She connects her laptop into the intranet and a download for a large software distribution package resumes where it left off, completing quickly with the faster network connection.
    The user notices that two optional software distributions are available and decides to install them in case they are needed later.

Manage Home Computers That Never Connect to the Intranet

This scenario demonstrates how you can create a new Configuration Manager site to support clients on the Internet that never connect to the intranet, using Internet-based client management. The network design chosen incorporates the supported scenario of having a child site completely in the perimeter network: Network Diagram for Internet-Based Servers - Scenario 2 with Child Site.

Coho Winery has a number of contract users who work at home, using their own computers and communicating by e-mail. They do not have Windows user accounts on the intranet and so will never log in to the intranet. However, they sometimes need software applications to complete their work, and they would like tested software updates installed automatically to help keep their computers secure.

To offer this level of management to home workers, Coho Winery decides to install the Configuration Manager client on these computers with an Internet-only configuration. This allows the home computers to be managed, which will increase the home workers' efficiency and productivity. Jenni Merriam is the Configuration Manager administrator, and she takes the course of action described in the following table.

Process Reference

Jenni reads about Internet-based client management and how clients can be configured for Internet-only, and be able to receive software distributions and software updates.

Overview of Internet-Based Client Management

Jenni discusses her proposal with her manager, who asks her to look into what dependencies Internet-based client management has, to make sure that these can be met, and to engage the necessary people within the company who will be needed to support the implementation.

Jenni checks the dependencies and identifies the people who will need to be involved.

Prerequisites for Internet-Based Client Management

Determine Administrator Roles and Processes for Internet-Based Client Management

Jenni realizes that Internet-based client management requires native mode, and the hierarchy is currently configured for mixed mode.

The company doesn't have a PKI solution, so she makes this her first priority to investigate.

After discussions with management, they are willing to engage PKI consultants to implement a PKI solution that is suitable for Configuration Manager, and that can be expanded to support other business requirements in the future.

PKI consultants are brought in with the design of migrating to native mode the central site in the Configuration Manager hierarchy, which will allow a new child site to be created for native mode that will support the Internet-only clients.

Jenni hands them the list of certificate requirements for native mode that must be in place for the central site and the new child site.

Certificate Requirements for Native Mode

Administrator Checklist: Deploying the PKI Requirements for Native Mode

Jenni then initiates design meetings with the company's networking infrastructure team to decide how the Internet connectivity will fit in with the existing networking infrastructure.

They discuss supported scenarios, how many sites need to support Internet-based clients, and where servers should be placed.

Supported Scenarios for Internet-Based Client Management

Determine Site Placement for Internet-based Client Management

Determine Server Placement for Internet-Based Client Management

They decide to create one new site in the perimeter network.

Network Diagram for Internet-Based Servers - Scenario 2 with Child Site

They discuss the design with the company's security team, who approves it on condition that the SMB traffic that traverses the security boundary of the perimeter network is secured with IPsec.

The PKI consultants incorporate this request into their design.

Implementing IPsec in Configuration Manager 2007

When the network design is approved, Jenni involves the networking team that looks after firewalls and network devices in the perimeter network.

They identify the ports that will be used so they can make changes as required.

Determine the Ports Required for Internet-Based Client Management

The company's Internet DNS servers are managed internally in the perimeter network, so Jenni submits a Request for Change (RFC) to publish the Internet FQDNs of the Internet-based site systems in DNS. She supplies the information required.

Configuring DNS for Configuration Manager Site System Roles

With the PKI certificates now deployed, Jenni migrates the central site to native mode and monitors it for a period of time to ensure that there are no problems.

How to Migrate the Site Mode from Mixed Mode to Native Mode

Additional servers are installed and hardened with security policies suitable for computers in the perimeter network.

Jenni confirms that the networking infrastructure is configured as required.

Internal process that is company-specific

Jenni installs a new child site in the perimeter network, configuring the Internet-based site system roles on the servers with the Internet FQDN of the site systems registered in the Internet DNS servers.

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

Jenni configures the Internet-based software update point to synchronize software updates.

How to Synchronize Software Updates

Jenni configures the Internet-based site systems to accept connections from Internet clients only.

How to Configure a Management Point for Internet-Based Client Connections

How to Configure a Distribution Point for Internet-Based Client Connections

How to Configure a Fallback Status Point for Internet-Based Client Connections

How to Configure a Software Update Point for Internet-Based Client Connections

Jenni configures the Internet-based distribution points so that they can transfer content over the Internet.

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

Jenni runs a test pilot with a few machines, specifying the Internet-based management point FQDN on the Internet tab of Configuration Manager in the client Control Panel.

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point

When the operational tests prove successful, Jenni then creates and tests an installation package with all the source files. This installation installs the Configuration Manager client with the following installation parameters:

  • Assignment to the Internet site.
  • Internet-only configuration
  • Native mode communication.
  • The FQDN of the Internet-based management point.
  • The FQDN of the Internet-based fallback status point.
  • Copy of the site server signing certificate.

About Configuration Manager Client Installation Properties

The PKI team constructs a Web portal in the perimeter network, to which the home users can connect and request the certificates they need.

Internal process that is company-specific

Home workers are informed about the new service and told that installation is a two-step process:

  • They must connect to the certificate Web portal to request a certificate.
  • They must run the installation package from the CD that will arrive in the mail.

Internal process that is company-specific

The Help Desk is updated and given information on how to troubleshoot clients that experience problems requesting the certificates or installing the client.

Internal process that is company-specific

After a pilot test with a few home workers, Jenni is satisfied with the results, and the installation CD is mailed to the remaining home workers.

Internal process that is company-specific

After six weeks, Jenni notes 100 percent of the home workers' computers are successfully assigned to the site and receiving software distributions and software updates.

About the Fallback Status Point in Configuration Manager

Jenni solicits feedback from the Help Desk and users to review the process for improvements or changes.

Internal process that is company-specific

This deployment of Internet-based client management might impact the home workers in the following ways when their computers are configured for Internet-only management:

  • Software updates are automatically installed.
    Some home workers remember to run Windows Update, but many forget or get confused about which updates to install. Having critical software updates automatically installed for them helps to keep their computers more secure.
  • Software applications are made available.
    To complete a project, a specific application is often needed. Instead of trying to install it as an e-mail attachment or having to wait for it to arrive in the mail, it now appears as an available application that home workers can select when it's needed.

Support Internet-Based Clients and Intranet Clients in the Intranet on the Same Site System Server

This scenario demonstrates how you can add Internet-based client management to an existing Configuration Manager site in the intranet, without having to add new site system servers in the perimeter network. Because this configuration bridges the security boundary of the perimeter network into the intranet, it is not a security best practice. However, as in this scenario, it does offer an efficient way to quickly test the Internet-based client management feature without having to install and configure additional servers. It also disables certificate revocation checking on clients, to save the additional configuration that would be required on a production network to publish a certificate revocation list that is accessible from the Internet.

The network design involves the supported scenario of the Configuration Manager 2007 site contained on the intranet, and the site systems that are configured for Internet-based client management can accept both Internet connections and intranet connections. (Network Diagram for Internet-Based Servers - Scenario 4 with Internet Connections into the Intranet.)

The administrators at Trey Research are interested in implementing Internet-based client management to supplement their computer management strategy for their existing Configuration Manager hierarchy. They have had problems keeping laptops up-to-date with important security software updates and application updates when staff spends extended time away from their offices to attend worldwide conferences. However, Trey Research does not currently have a PKI in place, which is a requirement for Internet-based client management. Before management will agree to resource this project, they require confirmation that Internet-based client management works and will provide the business benefits that they require.

The Configuration Manager administrator, Terry Adams, takes the course of action described in the following table.

Process Reference

For testing purposes, Terry uses a nonproduction Active Directory forest on an isolated section of the intranet that also has access to the Internet.

The Internet namespace for the company is treyresearch.net, and the internal Active Directory namespace on the test network is testnet.treyresearch.net.

Internal process.

For rapid deployment and with limited testing equipment, Terry decides to use just one server for all his Configuration Manager site systems that will host the following site system roles:

  • Site server
  • Management point
  • Distribution point
  • Software update point

Terry decides not to deploy a fallback status point for this proof of concept, because although it would be useful for identifying client communication issues, it is not needed to test basic site operation.

After reading through the server placement options for Internet-based site systems, Terry realizes that a single site system can support intranet clients and Internet-based clients. Although this is not a security best practice, the advantages for Terry are that he needs to install and configure fewer servers. This strategy allows Terry to test the Internet-based client management feature more quickly than if he had to install and configure multiple servers. The security risks of hosting multiple site system roles on a single server and of accepting Internet traffic into the intranet are mitigated by the test network's isolation from the production network.

About the Fallback Status Point in Configuration Manager

Determine Server Placement for Internet-Based Client Management

Terry installs a new server running Windows Server 2003 Service Pack 1 (which he names IBCMServer) and joins it to the domain. This server will be his single site system server. On it, he also installs IIS and all other prerequisites for Configuration Manager 2007.

He then extends the Active Directory schema for Configuration Manager 2007 and enables publishing by creating the System Management container and configuring the permissions on it for the IBCMServer computer.

Terry then installs a laptop computer running Windows Vista and joins it to the domain.

Prerequisites for Installing Configuration Manager

How to Extend the Active Directory Schema for Configuration Manager

Terry next discusses his proof of concept design with the networking team that manages the company's Internet connectivity requirements. After reading the external dependencies for Internet-based client management, Terry realizes that he will need their help with the following:

  • The front-end firewall must be configured to allow traffic for Internet-based client management.
  • The company Internet DNS servers must be configured with a public host entry for the test Internet-based site system.
    They decide to use the same host name of IBCMServer, so the Internet FQDN is IBCMServer.treyresearch.net.
  • The back-end Microsoft ISA Server must publish the Internet-based site systems to the intranet.

Prerequisites for Internet-Based Client Management

The networking team requires acceptance from the security team before they can make changes to the existing Internet infrastructure.

The security team reviews the plan and raises concerns about the server being in the intranet and exposed to traffic from the Internet.

Terry explains that this design is only for a proof of concept on an isolated network and shows them the different supported designs for production networks. In these, the site server is never exposed to Internet traffic, and although the Internet-based site systems can support Internet connections and intranet connections, there are other designs that offer stronger security.

The security team agrees to the design of the proof of concept on the understanding that Terry works with them for a more extensive review of the final design if the project is approved.

Supported Scenarios for Internet-Based Client Management

Terry confirms that his member server has automatically registered the computer name of IBCMServer in his internal Active Directory DNS zone of testnet.treyresearch.net.

The networking team manually adds a DNS A record for IBCMServer in the public DNS zone of treyresearch.net. Because ISA Server will be publishing this Internet-based site system, this record is configured with a public IP address that belongs to one of the external adapters on the ISA Server and that is not currently in use. This external IP address must be dedicated to Internet-based client management connections.

Note
If Terry had used more than one server for all his Internet-based site system roles, each internal site system that accepts connections over the Internet would require its own dedicated external IP address, even though all connections are through the same ISA Server computer.

Configuring DNS for Configuration Manager Site System Roles

Terry turns his attention to the PKI requirements and checks which certificates are needed for his test network. He references the documentation topics that cover the certificate requirements with guidance about how to install them.

Because of the limited scope of the testing environment, Terry needs only the following certificates:

  • Root certification authority
  • Site server signing certificate
  • Web server certificate (which must have both the intranet FQDN and Internet FQDN)
  • Client certificates

Certificate Requirements for Native Mode

Deploying the PKI Certificates Required for Native Mode

Terry realizes that the easiest way to deploy the required certificates is by using a Microsoft enterprise root certification authority, using the Enterprise Edition of Windows Server 2003. This solution provides the following benefits:

  • The root certification authority is automatically deployed to all computers in the Active Directory forest.
  • Web-based enrollment can be used to request custom certificates, with automatic approval.
  • Auto-enrollment is supported with Group Policy.

Terry confirms that his single Active Directory domain controller in the test network is running the Enterprise Edition of Windows Server 2003 and has Internet Information Services (IIS) installed.

Terry then installs on his domain controller Microsoft Certificate Services (with the subcomponents of Certificate Services CA and Certificate Services Web Enrollment Support) and configures an enterprise root certification authority.

After reading the topic about deploying the Web server certificate to site system servers, he realizes that he needs to enable support for the Subject Alternative Name (SAN) certificate attribute so that he can specify both the intranet FQDN and the Internet FQDN. He follows the procedure referenced in the article to enable SAN support on his root certification authority (CA), which, in his test environment, will also issue the certificates.

Determine If You Can Use Your Existing PKI (Native Mode)

Deploying the Web Server Certificates to Site System Servers

Information about how to add support for Subject Alternative Names with a Microsoft certification authority: http://go.microsoft.com/fwlink/?LinkId=93692

Terry has little PKI experience, so he references the step-by-step example deployment guide in the Configuration Manager library.

He follows the procedures exactly for the site server signing certificate and for deploying client certificates. However, he has to modify the procedure for specifying his Web server certificate for this Internet-based site system, because this requires both the intranet FQDN and the Internet FQDN in the Subject Alternative Name:

  • He uses the Web server certificate template without modification, confirming that the option Supplied in the request is enabled on the Subject Name tab.
  • He uses the Web enrollment method to request the Web server certificate from his member server, just as he did for the site server signing certificate.
  • In the certificate form, he specifies the intranet FQDN as the Subject Name, and in the Attributes box, he specifies both the intranet FQDN and the Internet FQDN as follows: san:dns=IBCMServer.testnet.research.net&dns=IBCMServer.research.net.
  • Terry submits the certificate, it is immediately approved, and Terry installs it on the default Web site.
  • Terry returns to the step-by-step example deployment guide for information about how to configure IIS to use the Web server certificate.

Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority

Information about how to add support for Subject Alternative Names with a Microsoft certification authority: http://go.microsoft.com/fwlink/?LinkId=93692

After checking the prerequisites for native mode, Terry realizes that because his issuing certification authority is on the intranet, clients on the Internet will not, by default, be able to access the certificate revocation list (CRL). An intranet CRL is published by default with his certification authority.

Terry reads the planning topic on CRL checking and realizes that if clients on the Internet attempt to locate the CRL and this fails, connections to the Internet-based site system roles will fail.

Rather than publish a CRL on the Internet, which would be required for a production network, Terry decides to disable CRL checking on clients within his test environment so that he minimizes additional configuration requirements.

Prerequisites for Native Mode

Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)

Terry then runs Configuration Manager 2007 Setup on the member server with the following selections:

  • Simple Setup
  • The same site code in the site server's signing certificate Subject Name.
  • Native mode, successfully browsing to the deployed site server signing certificate.

When setup is complete, Terry performs the following post setup tasks:

  • Configures an Active Directory boundary.
  • Configures the site system server with an intranet FQDN of IBCMServer.testnet.treyresearch.net and an Internet FQDN of IBCMServer.treyresearch.net.
  • Disables CRL checking on clients as a site property, to support the test network environment.

Simple Setup Overview

How to Deploy a Site Using Simple Setup

How to Configure Configuration Manager Boundaries

How to Configure the Intranet FQDN of Site Systems

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

How to Enable or Disable Certificate Revocation Checking (CRL) on Clients

Terry now installs the Configuration Manager client on the laptop, configures software updates, and confirms standard Configuration Manager operation on the intranet.

Tasks for Installing Configuration Manager Clients

Software Updates in Configuration Manager

With intranet operation in native mode confirmed, Terry then configures the site system roles to allow intranet and Internet client connections.

He also confirms that the distribution point is configured to transfer content using BITS and HTTP.

How to Configure a Management Point for Internet-Based Client Connections

How to Configure a Software Update Point for Internet-Based Client Connections

How to Configure a Distribution Point for Internet-Based Client Connections

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

On the laptop computer, Terry specifies IBCM.treyresearch.com as the Internet-based client management point on the Internet tab of Configuration Manager in Control Panel.

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point

The networking team makes the final required configurations to allow the Internet traffic into both the perimeter network and the intranet:

  • The back-end Microsoft ISA Server is configured with a server publishing rule so that incoming HTTPS requests using port 443 to IBCMServer.treyresearch.net maps to HTTPS requests using port 443 to IBCMServer.testnet.treyresearch.net. This configuration uses SSL tunneling, which does not require additional certificates on the ISA Server.
  • The front-end firewall is confirmed as already configured to allow incoming traffic of port 443 to the ISA Server.

Determine the Ports Required for Internet-Based Client Management

Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management

Terry disconnects his test laptop from the test network and, using the software updates feature in Configuration Manager, creates a new optional software update deployment.

Terry then takes the test laptop home, connects to the Internet, manually initiates client policy, receives notification of the optional software update, and is able to successfully install it.

How to Initiate Policy Retrieval for a Configuration Manager Client

About the Software Updates End User Experience

Available Software Updates Dialog Box on Clients

After this initial successful test, Terry conducts further tests with automatic software updates and software distributions, and he confirms that hardware inventory and desired configuration management compliance information is still reported when the laptop is on the Internet. He also confirms that a content download can seamlessly continue when he moves the laptop from the Internet to the intranet and vice versa.

Terry documents his findings and two weeks later presents his findings to the management team. The successful conclusion convinces the management team that Internet-based client management offers a seamless user experience that provides an effective method of managing laptops even when they are away from the company network. In turn, this helps to keep the laptops secure, so the investment required in a PKI solution is seen to be cost justified.

The company does not have the internal resources or experience to implement an internal PKI, so the proof of concept provides the cost justification to outsource this project so that Internet-based client management can be implemented in the near future.

See Also

Concepts

Administrator Checklist: Configuring a Site for Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
Administrator Workflow: Configuring a Site for Internet-Based Client Management
Overview of Internet-Based Client Management


Prerequisites for Internet-Based Client Management

Topic last updated -- August 2007

Internet-based client management in Configuration Manager 2007 has the following external dependencies and dependencies within the product.

Dependencies External to Configuration Manager 2007

Dependency More Information

Clients that will be managed on the Internet must have an Internet connection.

Configuration Manager 2007 uses existing Internet Service Provider (ISP) connections to the Internet, which can be either permanent or temporary connections. Client mobile devices must have a direct Internet connection, but client computers can have either a direct Internet connection or connect using a proxy Web server.

Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management

Site systems that will support Internet-based client management must have connectivity to the Internet.

Site System Roles that Support Internet-Based Client Management

Determine Server Placement for Internet-Based Client Management

Site systems that will support Internet-based client management must be in an Active Directory domain, but can be in a different Active Directory forest from the forest that contains the site server.

Note
The Internet-based site systems do not require a trust relationship with the site server's Active Directory forest.

Configuration Manager in Multiple Active Directory Forests

You must have a supporting public key infrastructure (PKI) that can deploy and manage the certificates required for native mode.

Certificate Requirements for Native Mode

The Internet fully qualified domain name (FQDN) of site systems that support Internet-based client management must be registered as host entries on public DNS servers.

Configuring DNS for Configuration Manager Site System Roles

Intervening firewalls or proxy servers between the client and the Internet-based systems have the following communication requirements:

  • Support HTTP 1.1
  • Allow HTTP content type of multipart MIME attachment (multipart/mixed and application/octet-stream)
  • Allow the following verbs:
    • HEAD
    • CCM_POST
    • BITS_POST
    • POST
    • GET
    • PROPFIND
    • PROPGET
  • Allow the following HTTP headers:
    • Range:
    • CCMClientID:
    • CCMClientIDSignature:
    • CCMClientTimestamp:
    • CCMClientTimestampsSignature:

Refer to your firewall or proxy server documentation for configuration information to support these requirements.

Configuration Manager 2007 Dependencies

Dependency More Information

The Configuration Manager 2007 site must be in native mode, and a primary site.

Prerequisites for Native Mode

Note
You cannot specify different port numbers for intranet and Internet Client Requests on the same site.

Site systems that will support Internet-based client management must be configured in Configuration Manager 2007 with an Internet fully qualified domain name.

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

How to Configure the Internet FQDN of an Internet-based NLB Management Point

Site systems that will support Internet-based client management must be configured in Configuration Manager 2007 to accept connections from the Internet.

Note
You cannot configure site systems for Internet-based client management if they are configured as a site server share, a protected site system, or a branch distribution point.

How to Configure a Management Point for Internet-Based Client Connections

How to Configure a Distribution Point for Internet-Based Client Connections

How to Configure a Fallback Status Point for Internet-Based Client Connections

How to Configure a Software Update Point for Internet-Based Client Connections

Internet-based site systems in Configuration Manager 2007 must be configured with the same Internet fully qualified domain names (FQDN) that are registered as host entries on public DNS servers.

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

Distribution points must be configured in Configuration Manager 2007 to transfer content using BITS, HTTP, and HTTPS.

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

If the Internet-based site systems are in a different Active Directory forest from the site server's forest, you must specify the following properties for these site systems:

  • A site system installation account
  • Allow only site server initiated data transfers from the site system

How to Configure the Site System Installation Account

How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers

See Also

Concepts

Overview of Internet-Based Client Management
Administrator Workflow: Configuring a Site for Internet-Based Client Management
Administrator Checklist: Configuring a Site for Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management


Planning for Internet-Based Client Management

Planning a site for Internet-based client management in Configuration Manager 2007 is critical and typically involves coordination with other teams that are responsible for security and the network infrastructure.

This section provides the planning steps to be included for deploying Configuration Manager 2007 to support Internet-based client management.

Click the related link below for detailed information about how to plan the Configuration Manager 2007 site to support Internet-based client management.

In This Section

Determine If You Should Use Internet-Based Client Management

Helps you to determine if using Internet-based client management is appropriate for your Configuration Manager 2007 site.

Determine Administrator Roles and Processes for Internet-Based Client Management

Provides guidance on the various administrator roles and processes involved with implementing Internet-based client management in Configuration Manager 2007, and warns of some of the consequences if these are not taken into account.

Determine Site Placement for Internet-based Client Management

Helps you identify where to place the Internet-based sites in the Configuration Manager hierarchy.

Determine Server Placement for Internet-Based Client Management

Helps you identify where to place site systems and related servers when the site is configured to support Internet-based client management.

Determine the Ports Required for Internet-Based Client Management

Helps you to identify the ports used with Internet-based client management. This information might be required for configuring network devices, such as firewalls, that are placed between network security boundaries, such as the Internet and your perimeter network, and the perimeter network and the intranet.

Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management

Identifies the requirements for proxy Web servers if your environment has these placed between the Internet and your company networks.

See Also

Concepts

Overview of Internet-Based Client Management
Prerequisites for Internet-Based Client Management

Other Resources

Configuring Internet-Based Client Management


Determine If You Should Use Internet-Based Client Management

If all your client computers are on the intranet, you do not need to configure Configuration Manager 2007 for Internet-based client management. However, if you have client computers that are either always or sometimes on the Internet, and you need to manage them when they are not on your intranet, you must determine whether Internet-based client management is a suitable solution for your environment.

You can manage remote computers when they connect to the intranet with a virtual private network (VPN). However, this management method can have a number of disadvantages, such as the additional costs of maintaining this service and the reliance on users to make the additional connection. When determining whether you should use Internet-based client management rather than a virtual private network to manage client computers that are not connected to the intranet, you should consider the advantages and disadvantages of each solution to best meet your business requirements.

The following table outlines the advantages and disadvantages of both management solutions to help you determine whether you should use Internet-based client management to manage remote computers.

Management Solution Advantage Disadvantage

Configuration Manager with a virtual private network (VPN)

No change in network infrastructure if this is already in place.

All Configuration Manager features are supported, such as software distribution to users and Network Access Protection.

Does not require the site to be in native mode, with a supporting public key infrastructure (PKI).

Costs and overhead of maintaining this additional service.

Large volumes of data are transferred, and the data transfer method is not suitable for slow and unreliable connections.

Relies on users making the additional connection, which can delay or prevent management tasks such as software deployment and inventory reporting.

Configuration Manager with Internet-based client management

No additional service with associated costs and overhead.

Less data is transferred, and the data transfer method is more suitable for slow and unreliable networks.

Does not rely on users making an additional connection (or even logging on), which can increase the success rate of management tasks.

Requires changes in the network infrastructure, such as implementing firewalls and placing Configuration Manager site systems in the perimeter network.

Requires additional configuration in Configuration Manager, and it could require additional servers.

Not all Configuration Manager features are supported.

Requires that the site is in native mode, with a PKI support infrastructure.

See Also

Concepts

Overview of Internet-Based Client Management
Prerequisites for Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


Determine Administrator Roles and Processes for Internet-Based Client Management

In a production environment, implementing Internet-based client management will require interaction and collaboration with a number of different groups across the enterprise. For example, these groups might include the following:

  • Active Directory Domain Services service administrators to extend the schema and configure the System Management container with required security permissions.
Note
Extending the schema for Configuration Manager is not a requirement for Internet-based client management. However, when you have clients that will be managed on both the intranet and the Internet, it is much easier to configure native mode clients on the intranet when Configuration Manager is publishing to Active Directory Domain Services.

  • Active Directory Domain Services data administrators to create any accounts that might be needed if the Internet-based site systems are deployed in a separate Active Directory forest.
  • Public key infrastructure (PKI) specialists to create, deploy, and manage the PKI certificates required for native mode.
  • Infrastructure architects and security advisors to decide the most suitable network topology and server placement that will be used to support Internet-based client management.
  • Windows Server administrators to build, configure, and harden the servers that will support connections from the Internet.
  • Firewall and Web proxy administrators to make configuration changes on firewalls and network devices required to support Internet-based connections.
  • DNS administrators to add host entries for the Internet-based site systems.
  • Database administrators to configure SQL replication if this is part of your Internet-based site design.
  • Packaging administrators to create the installation package that will install and configure the Configuration Manager client from removable media, for the clients that cannot install on the intranet.
  • Help Desk engineers who will receive calls from users on the Internet who are experiencing problems receiving application and software updates over the Internet.
  • End users who might require training about how to install the client from removable media, how to change their Internet-based management point and proxy server settings, and what processes to follow if they experience problems.

Because implementing a site to support Internet-based client involves so many roles, it is critical that you identify early who is responsible for the various roles, and work with them to incorporate their requirements and their processes.

For example, if updating public DNS servers can take a month, initiate this request early enough so that it's completed when you are ready to configure clients for their Internet-based site, rather than leaving it until the day before on the assumption that it will be completed quickly.

A successful ongoing implementation will depend on identifying and adhering to processes that coordinate the various functions between the roles.

Some of the potential consequences of not having and following defined processes when implementing Internet-based client management in a production environment are as follows:

  • A critical component, such as DNS configuration or firewall configuration, delays deployment because it wasn't requested in a timely manner.
  • Users receive an installation disk with no instructions, and the Help Desk also has no information about the disk when users ask for more information.
  • The corporate security policy is violated by installing servers in the perimeter network without the usual security hardening measures.
  • There is no network connectivity between the Internet-based site systems and the site server because of a failure to identify that the back-end firewall requires configuration.

Use a methodology such as ITIL or Microsoft Operations Framework (http://go.microsoft.com/fwlink/?LinkId=88047) to help you implement Internet-based client management within a framework of defined processes. Make sure you document your design, testing procedures, the areas of responsibility, and the processes to follow for configuration and troubleshooting, and then disseminate this information, making sure that it is centrally available and updated.

Note
Review existing company security policies and, if necessary, modify them to include the implementation of Internet-based client management.

See Also

Concepts

Administrator Workflow: Configuring a Site for Internet-Based Client Management
Overview of Internet-Based Client Management

Other Resources

Planning for Internet-Based Client Management


Determine Site Placement for Internet-based Client Management

You can implement a Configuration Manager 2007 site to support Internet-based client management in the following two ways:

  • Enable one or more primary sites to support Internet-based client management, and also support intranet clients.
  • Enable one or more primary child sites to support only Internet-based client management.
Note
Secondary sites cannot support Internet-based client management.

For more information about server placements for these choices, see Determine Server Placement for Internet-Based Client Management.

When determining how many sites will support Internet-based client management, take into account that clients connecting over the Internet will download content from any of the Internet-based distribution points in the site, regardless of bandwidth or physical location. This behavior might identify the requirement for multiple Internet-based sites in the hierarchy.

For example, if you want specified users to connect only to a specified group of Internet-based distribution points, create an Internet-based site for each group of distribution points and then assign the users to one of the sites as appropriate.

Note
There is no concept of roaming on the Internet. The Internet-based distribution points used by clients when they are on the Internet are determined by the client's assigned site, and not by the connecting client's location. For example, if you assign a client to an Internet-based site in Los Angeles, that client traveling in Japan cannot use Internet-based distribution points from an Internet-based site in Tokyo without first being reassigned to the Tokyo site.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Overview of Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management

Other Resources

Configuring Internet-Based Client Management
Planning for Internet-Based Client Management


Determine Server Placement for Internet-Based Client Management

A number of scenarios are supported for Internet-based client management, and each one has advantages and disadvantages. To determine whether servers should be in the perimeter network, or the intranet, you must decide which scenario is suitable for your environment and business requirements.

All server placement references below refer to a primary site only; secondary sites do not support Internet-based client management.

Server Placement for Sites that Do Not Need to Also Manage Intranet Client

If the Configuration Manager 2007 site does not need to support both Internet clients and intranet clients, Scenarios 1 and 2 in the following table are applicable. The following table lists the advantages and disadvantages of these scenarios and the related server placement.

Scenario to support Internet clients only Advantage Disadvantage Server Placement

Scenario 1: All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. The site server is in the intranet:

  • The management point that supports Internet-based clients communicates directly with the SQL server in the intranet.

The site server is protected from Internet traffic by being in the intranet.

There is no SQL Server replica to configure and no associated replication latency.

The back-end firewall requires some configuration to allow SQL traffic and Server Message Block (SMB) traffic.

The SQL connection is initiated from the perimeter network to the intranet, which is a less secure configuration than if the connection is initiated from the intranet.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point

Intranet:

  • Site server
  • SQL Server (can be running on the site server)

Scenario 1: All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. The site server is in the intranet:

  • The management point that supports Internet-based clients communicates with a SQL server replica in the perimeter network.

The site server is protected from Internet traffic by being in the intranet.

The SQL replica means that all the connections from the perimeter network to the intranet are initiated from the intranet, which is more secure than being initiated from the perimeter network.

The back-end firewall requires some configuration to allow SQL traffic and SMB traffic.

SQL replica requires a server with associated costs, and there will be some replication latency between the replica and the site server.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point
  • SQL Server configured for replication

Intranet:

  • Site server
  • SQL Server (can be running on the site server)

Scenario 2: The Internet-based site is contained within the perimeter network:

  • This site is a child site of your Configuration Manager 2007 hierarchy.

No Internet traffic is passing to the intranet.

Just one configuration is required on the back-end firewall from the child site server to parent site server.

Supports centralized management and reporting.

The site server is more vulnerable to attacks from the Internet than if it was located in the intranet.

Requires the back-end firewall to be configured to allow inbound SMB traffic.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point

Intranet:

  • None

Scenario 2: The Internet-based site is contained within the perimeter network:

  • This site is the only site in your Configuration Manager 2007 hierarchy.

No Internet traffic is passing to the intranet.

Nothing to configure on the back-end firewall.

The site server is more vulnerable to attacks from the Internet than if it was located in the intranet.

No support for centralized management and reporting.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point

Intranet:

  • None

Server Placement for Sites that Manages Clients on the Internet and the Intranet

If the Configuration Manager 2007 site needs to support both Internet clients and intranet clients, Scenarios 3 and 4 in the following table are applicable. The following table lists the advantages and disadvantages of these scenarios and the related server placement.

Scenario to support clients on the Internet and on the intranet Advantage Disadvantage Server Placement

Scenario 3: The site spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. There is a second management point (and second software update point and fallback status point, and additional distribution points) and other site systems that are in the intranet for clients connecting on the intranet:

  • The management point that supports Internet-based clients communicates directly with the SQL server in the intranet.

The site server is protected from Internet traffic by being in the intranet.

The assigned management point, and other site systems that intranet clients connect to, are separated from Internet traffic.

There is no SQL Server replica to configure and no associated replication latency.

More servers are required for the Internet-based connections, with associated costs.

The back-end firewall requires some configuration to allow SQL traffic and SMB traffic.

The SQL connection is initiated from the perimeter network to the intranet, which is a less secure configuration than if the connection is initiated from the intranet.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point

Intranet:

  • Site server
  • SQL Server (can be running on the site server)
  • Fallback status point
  • Distribution points
  • Software update point
  • All other site systems

Scenario 3: The site spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network and accept connections for clients connecting over the Internet. There is a second management point (and second software update point and fallback status point, and additional distribution points) and other site systems that are in the intranet for clients connecting on the intranet:

  • The management point that supports Internet-based clients communicates with a SQL server replica in the perimeter network.

The site server is protected from Internet traffic by being in the intranet.

The assigned management point, and other site systems that intranet clients connect to, are separated from Internet traffic.

The SQL replica means that all the connections from the perimeter network to the intranet are initiated from the intranet, which is more secure than being initiated from the perimeter network.

More servers are required for the Internet-based connections, with associated costs.

The back-end firewall requires some configuration to allow SQL traffic and SMB traffic.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point
  • SQL Server

Intranet:

  • Site server
  • SQL Server (can be running on the site server)
  • Fallback status point
  • Distribution points
  • Software update point
  • All other site systems

Scenario 4: The site bridges the perimeter network and intranet:

  • Internet-based site systems have two network cards.

Fewer servers to configure and maintain for both intranet connections and Internet connections.

The site server is protected from Internet traffic by being in the intranet.

There is no SQL Server replica to configure and no associated replication latency.

There is no security boundary between the perimeter network and the intranet, which is not a recommended solution.

The SQL connection is initiated from the perimeter network to the intranet, which is a less secure configuration.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point

Intranet:

  • Same site systems as on the perimeter network because they are on both networks
  • Site server
  • SQL Server (can be running on the site server)
  • All other site systems

Scenario 4: The site bridges the perimeter network and intranet:

  • Internet-based site systems are in the intranet and can accept both Internet connections and intranet connections.

Fewer servers to configure and maintain for both intranet connections and Internet connections.

The site server is protected from Internet traffic by being in the intranet.

There is no SQL Server replica to configure and no associated replication latency.

Requires a reverse proxy configuration between the perimeter network and the intranet so that the Internet-based site systems on the intranet are published to Internet clients.

Internet clients are traversing a security boundary to make connections to servers on the intranet. You can help mitigate this threat by using SSL bridging rather than SSL tunneling on the proxy server. For more information, see Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management.

Perimeter Network:

  • None

Intranet:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point
  • All other site systems

Scenario 4: The site bridges the perimeter network and intranet:

  • Internet-based site systems are in the perimeter network and can accept both Internet connections and intranet connections.

Fewer servers to configure and maintain for both intranet connections and Internet connections.

The site server is protected from Internet traffic by being in the intranet.

There is no SQL Server replica to configure and no associated replication latency.

Intranet clients are traversing a security boundary to make connections to servers that are exposed to Internet traffic.

The back-end firewall requires some configuration to allow SQL traffic and SMB traffic.

The SQL connection is initiated from the perimeter network to the intranet, which is a less secure configuration.

Perimeter Network:

  • Internet-based management point
  • Internet-based fallback status point
  • Internet-based distribution points
  • Internet-based software update point

Intranet:

  • Site server
  • SQL Server (can be running on the site server)
  • All other site systems

See Also

Concepts

Supported Scenarios for Internet-Based Client Management
Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management
Overview of Internet-Based Client Management


Determine the Ports Required for Internet-Based Client Management

Topic Last Updated—August 2008

Configuring Configuration Manager 2007 for Internet-based client management often requires some network configuration to support the additional traffic from the Internet. Typically, this requires reconfiguration of firewalls between the Internet and your perimeter network (a perimeter network is also known as a screened subnet or a DMZ), and also between the perimeter network and your intranet. It might also include configuration of Web proxy servers between security boundaries.

Note
Firewalls placed between the Internet and perimeter networks are often referred to as "front-end firewalls," and firewalls placed between the perimeter network and the intranet are often referred to as "back-end firewalls."

Use the network diagrams that correspond to your chosen supported scenario for Internet-based client management to identify the protocols that cross security boundaries and will therefore need to be configured on firewalls. For a list of the supported scenarios, see Supported Scenarios for Internet-Based Client Management.

Additionally, make sure that any intervening firewalls support HTTP 1.1, and that they do not block traffic required by Configuration Manager 2007 Internet-based client management. Reference the external dependency for intervening firewalls or proxy servers in the following topic: Prerequisites for Internet-Based Client Management.

The list of possible protocols used in Internet-based client management scenarios is as follows:

  • RPC
  • SMB
  • Microsoft SQL Server
  • HTTP
  • HTTPS

Remote procedure calls (RPC) is needed for site system installation, and installing packages onto distribution points. These connections typically use ports UDP and TCP 135 and a dynamic TCP port range.

Server message blocks (SMB) is needed for site system installation and repair, and for sending site system status. These connections typically use ports TCP 445.

SQL Server connections typically use port TCP 1433.

Clients on the Internet will use HTTP to connect to their Internet-based fallback status point. Clients on the Internet will use HTTPS to connect to their Internet-based management point, Internet-based distribution points, and Internet-based software update point. Software update points can synchronize to another software update point using HTTPS. If your firewalls require the port numbers for HTTP and HTTPS protocols, by default they are TCP 80 and TCP 443, respectively. However, you can change these port numbers for HTTP and HTTPS traffic in Configuration Manager 2007, and this offers some additional security if you are using Internet-based client management.

Use the following procedure to identify the port numbers configured for HTTP and HTTPS connections, so that you can configure this port information on firewalls that protect your networks from the Internet.

Important
Do not change the port numbers in Configuration Manager 2007 without understanding the consequences. For example, changing the port numbers for the client request services without following the correct procedure might result in all the clients in the site being unable to connect to their management point and, as such, unmanaged.

Procedures

To view the port numbers for client requests that use HTTP and HTTPS connections

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> – <site name>, and then click Properties.

  3. On the Ports tab in the site properties dialog box, view the Active Ports section.

  4. Locate the two services Client Requests-HTTP (TCP). Identify the configured port number if the service is selected to be used by the site. If both services are selected, you might need to configure firewalls for both port numbers if some clients are still using the default port number.

  5. Locate the service Client Requests-HTTPS (TCP). Identify the configured port number if the service is selected to be used by the site. If both services are selected, you might need to configure firewalls for both port numbers if some clients are still using the default port number.

  6. Click OK.

 To view the port number for software update points that use HTTPS connections (client requests and synchronization to another software update point)

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration.

  2. Right-click Software Update Point, and then click Properties.

  3. On the Internet Facing tab, locate the section Specify the port settings used by this WSUS server and then identify the configured port number for SSL port number.

  4. Click OK.

See Also

Tasks

How to Configure Request Ports for the Configuration Manager Client

Concepts

Supported Scenarios for Internet-Based Client Management
Ports Used by Configuration Manager
Implementing IPsec in Configuration Manager 2007


Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management

Topic Last Updated—August 2008

If you are using proxy Web servers with Internet-based client management in Configuration Manager 2007, the requirements for these servers are listed in the following sections.

If you are using Microsoft Internet Security and Acceleration (ISA) Server as your proxy Web server, refer to the following information:

  • How to Configure ISA SSL Bridging for System Center Configuration Manager Internet-Based Client Management (http://go.microsoft.com/fwlink/?LinkId=122350).
  • Microsoft ISA Server Web page for general setup and configuration information (http://go.microsoft.com/fwlink/?LinkId=91897).

Support for Secure Sockets Layer (SSL)

Note
SSL termination with authentication using bridging technology is recommended, although SSL tunneling is also supported if your proxy Web server cannot support bridging with authentication. For more information, see the Microsoft Internet Security and Acceleration Server documentation about the differences between bridging and tunneling (http://go.microsoft.com/fwlink/?LinkId=80311).

  • SSL bridging to SSL:
    The recommended configuration when using proxy Web servers with Configuration Manager 2007 Internet-based client management is SSL bridging to SSL, using termination with authentication. Client computers must be authenticated using machine authentication, and client mobile devices are authenticated using user authentication.
    The benefit of SSL termination at the proxy Web server is that packets from the Internet are subject to inspection before they are forwarded to the internal network. The proxy Web server authenticates the connection from the client, terminates it, and then opens a new authenticated connection to the Internet-based site systems. When Configuration Manager clients use a proxy Web server, the client identity (client GUID) is securely contained within the packet payload so that the management point does not consider the proxy Web server to be the client. Bridging is not supported in Configuration Manager 2007 with HTTP to HTTPS, or from HTTPS to HTTP.
  • Tunneling:
    If your proxy Web server cannot support the requirements for SSL bridging, SSL tunneling is also supported. This is a less secure option because the SSL packets from the Internet are forwarded to the site systems without termination, so they cannot be inspected for malicious content. When using SSL tunneling, there are no certificate requirements for the proxy Web server.

Certificates Requirements for SSL Bridging

  • Web server certificate for server authentication and SSL if you are using bridging:
    • The certificate must chain to a root authority that is trusted by client computers.
    • The certificate must contain the Internet fully qualified domain names (FQDNs) of all the Internet-based site systems in the Subject Alternative Name field.
  • Client machine certificate for authentication if you are using bridging for client computers:
    • The certificate must chain to a root certification authority that is trusted by the site system servers.
    • The certificate must have a unique value in the Subject field or the Subject Alternative Name field.
  • Client user certificate for authentication if you are using bridging for client mobile devices:
    • The certificate must chain to a root certification authority that is trusted by the site system servers.
    • The certificate must have a unique value in the Subject field or the Subject Alternative Name field.

Fallback Status Point Requirements

  • Support for HTTP:
    • If you are using an Internet-based fallback status point, the proxy Web server must accept HTTP traffic.

DNS Requirements

  • The Internet-based site systems must be configured with an Internet FQDN in Configuration Manager 2007, which is also registered on public Internet DNS servers with the IP address of your proxy Web server.
  • The Internet-based site systems must be published on the proxy Web server with the Internet FQDN they are configured to use in Configuration Manager 2007.

Application Level Inspection

If the Proxy Web server performs application level inspection, it must allow the following communication between Configuration Manager clients and Internet-based site systems:

  • HTPP version 1.1
  • HTTP content type of multipart MIME attachment
  • Required verbs and HTTP headers

For more information, see the external dependencies listed in Prerequisites for Internet-Based Client Management

See Also

Concepts

Certificate Requirements for Native Mode
Determine the Ports Required for Internet-Based Client Management
Overview of Internet-Based Client Management


Configuring Internet-Based Client Management

Configuring a site for Internet-based client management in Configuration Manager 2007 requires that the site systems that support Internet-based client management are configured appropriately.

Click the related link below for detailed information about how to configure the site systems for Internet-based client management.

In This Section

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

Specifies how to configure the Internet fully qualified domain name (FQDN) for the site systems that support Internet-based client management.

How to Configure the Internet FQDN of an Internet-based NLB Management Point

Specifies how to configure the Internet fully qualified domain name (FQDN) for an Internet-based management point that is configured for network load balancing (NLB).

How to Configure a Management Point for Internet-Based Client Connections

Specifies how to configure an Internet-based management point for client connections.

How to Configure a Distribution Point for Internet-Based Client Connections

Specifies how to configure an Internet-based distribution point for client connections.

How to Configure a Fallback Status Point for Internet-Based Client Connections

Specifies how to configure an Internet-based fallback status point for client connections.

How to Configure a Software Update Point for Internet-Based Client Connections

Specifies how to configure an Internet-based software update point for client connections.

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

Specifies how to configure an Internet-based distribution point appropriately for content download over the Internet.

How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers

Specifies how to configure Internet-based site systems so that they respond to connections from the site server to retrieve information such as status messages. This option is particularly relevant when the Internet-based site systems are in the perimeter network and the site server is in the intranet.

How to Configure SQL Server Site Database Replication

Specifies how to configure a SQL Server replica. This option is particularly relevant when the Internet-based site systems are in the perimeter network and the site server is in the intranet.

Administrator Workflow: Configuring a Site for Internet-Based Client Management

Specifies the administrator workflow for configuring a site for Internet-based client management in a flowchart format.

Administrator Checklist: Configuring a Site for Internet-Based Client Management

Specifies the administrator checklist for configuring a Configuration Manager 2007 site for Internet-based client management.

Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Specifies the administrator checklist to install Configuration Manager 2007 client computers when they are assigned to a site that supports Internet-based client management.

Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management

Specifies the administrator checklist to install Configuration Manager 2007 client mobile devices when they are assigned to a site that supports Internet-based client management.

See Also

Concepts

Overview of Internet-Based Client Management
Prerequisites for Internet-Based Client Management

Other Resources

Planning for Internet-Based Client Management


How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

Internet DNS servers must be registered with a fully qualified domain name (FQDN) for the site systems that will support Internet-based client management, so that clients on the Internet can resolve the FQDN of Internet-based site systems to the public IP address of the Internet-based servers. These same Internet FQDNs must also be configured in Configuration Manager 2007 with the same Internet FQDNs.

The site system roles that can support Internet-based client management are the following:

  • Management point
  • Distribution points
  • Fallback status point
  • Software updates point

To configure the Internet FQDN of site systems that will support Internet-based client management

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Select the first server that will support Internet-based client management to display the list of roles.

  3. Right-click ConfigMgr Site System, and then select Properties.

  4. On the General tab, select Specify an Internet fully qualified domain name for this site system.

  5. In the Internet FQDN text box, enter the Internet FQDN that is registered on the public Internet DNS for the server.

  6. Click OK.

  7. Repeat steps 3 to 6 for any remaining servers that will support Internet-based client management.

See Also

Tasks

How to Configure a Distribution Point for Internet-Based Client Connections
How to Configure a Fallback Status Point for Internet-Based Client Connections
How to Configure a Management Point for Internet-Based Client Connections
How to Configure a Software Update Point for Internet-Based Client Connections
How to Configure the Internet FQDN of an Internet-based NLB Management Point

Concepts

Determine Server Placement for Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


How to Configure the Internet FQDN of an Internet-based NLB Management Point

If you are using a network load balanced (NLB) cluster in Configuration Manager 2007 for a management point that supports Internet-based client management, the fully qualified domain name (FQDN) of the NLB cluster must be registered on Internet Domain Name System (DNS) servers. Then configure the NLB management point in Configuration Manager 2007 with the same Internet FQDN.

To configure the Internet FQDN of an Internet-based NLB management point:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. Right-click Management Point Component, and then select Properties.

  3. On the General tab, select Network Load Balancing cluster virtual server.

  4. Click FQDN, and then enter the registered Internet fully qualified domain name (FQDN) in the text box Public DNS.

  5. Click OK.

See Also

Tasks

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management


How to Configure the Internet FQDN of an Internet-Based NLB Software Update Point

If you are using a network load balanced (NLB) cluster in Configuration Manager 2007 for a software update point that supports Internet-based clients, the fully qualified domain name (FQDN) of the NLB cluster must be registered on Internet Domain Name System (DNS) servers. Then configure the NLB software update point in Configuration Manager 2007 with that Internet FQDN.

For more information about how to configure the software update point for an NLB cluster, see How to Configure the Active Software Update Point Component to Use an NLB Cluster.

For more information about how to configure an active software update point for Internet-based client management, see How to Create and Configure an Active Internet-Based Software Update Point.

To configure a software update point for Internet-based client connections

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration.

  2. Right-click Software Update Point Component, and then click Properties.

  3. On the General tab, ensure the following option is selected: Use Network Load Balancing cluster for active software update point. Then click Settings for the Network Load Balancing Settings option.

  4. In the Network Load Balance Settings dialog box, enter the registered Internet fully qualified domain name (FQDN) in the text box FQDN (public).

  5. Click OK, and then click OK again to close the Software Update Point Component Properties dialog box.

See Also

Concepts

Overview of Internet-Based Client Management


How to Configure a Management Point for Internet-Based Client Connections

If the Configuration Manager 2007 management point will support Internet-based clients, you must configure the management point to accept connections from Internet-based clients.

To configure a management point for Internet-based client connections

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server that is configured with the management point role that will manage Internet-based clients.

  3. In the results pane, right-click ConfigMgr management point, and then select Properties.

  4. On the General tab, select one of the following options:

    • Allow Internet-only client connections: With this more secure option, the management point will accept only connections from clients using the Internet FQDN.
    • Allow both intranet and Internet client connections: With this less secure option, the management point will accept connections from clients using the Internet FQDN or the intranet FQDN.
    Note
    If these options are not available and the only option displayed is Allow intranet-only connections, confirm that the site is in native mode and that an Internet fully qualified domain name (FQDN) is specified for this site system server.

  5. Click OK.

    Note
    For more information about the options in this dialog box, see ConfigMgr Management Point Properties: General Tab.

See Also

Tasks

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

Concepts

Determine Server Placement for Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management
Prerequisites for Internet-Based Client Management


How to Configure a Distribution Point for Internet-Based Client Connections

If a Configuration Manager 2007 distribution point will support Internet-based clients, you must configure the distribution point to accept connections from Internet-based clients.

To configure a distribution point for Internet-based client connections

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server that is configured with the distribution point role that will manage Internet-based clients.

  3. In the results pane, right-click ConfigMgr distribution point, and then select Properties.

  4. On the General tab, select the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients), and then select one of the following options:

    • Allow Internet-only client connections: With this more secure option, the distribution point will accept only connections from clients using the Internet FQDN.
    • Allow both intranet and Internet client connections: With this less secure option, the distribution point will accept connections from clients using the Internet FQDN or the intranet FQDN.
    Note
    If these options are not available and the only option displayed is Allow intranet-only connections, confirm that the site is in native mode and that an Internet fully qualified domain name (FQDN) is specified for this site system server.

  5. Click OK.

    Note
    For more information about the options in this dialog box, see ConfigMgr Distribution Point Properties: General Tab.

See Also

Tasks

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS
How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management

Concepts

Determine Server Placement for Internet-Based Client Management
Prerequisites for Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


How to Configure a Fallback Status Point for Internet-Based Client Connections

If a Configuration Manager 2007 fallback status point will support Internet-based clients, verify that it will accept client connections from the Internet and configure throttling for processing state messages from clients.

Note
Unlike the other site systems that support Internet-based client management, you cannot configure the Allowed client connections option because the fallback status point uses unauthenticated client connections. When the site is in native mode and the site system server configured for the fallback status point is configured with an Internet fully qualified domain name (FQDN), the option Allow both intranet and Internet client connections is automatically configured. It is the server placement and client configuration of assigning the fallback status point that determines whether clients on the intranet or the Internet can connect to the fallback status point.

Use the following procedure to verify that the fallback status point can accept connections from the Internet, and configure throttling options.

To configure the fallback status point configuration for Internet-based client connections

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server with the fallback status point role installed.

  3. In the results pane, right-click ConfigMgr fallback status point, and then click Properties.

  4. On the General tab, confirmed that the option Allowed client connections displays Allow both intranet and Internet client connections.

    If the option displays Allow intranet-only connections, confirm that the site is in native mode and that an Internet fully qualified domain name (FQDN) is specified for this site system server. See How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management.

  5. Specify the value for Number of messages and modify this if required.

  6. Specify the value for Throttle interval (in seconds) and modify this if required.

  7. Click OK.

    Note
    For more information about the options in this dialog box, see ConfigMgr Fallback Status Point Properties: General Tab.

See Also

Tasks

How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management
How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

Determine Server Placement for Internet-Based Client Management
Prerequisites for Internet-Based Client Management
Supported Scenarios for Internet-Based Client Management


How to Configure a Software Update Point for Internet-Based Client Connections

If a Configuration Manager 2007 software update point will support Internet-based clients, you must configure the software update point with one of the following options:

  • Configure the active software update point to accept connections from client computers from the intranet and Internet
  • Configure the active software update point to accept connections from clients on the intranet, and configure an active Internet-based software update point to accept connections from clients on the Internet.

Use the following procedure to configure a software update point for Internet-based client connections.

To configure a software update point for Internet-based client connections

  • Follow the steps in the Administrator Checklist: Configuring the Software Update Point in a Native Mode Site.

See Also

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Overview of Internet-Based Client Management


How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

If a distribution point in Configuration Manager 2007 supports Internet-based clients, you must configure the distribution point for Internet-based content with the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients). For other scenarios when this option must be configured, see Decide Whether to Enable BITS on a Distribution Point.

Although this option must be configured when you configure the Internet-based distribution point for client connections, use the following procedure to verify its configuration and correct if necessary.

To configure a distribution point for Internet-based content

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system that is configured for the Internet-based distribution point role, right-click ConfigMgr distribution point, and then select Properties.

  3. On the General tab, in the Communication Settings section, select Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients).

  4. Click OK.

    Note
    For more information about the options in this dialog box, see ConfigMgr Distribution Point Properties: General Tab.

See Also

Tasks

How to Configure a Distribution Point for Internet-Based Client Connections

Concepts

Administrator Workflow: Configuring a Site for Internet-Based Client Management

Other Resources

Configuring Internet-Based Client Management


How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers

The default behavior of site systems in Configuration Manager 2007 is to initiate a connection to the site server in order to send status information to the site. However, you can configure the site server to initiate the connection to site systems that support Internet-based site systems. This configuration might introduce some latency in sending status messages, with a decrease in performance on the site server. You should therefore configure this option if both of these two conditions apply:

  • The Internet-based site systems are located in a perimeter network and the site server is located in the intranet.
  • Your network security policy prohibits Server Message Block (SMB) traffic that is initiated from the perimeter network to the intranet, but it allows SMB traffic that is initiated from the intranet to the perimeter network.
Important
To use this option, you must also specify the Site System Installation Account on the site system server.

To configure the Internet-based site system so that it allows only site server initiated data transfers:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Site Systems.

  2. Expand the site system servers, and then expand the first Internet-based site system server.

  3. Right-click ConfigMgr Site System, and then click Properties.

  4. On the General tab, select Allow only site server initiated data transfers from this site system.

    Important
    When you select this option, you must also have configured a Windows user account to install and configure the site system (the option Use another account for installing this site system on this same tab), even if there is a trust relationship between the site server's domain and the Internet-based site system's domain.

  5. Click OK.

    Note
    For more information about the options in this dialog box, see Site System Properties: General Tab.

See Also

Concepts

Determine Server Placement for Internet-Based Client Management
Administrator Workflow: Configuring a Site for Internet-Based Client Management
Site System Roles that Support Internet-Based Client Management
Configuration Manager in Multiple Active Directory Forests

Other Resources

Configuring Internet-Based Client Management


How to Configure SQL Server Site Database Replication

Configuration Manager 2007 SQL Server site database replication can be configured to use transactional replication to allow management point and server locator point site systems to access site database information from a SQL Server replica of the site database.

Note
Configuration Manager does not support an automated method to replicate the site database.

The basic steps to configure SQL Server site database replication are:

  1. Plan for SQL Server site database replication.
  2. Perform pre-replication tasks to prepare SQL Server computers for site database replication.
  3. Configure the SQL Server hosting the site database to publish the site database for replication.
  4. Configure a subscription to the publication on a remote SQL Server that site systems configured to use a SQL Server site database replica will access.
  5. Perform post-SQL Server replication configuration tasks.

The procedures in this section can be used to enable or disable transactional SQL Server replication for the Configuration Manager 2007 site database.

In This Section

Planning for SQL Server Site Database Replication

Describes planning considerations for implementing SQL Server site database replication.

How to Perform Required Pre-Replication Setup Tasks

Describes the pre-replication configuration tasks required to enable SQL Server site database replication.

How to Configure the SQL Server Publisher Computer

The publication step allows you to select the data and database objects you want to replicate and filter the published data so that subscribers receive only the data that is needed.

How to Configure the SQL Server Subscriber Computer

The subscription step allows you to subscribe to the site database information needed to support site systems configured to access SQL Server replica of the site database.

How to Perform Required Post-Replication Setup Tasks

Describes the post-replication configuration tasks required to enable site systems to access SQL Server site database replica information.

How to Configure Site Systems to Access a SQL Server Site Database Replica

Describes the procedures used to configure the management point and server locator point site systems to access a SQL Server site database replica from within the Configuration Manager console.

How to Disable SQL Server Database Replication

Describes the procedure to disable SQL Server site database replication.

See Also

Concepts

Configuration Manager Tasks for Configuring a Single Site


Administrator Workflow: Configuring a Site for Internet-Based Client Management

This administrator workflow displays the recommended steps to configure a Configuration Manager 2007 site for Internet-based client management.

For information about each step of the workflow, see the following topic: Administrator Checklist: Configuring a Site for Internet-Based Client Management.

Internet-based client management workflow

See Also

Concepts

Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients


Administrator Checklist: Configuring a Site for Internet-Based Client Management

The following checklist provides the steps required to configure a Configuration Manager 2007 site for Internet-based client management and can be used in conjunction with the following administrator workflow: Administrator Workflow: Configuring a Site for Internet-Based Client Management.

Step | Reference
Confirm the decision to configure the site for Internet-based client management. | Determine If You Should Use Internet-Based Client Management Prerequisites for Internet-Based Client Management
Decide on server placement. | Determine Server Placement for Internet-Based Client Management
Make any necessary changes to your network infrastructure, such as firewall and proxy server configuration. | Supported Scenarios for Internet-Based Client Management Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management Determine the Ports Required for Internet-Based Client Management
Register on Internet Domain Name System (DNS) servers the Internet fully qualified domain name (FQDN) of the site systems and network load-balanced clusters that will support Internet-based client management. | Site System Roles that Support Internet-Based Client Management Configuring DNS for Configuration Manager Site System Roles
Install the site systems in Configuration Manager 2007, and configure them with the Internet FQDN. | How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management
If you are using a network load balancing (NLB) cluster, specify the Internet FQDN for the NLB cluster in Configuration Manager 2007. | How to Configure the Internet FQDN of an Internet-based NLB Management Point How to Configure the Internet FQDN of an Internet-Based NLB Software Update Point
If the Internet-based site systems are in a different forest than your site server, configure these site systems to accept data retrieval from the site server. | How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers
Configure the Internet-based software update point to synchronize with an intranet software update point, or initiate a manual procedure for importing software update definitions. | How to Synchronize Software Updates How to Manually Download Software Updates
Configure the site systems that will support Internet-based client management to accept connections from Internet clients. | How to Configure a Management Point for Internet-Based Client Connections How to Configure a Distribution Point for Internet-Based Client Connections How to Configure a Fallback Status Point for Internet-Based Client Connections How to Configure a Software Update Point for Internet-Based Client Connections
Configure distribution points to transfer content using BITS, HTTP, and HTTPS. | How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS
If the Internet-based site systems are in a different forest than your site server, and you want the additional security of the SQL Server connection to be initiated from the intranet rather than from the perimeter network, configure a Microsoft SQL Server replica. | How to Configure SQL Server Site Database Replication

Next Steps

Use the following administrator checklists to configure client computers and mobile device clients to be managed by the Internet-based site:

  • Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
  • Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management

See Also

Concepts

Administrator Workflow: Configuring a Site for Internet-Based Client Management
Overview of Internet-Based Client Management


Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

The following checklist provides the configuration requirements to install Configuration Manager 2007 client computers when they are assigned to a site that supports Internet-based client management.

Before using this checklist, ensure that the site is configured for Internet-based client management. For more information, see Administrator Checklist: Configuring a Site for Internet-Based Client Management.

For tasks related to managing Internet-based clients, see Tasks for Configuration Manager Internet-Based Client Management.

Step More Information

Identify the server placement of site systems that support Internet-based client management.

Site System Roles that Support Internet-Based Client Management

Supported Scenarios for Internet-Based Client Management

If you have Internet client computers that will never connect to your intranet, install Configuration Manager clients using CCMSetup with command-line options for the following configuration:

  • Native mode.
  • Internet-only client management.
  • Assign them to the Internet site.
  • Specify the FQDN of the Internet management point.
  • If you are using a fallback status point, specify the Internet-based fallback status point.

If they need to connect to the Internet using a proxy server, the proxy server settings must be specified after installation.

How to Configure Configuration Manager Client Computers for Internet-Only Management

About Configuration Manager Client Installation Properties

How to Configure Configuration Manager Client Computers to Access Their Internet-Based Management Point with a Proxy Server

If you have Internet client computers that will sometimes be on the Internet and sometimes on the intranet, install Configuration Manager clients with the following configuration:

  • Native mode.
  • Assign them to the Internet site.
  • Specify the FQDN of the Internet-based management point.
  • If they will need to connect to the Internet using a proxy server, specify the proxy server details.
  • If you are using a fallback status point, specify the Internet-based fallback status point.

How to Configure Configuration Manager Client Computers for Internet or Intranet Management

How to Configure Configuration Manager Client Computers to Access Their Internet-Based Management Point with a Proxy Server

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point

How to Assign the Fallback Status Point to Configuration Manager Client Computers

If you have Configuration Manager client computers that will never connect to the Internet, install them with the following configuration:

  • Native mode.
  • Assign them to the Internet site.
  • If you are using a fallback status point, specify the fallback status point on the intranet.

How to Assign the Fallback Status Point to Configuration Manager Client Computers

See Also

Concepts

Administrator Checklist: Configuring a Site for Internet-Based Client Management
Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management
Overview of Internet-Based Client Management

Other Resources

Planning and Deploying Clients for Configuration Manager 2007
Tasks for Configuration Manager Internet-Based Client Management


Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management

The following checklist provides the configuration requirements to install Microsoft System Center Configuration Manager 2007 client mobile devices when they are assigned to a site that supports Internet-based client management.

Before using this checklist, ensure that the site is configured for Internet-based client management. For more information, see Administrator Checklist: Configuring a Site for Internet-Based Client Management.

Step Reference

Identify the server placement of site systems that support Internet-based client management.

Site System Roles that Support Internet-Based Client Management

Supported Scenarios for Internet-Based Client Management

If you have Configuration Manager mobile device clients that will never connect to your intranet, the following configurations are required. The following values are configured in either ClientSettings.ini or DMCommonInstaller.ini:

  • Specify the FQDN of the Internet-based device management point for the DMServerName value.
  • Specify the FQDN of the Internet-based device management point for the FSPServerName value.
  • Specify SecurityMode=NativeMode.
  • Specify InternetConnected=True.
  • Specify the FQDN in the Subject Name or Subject Alternative Name for the Internet-based device management point's certificate in the CertSubjectName value.
    Note
    Mobile devices must connect to the intranet once to enroll a personal certificate if the certification authority issuing personal certificates is not Internet-based.

How to Edit the Mobile Device Client Configuration .ini File

Deploying Certificates to Mobile Device Clients

If you have Configuration Manager mobile devices that will never connect to the Internet-based device management point, install them with the following configuration:

  • Native mode.
  • Assign them to the intranet site.
  • Specify the FQDN or NetBIOS Name of the intranet management point for the DMServerName value.
  • Specify the FQDN of the FSPServerName value.
  • InternetConnected=False.

Specify the FQDN or NetBIOS Name in the Subject Name or Subject Alternative Name for the Intranet-based device management point's SSL certificate in the CertSubjectName value. You can specify different device management point server names in the subject name and subject alternate name fields if you need to specify both a FQDN and a NetBIOS name.

How to Edit the Mobile Device Client Configuration .ini File

Deploying Certificates to Mobile Device Clients

See Also

Concepts

Overview of Internet-Based Client Management
Administrator Checklist: Configuring a Site for Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
Administrator Workflow: Configuring a Site for Internet-Based Client Management
Overview of Internet-Based Client Management


Deploying Configuration Manager Sites in International and Multi-Language Environments

This section provides instructions for planning and deploying Configuration Manager 2007 in mixed language, international organizations. It is targeted at Configuration Manager 2007 architects and administrators who are interested in using Configuration Manager 2007 in a mixed language organization. If you use only the English version of the product, you do not need to read this section. This section does not duplicate the content provided in the sections about planning and deploying single and multiple sites.

Review any documentation provided with your operating system version concerning multilingual issues.

In This Section

Planning and Deploying Your Multilingual Site Hierarchy

Tasks for International and Multi-Language Configuration Manager Clients

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment
Configuration Manager Multiple Site Planning and Deployment
Planning and Deploying Clients for Configuration Manager 2007


Planning and Deploying Your Multilingual Site Hierarchy

Configuration Manager 2007 provides a broad range of supported languages and other capabilities that enable you to centrally manage a multilingual Configuration Manager 2007 site hierarchy. For example, Configuration Manager 2007 supports:

  • Multiple language versions of the Configuration Manager 2007 console.
  • Multiple language versions of the Configuration Manager 2007 client.
  • Double-byte and single-byte character sets for both servers and clients.

The following sections describe how you can use each of these features to plan for and centrally manage a multilingual hierarchy.

This section provides current language support information for each of the seven Configuration Manager 2007 server languages and lists the client languages supported by each of these packages. You must adequately plan for the language requirements of each site including site server and clients. Each localized site server supports only certain localized clients. After you have fully planned how to address your hierarchies' language needs, you plan, deploy, and configure your sites as recommended in the planning and deployment sections of this guide.

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Planning Multilingual Sites

Many organizations that operate internationally or across linguistic barriers must support multiple languages on their site systems and clients. To address this need, Configuration Manager 2007 provides several features to help you centrally manage your international Configuration Manager 2007 site hierarchy and facilitate the flow of information within sites.

Multiple character set support

For example, Configuration Manager 2007 supports both double-byte character sets (DBCS) and single-byte character sets (SBCS) so that you can display and manage both Asian-language and European-language site servers and clients from within the same Configuration Manager 2007 site hierarchy. DBCS character sets include East Asia languages such as Japanese, Traditional Chinese, Simplified Chinese and Korean. Configuration Manager 2007 offers seven server user interfaces, four of which are fully localized - that is, fully translated into the target language - and client user interfaces in 22 languages. With Configuration Manager 2007, you can centrally manage the desktop computers in your international organization, facilitating the flow of information within organizational units.

Localized interface

A localized interface is one that has been adapted to a specific international market or locale. Configuration Manager 2007 is considered fully localized with respect to the target language when all Configuration Manager 2007 user interfaces, dialog boxes, and messages to the user are translated into the supported language. Configuration Manager 2007 supports the display of the language using the correct character set, fonts, and regional options for a target language.

Enabled interface

An enabled interface is one enabled to display and process DBCS/extended characters. A Configuration Manager 2007 console displays data from a localized client, but the interface is not translated to the target language. For example, the Korean-language version of Configuration Manager 2007 is enabled to display and process Korean characters, such as the name of a discovered logon user name. But because it is not localized, the Configuration Manager 2007 console is in English, not Korean. The administrator must navigate the menu and dialog text in English. The English-language Configuration Manager 2007 site server and client versions run on, and are supported by, any localized operating system. The localized versions of Configuration Manager 2007 site servers and clients are supported only by their matching localized operating systems.

See Also

Concepts

Supported Localized Languages
Native Mode Certificates and Double-Byte Character Sets
Site Hierarchy Languages
Site Server Languages
Client Languages
Multilingual Features
Local Language Display Configuration
SQL Server Configuration


Supported Localized Languages

Topic last updated—November 2007

The following table lists the languages that Microsoft System Center Configuration Manager 2007 site servers support. The first column lists the languages into which Configuration Manager 2007 servers are localized or enabled. The second column lists the corresponding client languages supported by each of the server language packages. Any site server language version listed in the table can be the child site or the parent site of any other listed localized server. Except for the French server, all localized servers support U.S. English clients.

Site server language | Supported client language
English | English and all languages available with supported client operating systems
French | French
German | German, English
Japanese | Japanese, English
Korean | Korean, English
Simplified Chinese | Simplified Chinese, English
Traditional Chinese | Traditional Chinese, English

The English-language server is available in both English and International English. The contents of the Configuration Manager 2007 product CD for these two versions are identical and can be used interchangeably; however, their license agreements are different.

Note
The Configuration Manager 2007 consoles for Traditional Chinese and Korean are displayed in the English language, but they are enabled for the specific server languages, so the DBCS output displays correctly in that language. The Configuration Manager 2007 client is fully localized to the local language. For example, menus are displayed in English but data such as package names and inventory data are viewed in the DBCS character set.

In addition to English, Configuration Manager 2007 clients are available in 21 language versions.

Czech | Norwegian
Danish | Polish
Dutch | Portuguese
Finnish | Portuguese-Brazilian
French | Russian
German | Simplified Chinese
Greek | Spanish
Hungarian | Swedish
Italian | Traditional Chinese
Japanese | Turkish
Korean |

Character Sets

The DBCS support provided by Configuration Manager 2007 allows communication to take place between SBCS and DBCS site servers. This functionality is important because it enables you to use a single Configuration Manager 2007 site hierarchy to centrally manage your SBCS and DBCS sites. For example, you can centrally manage an English-language central site and a Japanese-language child site.

If any sites in your Configuration Manager 2007 hierarchy will use DBCS, the following requirements must be met:

  • Configuration Manager 2007 server computer names, Microsoft SQL Server database names, domain names, Active Directory site names, Configuration Manager 2007 site codes, user group names, report names, and Configuration Manager 2007 accounts that install or manage the Configuration Manager 2007 site hierarchy cannot contain DBCS characters. Only U.S. English is supported for object names, including those listed, in any Configuration Manager 2007 hierarchy. Plan to name all network resources with SBCS.
  • Hardware inventory class and value names in IDMIF and NOIDMIF files must not contain DBCS. However, values can contain DBCS.
  • Configuration Manager 2007 hardware inventory requires a backslash character (\) to follow every 5c character in an MIF file.
  • Software inventory file collection works correctly if 5c characters are in a file name. However, software inventory cannot collect files that contain 5c characters in the file name extension.
  • DBCS characters are not supported for package or file names.

In addition to providing support for both DBCS and SBCS servers, Configuration Manager 2007 is available in several language packages that provide different combinations of default server and client component language support. For example, the German-language package of Configuration Manager 2007 provides a German-language server user interface that supports German-language and English-language clients, while the French-language package of Configuration Manager 2007 provides a French-language server user interface that supports French-language clients.

Localized versions of Configuration Manager 2007 site servers are installed only on corresponding localized operating systems. For example, the Japanese language Configuration Manager 2007 site server version is installed on a Japanese operating system only.

See Also

Concepts

Planning Multilingual Sites


Native Mode Certificates and Double-Byte Character Sets

If your Configuration Manager 2007 hierarchy contains computers that are configured with computer names that use double-byte character sets (DBCS) and your sites will be configured for native mode, you might need to take additional configuration steps before these computers can operate in native mode.

Public key infrastructure standards do not currently allow for double-byte character sets, which affects the following computers in a native mode Configuration Manager 2007 site:

  • Management points
  • Standard distribution points that are not configured as server shares
  • Software update points
  • State migration points
  • Client workstations

The four site systems use Secure Sockets Layer (SSL) and therefore must be configured with a certificate that contains the server name in the subject name or the subject alternative name. This server name must match the server name configured in Configuration Manager 2007. If these site systems in Configuration Manager 2007 are configured with computer names that contain double-byte characters, rename them so that they have computer names using only single-byte characters.

Client certificates for native mode require a unique value in the certificate subject name or the certificate subject alternative name. This unique value does not have to contain the computer name, although this is usual practice and the default value if you are deploying client certificates with a Microsoft Enterprise certification authority, using templates and autoenrollment with Group Policy.

When you have clients that are configured with computer names that consist of double-byte characters, ensure that client certificates do not use double-byte characters for their unique value. If you are using a Microsoft public key infrastructure (PKI) Enterprise certification authority, some possible solutions are as follows:

  • Rename the computer using a single-byte character set.
  • Use an alternative option for the automatically generated certificate subject alternative name with a version 2 template if this generates a string using all single-byte characters. Some alternative options include the universal principle name (UPN) or e-mail name.
  • Do not use autoenrollment with templates; instead, use another process, such as submitting a string of single-byte characters when requesting a certificate with the use of templates or the CertReq utility.

If you are using a non-Microsoft PKI solution, consult your PKI documentation for solutions on how to generate client certificates that do not use double-byte character sets.

See Also

Concepts

Certificate Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Site Hierarchy Languages

To determine which languages are required at which sites or locations in your organization, you must gather information about:

  • Corporate standards for the operating system language version that Configuration Manager 2007 is installed on.
  • Operating system language versions of the clients in each site.
  • The language skills of operations personnel at each site location.
  • The language skills of end users and associated organizational standards for application localization at each site location.

In each of the Configuration Manager 2007 sites in your organization, determine which Configuration Manager 2007 language versions are within your organizational standards. Next, determine what operating system language versions are required by client computers.

  • Are there other client operating system language restrictions?
  • Who creates and distributes packages?
  • Who manages site settings?
  • Do your operations personnel require a particular Configuration Manager 2007 site server language version?
  • In some situations, you must request exceptions to any corporate standards if the configuration of Configuration Manager 2007 server and client languages requires language versions outside your corporate standards.

While planning your Configuration Manager 2007 site hierarchy, plan to name all network resources by using standard ASCII characters, including codes 0 through 127. This includes all computer names, share names, user names, user group names, domain names, and site codes.

After you have fully planned your multilingual Configuration Manager 2007 site hierarchy and established your sites, administrators and users can effectively useConfiguration Manager 2007 . For example, when an Configuration Manager 2007 central site administrator in Vancouver uses an English-language version of the Configuration Manager 2007 console to send an advertisement to an Configuration Manager 2007 client in Amsterdam, the Dutch-speaking user reads Configuration Manager 2007 dialog boxes in her own language because the International Client Pack (ICP) was applied and it provides the localized client software. The administrator of the site sees the Dutch-language computer name and other client data using the correct Dutch-language character display.

Default Collection Names

Any collection, package, or advertisement that is passed down a hierarchy assumes the name it is assigned at the site where it is created, and appears with that same name throughout the hierarchy. The default collections are a special case of this.

As each site is created, the default collections are created at that site, and the name of the collection reflects the language of the site. When the site attaches to a parent site, the collection definitions for the default collections are overwritten with the definitions used at the parent site. If the child and parent use different languages, the collection names are displayed in the language of the parent site. This extends all the way up the hierarchy: default collections are assigned the name used at the central site. The implications of this depend on the code pages used by the affected sites. A code page is a definition of the bit patterns that represent specific letters, numbers, or symbols for character or Unicode data. For additional information about code pages, see the "SQL Server Code Pages" section later in this chapter.

  • If the two sites are using the same code page, the Configuration Manager 2007 console at the child site displays the collection name correctly, but it is in the language of the central site.
  • If the two sites are using different code pages, the Configuration Manager 2007 console at the child site cannot display the collection name correctly. The names of the default collections are unreadable.

If the two sites use the same code page, administrators at the child site must learn to recognize the names of the default collections when they are in the language of the central site.

If the two sites use different code pages, at the central site, you can rename the default collections using only ASCII characters. The collection names are then displayed correctly at all sites. In addition, assign ASCII-only names to all collections, packages, and advertisements at any site that is or might later become a parent to a site using a different code page.

An alternative method is to maintain an Configuration Manager 2007 console at the child site on a computer that uses the language of the central site.

See Also

Concepts

Planning Multilingual Sites


Site Server Languages

You must plan for language requirements of your site server and its clients concurrently. The language you choose for your Configuration Manager 2007 site server determines which client localizations it can support. If your organization's policies or operating systems require that the Configuration Manager 2007 site server and all clients in that site support one language, you can install any non-U.S. English version of Configuration Manager 2007 that meets your needs. Unlike other localized versions of the Configuration Manager 2007 server software, the French version only supports its same-language client. All other translated versions of Configuration Manager 2007 support U.S. English clients. Configuration Manager 2007 site servers of different installed languages can be placed together in any combination in a hierarchy. If you have a requirement to support multiple client languages within a specific site, then you must install the U.S. English version of the site server and the ICP.

When planning for the support of multiple languages in your Configuration Manager 2007 site hierarchy, consider the following:

  • Which languages are required for clients and servers at which locations in your company.
  • When you plan to deploy these languages, keep in mind that some local-language versions of Configuration Manager 2007 are not released until after the initial U.S. English version is released.
  • Which Configuration Manager 2007 features you need. Balance your requirements against specific language support limitations.
  • Whether you will use computer hardware dedicated to Configuration Manager 2007 site systems or site roles. If you dedicate computer hardware for Configuration Manager 2007 functions, then you have some flexibility to choose your Configuration Manager 2007 language version. If you choose not to dedicate computer hardware to Configuration Manager 2007 site systems or site roles, then you are limited by the language of the operating system of the existing computers.
  • Whether the Configuration Manager 2007 site server is required to run a specific localized operating system.
  • Whether you are installing an ICP to support numerous client languages. If you are required to install an ICP at a given site, then you must install the Configuration Manager 2007 U.S. English version at the site.
    Important
    The SMS Provider must be installed on a computer with the same operating system language as the site server's operating system language when a site contains site servers or clients with different language operating systems installed.

  • Whether you are able to maintain multiple versions of each language version ofConfiguration Manager 2007 . Each language version must have its own service pack and hotfix version. For additional information about Configuration Manager 2007 versions, see the "Applying updates" section later in this chapter.
  • Whether the language skills of the operations staff at each level of the hierarchy are aligned with the requirements of Configuration Manager 2007 features, such as software distribution, site management, and help desk. Where are packages and advertisements created? In what language? Is the operations staff at lower levels of the hierarchy able to read the names of objects that flow down?

Multilingual Site Hierarchy Example

As an example of a multilingual Configuration Manager 2007 site hierarchy, consider a company whose headquarters is located in Vancouver, Canada, with branch offices in Tokyo, Seoul, Berlin, and Madrid. The branch offices are all child sites of the parent headquarters site.

The Configuration Manager 2007 site administrators configure the central, primary site system in Vancouver to use an English-language site server running an English-language Configuration Manager 2007 console. In addition, two Configuration Manager 2007 consoles are installed on remote workstations running Japanese and Korean operating systems. At the central site in Vancouver, the Configuration Manager 2007 administrators can view the information of each of the child sites in the native languages and character sets of each of the child sites. The Vancouver site also supports English-language and French-language clients. The ICP is installed at the Vancouver site because the French version of Configuration Manager 2007 does not support U.S. English clients. All client computers in the site have localized operating systems and users want localized Configuration Manager 2007 client software, so the ICP is installed to support various client languages.

At the Tokyo site, the Configuration Manager 2007 administrators install the Japanese version of Configuration Manager 2007 on a Japanese operating system so they can view data from the Japanese-language clients.

The Seoul site server computer hardware runs a U.S. English operating system. The end users are fluent in U.S. English. Although the client operating systems are Korean, the site administrator decides not to install the Korean version ofConfiguration Manager 2007. The end users use U.S. English clients. The site administrator has access to a Korean version of the Configuration Manager 2007 console installed on a Korean operating system that is occasionally used to view localized Korean data.

The Berlin site runs a German-language site server that runs on a German operating system. The site has U.S. English, German, and Traditional Chinese operating system clients. An ICP cannot be installed on the site server because it is not U.S. English. Only German client computers have a localized Configuration Manager 2007 client. The U.S. English and Traditional Chinese operating system clients use a U.S. English Configuration Manager 2007 client.

The Madrid site runs an English-language site server that supports a mix of Spanish-language, Italian-language, Turkish-language, and English-language clients. To obtain the required client language support, Configuration Manager 2007 administrators install ICPs on the Vancouver and Madrid sites only.

Note
In the case of Korean and Traditional Chinese, to view the data correctly, the administrators in the example scenario should install a language-specific operating system, create a site, and then install a language-specific remote Configuration Manager 2007 console. The administrators can then view the data of these DBCS languages correctly by using a remote Configuration Manager 2007 console to attach to a site server where the data resides. The Japanese site was installed with a localized version of Configuration Manager 2007 and Japanese operating system, so no remote Configuration Manager 2007 console is necessary.

The Configuration Manager 2007 site administrators of the example company choose this configuration to take advantage of the international features of Configuration Manager 2007. Because Configuration Manager 2007 supports DBCS languages, it supports Japanese (a double-byte character set language) child sites reporting to the English (a single-byte character set language) central site. Configuration Manager 2007 also supports any DBCS language sites reporting to other DBCS language sites. The European branch has Configuration Manager 2007 clients enabled with several central, western, and eastern European languages that are deployed by installing ICP2.

For the site administrators, the advantage of this configuration is to have broad administrative coverage of the information systems in an organization. This capability makes it possible for administrators to store all of their Configuration Manager 2007 information for the organization in one location and to view the data in the native language from each site, from any location, through remote Configuration Manager 2007 consoles. Because the site administrators can use any mix of the supported server languages, they have considerable flexibility in designing their Configuration Manager 2007 site hierarchy to suit the needs of their organization. The English-language site server supports all Configuration Manager 2007 client languages.

See Also

Concepts

Planning Multilingual Sites


Client Languages

Configuration Manager 2007 attempts to match the language of the Configuration Manager 2007 client (dialog boxes, messages to the user, and text displayed in any Configuration Manager 2007 user component) to one of the site server languages supported by Configuration Manager 2007. The client operating system can support many language dialects, Australian English for example. If Configuration Manager 2007 cannot match the client's current language settings directly to a supported language, Configuration Manager 2007 either renders the client interface as closely as possible in a supported version of the language, or installs client software components in U.S. English, unless the client is French. French Configuration Manager 2007 site servers support French clients only.

Localization to local-language character, time, and value display takes place at both the operating system level and within Configuration Manager 2007. At the operating system level, you can change the regional and language options to specify how the system displays characters and formats numbers, currency, and time and date values in accord with language-specific requirements. Users can set the character mapping of the keyboard to various languages.

See Also

Concepts

Planning Multilingual Sites


International Client Pack

Topic last updated—November 2007

International Client Packs (ICPs) are installed on U.S. English sites only and contain the localized client language files required to install local language Microsoft System Center Configuration Manager 2007 clients. Localized Configuration Manager 2007 client software is installed only on computers running a corresponding localized operating system.

Client Languages

The client languages contained within each ICP are listed in the following table.

International Client Pack | Languages
ICP1 | English, French, German, Japanese, and Spanish
ICP2 | All the ICP1 languages, plus Czech, Danish, Dutch, Finnish, Greek, Hungarian, Italian, Korean, Norwegian, Polish, Portuguese, Portuguese-Brazilian, Russian, Simplified Chinese, Swedish, Traditional Chinese, and Turkish

The Configuration Manager 2007 ICPs are cumulative. Any client language that exists in a previous ICP will also exist in all subsequent releases. For example, ICP2 includes all client languages that existed in ICP1.

All client languages contained in an ICP are installed at the same time on the site server. You cannot install the client languages individually. For example, if you want to install an Italian Configuration Manager 2007 client, you must use ICP2, which contains all the languages of ICP1 and ICP2.

You cannot uninstall ICPs. If you decide you want to return your system to its non-localized version, you must reinstall your English site server or restore your backup.

Although it is possible to run International Client Pack (ICP) Setup on non-English language secondary site servers, this type of installation is not supported. ICP setup is only supported on English site servers on English operating systems.

Site configurations that mix the release levels of the English language site server and an installed ICP are not supported. Previously released ICPs are not compatible with later versions of the Configuration Manager 2007 site server software. After you upgrade the site server, immediately install the matching version of the ICP you are using or that of a higher-numbered ICP. Do not upgrade a site server that supports localized clients until you are ready to install the matching version of the ICP you are using or that of a higher-numbered ICP. For example, if you have a site server that is using SMS 2003 SP2 ICP1 and you upgrade that site server to Configuration Manager 2007, you must immediately install Configuration Manager 2007 with an ICP level equal to or greater than ICP1.

Client Multilingual User Interfaces

If your Configuration Manager 2007 sites have an ICP applied and your client computers run Windows 2000, Windows XP Professional, Windows Server 2003, or Windows Vista operating systems, Configuration Manager 2007 offers support for Multilingual User Interface Packs (MUIs).

The client included with each ICP consists of a single client installer file, Client.msi. The Client.msi file includes all language resources necessary for clients to switch between supported languages. The default installation language is English. To display a client localized installation language, you must install the client with the TRANSFORMS command-line option. As an example, you can use the following command from the Japanese language folder:

msiexec.exe /i client.msi TRANSFORMS=client.mst

Requirements: Configuration Manager 2007 client users or administrators do not need to create a registry key to use an MUI. After the client is installed, the user can switch from one language to another, within the supported languages, without reinstalling the Configuration Manager 2007 client software. However, the user must log off the client computer and log on again each time the user changes the display language.

Sample Client User Interfaces

Configuration Manager 2007 provides your organization great flexibility when planning your site's client composition, considering the large number of different localized clients possible that can report to a single U.S. English site. The following example shows what users on Configuration Manager clients with ICPs see when viewing the Program Download Monitor. The example is Japanese.

Sample Client User Interface Japan

See Also

Concepts

Planning Multilingual Sites


Multilingual Features

Configuration Manager 2007 provides international support for all Configuration Manager 2007 features. However, there are certain issues that you must consider when using Configuration Manager Installer and software metering. Planning for the language requirements of your organization might influence the extent to which these features are used.

Configuration Manager Installer

You can use Configuration Manager Installer to create installation scripts for single and multiple local languages. A local language installation script is a standard Configuration Manager 2007 installation script that has its entire user interface text, dialog boxes and messages to the user, replaced with the local language equivalents. The following table lists the languages that Configuration Manager Installer supports and the corresponding local language installation scripts that it supports. For example, the English-language version of Configuration Manager Installer has an English-language user interface, but supports the creation of installation scripts that contain German-language dialog boxes and installation messages. In addition, you can write a multiple language installation script by using the English version of Configuration Manager Installer. Such a script might contain installation messages and dialog boxes in English, German, and French.

Configuration Manager Installer user interface language | Supported installation script languages
English | Danish, Dutch, English, Finnish, French, German, Italian, Norwegian, Portuguese-Brazilian, Spanish, Swedish installation messages and dialog boxes
French | French installation messages and dialog boxes
German | German and English installation messages and dialog boxes
Korean- enabled (English user interface) | Korean and English installation messages and dialog boxes
Japanese | Japanese and English installation messages and dialog boxes
Simplified Chinese | Simplified Chinese and English installation messages and dialog boxes
Traditional Chinese- enabled (English user interface) | Traditional Chinese and English installation messages and dialog boxes

Software Metering

Most executable programs contain header information that includes the product version, product name, and language of the program. Configuration Manager 2007 software metering tracks usage of local-language versions of executable programs by verifying the language field in the version stamp of the executable program file. Verification of the language field is automatically performed by software metering when new software metering rules are created. When you add a software program for monitoring and you change the language field from the default value detected by Configuration Manager 2007, you might set the language field incorrectly. If the language field is set incorrectly, the correct language version of the program is not collected. To avoid this problem, verify that the software programs you are metering contain the correct language field entry in accord with your licensing agreements. For information about creating software metering rules, see Software Metering in Configuration Manager. The language version of each monitored program is displayed in the Software Metering Rules Properties page in the Configuration Manager console.

See Also

Concepts

Planning Multilingual Sites


Local Language Display Configuration

Although the English version of the Configuration Manager 2007 server software supports a wide variety of client languages, you must perform the following configuration tasks to display non-ASCII characters generated by the clients in the Configuration Manager console.

Locale Setting Must Match the Language of Data

The locale setting of the computer running the Configuration Manager console must match the language of the data you want to view or enter. For example, if you want to view Russian-language hardware inventory data or distribute a software package with a Russian name, the Configuration Manager console you use must run on an operating system on which the locale is set to Russia.

To set the locale

  1. In Control Panel, double-click Regional Settings.

  2. Click the Regional Settings tab, and then select the appropriate locale.

To view data collected from or directed to clients that are using a specific language, you must run the appropriate language version of the Configuration Manager console on a computer set to the corresponding locale.

For each client language other than Japanese, Korean, Simplified Chinese, or Traditional Chinese, inventory data is viewed from a Configuration Manager console by changing the locale setting on a computer running a U.S. English operating system.

Maintain a Computer Running a Localized Operating System

To view data in Japanese, Korean, Simplified Chinese, or Traditional Chinese, you must maintain a computer running that language. On that computer, install the appropriate localized version of the Configuration Manager console. For example, because the English-language server does not support display of DBCS characters, an administrator in Vancouver who wants to view data from Tokyo must set up a Japanese-localized computer running the Japanese version of the Configuration Manager console to view the data in the Japanese language.

Install Additional Languages on the Computer Where the SMS Provider Is Installed

In addition, you might need to install additional languages to the computer where the SMS Provider is installed. The SMS Provider resides on either the site server or on the computer where the Configuration Manager 2007 site database is installed. The Configuration Manager console accesses the SMS Provider to view data in these languages.

To install additional languages on Windows 2000 Server or Windows Server 2003, choose the desired language in Regional and Language Options in Control Panel.

Reports Must Be Configured to Open in a New Window

The Microsoft Management Console (MMC) cannot be set to change the code page used when displaying report data in the Configuration Manager 2007 console. To display reports properly in the required language, always set configure reports to open in a new window instead of displaying in the Configuration Manager 2007 console. For more information, see How to Change Options for Running Reports in the Console.

See Also

Concepts

Planning Multilingual Sites


SQL Server Configuration

The primary site server and the Microsoft System Center Configuration Manager 2007 site database can reside on different computers on your network configured with different languages, provided they use the same code page. If your primary site server has DBCS child sites or clients, remember that SQL Server 2005 or later supports both single-byte and double-byte character sets. All characters from the 22 potential client languages (including the ENU client) can be stored in the Configuration Manager 2007 site database.

Language Versions

You can use the English-language version of SQL Server 2005 or later with the default 1252 code page with any Configuration Manager 2007 site server language version or you can pair local-language versions of SQL Server with a matching localized version of Configuration Manager 2007. For example, a Configuration Manager 2007 administrator in Bonn can use a German-language Configuration Manager 2007 site server with either a German-language or an English-language version of SQL Server.

Mixed-Language Data

If your database contains mixed-language data, you are limited to a single sort order. You select the sort order during SQL Server setup. For more information, see your SQL Server product documentation.

SQL Server Code Pages

All sites within a single-language hierarchy must use the same SQL Server code page. This is because default collections are unreadable at child sites if the child sites use different code pages than their parent site.

All sites within a multilingual hierarchy must use either ANSI 1252 or ISO 8859-1 code page because all Configuration Manager 2007 server and ICP languages can use each.


Deploying Multilingual Sites

Multilingual sites are installed and upgraded in the same manner as U.S. English sites. The only significant difference between installing the two types of sites is that additional planning is required when you consider creating a mixed-language hierarchy.

U.S. English sites with ICPs applied differ somewhat from localized sites because the number of possible client languages are increased. With ICP2, a single U.S. English site server can support 22 localized client languages. For additional information about planning and installing ICPs, see Tasks for International and Multi-Language Configuration Manager Clients.

See Also

Concepts

Sample Deployment Scenarios


Sample Deployment Scenarios

The following sample scenarios represent common Microsoft System Center Configuration Manager 2007 configurations in multilingual environments.

  • U.S. English operating systems without ICPs
    In this scenario, an international corporation has all its Configuration Manager 2007 site servers in numerous countries/regions in U.S. English. All Configuration Manager 2007 clients run on localized operating system languages. However, Configuration Manager 2007 ICPs are not applied. All users view the U.S. English Configuration Manager 2007 client. This decision was made to keep all Configuration Manager 2007 sites at the exact same version, to help minimize administrative operating costs, to have fewer versions and deployments, and to minimize managing localized Configuration Manager 2007 updates. This is because Configuration Manager 2007 updates must be requested for each Configuration Manager 2007 localized version. This example company provides translated screenshots of the U.S. English client, when necessary.
  • U.S. English operating systems with ICPs
    In this scenario, an international corporation has all its Configuration Manager 2007 site servers in numerous countries/regions in U.S. English. All Configuration Manager 2007 clients are installed on computers running localized operating systems. ICPs provide Configuration Manager 2007 clients with a localized interface.
  • Existing site servers in an existing mixed-language operating system infrastructure
    In this scenario, each server operating system and SQL Server code page that it uses presents planning challenges. The servers that are in use now will be used as Configuration Manager 2007 site servers. The servers might not run localized operating systems. For example, you might find that the server you have been given for use in Kyoto, Japan runs a U.S. English operating system. Your server in Beijing runs a Simplified Chinese operating system. In this example, you will install the U.S. English Configuration Manager 2007 server in Kyoto. The server in Beijing will continue to run Simplified Chinese. In this scenario, the SQL Servers involved must use the 1252 code page.
  • New servers in a mixed operating system language infrastructure
    In this scenario, you must determine who will administer your computers, and what your corporate policy is regarding operating system language installation. You must consider the language requirements of those that use the Configuration Manager console. Is the current language localized or enabled? Does it make sense to localize Configuration Manager 2007 on that basis? Can you maintain separate versions, service packs, and hotfixes for the U.S. English, localized language, and ICP versions of Configuration Manager 2007? In what languages must you view your clients? If only one language is required, then you can install a localized Configuration Manager 2007 site server. However, if you require multiple client languages, then you must use the U.S. English version of Configuration Manager 2007 and apply an ICP on the site server.
  • Single language environment
    If a Configuration Manager 2007 site consists of computers running a localized operating system version, such as German, and you want to administer the site in German, and you also want to have all clients display a German client interface, then install the German localized Configuration Manager 2007 version. In this case, there is no need for an ICP. You can add the site to a hierarchy of other Configuration Manager 2007 language versions. If you have other clients with localized operating systems in the site, such as Italian and Chinese, then those clients will use the U.S. English Configuration Manager 2007 client.

See Also

Concepts

Deploying Multilingual Sites


Configuration Manager Tasks for Decommissioning Sites and Hierarchies

To decommission hierarchies, begin at the bottom of the hierarchy and move upward. Remove secondary sites attached to primary sites and then the primary sites themselves.

In This Section

How to Remove a Primary Site from a Hierarchy

How to Remove a Secondary Site Using the Configuration Manager Console

How to Remove a Secondary Site From a Hierarchy


How to Remove a Primary Site from a Hierarchy

Configuration Manager 2007 site hierarchies are made up of sites joined together in parent-child relationships. To disconnect sites, you must remove the site's parent site information and change the child site to a central site. Once the following procedure has been followed to disconnect the site, ensure that the addresses between sites (parent to child on the parent site and child to parent on the child site) have been deleted.

Note
When a parent primary site is removed from a hierarchy, any objects previously replicated from that site to a child site will remain at the child site after the parent-child relationship is broken. This is because there might be advertisements based on the replicated collections or software distribution packages that were replicated down the hierarchy. Once the parent site has been removed, the replicated objects will no longer be locked at the child site and can be modified or deleted as needed.

To remove a primary site from a hierarchy

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and click Properties.

  3. On the General tab, click Set Parent Site.

  4. Select the Central Site option.

See Also

Tasks

How to Delete an Address


How to Uninstall a Primary Site

If the primary site to be uninstalled is a child site or has child sites of its own, ensure that you have performed the following actions before removing the site from the hierarchy:

  • If the site is a child site, you should remove the site from the hierarchy before uninstalling it. For more information about removing a primary site from a hierarchy, see How to Remove a Primary Site from a Hierarchy.
  • If the site has any child primary sites, ensure that they have been reassigned to new parent sites before performing this procedure.
  • If the site has any child secondary sites, ensure that they have been uninstalled before uninstalling the primary site. For more information about uninstalling secondary sites, see How to Remove a Secondary Site From a Hierarchy.
Note
After uninstalling a primary site, you should verify that the deleted site information has been removed from Active Directory Domain Services.

To uninstall a primary site

  1. Click Configuration Manager Setup from within the Start menu program files directory for Configuration Manager.

  2. On the Welcome page, click Next.

  3. On the Configuration Manager Setup Options page, click Uninstall Configuration Manager.

  4. Confirm your decision to uninstall the site by clicking Yes on the delete confirmation dialog box.

  5. Review the Installation Summary page to determine the steps Configuration Manager 2007 is taking as it uninstalls the site.


How to Remove a Secondary Site From a Hierarchy

Secondary sites cannot be moved or reassigned to a new parent primary site. To remove a secondary site from a hierarchy, it must be deleted or uninstalled from its direct parent site.

Note
After uninstalling a secondary site, you should verify that the deleted site information has been removed from Active Directory Domain Services.

In This Section

How to Remove a Secondary Site Using the Configuration Manager Console

How to Remove a Secondary Site Using Configuration Manager Setup


How to Remove a Secondary Site Using the Configuration Manager Console

Secondary sites can be removed from within the parent site's Configuration Manager console using the Delete Secondary Site Wizard.

When removing a secondary site using the Delete Secondary Site Wizard, you must choose whether to delete or uninstall the secondary site:

  • Deleting the site will delete all information about the site and its resources from the Configuration Manager site database at its parent site, but it will leave the Configuration Manager secondary site installed on the secondary site computer. Select this option if you have already manually uninstalled the secondary site using Configuration Manager Setup at the secondary site computer.
Important
When Configuration Manager 2007 sites are deleted, the deleted site information is only deleted from the deleted site's direct parent site. Site deletion information is not propagated up the hierarchy to grandparent sites. In order to delete the site from the site database at sites above the deleted site's direct parent site, the hierarchy maintenance tool (Preinst.exe) must be run on every primary site above the deleted site's parent primary site using the command Preinst /delsite. For more information about the hierarchy maintenance tool, see Hierarchy Maintenance Tool (Preinst.exe).

  • Uninstalling the site will uninstall the Configuration Manager secondary site, and then delete all information about the site and its resources from the Configuration Manager site database at its parent site.

To start the Delete Secondary Site Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / <secondary site code> - <secondary site name>.

  2. Right-click <secondary site code> - <secondary site name> and click Delete.

See Also

Concepts

Delete Secondary Site Wizard


How to Remove a Secondary Site Using Configuration Manager Setup

You can uninstall a secondary site from the Configuration Manager 2007 installation media, or you can connect to the installation files from a mapped network drive, hard disk drive, or another removable storage media at the secondary site.

Note
If the server hosting the secondary site will not be part of the Configuration Manager 2007 hierarchy after the secondary site is uninstalled, you should remove the computer account of the primary site server from the local Administrators group on the secondary site server computer after performing this procedure.

To uninstall a secondary site using Configuration Manager Setup

  1. Log on to the new secondary site server computer with an account that has local administrative permissions.

  2. Insert the Configuration Manager 2007 installation media into the server’s drive, or click autorun.exe, located at the root of the installation files directory, on source files copied to a local drive on the server.

  3. Click Configuration Manager 2007.

  4. On the Welcome page, click Next.

  5. On the Configuration Manager Setup Options page, click Uninstall Configuration Manager.

  6. Confirm your decision to uninstall the secondary site by clicking Yes in the delete confirmation dialog box.

  7. Review the Installation Summary page to determine the steps Configuration Manager 2007 is taking as it uninstalls the secondary site.

    Note
    After the secondary site has been successfully uninstalled, you must manually delete the address to the secondary site and delete the secondary site from the primary site's Configuration Manager console using the Delete Secondary Site Wizard.

See Also

Tasks

How to Remove a Secondary Site Using the Configuration Manager Console


Administrator Workflow: Decommissioning Sites

This administrator workflow displays the recommended steps to follow when decommissioning sites.

Workflow of Uninstalling ConfigMgr Sites

See Also

Other Resources

Configuration Manager Tasks for Decommissioning Sites and Hierarchies


Planning and Deploying Clients for Configuration Manager 2007

Client deployment in Configuration Manager 2007 provides a set of tools and resources that can help to successfully deploy the Configuration Manager 2007 client in your organization.

Click any link in the following section for detailed information about planning, configuring, monitoring, maintaining and troubleshooting client deployment in Configuration Manager 2007.

In This Section

Overview of Configuration Manager Client Deployment

Provides an overview of client deployment in Configuration Manager 2007.

Prerequisites for Configuration Manager Client Deployment

Provides information about the necessary prerequisites for client deployment in Configuration Manager 2007.

Planning for Configuration Manager Client Deployment

Provides planning information for the client deployment in Configuration Manager 2007.

Configuring Configuration Manager Client Deployment

Provides the configuration checklist and tasks to configure client deployment for the site.

Tasks for Configuration Manager Client Deployment

Provides a set of tasks to perform client deployment objectives.

Troubleshooting Configuration Manager Client Deployment

Provides troubleshooting information for deploying and managing clients in Configuration Manager 2007.

Best Practices for Securing Clients

Provides security and privacy information and best practices for client deployment.

Technical Reference for Configuration Manager Client Deployment

Provides technical reference information for client deployment.

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Overview of Configuration Manager Client Deployment

Client deployment in Configuration Manager 2007 refers to the planning, installation and management of the Configuration Manager 2007 client software in your enterprise.

Topics in this section refer to deploying and managing the Configuration Manager 2007 client on computer systems. For information about using Configuration Manager 2007 with mobile devices, see Mobile Device Management in Configuration Manager.

The following table lists the various methods that you can use to install the Configuration Manager 2007 client software:

Client Installation Method | Description
Client push installation | Used to target the client to assigned resources. See How to Install Configuration Manager Clients Using Client Push
Software update point installation | Used to install the client using the Configuration Manager 2007 software updates feature. See How to Install Configuration Manager Clients Using Software Update Point Based Installation
Group Policy installation | Used to install the client using Windows Group Policy. See How to Install Configuration Manager Clients Using Group Policy
Logon script installation | Used to install the client by means of a logon script. See How to Install Configuration Manager Clients Using Logon Scripts
Manual installation | Used to manually install the client software. See How to Install Configuration Manager Clients Manually
Upgrade installation | Used to upgrade clients to a newer version. See How to Upgrade Clients Using Software Distribution in Configuration Manager
Client Imaging | Used to pre-stage the client installation in an operating system image. See How to Install Configuration Manager Clients Using Computer Imaging

After the client has installed successfully, it will attempt to assign to a site and find that site's default management point to download policy. For more information about site assignment, see About Client Site Assignment in Configuration Manager, and for more information about how clients locate their default management point, see Configuration Manager and Service Location (Site Information and Management Points).

The client's success or failure for these processes can be captured with the fallback status point if this role has been defined for the site, and the client is assigned to it. For more information about the fallback status point, see About the Fallback Status Point in Configuration Manager.

In This Section

About the Fallback Status Point in Configuration Manager

Provides information about the fallback status point role and how to use it.

About Client Approval in Configuration Manager

Provides information on the client approval methods available in Configuration Manager 2007.

About Client Site Assignment in Configuration Manager

Provides information on how client computers are assigned to Configuration Manager 2007 sites.

About Client States in Configuration Manager

Provides information about the various states a client might report in the Configuration Manager console.

About Client Roaming in Configuration Manager

Provides information about how client computers function when moving between Configuration Manager 2007 sites.

About Configuration Manager Client Installation Properties

Provides details about the available command line properties to modify the Configuration Manager 2007 client installation behavior.

About Configuration Manager Client Installation Properties Published to Active Directory Domain Services

Provides details about the client installation properties that are published to Active Directory when the schema is extended.

About Reports for Configuration Manager Clients

Lists the reports that provide information to help you manage and troubleshoot clients in the Configuration Manager 2007 hierarchy. These include reports for both Configuration Manager 2007 clients and SMS 2003 clients, which reports require a fallback status point, and identifies the reports that help you manage clients in a native mode site.

Administrator Checklist: Deploying Configuration Manager Clients

Provides a checklist for a recommended path to successfully deploying the Configuration Manager 2007 client to computers in your enterprise.

Data Flows for Configuration Manager Client Deployment

Provides data flows to assist you in understanding Configuration Manager 2007 client deployment.

See Also

Concepts

Best Practices for Securing Clients
Understanding Configuration Manager Clients
About the Fallback Status Point in Configuration Manager
Configuration Manager and Service Location (Site Information and Management Points)

Other Resources

Planning for Configuration Manager Client Deployment
Configuring Configuration Manager Client Deployment
Tasks for Configuration Manager Client Deployment
Technical Reference for Configuration Manager Client Deployment
Troubleshooting Configuration Manager Client Deployment


About the Fallback Status Point in Configuration Manager

A fallback status point in Configuration Manager 2007 is a site system role that is used to help administrators monitor client deployment and identify any problems encountered during installation or assignment. It is also used to help identify clients that are unmanaged because they have problems communicating with their management point, which is particularly relevant for when the site is operating in native mode.

The fallback status point is an optional but recommended site system role that helps you manage clients and identify any client-related problems.

Note
SMS 2003 client computers cannot use a fallback status point.

The fallback status point receives state messages from Configuration Manager 2007 client computers and then relays these back to the site. The state message system allows client computers to send short messages to the fallback status point or to the management point that indicate changes of state, for instance, success or failure. These changes of state are then made available to the administrator through a number of Configuration Manager 2007 reports. For more information about the reports generated from data using a fallback status point, see About Reports for Configuration Manager Clients.

Note
There is no equivalent of the status message viewer for state messages.

If you decide to use a fallback status point, install and configure this site system role before you deploy clients. This allows you to assign the fallback status point when the client is installed. Although you can install more than one fallback status point for a Configuration Manager 2007 site, client computers can be assigned to only one fallback status point.

Using the Fallback Status Point for Client Deployment

Examples of state messages a client might send to a fallback status point if it encountered problems during client deployment include the following:

  • The client failed to install properly (for example, because of incorrect setup options or syntax errors, or because it failed to locate the required files).
  • The client failed to be assigned to a site.
  • The client failed to register with its assigned site.
  • The client failed to locate its management point.
  • There was a network connectivity problem between the client and the management point.
  • The management point is not configured correctly (for example, Internet Information Services (IIS) is not configured correctly for a Configuration Manager management point).

In addition to sending state messages when there is a problem during client deployment, the client will send a state message to the fallback status point when it is successfully installed and when it is successfully assigned to a Configuration Manager 2007 site. In this scenario, the client will also report if a restart is required to complete the installation.

Using the Fallback Status Point to Identify Native Mode Communication Problems

Because the fallback status point accepts unauthenticated communications, it accepts state messages from native mode clients when PKI certificate issues prevent communication between the client and its management point. Examples of state messages a client might send to a fallback status point to identify problems with native mode communication include the following:

  • There is no valid client certificate.
  • There is more than one possible valid client certificate without an appropriate certificate selection configuration specified.
  • A server certificate needed for native mode communication fails to chain successfully to the trusted root certification.
  • A server certificate needed for native mode communication is expired.
  • A server certificate needed for native mode communication is revoked.

See Also

Tasks

How to Create a Fallback Status Point in Configuration Manager
How to Configure the Fallback Status Point in Configuration Manager
How to Remove the Fallback Status Point in Configuration Manager
How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

About Reports for Configuration Manager Clients
Determine If You Should Install a Fallback Status Point for Configuration Manager Clients
Client Communication in Mixed Mode and Native Mode
Configuration Manager Site Modes


About Client Approval in Configuration Manager

Topic last updated -- November 2007

Configuration Manager 2007 mixed mode does not authenticate clients before they are allowed to join the site. Any computer with the System Center Configuration Manager 2007 client installed and assigned to a site, and that has a self-signed certificate can communicate with a management point, display in the System Center Configuration Manager 2007 console, receive policy from the site, and send information to the site. In mixed mode, if the check box This site contains only ConfigMgr 2007 clients is not selected, then policies containing sensitive data can be sent to any client. However if the check box is selected, only clients that are approved can receive policies containing sensitive data.

A Configuration Manager 2007 client cannot be approved until it has successfully installed and assigned to a site.

Approval can be manual, automatic for computers in trusted domains, or automatic for all computers and is configured as a site property on the site mode tab for mixed mode sites.

The most secure approval method is to automatically approve clients that are members of trusted domains. In this mode, clients that are not members of a trusted domain, including workgroup clients, must be manually approved. If you want to manually verify every client before it is allowed to receive policies containing sensitive data, set the approval mode to manual. Automatically approving all clients is not recommended unless you have other access controls to prevent untrustworthy computers from accessing your network. If a client is not approved by an automatic method, it still displays in the Configuration Manager 2007 console and can be manually approved by locating it in a collection and using Approve from the Action menu. For more information, see How to Approve Configuration Manager Clients.

Mobile device clients do not receive any policies containing sensitive data and therefore do not require approval.

Approval is also not required when the site is configured for native mode, because public key infrastructure (PKI) certificates authenticate clients to the management point and other site systems.

Note
When a Configuration Manager 2007 site is in native mode, client approval is not used. However, if you view a collection in the Configuration Manager console, the approval column is displayed. For native mode sites, the information in this column should not be used.

The following table lists the three approval options that are available as a mixed mode site option.

Approval Setting More Information

Manually approve each computer

Manually approving every computer to join the site introduces the least risk, but the largest administrative overhead. Clients must be manually approved from their assigned site within the Configuration Manager console.

Automatically approve computers in trusted domains

Automatically approving computers in trusted domains automatically approves client computers joined to domains trusted by the site server's domain. When using this setting, you should ensure that you have other security controls in place to prevent untrustworthy computers from joining a trusted domain.

Important
If clients are from a different domain from the site server's domain, you must configure the site's default management point (or NLB management point) with a fully qualified domain name (FQDN) to use this option.

For information about how to specify this FQDN, see How to Configure the Intranet FQDN of Site Systems.

Automatically approve all computers

Automatically approving all computers to join the site will allow any computer to join the site. This setting is never recommended because it allows any computer to become a client without verifying trustworthiness.

Resetting the Client's Approval Status on Site Migration to Native Mode

When a Configuration Manager 2007 site is migrated from mixed mode to native mode, clients do not retain their approval status and the approval status of all clients assigned to the site is automatically set to unapproved.

When the site is operating in native mode, client authentication using the PKI certificates takes the place of approval, and the approval status is not used. However, if the site reverts to mixed mode, clients must be re-approved as if they are new clients.

See Also

Tasks

How to Approve Configuration Manager Clients
How to Block Configuration Manager Clients

Reference

Site Properties: Site Mode Tab

Concepts

Choose between Native Mode and Mixed Mode
Determine If You Will Use FQDN Server Names
Overview of Configuration Manager Client Deployment
Best Practices for Securing Clients


About Client Site Assignment in Configuration Manager

Topic last updated -- August 2007

Before a Configuration Manager 2007 client can be managed, it must belong to a Configuration Manager 2007 primary site. The site that a client computer belongs to is referred to as its assigned site.

Configuration Manager 2007 clients cannot be assigned to secondary sites; they are always assigned to the parent primary site. However, if they reside in the boundaries of the secondary site, they can take advantage of any proxy management points and distribution points at the secondary site.

The assignment process happens after the client is successfully installed, and determines which site manages the client computer. However, it is possible to install a client and not immediately assign it to a site, but in this scenario it is considered an unmanaged client until site assignment is successful.

You can either directly assign a client to a site, or use auto-site assignment where the client automatically finds an appropriate site based on its current network location.

After the client is assigned to a site, it remains assigned to that site even if it changes its IP address and roams to another site. Only an administrator can later manually assign the client to another site or remove the client assignment.

If the client fails to assign to a site, the client software remains installed, but will be unmanaged.

Note
A client is considered unmanaged when it is installed but not assigned to a site, or is assigned to a site but cannot communicate with that site's default management point.

How Manual Site Assignment Works

Clients can be manually assigned to a site using the following two methods:

  • A client installation property which specifies the site code.
  • Specifying the site code in Configuration Manager in the computer's Control Panel.
Note
If you manually assign a client computer to a Configuration Manager 2007 site code that does not exist, site assignment will fail. The client will remain installed but unmanaged until it is assigned to a valid Configuration Manager 2007 site.

How Auto-Site Assignment Works

During client deployment, clients that are configured to use auto-site assignment compare their own IP address with the site boundaries configured in the Configuration Manager 2007 hierarchy. When the client IP address falls within the boundaries of a site, the client is automatically assigned to that site.

Boundaries are configured for one or more of the following:

  • IP subnet
  • Active Directory site
  • IP v6 prefix
  • IP address range
Note
If a Configuration Manager 2007 client has multiple network cards (possibly a LAN network card and a dial-up modem), and therefore has multiple IP addresses, the IP address used to evaluate client site assignment is nondeterministic.

Configuration Manager 2007 clients that use auto-assignment attempt to find site boundaries published to Active Directory Domain Services. If this method fails (for example, the Active Directory schema is not extended for Configuration Manager 2007, or clients are not within the same forest), clients can find boundary information from a server locator point.

The server locator point can be directly assigned to the client during installation, or the client can attempt to locate it using WINS. For more information about locating a service locator point through WINS, see Configuration Manager and Service Location (Site Information and Management Points).

If the client cannot find a site configured with boundaries that match its own IP address, the client will retry every 10 minutes until it is able to assign to a site.

Configuration Manager 2007 clients cannot be automatically assigned to a site if any of the following scenarios apply, and instead they must be manually assigned:

  • They are currently assigned to a site.
  • You want to manage them as Internet-based clients.
  • They will locate the site's default management point using DNS publishing
  • Their IP address does not fall within one of the configured boundaries in the Configuration Manager hierarchy.

Completing Site Assignment by Checking Site Compatibility

After a client has found its assigned site, the client's version is checked to ensure that a Configuration Manager 2007 client is not incorrectly assigned to an SMS 2003 site. Additionally, if the client is running Windows 2000, a further check is made to ensure that it is not being assigned to a Configuration Manager 2007 site that is configured for native mode. Both of these configurations would result in an unmanaged client, so site assignment checks identify this misconfiguration.

The site compatibility check requires one of the following conditions:

  • The client can access site information published in Active Directory Domain Services.
  • The client can access a server locator point.

If the site compatibility check fails to complete successfully, site assignment will fail and the client will remain unmanaged until the site compatibility check is successful.

The exception to performing the site compatibility check is when a native mode client is configured for an Internet-based management point. In this scenario, no site compatibility check is made. If you are assigning clients to an Internet-based site and specifying an Internet-based management point, take particular care that you are assigning the client to the correct site. For more information about configuring clients for Internet-based client management, see Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management.

Locating the Default Management Point

After a client is successfully assigned to a site, it must then locate that site's default management point so that it can download its client policy. Or, if it assigned when on the Internet, it connects to its specified Internet-based management point. When the client has downloaded client policy from its assigned site's management point, the client is then a managed client.

For more information about how clients locate their default management point and find server locator points, see Configuration Manager and Service Location (Site Information and Management Points).

For more information about managing clients on the Internet, see Deploying Configuration Manager Sites to Support Internet-Based Clients.

Locating Site Mode and Related Settings

After site assignment succeeds and the client has found its default management point, a client that uses Active Directory Domain Services for its site compatibility check will locate the site mode settings for its assigned site.

When there is a site mode mismatch between client and site (for example, a mixed mode client is assigned to a native mode site), the client will be automatically reconfigured for the correct client communication mode so that it can communicate with its assigned site. Additionally, any other site mode related settings will also be configured on the client, such as the certificate selection criteria, whether to use a certificate revocation list, and the client request port numbers. The client continues to check these settings on a periodic basis.

However, a client that uses a server locator point for its site compatibility check cannot be automatically reconfigured. This means that a mixed mode client that is assigned to a native mode site (or a native mode client assigned to a mixed mode site) will be unable to communicate with the site until its client communication mode is manually reconfigured by the administrator (for example, reinstalled with the CCMSetup native mode option). Additionally, all client options relating to native mode configuration must be specified during installation using client installation properties. For more information, see About Configuration Manager Client Installation Properties.

Site Assignment Scenarios

For example scenarios of how client site assignment works in different circumstances, see the following:

  • Example Assignment Scenarios for Configuration Manager: Primary Sites
  • Example Assignment Scenarios for Configuration Manager: Secondary Sites
  • Configuration Manager Site Assignment Data Flow

See Also

Tasks

How to Configure Configuration Manager Boundaries
How to Assign Configuration Manager Clients to a Site

Concepts

Overview of Configuration Manager Client Deployment
Choose Configuration Manager Boundaries
Decide If You Should Extend the Active Directory Schema
Understanding Configuration Manager Clients
About Client Roaming in Configuration Manager
Determine If You Need a Server Locator Point for Configuration Manager Clients


About Client States in Configuration Manager

Topic last updated -- November 2007

When you view Configuration Manager 2007 collections in the Configuration Manager console, there are a number of columns that indicate the current state of the client.

Client State More Information

Approved

If the Configuration Manager 2007 site is in mixed mode, displays the approval status of clients.

For more information about client approval, see About Client Approval in Configuration Manager.

Assigned

Indicates whether a discovered resource falls within the boundaries of a Configuration Manager 2007 site.

For more information about client assignment, see About Client Site Assignment in Configuration Manager.

Blocked

Indicates whether the client computer has been blocked from communicating with the Configuration Manager 2007 site.

For more information about blocking clients, see Determine If You Need to Block Configuration Manager Clients.

Client

Indicates whether the client computer has a Configuration Manager 2007 client installed.

For more information about installing clients, see Tasks for Installing Configuration Manager Clients.

Obsolete

Indicates whether this client record is obsolete.

A record that is marked obsolete typically was superseded by a newer record for the same client. The newer record becomes the client's current record, and the older record becomes obsolete.

Active

If a client computer is marked as obsolete, this state is set to No.

Decommissioned

When a Configuration Manager 2007 client is removed from a child site, its record is not automatically deleted from the parent site. However, a new DDR is sent to the parent site and the client becomes marked as decommissioned. You can then use Configuration Manager 2007 queries or collections to identify decommissioned client computers.

Note
This state is not shown by default in the Configuration Manager console Collections view. To view this column. Click View and then Add/Remove columns in the actions pane.

See Also

Tasks

How to Approve Configuration Manager Clients
How to Block Configuration Manager Clients

Concepts

Overview of Configuration Manager Client Deployment
Configuration Manager and Service Location (Site Information and Management Points)


About Client Roaming in Configuration Manager

Roaming in Configuration Manager 2007 refers to the ability of clients to move between sites in the Configuration Manager hierarchy and continue to be managed while making the best use of network resources.

When the client is no longer within the designated boundaries of its assigned site, roaming behavior allows Configuration Manager 2007 clients to find the closest distribution points from which to download package source files required for software distribution, software updates, or operating system deployment. These package source files are collectively known as content.

Roaming behavior helps reduce the need for clients to download content over slow or unreliable network connections so that clients receive the content they need as efficiently as possible, and network bandwidth usage is minimized.

Roaming is ideally suited to laptop computers that move from one location on the network, to another. Some examples of client roaming are the following:

  • Moving a laptop computer from building to building.
  • Moving a laptop computer from one geographical location to another.
  • Moving a laptop computer from its wired network connection and connecting to the network using a wireless network card.
  • Removing a laptop computer from the office and connecting it to a virtual private network (VPN) from home.

Configuration Manager 2007 boundaries are used to identify a roaming client's position in the Configuration Manager 2007 hierarchy, which in turn facilitates locating the nearest distribution points that host the content requested by clients.

When a change in network location results in a client being outside its assigned site's boundaries, it relies on roaming behavior to locate content.

For more information about planning Configuration Manager 2007 site boundaries, see Planning Configuration Manager Boundaries, and for more information about content location, see Configuration Manager and Content Location (Package Source Files).

Roaming Capabilities: Global and Regional

When a client has global roaming capability, the Configuration Manager 2007 client can access site information from Active Directory Domain Services. This requires that the Active Directory schema is extended for Configuration Manager 2007, all sites are publishing to Active Directory Domain Services, and the client belongs to the same forest. This is not possible for clients from another forest, workgroup clients, or mobile devices.

For more information about extending the Active Directory schema to enable global roaming capability, see How to Extend the Active Directory Schema for Configuration Manager.

When a client does not have global roaming capability because it cannot access site information from Active Directory Domain Services, it has regional roaming capability. This offers more limited roaming support in that a client can download content locally from sites lower than its assigned site in the Configuration Manager 2007 hierarchy, but it cannot download content locally from sibling sites, or sites higher in the hierarchy.

Global Roaming Behavior

A client that has global roaming capability first identifies the site into which it has roamed by comparing its current IP address with the list of IP networks that define the boundaries in the Configuration Manager 2007 hierarchy.

When the client finds a match for the boundary, it can then identify which site is configured for that boundary, and then locate the management point for that site. This default management point for the site that the client has roamed into is referred to as the resident management point.

The resident management point informs the roaming client of distribution points in its site that contain package source files the client can access. However, if the package source files are not available in the site the client has roamed into, the client falls back to asking its default management point for distribution points.

Regional Roaming Behavior

When clients cannot access Configuration Manager 2007 site information published to Active Directory Domain Services, clients continue to contact the default management point in their assigned site. They are not aware of the site's identity that they have roamed into, or of management points in that site.

In this scenario, when clients roam into a site that is lower in the hierarchy than their assigned site (for example, a child site or a grandchild site), the client's default management point informs the roaming client of the closest distribution points the client can access.

How Roaming Clients Locate Content

When a roaming client needs to access content such as an advertised program's package source files, it sends a content location request to the resident management point if it has global roaming capability, or to its default management point if it has regional roaming capability.

The management point determines which distribution points contain the content requested and are available to the client. It makes this determination by checking whether the distribution points are in a fast or slow network boundary associated with the boundary the client computer is in, and if the client is located within the boundaries of a protected distribution point.

For more information about content location, see Configuration Manager and Content Location (Package Source Files).

When Content is Locally Available to Roaming Clients

If content is available from distribution points in the site the client has roamed into, the client downloads the content from these local distribution points.

If the client disconnects before the content has completed its download, and roams into another site or returns to its assigned site, a content download using BITS (download and then run) will continue where it left off even though it is from a different distribution point.

When Content is Not Locally Available to Roaming Clients

If the content isn't available locally in the site the client has roamed into, the advertisement or software update deployment configuration settings determine if the roaming client can access it from distribution points in its assigned site. In some situations, this is advantageous so that the client has the content it needs. In other cases, however, content downloads over slow and unreliable networks usually mean bandwidth saturation and delays if the source files are transferred over WAN links. It can also be an expensive solution for some organizations.

If the advertisement or software update deployment is configured to prevent installation when a client is connected using a slow or unreliable network connection, and the client is currently located on a slow or unreliable site boundary, the client cannot access the package source files.

To prevent clients from accessing package source files across slow or unreliable network links, configure the following settings:

  • For an advertisement: When a client is connected within a slow or unreliable network boundary: Do not run program on the Advertisement Name Properties: Distribution Points Tab.
  • For a software update deployment: When a client is connected within a slow or unreliable network boundary: Do not install software updates on the Deployment Name Properties: Download Settings Tab and When no distribution point is available locally: Do not run update installation on the Deployment Name Properties: SMS 2003 Settings Tab.

In this scenario, the client cannot download the content until it returns to its assigned site or it roams into another site that hosts the content on local distribution points. This configuration protects the network from network saturation associated with large packages such as operating system deployment packages and software updates that contain service packs. This is the default setting for both advertisements and software update deployments.

However, if the advertisement or software update deployment is not configured with this option, the client downloads the content from distribution points, even if the content is not local to them. This ensures that the client gets the content it needs, even if it takes a long time to transfer over a slow network and might consume a high proportion of the limited network bandwidth.

Roaming Exceptions

When the Configuration Manager 2007 hierarchy contains some sites in native mode, and some sites in mixed mode, this affects roaming behavior. For more information, see Roaming Between Sites in Different Modes.

Roaming Scenarios

For example scenarios of how roaming works in different circumstances, see the following:

  • Example Roaming Scenarios for Configuration Manager: Simple
  • Example Roaming Scenarios for Configuration Manager: Complex

See Also

Tasks

How to Configure Configuration Manager Boundaries

Concepts

Overview of Configuration Manager Client Deployment
About Client Site Assignment in Configuration Manager
Choose Configuration Manager Boundaries
Planning Configuration Manager Boundaries
About Configuration Manager Client Installation Properties

Other Resources

Configuration Manager Multiple Site Planning and Deployment


About Configuration Manager Client Installation Properties

Topic Last Updated—August 2008

Use the Microsoft System Center Configuration Manager 2007 CCMSetup.exe command to manually install the Configuration Manager 2007 client software onto computers in your enterprise.

CCMSetup downloads all the necessary files to complete the client installation from a specified management point or from a specified source location. These files might include the following:

  • The executable client.msi that installs the Configuration Manager 2007 client software.
  • Background Intelligent Transfer Service (BITS) installation files (if required).
  • Windows Installer installation files (if required).
  • Patches and fixes for the Configuration Manager 2007 client (if required).
Note
In Configuration Manager 2007, you cannot run client.msi directly.

CCMSetup.exe provides several command line properties to customize the installation behavior. Additionally, you can also specify properties to modify the behavior of client.msi from the CCMSetup.exe command line.

Important
You must specify all required CCMSetup properties before you specify properties for client.msi.

CCMSetup.exe and its supporting files are located on the Configuration Manager 2007 site server in the SMS\Client folder.

The format of the CCMSetup.exe command line is as follows:

CCMSetup.exe [ccmsetup properties] [client.msi setup properties]

For example, the following command line performs the following actions:

CCMSetup.exe /mp:SMSMP01 /logon SMSSITECODE=S01 FSP=SMSFSP01

  • Specifies to download installation files from the management point named SMSMP01
  • Specifies that installation should stop if a version of the Configuration Manager 2007 or SMS 2003 client already exists on the computer.
  • Instructs client.msi to assign the client to the site code S01
  • Instructs client.msi to use the fallback status point named SMSFP01
Note
If a property contains spaces, surround it by quotation marks ("").

The following properties are available to modify the installation behavior of CCMSetup.exe.

Important
If you have extended the Active Directory schema for Configuration Manager 2007, many client installation properties are published in Active directory and read automatically by the Configuration Manager 2007 client. For a list of the client installation properties published in Active Directory, see About Configuration Manager Client Installation Properties Published to Active Directory Domain Services.

CCMSetup.exe Command Line Properties

Property More Information

/?

Opens the CCMSetup dialog box showing command line properties for ccmsetup.exe.

Example: CCMSetup.exe /?

/source:<Path>

Specify the location from which to download installation files. You can use a local or UNC installation path.

Note
You can use the /source property multiple times on the command line to specify alternative locations from which to download installation files.

Important
To use the /source switch, the Windows user account being used for client installation must have read permissions to the install location.

Example: CCMSetup.exe /source:"\\computer\folder"

/mp:<Computer>

Specify the source management point for downloading installation files. Files are downloaded over a http connection.

Note
You can use the /mp property multiple times on the command line to specify alternative locations from which to download installation files.

Important
This property is only used to specify the management point from which to download installation files. It does not specify the management point that the client will become assigned to after installation.

Example: CCMSetup.exe /mp:SMSMP01

/retry:<Minutes>

Specify the retry interval if CCMSetup.exe fails to download installation files. The default value is 10 minutes. CCMSetup will continue to retry until it reaches the limit specified in the downloadtimeout installation property.

Example: CCMSetup.exe /retry:20

/noservice

Prevents CCMSetup from running as a service which might have insufficient rights to access network resources. If this property is not specified, /service will be used by default.

Example: CCMSetup.exe /noservice

/service

Specifies that CCMSetup should run as a service using the local system account.

Example: CCMSetup.exe /service

/uninstall

Specify that the Configuration Manager 2007 client software should be uninstalled. For more information, see How to Uninstall the Configuration Manager Client.

Example: CCMSetup.exe /uninstall

/logon

Specify that the client installation should stop if any version of the Configuration Manager 2007 or SMS client is already installed.

Example: CCMSetup.exe /logon

/forcereboot

Specify that CCMSetup should force the client computer to restart if this is necessary to complete the client installation. If this option is not specified, CCMSetup will exit when a restart is necessary and then continue after the next manual restart.

Example: CCMSetup.exe /forcereboot

/BITSPriority:<Priority>

Specify the download priority when client installation files are downloaded over an http connection. Possible values are:

  • FOREGROUND
  • HIGH
  • NORMAL
  • LOW

The default value is NORMAL.

Example: CCMSetup.exe /BITSPriority:HIGH

/downloadtimeout:<Minutes>

Specify the length of time in minutes that CCMSetup will attempt to download the client installation files before it gives up. The default value is 1440 minutes (1 day).

Example: CCMSetup.exe /downloadtimeout:100

/native: [<native mode option>]

Specifies native mode client communication.

Note
You must specify this property if you are installing a client for Internet-only communication. For more information about Internet-based client management, see Deploying Configuration Manager Sites to Support Internet-Based Clients.

The following optional properties can be specified:

  • CRL Certificate revocation list (CRL) checking enabled
  • FALLBACK HTTP communication for roaming and site assignment
  • CRLANDFALLBACK Certificate revocation list (CRL) checking, and HTTP communication for roaming and site assignment

For more information about these native mode options, see Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode) and Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode).

Examples: CCMSetup.exe /native

CCMSetup.exe /native:CRLANDFALLBACK

/config:<configuration file>

Specifies the name of a text file containing client installation properties. Unless you also specify the /noservice CCMSetup property, this file must be located in the CCMSetup folder, which is <%windir%>\system32\ccmsetup for 32-bit operating systems and <%windir%>\ccmsetup for 64-bit operating system. If you specify the /noservice property, this file must be located in the same folder from which you run CCMSetup.exe.

Example: CCMSetup.exe /config:<Configuration File Name.txt>

Use the mobileclienttemplate.tcf file in the <Configuration Manager directory>\bin\<platform> folder on the site server computer to provide the correct format of the file. This file also contains information in comment form about the sections and how they are used. Specify the client installation properties in the [Client Install] section, after the following text: Install=INSTALL=ALL

Example [Client Install] section entry: Install=INSTALL=ALL SMSSITECODE=ABC SMSSLP03 SMSCACHESIZE=100

Client.msi Properties

The following properties can modify the installation behavior of client.msi. If you use the client push installation method, these can also be specified in the Client tab of the Client Push Installation Properties dialog box.

Property More Information

CCMALWAYSINF

Set to 1 to specify that the client will always be Internet-based and will never connect to the intranet. The client's Connection type will display Always Internet.

This property should be used in conjunction with CCMHOSTNAME which specifies the FQDN of the Internet-based management point.

For more information about Internet-based client management, see Overview of Internet-Based Client Management.

Example: CCMSetup.exe CCMALWAYSINF=1

CCMCERTSEL

Specifies the certificate selection criteria if the client has more than one certificate that can be used for native mode communication (a valid certificate that includes client authentication capability).

For more information about whether you need to specify this property, see Determine If You Need to Specify Client Certificate Settings (Native Mode).

You can search for an exact match in the Subject Name or Subject Alternative Name (use Subject:) or a partial match (use SubjectStr:), in the Subject Name or Subject Alternative Name. Examples:

CCMCERTSEL="Subject:computer1.contoso.com" searches for a certificate with an exact match to the computer name "computer1.contoso.com" in either the Subject Name, or the Subject Alternative Name.

CCMCERTSEL="SubjectStr:contoso.com" searches for a certificate that contains "contoso.com" in either the Subject Name, or the Subject Alternative Name.

You can also use Object Identifier (OID) or distinguished name attributes in the Subject Name or Subject Alternative Name attributes, for example:

CCMCERTSEL="SubjectAttr:2.5.4.11 = Computers" searches for the organizational unit attribute expressed as an Object Identifier, and named Computers.

CCMCERTSEL="SubjectAttr:OU = Computers" searches for the organizational unit attribute expressed as a distinguished name, and named Computers.

Important
If you use the Subject Name field, the matching process for the Subject: selection criteria value is case sensitive and the matching process for the SubjectStr: selection criteria value is case insensitive.

If you use the Subject Alternative Name field, the matching process for both the Subject: selection criteria value and the SubjectStr: selection criteria value is case insensitive.

The complete list of attributes that can be used for certificate selection is listed in the table in Determine If You Need to Specify Client Certificate Settings (Native Mode).

If more than one certificate matches the search and the property CCMFIRSTCERT has been set to 1, a certificate from the search results is randomly selected, unless the client is running Configuration Manager 2007 SP1, in which case the certificate with the longest validity period is selected . If CCMFIRSTCERT has not been set and the client has more than one certificate that can be used for native mode communication, the client sends a failure message to its assigned fallback status point.

CCMCERTSTORE

Specifies an alternate certificate store name if the client certificate to be used for native mode communication is not located in the default certificate store of Personal in the Computer store.

Example: CCMSetup.exe CCMCERTSTORE="ConfigMgr"

CCMFIRSTCERT

If set to 1, this property specifies that the client should select any valid and matching certificate for native mode communication if multiple valid certificates are found in the certificate store. However, if the client is running Configuration Manager 2007 SP1, the certificate with the longest validity period will be selected. This setting might be required if you are using Network Access Protection with IPsec enforcement.

Example: CCMSetup.exe CCMFIRSTCERT=1

CCMHOSTNAME

Specifies the FQDN of the Internet-based management point, if the client is managed over the Internet.

Do not specify this option with the installation property of SMSSITECODE=AUTO. Internet-based clients must be directly assigned to their Internet-based site.

Example: CCMSetup.exe CCMHOSTNAME="SMSMP01.corp.contoso.com"

CCMHTTPPORT

Specifies the port the client should use when communicating over HTTP to site system servers. For more information about client communication over HTTP, see Client Communication in Mixed Mode and Native Mode.

If this is not specified then the default value of 80 will be used.

Example: CCMSetup.exe CCMHTTPPORT=80

CCMHTTPSPORT

Specifies the port the client should use when communicating over HTTPS to site system servers. For more information about client communication over HTTPS, see Client Communication in Mixed Mode and Native Mode.. If this is not specified then the default value of 443 will be used.

Example: CCMSetup.exe CCMHTTPSORT=443

SMSPUBLICROOTKEY

Specifies the trusted root key where this cannot be retrieved from Active Directory. For more information, see How to Pre-provision the Trusted Root Key on Clients.

Example: CCMSetup.exe SMSPUBLICROOTKEY=<key>

SMSSIGNCERT

Specifies the full path and .cer filename of the exported site server signing certificate for native mode clients.

For more information about whether you need to specify this property, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode).

For procedural information about creating the .cer file, see How to Export the Site Server Signing Certificate for Configuration Manager Client Installation.

Example: CCMSetup.exe SMSSIGNCERT=<Full path and filename>

SMSROOTKEYPATH

Used to reinstall the trusted root key. Specify the full path and filename to a file containing the trusted root key. For more information, see How to Pre-provision the Trusted Root Key on Clients.

Example: CCMSetup.exe SMSROOTKEYPATH=<Full path and filename>

RESETKEYINFORMATION

If a Configuration Manager 2007 client has the wrong trusted root key and cannot contact a trusted management point to receive a valid copy of the new trusted root key, you must manually remove the old trusted root key by using this property. This situation commonly occurs when you move a client from one site hierarchy to another.

Example: CCMSetup.exe RESETKEYINFORMATION=TRUE

CCMDEBUGLOGGING

Enables debug logging. Values can be set to 0 (off) or 1 (on). The default value is 0. This causes the client to log low-level information that might be useful for troubleshooting problems. As a best practice, avoid using this property in production sites because excessive logging can occur which might make it difficult to find relevant information in the log files. CCMENABLELOGGING must be set to TRUE to enable debug logging.

Example: CCMSetup.exe CCMDEBUGLOGGING=1

CCMENABLELOGGING

Enables logging if this property is set to TRUE. By default, logging is enabled. The log files are stored in the Logs folder in the Configuration Manager Client installation folder. By default, this folder is %Windir%\System32\CCM\Logs.

Example: Ccmsetup.exe CCMENABLELOGGING=TRUE

CCMLOGLEVEL

Specifies the amount of detail to write to Configuration Manager 2007 log files. Specify an integer ranging from 0 to 3, where 0 is the most verbose logging, and 3 logs only errors. The default is 1.

Example: CCMSetup.exe CCMLOGLEVEL=3

CCMLOGMAXHISTORY

When a Configuration Manager 2007 log file reaches 250,000 bytes in size (or the value specified by the property CCMMAXLOGSIZE), it is renamed as a backup, and a new log file is created.

This property specifies how many previous versions of the log file to retain. The default value is 1. If the value is set to 0 then no old log files are kept.

Example: CCMSetup.exe CCMLOGMAXHISTORY=0

CCMLOGMAXSIZE

Specifies the maximum log file size in bytes. When a log grows to the size that is specified, it is renamed as a history file, and a new file is created. This property must be set to at least 10000 bytes. The default value is 250000 bytes.

Example: Ccmsetup.exe CCMLOGMAXSIZE=300000

CCMALLOWSILENTREBOOT

If this property is set to 1, the computer will be allowed to restart following the client installation if this is required.

Important
The computer will restart without warning even if a user is currently logged on.

Example: CCMSetup.exe CCMALLOWSILENTREBOOT=1

DISABLESITEOPT

If set to TRUE, disables the ability of end users with administrative credentials on the client computer to change the Configuration Manager Client assigned site using Configuration Manager from the client computer's Control Panel.

Example: CCMSetup.exe DISABLESITEOPT=TRUE

DISABLECACHEOPT

If set to TRUE, disables the ability of end users with administrative credentials on the client computer to change the temporary program download folder settings for the Configuration Manager Client by using Configuration Manager from the client computer's Control Panel.

Example: CCMSetup.exe DISABLECACHEOPT=TRUE

SMSCACHEDIR

Specifies the location of the temporary program download folder on the client computer. By default, the location is %windir%\System32\CCM\Cache.

Example: CCMSetup.exe SMSCACHEDIR="C:\Temp"

This property can be used in conjunction with the SMSCACHEFLAGS property to further control the temporary program download folder location.

Example: CCMSetup.exe SMSCACHEDIR=Cache SMSCACHEFLAGS=MAXDRIVE installs the temporary program download folder on the largest available disk drive on the client.

SMSCACHEFLAGS

Configures the Configuration Manager 2007 temporary program download folder. You can use SMSCACHEFLAGS properties individually or in combination, separated by semicolons. If this property is not specified, the temporary program download folder is installed according to the SMSCACHEDIR property, the folder is not compressed, and the SMSCACHESIZE value is used as the size in MB of the folder.

Specifies further installation details for the client temporary program download folder. The following properties can be specified.

  • PERCENTDISKSPACE: Specifies the folder size a percentage of the total disk space. If you specify this property, you must also specify the property SMSCACHESIZE as the percentage value to use.
  • PERCENTFREEDISKSPACE: Specifies the folder size as a percentage of the free disk space. If you specify this property, you must also specify the property SMSCACHESIZE as the percentage value to use. For example, if the disk has 10MB free and SMSCACHESIZE is specified as 50, then the folder size is set to 5MB. You cannot use this property with the PERCENTDISKSPACE property.
  • MAXDRIVE: Specifies that the folder should be installed on the largest available disk. This value will be ignored if a path has been specified with the SMSCACHEDIR property.
  • MAXDRIVESPACE: Specifies that the folder should be installed on the disk drive which has the most free space. This value will be ignored if a path has been specified with the SMSCACHEDIR property.
  • NTFSONLY: Specifies that the folder can only be installed on disk drives formatted with the NTFS file system. This value will be ignored if a path has been specified with the SMSCACHEDIR property.
  • COMPRESS: Specifies that the folder should be held in a compressed form.
  • FAILIFNOSPACE: Specifies that the client software should be removed if there is insufficient space to install the folder.
Note
Multiple properties for this property can be specified by separating each with a semicolon.

If this property is not specified, the temporary program download folder will be created according to the SMSCACHEDIR property, will not be compressed and will be the size specified in the SMSCACHESIZE property.

Example: CCMSetup.exe SMSCACHEFLAGS=NTFSONLY;COMPRESS

Note
This setting is ignored when upgrading an existing client.

SMSCACHESIZE

Specifies the size of the temporary program download folder in MB or as a percentage when used with the PERCENTDISKSPACE or PERCENTFREEDISKSPACE properties. If this property is not set then the folder defaults to a maximum size of 5,120 MB.

Note
If a new package that must be downloaded would cause the folder to exceed the maximum size, and the folder cannot be purged to make sufficient space available, then the package download fails and the advertised program will not run.

This setting is ignored when upgrading an existing client.

Example: CCMSetup.exe SMSCACHESIZE=100

SMSCONFIGSOURCE

Specifies the location and order that the Configuration Manager Client Installer checks for configuration settings. The property is a string containing one or more characters, each defining a specific configuration source. Use the character values R, P, M, and U, alone or in combination, as shown in the examples below.

  • R: Check for configuration settings in the registry.
  • P: Check for configuration settings in the installation properties provided on the command line.
  • M: Check for existing settings when upgrading an older client with the Configuration Manager 2007 client software.
  • U: Upgrade the SMS 2003 advanced client or upgrade the Configuration Manager 2007 client to a newer version (using the assigned site code).

By default, the client installation uses PU to check first the installation properties and then the existing settings.

Example: CCMSetup.exe SMSCONFIGSOURCE=RP

SMSDIRECTORYLOOKUP

Specifies how the client uses WINS for service location.

Service location using WINS in mixed mode includes the management point and server locator point.

Service location using WINS in native mode includes the server locator point only.

For alternative methods of locating management points and the order in which they are performed, see Configuration Manager and Service Location (Site Information and Management Points).

If WINS is not used by clients to find a server locator point, it must be directly assigned to clients, for example using the SMSSLP Client.msi property.

This property has no impact on whether the client uses WINS for name resolution. For more information about using WINS for name resolution, see Configuration Manager and Name Resolution.

You can configure how WINS is used for service location using one of the following three modes:

  • NOWINS: This is the most secure method. In this mode, WINS is not used for service location and clients must have an alternative method of locating management points and a server locator point (if required).
  • WINSSECURE: In this mode, the mixed mode client can use WINS for service location but verifies the management point's mixed mode certificate before communicating with it.
    To verify the certificate, the client checks its copy of the mixed mode trusted root key in WMI. If the signature on the management point certificate matches the client’s copy of the trusted root key, the certificate is validated, and the client communicates with the management point found through WINS. If the signature on the management point certificate does not match the client’s copy of the trusted root key, the certificate is not valid and the client will not communicate with the management point located with WINS.
  • WINSPROMISCUOUS: In this mode, the mixed mode client can use WINS for service location but does not verify the management point's mixed mode certificate before communicating with it. This mode is not secure and is not recommended.

If this property is not specified, the default value of WINSSECURE will be used.

Example: CCMSetup.exe SMSDIRECTORYLOOKUP=NOWINS

SMSMP

Assign the Configuration Manager 2007 client to the specified management point. You can specify a fully qualified domain name as this property.

Example: CCMSetup.exe SMSMP=SMSMP01

SMSSITECODE

Specifies the Configuration Manager 2007 site to assign the Configuration Manager Client to. This can either be a three-character Configuration Manager 2007 site code or the word AUTO. If AUTO is specified, the Configuration Manager Client attempts to determine its Configuration Manager 2007 site assignment by using Active Directory or a server locator point.

Note
Do not use AUTO if the client will find its default management point using DNS, or if you are also specifying the Internet-based management point (CCMHOSTNAME). In both of these scenarios, you must directly assign the client to its site.

Example: CCMSetup.exe SMSSITECODE=AUTO

SMSSLP

Specifies the server locator point for site assignment and locating management points for clients that cannot locate this information from Active Directory Domain Services, DNS, or WINS.

For more information about how server locator points are used, see Configuration Manager and Service Location (Site Information and Management Points).

To determine if clients need a server locator point, see Determine If You Need a Server Locator Point for Configuration Manager Clients.

Example: CCMSetup.exe SMSSLP=SMSSLP01

CCMINSTALLDIR

Identifies the folder where the Configuration Manager Client files are installed. If this property is not set, then the client software is installed in the %Windir%\System32\CCM folder. Regardless of where the Configuration Manager Client files are installed, the Ccmcore.dll file is always installed in the %Windir%\System32 folder.

Example: CCMSetup.exe CCMINSTALLDIR="C:\Temp"

CCMADMINS

Specifies one or more Windows user accounts or groups to be given access to client settings and policies. This is useful where the Configuration Manager 2007 administrator does not have local administrator privileges on the client computer. You can specify a list of accounts separated by semi-colons.

Example: CCMSetup.exe CCMADMINS="Domain\Account1;Domain\Group1"

FSP

Specifies the fallback status point that will receive and process state messages sent by Configuration Manager 2007 client computers.

For more information about the fallback status point, see About the Fallback Status Point in Configuration Manager.

Example: CCMSetup.exe FSP=SMSFP01

DNSSUFFIX

Specifies the DNS domain to use for locating the default management point in DNS, when DNS publishing is used.

For more information about locating management points in DNS, see Configuration Manager and Service Location (Site Information and Management Points).

If this property is specified, SMSSITECODE must not be set to AUTO.

When this property is specified, client assignment will look for a DNS service location resource record (SRV RR) in DNS, which includes this DNS suffix of the management point. For the exact record format, see How to Manually Publish the Default Management Point to DNS.

Note
DNS publishing is not enabled by default in Configuration Manager 2007. For more information on whether you should use DNS publishing, see Determine If You Need to Publish to DNS.

Example: CCMSetup.exe SMSSITECODE=ABC DNSSUFFIX=contoso.com

See Also

Tasks

How to Specify the Client Certificate Selection Criteria
How to Specify the Client Certificate Store

Concepts

How to Uninstall the Configuration Manager Client
Determine If You Need to Specify Client Certificate Settings (Native Mode)
Determine the Ports Required for Internet-Based Client Management
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services

Other Resources

Tasks for Installing Configuration Manager Clients


About Configuration Manager Client Installation Properties Published to Active Directory Domain Services

If you have extended the Active Directory schema for your Configuration Manager 2007 site, then a number of client installation settings will be published to Active Directory Domain Services. When a new Configuration Manager 2007 client is installed, it can then search Active Directory Domain Services to find standard installation properties to use.

Advantages of using Active Directory to store client installation properties include the following:

  • Software update point client installation and Group Policy based client installations do not require setup parameters to be provisioned on each computer.
  • Because this information is automatically generated, the risk of human error associated with manually entering installation properties is eliminated.

Client installation properties stored in Active Directory Domain Services are used only if no other setup properties are specified with any of the following methods:

  • Manual installation
  • Provisioning client installation properties using Windows Group Policy

The following table lists Configuration Manager 2007 client installation methods and the circumstances in which they will use Active Directory to obtain installation properties:

Installation Method Comments

Client push installation

Client installation properties are specified in the Client tab of the Client Push Installation Properties dialog box. Configuration settings are stored in a file which is read by the client during installation. Client push installation does not use Active Directory to obtain installation properties.

Client push installation properties specified in this tab are published to Active Directory if the schema is extended for Configuration Manager 2007 and read by client installations where CCMSetup is run with no installation properties.

Note
You do not need to specify client push installation properties for the fallback status point or for native mode settings in this tab as these are supplied by default to client push installations.

Software update point based installation

The software update point installation method does not support adding installation properties to the CCMSetup command line.

If no command line properties have been provisioned on the client computer using Group Policy, it will search Active Directory for installation properties.

Group Policy installation

The Group Policy installation method does not support adding installation properties to the CCMSetup command line.

If no command line properties have been provisioned on the client computer using Group Policy, it will search Active Directory for installation properties.

Manual installation

Active Directory will be searched for installation properties under the following circumstances:

  • No command line properties are specified following the CCMSetup.exe command.
  • The computer has not been provisioned with installation properties using Group Policy.

Logon script installation

Active Directory will be searched for installation properties under the following circumstances:

  • No command line properties are specified following the CCMSetup.exe command.
  • The computer has not been provisioned with installation properties using Group Policy.

Software distribution installation

Active Directory will be searched for installation properties under the following circumstances:

  • No command line properties are specified following the CCMSetup.exe command.
  • The computer has not been provisioned with installation properties using Group Policy.

Installations for clients that cannot access Active Directory for published information:

  • Workgroup computers
  • Clients from a different Active Directory forest to the site server computer's forest
  • Clients that are installed on the Internet

These client computers cannot read installation properties from Active Directory, and so will not be able to access installation properties published to Active Directory.

The following client installation properties are published by Configuration Manager 2007 to Active Directory. See the topic About Configuration Manager Client Installation Properties for further information on these items.

  • The management point used to download content for the client installation.
  • The Configuration Manager 2007 site code.
  • The HTTP port used for client communications in both mixed mode and native mode.
  • The HTTPS port used for client communication in native mode.
  • A setting to indicate that the client must communicate in native mode.
  • The fallback status point (if the site has multiple fallback status points, only the first one that was created will be published to Active Directory).
  • The certificate store name if the default (Local Computer) is not being used.
  • The selection criteria for certificate selection, if this is required because the client has more than one valid certificate that can be used for native mode communication.
  • A setting to determine if the any valid certificate should be used for native mode communication if multiple valid certificates exist.
  • Installation properties specified in the Client tab of the Client Push Installation Properties dialog box.

See Also

Tasks

How to Provision Configuration Manager Client Installation Properties using Group Policy

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties
Decide If You Should Extend the Active Directory Schema


About Reports for Configuration Manager Clients

The following reports in Configuration Manager 2007 help you manage and troubleshoot clients in the Configuration Manager 2007 hierarchy. They have the report category of Site - Client Information.

For more general information about using reports, see Reporting in Configuration Manager.

Client Deployment and Assignment Reports

The following reports help you track and monitor client deployment for both Configuration Manager 2007 clients and SMS 2003 clients, and do not require that clients are assigned a fallback status point:

  • Computers Assigned but not installed for a particular site
  • Computers with a specific SMS client version
  • Count clients assigned and installed for each site
  • Count clients for each site
  • Count SMS client versions

The following reports help you track and monitor client deployment for Configuration Manager 2007 clients only, and require that these clients are assigned a fallback status point:

  • Client Assignment Detailed Status Report
  • Client Assignment Failure Details
  • Client Assignment Status Details
  • Client Assignment Success Details
  • Client Deployment Failure Report
  • Client Deployment Status Details
  • Client Deployment Success Report

Client Communication Reports

The following reports help you to identify client communication problems, for example if a client cannot communicate with its management point because of certificate problems.

These reports apply to Configuration Manager 2007 clients only, and require that these clients are assigned a fallback status point:

  • Issues by incidence detail report for a specific collection
  • Issues by incidence summary report for a specific collection
  • Issues by incidence detail report for a specific site
  • Issues by incidence summary report
Important
Configuration Manager 2007 reports that require a fallback status point will only display data from computers that have commenced client installation and reported state messages to the fallback status point. Data from the fallback status point might take some time to reach the Configuration Manager 2007 site server if you are deploying the client to a large number of computers. For more information, see Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager.

Client Mode Reports

These reports help you to manage clients for when sites are configured for native mode, which requires public key infrastructure (PKI) certificates for all clients, and specific site systems. For more information about native mode, see Configuration Manager Site Modes.

Use the following report when you are migrating sites from mixed mode to native mode, to help you identify which clients have successfully switched their site mode configuration so that they can communicate with their native mode site:

  • Summary information of clients in native mode

The following reports help you to determine if clients are ready to be migrated to native mode, but require that the Configuration Manager Native Mode Readiness Tool is first run on Configuration Manager 2007 clients. For more information, see How to Determine Whether Client Computers Are Ready for Native Mode:

  • Clients incapable of native mode
  • Summary information of clients capable of native mode
Note
To incorporate these reports into the procedures for migrating a site to native mode, see Administrator Checklist: Migrating a Site to Native Mode.

See Also

Tasks

How to Assign the Fallback Status Point to Configuration Manager Client Computers
How to Create a Fallback Status Point in Configuration Manager
How to Migrate the Site Mode from Mixed Mode to Native Mode

Concepts

Overview of Configuration Manager Client Deployment
About the Fallback Status Point in Configuration Manager
Reporting in Configuration Manager


Administrator Checklist: Deploying Configuration Manager Clients

The following checklist for Configuration Manager 2007 client deployment provides the steps necessary to plan, configure and deploy Configuration Manager 2007 clients in your organization:

Step | More Information
Review the changes made to client deployment in Configuration Manager 2007. | What's New in Client Deployment for Configuration Manager
Review the Configuration Manager 2007 client deployment concepts. | Overview of Configuration Manager Client Deployment
Review the prerequisites for installing Configuration Manager 2007 clients and make any required changes. | Prerequisites for Configuration Manager Client Deployment
Plan for any changes you need to make to your Configuration Manager 2007 site and review the client installation methods available. | Planning for Configuration Manager Client Deployment
Configure you Configuration Manager 2007 site for client deployment and prepare computers for client deployment. | Configuring Configuration Manager Client Deployment
Deploy the Configuration Manager 2007 client to computers. | How to Install Configuration Manager Clients Using Client Push How to Install Configuration Manager Clients Using Software Update Point Based Installation How to Install Configuration Manager Clients Using Group Policy How to Install Configuration Manager Clients Manually How to Install Configuration Manager Clients Using Logon Scripts How to Upgrade Clients Using Software Distribution in Configuration Manager How to Install Configuration Manager Clients Using Computer Imaging How to Install Configuration Manager Clients on Workgroup Computers
Review installation methods for Internet-based clients and configure and install these. | Overview of Internet-Based Client Management Tasks for Configuration Manager Internet-Based Client Management
Deploy international and multi-language Configuration Manager 2007 clients. | Tasks for International and Multi-Language Configuration Manager Clients
Review and implement tasks for managing clients in your Configuration Manager 2007 site. | Tasks for Managing Configuration Manager Clients
Monitor Configuration Manager 2007 clients to ensure that they remain managed. | Tasks for Monitoring Configuration Manager Clients

See Also

Other Resources

Planning and Deploying Clients for Configuration Manager 2007


Data Flows for Configuration Manager Client Deployment

The following data flows depict client deployment processes involved when deploying Configuration Manager 2007 clients.

Click any link in the following section for more information about the available client deployment data flows that help explain the processes involved in client deployment in Configuration Manager 2007.

In This Section

Configuration Manager Client Deployment Data Flow: CCMSetup Installation Process

Configuration Manager Management Point Location Data Flow: Mixed Mode

Configuration Manager Management Point Location Data Flow: Native Mode

See Also

Concepts

Overview of Configuration Manager Client Deployment
Administrator Checklist: Deploying Configuration Manager Clients


Configuration Manager Client Deployment Data Flow: CCMSetup Installation Process

This data flow displays the process by which CCMSetup obtains the necessary files to proceed with the Configuration Manager 2007 client installation.

Data flow of how CCMSetup obtains necessary files

See Also

Concepts

Overview of Configuration Manager Client Deployment
Prerequisites for Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties


Configuration Manager Management Point Location Data Flow: Mixed Mode

Topic last updated -- November 2007

This data flow displays the process by which Configuration Manager 2007 clients locate their default management point, when their assigned site is operating in mixed mode.

Flowchart - mixed mode management point location
Note
If the Active Directory schema has been extended for SMS 2003 but not extended for Configuration Manager 2007, clients can additionally find a server locator point in Active Directory Domain Services, and management point assignment succeeds. This service location request occurs before Was a server locator point specified on the client installation command line?

See Also

Concepts

Configuration Manager and Service Location (Site Information and Management Points)
Configuration Manager Site Modes
Overview of Configuration Manager Client Deployment


Configuration Manager Management Point Location Data Flow: Native Mode

Topic last updated -- November 2007

This data flow displays the process by which Configuration Manager 2007 clients locate their default management point, when their assigned site is operating in native mode.

Flowchart - native mode management point location
Note
If the Active Directory schema has been extended for SMS 2003 but not extended for Configuration Manager 2007, clients can additionally find a server locator point in Active Directory Domain Services, and management point assignment succeeds. This service location request occurs before Was a server locator point specified on the client installation command line?

See Also

Concepts

Configuration Manager and Service Location (Site Information and Management Points)
Configuration Manager Site Modes
Overview of Configuration Manager Client Deployment


Configuration Manager Site Assignment Data Flow

Topic last updated -- November 2007

This data flow displays the process by which Configuration Manager 2007 clients assign to a site in mixed or native mode.

Configuration Manager Site Assignment Flowchart
Note
If the Active Directory schema has not been extended for Configuration Manager 2007, site information required to complete client site assignment cannot be published to Active Directory Domain Services, and clients must have an alternative mechanism to complete site assignment.

Additionally, clients that are not in the same Active Directory forest as the site servers (such as workgroup clients or clients from a different Active Directory forest) are not be able to locate the site information they require from Active Directory Domain Services.

In either of these scenarios, a server locator point is required for clients to complete site assignment. For more information, see About Client Site Assignment in Configuration Manager.

See Also

Concepts

Configuration Manager and Service Location (Site Information and Management Points)
Overview of Configuration Manager Client Deployment
Example Assignment Scenarios for Configuration Manager: Primary Sites
Example Assignment Scenarios for Configuration Manager: Secondary Sites


Prerequisites for Configuration Manager Client Deployment

Deploying Configuration Manager 2007 clients in your environment has the following external dependencies and dependencies within the product. Additionally, each client deployment method has its own dependencies that must be met for client installations to be successful.

Also review Configuration Manager Supported Configurations to ensure that computers in your site meet the minimum hardware and operating system requirements for the Configuration Manager 2007 client.

Dependencies External to Configuration Manager 2007 and Automatically Downloaded During Installation

The Configuration Manager 2007 client has a number of potential external dependencies listed below. The exact dependencies depend on the client's operating system, the installed software and the processor type of the client computer.

If these dependencies are required to complete the installation of the client, they are automatically installed with the client software.

Dependencies Automatically Supplied During Installation More Information

Microsoft Background Intelligent Transfer Service (BITS) version 2.5

Required to allow throttled data transfers between the client computer and Configuration Manager 2007 site systems.

Note
On computers running Windows 2000, BITS version 2.0 will be installed.

Microsoft Windows Installer version 3.1.4000.2435

Required to support the use of Microsoft Windows Installer update (.msp) files for packages and software updates.

Microsoft Windows Update Agent version 7.0.6000.363

Required by Windows to support update detection and deployment.

Microsoft Core XML Services (MSXML) version 6.0.3883.0

Required to support the processing of XML documents in Windows.

Microsoft WMI Redistributable Components version 5.2.3790.1830

WMI components required by Windows 2000 Service Pack 4 computers.

Microsoft Remote Differential Compression (RDC)

Optimizes data transmission over the network.

Note
The software version numbers listed are minimum version numbers only.

Important
When BITS is installed on client computers a restart is generally required. If BITS is being installed during client installation (by CCMSetup.exe), then the client installation will not complete until the computer is restarted. For this reason, it is recommended that you pre-deploy BITS on client computers before you install the Configuration Manager 2007 client.

Configuration Manager 2007 Dependencies

For more information about the following site system roles, see Configuration Manager Site System Planning.

Configuration Manager Site System | More Information
Management Point | Although a management point is not required to deploy the Configuration Manager 2007 client, you must have a management point to transfer information between client computers and Configuration Manager 2007 servers. Without a management point, you cannot manage client computers.
Fallback Status Point | The fallback status point is an optional, but recommended site system role. The fallback status point allows computers in the Configuration Manager 2007 site to send state messages when they are unable to communicate with a management point.
Server Locator Point | Client computers require a server locator point to assign to Configuration Manager 2007 site and to locate management points when the Active Directory schema has not been extended for Configuration Manager 2007.

Installation Method Dependencies

The following prerequisites are specific to the various methods of client installation:

Client Installation Method More Information

Client Push installation
  • At least one Client push installation account must have been defined in the Accounts tab of the Client Push Installation Properties dialog box.
  • The computer to which you are targeting the client installation must have been discovered by at least one Configuration Manager 2007 discovery method.
  • Enable client push installation to assigned resources must be selected in the Client Push Installation Properties dialog box if you want to automatically push the Configuration Manager 2007 client to discovered resources.
  • The client computer must be able to contact a management point in order to download supporting files.
  • The Windows firewall must be configured on client computers with exceptions to allow client push installation to complete. For information, see Firewall Settings for Configuration Manager Clients.

Software Update Point based installation
  • If the Active Directory schema has not been extended, installation properties for CCMSetup.exe must be provisioned in the registry of the computer using the procedure in How to Provision Configuration Manager Client Installation Properties using Group Policy.
  • The required version of the Configuration Manager 2007 client must be published to the software update point.
  • The client computer must be able to contact a management point in order to download supporting files.

Group Policy based installation
  • If the Active Directory schema has not been extended, installation properties for CCMSetup.exe must be provisioned in the registry of the computer using the procedure in How to Provision Configuration Manager Client Installation Properties using Group Policy.
  • The client computer must be able to contact a management point in order to download supporting files.

Logon Script based installation
  • The client computer must be able to contact a management point in order to download supporting files unless the /source switch has been specified in the CCMSetup.exe command line.

Manual installation
  • The client computer must be able to contact a management point in order to download supporting files unless the /source switch has been specified in the CCMSetup.exe command line.

Software Distribution based installation (for upgrades only)
  • If the Active Directory schema has not been extended, installation properties for CCMSetup.exe must be provisioned in the registry of the computer using the procedure in How to Provision Configuration Manager Client Installation Properties using Group Policy.or in the setup command line in the Configuration Manager 2007 package containing the client.
  • The client computer must be able to contact a management point in order to download supporting files unless the /source switch has been specified in the CCMSetup.exe command line.

See Also

Tasks

How to Create a Fallback Status Point in Configuration Manager
How to Provision Configuration Manager Client Installation Properties using Group Policy

Concepts

Overview of Configuration Manager Client Deployment
Configure Your Management Point
About Configuration Manager Discovery
Decide If You Should Extend the Active Directory Schema
About Configuration Manager Client Installation Properties
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services
Firewall Settings for Configuration Manager Clients

Other Resources

Tasks for Installing Configuration Manager Clients


Planning for Configuration Manager Client Deployment

Client deployment in Configuration Manager 2007 provides various methods of deploying and configuring the Configuration Manager 2007 client. Before deploying the Configuration Manager 2007 client in your site, you should review the information in this section to help you plan for a successful deployment.

Click any link in the following section for planning information about using client deployment in Configuration Manager 2007.

In This Section

Determine If You Need a Server Locator Point for Configuration Manager Clients

Helps you decide whether to install a server locator point in your Configuration Manager 2007 site.

Determine If You Should Install a Fallback Status Point for Configuration Manager Clients

Helps you decide whether to install a fallback status point in your Configuration Manager 2007 site.

Determine the Configuration Manager Client Installation Method to Use

Helps you decide which client installation methods best suit your needs.

Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager

Helps you decide the optimum throttle settings for the fallback status point in your Configuration Manager 2007 site.

Decide How to Install Configuration Manager Clients for Internet-Based Client Management

Helps you decide which method of installing Internet-based clients best suits your needs.

Determine If You Need to Block Configuration Manager Clients

Helps you decide if you should block a client and the difference between this action and using certificate revocation if the site is in native mode.

See Also

Concepts

Understanding Configuration Manager Clients
Overview of Configuration Manager Client Deployment
Best Practices for Securing Clients

Other Resources

Configuring Configuration Manager Client Deployment
Tasks for Configuration Manager Client Deployment
Technical Reference for Configuration Manager Client Deployment
Troubleshooting Configuration Manager Client Deployment


Determine If You Need a Server Locator Point for Configuration Manager Clients

Server locator points are used in a Configuration Manager 2007 hierarchy to complete client site assignment on the intranet and help clients find management points when they cannot find that information through Active Directory Domain Services.

Intranet clients use Active Directory Domain Services as their preferred method to complete site assignment and find management points. However, clients must use a server locator point if the Active Directory schema is not extended for Configuration Manager 2007 or the site is not published to Active Directory Domain Services, or if clients do not belong to the same Active Directory forest as the site server's forest.

For more information about site assignment, see About Client Site Assignment in Configuration Manager.

For more information about how clients find management points, see Configuration Manager and Service Location (Site Information and Management Points).

Note
You need only one server locator point for the Configuration Manager 2007 hierarchy, even if you have multiple sites. In a multi-site hierarchy, install the server locator point in the central site. If you install a server locator point in the middle of the hierarchy, it will have no knowledge of sites above it in the hierarchy.

You do not need to install a server locator point if both of the following conditions apply:

  • You have extended the Active Directory schema for Configuration Manager 2007, and all sites in the hierarchy are published to Active Directory Domain Services.
  • You do not manage either workgroup clients or clients from another forest.

Additionally, you do not need to install a server locator point if all sites are configured for Internet-based client management.

Install a server locator point if either of the following conditions applies:

  • You have not extended the Active Directory schema for Configuration Manager 2007 or not all sites in the hierarchy are published to Active Directory Domain Services.
  • You have workgroup clients or clients from another forest.
Important
If native mode clients need to communicate with a server locator point, you must configure these clients to allow HTTP communication for roaming and site assignment. For more information, see How to Configure HTTP Communication for Roaming and Site Assignment.

For information about how to create the server locator point, see How to Create a Server Locator Point in Configuration Manager.

See Also

Tasks

How to Specify the Server Locator Point for Configuration Manager Client Computers
How to Publish Configuration Manager Site Information to Active Directory Domain Services

Concepts

Configuration Manager Site System Planning
Client Communication in Mixed Mode and Native Mode
Configuration Manager in Multiple Active Directory Forests
How to Install Configuration Manager Clients on Workgroup Computers

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
How to Extend the Active Directory Schema for Configuration Manager


Determine If You Should Install a Fallback Status Point for Configuration Manager Clients

The fallback status point in Configuration Manager 2007 always communicates with clients using HTTP which uses unauthenticated connections and sends data in clear text, even when the site is in native mode. This makes the fallback status point vulnerable to attack, particularly when it is used with Internet-based client management. To help reduce the attack surface, always dedicate a server to running the fallback status point and do not install other site system roles on the same server in a production environment.

Install a fallback status point in the site if all of the following conditions apply:

  • You want client computers to report any failures to the site database, particularly when they cannot contact a management point.
  • You want to utilize the Configuration Manager 2007 client deployment reports which use data sent by the fallback status point.
  • You have a dedicated server for this site system role, and have additional security measures to help protect the server from attack.
  • The benefits of using a fallback status point outweigh any security risks associated with unauthenticated connections and clear text transfers over HTTP traffic.

Do not install a fallback status point in the site if the following condition applies:

  • The security risks of running a Web site with unauthenticated connections and clear text transfers outweigh the benefits of identifying client communication problems.

See Also

Tasks

How to Create a Fallback Status Point in Configuration Manager
How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

About the Fallback Status Point in Configuration Manager
Client Communication in Mixed Mode and Native Mode


Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager

Although the default throttling configuration for the fallback status point in Configuration Manager 2007 is sufficient for most circumstances, you might need to change the throttling configuration for the scenario in the following table.

Scenario More Information Throttling Setting

The fallback status point accepts connections only from the intranet, and will be used during a client deployment rollout for a high number of computers.

During a deployment of many computers, the default throttling settings might result in a backlog of state messages.

This can result in a delay in displaying up-to-date information in the client deployment reports.

Consider changing one of the following throttling settings:

  • Increase the number of messages
  • Decrease the throttle interval

The default throttle settings for a Configuration Manager 2007 fallback status point are the following:

  • Number of Messages: 10,000
  • Throttle interval (in seconds): 3,600

These throttle settings limit the number of state messages that can be sent to the Configuration Manager 2007 site server in a specified period.

Without throttling, a continuous stream of state messages could negatively affect the performance of the Configuration Manager 2007 site server.

State Messages Sent by the Fallback Status Point

Each computer that successfully installs the Configuration Manager 2007 client sends the following four state messages to the fallback status point:

  • Client deployment started
  • Client deployment succeeded
  • Client assignment started
  • Client assignment succeeded

In addition, computers that fail to install or assign the Configuration Manager 2007 client will send further state messages.

For a client deployment up to 20,000 computers, this could result in 80,000 state messages being sent to the fallback status point. Because the default throttling configuration allows 10,000 state messages to be sent to the fallback status point each 3600 seconds (1 hour), state messages might become backlogged on the fallback status point as a result of the throttling configuration.

You also need to take into account the available network bandwidth between the fallback status point and the site server, and the processing power of the site server to process a high number of state messages.

Considerations for Configuring the Throttling Settings on the Fallback Status Point

Consider changing one of the throttle values for the fallback status point if the following condition applies:

  • You calculate that the default throttle values will not process state messages from your client deployment in a reasonable timescale.

Reset the throttle values for the fallback status point if either of the following conditions applies:

  • You calculate that the current throttle values are higher than required to process state messages from the fallback status point.
  • You find that the current throttle settings result in a high CPU load on your Configuration Manager 2007 site server.
Important
Do not change the fallback status point throttle settings unless you understand the consequences. For example, if you increase the throttle settings too high, you could cause high CPU load on your Configuration Manager 2007 site server that negatively affects the operation of your site.

For information about how to change the default throttling values for the fallback status point throttle, see How to Configure the Fallback Status Point in Configuration Manager.

See Also

Tasks

How to Create a Fallback Status Point in Configuration Manager
How to Configure the Fallback Status Point in Configuration Manager

Concepts

About the Fallback Status Point in Configuration Manager
Determine If You Should Install a Fallback Status Point for Configuration Manager Clients
Overview of Configuration Manager Client Deployment


Determine the Configuration Manager Client Installation Method to Use

There are a number of different methods that you can use to install the Configuration Manager 2007 client software on computers in your enterprise. You can use one, or any combination of these methods which are suitable for your needs.

The following table outlines the advantages and disadvantages of each client installation method to help you determine which will work best in your organization. Reference Tasks for Installing Configuration Manager Clients for procedural information about using these methods.

Client Installation Method Advantage Disadvantage

Client push installation
  • Can be used to push to a single computer, a collection or the results from a query.
  • Can be used to automatically install the client on discovered computers.
  • Automatically uses client installation properties defined on the Client tab of the Client Push Installation Properties dialog box.
  • Can cause high network traffic when pushing to large collections.
  • Can only be used on computers that have been discovered by Configuration Manager 2007.
  • Cannot be used to install clients in a workgroup.
  • A client push installation account must be specified which has administrative rights to the intended client computer.
  • The Windows firewall must be configured on client computers with exceptions to allow client push installation to complete.

Software update point based installation
  • Can use your existing software updates infrastructure to manage the client software.
  • Can automatically install the client software on new computers if WSUS and Active Directory Group Policy is configured correctly.
  • Does not require computers to be discovered before the client can be installed.
  • If the Active Directory schema has been extended for Configuration Manager 2007, computers can read installation properties published to Active Directory Domain Services.
  • Will reinstall the client software if it is removed.
  • Requires a functioning software updates infrastructure as a prerequisite.
  • Must use the same server for client installation and software updates, and this server must reside in a primary site.
  • To install new clients, you must configure an Active Directory Group Policy object with the client's active software update point and port.
  • If the Active Directory schema is not extended for Configuration Manager 2007, you must use Group Policy to provision computers with client installation properties.

Group Policy installation
  • Does not require computers to be discovered before the client can be installed.
  • Can be used for new client installations or for upgrades.
  • If the Active Directory schema has been extended, computers can read installation properties published to Active Directory.
  • Can cause high network traffic if a large number of clients are being installed.
  • If the Active Directory schema is not extended for Configuration Manager 2007, you must use Group Policy to add client installation properties to computers in your site.

Logon script installation
  • Does not require computers to be discovered before the client can be installed.
  • Supports using command line properties for CCMSetup.
  • Can cause high network traffic if a large number of clients are being installed.

Manual installation
  • Does not require computers to be discovered before the client can be installed.
  • Can be useful for testing purposes.
  • Supports using command line properties for CCMSetup.
  • No automation, therefore time consuming.

Upgrade installation (software distribution)
  • Can leverage the features of Configuration Manager 2007 to upgrade the client by collection, or to a defined timescale.
  • Supports using command line properties for CCMSetup.
  • Can cause high network traffic when distributing the client to large collections.
  • Can only be used to upgrade the client software on computers that have been discovered and assigned to the site.

See Also

Tasks

How to Provision Configuration Manager Client Installation Properties using Group Policy

Concepts

Supported Scenarios for Internet-Based Client Management
Overview of Internet-Based Client Management
About Configuration Manager Client Installation Properties
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services
Firewall Settings for Configuration Manager Clients

Other Resources

Planning and Deploying Clients for Configuration Manager 2007
Tasks for Installing Configuration Manager Clients


Decide How to Install Configuration Manager Clients for Internet-Based Client Management

Topic Last Updated—August 2008

When the Configuration Manager 2007 site supports Internet-based client management for clients that are sometimes on the intranet, and sometimes on the Internet, you can install the clients on the intranet with any of the available client installation methods and include the configuration for Internet-based client management.

However, you might need to install clients that are on the Internet (either because they are Internet-only clients or because you need to install them before they come back into the intranet). In this scenario, you need to decide how to install these clients.

Note
Installing a client directly from the Internet-based management point, or from the Internet-based software update point is not supported.

How to Install Clients on the Internet

There are two supported methods for installing clients that are on the Internet:

  • Provide a mechanism for these clients to temporarily connect to the intranet using a virtual private network (VPN), and then install them using any appropriate client installation method.
  • Use an installation method independent from Configuration Manager, such as packaging the client installation source files onto removable media that you can send to users to install with instructions. The client installation source files are located in the <InstallationPath>\Client folder on the Configuration Manager 2007 site server and management points. Include on the media a script to manually install the client by using CCMSetup.exe and all the appropriate CCMSetup command-line properties. These will need to include the following:
    • CCMSetup command-line property /source:<local path on removable media>
    • CCMSetup command-line property /native: [<native mode option]
    • Client.msi property CCMHOSTNAME=<FQDN of Internet-based management point>
    • Client.msi property SMSSIGNCERT=<local path to exported site server signing certificate>
    • Client.msi property SMSSITECODE=<site code of Internet-based management point>
    If you are using an Internet-based fallback status point, specify the following:
    • Client.msi property FSP=<Internet FQDN of the Internet-based fallback status point>
    If you are installing the client to be Internet-only because it will never be managed on the intranet, specify the following:
    • Client.msi property CCMALWAYSINF=1
      Note
      For a full list of CCMSetup command-line properties, see About Configuration Manager Client Installation Properties.

PKI Client Computer Certificate Requirement

Because clients that are managed over the Internet must communicate with their Internet-based site using native mode communication, ensure that these clients also have their public key infrastructure (PKI) certificate installed. For more information about this certificate requirement, see the following topics:

  • Certificate Requirements for Native Mode
  • Deploying the Client Computer Certificates to Clients and the Management Point

See Also

Concepts

Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
Example Scenarios for Implementing Internet-Based Client Management in Configuration Manager
Supported Scenarios for Internet-Based Client Management
Determine the Configuration Manager Client Installation Method to Use

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Installing Configuration Manager Clients


Determine If You Need to Block Configuration Manager Clients

If a client computer or client mobile device is no longer trusted, the Configuration Manager administrator can block the client in the Configuration Manager 2007 console. Blocked clients are rejected by the Configuration Manager 2007 infrastructure so that they cannot communicate with site systems to download policy, upload inventory data, or send state or status messages.

You must block and unblock a client from its assigned site. These actions cannot be performed from sites higher in the hierarchy.

Important
Although blocking in Configuration Manager 2007 can help to secure the Configuration Manager 2007 site, do not rely on this feature to protect the site from untrusted computers or mobile devices if the site is in mixed mode, because a blocked client could re-join the site with a new self-signed certificate and hardware ID.

This feature is designed to be used to block lost or compromised boot media when deploying clients with the operating system deployment feature, and with native mode clients.

Clients accessing the site using the ISV Proxy certificate cannot be blocked. For more information about the ISV Proxy certificate, see the System Center Configuration Manager 2007 Software Development Kit (SDK).

If the site is in native mode and your public key infrastructure supports a certificate revocation list (CRL), always consider certificate revocation to be the primary line of defense against potentially compromised certificates. Blocking clients in Configuration Manager 2007 offers a second line of defense to protect your hierarchy.

To help differentiate between certificate revocation in a PKI-supported environment, and blocking a client in Configuration Manager 2007, refer to the following table.

Block Client Certificate Revocation

Option is available in both mixed mode and native mode sites, but has limited security when the site is in mixed mode.

Option is available for native mode sites only, if the public key infrastructure supports a certificate revocation list (CRL).

Mobile device clients do not use certificate revocation lists, although their certificates can be revoked and checked by Configuration Manager 2007.

Configuration Manager 2007 administrator has the authority to block a client, and the action is taken in the Configuration Manager console.

Public key infrastructure administrator has the authority to revoke a certificate, and the action is taken outside the Configuration Manager console.

Client communication is rejected from the Configuration Manager 2007 hierarchy only.

Note
The same client could register with a different Configuration Manager 2007 hierarchy.

Client communication can be rejected from any computer or mobile device that requires this client certificate.

Client is immediately blocked from the Configuration Manager 2007 site.

There is likely to be a delay between revoking a certificate and site systems downloading the modified certificate revocation list (CRL).

For many PKI deployments, this delay can be a day or longer. For example, in Microsoft Windows 2003 Certificate Services, the default expiration period is one week for a full CRL, and one day for a delta CRL.

Helps to protect site systems from potentially compromised computers and mobile devices.

Helps to protect both site systems and clients from potentially compromised computers and mobile devices.

For more information about enabling certificate revocation checking on client computers, see Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode).

Note
You can further protect the native mode site from unknown clients by using a certificate trust list (CTL). For more information, see Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode).

See Also

Tasks

How to Block Configuration Manager Clients

Concepts

Administrator Checklist: Deploying the PKI Requirements for Native Mode
Overview of Configuration Manager Client Deployment
Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)

Other Resources

Planning and Deploying Clients for Configuration Manager 2007


Configuring Configuration Manager Client Deployment

There are various configurations that must be completed before you can install and upgrade the Configuration Manager 2007 client software. The links in this section provide the necessary information to complete each task associated with configuring Configuration Manager 2007 client deployment.

In This Section

How to Create a Fallback Status Point in Configuration Manager

Specifies how to create a fallback status point that is used to receive client information, which is then displayed in reports.

How to Configure the Fallback Status Point in Configuration Manager

Specifies how to verify that the fallback status point is correctly configured for client communications.

How to Assign the Fallback Status Point to Configuration Manager Client Computers

Specifies how to assign clients to a fallback status point so that clients can send it information, which is then displayed in reports.

How to Remove the Fallback Status Point in Configuration Manager

Specifies how to remove the fallback status point role if it is no longer required.

How to Configure the Configuration Manager Client Push Installation Account

Specifies how to configure the account used during Client Push if you are using this method of client deployment.

How to Configure Request Ports for the Configuration Manager Client

Specifies how to configure the ports used by clients to communicate with the site.

How to Configure Configuration Manager Clients to Find their Management Point using DNS Publishing

Specifies how to configure clients to find their management point by searching DNS.

How to Create a Server Locator Point in Configuration Manager

Specifies how to install the server locator point role, which is used for site assignment and can be used for locating a default management point if other service location methods are not possible.

How to Provision Configuration Manager Client Installation Properties using Group Policy

Specifies how to provision client computers with installation properties using Windows Group Policy.

How to Prevent the Configuration Manager Client Software from Being Installed on Specific Computers

Specifies how to prevent the Configuration Manager 2007 client being installed on computers you identify that should not have the client software installed.

How to Configure the Configuration Manager Computer Client Agent

Specifies how to configure general settings for all client computers in your Configuration Manager 2007 site.

See Also

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Planning for Configuration Manager Client Deployment
Tasks for Installing Configuration Manager Clients
Planning and Deploying Clients for Configuration Manager 2007


How to Create a Fallback Status Point in Configuration Manager

The fallback status point receives state messages from Configuration Manager 2007 clients when they fail to communicate with a management point. The state messages sent to the fallback status point provide administrators with information about client status.

Preparing for the Fallback Status Point

The fallback status point site system must have Internet Information Services (IIS) configured to accept incoming messages using the site-wide HTTP port using anonymous HTTP communication.

The fallback status point site role should not be co-located on an existing management point, or to any other site server that accepts messages from client computers that require HTTPS communication.

Use the following procedure to create the fallback status point:

To create the fallback status point:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager/ Site Database /Site Management/ <site code> - <site name> /Site Settings/Site Systems

  2. To launch the New Site Role Wizard, right-click the server that will be assigned the fallback status point site role and then click New Roles.

  3. On the General page of the New Site Role Wizard, specify the following information:

    • Intranet FQDN: Specify a fully qualified domain name for intranet-based clients to communicate with this fallback status point. This configuration is recommended, but not required.
    • Internet FQDN: Specify a fully qualified domain name for Internet-based clients to communicate with this fallback status point. This configuration is required if you want to support Internet-based client computers.
    • Select an account to use to install the fallback status point. If no Windows domain user account is specified, then the site server computer account is used.
      Note
      For more information about the options in this dialog box, see New Site Role Wizard: General Page.

    • Click Next to continue.

  4. On the System Role Selection page, click the check box next to Fallback Status Point and then click Next.

  5. On the Fallback Status Point page, specify the following information:

    • Confirm that the option Allowed client connections displays the correct setting for the site system's server placement and configuration:
    • Allow intranet-only connections
    • Allow both intranet and Internet client connections

    These options are set automatically and cannot be directly changed by the administrator.

    • Number of messages: Specify the number of state messages that the fallback status point can process within the specified throttle interval.
    • Throttle interval (in seconds): Specify the throttle interval in seconds. Only the specified number of state messages will be processed during this interval.
      Note
      For more information about the options in this dialog box, see ConfigMgr Fallback Status Point Properties: General Tab.

  6. To view the Summary, click Next on the Fallback Status Point page.

  7. To complete the wizard, click Next on the Site System Summary page.

See Also

Tasks

How to Remove the Fallback Status Point in Configuration Manager
How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

About the Fallback Status Point in Configuration Manager
How to Configure Site System Roles
Prerequisites for Installing Configuration Manager


How to Configure the Fallback Status Point in Configuration Manager

Use the following procedure to verify that the Configuration Manager 2007 fallback status point is configured correctly for intranet and Internet connections, and modify the throttling configuration if this is required.

To help you decide if you need to modify the throttling settings, see Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager.

To configure the fallback status point:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server with the fallback status point role installed.

  3. In the results pane, right-click ConfigMgr fallback status point, and then click Properties.

  4. On the General tab, confirmed that the option Allowed client connections displays the correct setting for the site system's server placement and configuration:

    • Allow intranet-only connections
    • Allow both intranet and Internet client connections

    These options are set automatically and cannot be directly changed by the administrator.

  5. Specify the value for Number of messages and modify this if required.

  6. Specify the value for Throttle interval (in seconds) and modify this if required.

  7. Click OK.

    Note
    For more information about the options in this dialog box, see ConfigMgr Fallback Status Point Properties: General Tab.

See Also

Tasks

How to Assign the Fallback Status Point to Configuration Manager Client Computers
How to Create a Fallback Status Point in Configuration Manager

Concepts

Determine Server Placement for Internet-Based Client Management
Determine If You Should Install a Fallback Status Point for Configuration Manager Clients
Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager

Other Resources

Configuring Configuration Manager Client Deployment
Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


How to Assign the Fallback Status Point to Configuration Manager Client Computers

Configuration Manager 2007 clients can be assigned a fallback status point in the following ways:

  • If a fallback status point site system role is installed in a site, and you are using client push installation, the site's fallback status point will be automatically assigned during the client push installation.
  • If a fallback status point site system role is installed in a site and the site is publishing to Active Directory Domain Services, running CCMSetup.exe with no command line properties will result in searching for the site's fallback status point in Active Directory. If the client belongs to the same Active Directory forest as the site server's forest, the site's fallback status point will be automatically assigned during client installation.
  • CCMSetup.exe is run manually, specifying a client.msi property to directly assign a fallback status point to a client.
    Note
    This method is required if you are assigning an Internet-based fallback status point to clients that are managed over the Internet, or if you want to assign a fallback status point that is outside the client's assigned site.

Although more than one fallback status point can be installed in a site, clients can be assigned to use only one.

Use the following procedure to manually assign a fallback status point to Configuration Manager clients.

To manually assign a fallback status point to clients:

  • Use the client.msi option FSP=<server> with CCMSetup.exe command line options. You can use a short name to specify the server parameter, or a fully qualified domain name, or an IP address.

    • Example 1: CCMSetup.exe SMSSITECODE=A01 FSP=server1
    • Example 2: CCMSetup.exe SMSSITECODE=A01 FSP=server1.contoso.com
    • Example 3: CCMSetup.exe SMSSITECODE=A01 FSP=10.10.0.15

See Also

Tasks

How to Create a Fallback Status Point in Configuration Manager
How to Block Configuration Manager Clients

Concepts

Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
How to Install Configuration Manager Clients Manually
About Configuration Manager Client Installation Properties
About the Fallback Status Point in Configuration Manager


How to Remove the Fallback Status Point in Configuration Manager

Use this procedure to remove the fallback status point site role from a Configuration Manager 2007 site.

Important
If this site system role is removed, client computers will not automatically assign themselves to another fallback status point. To assign computers to another fallback status point, see the topic How to Assign the Fallback Status Point to Configuration Manager Client Computers.

To remove the fallback status point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Select the server containing the fallback status point.

  3. Select the Fallback Status Point from the Site Systems Roles pane.

  4. Right-click the ConfigMgr fallback status point entry in the results pane and then click Delete.

  5. To confirm the site role deletion, click Yes.

See Also

Tasks

How to Create a Fallback Status Point in Configuration Manager
How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

How to Configure Site System Roles


How to Configure the Configuration Manager Client Push Installation Account

The client push installation account is used to connect to computers to install the Microsoft System Center Configuration Manager 2007 client software. This account is only used by the client push installation method. If you do not configure an account, Configuration Manager 2007 will try to use the site system computer account. This account must have local administrator rights on every client to be installed.

Note
If you are using the client push installation method to install the client on child sites, the account must be specified at the site which initiates the client push.

How to specify the Client Push Installation account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Installation Methods.

  2. To open the Client Push Installation Properties dialog box, double-click Client Push Installation.

  3. In the Client Push Installation Properties dialog box, select the Accounts tab, and then click the New button.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password. You can repeat this process to specify as many accounts as you want. The accounts will be used in order until one succeeds.

See Also

Concepts

About the Client Push Installation Account
Overview of Configuration Manager Client Deployment


How to Configure Request Ports for the Configuration Manager Client

Topic Last Updated—August 2008

You can change the port numbers used by Configuration Manager 2007 clients to communicate with site systems that use HTTP and HTTPS for communication. You can specify both a default port and an alternative port to use if communication using the default port fails. You can specify settings for both HTTP (mixed mode) and HTTPS (native mode) data communication.

The default values for these ports are 80 for HTTP traffic and 443 for HTTPS traffic. Change them only if you do not want to use these default values.

Important
Do not change the port numbers in Configuration Manager 2007 without understanding the consequences. For example, changing the port numbers for the client request services might result in clients being unable to connect to Configuration Manager 2007 site systems, resulting in them becoming unmanaged.

Changing the default request port numbers requires that the site is configured with the new request port numbers and that clients are configured to use the new request port numbers. When you change the request ports on a primary site, any attached secondary sites automatically inherit the same port configuration. Use the procedure in this topic to configure the request ports on the primary site.

When the Configuration Manager site is published to Active Directory Domain Services, new and existing clients that can access this information will automatically be configured with their site port settings and you do not need to take further action. Clients that cannot access this information published to Active Directory Domain Services include workgroup clients, clients from another Active Directory forest, clients that are configured for Internet-only, and clients that are currently on the Internet. If you change the default port numbers after these clients have been installed, reinstall them and install any new clients by using one of the following methods:

  • Reinstall the clients by using the Client Push Installation Wizard. Client push installation automatically configures clients with the current site port configuration. For more information about how to use the Client Push Installation Wizard, see How to Install Configuration Manager Clients Using Client Push.
  • Reinstall the clients by using CCMSetup.exe and the client.msi installation properties of CCMHTTPPORT and CCMHTTPSPORT. For more information about these properties, see About Configuration Manager Client Installation Properties.
  • Reinstall the clients by using a method that searches Active Directory Domain Services for Configuration Manager client installation properties. For more information, see About Configuration Manager Client Installation Properties Published to Active Directory Domain Services .

To reconfigure the port numbers for existing clients, you can also use the script PORTSWITCH.VBS that is provided with the installation media in the \Tools\PortConfiguration folder.

Important
For existing and new clients that are currently on the Internet, you must configure the non-default port numbers by using the CCMSetup.exe client.msi properties of CCMHTTPPORT and CCMHTTPSPORT.

After changing the request ports on the site, new clients that are installed by using the site-wide Client Push installation method will be automatically configured with the current port numbers for the site.

To configure the request ports on the site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> – <site name>, and then click Properties.

  3. On the Ports tab in the site properties dialog box, view the Active Ports list.

  4. Select any of the Client Request items and click the Properties icon to display the Port Detail dialog box.

  5. In the Port Detail dialog box, specify the port number and description for the item, and then click OK.

  6. When you have finished configuring client request ports, click OK to close the site properties dialog box.

See Also

Concepts

About Configuration Manager Client Installation Properties
Client Communication in Mixed Mode and Native Mode
Determine the Ports Required for Internet-Based Client Management
Firewall Settings for Configuration Manager Clients
Decide How to Install Configuration Manager Clients for Internet-Based Client Management
Overview of Configuration Manager Client Deployment
Ports Used by Configuration Manager


How to Configure Configuration Manager Clients to Find their Management Point using DNS Publishing

Clients in Configuration Manager 2007 must locate their default management point during site assignment, and as an on-going process to remain managed. There are various ways that clients can find their default management point in Configuration Manager 2007, and the most secure method is through Active Directory Domain Services. However, if this is not possible (for example, you have not extended the Active Directory schema or clients are from a different forest or a workgroup), then the preferred alternative is to use DNS publishing.

For more information about how clients find management points, see Configuration Manager and Service Location (Site Information and Management Points) and Determine If You Need to Publish to DNS.

Before configuring clients to find their management point using DNS publishing, ensure that DNS servers on the intranet have service location resource records (SRV RR) for the site's default management point. This is achieved either automatically with a configuration in Configuration Manager (see How to Automatically Publish the Default Management Point to DNS) or manually, by the DNS administrator manually adding the record to DNS (see How to Manually Publish the Default Management Point to DNS).

Note
Network load balancing (NLB) management points are not published to DNS, so sites that use an NLB management point cannot use DNS publishing.

You can configure clients to find the management point using DNS publishing either during installation, or after installation:

  • To configure clients to find their management point using DNS publishing during client installation, use CCMSetup client.msi properties.
  • To configure clients to find their default management point using DNS publishing after client installation, configure the Configuration Manager Properties.

To configure clients to find their management point using DNS publishing during client installation:

  • Install the client with the following CCMSetup client.msi properties:

    • DNSSUFFIX=<domain of the management point>
    • SMSSITECODE=<site code of client's assigned site>
    Note
    You cannot use auto-site assignment when configuring clients to find their management point in DNS, but must directly assign them to a site. For more information about the CCMSetup command line properties, see About Configuration Manager Client Installation Properties.

To configure clients to find their default management point using DNS publishing after client installation:

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and then double-click to open its properties.

  2. On the Advanced tab, specify the DNS suffix of the client's default management point in the option Specify or modify a DNS suffix for site assignment below.

  3. Click OK.

    Note
    For more information about the options displayed in this dialog box, see Configuration Manager Properties: Advanced Tab.

See Also

Tasks

How to Automatically Publish the Default Management Point to DNS
How to Manually Publish the Default Management Point to DNS
How to Configure Network Load Balancing for Configuration Manager Site Systems

Concepts

About Configuration Manager Client Installation Properties
Configuration Manager and Service Location (Site Information and Management Points)
Determine If You Need to Publish to DNS

Other Resources

Configuring Configuration Manager Client Deployment


How to Create a Server Locator Point in Configuration Manager

Server locator points are used in a Configuration Manager 2007 hierarchy to complete site assignment and help clients locate management points when clients cannot locate that information through Active Directory Domain Services.

For more information, see Determine If You Need a Server Locator Point for Configuration Manager Clients.

Note
The server locator point site system must have Internet Information Services (IIS) installed.

Clients can find a server locator point by either automatically locating it in WINS, or by having the server locator point manually assigned during installation. For more information see How to Specify the Server Locator Point for Configuration Manager Client Computers.

Procedure

Use the following procedure to create the server locator point.

To create a server locator point:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager/ Site Database /Site Management/ <site code> - <site name> /Site Settings/Site Systems

  2. To launch the New Site Role Wizard, right-click the server that will be assigned the server locator point role and then click New Roles.

  3. On the General page of the New Site Role Wizard, complete the options if needed, and then click Next.

    Note
    For more information about the options, see Site System Properties: General Tab.

  4. On the System Role Selection page, click Server Locator Point, and then click Next.

  5. On the Server Locator Point page, specify any options that are required, and then click Next.

    Note
    For more information about the options, see ConfigMgr Server Locator Point Properties: General Tab.

  6. On the Summary page, click Next.

  7. Click Close to complete and exit the wizard.

See Also

Tasks

How to Specify the Server Locator Point for Configuration Manager Client Computers

Concepts

How to Configure Site System Roles
Overview of Configuration Manager Client Deployment
Determine If You Need a Server Locator Point for Configuration Manager Clients
About the Server Locator Point Database Connection Account
Prerequisites for Installing Configuration Manager


How to Provision Configuration Manager Client Installation Properties using Group Policy

You can use Windows Group Policy to provision computers in your enterprise with Configuration Manager 2007 client installation properties. These properties are stored in the registry of the computer and read when the client software is installed. This procedure would not normally be required for Configuration Manager 2007. However, this might be required for some client installation scenarios, such as the following:

  • You are using the Group Policy or software update point client installation methods and you have not extended the Active Directory schema for Configuration Manager 2007.
  • You want to override client installation properties on specific computers.
Note
If any installation properties are supplied on the CCMSetup.exe command line, then installation properties provisioned on computers will not be used.

A Group Policy administrative template named ConfigMgr2007Installation.adm is supplied on the Configuration Manager 2007 installation media which can be used to provision client computers with installation properties. Use the following procedure to configure and assign this template to computers in your organization.

To configure and assign client installation properties using Group Policy:

  1. Import the administrative template ConfigMgr2007Installation.adm into a new or existing Group Policy object, using an editor such as Windows Group Policy object editor.

    Note
    This file can be found in the folder TOOLS\ConfigMgrADMTemplates on the Configuration Manager 2007 installation media.

  2. Open the properties of the imported setting Configure Client Deployment Settings.

  3. Click Enabled.

  4. In the CCMSetup field, enter the required CCMSetup command line properties. For a list of all CCMSetup command line properties and examples of their use, see About Configuration Manager Client Installation Properties.

  5. Assign the Group Policy object to the computers that you want to provision with Configuration Manager 2007 client installation properties.

Note
For information about Windows Group Policy, refer to your Windows Server documentation.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services


How to Prevent the Configuration Manager Client Software from Being Installed on Specific Computers

Topic last updated -- November 2007

You can prevent the Configuration Manager 2007 client from installing on specific computers when using the client push or software update point installation methods by editing the Windows registry. The registry of the Configuration Manager 2007 site server contains a list of computers that should be excluded from client installation. Computers that are excluded from the client installation can still be found using Configuration Manager 2007 discovery methods.

Important
If you use the Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using the Registry Editor incorrectly. Use the Registry Editor at your own risk.

When you add a computer to the ExcludeServers list it is flagged in the site database with an installed status which prevents the client from reinstalling. If you later remove the computer from the list, this flag remains. To change this status to uninstalled, you must run the clear install flag task.

Follow these procedures to add computers to the exclude list, and to run the clear install flag task if this task is necessary.

To add computers to the exclude list to prevent client software from being installed:

  1. Open the Windows Registry Editor on the Configuration Manager 2007 site server that hosts the site that you want to exclude a computer from joining.

  2. Locate the SMS_DISCOVERY_DATA_MANAGER sub-key by browsing to HKEY_LOCAL_MACHINE/Software/Microsoft/SMS/Components/SMS_DISCOVERY_DATA_MANAGER.

  3. To enter the name of the computers you want to exclude, double-click the key ExcludeServers to open the Edit Multi-String window.

  4. In the Edit Multi-String window, specify the name of each computer you want to exclude. Press the Enter key after typing each computer name to ensure that each computer name appears on a separate line.

  5. After you have entered the computer names of computers you wish to exclude, click OK. Close the Registry Editor window.

To clear the Install Flag so that client software will install:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Maintenance / Tasks.

  2. Double-click Clear Install Flag to open the Clear Install Flag Properties dialog box.

  3. In the Clear Install Flag Properties dialog box, specify the following:

    • Select the checkbox to enable the clear install flag task.
    • Set the schedule to control how often the task runs.

  4. Click OK to close the Clear Install Flag Properties dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Discovery
Clear Install Flag Task Overview

Other Resources

Configuring Configuration Manager Client Deployment


How to Configure the Configuration Manager Computer Client Agent

Topic last updated -- January 2008

The computer client agent is installed and enabled on all client computers in the Configuration Manager 2007 site. You can configure settings for the computer client agent such as settings that client computers use to communicate with Configuration Manager 2007 site systems, notification options for users of client computers and the behavior of client computers which require a restart.

Use the following procedure to configure the computer client agent.

Procedure

To configure the computer client agent:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager/ Site Database /Site Management/ <site code> - <site name> /Client Agents

  2. Right-click Computer Client Agent, and then click Properties.

  3. On the General tab of the Computer Client Agent Properties dialog box, specify the network service account and the site-wide policy polling interval to use. For more information, see Computer Client Agent Properties: General Tab.

  4. On the Customization tab, specify organization-specific text that will be displayed to users of client computers when they receive Configuration Manager 2007 software packages. For more information see Computer Client Agent Properties: Customization Tab.

  5. On the Reminders tab, specify how often users of client computers are notified of approaching deadlines and mandatory assignment schedules. For more information, see Computer Client Agent: Reminders Tab.

  6. On the BITS tab, specify Background Intelligent Transfer Service (BITS) bandwidth throttling settings to control network traffic between Configuration Manager 2007 clients and site systems. For more information, see Computer Client Agent: BITS Tab.

    Important
    When you specify BITS settings using the Configuration Manager 2007 console, they are stored in the local policy of the client computer. These settings might override BITS settings configured by another application. Additionally, if you use Windows Group Policy to configure BITS settings, the settings specified in the Group Policy will override those configured by Configuration Manager 2007.

  7. On the Restart tab, specify site-wide notification settings to be used when a program requires a restart of the client computer. For more information, see Computer Client Agent Properties: Restart Tab.

  8. Click OK to close the Computer Client Agent Properties dialog box.

    Important
    If a client computer is a member of multiple collections with different polling and restart intervals, it will use the shortest configured interval.

See Also

Concepts

Overview of Configuration Manager Client Deployment


How to Specify the Server Locator Point for Configuration Manager Client Computers

Server locator points are used in a Configuration Manager 2007 hierarchy to complete site assignment and locate management points when clients cannot locate that information through Active Directory Domain Services.

If you need more information about whether you need a server locator point, see Determine If You Need a Server Locator Point for Configuration Manager Clients.

Specify the server locator point for clients using one of the following methods:

  • Manually publish the server locator point in WINS so that clients can automatically locate it.
    Client computers search WINS for the server locator point if the client.msi installation property SMSDIRECTORYLOOKUP=NOWINS has not been specified.
  • Assign the server locator point to clients during client installation, using the client.msi property SMSSLP=<server locator point name> on the CCMSetup command line.
Important
For native mode clients to use a server locator point, they must be configured to allow HTTP communication for roaming and site assignment.

For more information about this configuration, see How to Configure HTTP Communication for Roaming and Site Assignment.

Additionally, the server locator point is published to Active Directory Domain Services. If you have extended the Active Directory schema for SMS 2003 but not for Configuration Manager 2007, clients can automatically find a server locator point through Active Directory publishing if they are in the same Active Directory forest as the site server. In this scenario, there is no requirement to manually specify the server locator point in WINS or on the CCMSetup command line.

To publish the server locator point in WINS:

  • Manually add the server locator point entry to WINS using the procedure in the following topic: How to Manually Add Configuration Manager Site Information to WINS.

To assign the server locator point on the CCMSetup command line:

  • Install the client with the installation property SMSSLP=<server locator point name>

    Example CCMSetup.exe SMSSITECODE=A01 SMSSLP=server1

See Also

Tasks

How to Create a Server Locator Point in Configuration Manager

Concepts

Configuration Manager and Service Location (Site Information and Management Points)
About Configuration Manager Client Installation Properties
About Client Site Assignment in Configuration Manager


Tasks for Configuration Manager Client Deployment

Topic last updated -- January 2008

There are various tasks associated with deploying the Configuration Manager 2007 client. However, before deploying clients, ensure that you have configured the environment appropriately. See Configuring Configuration Manager Client Deployment for more information.

The links in this section provide the necessary information to complete the tasks associated with client deployment.

In This Section

Tasks for Installing Configuration Manager Clients

Lists the tasks associated with each client deployment method.

Tasks for Configuration Manager Client Assignment

Lists the tasks associated with site assignment so that installed clients can be managed by Configuration Manager 2007.

Tasks for Configuration Manager Internet-Based Client Management

Lists the tasks associated with managing clients in a site that supports Internet-based client management.

Tasks for International and Multi-Language Configuration Manager Clients

Lists the tasks associated with deploying and supporting multi-language clients that use the International Client Packs (ICPs).

Tasks for Managing Configuration Manager Clients

Lists the tasks associated with managing clients after they are deployed and assigned to their site.

Tasks for Monitoring Configuration Manager Clients

Lists the tasks associated with monitoring clients to ensure that they continue to be successfully managed by Configuration Manager 2007.

Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices

Lists tasks associated with managing Configuration Manager 2007 clients on devices running the Windows XP Embedded operating system.

See Also

Concepts

Administrator Checklist: Deploying Configuration Manager Clients
Overview of Configuration Manager Client Deployment
Overview of Internet-Based Client Management

Other Resources

Planning and Deploying Clients for Configuration Manager 2007
Planning for Configuration Manager Client Deployment
Configuring Configuration Manager Client Deployment


Tasks for Installing Configuration Manager Clients

There are various deployment methods available to help you install the Configuration Manager 2007 client software. To help you decide which deployment method to use, see Determine the Configuration Manager Client Installation Method to Use.

Before installing Configuration Manager 2007, ensure that all prerequisites are in place and that you have completed any deployment configuration required. For more information, see Prerequisites for Configuration Manager Client Deployment and Configuring Configuration Manager Client Deployment.

Click any link in the following section for procedural information about each deployment method.

In This Section

How to Install Configuration Manager Clients Using Client Push

How to Install Configuration Manager Clients Using Software Update Point Based Installation

How to Install Configuration Manager Clients Using Group Policy

How to Install Configuration Manager Clients Manually

How to Install Configuration Manager Clients Using Logon Scripts

How to Upgrade Clients Using Software Distribution in Configuration Manager

How to Install Configuration Manager Clients Using Computer Imaging

How to Install Configuration Manager Clients on Workgroup Computers

How to Manage the Trusted Root Key in Configuration Manager

See Also

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Tasks for Configuration Manager Client Deployment
Planning and Deploying Clients for Configuration Manager 2007
Data Flows for Configuration Manager Client Deployment


How to Install Configuration Manager Clients Using Client Push

Topic last updated—January 2008

Client push installation is designed to push Configuration Manager 2007 client software to discovered computers or resources. You can configure client push installation for a site, and client installation will be automatically initiated on the computers discovered within the site's configured boundaries, or you can initiate a client push installation by targeting a specific collection or resource within a collection using the Client Push Installation Wizard.

You can also use the client push installation wizard to install the Configuration Manager 2007 client to the results obtained from running a query. In order for installation to succeed, one of the items returned by the selected query must be the attribute ResourceID from the attribute class System Resource.

Note
You can use the wizard to install clients even if the site is not configured for client push.

Important
If clients are running the Windows Firewall, this can prevent client push installation from succeeding until it is configured to allow the ports required for client push installation. For more information, see Firewall Settings for Configuration Manager Clients.

To configure the site to automatically use client push for discovered computers:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Installation Methods.

  2. Right-click Client Push Installation, and click Properties to open the Client Push Installation Properties dialog box.

  3. On the General tab, select Enable Client Push Installation to Assigned Resources. Select the system types that Configuration Manager 2007 should push the client software to by selecting Servers, Workstations, or Domain controllers. The default selection is Servers and Workstations.

  4. To enable the client software to be installed on Configuration Manager 2007 site systems, select the Enable Client Push Installation to site systems checkbox.

  5. On the Accounts tab specify one or more accounts for Configuration Manager 2007 to use when connecting to the computer to install the client software. Click the New icon, enter the User name and Password, confirm the password, and then click OK.

    Note
    The account or accounts specified must have administrative rights on the computer that will have the client software installed. In addition, if you intend to use the client push installation method to install the client on child sites, the account must be specified at the site which initiates the client push.

    For more information about the client push installation account, see How to Configure the Configuration Manager Client Push Installation Account

  6. On the Client tab, specify any installation properties to use when installing the Configuration Manager 2007 client. You can only specify installation properties for client.msi in this tab; you cannot specify properties for CCMSetup.exe. Client installation properties specified in this tab are published to Active Directory if the schema is extended for Configuration Manager 2007 and read by client installations where CCMSetup is run with no installation properties. For more information about client installation properties, see About Configuration Manager Client Installation Properties.

    Note
    If you enable client push installation on a secondary site, make sure that the SMSSITECODE property is set to the Configuration Manager 2007 site name of its parent primary site. If the Active Directory schema is extended for Configuration Manager 2007, you can also set this to AUTO to automatically find the correct site assignment.

To use the Client Push Installation Wizard:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Installation Methods.

  2. To specify client installation parameters that should be used when installing the Configuration Manager 2007 client, right click the Client Push Installation method, and then click Properties. On the Client tab specify the installation properties to use when installing the Configuration Manager 2007 client. For more information about client installation properties, see About Configuration Manager Client Installation Properties.

  3. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  4. Select the collection or computer in a collection you want to push the client software to. To launch the Client Push Installation wizard, right-click the computer or collection that should receive the client software, and then select Install Client. To display the installation options, click Next.

  5. On the Installation options page, specify the client installation options that should be used for installing the Configuration Manager 2007 client to a domain controller, clients assigned to this site, sub collections, or if the software should always be installed by selecting the appropriate options. The default is Include only clients in this site's boundaries.

  6. To complete the Client Push Installation wizard, click Next. Review the installation settings, and click Finish to close the wizard.

Important
If you select multiple computers in a Configuration Manager console collections window, the right-click Install Client option will be unavailable. If you click Install Client in the Actions pane of the Configuration Manager console, the Configuration Manager 2007 client will be installed to all computers in the currently selected collection and not only to the currently selected computers.

See Also

Tasks

How to Configure the Configuration Manager Client Push Installation Account

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties


How to Install Configuration Manager Clients Using Software Update Point Based Installation

Topic last updated -- August 2007

Software update point based client installation publishes the Configuration Manager 2007 client to a software update point, as an additional software update. This method of client installation can be used to install the Configuration Manager 2007 client on computers that do not already have the client installed, or to upgrade existing Configuration Manager 2007 clients.

If a computer is an existing Configuration Manager 2007 client, its Configuration Manager client policy provides the software update point server name and port from which to obtain software updates.

Important
To use software update point based installation, you must use the same WSUS server for both client installation and software updates. This server must be the active software update point in a primary site. For more information, see How to Create and Configure an Active Software Update Point.

If a computer doesn't have the Configuration Manager 2007 client installed, you must configure and assign an Active Directory Group Policy object to specify the software update point server name from which the computer will obtain software updates.

It is not possible to add command line properties to a software update point based client installation. If you have extended the Active Directory schema for Configuration Manager 2007, client computers will automatically query Active Directory Domain Services for installation properties when they install.

If you have not extended the Active Directory schema, you can use Windows Group Policy to provision client installation settings to computers in your site. These settings will automatically be applied to any software update point based client installations. For more information, see How to Provision Configuration Manager Client Installation Properties using Group Policy and How to Assign Configuration Manager Clients to a Site.

Use the following procedures to configure computers without a Configuration Manager 2007 client to use the software update point for client installation and software updates, and to publish the Configuration Manager 2007 client software to the software update point.

To configure an Active Directory Group Policy object to specify the software update point for client installation and software updates

  1. Using an editor such as Windows Group Policy editor, open a new or existing Group Policy object.

  2. In the Group Policy editor, navigate to Computer Configuration / Administrative Templates / Windows Components / Windows Update, and then open the properties of the setting Specify intranet Microsoft update service location.

  3. Click Enabled.

  4. In the Set the intranet update service for detecting updates: field, specify the name of the software update point server you want to use, and the port. These must match exactly with the server name format and the port being used by the software update point:

    • If the Configuration Manager site system is configured to use a fully qualified domain name (FQDN), specify the server name using FQDN format.
    • If the Configuration Manager site system is not configured to use a fully qualified domain name (FQDN), specify the server name using a short name format.
    • If the site is in mixed mode and software updates is using the default Web site, the port number is likely to be 80 unless it has been changed.
    • If the site is in mixed mode and software updates is using a custom Web site, the port number is likely to be 8530 unless it has been changed.
      Note
      To determine the port number being used by the software update point, see How to Determine the Port Settings Used by WSUS.

    Example: http://server1.contoso.com:8530

  5. In the Set the intranet statistics server: field, specify the name of the intranet statistics server you want to use. There are no specific requirements for specifying this server. It does not have to be the same computer as the software update point server, and the format does not have to match if it is the same server.

  6. Assign the Group Policy object to the computers on which you want to install the Configuration Manager client and receive software updates.

To publish the Configuration Manager 2007 client to the software update point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Installation Methods.

  2. Right-click Software Update Point Client Installation, and click Properties.

  3. To enable client installation, select the Enable Software Update Point Client Installation check box.

  4. If the client software on the Configuration Manager 2007 site server is a later version than the client version stored on the software update point, the Upgrade Client Package Version dialog box will open. Click Yes to publish the most recent version of the client software to the software update point.

    Note
    If the client software has not been previously published to the software update point, this field will be blank.

  5. To finish configuring the software update point client installation, click OK.

See Also

Tasks

How to Provision Configuration Manager Client Installation Properties using Group Policy
How to Assign Configuration Manager Clients to a Site

Concepts

Decide If You Should Extend the Active Directory Schema
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services
Planning for Software Updates Client Settings

Other Resources

Software Updates in Configuration Manager
Software Distribution in Configuration Manager


How to Install Configuration Manager Clients Using Group Policy

You can use Active Directory Group Policy to publish or assign the Configuration Manager 2007 client to computers in your enterprise. When you assign the Configuration Manager 2007 client to computers using Group Policy, it will be installed when the computer first starts. When you publish the Configuration Manager 2007 client to computers using Group Policy, it will be displayed in the control panel Add or Remove Programs dialog box of the computer, from where it can be installed.

The Windows Installer executable Ccmsetup.msi is used for Group Policy based installations. This file can be found in the folder SMS\bin\i386 on the Configuration Manager 2007 site server. It is not possible to add properties to this file to modify installation behavior.

If the Active Directory Schema is extended for Configuration Manager 2007 and Publish this site in Active Directory Domain Services is selected in the Advanced tab of the Site Properties dialog box then client computers will automatically search Active Directory for installation properties.

If the Active Directory schema has not been extended, then you can use the procedures specified in How to Provision Configuration Manager Client Installation Properties using Group Policy and How to Assign Configuration Manager Clients to a Site to store installation properties in the registry of computers which will be used when the Configuration Manager 2007 client is installed.

For information about using Active Directory Group Policy to install software, refer to your Microsoft Windows server documentation.

See Also

Tasks

How to Provision Configuration Manager Client Installation Properties using Group Policy
How to Assign Configuration Manager Clients to a Site

Concepts

About Configuration Manager Client Installation Properties
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services
Overview of Configuration Manager Client Deployment


How to Install Configuration Manager Clients Manually

You can manually install the Configuration Manager 2007 client software on computers in your enterprise by using the CCMSetup.exe executable. This executable and its supporting files can be found in the SMS\Client folder on the Configuration Manager 2007 site server and management points in your site.

CCMSetup.exe copies all necessary installation prerequisites to the client computer and calls client.msi to perform the client installation.

Note
In Configuration Manager 2007, you cannot run client.msi directly.

Important
If you are installing the Configuration Manager Client to workgroup computers you should publish the management point information in Domain Name System (DNS) to support clients in an IPv6 environment.

You can specify command line properties for both CCMSetup.exe and client.msi to modify the behavior of the client installation. For example, if you specify the command line CCMSetup.exe /mp:SMSMP01 /logon SMSSITECODE=AUTO FSP=SMSFP01, then the client installation would use the following properties:

Property | Description
/mp:SMSMP01 | Specifies the management point SMSMP01 to download the necessary client installation files.
/logon | Specifies that the installation should stop if an existing Configuration Manager 2007 or SMS 2003 client is found on the computer.
SMSSITECODE=AUTO | Specifies that the client should determine its Configuration Manager 2007 site code by using Active Directory or the server locator point.
FSP=SMSFP01 | Specifies that the fallback status point named SMSFP01 will be used to receive state messages sent from the client computer.

A full list of client installation properties can be found in the topic About Configuration Manager Client Installation Properties.

If the Active Directory Schema is extended for Configuration Manager 2007 and Publish this site in Active Directory Domain Services is selected in the Advanced tab of the Site Properties dialog box then client computers will automatically search Active Directory for installation properties.

Note
CCMSetup.exe requires administrative rights to the client computer. If the user running CCMSetup.exe does not have administrative privileges, then the installation will fail.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services


How to Install Configuration Manager Clients Using Logon Scripts

Configuration Manager 2007 supports the use of logon scripts to install the Configuration Manager 2007 client software. You can use the file CCMSetup.exe in a logon script to trigger the client installation.

Logon script installation uses the same methods as manual client installation. You can specify the /logon installation property for ccmsetup.exe which prevents the client from installing if any version of the client already exists on the machine. This prevents reinstallation of the client from taking place each time the logon script runs.

If no installation source is specified using the /Source switch and no management point from which to obtain installation is specified using the /MP switch, CCMSetup.exe can locate the management point by searching Active Directory if the schema has been extended for Configuration Manager 2007. If the schema has not been extended then CCMSetup will search WINS for a server locator point to query for a management point from which to install the client.

See Also

Concepts

How to Install Configuration Manager Clients Manually
Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties
Decide If You Should Extend the Active Directory Schema


How to Upgrade Clients Using Software Distribution in Configuration Manager

You can use Configuration Manager 2007 software distribution to upgrade the client software on computers in your enterprise. A package definition file is supplied with Configuration Manager 2007 which populates the package properties with commonly used values. You can customize the behavior of the client installation by specifying additional command line properties.

Note
Software distribution can only be used to upgrade the client software. It cannot be used for new client installations.

When you have created the package, you can use software distribution to advertise it to collections of computers on your Configuration Manager 2007 site.

Important
Microsoft Background Intelligent Transfer Service (BITS) is a prerequisite for client installation. When BITS is installed on client computers a restart is generally required. If BITS is being installed during client installation (by CCMSetup.exe), then the client installation will not complete until the computer is restarted. For this reason, it is recommended that you pre-deploy BITS on client computers before you install or upgrade the Configuration Manager 2007 client.

Use this procedure to create a Configuration Manager 2007 package which can be distributed to computers to upgrade the client software:

To create a Configuration Manager Package containing the client software:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right click the Packages node, click New and then click Package From Definition.

  3. On the Welcome page of the Create Package from Definition Wizard, click Next to Continue.

  4. On the Package Definition page of the Create Package from Definition Wizard, select Microsoft from the Publisher drop-down list, select Configuration Manager Client Upgrade from the Package Definition list and then click Next.

  5. On the Source Files page of the Create Package from Definition Wizard, select Always obtain files from a source directory and then click Next.

  6. On the Source Directory page of the Create Package from Definition Wizard, select Network path (UNC Name) and enter the network path to the computer and folder containing the Configuration Manager 2007 client installation files.

    Note
    The computer on which the Configuration Manager 2007 advertisement runs must have access to this network location. If it does not have access then the installation will fail.

  7. To continue, click Next.

  8. Click Finish to close the Create Package from Definition Wizard.

  9. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages / Microsoft Configuration Manager Client Upgrade 4.0 ALL / Programs.

  10. Right-click the program Advanced Client Silent Upgrade and then click Properties.

  11. In the Advanced Client Silent Upgrade Dialog box, make any required changes or additions to the setup properties in the Command Line field and then click OK. The default installation properties are /noservice SMSSITECODE=AUTO.

  12. Copy the package to all required Configuration Manager 2007 distribution points.

    Note
    You should specify the name of the site fallback status point if one has been defined using the client.msi property FSP=<fallback status point name>. For a list of all installation properties, see About Configuration Manager Client Installation Properties.

    Important
    If any installation properties are specified after the CCMSetup.exe command, the client will not search Active Directory for additional installation properties.

See Also

Tasks

How to Create a Package
How to Create an Advertisement
How to Provision Configuration Manager Client Installation Properties using Group Policy

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties


How to Install Configuration Manager Clients Using Computer Imaging

Topic last updated—November 2007

You can pre-install the Microsoft System Center Configuration Manager 2007 client software on a master image computer that will be used to build computers in your enterprise. To install the client on a master computer, you must not specify a site code to assign the client to. When computers are imaged from this master image, they will contain the Configuration Manager 2007 client, but this will not be assigned to any site code.

Important
The imaged computers will not be functional Configuration Manager 2007 clients until the Configuration Manager 2007 clients are assigned to a Configuration Manager 2007 site.

You must remove any computer-specific certificates that are installed on the master image computer. For example, if you are in native mode, you must remove the client authentication certificate before imaging the computer.

If clients cannot query Active Directory Domain Services to locate a management point, they use the trusted root key to determine trusted management points. If all imaged clients will be deployed in the same hierarchy as the master computer, leave the trusted root key in place. If the clients will be deployed in different hierarchies, you should remove the trusted root key; however, you should consider a process to pre-provision the newly imaged computers with the trusted root key for their site hierarchies. For more information, see About the Trusted Root Key.

Use the following procedure to install the Configuration Manager 2007 client on your master computer and to prepare it for imaging.

To prepare the client computer for imaging

  1. Manually install the Configuration Manager 2007 client software on the master image computer. For more information, see How to Install Configuration Manager Clients Manually.

    Important
    Do not specify a Configuration Manager 2007 site code for the client in the CCMSetup.exe command-line properties.

  2. Type net stop ccmexec from a command prompt to ensure that the SMS Agent Host service (Ccmexec.exe) is not running on the master image computer.

  3. Remove any certificates stored in the local computer store on the master image computer. Additionally, remove any native-mode client certificates if applicable. For more information, refer to your public key infrastructure (PKI) documentation.

  4. If the clients will be installed in different Configuration Manager 2007 hierarchies than the master image computer, remove the Trusted Root Key from the master image computer. For more information, see How to Remove the Trusted Root Key.

  5. Use your imaging software to capture the image of the master computer.

  6. Deploy the image to destination computers.

See Also

Concepts

About Configuration Manager Client Installation Properties
How to Install Configuration Manager Clients Manually
Overview of Configuration Manager Client Deployment

Other Resources

How to Manage the Trusted Root Key in Configuration Manager


How to Install Configuration Manager Clients on Workgroup Computers

Configuration Manager 2007 supports client installation for computers in workgroups. You can install workgroup computers using the method specified in How to Install Configuration Manager Clients Manually.

The following prerequisites must be met in order to install the Configuration Manager 2007 client on workgroup computers:

  • The client must be installed manually on each workgroup computer. During installation, the logged-on user must possess local administrator rights on the workgroup computer.
  • The workgroup computer must be able to locate a server locator point to complete site assignment because they cannot query Active Directory Domain Services. The server locator point can be manually published in WINS, or it can be specified in the CCMSetup.exe command line properties.

There are a number of limitations to supporting workgroup computers in WINS:

  • Workgroup clients cannot locate their default management point from Active Directory Domain Services, and instead must use DNS, WINS, or a server locator point. For more information, see Configuration Manager and Service Location (Site Information and Management Points).
Important
Workgroup clients assigned to native mode sites cannot locate management point information in WINS. The preferred alternative method for workgroup clients to find their default management point is to use DNS publishing. For more information, see Determine If You Need to Publish to DNS.

  • Global roaming is not supported, because clients cannot query Active Directory Domain Services for site information.
  • Native mode clients cannot be automatically configured for options related to native mode, such as native mode communication, certificate selection, and the option to allow HTTP communication for roaming and site assignment. These options must be specified using CCMSetup.exe command line properties.
  • Active Directory discovery methods will not discover computers in workgroups.
  • Advertisements targeted to users are not possible.
  • The client push installation method cannot be used to install the client on workgroup computers.
  • A workgroup client cannot be used as a branch distribution point. Configuration Manager 2007 requires that the branch distribution point computers be members of a domain.

See Also

Tasks

How to Configure Configuration Manager Clients to Find their Management Point using DNS Publishing

Concepts

Overview of Configuration Manager Client Deployment
How to Install Configuration Manager Clients Manually
About Configuration Manager Client Installation Properties
Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)
Determine If You Need a Server Locator Point for Configuration Manager Clients

Other Resources

Configuration Manager Supported Configurations


How to Manage the Trusted Root Key in Configuration Manager

Trusted root key management is not required. If you have extended your schema for Microsoft System Center Configuration Manager 2007 and are publishing to Active Directory Domain Services, then you do not need the following section. However, if your client computers cannot query Active Directory to retrieve the list of valid management points, then configuring the trusted root key is recommended to help clients establish their initial trust relationship with a valid management point.

In This Section

How to Pre-provision the Trusted Root Key on Clients

Describes the procedure to place the trusted root key on the client computer during installation.

How to Verify the Trusted Root Key

Describes the procedure to view the trusted root key configured in the client computer's WMI repository

How to Remove the Trusted Root Key

Describes the procedure to remove the trusted root key. This is useful when moving computers between sites in different hierarchies.

See Also

Concepts

About the Trusted Root Key

Other Resources

Tasks for Installing Configuration Manager Clients


How to Pre-provision the Trusted Root Key on Clients

Microsoft System Center Configuration Manager 2007 mixed mode clients have a small window of vulnerability when establishing trust with the management point for their site. If clients cannot query the global catalog for Configuration Manager 2007 information, and if you do not pre-provision the trusted root key on the client during installation, the client will trust the first management point it contacts and accept a trusted root key from that management point. It would be difficult, but not impossible, for an attacker to attempt to hijack the initial communication and trick the client into trusting a fake copy of the trusted root key. To mitigate this threat, you can give the client a copy of the trusted root key when you install it.

Note
This procedure is not necessary in native mode because trust is established using the PKI certificates. This procedure is not necessary if clients can query the global catalog for management point information. For example, if you have enabled Active Directory publishing then clients in the same forest can query the global catalog, but workgroup clients and clients in different forests should use this procedure.

If you have already installed your clients, this procedure is probably too late to be of value as a security mitigation because the clients have probably already established a trust relationship with the management point. You can still verify that the trusted root key on a client is the correct trusted root key. For more information, see How to Verify the Trusted Root Key. If you detect an invalid trusted root key, remove the trusted root key and then use this procedure to re-provision the correct trusted root key. For more information about removing the trusted root key, see How to Remove the Trusted Root Key.

If you move clients between sites in the same hierarchy, you do not need to change the trusted root key because all sites in the same hierarchy use the same trusted root key. If you migrate your clients to a new hierarchy, you should pre-provision the clients with the trusted root key for the new site hierarchy using the SMSROOTKEYPATH as described in this topic. SMSROOTKEYPATH will overwrite the old trusted root key. You could also remove the trusted root key and allow the client to establish trust with a management point in a new site, but pre-provisioning is the more secure option.

For more information about the trusted root key, see About the Trusted Root Key.

To pre-provision the trusted root key using a file

  1. In a text editor, edit the file <Configuration Manager directory>\bin\<platform>mobileclient.tcf.

  2. Locate the entry SMSPublicRootKey= and copy the key from that line to a text file.

  3. Save the text file with the trusted root key to a file and place it somewhere where all computers can access it but the file is safe from tampering.

  4. When you install the client, using any client installation method, use the Client.msi property SMSROOTKEYPATH=<Full path and filename>.

To pre-provision the trusted root key without using a file

  1. In a text editor, edit the file <Configuration Manager directory>\bin\<platform>mobileclient.tcf.

  2. Locate the entry SMSPublicRootKey= and write down the key or copy it to the Clipboard.

  3. When you install the client, using any client installation method, use the Client.msi property SMSPublicRootKey=<key>, where key is the string you copied from mobileclient.tcf.

See Also

Other Resources

How to Manage the Trusted Root Key in Configuration Manager
Tasks for Configuration Manager Security


How to Verify the Trusted Root Key

If you are not sure if a Microsoft System Center Configuration Manager 2007 client computer has received the trusted root key, or if you want to verify that a client has the correct trusted root key, you can view the trusted root key in the WMI on the Configuration Manager 2007 client computer.

Procedure

To verify the installation of the trusted root key

  1. From the Start menu, click Run, and then type Wbemtest.

  2. In the Windows Management Instrumentation Tester dialog box, click Connect. The Connect dialog box appears.

  3. In the Connect dialog box, in the Namespace field, type root\ccm\locationservices, and then click Connect. The Windows Management Instrumentation Tester dialog box reappears.

  4. In the IWbemServices section, click Enum Classes. The Superclass Info dialog box appears.

  5. In the Superclass Info dialog box, select Recursive, and then click OK. The Query Result window appears.

  6. In the Query Result window, scroll to the end of the list, and then double-click TrustedRootKey (). The Object editor for TrustedRootKey dialog box appears.

  7. In the Object editor for TrustedRootKey dialog box, click Instances. A new Query Result window appears to display the instances of TrustedRootKey.

  8. In the Query Result window, double-click TrustedRootKey=@. The Object editor for TrustedRootKey=@ dialog box appears.

  9. In the Object editor for TrustedRootKey=@ dialog box, in the Properties section, scroll down to TrustedRootKey CIM_STRING. The string in the right column is the trusted root key. It should match the SMSPublicRootKey in the file <Configuration Manager directory>\bin\<platform>mobileclient.tcf.

See Also

Other Resources

Tasks for Configuration Manager Security
How to Manage the Trusted Root Key in Configuration Manager


How to Remove the Trusted Root Key

If you move a Microsoft System Center Configuration Manager 2007 client from one hierarchy to a different hierarchy and to a site that does not have the schema extended for Configuration Manager 2007, you must remove the trusted root key before moving the client to the new site or the client will not trust the management point at the new site and will not receive policy.

To remove the trusted root key

  • On the client computer, run CCMSetup RESETKEYINFORMATION = TRUE.

See Also

Concepts

About the Trusted Root Key

Other Resources

How to Manage the Trusted Root Key in Configuration Manager
Tasks for Configuration Manager Security


Tasks for Configuration Manager Client Assignment

After a Configuration Manager 2007 client is installed, it must be assigned to a site before it can be managed.

Before assigning clients to a site, ensure that one of the following conditions are true:

  • The site must be publishing to Active Directory Domain Services, and clients are in the same Active Directory forest as the site server's forest.
  • There is a server locator point deployed in the Configuration Manager 2007 hierarchy and clients can either automatically locate it, or are directly assigned to it.

The exception to these requirements for site assignment is if you assign a client to an Internet-based site that does not manage clients on the intranet. In this scenario, you directly assign the site to the client and there is no requirement for retrieving information from Active Directory Domain Services, or from a server locator point.

For more information about site assignment, see About Client Site Assignment in Configuration Manager and Determine If You Need a Server Locator Point for Configuration Manager Clients.

Click any link in the following section for procedural information about assigning clients to sites.

In This Section

How to Assign Configuration Manager Clients to a Site

How to Verify Configuration Manager Site Assignment

See Also

Tasks

How to Publish Configuration Manager Site Information to Active Directory Domain Services

Concepts

Overview of Configuration Manager Client Deployment
Supported Scenarios for Internet-Based Client Management

Other Resources

How to Extend the Active Directory Schema for Configuration Manager
Tasks for Configuration Manager Client Deployment
Planning and Deploying Clients for Configuration Manager 2007


How to Assign Configuration Manager Clients to a Site

Topic last updated -- November 2007

Assign a Configuration Manager 2007 client to a site in one of the following ways:

  • Assign or reassign the client during installation, by either providing the Configuration Manager 2007 site code or by setting this to AUTO to automatically discover a site.
  • Manually assign or reassign the client after installation.
  • Use Windows Group Policy to assign or reassign the client.
  • If the Active Directory schema has been extended for Configuration Manager 2007 and the SMSSITECODE installation property is set to AUTO, the client will query a management point to determine its assigned site.

If you automatically assign clients to sites, the clients' IP address must be within the site boundaries of a Configuration Manager 2007 site.

If you assign or reassign the client to a site using Windows Group Policy, the site code is stored in a registry key on client computers. To reassign a client to another site, change the Group Policy setting to update the registry key. Use the Group Policy administrative template named ConfigMgr2007Assignment.adm supplied in the folder TOOLS\ConfigMgrADMTemplates on the Configuration Manager 2007 installation media to apply the site assignment configuration to client computers.

Important
You cannot change the value of this registry key directly.

Use the following procedures to assign a site to the Configuration Manager 2007 client during and after installation:

To assign the client to a site during installation using client push:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Installation Methods.

  2. Right-click Client Push Installation, and then click Properties to open the Client Push Installation Properties dialog box.

  3. On the Client tab, enter the SMSSITECODE command line property in the Installation properties: field as one of the following:

    • SMSSITECODE=AUTO to automatically assign a Configuration Manager 2007 site.
    • SMSSITECODE=<site code> to assign the client to the specified site.

  4. Click OK.

To assign the client to a site during installation using the command line:

  • Refer to How to Install Configuration Manager Clients Manually and specify the client.msi property SMSSITECODE as one of the following:

    • SMSSITECODE=AUTO to automatically assign the client Configuration Manager 2007 site.
    • SMSSITECODE=<site code> to assign the client to the specified site.

To assign the client to a site after installation using Configuration Manager:

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and double-click to open its properties.

  2. Click the Advanced tab, and specify the site code to assign the client to in the Currently assigned to site code: field.

    Note
    You can automatically find the local site code by clicking Discover.

  3. Click OK.

    Note
    For more information about the options in this dialog box, see Configuration Manager Properties: Advanced Tab.

To assign the client to a site after installation using Windows Group Policy:

  1. Import the administrative template ConfigMgr2007Assignment.adm into a new or existing Group Policy object, using an editor such as Windows Group Policy object editor.

  2. Open the properties of the imported setting Configure Site Assignment.

    Note
    If you cannot see the properties of the imported administrative template, this might be because the filtering options for your Group Policy editor are preventing these from being displayed. Specify less restrictive filter options to display these properties. For instance, in the Filtering options dialog box of the Windows Group Policy Object Editor, clear the checkbox Only show policy settings that can be fully managed.

  3. Click Enabled.

  4. In the Assigned Site field, enter the three character code of the Configuration Manager 2007 site you want to assign computers to.

  5. In the Site Assignment Retry Interval (Mins) field, enter the retry interval the client should use when attempting to assign to the specified Configuration Manager 2007 site. The default value is 60 minutes.

  6. In the Site Assignment Retry Duration (Hours) field, enter the maximum length of time that the client should attempt to try and assign to the specified Configuration Manager 2007 site. The default value is 12 hours.

  7. Assign the Group Policy object to the computers that you want to assign or reassign to the Configuration Manager 2007 site code included in the Group Policy object.

    Note
    For information about Windows Group Policy, refer to your Windows Server documentation.

See Also

Tasks

How to Upgrade Clients Using Software Distribution in Configuration Manager

Concepts

About Client Site Assignment in Configuration Manager
Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties
How to Install Configuration Manager Clients Manually
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services


How to Verify Configuration Manager Site Assignment

You can use a number of methods to verify that your Configuration Manager 2007 clients have successfully assigned to a site. These methods include the following:

  • View Configuration Manager client assignment reports.
  • View the assignment status of the client in the Configuration Manager console.
  • View the client's assigned site in Systems Management on the client computer.
  • Examine the client log files.
Important
The client assignment reports display information sent from the Configuration Manager 2007 site fallback status point. If client computers are not assigned to a fallback status point, these reports will not display data for these clients. For information about assigning a fallback status point, see How to Assign the Fallback Status Point to Configuration Manager Client Computers.

To view the client assignment reports:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the report you want to display, and then select Run from the menu. The following reports are available with the report category of Site - Client Information:

    • Client Assignment Success Details
    • Client Assignment Failure Details
    • Client Assignment Status Details
    • Client Assignment Detailed Status Report

To view the assignment status of the client in the Configuration Manager console:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections / All Systems.

  2. In the All Systems collection, examine the entries for Site Code and Assigned for the client computer that you want to verify. If the client has been successfully assigned, the Assigned column will display Yes and the Site Code column will display the name of the site to which the client computer has been assigned.

To view the client's assigned site in Configuration Manager on the client computer:

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and then double-click to open its properties.

  2. Click the Advanced tab.

  3. Verify that the site code displayed in the Currently assigned to site code: field is correct, and then click OK.

    Note
    For more information about the option in this dialog box, see Configuration Manager Properties: Advanced Tab.

To examine the client log files:

  1. On the client computer, open the file ClientLocation.log in the folder %windir%\system32\CCM\Logs.

  2. Review the log file to verify that the assigned site is correct.

See Also

Concepts

About the Fallback Status Point in Configuration Manager
Overview of Configuration Manager Client Deployment
Log Files for Managing Configuration Manager Clients
About Reports for Configuration Manager Clients

Other Resources

Tasks for Installing Configuration Manager Clients


Tasks for Configuration Manager Internet-Based Client Management

If the Configuration Manager 2007 site is configured for Internet-based client management, there are various tasks specific to configuring and monitoring clients in a site that supports Internet-based client management.

Before configuring clients for Internet-based client management, ensure that the site is configured correctly, and that the supporting infrastructure is in place. These steps are covered in the following topic: Administrator Checklist: Configuring a Site for Internet-Based Client Management.

Click any link in the following section for tasks associated with managing clients in an Internet-based site.

In This Section

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point

How to Configure Configuration Manager Client Computers to Access Their Internet-Based Management Point with a Proxy Server

How to Configure Configuration Manager Client Computers for Internet or Intranet Management

How to Configure Configuration Manager Client Computers for Internet-Only Management

How to Configure Configuration Manager Client Computers for Intranet-Only Management

How to Determine If a Configuration Manager Client Computer Is Currently Managed on the Intranet or the Internet

How to Determine If a Configuration Manager Client Computer Is Configured for Internet-Only Management

See Also

Concepts

Overview of Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Client Deployment
Planning and Deploying Clients for Configuration Manager 2007


How to Assign Configuration Manager Client Computers to the Internet-Based Management Point

Topic Last Updated—August 2008

When Configuration Manager 2007 clients are managed over the Internet, you must configure them with the fully qualified domain name of their Internet-based management point, or their Internet-based network load balanced (NLB) management point. This name must be registered on Internet DNS servers, and match the Internet FQDN configured on the management point that is configured to accept client connections over the Internet, or on the Internet-based NLB management point.

You can configure the Internet-based management point on client computers in the Internet tab of Configuration Manager, or by using a command line configuration, or by using script.

To assign client computers to the Internet-based management point in Configuration Manager Properties

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and then double-click to open its properties.

  2. On the Internet tab, enter the fully qualified domain name of the Internet-based management point in the Internet FQDN text box.

    Note
    The Internet tab is only available if the Configuration Manager 2007 site is running in native mode.

  3. Click OK.

    Note
    For more information about the options on this tab, see Configuration Manager Properties: Internet Tab.

To assign client computers to the Internet-based management point by using a command-line configuration

  • Specify the CCMSetup.exe client.msi property CCMHOSTNAME="<Internet-based management point FQDN>". For more information, see About Configuration Manager Client Installation Properties.

To assign client computers to the Internet-based management point by using a script

  1. Open a text editor, such as Notepad.

  2. Copy and insert the following into the file:

    Copy Code
    on error resume next

' Create variables.
Dim newInternetBasedManagementPointFQDN
Dim client

newInternetBasedManagementPointFQDN = "mp.contoso.com"

' Create the client COM object.
Set client = CreateObject ("Microsoft.SMS.Client")

' Set the Internet-Based Management Point FQDN by calling the SetCurrentManagementPoint method.
client.SetInternetManagementPointFQDN newInternetBasedManagementPointFQDN

' Clear variables.
Set client = Nothing
Set internetBasedManagementPointFQDN = Nothing

  3. Replace mp.contoso.com with the Internet FQDN of your Internet-based management point.

    Note
    If you need to delete a specified Internet-based management point so that the client is not configured to use an Internet-based management point, remove the value inside the quotation marks so that this line becomes newInternetBasedManagementPointFQDN = "".

  4. Save the file with a .vbs extension.

  5. Run the script on client computers, using one of the following methods:

    • Send the file to existing Configuration Manager clients by using software distribution.
    • Run the file locally on existing Configuration Manager clients by double-clicking the script file in Windows Explorer.

See Also

Tasks

How to Configure Configuration Manager Client Computers to Access Their Internet-Based Management Point with a Proxy Server

Concepts

Overview of Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


How to Configure Configuration Manager Client Computers to Access Their Internet-Based Management Point with a Proxy Server

If Configuration Manager 2007 Internet-based client computers need to connect to the Internet using a proxy server, you can configure the following proxy server options:

  • Proxy server fully qualified domain name and port number.
  • Proxy server user name if user authentication is required on the proxy server.
  • Proxy server password if user authentication is required on the proxy server.

You can configure these connection details in the Configuration Manager Properties.

To configure client computers to access their Internet-based management point with a proxy server in Configuration Manager Properties

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and then double-click to open its properties.

  2. On the Internet tab, locate the Proxy Settings section, and then enter the proxy server name or IP address in the Proxy server text box

    Note
    The Internet tab is displayed only if the client is communicating in native mode.

  3. If the proxy server is configured for user authentication, specify the user account in the Proxy server user name text box, and then specify the associated password in the Proxy server password text box.

  4. Click OK.

    Note
    For more information about the options on this tab, see Configuration Manager Properties: Internet Tab.

See Also

Tasks

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point
How to Determine the Site Mode for a Configuration Manager Client

Concepts

Overview of Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


How to Configure Configuration Manager Client Computers for Internet or Intranet Management

When configuring a Configuration Manager 2007 client computer for Internet or intranet management, it must not be configured for Internet-only management and it must be configured with the Internet fully qualified domain name (FQDN) of its Internet-based management point.

To configure client computers for Internet or intranet management

  1. Install the client computer without the CCMSetup.exe client.msi property CCMALWAYSINF=1 for Internet-only management.

  2. Assign the client computer to its Internet-based management point, using one of the following methods:

    • Specify the Internet-based management point on the Internet tab of Configuration Manager from the Control Panel of the client computer.
    • Use the CCMSetup.exe client.msi property CCMHOSTNAME = [FQDN of the Internet-based management point].

    For more information about these methods, see How to Assign Configuration Manager Client Computers to the Internet-Based Management Point.

See Also

Tasks

How to Configure Configuration Manager Client Computers for Internet-Only Management

Concepts

Overview of Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


How to Configure Configuration Manager Client Computers for Internet-Only Management

You can configure Configuration Manager 2007 clients for Internet only management, which means that they will never connect to site systems on the intranet.

Note
Some Configuration Manager features are not supported when clients are managed over the Internet. Ensure that client computers that you configure for Internet-only management do not require these features.

For more information, see Overview of Internet-Based Client Management.

Use the following procedure to configure a Configuration Manager 2007 client computer for Internet-only management.

To configure client computers for Internet only management:

  • Specify the CCMSetup.exe client.msi property CCMALWAYSINF=1. For more information, see About Configuration Manager Client Installation Properties.

    Note
    Installing a client computer with this configuration means that it will be unable to connect to its site's default management point, and any other site system on the intranet. You would therefore need to install the client with additional properties such as the CCMSetup.exe command line property for native mode communication, its assigned site code, and its Internet-based management point.

See Also

Tasks

How to Determine If a Configuration Manager Client Computer Is Configured for Internet-Only Management

Concepts

Overview of Internet-Based Client Management
Decide How to Install Configuration Manager Clients for Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


How to Configure Configuration Manager Client Computers for Intranet-Only Management

If you assign a Configuration Manager 2007 client computer to a site that supports Internet-based client management, but never want the client to be managed over the Internet, configure it for intranet-only client management.

This configuration is achieved by ensuring that the client is not installed for Internet-only communication, and the client is not configured with the Internet fully qualified domain name (FQDN) of the site's Internet-based management point.

To configure client computers for intranet-only management

  1. Install the client computer without the CCMSetup.exe client.msi property CCMALWAYSINF=1.

  2. Do not assign an Internet-based management point on the Internet tab of Configuration Manager from the Control Panel of the client computer, or specify the CCMSetup.exe client.msi property CCMHOSTNAME= [FQDN of the Internet-based management point].

See Also

Tasks

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point
How to Configure Configuration Manager Client Computers for Internet-Only Management

Concepts

About Configuration Manager Client Installation Properties
Overview of Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


How to Determine If a Configuration Manager Client Computer Is Currently Managed on the Intranet or the Internet

Configuration Manager 2007 client computers can be configured for Internet or intranet management. When the computer detects a network change, it can switch from communicating with the Internet-based site systems to the site systems on the intranet, and vice versa.

You can use the ConfigMgr Connection Type property displayed in Configuration Manager to confirm whether the client computer is currently managed on the intranet or on the Internet.

Important
The ConfigMgr Connection Type does not immediately update if you add or remove the Internet-based management point configuration on the client. You must restart the client for this value to update and reflect the correct value.

To determine if a client computer is currently managed on the intranet or on the Internet

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and then double-click to open its properties.

  2. On the General tab, locate the property ConfigMgr Connection Type.

  3. View the value to determine whether the client computer is currently managed on the intranet or currently managed on the Internet:

    • Currently Internet: The client is configured for Internet or intranet management and is currently managed on the Internet.
    • Currently intranet: The client is configured for Internet or intranet management and is currently managed on the intranet.
    Note
    If you see the value Always Internet, the client is configured for Internet-only connections and cannot be managed as an intranet client. If you see the value Always intranet, the client is not configured for Internet-based client management and so cannot be managed on the Internet.

  4. Click OK.

See Also

Tasks

How to Configure Configuration Manager Client Computers for Internet or Intranet Management

Concepts

Overview of Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


How to Determine If a Configuration Manager Client Computer Is Configured for Internet-Only Management

Configuration Manager 2007 client computers can be configured for Internet-only management, which means that they continue to communicate with Internet-based site systems even if they connect to the intranet. Use this configuration only if the client computer will not connect to the intranet.

You can use the ConfigMgr Connection Type property displayed in Configuration Manager to confirm whether the client computer is configured for Internet-only management.

To determine if a client computer is configured for Internet-only management

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and then double-click to open its properties.

  2. On the General tab, locate the property ConfigMgr Connection Type.

  3. If the client computer is configured for Internet-only management, the value of ConfigMgr Connection Type displays Always Internet.

    Note
    If you see the value Currently Internet or Currently intranet, the client is configured for Internet or intranet management. With this configuration, the client will connect to site systems on the intranet if it detects an intranet connection.

  4. Click OK.

See Also

Tasks

How to Configure Configuration Manager Client Computers for Internet-Only Management

Concepts

Overview of Internet-Based Client Management
Decide How to Install Configuration Manager Clients for Internet-Based Client Management
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Tasks for Configuration Manager Internet-Based Client Management


Tasks for International and Multi-Language Configuration Manager Clients

An International Client Pack (ICP) displays the user interface elements of the Configuration Manager 2007 client in the language of the client's operating system.

A Configuration Manager 2007 user who has a localized Configuration Manager 2007 client and a localized operating system can use Configuration Manager 2007 to install software and participate in remote control sessions using the Configuration Manager 2007 client user interface in their own language. Users can also read dialog boxes and menus of the Manual Client Installation Wizard, SMSman.exe, and the Configuration Manager icon in Control Panel in their own language. ICPs include of the following localized files:

  • Client.msi
  • Client.mst
  • A few small supporting files, including language resource files

Deploying a Configuration Manager 2007 ICP in a large environment is a project that requires planning, testing, and then deployment. The phases of the project include design, testing, and installation.

There are a variety of issues you must design and test for while planning a Configuration Manager 2007 ICP deployment, such as the following:

  • Site server localization ICPs are installed only on U.S. English site servers.
  • Client operating system localization ICPs are available for many different localized operating systems, but not all localized operating systems are supported.
  • Effect on the end user Users might be negatively affected if your network cannot adequately support their needs when clients are receiving ICP software.

Deploying an ICP is similar to deploying a service pack. For example, newer program files replace older program files. However, deploying an ICP is dissimilar to deploying a service pack because it does not do anything to the site server except update the client source files. Deploying an ICP does not update files for server components, make changes to the database schema, or perform other non-client upgrade functions.

The content in this section provides the steps necessary to plan, design, test, install and troubleshoot International Client Packs (ICPs) for Configuration Manager 2007.

In This Section

Planning for International Client Pack (ICP) Deployments

Designing the International Client Pack (ICP) Deployment

Testing International Client Packs (ICPs)

Installing International Client Packs (ICPs)

Troubleshooting International Client Pack (ICP) Deployments

See Also

Other Resources

Deploying Configuration Manager Sites in International and Multi-Language Environments
Planning and Deploying Clients for Configuration Manager 2007


Planning for International Client Pack (ICP) Deployments

The following questions reflect some typical issues that you might face when you are planning to deploy an International Client Pack (ICP) in Configuration Manager 2007:

  • Where do you need to install an ICP?
  • Are there steps you must take before applying an ICP?
  • Can you roll back an ICP after it is deployed?
  • Which method do you want to use to install an ICP?
  • Will the deployment of an ICP put a demanding workload on your network or servers?
  • How will an ICP affect users, including those who roam and dial in?
  • Are clients who dial into the Configuration Manager 2007 sites forced to upgrade before they can use the connection?
  • How can you ensure that the ICP deployment is proceeding successfully?
  • Will the application of the ICP regress any fixes previously applied?
  • How do you apply subsequent ICPs, service packs, or hotfixes to sites with an ICP already installed?

These questions are answered during the design and test phases of your ICP deployment. After your issues or concerns are addressed, you will be ready to move to the deployment phase.

When you are planning your ICP deployment, refer to the Release Notes that are provided with the ICP. In addition to the release notes, other documentation about changes introduced by the ICP might become available at the same time as the ICP, which might help you to better understand the ICP. Such documentation is included with the ICP and is in the Configuration Manager 2007 Web site, see (http://go.microsoft.com/fwlink/?linkid=74318).

See Also

Other Resources

Tasks for International and Multi-Language Configuration Manager Clients
Deploying Configuration Manager Sites in International and Multi-Language Environments


Designing the International Client Pack (ICP) Deployment

At a minimum, your Microsoft System Center Configuration Manager 2007 International Client Pack (ICP) deployment design might include the following preparatory tasks:

  • Analyzing the ICP to understand the changes it introduces and any required prerequisites.
  • Analyzing your environment to determine if the deployment will create problems for your users.
  • Scheduling the project, including when each site is upgraded and the roles and responsibilities of staff members who assist you.
  • Communicating relevant details about the ICP deployment to all interested parties, such as users of Configuration Manager 2007 services, management, other Configuration Manager 2007 administrators, and technical staff.
  • Preparing to monitor the deployment to ensure that it is successful.
  • Preparing the sites.

You will repeat most of these tasks in each of the project phases, including design, testing, and deployment.

ICP Requirements

ICPs include release notes that must be carefully reviewed because they describe prerequisites for the ICP, and they address known problems that the ICP does not solve. When you read the release notes, consider your answers to the following questions:

  • Are there any prerequisites that must be implemented before you apply this ICP? Generally, the only prerequisite for an ICP site server installation is that it must be installed on an English-language operating system. However, other requirements might be listed.
  • Does this ICP change Configuration Manager 2007 enough so that you must notify other people who are affected by this change? The people who need notification might include other Configuration Manager 2007 administrators, managers, technical staff, people responsible for the files and security of the domain controllers, people who monitor bandwidth usage, people who use the Configuration Manager 2007 services, and the end users.
  • Does deploying this ICP cause additional load on the network, servers, or clients? If so, then planning the deployment of the service pack can minimize this effect.
  • Is your environment large enough or complex enough to warrant treating the deployment of this ICP as a formal project?
  • Do you have problems with clients that might prevent a successful upgrade? If so, you must resolve these issues before upgrading your clients.
  • How large are the client upgrade components? To determine the size of your upgrade, see the "Determine the size of client component upgrades" section later in this chapter.

Checking versions

ICPs are released in numbered versions including ICP1 and ICP2. Each version supports a greater number of client operating system languages, including the operating system languages of the earlier version.

When you install an ICP on a U.S. English site, the ICP version must be compatible with a previously installed Configuration Manager 2007 service pack version. For example, you must use the Configuration Manager 2007 SP1 version of ICP2 if U.S. English Configuration Manager 2007 SP1 is installed on the site server. You cannot install the SP2 version of the ICP on a U.S. English SP1 site.

After an ICP is installed, you must be aware of the timing of subsequent ICP releases. ICPs are released shortly after each service pack. When a new service pack is released you must wait for the subsequent ICP release before installing the service pack. After you have obtained the ICP, install the service pack, and then install the ICP.

If you are concerned about the stability of the site after you install the service pack, you can wait for the service pack installation to stabilize before you install the ICP. However, your international clients will have an older version of the localized client files until the ICP is installed.

Applying updates

To apply client hotfixes, also called product updates, to an ICP site, you must obtain a hotfixed version of the ICP you have installed. You can identify service pack, ICP, and hotfix numbers from the version number. These minor releases and revisions are the last four digits of the Configuration Manager 2007 version number.

You can determine whether an ICP is installed by checking for multiple language folders, such as the 00000409 folder for English and the 00000407 folder for German on the site server. There is a folder for each client language supported by that ICP.

The first digit of the fourth part of the version number, such as x in x000, is the service pack release number. For example, 2.50.2485.2000 denotes SP2. If the Configuration Manager 2007 version number is 2.50.2485.3000 or higher, then the service pack is SP3.

Additionally, ICP1 has a 4 as the third-to-last digit. For example, 2.50.2485.2400 indicates SP2 ICP1, and 2.50.2485.3400 indicates SP3 ICP1. Likewise, ICP2 has a 7 as the third-to-last digit. For example, 2.50.2485.3700 indicates SP3 ICP2.

The last three digits are the hotfix version number, which can range from .0001 to .0299.

If you apply Configuration Manager 2007 SP2 ICP1 to a Configuration Manager 2007 SP2 U.S. English site that has had several hotfixes installed after SP2 was installed, and files with the same name are included in ICP1, then ICP1 overwrites the newer files because the files in ICP1 do not contain the bug fixes. If the ICP overwrites new files, whatever problems caused you to apply the hotfixes might reappear. For example, you might have previously applied a hotfix to prevent Configuration Manager 2007 APM32 from using the CPU at 100 percent. Later you apply ICP1, which does not contain the hotfix. After ICP1 installation, your site server CPU usage is back to 100 percent. To prevent this from occurring, contact Microsoft Product Support Services and obtain the version of the hotfix that correctly matches the ICP you intend to install before ICP installation. Then, after you install the ICP, immediately install the hotfixes that were released later than the ICP.

Note
Ensure that you install an ICP and ICP hotfixes that correspond to a previously applied Configuration Manager 2007 service pack and post service pack hotfixes

Because ICPs are cumulative and are released as they become available, you might need to plan the deployment of language-specific versions of Configuration Manager 2007 server and client software when the ICP you need becomes available. ICPs have their own setup program and can be installed sequentially onto a site server without any change to the existing clients. All new clients can install in any of the languages from the most recently installed ICP.

Consider the size of the ICPs in relation to the available bandwidth of your network. Later versions of ICPs are larger because each consecutive version contains the languages of the previous versions. Plan the deployment of any language client pack for light network usage periods to minimize degradation of network performance for your users.

Microsoft often releases service packs and client packs on the Web, so that the latest updates can be made available to customers as quickly as possible. The ICPs released by Microsoft contain the current service pack files, in addition to the ICP files, to reduce the number of required installations. These releases are available at http://go.microsoft.com/fwlink/?LinkId=93900.

Site Server ICP Installation Phases

Installation of Configuration Manager 2007 ICP occurs in three phases:

  • Installing an ICP on the site server: Installing an ICP starts with running the ICP setup program on a site server. When the site server is upgraded with the ICP, it automatically upgrades the client source files.
  • Installing an ICP on management point: The client files on management points are automatically upgraded.
  • Installing an ICP on a client: Clients are not automatically upgraded. If an upgrade is required, the administrator must determine the method.

Site component ICP installation methods can be seen in the following table:

Configuration Manager 2007 site component | Method
Site server on primary or secondary site | Running Setup.exe from the ICP source, or package, then manually installing required language packs to the system where the SMS Provider exists.
Site server on secondary site (alternative method) | Running the Upgrade Secondary Sites or Upgrade Site option from the Configuration Manager console, depending on what kind of site node is selected.
Management point | Automatically updated by Inbox Manager.
Distribution points | Not applicable.
Component servers, such as sender servers | Not applicable.
SQL Server if it is installed on a computer other than the site server, or the SMS Provider if it is installed on the SQL Server | Manually installing the required language packs to the system where the SMS Provider exists. For additional information about manually installing language packs, see the ICP release notes.
Configuration Manager consoles on separate computers | Manually adding code pages.

Primary site server ICP installation

The ICP setup program runs on the site server. It stops all components on the site system, copies the client files to the site server, and then restarts all site components on the site system. You can monitor the progress of the setup program with the progress dialog boxes that appear on the site server screen, in the site component manager log, and in the SMSsetup.log, which is in the root of the system drive.

If you use an advertisement to distribute the ICP setup program, ensure that you monitor the status of the advertisement until the ICP installation is complete.

The ICP does not install if Terminal Services is running in execute mode on the site server. The following error message appears when Terminal Services is running in execute mode on the site server:

"Configuration Manager 2007 Setup cannot continue because of the following error: Setup has detected that Windows Terminal Server is running on this computer and the current user session is in the execute mode. You must set the current user session to the install mode in order to run Configuration Manager 2007 Setup."

For Setup to proceed in this case, you must change the user mode to install mode at the command prompt by typing change user /install.

Secondary site server ICP installation

You can upgrade secondary sites by using the Upgrade Secondary Site Wizard. The Upgrade Secondary Site Wizard is used to upgrade multiple sites at the same time. You can initiate the Upgrade Secondary Site Wizard from the Configuration Manager console by selecting the Upgrade Secondary Sites option from the Action menu when a site is selected. The Upgrade Secondary Site Wizard can transfer the necessary files, in an approximately 63-MB package for ICP1, to each site over your WAN. Transferring the files over the WAN can take a long time, depending on the link capacity that is available, so you might want to make the Configuration Manager 2007 software available at the site on CD.

If you have many sites to upgrade with the ICP, then you might want to consider automating their upgrades. This is described in the Automating the installation section in Installing International Client Packs (ICPs).

The Management Point upgrade process

All management points on the site server are upgraded when you install the ICP. When you install an ICP to a site, it typically takes less than 15 minutes to copy the files to the relevant site directories, restart the services, and copy the updated files to a management point and logon point over a 100 MB connection. The following table shows the network traffic required to apply ICPs to a management point in various scenarios.

Scenario | Network traffic
New U.S. English management point installation, no ICP | 42 MB
ICP1 update of existing management point | 35 MB
New ICP1 management point | 48 MB
ICP2 update of ICP1 management point | 72 MB

Client ICP installation

When a client starts its upgrade with a new ICP version, you can check the client status by clicking Configuration Manager in Control Panel. The Components tab of Configuration Manager indicates that the based components have changed to an install pending state. The versions of the client agents change to a pending state with a status of repair pending.

The base components take several minutes to install. The optional components take up to 60 minutes for full deployment.

Note
After the ICP is installed on the client, it is normal for optional component versions to differ from the base component versions.

As an example of the network traffic required to deploy the ICP updates to a single client, the traffic for different Configuration Manager 2007 ICPs is shown in the following table:

ICP version | Base component installation | Optional components | Client
ICP1 | 5.0 MB | 6.9 MB | 6.9 MB
ICP2 | 9.4 MB | 11.7 MB | 9.8 MB

Normally, clients are upgraded by using the same methods that are used to install them. However, Client Push Installation does not automatically upgrade existing clients.

Planning to Monitor

You must plan to monitor the deployment to ensure that the project is proceeding successfully. Isolate and resolve problems while they are still small. Design and test reporting solutions during the early phases of your project and use them before you start the deployment in a production environment.

Using Configuration Manager Version and Upgrade Information

Configuration Manager 2007 version data is available from several different sources, and you can use it by employing a variety of techniques. You can choose from among the following techniques those that are appropriate to your situation:

  • Try to use reporting-based monitoring techniques if you have many computers or sites, or if you want to monitor the deployment closely.
  • Collect version numbers as part of hardware inventory collection if you want to enhance your reporting options, or you could check the registry entries they are stored in.
  • Check the file versions on random computers, if appropriate.

If you develop reports, then create reports that address the following questions:

  • Which sites have been upgraded?
  • What percentage of site servers has been successfully upgraded?
  • Which site servers were not upgraded?
  • Which clients were not upgraded?

To enhance your reporting options, you can collect client component version numbers during hardware inventory collection. For more information, see the "Check the client component versions" section later in this chapter.

To determine the version of a file

  1. Find the file by using Windows Explorer.

  2. Right-click the file and choose Properties.

  3. On the Version tab of the Properties dialog box, read the Product Version property.

For troubleshooting assistance, view the server logs at the sites during your upgrade.

Note
The ICP setup program records its activities in the SMSSetup.log file. You can find this file at the root of your system drive.

Preparing Configuration Manager Sites

Before you deploy an ICP at any site, consider performing a backup. For additional information about backing up your site, see Overview of Backup and Recovery. Whether or not you perform a backup at the site is determined by the following:

  • The risk that the ICP installation poses to the site. In the early stages of the deployment the risk is higher than in later stages, especially if you do not thoroughly test the ICP deployment.
  • The cost involved in restoring a site to a backup, or rebuilding the site, or if the ICP causes irreparable problems. This varies by site and includes the cost of the work itself and of the lack of Configuration Manager 2007 services. The most costly site to lose is typically your central site, and the least costly site to lose is a small site at the lowest levels of your hierarchy. The cost also relates to your business dependence on Configuration Manager 2007 at that site.

The only other preparations required for each site are those required by your project plan or those required by the ICP itself.

See Also

Other Resources

Tasks for International and Multi-Language Configuration Manager Clients
Deploying Configuration Manager Sites in International and Multi-Language Environments


Testing International Client Packs (ICPs)

To test Configuration Manager 2007 International Client Packs (ICPs), prepare a network and a set of client and server computers that simulate your production environment as closely as possible. Consider including similar domain models, localized versions of Configuration Manager 2007, code pages, localized client operating systems, applications, network links, and roaming scenarios. Apply the ICP using the plans and procedures that you created in the design phase. You might consider performing the tests repeatedly in this environment while you refine your procedures and discover and resolve any identified issues.

Select a portion of your production system that is safe to use for testing but typical enough to represent your production system. Ensure that you do not use a domain managed by multiple sites that you do not want to include in the pilot. Ensure that you are in close proximity to test computers so you can easily reconfigure them. Deploy the ICP during this phase using the plan you create in the design phase including any improvements that you identify in the testing phase. If you observe problems that were not identified in the design phase, adjust your procedures and design accordingly.

ICP Deployment Best Practices

Some aspects of Configuration Manager 2007 ICP deployment can be done in a variety of ways, but generally, each has a preferred approach that provides the best results.

Use similar code pages

You must use the same code page for all your Configuration Manager 2007 sites. You must ensure that all sites in a hierarchy can process inventory from all sites below them in the hierarchy, so you must ensure that all code page issues are resolved before applying the ICP. This includes ensuring that the operating system language files are properly installed on all site servers and that all SQL Server computers are using either ANSI 1252 or ISO 8859-1 code page. Ensure that the Automatic ANSI to OEM conversion check box is cleared on all computers running SQL Server.

Apply the ICP hotfixes

ICPs have version numbers that are a version higher than the U.S. English release they upgrade. Great care must be taken to keep hotfixes at the correct version. For more information, see the "Applying updates" section in Designing the International Client Pack (ICP) Deployment.

Conduct research

Peer support from your fellow Configuration Manager 2007 administrators is an excellent source of knowledge and of solutions based on real-world experience. If you hear from other Configuration Manager 2007 administrators that an ICP can cause problems under some circumstances, research the issue to decide whether you will apply the ICP. Conduct your own testing and be cautious for any problems you have heard about. If you do observe the problem, then you can contact product support to confirm or deny the issue, and to receive any fixes or workarounds that might be required.

Determine the size of client component upgrades

To assess the effect of client component upgrades at large sites or over slow links, it is important to determine the size of the client component upgrades. Multiply the size of the upgrade in MB by the number of clients to be upgraded to determine the total network effect. Divide the resulting number by the capacity of the link, in time, to estimate the length of time required for all clients to be upgraded.

You can measure the size of client component upgrades in various terms, including the size of the files transferred, the increase in disk space used, and the increase in memory used. However, usually the most important issue is the effect on the network of deploying the ICP, especially because you might be doing hundreds or thousands of clients in a short period of time.

Using Network Monitor to determine upgrade size: If you need more precise information, then the best approach to determining the size of client component upgrades is to measure the network traffic. To access Network Monitor you must first install it from the Configuration Manager 2007 compact disc. After installation, click Start, then click Microsoft Network Monitor, and then click Network Monitor.

In a test environment, set up a site server and client with the previous version relative to the ICP you want to install. Configure all site server settings to match those used on your production Configuration Manager 2007 site server. Then, upgrade the site server. You can then start a Network Monitor capture session.

To start a Network Monitor capture session:

  1. Start Network Monitor.

  2. On the Capture menu, click Buffer Settings.

  3. The Capture Buffer Settings dialog box appears.

  4. In the Buffer Size (MB) box, click 16, and then click OK.

  5. Configure a capture session to capture network traffic only between your server and the client computer.

  6. On the Capture menu, click Start.

When the capture starts, start the client upgrade by using the client installation method that your site's clients will use. Monitor the client upgrade processing, but do not monitor network traffic, until the client is completely upgraded. You can use the Configuration Manager icon in Control Panel to monitor the upgrade process. When it is completed, return to Network Monitor to stop the capture and analyze the network traffic.

To analyze the network traffic:

  1. In the right pane of Network Monitor, the total number of frames transmitted and the total number of bytes captured is displayed.

  2. In the Session Statistics pane, displayed in the left middle-window pane, the session traffic between the client and the server is displayed. This indicates how much data, in bytes, was sent from the server to the client, and how much information the client sent back to the server.

See Also

Other Resources

Tasks for International and Multi-Language Configuration Manager Clients
Deploying Configuration Manager Sites in International and Multi-Language Environments


Installing International Client Packs (ICPs)

When you install a Configuration Manager 2007 International Client Pack (ICP) on a U.S. English site server, the client source files on the site server are updated. Clients access the site systems to download the client source files. Because the ICP has a version number higher than its corresponding U.S. English version, existing clients detect that an upgrade is available and download the ICP version of the client source files.

Apply the procedures and details that you have developed in other phases to your entire production system. Ideally, this is done using a staged, systematic plan with continual monitoring. Continual monitoring ensures that any missed problems are dealt with before they affect too many systems or users.

Monitoring the ICP Deployment

Monitoring your ICP deployment is important because you must ensure that the deployment proceeds successfully. If problems occur, you can quickly isolate them.

Monitoring ICP deployments is done using a combination of the status subsystem, log files, and relevant classes in the Configuration Manager 2007 site database, and hardware inventory. The following table lists items in the Configuration Manager 2007 console that are updated when each Configuration Manager 2007 component is upgraded, classes that reflect upgraded Configuration Manager 2007 components, and files that can be checked for the correct version number.

Updated items Update status indicators

Site version

To determine which version of the ICP is installed on a site server, check the version value of HKLM\Software\Microsoft\SMS\Setup in the registry of the site server. Also, the SMSsetup.log on the site server has an entry that displays the installation version of the ICP.

Note: the version information displayed in the Configuration Manager 2007 console and SMS_Site class Version property do not include ICP version information.

Management points

Language directories are created and contain language resource files (.mst) files.

Clients

Create a custom query and include the Client Version property from the System Resource class. Create a custom report and include the SMS_R_System class, ClientVersion property.

Client components

Click Configuration Manager in Control Panel. The version is displayed on the Components tab, in the Version column on each client.

Monitor the ICP deployment and answer the following questions:

  • Which sites have been upgraded?
  • What percentage of site servers have successfully upgraded?
  • What percentage of clients has successfully upgraded?
  • Which site servers were unsuccessful in the upgrade?
  • Which clients were unsuccessful in the upgrade?

You can use the Configuration Manager 2007 console to answer these questions, or you can prepare reports to provide these answers for you, as described in the "Planning to Monitor" section in Designing the International Client Pack (ICP) Deployment. From the reports that list unsuccessful server and client upgrades, you can see where you have problems that require further investigation. You can use the status messages at the site for the appropriate Configuration Manager 2007 components. You might also want to look at the log files for the relevant components, and randomly check the files on upgraded computers. These systems include the site server, management points, secondary sites, and clients. The frequency and depth at which you monitor the deployment will be based on several factors including the following:

  • How confident you are that the upgrade will succeed. Good testing and pilot testing, and past experience, will help to increase your confidence.
  • How sensitive users at the site are to problems.
  • How large or complex the site is, and how likely it is to encounter problems.

Installing the ICP

Installing the ICP involves implementing your deployment plan. The installation at each site proceeds automatically after you run the ICP setup program. However, if the installation affects many computers or more than one physical site, then consider whether you need to control the deployment in an automated fashion.

Automating the installation

If you have many sites, you might want to consider automating the site server ICP upgrade. The Icpsetup.exe has an /icpunattended switch that you can use to instruct the setup program to proceed without user interaction, though not silently. You can also install an ICP remotely by using an advertisement or by using Remote Control. You can also install an ICP remotely by using Courier Sender.

A package and advertisement can be created to install the ICP on your primary and secondary sites according to a schedule. If you include the ICP source files in your package, you can configure the package and advertisement as a typical software distribution.

When you automate the installation of ICPs, consider the following issues:

  • If you copy the ICP files to the site server or use the local CD drive, and use a package with no source files, you must create a batch file that calls Icpsetup.exe /icpunattended.
  • The ICP does not install on a server running Terminal Services unless you first change the user mode to install mode at the command prompt using change user /install. You might want to incorporate the command into a batch file. The server should be set back to its Terminal Service mode after running the ICP installation. However, you might want to do that after the ICP installation has been completed, and you have verified the installation was successful.
  • Even if an advertisement runs successfully on the site server, the ICP might not be installed correctly. You must still monitor the site servers, management points, and clients.

ICP setup command-line switch support

ICP Setup (ICPSetup.exe) supports the /icpunattended command-line switch. This switch allows ICP Setup to run without user intervention and is used to silently install ICPs on remote or local systems. Unattended installation is supported in the following scenarios:

  • Install English Configuration Manager 2007 and then install ICP from the CD to a primary or secondary site.
  • Install ICP silently by using an advertisement and program sent to a primary or secondary site system that has the ICP CD already in that system's disc drive.
  • Install ICP by remote controlling the targeted Configuration Manager 2007 site system, then run ICP Setup from the ICP CD in that system's disc drive.
  • Install ICP on a primary or secondary site silently by creating a Configuration Manager 2007 package containing the ICP CD files, create a program that uses the Icpsetup.exe / icpunattended switch, and then create an appropriate assigned and unattended advertisement.
  • Install ICP silently on a remote Configuration Manager 2007 primary or secondary site system by using a Courier Sender package.

Using Software Distribution

If you create a package for the ICP, you can reduce the size of the package by including only the \SMSSETUP folder contents.

Note
An incorrect status message is generated when ICPs are deployed with Configuration Manager 2007 software distribution. When you install an ICP with Configuration Manager 2007 software distribution, the status returned for that advertisement always states that the installation failed because Icpsetup.exe reports a non-zero status code. To verify whether the ICP installation has been properly installed, you can check the SMSsetup.log for the actual installation status.

Controlling the ICP installation

Installing a Configuration Manager 2007 ICP can cause considerable network traffic at large sites or in large organizations and might need to be controlled, because the software is copied to a large number of servers and clients. The load on servers can also be heavy. These effects also occur if your network links are slow.

The following table lists methods that you can use to control the deployment of Configuration Manager 2007 service packs to the Configuration Manager 2007 components.

Upgraded Configuration Manager 2007 component | Method of control
Site server (primary or secondary) | Manually, or by a scheduled advertisement
Secondary site server (optional) | Manually, or by a scheduled job

See Also

Concepts

Overview of Backup and Recovery

Other Resources

Tasks for International and Multi-Language Configuration Manager Clients
Deploying Configuration Manager Sites in International and Multi-Language Environments


Troubleshooting International Client Pack (ICP) Deployments

Troubleshooting the deployment of a Microsoft System Center Configuration Manager 2007 International Client Pack (ICP) deployment can occur any time during the deployment. Use the following sections to help you troubleshoot the deployment of International Client Packs in Configuration Manager 2007.

Isolate the problem

Monitoring the deployment alerts you to an existing problem, but it might not specify where the problem is occurring. Is it unique to the particular client or server? Can the client or server obtain the files it requires? Is the client or server having problems installing the files?

To isolate the problem, you might have to begin at the point where you see the symptoms and then work your way backward through Configuration Manager 2007 processing. Or, you might have to start at the point where you know everything is working properly and then follow the processing forward. For additional information about isolating problems, see the "Site Server ICP Installation Phases" section in Designing the International Client Pack (ICP) Deployment. It is also recommended that you compare computers that are working properly with those that are not working properly.

Understand the Problem

When you have located where the problem originates, you must try to understand why the problem is occurring. Status messages from the Configuration Manager 2007 status system and log files might give helpful details. You can also try to recreate the conditions causing the problem and then check the Configuration Manager 2007 status system for related error messages. It might be helpful to search the Microsoft Knowledge Base for articles. Check the Release Notes for known issues.

Correct the Cause of the Problem

When you isolate the problem and understand it reasonably well, you can correct it. You might have to adjust your procedures, security constraints, or configuration. Normally, you will not delete files, change registry entries, or perform similar steps, because it might not be practical to do the same manual interventions on all the computers that might be affected by this problem.

If it is not possible to fully understand the problem or isolate it, then you might have to guess what the most likely solutions are and then try each of them. Ensure that solutions you devise do not actually make the problem worse, or create new problems.

If you cannot solve the problem by troubleshooting it yourself, then you might have to call someone else to help. This could include other Configuration Manager 2007 administrators, or product support.

In the worst-case scenario you can restore your backup so that the site is restored to a known good state. However, this is a serious and difficult step that must be accomplished with very detailed instructions that are appropriate for your particular situation. To restore a site that has parent or child sites, use the recovery procedures documented in the backup and recovery section.

Typical Problems

To plan the deployment of a Configuration Manager 2007 ICP, you must decide which issues pertain to your environment, and then plan to minimize the effect of those issues. Consider the issues in the following table:

Problem | Potential solution
Bugs might be introduced if you have applied hotfixes that are overwritten by the ICP. | Contact product support to receive the latest ICP containing the corresponding hotfixes.
Customized hardware inventory and custom reports. | Test the reports, and view the hardware inventory. Extended characters might be used and might cause problems with information displayed.
Customized tools or similar programs using the SDK | Ensure your custom programs still work. Test the programs thoroughly in the international environment, ensuring that no bugs are created by dealing with extended characters and double byte characters.

Reports Might Not Display Correctly in Translated Versions

Reports can be run in the results pane of the Microsoft Management Console (MMC) or they can run in separate instances of Internet Explorer. If you configure Configuration Manager 2007 to run the report in the MMC window and you are running a non-English version of Configuration Manager 2007, some of the words in the report might not display correctly.

WORKAROUND Change the Report Options to Open reports in a new window. For more information, see How to Change Options for Running Reports in the Console.

See Also

Other Resources

Tasks for International and Multi-Language Configuration Manager Clients
Deploying Configuration Manager Sites in International and Multi-Language Environments


Tasks for Managing Configuration Manager Clients

Topic last updated—November 2007

When Configuration Manager 2007 clients are installed and assigned to sites, there are various tasks associated with managing these clients on a day-to-day basis.

The content in this section has more information about these tasks.

In This Section

How to Approve Configuration Manager Clients

How to Block Configuration Manager Clients

How to Configure the Temporary Program Download Folder (Cache) for Configuration Manager Clients

How to Uninstall the Configuration Manager Client

How to Manage Conflicting Records for Configuration Manager Clients

How to Clean Up Decommissioned Client Records for Configuration Manager Clients

How to Initiate Policy Retrieval for a Configuration Manager Client

How to Configure the Client Policy Polling Interval for a Specific Collection

See Also

Other Resources

Tasks for Configuration Manager Client Deployment
Planning and Deploying Clients for Configuration Manager 2007


How to Approve Configuration Manager Clients

Approval applies to mixed mode sites in Configuration Manager 2007 and provides additional security to help protect the site from unauthenticated clients when they join a site. It is required for clients that require policy that might contain sensitive data, for example with operating system deployments.

For more information about approval, see About Client Approval in Configuration Manager.

A mixed mode site is configured for one of three approval methods:

  • Manually approve each computer
  • Automatically approve computers in trusted domains
  • Automatically approve all computers

The default setting is to automatically approve computers in trusted domains. With this configuration, the management point must be configured with an intranet fully qualified domain name (FQDN) if clients are not in the same domain as the site server.

Use the following procedures to configure the approval method for the site, and to manually approve client computers if this is required.

Note
You do not need to approve Configuration Manager 2007 clients in native mode environments, or mobile client devices in either site mode.

To approve clients using the site approval configuration:

  1. Open the Configuration Manager console in the primary site in which you need to configure the approval method, and navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name>, and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, select one of the following approval settings:

    • Manually approve each computer
    • Automatically approve computers in trusted domains
    • Automatically approve all computers

  4. Click OK.

    Note
    Changing the site approval method will not automatically reset the approval status of clients already assigned to the site. The new setting will take affect for newly assigned clients only.

    For more information about the options on this dialog box, see Site Properties: Site Mode Tab

To approve clients manually:

  1. Open the Configuration Manager console in the primary site in which the client is assigned, and navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

    Note
    You must approve clients from their assigned site, and cannot approve them from sites higher in the hierarchy.

  2. Locate the Configuration Manager Client to be approved, right-click the client, and then click Approve.

  3. In the Confirm Approval dialog box, click Yes to approve the client.

See Also

Tasks

How to Block Configuration Manager Clients

Concepts

Overview of Configuration Manager Client Deployment
About Client Approval in Configuration Manager
About Client States in Configuration Manager

Other Resources

Tasks for Managing Configuration Manager Clients


How to Block Configuration Manager Clients

If a client computer is no longer trusted, the Configuration Manager administrator can block the client in the Configuration Manager 2007 console. Blocking applies to both native mode and mixed mode sites.

Blocked clients are ignored by the Configuration Manager 2007 hierarchy. This is especially useful for laptop computers or mobile devices that are lost or stolen, to help prevent attackers from using a trusted client to attack the site or the network.

When the client belongs to a native mode site, you can also use certificate revocation to help prevent communication from a computer or device that is no longer trusted.

For more information about blocking, see Determine If You Need to Block Configuration Manager Clients.

Note
Clients accessing the site using the ISV Proxy certificate cannot be blocked. For more information about the ISV Proxy certificate, see the System Center Configuration Manager 2007 Software Development Kit (SDK).

Use the following procedure to block Configuration Manager 2007 clients.

To block Configuration Manager clients

  1. Open the Configuration Manager console in the primary site in which the client is assigned, and navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

    Important
    You must perform this procedure from the client's assigned site. This action cannot be performed from sites higher in the hierarchy.

  2. Locate the Configuration Manager Client to be blocked, right-click the client, and then click Block.

  3. In the Confirm Block dialog box, click Yes to block the client.

    Note
    To unblock a blocked client, right-click the client, and then click Unblock.

See Also

Tasks

How to Approve Configuration Manager Clients

Concepts

Determine If You Need to Block Configuration Manager Clients
Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)
Configuration Manager Site Modes
About Client Approval in Configuration Manager
Overview of Configuration Manager Client Deployment


How to Configure the Temporary Program Download Folder (Cache) for Configuration Manager Clients

You can configure the location and amount of disk space Configuration Manager 2007 clients will use to store temporary downloaded programs. These settings can be configured when you install the Configuration Manager 2007 client manually, when you use client push installation, or after the client is installed.

Use the following procedures to configure the temporary program download folder during manual client installation, or after the client is installed.

To configure the temporary program download folder during manual client installation:

  • Run the CCMSetup.exe command from the install source location, specifying the following properties as required, and separated by spaces:

    • DISABLECACHEOPT:
    • SMSCACHEDIR:
    • SMSCACHEFLAGS:
    • SMSCACHESIZE:
    Note
    For more information about these command line properties for CCMSetup.exe, see About Configuration Manager Client Installation Properties.

 To configure the temporary program download folder when installing clients using client push installation:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Installation Methods.

  2. Right-click Client Push Installation, and click Properties to open the Client Push Installation Properties dialog box.

  3. On the Client tab, specify the following properties as required, separated by spaces:

    • DISABLECACHEOPT:
    • SMSCACHEDIR:
    • SMSCACHEFLAGS:
    • SMSCACHESIZE:
      Note
      For more information about these command line properties for CCMSetup.exe, see About Configuration Manager Client Installation Properties.

  4. Click OK.

 To configure the temporary program download folder after the client is installed:

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and then double-click to open its properties.

  2. Click the Advanced tab.

  3. Under Amount of disk space to use: (MB), specify the amount in MB to reserve for downloaded programs.

  4. To change the location of the temporary program download folder, click Change Location, and then specify the new location. The default location is %windir%\system32\CCM\Cache.

  5. To delete all of the files currently stored in the temporary program download folder, click Delete Files.

  6. Click OK.

See Also

Concepts

About Configuration Manager Client Installation Properties

Other Resources

Tasks for Installing Configuration Manager Clients


How to Uninstall the Configuration Manager Client

You can uninstall the Configuration Manager 2007 client software from a computer by using CCMSetup.exe with the /Uninstall switch. Run CCMSetup.exe on an individual computer from the command prompt or use Configuration Manager 2007 software distribution to uninstall the client on a collection of computers by using a script.

Use the following procedure to uninstall the Configuration Manager 2007 client.

To uninstall the Configuration Manager client

  1. Open a Windows command prompt and change the folder to the location in which CCMSetup.exe is located.

  2. Type Ccmsetup.exe /uninstall, and then press Enter.
Note
The uninstall process is silent and displays no results on the screen. To verify that client uninstallation has succeeded, examine the log file CCMSetup.log in the folder %windir%\system32\ccmsetup folder on the client computer.

See Also

Tasks

How to Block Configuration Manager Clients

Concepts

Overview of Configuration Manager Client Deployment


How to Manage Conflicting Records for Configuration Manager Clients

Microsoft System Center Configuration Manager 2007 uses the hardware ID to attempt to identify clients that might be duplicates and alert you to the conflicting records. For example, if you have to reinstall a computer, the hardware ID would be the same but the GUID used by Configuration Manager 2007 might be changed.

You can configure a site-wide setting to tell Configuration Manager 2007 whether to automatically create new records when it detects duplicate hardware IDs, or to allow you to decide when to merge, block, or create new client records. If you decide to manually manage duplicate records, you must manually resolve the conflicting records.

In addition to manually resolving conflicting records at the site level, you can resolve conflicts centrally in the entire hierarchy, if the entire branch of the hierarchy is configured to manually resolve conflicting records.

Important
If the entire branch of the hierarchy is not set to manually resolve conflicting records, the conflicting records will not appear in the parent site Configuration Manager 2007 console.

To change the site-wide settings for managing conflicting records

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Advanced tab, click either Manually resolve conflicting records or Automatically create new client records for duplicate hardware IDs.

  4. Click OK.

To manually resolve conflicting records

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Conflicting Records.

  2. In the results pane, select one or more conflicting records.

  3. In the Actions pane, select one of the following:

    • Merge to combine the newly detected record with the existing client record, creating one unified record.
    • New to create a new record for the conflicting client record.
    • Block to create a new record for the conflicting client record, but mark it as blocked.

See Also

Tasks

How to Block Configuration Manager Clients

Reference

Conflicting Records
Site Properties: Advanced Tab


How to Clean Up Decommissioned Client Records for Configuration Manager Clients

When Configuration Manager 2007 clients are deleted from a child site, the record is not automatically deleted from the parent site. However, the client record at the parent site is marked as decommissioned. You can display decommissioned client records in the Configuration Manager 2007 console and create collections of decommissioned clients.

Use the following procedures to display decommissioned client records in the collections window of the Configuration Manager console, and to create a collection showing only decommissioned client computers.

To display decommissioned client computer records in the Configuration Manager Console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections / All Systems.

  2. In the Actions pane of the Configuration Manager console, click View, and then click Add/Remove columns.

  3. In the Available columns field of the Add/Remove Columns dialog box, select Decommissioned, and then click Add.

  4. Click OK to close the Add/Remove Columns dialog box.

To create a Configuration Manager collection to display decommissioned client computers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management.

  2. Right-click Collections and then click New Collection.

  3. In the General page of the New Collection Wizard, specify the following values:

    • Name: Enter a descriptive name for the collection such as Decommissioned clients.
    • Comment: Enter a description for the collection, such as Displays all decommissioned client computers.

  4. Click Next to continue.

  5. In the Membership Rules page of the New Collection Wizard, click the new query icon to open the Query Rule Properties dialog box.

  6. In the General tab of the Query Rule Properties dialog box enter a name for the query rule such as Decommissioned clients query.

  7. Click Edit Query Statement to open the Query Statement Properties dialog box.

  8. In the General tab of the Query Statement Properties dialog box, click Show Query Language.

  9. In the Query Statement field of the Query Statement Properties dialog box, copy and paste the following code:

    Copy Code
    Select * from SMS_R_System where SMS_R_System.Decommissioned = 1

  10. Click OK to close the Query Statement Properties dialog box.

  11. Click OK to close the Query Rule Properties dialog box.

  12. In the Membership Rules page of the New Collection Wizard, click Next to continue.

  13. In the Advertisements page of the New Collection Wizard, click Next to continue.

  14. In the Security Page of the New Collection Wizard, click Next to continue.

  15. In the Confirmation page of the New Collection Wizard, click Close.

See Also

Concepts

About Client States in Configuration Manager


How to Initiate Policy Retrieval for a Configuration Manager Client

Topic last updated—November 2007

A Configuration Manager 2007 client downloads its client policy on a schedule. By default, this value is configured to every 60 minutes and is configured with the option Policy polling interval (minutes). (To identify the dialog where you can configure this option, see Computer Client Agent Properties: General Tab.) However, there might be occasions when you want to initiate ad-hoc policy retrieval from the client—for example, in a troubleshooting scenario or when testing.

Use the following procedures to initiate ad-hoc policy retrieval from the client outside its scheduled polling interval, either by using the Actions tab on the Configuration Manager client or by running a script on the computer. You must be logged onto the client computer with local administrative rights to perform these procedures.

Note
The same procedures can be used with the SMS 2003 client, which is named Systems Management in the Control Panel of the client computer.

To manually initiate client policy retrieval using the Actions tab on the Configuration Manager client

  1. Select Configuration Manager in the Control Panel of the computer.

  2. Click the Actions tab.

  3. Click Machine Policy Retrieval and Evaluation Cycle, and then click Initiate Action.

  4. Click OK to confirm the prompt, and then click OK to close Configuration Manager.

To manually initiate client policy retrieval using a script

  1. Open a text editor, such as Notepad.

  2. Copy and insert the following into the file:

    Copy Code
    on error resume next

dim oCPAppletMgr 'Control Applet manager object.
dim oClientAction 'Individual client action.
dim oClientActions 'A collection of client actions.

'Get the Control Panel manager object.
set  oCPAppletMgr=CreateObject("CPApplet.CPAppletMgr")
if err.number <> 0 then
    Wscript.echo "Couldn't create control panel application manager"
    WScript.Quit
end if

'Get a collection of actions.
set oClientActions=oCPAppletMgr.GetClientActions
if err.number<>0 then
    wscript.echo "Couldn't get the client actions"
    set oCPAppletMgr=nothing
    WScript.Quit
end if

'Display each client action name and perform it.
For Each oClientAction In oClientActions

    if oClientAction.Name = "Request & Evaluate Machine Policy" then
        wscript.echo "Performing action " + oClientAction.Name
        oClientAction.PerformAction
    end if
next

set oClientActions=nothing
set oCPAppletMgr=nothing

  3. Save the file with a .vbs extension.

  4. On the client computer, run the file using one of the following methods:

    • Navigate to the file by using Windows Explorer, and double-click the script file.
    • Open a command prompt, and type: cscript <path\filename.vbs>.

  5. Click OK in the Windows Script Host dialog box.

See Also

Tasks

How to Configure the Configuration Manager Computer Client Agent

Concepts

About Client Policy in Configuration Manager

Other Resources

Tasks for Managing Configuration Manager Clients


How to Configure the Client Policy Polling Interval for a Specific Collection

Topic last updated—November 2007

A Configuration Manager 2007 client computer downloads its client policy on a schedule. By default, clients download policy every 60 minutes. This schedule is configured on the Computer Client Agent Properties: General Tab .

However, you might want selected clients to have a more frequent polling interval. To achieve this, configure a collection-specific policy polling interval, which will then apply to members of that collection.

Use the following procedure to specify a collection-specific policy polling interval.

Note
If a client computer is a member of multiple collections with different policy polling intervals, it will use the shortest configured interval.

To configure a collection-specific policy polling interval

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. In the results pane, right-click the collection you want to modify, and then click Modify Collection Settings.

  3. In the Advanced tab of the Collection Properties dialog box, select Enable collection specific policy polling interval, and then specify the required policy polling interval in minutes.

  4. Click OK to close the Collection Properties dialog box.

See Also

Tasks

How to Configure the Configuration Manager Computer Client Agent
How to Initiate Policy Retrieval for a Configuration Manager Client

Concepts

About Client Policy in Configuration Manager
About Collection-Specific Settings


Tasks for Monitoring Configuration Manager Clients

When Configuration Manager 2007 clients are installed and assigned to sites, there are various tasks associated with monitoring these clients to ensure that they remain managed.

The content in this section has more information about these tasks.

In This Section

How to Verify Configuration Manager Client Deployment

How to Determine the Site Mode for a Configuration Manager Client

How to Monitor Changes in Configuration Manager Client Site Modes

How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management

How to Run Reports to Monitor Configuration Manager Clients

See Also

Other Resources

Tasks for Configuration Manager Client Deployment
Planning and Deploying Clients for Configuration Manager 2007


How to Verify Configuration Manager Client Deployment

Verify the success or failure of your Configuration Manager 2007 client deployment by viewing the following reports:

  • Client Deployment Success
  • Client Deployment Failure
  • Client Deployment Status Details
    Important
    These reports use information from the Configuration Manager 2007 site fallback status point. If your site does not have a fallback status point, or if client computers in your site are not assigned to a fallback status point, these reports will not display any data.

Data from these reports is not presented in real time. Depending on the throttle settings you have configured on your fallback status point, it may take some time for data from the fallback status point to reach the Configuration Manager 2007 site server. For more information see Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager.

Use the following procedures to view reports.

Note
You can modify general report properties such as general information, refresh behavior, and link behavior by right-clicking the report you want to modify, and then selecting Properties from the menu.

To view the Client Deployment Success report:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the Client Deployment Success report, and then select Run from the menu.

To view the Client Deployment Failure report:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the Client Deployment Failure report, and select Run from the menu.

To view the Client Deployment Status Details report:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the Client Deployment Status Details report, and select Run from the menu.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Reports for Configuration Manager Clients
About the Fallback Status Point in Configuration Manager

Other Resources

Tasks for Installing Configuration Manager Clients


How to Determine the Site Mode for a Configuration Manager Client

The client site mode configuration determines how the Configuration Manager 2007 client communicates with its assigned site:

  • A client that reports to a site in mixed mode must be configured to communicate in mixed mode.
  • A client that reports to a site in native mode must be configured to communicate in native mode.

If the client and site mode does not match, the client cannot communication with the site and will send an error message to its assigned fallback status point.

Use the Site mode property displayed in the client's Configuration Manager to confirm whether the client computer is configured for native mode or mixed mode management.

To determine a client computer's site mode:

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and double-click to open its properties.

  2. On the General tab, locate the property Site Mode.

  3. The value will display one of the following:

    • Native Mode: the client is currently configured for native mode and will attempt communication with its management point using HTTPS.
    • Mixed Mode: the client is currently configured for mixed mode and will attempt communication with its management point using HTTP.

  4. Click OK.

See Also

Tasks

How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

Configuration Manager Site Modes
About the Fallback Status Point in Configuration Manager


How to Monitor Changes in Configuration Manager Client Site Modes

When you migrate a Configuration Manager 2007 site from mixed mode to native mode, or you want to track the progress of migrating sites in the hierarchy, run the report Summary information of clients in native mode to monitor the change of site mode for clients. This report displays the current site mode of clients and their assigned site.

Additionally, you can check the site mode of a single client using the Site Mode property displayed in Configuration Manager in the Control Panel of a client computer. For this procedure, see How to Determine the Site Mode for a Configuration Manager Client.

For more information about site modes, see Configuration Manager Site Modes.

To monitor the site mode of multiple clients, use the following procedure.

Note
If you are in the process of migrating a site to native mode (or reverting a site to mixed mode) and the site publishes to Active Directory Domain Services, clients that can access this published information will automatically change their site mode so that it synchronizes with their assigned site. However, this process can take some time to complete, typically two polling cycles of the client computer's policy. The policy is configured in the computer client agent properties, and by default is configured for every 60 minutes.

Procedure

To monitor the site mode of clients using a report:

  1. In the Configuration Manager console, navigate to the Reports node, click the Category column to sort the reports so that you can more easily find the reports with the category of Site - Client Information.

  2. Right-click the report Summary information of clients in native mode, and then select Run.

  3. Close the report.

See Also

Tasks

How to Migrate the Site Mode from Mixed Mode to Native Mode
How to Determine the Site Mode for a Configuration Manager Client

Concepts

Administrator Checklist: Migrating a Site to Native Mode
About Reports for Configuration Manager Clients

Other Resources

Tasks for Configuration Manager Client Deployment


How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management

Topic last updated—November 2007

It is useful to identify native mode and Internet-based client management configuration for Configuration Manager 2007 clients for both auditing and troubleshooting purposes. You can also use this information to create query-based collections if you need to target computers with a particular configuration with a script, or software distribution package.

The native mode and Internet-based client management configurations described in the following table are stored in the client's hardware inventory, under SMS Advanced Client SSL Configuration.

Note
There is a known issue with Windows XP and Windows Server 2003 64-bit operating systems that do not display this data. This issue is not known to occur on these 64-bit operating systems with Service Pack 2.

Value Description

Certificate Selection Criteria

Displays the type of certificate selection method and criteria, if specified. The syntax used is the same as the CCMSetup client.msi property CCMCERTSEL. For more information, see About Configuration Manager Client Installation Properties.

Certificate Store

Displays the type of certificate selection method and criteria, if specified. The syntax used is the same as the CCMSetup client.msi property CCMCERTSEL. For more information, see About Configuration Manager Client Installation Properties.

Client Always On Internet

If the client has been installed with the CCMSetup client.msi property CCMALWAYSINF=1, this value displays 1 to indicate that the client will always be Internet-based and cannot be managed as an intranet client. If the client has not been installed with this CCMSetup client.msi property, this value displays 0 to indicate that the client can be managed on both the Internet and on the intranet. For more information, see About Configuration Manager Client Installation Properties.

Https State Flags

This displays a bitmask value to indicate whether the client is configured for native mode, CRL checking, and HTTP for site assignment and roaming:

  • 0 = mixed mode communication.
  • 31 = native mode communication only.
  • 63 = native mode communication and CRL checking.
  • 95 = native mode and HTTP for roaming and site assignment.
  • 127 = native mode communication, CRL checking, and HTTP for roaming and site assignment.

Instance Key

Displays SMSSSLConfiguration.

Internet MP Host Name

Displays the specified Internet-based management point.

Select First Certificate

Displays 0 or 1, to indicate the action to take if the Configuration Manager client finds more than one valid certificate for native mode communication, based on the certificate settings specified:

  • 0 indicates that none of the certificates will be used to attempt a connection. The client will not attempt communication with its management point, and instead it will send an error message to its assigned fallback status point.
  • 1 indicates that the client will select any valid and matching certificate for native mode communication if multiple valid certificates are found in the certificate store, unless the client is running Configuration Manager 2007 SP1, in which case the certificate with the longest validity period is selected. If a connection is not successfully made with this certificate, the other certificates found will not be tried and the client will send an error message to its assigned fallback status point.

Use the following procedures to view this configuration information on a single computer by using Resource Explorer, or for multiple computers by creating and running a Configuration Manager query.

To view a client's native mode and Internet-based client management configuration using Resource Explorer

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Expand Collections, and select the collection that contains the client whose native mode and Internet-based client management configuration you want to view.

  3. Right-click the client name, click All Tasks, and then click Start Resource Explorer.

  4. Navigate to Resource Explorer / Hardware / SMS Advanced Client SSL Configurations, and then view the details in the results pane.

  5. Close Resource Explorer.

To view all clients' native mode and Internet-based client management configuration using a Configuration Manager query

  1. Copy and paste the following Configuration Manager query into a text editor, such as Notepad:

    Copy Code
    select SMS_R_System.NetbiosName, SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.CertificateSelectionCriteria, SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.CertificateStore, SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.ClientAlwaysOnInternet, SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.HttpsStateFlags, SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.InstanceKey, SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.InternetMPHostName, SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.SelectFirstCertificate from  SMS_R_System inner join SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS on SMS_G_System_ADVANCED_CLIENT_SSL_CONFIGURATIONS.ResourceId = SMS_R_System.ResourceId

  2. Remove any configuration options from the query that you do not need to display, and then copy the text to the clipboard.

  3. Create the query by right-clicking the Queries node, click New, and then click Query to launch the New Query Wizard.

  4. On the General page, specify a query name, such as Client native mode configuration and, optionally, specify a description in the Comment box.

  5. Ensure that System Resource is selected as the Object Type, and then click Edit Query Statement.

  6. In the Query Statement Properties dialog box, click Show Query Language.

  7. In the Query Statement Properties dialog box, paste the query into the Query Statement edit box, replacing the text displayed.

  8. Click OK to save the query, and close the Query Statement Properties dialog box.

  9. Click Next on the General wizard page, and then click Finish.

  10. In the Queries results pane, double-click the query that you just created to view the configuration values for each client that has reported this information with their hardware inventory data.

See Also

Tasks

How to Assign Configuration Manager Client Computers to the Internet-Based Management Point
How to Configure Configuration Manager Client Computers for Internet-Only Management

Concepts

About Resource Explorer
Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
Overview of Internet-Based Client Management
Overview of Queries

Other Resources

How to Configure Native Mode
Tasks for Monitoring Configuration Manager Clients


How to Run Reports to Monitor Configuration Manager Clients

Client reports in Configuration Manager 2007 have the report category of Site - Client Information and can be used to help you to plan, deploy, monitor, and troubleshoot clients in Configuration Manager 2007.

Important
Many client reports require that clients are assigned to a fallback status point. For a list of which reports require a fallback status point, see About Reports for Configuration Manager Clients.

To run a client information report:

  1. Ensure you have a reporting point defined for the site.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  3. In the Look For box, type Site - Client Information, ensure the Search In drop-down menu has Category selected, and then click Find Now.

  4. Right-click the client information report that you want to run, and then select Run Report.

See Also

Concepts

About Reporting Points
Reporting in Configuration Manager

Other Resources

Troubleshooting Configuration Manager Client Deployment


Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices

Topic last updated—November 2007

Microsoft System Center Configuration Manager 2007 supports the installation of the Configuration Manager 2007 client on computers and devices running the Microsoft Windows XP Embedded operating system.

The topics in this section provide detailed information about planning, configuring, monitoring, maintaining, and troubleshooting client deployment on Windows XP Embedded computers and devices in Configuration Manager 2007.

In This Section

Overview of Configuration Manager Support for Windows XP Embedded Devices

Provides an overview of Configuration Manager 2007 support for Windows XP Embedded devices.

How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007

Provides tasks for managing Windows XP Embedded write filters using Configuration Manager 2007.

Known Limitations in Configuration Manager Support for Windows XP Embedded

Provides information about known limitations when using the Configuration Manager 2007 client on Windows XP Embedded devices.

Technical Reference for Configuration Manager 2007 Support for Windows XP Embedded Devices

Provides technical reference information for the Configuration Manager 2007 client running on Windows XP Embedded devices.

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Overview of Configuration Manager Support for Windows XP Embedded Devices

Topic last updated—November 2007

Microsoft Windows XP Embedded is a componentized version of Windows XP Professional which allows you to reduce the footprint and increase the security of Windows XP installations by installing only the components of the operating system that the application requires. Typically, devices using Windows XP Embedded might include the following:

  • Point of sale (POS) devices
  • Automated teller machines (ATM)
  • Industrial controllers
  • Gateways
  • Internet Protocol (IP) telephones
  • Server appliances
  • Windows-based thin clients
  • Advanced consumer electronic products
  • Specialized handheld devices

When the Microsoft System Center Configuration Manager 2007 client is installed on a Windows XP Embedded device, the following Configuration Manager 2007 features are supported:

  • Desired Configuration Management
  • Hardware Inventory
  • Software Inventory (with limitations)
  • Software Metering
  • Software Distribution (with limitations)
  • Software Updates Management (with limitations)
  • Remote Tools (with limitations)
  • Remote Desktop
  • Remote Assistance (with limitations)
  • Wake-on-LAN
  • Configuration Manager 2007 reporting for the preceding features
Note
For those features listed as having limitations, see Known Limitations in Configuration Manager Support for Windows XP Embedded.

In This Section

About Write Filters in Windows XP Embedded

Provides general information about write filters in Microsoft Windows XP Embedded.

About Using the Configuration Manager 2007 Client with Write Filters

Provides information about using the Configuration Manager 2007 client on Windows XP Embedded devices when write filters are enabled.

See Also

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


About Write Filters in Windows XP Embedded

Topic last updated -- November 2007

For security and operational reasons, it might be undesirable to write to storage media in Windows XP Embedded devices. By redirecting all write requests to either a separate disk partition or RAM, a write filter allows the run-time image to maintain the appearance of a writable run-time image without committing the changes to the storage media.

Starting with Feature Pack 2007 for Windows XP Embedded Service Pack 2, the following write filters are available:

  • File-based write filter, which operates at the file level
  • Enhanced write filter, which operates at the sector level

Enhanced write filter and file-based write filter redirect all writes targeted for protected volumes to a RAM or disk cache called an overlay. The overlay stores changes made to the operating system but is removed when the device is restarted, restoring the device to its original state.

Enhanced write filter works at the sector level on protected disks and allows you to commit changes so that they persist when the device is restarted. Enhanced write filter is useful for thin clients that do not need to store cached information or receive frequent updates. Changes made to a system protected by enhanced write filter are stored in one or more layers that represent snapshots in time. Applying changes to an image applies all changes made to the operating system during a specific period of time.

File-Based Write Filter works at the file level instead of the sector level on protected disks. By default, file-based write filter protects the whole disk, but selective write through exceptions can be granted to specific files and folders. Writes to folders which have been granted exceptions will be persisted when the device restarts.

Windows XP Embedded also features a registry filter, which monitors all writes to the registry and stores changes in a separate layer that is discarded when the device restarts. For registry writes, the registry filter supports persisting specific registry changes by using registry monitors when the device restarts. This feature is independent from enhanced write filter and file-based write filter and can be used regardless of your specific configuration.

For more information about Windows XPe SP2 Enhanced Write Filter, see http://go.microsoft.com/fwlink/?LinkId=79553.

For more information about Windows XPe SP2 File-Based Write Filter, see http://go.microsoft.com/fwlink/?LinkId=79554.

General Software Update Processes with Enhanced Write Filter or File-Based Write Filter

When you use enhanced write filter or file-based write filter protection on the drive for the Windows XP Embedded device, all uncommitted writes to the device are lost when the device restarts. This includes any software or software updates that have been installed. To persist changes when the device restarts, the enhanced write filter or file-based write filter must be turned off prior to performing the change actions or the changes must otherwise be explicitly committed to the drive using the commit command. This is required regardless of the method used to install software or software updates.

You can take the following steps to persist changes when the device is restarted.

To disable and then enable the write filter

  1. Disable enhanced write filter or file-based write filter. Disabling the filter will take effect after the next device restart. All changes to the system made prior to the device restart are discarded before enhanced write filter is disabled.

    Note
    An alternative to this step is to use the -commitanddisable command for enhanced write filter which will cause all pending write operations to be committed to the storage device before the filter is disabled. This is not recommended because it commits an unknown number of changes to the storage device.

  2. After the device restarts, all new changes are written directly to the storage device. The drive remains unprotected until enhanced write filter or file-based write filter is re-enabled.

  3. The required changes can now be made, such as installing or updating software, and changing system settings.

  4. After the necessary changes to the system have been made, enhanced write filter or file-based write filter can be re-enabled. This causes enhanced write filter or file-based write filter to be enabled after the next device restart. All changes prior to the restart are saved on the storage device.

  5. After restarting the device, the system returns to a protected state.

    Note
    If this procedure fails at any point after disabling the write filter, the system is left in an unprotected state.

 To use the commit command to write changes

  1. Restart the device to clear any changes that were made to the protected volume.

  2. Make the required changes to the system, such as installing or updating software, and changing system settings.

  3. Issue the commit command to cause all changes made to the system to be committed to the storage device after next device restart.

  4. After restarting the device, any changes to the system are committed and the system returns in a protected state.

  5. If any items that have been installed require the device to be restarted, a second restart might be required. Any changes caused by this second restart will be automatically committed to the storage device.

Although the second method does not completely disable the write filter, both methods will write the entire contents of the overlay to disk, regardless of the source of the changes. The second method might also require an additional device restart and commit action to account for installations that have post-restart actions, such as file replacement or drivers or services being installed. With the first method, you can handle any additional restarts as part of your software installation before re-enabling the write filter.

The use of write filters on Windows XP Embedded imposes unique requirements on system administrators who are tasked with change management. One option for administrators is to use a script to automate the additional actions needed to complete a software or software updates installation. For a sample script that performs these write filter modifications, see Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows XP Embedded Devices.

See Also

Tasks

How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007

Concepts

Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows XP Embedded Devices

Other Resources

Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices


About Using the Configuration Manager 2007 Client with Write Filters

Topic last updated—November 2007

When Windows XP Embedded write filters are not enabled, the Configuration Manager 2007 client behaves normally. However, when write filters are enabled, there are differences in functionality depending on which write filters are used.

The Configuration Manager 2007 client utilizes many Windows components on the computer or device on which it is installed. These might, for example include Windows Management Instrumentation (WMI), Background Intelligent Transfer Service (BITS) and Windows Server Update Services (WSUS). Both the Configuration Manager 2007 client and these Windows components store installation and state information in the registry as well as on the primary storage device of the computer or device.

In addition, other folders, files, and registry keys can be modified during the installation of software or software updates on a Configuration Manager 2007 client.

Windows XP Embedded write filters are designed to take these registry and file changes, store them in an overlay, and then discard that overlay when the device restarts. Depending on which write filter you use, the implications of write filters are different for the Configuration Manager 2007 client and Windows components the client utilizes.

Using the Configuration Manager Client with Enhanced Write Filter

The Configuration Manager 2007 client makes frequent writes to the registry and to the storage drive as part of its normal activities, including hardware and software inventory, policy download and evaluation, software distribution, and software updates management. Because enhanced write filter works at the sector level on protected disks, the Configuration Manager 2007 client would be unable to guarantee that only approved changes are committed to the XPe system. For this reason, Configuration Manager 2007 will not automatically manipulate your write filter configuration to persist its own write operations. As part of the management process for your Configuration Manager 2007 Windows XP Embedded clients, you can use one of the procedures provided in About Write Filters in Windows XP Embedded.

The next sections describe specific details for Configuration Manager 2007 when enhanced write filter is used on a Windows XP Embedded device.

Software Distribution and Software Updates Management

Before using Configuration Manager 2007 to distribute software or software updates to devices running Windows XP Embedded, you must ensure that the write filter is disabled.

You can use a script which is initiated by a Configuration Manager 2007 task sequence to disable the write filter, install the necessary updates, and then re-enable the write filter. For more information, see How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007.

Ongoing Client Operation

As a part of its normal operation, the Configuration Manager 2007 client connects with the Configuration Manager 2007 server to download policy information, downloads and caches files for software installation, collects and sends inventory, and sends status and state messages. In addition, Configuration Manager 2007 relies on external processes such as WMI and BITS, which also store state information on the storage drive. Since the write filter provides a transparent shield on the system, these processes continue to happen normally to the system. However, at the next restart, unless data is committed to the drive, all of these changes are lost. This means that when the client restarts and loads Windows, the Configuration Manager 2007 client will begin to operate as if it has not performed any of those operations since the last time the state data for those operations was committed to the storage drive.

As a result of this, the following issues might occur:

  • The Windows XP Embedded client will re-download all Configuration Manager 2007 policies which were rolled back as a result of the device restart.
  • The Windows XP Embedded client will re-download from the Configuration Manager 2007 Distribution Point any software distribution and software updates content that were removed as a result of the device restart.
  • The Windows XP Embedded client will produce new delta software and hardware inventory reports. Depending on the currency of the data found during those scans, the server might additionally request a full scan to resynchronize the client and server.
  • The Windows XP Embedded client will re-send status messages regarding any activities prior to the device restart to the Configuration Manager 2007 site server.

Depending on your specific configuration, you might experience a temporary impact to client performance during initial startup on Windows XP Embedded devices. You might also experience an increase in network traffic to and from the Windows XP Embedded client until the client is again re-synchronized and in an operational state.

Note
To avoid unnecessary network traffic, it is recommended that thin clients be restarted only as needed and otherwise left in a powered on state.

Using the Configuration Manager Client with File-Based Write Filter

Like enhanced write filter, file-based write filter protects the storage drive against changes. File-based write filter works at the file level instead of the sector level on protected disks. By default, the whole disk is protected, but certain folders can be given exceptions, known as selective write through, which allow writes to be persisted across device restarts.

Software Distribution and Software Updates Management

Although selective write through can be employed to allow write operations to specific locations, bypassing the write protection, exclusions for some folders, such as the Windows system folders, or for large parent folders, such as the Program Files folder, are not recommended. Additionally, the folders to be granted exceptions must be known in advance and a restart is required to activate these exclusions. As a result, selective write through can be employed for specific scenarios but might not be practical as a general method for installing software and software updates. Like enhanced write filter, the recommended method to perform change operations using Configuration Manager 2007 is to disable the write filter, make the desired changes, and then re-enable the write filter. For more information, see How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007.

Ongoing Client Operations

Selective write-through can be used to persist state data from the ongoing operations of the Configuration Manager 2007 client and other components it utilizes, such as WMI and BITS. However, this is not recommended because there is no way to specifically limit the necessary exceptions to just the data needed for Configuration Manager 2007. Therefore, the same conditions apply to file-based write filter protected Windows XP Embedded systems as for enhanced write filter protected systems.

Using the Configuration Manager Client with Registry Filter

In addition to the two disk write filters, there is a registry filter available for Windows XP Embedded that protects the registry against changes, discarding uncommitted changes at each restart. The registry filter does not use the enable, disable, or commit commands but can persist changes across restarts through the use of monitors. A registry monitor essentially takes changes to the registry and writes them to a temporary file, which is then re-imported to the registry following each restart. As with exceptions to the file-based write filter, the registry exceptions must be known in advance and must be configured while the active write filter, either enhanced write filter or file-based write filter, is disabled.

Consult your hardware vendor to see if registry filter exceptions are an available option for your device.

Other Considerations with Windows XP Embedded

Some hardware vendors provide a RAM disk for temporary file storage rather than writing directly to the storage drive. While this not important on a disk-based system, it becomes more important on a flash-based system. Non-volatile RAM (NVRAM) storage is fast but provides a limited number of writes to the media. Excessive writes to the media shortens the life span and can eventually lead to failure. Therefore, standard RAM is used as a way to provide temporary storage that does not impact the NVRAM.

The challenge imposed in this scenario is that the RAM disk might be allocated in a manner that provides insufficient space for the temporary location of installation files. Software installations often require large amounts of temporary storage space to uncompress files and install them to a permanent location. If the space allocated for this temporary storage is too small, the installation will fail.

When configuring automated installation of software, consider the available temporary storage area and the requirements of the program for temporary storage. If the requirements exceed the allocated space, a solution might be to temporarily reassign the path of the TEMP and TMP system variables to another location, such as a shared folder on the network.

Before redirecting the TEMP and TMP system variables to a network shared folder, ensure the installation has sufficient access permissions and consider any network latency issues you might encounter connecting to and from the remote shared folder.

See Also

Tasks

How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007

Other Resources

Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices


How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007

Topic last updated—November 2007

For a sample script that can be used with Configuration Manager 2007 to automate the configuration of the Windows XP Embedded write filter before and after the installation of software and software updates, see Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows XP Embedded Devices.

To use the script and perform software distribution and software updates management using Configuration Manager 2007 on Windows XP Embedded devices that use the EWF or FBWF write filter, you must take the following steps:

  1. Create a software distribution package for deployment of the VBScript that contains the following programs:
    • Program 1: Issues the command to disable the write filter.
    • Program 2: Issues the command to enable the write filter.
  2. Create a custom task sequence that performs the following tasks:
    • Set the default scripting host to cscript by running the following command: wscript.exe //b //H:cscript
    • Run Program 1 to disable the write filter.
    • Perform the required software distribution and software update activities.
    • Run Program 2 to enable the write filter.
  3. Deploy the task sequence to devices in your organization.
Note
The sample script has been written to run safely on any operating system, including computers not running Windows XP Embedded, but it has been tested only on XPe images. Test the script thoroughly before running the script on other systems.

Use the following procedures to create a software distribution package and programs containing the sample script and to create and deploy the task sequence used to install the script on Windows XP Embedded devices in your organization.

To create a software distribution package and programs containing the script to be deployed

  1. Copy the script in Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows XP Embedded Devices. Save it as a text file named XPeWriteFilters.vbs.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  3. Right-click the Packages node, click New, and then click Package to open the New Package Wizard.

  4. On the General page, specify a name for the package and other optional properties, and then click Next.

  5. On the Data Source page, select This package contains source files.

  6. Under Source version, click Set to open the Set Source Directory dialog box.

  7. In the Set Source Directory dialog box, type in or browse to the location where the script XPeWriteFilters.vbs is located, and then click OK.

  8. On the Data Source page, select Always obtain files from the source directory. Set any remaining options on this page as required, and then click Next.

  9. Complete the remaining pages of the New Package Wizard according to your standard software distribution procedures.

    Note
    This procedure needs to be performed only once for your Configuration Manager 2007 site.

To create a program to run the VBScript in disable mode

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. Expand the Packages node, and then expand the name of the package created in the preceding procedure.

  3. Right-click Programs under the package, click New, and then click Program to open the New Program Wizard.

  4. On the General page, specify the following values:

    • In the Name field, enter Disable write filter.
    • In the Command line field, enter wscript.exe XPeWriteFilter.vbs DISABLE.
    • In the After running drop-down, select ConfigMgr restarts computer.

  5. Click Next.

  6. On the Requirements page, click Next.

  7. On the Environment page, select Whether or not a user is logged on from the Program can run drop-down list, and then click Next.

  8. On the Advanced page, select Allow this program to be installed from the Install Software task sequence without being advertised.

  9. Complete the remaining pages of the New Package Wizard according to your standard software distribution procedures.

    Note
    This procedure needs to be performed only once for your Configuration Manager 2007 site.

To create a program to run the VBScript in enable mode

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. Expand the Packages node, and then expand the name of the package created in the preceding procedure.

  3. Right-click Programs under the package, click New, and then click Program to open the New Program Wizard.

  4. On the General page, specify the following values:

    • In the Name field, enter Enable write filter.
    • In the Command line field, enter wscript.exe XPeWriteFilter.vbs ENABLE
    • the After running drop-down, select ConfigMgr restarts computer

  5. Click Next.

  6. On the Requirements page, click Next.

  7. On the Environment page, select Whether or not a user is logged on from the Program can run drop-down list, and then click Next.

  8. On the Advanced page, select Allow this program to be installed from the Install Software task sequence without being advertised.

  9. Complete the remaining pages of the New Package Wizard according to your standard software distribution procedures.

    Note
    This procedure needs to be performed only once for your Configuration Manager 2007 site.

To create the task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment and expand the node.

  2. Right-click Task Sequences, click New, and then click Task Sequence to open the New Task Sequence Wizard.

  3. On the Create a New Task Sequence page, select the option Create a new custom task sequence, and then click Next.

  4. On the Task Sequence Information page, specify a name and optional comment for the task sequence, and then click Next. Do not enter a value in the Boot image field.

  5. On the Summary page, review the values you have specified for the task sequence, and then click Next.

  6. Click Close to close the New Task Sequence Wizard.

To edit the task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment and expand the node.

  2. Click Task Sequences, right-click the task sequence you created in the preceding procedure, and then click Edit to open the Task Sequence Editor.

  3. Click Add, click General, and then click Run Command Line to add a new task to set the default scripting host.

  4. In the Run Command Line task Properties tab, specify the following command in the Command line field:

    • wscript.exe //b //H:cscript

  5. Click Add, click General, and then click Install Software to add a new task to disable the write filter.

  6. In the Install Software task Properties tab, click Browse, and then select the package you previously created containing the XPeWriteFilter.vbs script.

  7. From the Program drop-down list, select the program Disable write filter.

  8. Add additional tasks to install software or software updates, as required.

  9. Click Add, click General, and then click Install Software to add a new task to enable the write filter.

  10. In the Install Software task Properties tab, click Browse, and then select the package you previously created containing the XPeWriteFilter.vbs script.

  11. From the Program drop-down list, select the program Enable write filter.

  12. Click OK to save the changes and close the Task Sequence Editor.

To deploy the task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment and expand the node.

  2. Click Task Sequences, right-click the task sequence you created in the preceding procedure, and then click Advertise to open the New Advertisement Wizard.

  3. On the General page, specify the following information:

    • Name: Specify a name for the advertisement.
    • Comment: Specify an optional description for the advertisement.
    • Task sequence: Click Browse, and then select the task sequence to advertise to Windows XP Embedded devices.
    • Collection: Click Browse, and then select the collection of Windows XP Embedded devices to advertise the task sequence to.

  4. Click Next.

  5. Complete the remaining pages of the New Advertisement Wizard according to your standard software distribution procedures.

    The task sequence will now run on the targeted devices, run the script to disable the write filter, and install the required software or updates. Then the script will automatically re-run to enable the write filter after installation is complete.

See Also

Concepts

About Task Sequences
Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows XP Embedded Devices

Other Resources

Overview of Configuration Manager Support for Windows XP Embedded Devices


Known Limitations in Configuration Manager Support for Windows XP Embedded

Topic last updated—November 2007

Consider the following limitations when running the Configuration Manager 2007 client on Windows XP Embedded computers:

  • Operating System Deployment is not supported, except for the use of Task Sequences.
  • When defining software inventory rules in the Inventory Collection tab of the Software Inventory Client Agent Properties dialog box, ensure the option Exclude encrypted and compressed files is unchecked when adding a new file type to the File types list.
  • Programs included in Configuration Manager 2007 packages must be configured to run with the option Whether or not a user is logged on on the Environment tab of the Program Properties dialog box.
  • Virtual application packages are not supported.
  • The Remote Assistance feature will detect “no user log-in” and show the correct user name whether it is local or domain.
  • The Remote Assistance Talking feature is not supported.

See Also

Other Resources

Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices


Technical Reference for Configuration Manager 2007 Support for Windows XP Embedded Devices

Topic last updated—November 2007

The topic in this section provides technical references for Windows XP Embedded support in Configuration Manager 2007.

In This Section

Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows XP Embedded Devices

Provides an example script you can use to automate configuration of the Windows XP Embedded write filter when installing software updates and packages to Configuration Manager 2007 client computers.

See Also

Other Resources

Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices


Example Script for Configuring Write Filters Using Configuration Manager 2007 on Windows XP Embedded Devices

Topic last updated—November 2007

Use the following script in Configuration Manager 2007 as part of a task sequence to automate configuration of Windows XP embedded write filters when you use Configuration Manager 2007 to install packages and software updates onto client computers. For details about how to use this script, see How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007.

Important
This script has been tested for use on computers running Windows XP Embedded. Before attempting to run this script on other operating systems, you should test it thoroughly.

Example Script

Copy Code
Option Explicit
On Error Resume Next
'#--------------------------------------------------------------------------------------------
'#
'#  This VBScript is used to allow software installation and update to a Windows Embedded
'#  client that is using EWF or FBWF protection on the drive.
'#
'#  Full documentation on the use of this VBScript is included in a separate document.
'#
'#--------------------------------------------------------------------------------------------

Dim gWshShell                                        'WScript.Shell object
Dim strProtectedDrive : strProtectedDrive = null     'The drive shown. by EWF or FBWF as being protected
Dim gSystemDrive                                     'Contains the System Drive (e.g. C:).
Dim strDisableCommand : strDisableCommand = null     'Either the EWF or FBWF command to disable the write filter.
Dim strEnableCommand  : strEnableCommand = null      'Either the EWF or FBWF command to enable the write filter.
Dim bIsWFEnabled : bIsWFEnabled = false              'Boolean for write filter enabled/disabled.
Dim bIsEWFInstalled  : bIsEWFInstalled = false       'Boolean for EWF installed.
Dim bIsFBWFInstalled : bIsFBWFInstalled = false      'Boolean for FBWF installed.
Dim strCommand : strCommand = null                   'The string holding the command-line argument.

Set gWshShell = WScript.CreateObject("WScript.Shell")       '# Create the Shell Object.

CheckWindowsEmbedded              '# Check to ensure this script is being run on Windows Embedded.

' Check whether any command-line argument is passed, and process.
If WScript.Arguments.Count = 1 Then
    strCommand = UCase(WScript.Arguments.Item(0))
    Select Case strCommand
        Case "DISABLE"
            CheckWhichWF
            DisableWF
        Case "ENABLE"
            CheckWhichWF
            EnableWF
        Case Else
            WScript.Quit (0)
    End Select

Else
    WScript.Echo "Invalid Command Line: Missing Action Parameter"
    WScript.Echo "USAGE:"
    WScript.Echo "EWF-FBWF.vbs [Disable|Enable]"
    WScript.Quit (0)
End If

WScript.Quit (0)

'--------------------------------------------------------------------------------------------
'   CheckWindowsEmbedded
'
'   Checks to ensure this script is being run on Windows Embedded and, if not, exits.
'     If there was no error in finding the key, read the string values from the key.
'     If the "EmbeddedNT" string is found, this is XPe.
'     In all other cases, bIsXPe is left as false, which causes an exit.
'--------------------------------------------------------------------------------------------
Sub CheckWindowsEmbedded()
    Dim arrValues, bIsXPe
    bIsXPe = FALSE

    arrValues = gWshShell.RegRead(XPE_REG_KEY)

    If Err.Number = 0 then
       For Each strValue in arrValues
            if strValue = "EmbeddedNT" then
                bIsXPe = True
            end if
       Next
    End If
    Err.Clear

    if not bIsXPe then
        WScript.Quit (0)
    end if
End Sub

'--------------------------------------------------------------------------------------------
'  CheckWhichWF
'
'  Determines which write filter (EWF or FBWF) is currently in use on this system and sets
'  a variable for use in other sections of this script. Because both EWF and FBWF can be on
'  a system (but not both controlling the protection of that system), simply testing for
'  the existence of the executable is not sufficient. Without using a separate C++ program
'  that accesses the EWF or FBWF API, the only way to test for which one is protecting the
'  drive is to use the output of the program at the command line to see whether it is active
'  and which drive is being protected.
'
'--------------------------------------------------------------------------------------------
Sub CheckWhichWF
    Dim oFSO, strFile, strPath, wsx
    Dim output, strLine
    Dim Status
    Set oFSO = CreateObject("Scripting.FileSystemObject")

    strPath = gWshShell.ExpandEnvironmentStrings("%SystemRoot%")
    If IsEmpty(strPath) Then
        WScript.Quit (1)
    Else
        '============================================
        '                    EWF
        '============================================
        'Check to see whether EWFMGR.EXE is on the system.
        strFile = strPath + "\system32\EWFMGR.EXE"
        If oFSO.FileExists(strFile) Then
            'Run the EWF Manager to see whether the drive is actually protected.
            set wsx = gWshShell.Exec("%comspec% /c " & strFile & " -all")
            Do
                Status = wsx.Status

                ' Parsing the output of the command to see whether the EWF is enabled
                ' and which drive is being protected (if any). Typical output
                ' of this command looks like this:
                '
                '   Protected Volume Configuration
                '     Type            RAM
                '     State           DISABLED
                '     Boot Command    ENABLE
                '       Param1        0
                '       Param2        0
                '     Persistent Data ""
                '     Volume ID       A7 FA CA 34 00 7E 00 00 00 00 00 00 00 00 00 00
                '     Device Name     "\Device\HarddiskVolume1" [C:]
                '     Max Levels      1
                '     Clump Size      512
                '     Current Level   N/A
                '
                output = split(wsx.Stdout.ReadAll(), vbNewLine)
                For Each strLine in output
                    if InStr(strLine, "State") then
                        ' If the output from the command generated text like the above,
                        ' EWF must be installed. Now check whether it's enabled or disabled.
                        bIsEWFInstalled = True
                        if InStr(strLine, "DISABLED") then
                            bIsWFEnabled = false
                        elseif InStr(strLine, "ENABLED") then
                            bIsWfEnabled = true
                        end if
                    End If

                    ' Check which drive is being protected, and get the drive letter
                    ' because the drive letter is required in the command line.
                    if (bIsEWFInstalled) AND (InStr(strLine, "Device Name")) Then
                        strProtectedDrive = left(right(strLine, 3), 2)
                        'Set the default commands to be used elsewhere in this script.
                        strEnableCommand = strFile & " " & strProtectedDrive & " -enable"
                        strDisableCommand = strFile & " " & strProtectedDrive & " -disable"
                    End If
                Next

                If Status <> 0 Then Exit Do
                WScript.Sleep 10

            Loop
        End if

        '============================================
        '                    FBWF
        '============================================
        'If EWF is enabled, FBWF cannot be enabled, so if EWF enabled, skip FBWF.
        If (Not bIsWFEnabled) Then
            Dim bCurrentState : bCurrentState = false
            Dim intLoopNum : intLoopNum = 0

            'Check to see whether FBWFMGR.EXE is on the system.
            strFile = strPath + "\system32\FBWFMGR.EXE"
            If oFSO.FileExists(strFile) Then
                'Run the FBWF Manager to see whether the drive is actually protected.
                set wsx = gWshShell.Exec("%comspec% /c " & strFile & " /displayconfig")
                Do
                    Status = wsx.Status

                    ' Parsing the output of the command to see whether the EWF is enabled
                    ' and which drive is being protected (if any). Typical output
                    ' of this command looks like this:
                    '
                    '   File-based write filter configuration for the current session:
                    '     filter state: disabled.
                    '
                    '   File-based write filter configuration for the next session:
                    '     filter state: enabled.
                    '     overlay cache data compression state: disabled.
                    '     overlay cache threshold: 64 MB.
                    '     overlay cache pre-allocation: enabled.
                    '     protected volume list:
                    '       \Device\HarddiskVolume1
                    '     write-through list of each protected volume:
                    '       \Device\HarddiskVolume1: (none)
                    '
                    output = split(wsx.Stdout.ReadAll(), vbNewLine)
                    For Each strLine in output
                        if InStr(strLine, "current session:") then
                            ' If the output from the command generated text like the above,
                            ' EWF must be installed. Now check whether it's enabled or disabled.
                            bIsFBWFInstalled = True

                           ' Gathering data from the current session (not the next session).
                           bCurrentState = true
                        elseif InStr(strLine, "next session:") then
                            bCurrentState = false
                            bNextState = true
                        end if

                        ' If the Current State / filter state = enabled, FBWF is enabled.
                        if (bCurrentState) AND (InStr(strLine, "filter state:")) then
                            if (InStr(strLine, "enabled")) then
                                bIsWFEnabled = true
                            else
                                bIsWFEnabled = false
                            end if
                            Exit For
                        end if
                    Next
                    If Status <> 0 Then Exit Do
                    WScript.Sleep 10
                Loop
                'Set the default commands to be used elsewhere in this script.
                if bIsFBWFInstalled then
                    strEnableCommand = strFile & " /enable"
                    strDisableCommand = strFile & " /disable"
                End if
            End if
        End if
    End If
End Sub

'--------------------------------------------------------------------------------------------
'   DisableWF
'
'   This sub is used to disable the write filter on the drive (EWF or FBWF) so that updates
'   can be written to the storage device.
'
'   If the drive is already disabled, this subroutine does nothing but just return. Otherwise,
'   the function will disable the EWF and reboot the machine.
'
'--------------------------------------------------------------------------------------------
Sub DisableWF
        Dim oExec

        'If the write filter is enabled, disable it.
        if bIsWFEnabled then
            Set oExec = gWshShell.Exec(strDisableCommand)
            'Wait for the previous command to complete.
            Do While oExec.Status = 0
                WScript.Sleep 100
            Loop

            'Reboot the machine to complete the operation.
            RebootEx 0
    End If
End Sub

'--------------------------------------------------------------------------------------------
'   EnableWF
'
'   This sub is used to enable the write filter on the drive (EWF or FBWF).
'
'   The function will enable the EWF and reboot the machine in two minutes so that task sequence
'   will have time to clean up itself.
'
'--------------------------------------------------------------------------------------------
Sub EnableWF
        Dim oExec

        ' If the write filter is installed, enable it.
        if (bIsEWFInstalled OR bIsFBWFInstalled) then
            Set oExec = gWshShell.Exec(strEnableCommand)
            ' Wait for the previous command to complete.
            Do While oExec.Status = 0

                WScript.Sleep 100
            Loop

            'Reboot the machine to complete the operation.
            RebootEx 120
    End If
End Sub

'--------------------------------------------------------------------------------------------
'    RebootEx
'
'   This sub reboots the system.
'--------------------------------------------------------------------------------------------
Sub RebootEx(intSeconds)

       Dim strRebootCommandLine

       strRebootCommandLine = "shutdown.exe -r -t " & intSeconds

      Set oExec = gWshShell.Exec(strRebootCommandLine)

      Do While oExec.Status = 0
            WScript.Sleep 100
      Loop
End Sub

See Also

Tasks

How to Manage Windows XP Embedded Write Filters Using Configuration Manager 2007

Other Resources

Tasks for Managing Configuration Manager Clients on Windows XP Embedded Devices


Troubleshooting Configuration Manager Client Deployment

Click any link in the following section for troubleshooting information for client issues with Configuration Manager 2007.

This content might have been updated. For the most recent information about troubleshooting client deployment, see http://go.microsoft.com/fwlink/?LinkId=88869.

In This Section

Troubleshooting Configuration Manager Client Issues

Specifies information about typical issues you might encounter when installing and managing clients in Configuration Manager 2007, and provides the steps to help resolve the issue.

Log Files for Managing Configuration Manager Clients

Lists the log files that can help you troubleshoot problems with Configuration Manager 2007 client deployment.

See Also

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Planning and Deploying Clients for Configuration Manager 2007


Log Files for Managing Configuration Manager Clients

Topic last updated—November 2007

There are a number of log files you can reference to help troubleshoot client issues in Configuration Manager 2007. These are located on both the client computer and the Configuration Manager 2007 site server.

Configuration Manager Client Computer Log Files

The Configuration Manager 2007 client log files can be found in one of the following locations:

  • On client computers that serve as management points, the client log files are located in the SMS_CCM\Logs folder.
  • On all other computers, the client log files are located in the %Windir%\System32\CCM\Logs folder.

The following table lists and describes the client computer log files.

Log file name Description

CcmExec.log

Records activities of the client and the SMS Agent Host service.

Can help to troubleshoot scenarios where the client is corrupted or not functioning. For example, this log file applies to a scenario where the client cannot communicate with a management point.

CertificateMaintenance.log

Records certificate maintenance for Active Directory Domain Services and management points.

Can help to troubleshoot scenarios where the client cannot communicate with a management point or with Active Directory Domain Services.

ClientIDManagerStartup.log

Records the creation and maintenance of client GUIDS and also the registration status of the client computer.

Can help to troubleshoot scenarios where the client changes its GUID after a hardware change or after Windows activation.

ClientLocation.log

Records site assignment tasks.

Can help to troubleshoot scenarios where the client is not assigned to a Configuration Manager 2007 site.

DataTransferService.log

Records Background Intelligent Transfer Service (BITS) communications for policy or package access.

Can help to troubleshoot client communication and policy signing issues.

InternetProxy.log

Records proxy server detection status for Internet-based client management.

Can help to troubleshoot client connectivity issues for Internet-based client computers.

LocationServices.log

Records attempts to find management points and distribution points.

Can help to troubleshoot scenarios where the client cannot find a management point or distribution point.

PolicyAgent.log

Records policy requests using the Data Transfer service.

Can help to troubleshoot policy request problems.

PolicyAgentProvider.log

Records policy changes.

Can help to troubleshoot policy request problems or Windows Management Instrumentation (WMI) errors.

PolicyEvaluator.log

Records new policy settings.

Can help to troubleshoot policy override issues.

StatusAgent.log

Records status messages that are created by the client components.

Can help to troubleshoot scenarios where the client cannot send status to the management point.

Configuration Manager Site Server Log Files

The Configuration Manager 2007 site server log files can be found in the folder <InstallationPath>\Logs on the site server. The following table lists and describes the site server log files.

Log file name Description

Ccm.log

Records client configuration manager tasks.

Can help to troubleshoot scenarios where the site cannot connect to computers because of permissions or name resolution.

Fspmgr.log

Records fallback status point activities.

Can help to troubleshoot problems with the fallback status point.

Hman.log

Records site configuration changes, and publishes site information in Active Directory Domain Services.

Can help to troubleshoot site control serial number or delta serial number issues, or scenarios where the site cannot publish site information to Active Directory Domain Services.

Mpcontrol.log

Records the registration of the management point with WINS. Records the availability of the management point every 10 minutes.

Can help to troubleshoot possible Internet Information Services (IIS) issues if the management point is unavailable.

Policypv.log

Records updates to the Advanced Client policies to reflect changes to client settings or advertisements.

Can help to troubleshoot scenarios where policy updates do not occur after you make changes to advertisements or to client settings.

Sitecomp.log

Records maintenance of the installed site components.

Can help to troubleshoot upgrade issues, registry or file system permission issues, or scenarios where the site cannot publish site information to Active Directory Domain Services.

Client Setup Log Files

Information on the client information can be found in the client setup log files located in the folder %windir%\system32\CCMSetup on the client computer. The following table lists and describes the client setup log files.

Log file name | Description
CCMSetup.log | Records setup tasks performed by CCMSetup. Can be used to troubleshoot client installation problems.
Client.msi.LOG | Records setup tasks performed by client.msi. Can be used to troubleshoot client installation problems.

See Also

Concepts

Overview of Configuration Manager Client Deployment


Troubleshooting Configuration Manager Client Issues

Topic last updated -- August 2007

Click any link in the following section for troubleshooting information to help you resolve issues when deploying and managing clients in Configuration Manager 2007.

Note
Assigning a fallback status point to Configuration Manager 2007 clients is one of the easiest ways for an administrator to identify troubleshooting issues for client installation or assignment. It also helps to identify clients that are unmanaged because they have problems communicating with their management point.

For more information, see About the Fallback Status Point in Configuration Manager.

In This Section

Configuration Manager Client Installation and Upgrade Issues

Lists possible problems and solutions that relate to installing the Configuration Manager 2007 client.

Configuration Manager Client Assignment Issues

Lists possible problems and solutions that relate to assigning the Configuration Manager 2007 client to a site.

Assignment can occur at the end of installation, and clients can be reassigned after installation.

Configuration Manager Client Mixed Mode Issues

Lists possible problems and solutions that relate specifically to client mixed mode communication.

Configuration Manager Client Native Mode and Internet-Based Client Management Issues

Lists possible problems and solutions that relate specifically to client native mode communication, and to Internet-based client management.

Configuration Manager Client General Issues

Lists possible problems and solutions that relate to managing Configuration Manager 2007 clients that are not specifically related to installation, assignment, client mode communication, or Internet-based client management.

See Also

Concepts

Prerequisites for Configuration Manager Client Deployment
What's New in Client Deployment for Configuration Manager

Other Resources

Planning and Deploying Clients for Configuration Manager 2007


Configuration Manager Client Installation and Upgrade Issues

Topic last updated -- August 2007

This section provides troubleshooting information to help you resolve issues when installing clients in Configuration Manager 2007.

For more information about installing clients in Configuration Manager 2007, see Administrator Checklist: Deploying Configuration Manager Clients.

Clients Fail to Install Using Client Push Because Windows Firewall Blocks Installation

If Configuration Manager 2007 clients are running Windows Firewall, client push installation can fail if the Windows Firewall is not configured appropriately. Because packets are blocked from the client, no information is sent to the fallback status point and client logs do not contain any data.

Solution

In order to successfully use client push to install Configuration Manager 2007 clients, add the following as exceptions to the Windows Firewall:

  • File and Printer Sharing
  • Windows Management Instrumentation (WMI)

For more information, see Firewall Settings for Configuration Manager Clients.

Systems Management Icon Does Not Appear on Client Computers

The Systems Management icon does not appear on Configuration Manager 2007 client computers.

Solution

Configuration Manager 2007 clients have a new icon, which is now called Configuration Manager, and displays as follows:

Configuration Manager client icon The Configuration Manager client icon that replaces the Systems Management icon from SMS 2003.

Use this icon for all procedures that relate to the Configuration Manager 2007 client and are performed on the client computer.

For more information about the changes since SMS 2003, see What's New in Client Deployment for Configuration Manager.

Client Installation Fails During Group Policy Installation if CCMSetup Fails to Retrieve Installation Properties from Active Directory Domain Services

If you install a client with the Group Policy installation method and the client cannot contact Active Directory Domain Services to retrieve installation properties, client installation will fail and will not retry. A possible reason for this could be that boundaries for the Configuration Manager 2007 site are incorrectly defined which results in site assignment failing because a site cannot be found that matches the client's network location.

Solution

Remedy the reason for the client installation failure and re-publish the Group Policy to reinstall the client.

Clients Fail to Install Using the Software Update Point Installation Method

Likely reasons for software update point installations to fail are the following:

  • Active Directory Group Policy is overriding the location of the site's software update point.
  • The site's software update point is not configured correctly.

Solution

For more information about how to install clients using a software update point, see How to Install Configuration Manager Clients Using Software Update Point Based Installation.

For more information about installing and configuring a software update point, see Planning for the Software Update Point Installation.

Clients Fail to Install after a Running Dcpromo.exe on a Management Point Server

If you run the dcpromo.exe command on a Windows 2003 Server hosting a Configuration Manager 2007 management point, the management point might stop responding to client requests.

The following entry appears in mpcontrol.log on the site server:

Http test request failed, status code is 401, 'Unauthorized'

Solution

Reinstall the management point.

Note
It is not recommended best practice to install a Configuration Manager 2007 management point on a domain controller. For more information, see Best Practices for Securing Site Systems.

Clients Fail to Install Because the Management Point is Not Operational

All clients in a site fail to be managed if their default management point is not operational because of an unsupported configuration or missing dependencies on the management point.

Solution

Ensure that the management point has the required dependencies in the section "General Site Server Prerequisites" in the following topic: Prerequisites for Installing Configuration Manager.

Also reference Configuration Manager Supported Configurations to verify that you running in a supported environment.

Consider manually running the Configuration Manager 2007 Setup Prerequisite Checker to identify any missing dependencies for the management point.

For more information about running the Setup Prerequisite Checker, see How to Start the Setup Prerequisite Checker.

SMS 2003 Client Fails to Install on Management Point in Configuration Manager 2007 Site

To support upgrade scenarios, a server that is running the SMS 2003 client can be configured as a management point in a Configuration Manager 2007 site. Both the management point and the client will function correctly, although upgrading the client to Configuration Manager 2007 after upgrading the site will allow you to benefit from the new client functionality.

However, after the site has been upgraded to Configuration Manager 2007, do not install the SMS 2003 client on the management point. The client installation will fail and display the following error: A newer version of the SMS Management Point is installed. Cannot continue installing this version of the client. The following errors are logged to CCMSetup.log:

  • MSI: A newer version of the SMS Management Point is installed. Cannot continue installing this version of the client
  • Installation failed with error code 1603

For more information about client log files, see Log Files for Managing Configuration Manager Clients.

Solution

Install the Configuration Manager 2007 client on a management point in a Configuration Manager 2007 site. Alternatively, follow these steps:

  1. Remove the Configuration Manager 2007 management point. For procedural information, see How to Delete Site System Roles From Site Systems.
  2. Reinstall the SMS 2003 client.
  3. Reinstall the management point. For procedural information, see How to Install a Management Point.

Hardware Inventory Scan Fails on Windows 2000 Clients after Upgrade from SMS 2003 SP2

When a client computer is upgraded from SMS 2003 Service Pack 2 to Configuration Manager 2007, the hardware inventory scan might fail to run on the upgraded client computer. Entries similar to the following appear in InventoryAgent.log on the client computer:

Unknown error encountered processing an instance of class CCM_System: 80041013

Collection: Failed to process mandatory data item for class: CCM_System. Cycle abandoned !! InventoryAgent

Failed to process instances of CCM_System: 80004005

Solution

Restart the client computer.

Configuration Manager Client Icon Does Not Appear in Control Panel for Computers with 64-Bit Operating Systems

The Configuration Manager 2007 client is a 32-bit application, and so does not immediately display in the 64-bit computer's Control Panel.

Solution

From Control Panel, click View 32-bit Control Panel Items to display the Configuration Manager 2007 client.

See Also

Other Resources

Troubleshooting Configuration Manager Client Issues
Planning and Deploying Clients for Configuration Manager 2007


Configuration Manager Client Assignment Issues

Topic last updated -- August 2007

This section provides troubleshooting information to help you resolve issues when assigning clients in Configuration Manager 2007.

For more information about assignment in Configuration Manager 2007, see About Client Site Assignment in Configuration Manager.

Clients Fail to Assign to a Site Because Cannot Perform Site Compatibility Check

If Configuration Manager 2007 clients successfully install but fail to assign to a site, a likely reason is that the check for site compatibility failed during the assignment process.

Solution

Ensure that clients have a mechanism to check for site compatibility. This is achieved in one of two ways:

  • Active Directory Domain Services is extended for Configuration Manager 2007, and clients belong to this forest.
  • Clients can find a server locator point that's published in WINS, or they are reinstalled and assigned to a server locator point during installation.

For more information, see the following:

  • What's New in Client Deployment for Configuration Manager
  • About Client Site Assignment in Configuration Manager
  • Determine If You Need a Server Locator Point for Configuration Manager Clients
  • How to Specify the Server Locator Point for Configuration Manager Client Computers

Clients Fail to Assign to a Site Because the Site is Running SMS 2003

A Configuration Manager 2007 client cannot successfully assign to an SMS 2003. The new functionality in the Configuration Manager 2007 client means that it will not operate in a site running SMS 2003. Site assignment will check the client's version against the assigned site's version and fail the site compatibility check. Site assignment will fail, with the client sending a state message to its fallback status point (if one is assigned).

Solution

To remedy the unmanaged client, perform one of the following steps:

  • Assign the client to another site that is running Configuration Manager 2007.
  • Uninstall the client and install the SMS 2003 client to assign to the SMS 2003 site.
  • Upgrade the SMS 2003 site, and then reassign the client to same site.

For procedural information to uninstall the Configuration Manager 2007 client, see How to Uninstall the Configuration Manager Client.

Clients Assign to a Site But Are Unmanaged Because Their Client Communication Mode Does Not Match Their Assigned Site's Site Mode

Clients that can access Configuration Manager 2007 site information from Active Directory Domain Services can automatically change their site mode to match their assigned site if it does not match. For example, a mixed mode client that is assigned to a native mode site will automatically be reconfigured to use native mode client communication.

However, clients that cannot access Configuration Manager 2007 site information from Active Directory Domain Services, but use a server locator point to complete site assignment cannot automatically switch client communication modes when there is a mismatch with its assigned site. In this scenario, the client will be assigned but unmanaged. Clients report the error HTTP 403 in the log file ccmexec.log, and in the client communication reports if they are assigned to a fallback status point.

Solution

Reinstall the client using one of the following methods:

  • If the site is in native mode, use the CCMSetup installation property /native: [<native mode option>]. For more information, see About Configuration Manager Client Installation Properties. If the site is in mixed mode, reinstall the client without this installation property.
  • Reinstall the client using the client push installation method, which automatically configures the client for the correct site mode. For procedural information, see How to Install Configuration Manager Clients Using Client Push.

When Installing a Configuration Manager Client using the CCMHOSTNAME Installation Property without Specifying a Site Code, you cannot Subsequently Specify a Site Code for the Client

If you use the CCMHOSTNAME installation property when installing the Configuration Manager 2007 client, but do not specify a site code, you cannot later use Configuration Manager in the client computer's Control Panel to assign the client to a Configuration Manager 2007 site.

The CCMHOSTNAME installation property specifies an Internet-based management point that is specified when a client is directly assigned to a site that supports Internet-based client management.

Solution

Reinstall the Configuration Manager 2007 client specifying both the CCMHOSTNAME and SMSSITECODE installation properties.

Reassignment Failures Using Configuration Manager Client When an Internet-Based Management Point is Configured

When a Configuration Manager 2007 client is configured to use an Internet-based management point, the client cannot automatically discover a site. On computers running Windows XP and Windows Server 2003, the Discover button is not available. On computers running Windows Vista, the Discover button is available but not functional and auto-site discovery will fail.

Furthermore, computers running Windows XP and Windows Server 2003 cannot reassign to another site without first removing the Internet-based management point value. Computers running Windows Vista can reassign to another site without first removing the Internet-based management point. However, in this scenario, ensure that the original Internet-based management point value is either removed (if the new site does not support Internet-based client management), or is updated with the new Internet-based management point in the new site.

Solution

Do not use the Discover button on the Configuration Manager Properties: Advanced Tab. Instead, always directly assign an Internet-based client to its Internet-based site (and specify that site's Internet-based management point).

To reassign a client computer running Windows XP or Windows Server 2003, first remove the value specified for the Internet-based management point.

Clients Fail to Assign to Correct Site Using Auto-Site Assignment

If you install clients using auto-site assignment which either fails or the client is assigned to the wrong site, the most likely reason for this failure is that boundaries are not configured correctly for the Configuration Manager 2007 sites, or that the client roamed into another site during the upgrade process.

Solution

Check that boundaries are configured correctly for each site in the Configuration Manager 2007 hierarchy.

For more information about boundaries, see the following topics:

  • Planning Configuration Manager Boundaries
  • Choose Configuration Manager Boundaries
  • How to Configure Configuration Manager Boundaries

If clients are likely to roam during the upgrade process, do not use auto-site assignment.

See Also

Other Resources

Troubleshooting Configuration Manager Client Issues
Planning and Deploying Clients for Configuration Manager 2007


Configuration Manager Client Mixed Mode Issues

Topic last updated—August 2007

This section provides troubleshooting information to help you resolve issues that are specific to Configuration Manager 2007 clients when they are operating in a mixed-mode site. For issues that affect both mixed-mode and native-mode clients, see Configuration Manager Client General Issues.

Most client troubleshooting issues that are specific to mixed-mode operations relate to the approval process. For more information about client approval, see About Client Approval in Configuration Manager.

Clients Fail to Automatically Approve (Mixed Mode)

If Configuration Manager 2007 clients do not automatically approve, even though you are using the default site setting of Automatically approve computers in trusted domains (recommended), the following situations might be the cause:

  • Client computers do not belong to the same domain as the site server's domain, and the site's default management point is not configured with a fully qualified domain name (FQDN).
  • Clients belong to a separate Active Directory forest or are workgroup computers.
  • You are using a network load balancing (NLB) management point.
  • You have changed the site approval setting after clients have successfully been assigned to the site.

For more information about client approval, see About Client Approval in Configuration Manager.

Solution

Refer to the following table to troubleshoot each situation listed above.

Situation Solution

Client computers do not belong to the same domain as the site server's domain, and the site's default management point is not configured with a fully qualified domain name (FQDN).

Configure the site system that holds the default management point role with an FQDN:

  • How to Configure the Intranet FQDN of Site Systems

Clients belong to a separate Active Directory forest or are workgroup computers.

This is by design, and you must manually approve these clients because they cannot be automatically verified using Windows integrated authentication.

See the procedure "To approve clients manually" in the following topic:

  • How to Approve Configuration Manager Clients

You are using an NLB management point.

This scenario requires the following additional configuration:

  1. Confirm that the NLB management point is configured to use an FQDN. For more information, see How to Configure the Intranet FQDN of an NLB Management Point.
  2. Configure a Service Principal Name (SPN) in Active Directory Domain Services for the FQDN NLB management point cluster. For more information, see How to Configure an SPN for NLB Management Point Site Systems.

You have changed the site approval setting after clients have successfully been assigned to the site.

This is by design, because the client approval state is set when the client is assigned to a site.

To approve clients that have successfully been assigned to the site but are unapproved, perform either of the following actions:

  • Manually approve the client. See the procedure "To approve clients manually" in the following topic: How to Approve Configuration Manager Clients.
  • Reinstall the client.

Client Repair Fails for a Mixed Mode Client That Has an Internet-Based Management Point Defined

If a client computer in mixed mode has an Internet-based management point specified, the client repair function fails. This configuration is possible only in the following two scenarios:

  • The Configuration Manager 2007 site was in native mode, and clients were configured to use an Internet-based management point. If the site is reverted to mixed mode, clients automatically retain their Internet-based management point configuration.
  • Native-mode clients configured to use an Internet-based management point are reassigned to a mixed-mode site, and they automatically retain their Internet-based management point configuration.

Solution

Reinstall the Configuration Manager 2007 client. If reinstalling the client is not an acceptable solution, you can clear the Internet-based management point (FQDN) entry by removing the data in the registry key Internet MP Hostname, which is located under HKLM\Software\Microsoft\SMS\Client\Internet Facing.

The Approve Option Is Still Available After a Client Is Approved

The Approve option remains available for an approved client, and selecting it does not result in updated log files.

For more information about client approval, see About Client Approval in Configuration Manager.

Solution

Do not select the Approve option for a client that displays as Approved. Selecting this option has no effect when the client is already approved. To confirm that a client is approved, reference the client state in the Configuration Manager console. For more information, see About Client States in Configuration Manager.

See Also

Concepts

What's New in Client Deployment for Configuration Manager

Other Resources

Planning and Deploying Clients for Configuration Manager 2007
Troubleshooting Configuration Manager Client Issues


Configuration Manager Client Native Mode and Internet-Based Client Management Issues

Topic Last Updated—August 2008

This section provides troubleshooting information to help you resolve issues that are specific to Configuration Manager 2007 clients when they are operating in a native-mode site, and it includes troubleshooting issues for Internet-based client management. For issues that affect both mixed-mode and native-mode clients, see Configuration Manager Client General Issues.

For administrator checklists for configuring native mode and Internet-based client management, see the following:

  • Administrator Checklist: Deploying the PKI Requirements for Native Mode
  • Administrator Checklist: Migrating a Site to Native Mode
  • Administrator Checklist: Configuring a Site for Internet-Based Client Management
  • Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management

Native Mode Failure or Internet-based Client Management Failure Because One or More Prerequisites Are Missing

Native mode and Internet-based client management have a number of prerequisites that, if not met, can result in numerous issues and error conditions. Before investigating specific errors, make sure that all these prerequisites have been met.

Solution

To verify that you have met all the prerequisites, see the following:

  • Prerequisites for Native Mode
  • Prerequisites for Internet-Based Client Management

Native Mode Operation Fails with Version 3 Certificate Templates and Windows Server 2008

If you are using Active Directory Certificate Services with Windows Server 2008, do not use version 3 templates. Using these certificate templates creates certificates that are not compatible with Configuration Manager. For example, a version 3 certificate template that is used to request the site server signing certificate results in the status message 5115 from the component SMS_POLICY_PROVIDER when attempting to sign the site policies, instead of the success status message of 5116. For more information about verifying the successful use of the site server signing certificate, see How to Verify Native Mode Migration Is Complete.

Version 3 templates can be identified in the Windows Server 2008 Certificate Templates Console by referencing the Minimum Supported CAs column. Version 3 templates display in this column as Windows Server 2008. When you duplicate an existing certificate template, you are prompted to select the template version, with version 3 templates displayed as Windows Server 2008, Enterprise Edition. The default for duplicated templates is version 2 (the option Windows Server 2003, Enterprise Edition), which is compatible with Configuration Manager native mode.

Solution

Do not use version 3 templates to create the certificates that support Configuration Manager native mode.

Client Mode Reports Are Blank and Reference the Native Mode Readiness Tool

The following reports do not display any client data until clients have run the Configuration Manager Native Mode Readiness tool:

  • Clients incapable of native mode
  • Summary information of clients capable of native mode

Solution

This utility is installed with Configuration Manager 2007 clients, in the folder %windir%\system32\CCM. It must be run with local administrator privileges on client computers that have the Configuration Manager 2007 client installed.

To run the utility, run Sccmnativemodereadiness.exe from the CCM folder.

For more information, see How to Determine Whether Client Computers Are Ready for Native Mode.

Clients Are Unmanaged After Site Migration to Native Mode

If some or all clients assigned to a Configuration Manager 2007 site stop receiving policy and do not send inventory information to the site after the migration to native mode, it might be because of one or more of the following reasons:

  • The native mode prerequisites are not met.
  • Certificate issues are preventing communication.
  • Clients have not received an instruction to switch to native-mode communication.
  • Migration is not yet complete.

Solution

If clients are assigned to a fallback status point, use the reports to identify the specific native mode communication issue. For more information about using the fallback status port reports, see the following topics:

  • About Reports for Configuration Manager Clients
  • How to Create a Fallback Status Point in Configuration Manager
  • How to Assign the Fallback Status Point to Configuration Manager Client Computers

Refer to the following checklist to ensure the correct procedures were followed and resolve missing steps if necessary: Administrator Checklist: Migrating a Site to Native Mode.

Native Mode Client Settings Not Working

If you configure any of the client settings specified in the Site Properties: Site Mode tab, the settings are published to Active Directory Domain Services and used by client push installation. For these settings to configure a native mode client after they have been installed, all the following circumstances must be true:

  • You have extended the Active Directory schema for Configuration Manager 2007.
  • The site is successfully publishing to Active Directory Domain Services.
  • Clients belong to the same Active Directory forest.
  • Clients are not configured for Internet-only management.

Solution

Refer to the following table to resolve each situation listed above.

Situation Solution

The Active Directory schema is not extended for Configuration Manager 2007.

Extending the Active Directory schema is not a requirement for native mode, but makes configuring native mode much easier than if the schema is not extended.

For more information about how to extend the Active Directory schema:

  • How to Extend the Active Directory Schema for Configuration Manager

Without the schema extended, configure the native mode settings you require during installation, manually specifying CCMSetup installation properties or using client push installation:

  • About Configuration Manager Client Installation Properties
  • How to Install Configuration Manager Clients Using Client Push

For additional information, see How to Configure Native Mode.

The site is not published to Active Directory Domain Services.

Configure the site to publish to Active Directory Domain Services:

  • How to Publish Configuration Manager Site Information to Active Directory Domain Services

To verify publication of site information:

  • How to Verify Site Information is Published to Active Directory Domain Services

Clients do not belong to same Active Directory forest as the site server's forest.

These clients cannot access the site settings published to Active Directory Domain Services and therefore need to be manually configured using CCMSetup installation properties or automatically configured using client push:

  • About Configuration Manager Client Installation Properties
  • How to Install Configuration Manager Clients Using Client Push

For additional information, see How to Configure Native Mode.

Clients are configured for Internet-only management.

These clients cannot access the site settings published to Active Directory Domain Services and therefore need to be manually configured using CCMSetup installation properties:

  • About Configuration Manager Client Installation Properties

For additional information, see the following:

  • How to Configure Native Mode
  • Decide How to Install Configuration Manager Clients for Internet-Based Client Management

Native Mode Clients Fail to Find NLB Management Point

In native mode, a network load balancing (NLB) management point must be configured with a fully qualified domain name (FQDN), and native mode clients must be able to locate this FQDN in Active Directory Domain Services, or a server locator point.

Solution

Refer to the following table to resolve issues related to the preceding requirements.

Problem Solution

The NLB management point is configured with an IP address instead of an FQDN.

This configuration is not supported for native mode, and the NLB management point must be configured with an FQDN:

  • How to Configure the Intranet FQDN of an NLB Management Point

The Active Directory schema is not extended for Configuration Manager 2007.

Because native mode clients cannot locate NLB management points in DNS or WINS, they locate the NLB management point using either Active Directory Domain Services or a server locator point.

For more information, see Configuration Manager and Service Location (Site Information and Management Points).

For more information about how to extend the Active Directory schema:

  • How to Extend the Active Directory Schema for Configuration Manager

For more information about installing a server locator point:

  • How to Create a Server Locator Point in Configuration Manager

Clients are from a separate forest or a workgroup.

These clients cannot locate management points from Active Directory Domain Services, even if their site is publishing to Active Directory Domain Services. In this scenario, these clients must locate their NLB management point with a server locator point.

For more information, see Configuration Manager and Service Location (Site Information and Management Points).

For more information about installing a server locator point:

  • How to Create a Server Locator Point in Configuration Manager

Native Mode Clients Fail to Connect to NLB Management Point Because of Certificate Misconfiguration

Clients fail to connect to a native mode NLB management point if the public key infrastructure (PKI) certificates are missing or are incorrectly configured for the NLB management point.

Solution

Each site system server in the NLB management point must have a PKI certificate that contains both the FQDN of the NLB management point and the site system server name. For more information, refer to the certificate requirements listed in the section "Network Load Balancing Management Points or Network Load Balancing Software Update Points" in the topic Certificate Requirements for Native Mode.

Note
For information about specifying multiple names in the certificate Subject Alternative Name field, see the following article about how to add a subject alternative name to a secure LDAP certificate: http://go.microsoft.com/fwlink/?LinkId=93692

Native Mode Clients Become Unmanaged When They Use a New Site Server Signing Certificate

If a Configuration Manager 2007 client uses a new site server signing certificate that chains to a different root certificate than was used with the previous site server signing certificate, the client will not accept the new site server signing certificate when it receives policies signed with the new certificate.

This will occur if the root certificate for the site server signing certificate changes from the client's point of view—for example, in the following circumstances:

  • If you move a Configuration Manager 2007 client from one Configuration Manager 2007 hierarchy to another (for example, a company merger).
  • If you configure the site to use a new site server signing certificate from a different root certification authority than the one that issued the previous site server signing certificate.
  • You renew your root certificate with a new key pair and then issue a new site server signing certificate.

This behavior provides security prevention against clients accepting a new site server signing certificate from a compromised management point. In this scenario, clients will not attempt to download the new site server signing certificate and will reject the policy they have downloaded, sending an error to the management point to alert the administrator to the fact that policy authorization failed.

Solution

Either delete the copy of the previous site server signing certificate on the Configuration Manager client, or uninstall or reinstall the client.

For more information about this scenario and remedial actions, see Renewing or Changing the Site Server Signing Certificate.

Native Mode Client Fails to Communicate with the Site Because It Has Multiple Certificates

When Configuration Manager 2007 is operating in native mode, clients communicate with the site using a public key infrastructure (PKI) certificate that has client authentication capabilities. By default, if Configuration Manager 2007 finds more than one valid client for this communication, it will not attempt to communicate with its default management point and will be unmanaged.

You can confirm the existence of multiple certificates on a computer by using the Windows Certificates snap-in on the client or by using Configuration Manager 2007 reports if clients are assigned to a fallback status point. For more information, see About Reports for Configuration Manager Clients.

Solution

There are different solutions to this problem, depending on your particular requirements for using multiple certificates. Use the following table to identify the correct course of action for your particular requirement.

Requirement Solution

Multiple certificates are required on the computer, and the Configuration Manager 2007 client needs to select the correct one to use for Configuration Manager 2007 native mode communication.

Configure the certificate selection criteria:

  • How to Specify the Client Certificate Selection Criteria

Multiple certificates are not required on the computer (for example, they are the result of certificate deployment testing, or they are no longer needed for their original purpose).

Delete the unwanted certificates only after verifying that they are not required.

Important
If you are at all in doubt about whether the certificates are required, back them up before removal by exporting them and then store them securely.

This leaves just one valid client certificate in the local certificate store, which the computer will use for Configuration Manager 2007 native-mode communication.

You do not mind which certificate is used for Configuration Manager 2007 native-mode communication.

Configure the client to select any valid certificate that includes client authentication capability. Additionally, in Configuration Manager 2007 SP1, the certificate with the longest validity period is selected, which is appropriate if you are using Network Access Protection with IPsec enforcement.

Note
This might result in successful native-mode communication, but it is a less reliable configuration than specifying the certificate selection criteria because the client certificate might not be trusted by the native mode site system server.

For more information:

  • How to Specify the Client Certificate Selection Criteria

Firewalls or Proxy Servers Block Internet Client Communication to Internet-Based Site

Front-end or back-end firewalls must be configured correctly to allow traffic to and from Internet clients to their Internet-based site systems.

Solution

Refer to the following topic for a list of ports associated with Internet-based client management:

  • Determine the Ports Required for Internet-Based Client Management

Refer to the following topic for information about the external dependency for intervening firewalls or proxy servers:

  • Prerequisites for Internet-Based Client Management

Internet Clients Do Not Use New Proxy Server Details

Note
This issue has been resolved with the Configuration Manager 2007 SP1 client.

A Configuration Manager 2007 client that accesses its Internet-based site using a proxy server does not dynamically pick up changes for the proxy server configuration, such as a new proxy server name or a change in credentials.

The new proxy server details will be used when the Configuration Manager 2007 client detects a network change or is restarted. Therefore, you are most likely to see this scenario for an Internet-only client.

Solution

Expedite the discovery of the new proxy server details using any of the following methods:

  • Disconnect and reconnect the client.
  • Release and renew the client's IP address.
  • Restart the SMS Agent Host service on the client computer.
  • Restart the client computer.

For a longer-term solution, upgrade the client to Configuration Manager 2007 SP1.

Proxy Server Settings on Client's Internet Tab Not Visible to Low-Rights Users

On Windows XP and Windows Server 2003, the Configuration Manager 2007 client's Internet tab in Configuration Manager displays the configuration options under the Proxy Settings section as read-only. However, on computers running Windows Vista, the configured options are not displayed, even though they are configured.

Solution

None. If you need to confirm the proxy settings for Internet clients, access this tab as a high-rights user. For example, log on as the local administrator, and then view the properties of Configuration Manager and click the Internet tab.

Proxy Server Settings on Client's Internet Tab Not Visible to Low-Rights Users

On Windows XP and Windows Server 2003, the Configuration Manager 2007 client's Internet tab in Configuration Manager displays the configuration options under the Proxy Settings section as read-only. However, on computers running Windows Vista, the configured options are not displayed, even though they are configured.

Solution

None. If you need to confirm the proxy settings for Internet clients, access this tab as a high-rights user. For example, log on as the local administrator, and then view the properties of Configuration Manager and click the Internet tab.

Client Fails to Communicate with the Default Management Point on the Intranet After Deleting the Internet-Based Management Point Setting

If you delete the client's configured Internet-based management point when the client is on the Internet, without replacing it with another Internet-based management point, the client will be unable to communicate with its default management point and will be unmanaged on the intranet until you restart the client (SMS Agent Host).

Solution

To resolve this situation, perform one of the following actions:

  • Restart the client (SMS Agent Host). This action requires local administrator rights.
  • Restart the computer.

Advertisements Fail to Run on the Internet

Advertisements fail to run on the Internet when you are using the Internet-based client management feature. However, other features, such as hardware inventory and software updates, succeed on the Internet.

Solution

See http://go.microsoft.com/fwlink/?LinkId=112041.

See Also

Concepts

Administrator Checklist: Configuring Client Computers for a Site that Supports Internet-Based Client Management
Administrator Checklist: Migrating a Site to Native Mode
Prerequisites for Native Mode
What's New in Client Deployment for Configuration Manager

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
How to Configure Native Mode
Planning and Deploying Clients for Configuration Manager 2007
Troubleshooting Configuration Manager Client Issues


Configuration Manager Client General Issues

Topic last updated—August 2007

This section provides general troubleshooting information to help you resolve issues when managing clients in Configuration Manager 2007, which are not specifically related to installation, assignment, or mixed or native mode.

For more information about client deployment in Configuration Manager 2007, see Planning and Deploying Clients for Configuration Manager 2007.

Clients Cannot Be Managed Because They Cannot Locate Their Default Management Point

If Configuration Manager 2007 clients are successfully installed and assigned to a site but fail to download policy, a likely reason is that either the site has no default management point or clients cannot locate it.

Solution

Make sure that a default management point is configured for the site. For more information, see How to Configure the Default Management Point for a Site.

Clients find their default management point using one of the following service location requests:

  • Active Directory Domain Services (if the schema is extended for Configuration Manager 2007)
  • DNS (if Configuration Manager 2007 is configured for DNS publishing)
  • Server locator point
  • WINS (mixed mode only)

Ensure that one of these mechanisms is available to clients. For more information, see Configuration Manager and Service Location (Site Information and Management Points).

Clients Lose Historical Data or Are Unmanaged and Missing from the All Systems Collection

Configuration Manager 2007 helps to ensure that each Configuration Manager 2007 client is uniquely identified. If a duplicate hardware ID is identified, by default Configuration Manager 2007 automatically creates a new client record for the duplicate record. This setting allows you to easily upgrade or deploy clients that might have duplicate hardware IDs, without requiring manual intervention. However, with this setting, a computer that has been re-imaged or restored from backup will have a new record created, which results in all previous information about that client being no longer available for reporting purposes.

An alternative configuration is to require the administrator to manually reconcile all conflicting records when they are detected. This setting results in affected clients being unmanaged and no longer displaying in collections, but displaying in the Conflicting Records node. These clients will remain unmanaged until the administrator resolves the conflict.

For more information, see the section "Managing Client Identity" in What's New in Client Deployment for Configuration Manager.

Solution

When a new record has been created, you cannot get back previous data for the client, but you can reconfigure Configuration Manager so that it does not automatically create new records in the future.

If clients are unmanaged and missing from collections, check the Conflicting Records node so that you can manually reconcile the records by merging them, creating a new record, or blocking the new record.

For more information about how to configure the site-wide setting and how to manually resolve conflicting records, see How to Manage Conflicting Records for Configuration Manager Clients.

Missing Data in Client Reports

If you view the following reports and they do not contain client data, ensure that clients are assigned to a fallback status point:

  • Client Assignment Detailed Status Report
  • Client Assignment Failure Details
  • Client Assignment Status Details
  • Client Assignment Success Details
  • Client Deployment Failure Report
  • Client Deployment Status Details
  • Client Deployment Success Report
  • Issues by incidence detail report for a specific collection
  • Issues by incidence summary report for a specific collection
  • Issues by incidence detail report for a specific site
  • Issues by incidence summary report

Solution

Assign a fallback status point to Configuration Manager 2007 clients, and view the reports from the site in which the fallback status point is installed.

Note
SMS 2003 clients do not use these reports.

For more information, see the following:

  • About Reports for Configuration Manager Clients
  • How to Create a Fallback Status Point in Configuration Manager
  • How to Assign the Fallback Status Point to Configuration Manager Client Computers

Additionally, if you are deploying a high number of clients at the same time, there might be a delay in processing all the state messages sent from the fallback status point to the site. In this scenario, wait for the data to appear and consider configuring the throttling settings on the fallback status point. For more information about the throttling settings, see Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager.

Error Codes in Reports with No Description

Error conditions reported by clients might be displayed using standard Microsoft Windows error codes, without a description of the error. Or they might use error codes that are specific to Configuration Manager 2007.

Solution

For information about how to map these error codes to an error description, see http://go.microsoft.com/fwlink/?LinkId=103419.

Computers Fail to Obtain Software Updates After Software Update Point Based Client Installation Is Configured

If Configuration Manager 2007 clients fail to obtain software updates from Configuration Manager and they have an Active Directory Group Policy setting configured for software update point based client installation, a likely reason is that the Active Directory Group Policy object is incorrectly configured.

The software updates feature automatically configures a local Group Policy setting for the Configuration Manager 2007 client so that it is configured with the software update point source location and port number. Both the server name and port number are required for the software updates client to find the software update point.

If an Active Directory Group Policy setting is applied to computers for software update point client installation, this overrides the local Group Policy setting. Unless the value of the setting is exactly the same (server name and port), the Configuration Manager 2007 software updates feature will fail on the client.

The following entries appear in the software updates log file WUAHandler.log:

[Group policy settings were overwritten by a higher authority (Domain Controller) to: Server http://server and Policy ENABLED]LOG

Solution

The software update point for client installation and software updates must be the same server, and it must be specified in the Active Directory Group Policy setting with the correct name format and with the port information (for example, http://server1.contoso.com:80 if the site system server is not configured to use a fully qualified domain name and is using the default Web site).

For more information, see How to Install Configuration Manager Clients Using Software Update Point Based Installation.

Hardware Inventory Fails If Client Switches Site Mode While BITS Installation Is Pending Reboot

When you switch the Configuration Manager 2007 client to a different site mode while the installation of Background Intelligent Transfer Service (BITS) is pending a restart, the client computer might not be able to send hardware inventory files to the management point. Entries similar to the following will appear in DataTransferService.log on the client computer:

DTS::AddTransportSecurityOptionsToBITSJob - Failed to QueryInterface for IBackgroundCopyJobHttpOptions. BITS 2.5+ may not be installed properly.

Solution

Restart the computer, and then reinstall the Configuration Manager 2007 client software.

Configuration Manager Client Remains Published to WSUS After You Uninstall a Site

When you uninstall a Configuration Manager 2007 site without first deselecting the option Enable Software Update Point Client Installation on the Software Update Point Client Installation Properties dialog box, the client will remain published as a software update in Windows Server Update Services (WSUS). If you then reinstall a Configuration Manager 2007 site with a newer client version and publish the client to WSUS, both client versions will be published.

Solution

Clear the check box Enable Software Update Point Client Installation in the General tab of the Software Update Point Client Installation Properties dialog box before uninstalling a Configuration Manager 2007 site. You can also use the WSUS console to remove published software updates.

For more information, see How to Install Configuration Manager Clients Using Software Update Point Based Installation.

High Load on Fallback Status Point Caused by Client Resynchronization

Client resynchronization is triggered when the state message system believes that data is missing from a client computer. When a high number of resynchronizations occur, this might cause a backlog of state messages that adversely affects the performance of the fallback status point server and of the Configuration Manager 2007 site server.

To identify whether clients are undergoing resynchronization, use the following SQL query to discover how many clients have resynchronized in the last seven days:

Copy Code
select count(*) from v_ClientMessageStatistics where LastResyncIssuedTime > DateAdd( day , -7 , GetUTCDate())

For information about creating queries, see How to Create a Query.

Solution

Wait for the backlog to clear. Alternatively, consider changing the default throttle interval on the fallback status point to limit the number of state messages sent to the site server. For more information, see Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager.

Cannot Approve or Block (or Unblock) a Client Outside Its Assigned Site

Manually approving and blocking (or unblocking) a client is not supported from sites other than the client's assigned site. These options are not available when you right-click clients from sites higher in the hierarchy than their assigned site.

Solution

Perform these actions from the client's assigned site. For more information, see the following:

  • How to Approve Configuration Manager Clients
  • How to Block Configuration Manager Clients

Client Communication Fails Because SPN Is Not Configured When Using a CNAME (DNS Alias) for Site Systems - Such as Distribution Points and Management Points

When Configuration Manager 2007 site systems are configured with a fully qualified domain name (FQDN) that is a CNAME (DNS alias) rather than the computer name registered in Active Directory Domain Services, the CNAME must be configured with a Kerberos service principal name (SPN) whenever Windows authentication is used. For example, Windows authentication is required in the following scenarios:

  • Users initiate content download from distribution points on site systems configured with CNAMEs, and the content is not configured for anonymous access.
  • The site is in mixed mode and configured with the option Automatically approve computers in trusted domains (recommended), and the management point site system is configured with a CNAME.

When Windows authentication fails in the preceding scenarios, the client records an HTTP 401 error in the log files Datatransferservice.log (for content download failures) and ccmexec.log (for automatic approval failures).

Note
If you see these 401 errors, even if the CNAME SPN is registered, it might be configured incorrectly. Re-register it using the procedure in the following solution.

Solution

For all site systems configured to use a CNAME, register the SPN using the Windows Setspn tool with the following syntax:

Setspn –A HTTP/CNAME_FQDN computername

The Setspn tool is included in Windows Server 2003 Support Tools. You can install Windows Server 2003 Support Tools from the Support\Tools folder of the Windows Server 2003 startup disk. By default, the support tools install in the folder C:\Program Files\Support Tools.

For more information about using SPNs with IIS, see the following article that explains how to use SPNs when you configure Web applications that are hosted on IIS 6.0: http://go.microsoft.com/fwlink/?LinkId=94785.

Important
If you have configured a network load balancing (NLB) management point with a CNAME, do not use this procedure for the cluster name. Instead, follow the instructions in the following topic: How to Configure an SPN for NLB Management Point Site Systems.

Clients Connecting over VPN Cannot Install Software Updates or Run Advertisements

If clients assigned to the site can install software updates and run advertisements when they are directly connected to the intranet but not when they are connected over a virtual private network (VPN) connection, this is likely to be a configuration issue related to boundaries and the software update deployment or advertisement configuration.

If you haven't defined the VPN scope used by these clients as a boundary for their assigned site, the VPN connection will be considered to be within a slow network boundary. You will also see this issue if you have defined the VPN scope as a boundary but it is configured as a slow network boundary rather than a fast network boundary. In either of these scenarios, if software update deployments or advertisements are configured to not install for clients connected to a slow network boundary (the default configuration), VPN clients will not be able to access this content until they are connected directly to the intranet (on a defined, fast network boundary).

Solution

There are two possible solutions to this scenario. Select the solution that best meets your business requirements:

  • If the VPN connection is fast and reliable enough that you want these clients to be considered as if they are connected directly to the intranet at their assigned site, configure a fast boundary. This will help ensure that they can always install advertisements and software update deployments available at their assigned site when they are connected over the VPN. Consult the VPN administrator to obtain a list of possible addresses for clients when they connect over the VPN, and use this information to create a fast network boundary with these addresses. Make sure that you are informed of any VPN scope changes so that you can modify the associated boundary information.
  • If the VPN connection is not fast or reliable but selected software update deployments and advertisements are critical for VPN clients, reconfigure the software update deployments and advertisements. Configure them with the option to download content and run locally instead of the default option to not install when clients are connected within a slow network boundary. However, this can result in other clients also installing this content when they are roaming to another site if they fall back to asking their default management point for content.

For more information about configuring boundaries, see Planning Configuration Manager Boundaries and New Boundary Dialog Box.

For more information about when roaming clients fall back to accessing content at their assigned site from remote sites, see About Client Roaming in Configuration Manager and Example Roaming Scenarios for Configuration Manager: Simple.

The Message 'Validation data missing or invalid' Frequently Appears in PolicyAgent.log

When a client computer requests a user policy and finds that no policy updates are available, the message Validation data missing or invalid is generated in the log file PolicyAgent.log.

Solution

None. This is a benign error message and will not interfere with the operation of a Configuration Manager 2007 site.

Available Cache Space on Configuration Manager Client Computer Displays Zero

If the Configuration Manager 2007 client is installed using the DISABLECACHEOPT=TRUE installation property, the user is unable to change the size of the temporary program download (cache) folder. However, the Amount of disk space to use (MB) item in the Advanced tab of the Configuration Manager Properties dialog box displays the value of 0, regardless of the size the folder has been set to.

Solution

There is currently no solution or workaround for this issue.

References to "Error registering hosted class" in Client Log File CCMExec.log

After client installation and at every restart of the client, the following is logged in the file CCMexec.log:

Error registering hosted class '{E67DBF56-96CA-4e11-83A5-5DEC8BD02EA8}'. Code 0x80040154

For more information about client log files, see Log Files for Managing Configuration Manager Clients.

Solution

This log entry does not identify a problem with the client and can be safely ignored.

See Also

Concepts

What's New in Client Deployment for Configuration Manager

Other Resources

Planning and Deploying Clients for Configuration Manager 2007
Troubleshooting Configuration Manager Client Issues


Best Practices for Securing Clients

Microsoft System Center Configuration Manager 2007 must accept data from clients, which introduces the risk that the clients could attack the site, for example by sending malformed inventory, or attempting to overload the site systems. Deploy the Configuration Manager 2007 only to computers and devices that you trust.

The following section applies only to client computers. For information about mobile device clients, see Mobile Device Clients Security Best Practices and Privacy Information.

Best Practices for Mixed Mode

Automatically approve clients from trusted domains Approval can be manual, automatic for computers in trusted domains, or automatic for all computers and is configured as a site property on the site mode tab for mixed mode sites. The most secure approval method is to automatically approve clients that are members of trusted domains. In this mode, clients that are not members of a trusted domain, including workgroup clients, must be manually approved. If you want to manually verify every client before it is allowed to receive policies containing sensitive data, set the approval mode to manual. Automatically approving all clients is not recommended unless you have other access controls to prevent untrustworthy computers from accessing your network. If a client is not approved by an automatic method, it still displays in the Configuration Manager 2007 console and can be manually approved by locating it in a collection and using Approve from the Action menu.

Note
If a client that was previously approved is deleted from the Configuration Manager 2007 console, and then not approved when it reappears in the console, the client will still have any policies containing sensitive data.

Do not rely on blocking to prevent clients from accessing the site Blocked clients are rejected by the Configuration Manager 2007 infrastructure so that they cannot communicate with site systems to download policy, upload inventory data, or send state or status messages. However, do not rely on blocking to protect the site from untrusted computers or mobile devices if the site is in mixed mode, because a blocked client could re-join the site with a new self-signed certificate and hardware ID. This feature is designed to be used to block lost or compromised boot media when deploying clients with the operating system deployment feature, and with native mode clients. If the site is in native mode and your public key infrastructure supports a certificate revocation list (CRL), always consider certificate revocation to be the primary line of defense against potentially compromised certificates. Blocking clients in Configuration Manager 2007 offers a second line of defense to protect your hierarchy. For more information, see Determine If You Need to Block Configuration Manager Clients.

Upgrade all clients to Configuration Manager 2007 and select "This site contains only ConfigMgr 2007 clients" If the check box This site contains only ConfigMgr 2007 clients is selected, only clients that are approved can receive policies containing sensitive data. However if the check box is not selected, then policies containing sensitive data can be sent to any client.

Best Practices for Native Mode

Use native mode whenever possible Native mode uses certificates issued by a PKI to provide mutual authentication between site systems and clients. Native mode is designed to be the most secure mode for Configuration Manager 2007.

Configure all distribution points to use BITS If you do not configure the setting Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS, then clients will communicate with those distribution points using server message blocks (SMB), even in native mode. SMB communication is not authenticated or encrypted by Configuration Manager 2007, even in native mode.

Do not enable "HTTP communication for roaming and site assignment" Enabling this setting allows native mode clients to communicate with resident management points and distributions points using HTTP instead of HTTPS when they roam to mixed mode sites. However, this setting must be enabled if Active Directory Domain Services schema is not extended for Configuration Manager 2007, or the native-mode site manages clients on the intranet from untrusted domains or workgroups. For more information, see Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode).

Follow the recommended best practices for certificate management For more information, see Best Practices for Certificate Management.

Best Practices for All Client Computers

Choose a client installation method that fits your risk profile There are several ways to install the Configuration Manager 2007 client software on your managed computers. The following table discusses the security pros, cons, and considerations for each method.

Method | Pros | Cons | Considerations
Manual Installation | Can be very secure if access controls and change controls are implemented. | Very resource and process intensive; does not scale well. Requires a user with administrative rights at each computer. | The administrator must create security controls for the entire process.
Imaging | Can be very secure if access controls and change controls are implemented. | Only practical for deploying a new client base, not deploying to existing computers. | The operating system deployment feature of Configuration Manager 2007 can be used to install the Configuration Manager 2007 client software as the new operating system is deployed.
Group Policy | Scales easily to large numbers of client computers. Uses security controls already present in Active Directory Domain Services. Automatically runs with administrative rights. | Requires coordination with Active Directory Domain Services Administrator. Organizational Units might not match how clients should be deployed throughout the site. Does not work for workgroup clients. | Group policy interactions can be complex to evaluate. Monitor to be sure computers receive the client software and correct client settings.
Client Push Installation | Scales easily to large numbers of client computers. | Requires an account with administrative rights on each client. Requires File and Printer sharing. Requires the file and print sharing ports and the Remote Administration service be open in the client personal firewall. For more information, see Firewall Settings for Configuration Manager Clients. | Do not use a Domain Admin account as the Client Push Installation account. Consider using multiple Client Push Installation accounts with smaller scopes of administration, so if attackers compromise one account they do not gain administrative control of all Configuration Manager 2007 client computers. For more information, see About the Client Push Installation Account.
Software Update Point Client Installation | Integrates with the software update feature. Low risk of file tampering because all software updates are signed. Automatically runs with administrative rights. | Requires WSUS infrastructure. You cannot use a different WSUS server for client installation and software updates. If the client is not already installed, you must configure an Active Directory Group Policy object using the correct server name format and port number. | An incorrectly configured Active Directory Group Policy object could prevent the client from obtaining software updates from the software update point. For more information, see How to Install Configuration Manager Clients Using Software Update Point Based Installation.
Software distribution | Easy way to upgrade existing clients without requiring a local administrator account Scales easily to large numbers of client computers. Can be configured to run with administrative rights. | Works only for existing client computers that need to be upgraded. | As with all software distribution, you must secure the source files that Configuration Manager 2007 uses to create the package.

Remove certificates prior to imaging clients If you plan to deploy clients using imaging technology, always remove certificates such as native mode client authentication certificates or mixed mode self-signed certificates prior to capturing the image. Failure to do so could allow clients to impersonate each other and could make it impossible to verify the data for each client. For more information about using Sysprep to prepare a computer for imaging, see http://go.microsoft.com/fwlink/?LinkId=93068.

Ensure that the Configuration Manager clients get an authorized copy of the trusted root key upon installation If you have not extended the Active Directory schema, clients rely on the trusted root key to authenticate valid management points. Without the trusted root key, the client has no way to verify that the management point is a trusted management point for the site, allowing a skilled attacker to direct the client to a rogue management point.

Configure client computers to use Active Directory Only mode The most secure option for client configuration is SMSDIRECTORYLOOKUP=NoWINS, however it can be used only if your clients can query the global catalog so it should not be used for clients in remote forests or workgroups, or if Active Directory schema has not been extended. If clients must use WINS for service location and SMSDIRECTORYLOOKUP=NoWINS, then service location will fail. For more information, see Configuration Manager and Service Location (Site Information and Management Points). If no properties are specified, the client installs in Secure WINS mode. The Any WINS mode is not secure and is not recommended. For more information, see About Configuration Manager Client Installation Properties.

Ensure maintenance windows are large enough to deploy critical software updates Configuration Manager 2007 gives you the ability to configure maintenance windows on the collections that clients are members of to restrict the times which Configuration Manager 2007 can use to install software. If you set too small of a window, the client might not be able to install critical software updates, leaving the client vulnerable to the attack mitigated by the software update.

Security Issues

The following security issues have no mitigation.

Status messages are not authenticated No authentication is performed on status messages. In mixed mode, any computer can send status messages to the management point. In native mode, a computer would have to obtain a valid client authentication certificate from a trusted root CA, but could also then send any status message. If a client sends an invalid status message it will be discarded. There are a few potential attacks against this vulnerability. An attacker could send a bogus status message to gain membership in a collection based on status message queries. Any client could launch a denial of service against the management point by flooding it with status messages. If status messages are triggering actions in status message filter rules, an attacker could trigger the status message filter rule. An attacker could also send status message that would render reporting information inaccurate.

Policies can be retargeted to non-targeted clients There are several methods attackers could use to make a policy targeted to one client apply to an entirely different client. For example, an attacker at a trusted client could send false inventory or discovery information to have the computer added to a collection it should not belong to, and then receive all of the advertisements to that collection. While controls exist to help prevent attackers from modifying policy directly, attackers could take an existing policy to reformat and redeploy an operating system and send it to a different computer, creating a denial of service. These types of attacks would require precise timing and extensive knowledge of Configuration Manager 2007 infrastructure.

Client logs allow user access All of the client log files allow users Read access and Interactive Users Write access. If you enable verbose logging, attackers might read the log files to look for information about compliance or system vulnerabilities. Processes such as software distribution that are performed in a user's context must be able to write to logs with a low-rights user account. This means an attacker could also write to the logs with a low rights account. The most serious risk is that an attacker could remove information in the log files that an administrator might need for auditing and intruder detection.

Privacy Information

When you deploy the Configuration Manager 2007 client, you enable client agents so you can use Configuration Manager 2007 features. The settings you use to configure the features apply to all clients in the site, regardless whether they are directly connected to the corporate network, connected through a remote session, or connected to the Internet but supported by the site. Client information is stored in the database and is not sent back to Microsoft. Before configuring the Configuration Manager 2007 client, consider your privacy requirements.

See Also

Other Resources

How to Manage the Trusted Root Key in Configuration Manager


Technical Reference for Configuration Manager Client Deployment

Click any link in the following section for technical references for client deployment in Configuration Manager 2007.

In This Section

Firewall Settings for Configuration Manager Clients

Specifies how to configure Windows Firewall when you are running the Configuration Manager 2007 client software.

How to Export the Site Server Signing Certificate for Configuration Manager Client Installation

Procedural information for exporting the native mode site server signing certificate if you need to specify this during client installation.

About Client Policy in Configuration Manager

Provides information about how client obtain and use policies in Configuration Manager 2007.

Example Assignment Scenarios for Configuration Manager: Primary Sites

Provides example scenarios to help explain how site assignment works when clients reside within boundaries of primary sites.

Example Assignment Scenarios for Configuration Manager: Secondary Sites

Provides example scenarios to help explain how site assignment works when clients reside within boundaries of secondary sites.

Example Roaming Scenarios for Configuration Manager: Simple

Provides example scenarios to help explain which management points roaming clients communicate with when roaming.

Example Roaming Scenarios for Configuration Manager: Complex

Provides example scenarios to help explain more complex roaming scenarios, and how a combination of factors and configuration can lead to often unwanted results.

See Also

Other Resources

Planning and Deploying Clients for Configuration Manager 2007


Firewall Settings for Configuration Manager Clients

Topic last updated – August 2008

Client computers that run Windows Firewall might require exceptions to be defined to allow communications with Microsoft System Center Configuration Manager 2007 site systems. These exceptions vary depending on the features of Configuration Manager 2007 you intend to use.

The following sections list the features of Configuration Manager 2007 which require exceptions to be made on the Windows Firewall and provide a procedure for configuring these exceptions.

Modifying the Ports and Programs Permitted by Windows Firewall

To modify the ports and programs permitted by Windows Firewall:

  1. On the computer running Windows Firewall, open Control Panel.

  2. Right-click Windows Firewall and click Open.

  3. On the Exceptions tab of the Windows Firewall Settings dialog box, select enable any required exceptions in the list box, or Click Add Program or Add Port to create custom programs or ports

Programs and Ports Required by Configuration Manager 2007

The following Configuration Manager 2007 features require exceptions to be made on the Windows Firewall:

Queries

If you are running the Configuration Manager console on a computer running Windows Firewall, queries will fail the first time they are run.

After failing to run the first time, the operating system displays a dialog box asking if you want to unblock statview.exe. If you unblock statview.exe, future queries will run without errors. You can also manually add statview.exe to the list of programs and services on the Exceptions tab of the Windows Firewall prior to running a query.

Client Push Installation

In order to successfully use client push to install the Configuration Manager 2007 client, you must add the following as exceptions to the Windows Firewall:

  • File and Printer Sharing
  • Windows Management Instrumentation (WMI)

Client Requests

In order for client computers to communicate with Configuration Manager 2007 site systems, you must add the following as exceptions to the Windows Firewall:

TCP Port 80 (for HTTP communication)

TCP Port 443 (for HTTPS communication)

Important
These are default port numbers which can be changed in Configuration Manager 2007. For more information, see How to Configure Request Ports for the Configuration Manager Client. If these ports have been changed, you must also configure matching exceptions on the Windows Firewall.

Network Access Protection

In order for client computers to successfully communicate with the system health validator point, you need to allow the following ports:

  • UDP 67 and UDP 68 for DHCP
  • TCP 80/443 for IPSec

Remote Control

In order to use the remote tools features of Configuration Manager 2007, you need to allow the following ports:

  • TCP port 2701
  • TCP port 2702
  • TCP port 135

Remote Assistance and Remote Desktop

To enable Remote Assistance to be initiated from the SMS Administrator console, add both the custom program helpsvc.exe and the custom port TCP 135 to the list of permitted programs and services in Windows Firewall on the client computer. Also, Windows Firewall must be configured to permit Remote Assistance and Remote Desktop. If a user initiates a request for Remote Assistance from that computer, Windows Firewall will automatically be configured to permit Remote Assistance and Remote Desktop.

Windows Event Viewer, Windows Performance Monitor and Windows Diagnostics

To enable Windows event viewer, Windows performance monitor and Windows diagnostics to be accessed from the Configuration Manager console, you must enable File and Printer Sharing as an exception on the Windows Firewall.

See Also

Tasks

How to Configure Request Ports for the Configuration Manager Client

Concepts

Overview of Configuration Manager Client Deployment
Determine the Ports Required for Internet-Based Client Management
Determine the Ports Required by Firewalls to Support Network Access Protection
Ports Used by Configuration Manager


How to Export the Site Server Signing Certificate for Configuration Manager Client Installation

Topic last updated—November 2007

If you need to install Configuration Manager 2007 clients with a copy of the native mode site server signing certificate because they cannot securely retrieve it from Active Directory Domain Services, use the following procedure to export the site server signing certificate so that it can be referenced with the CCMSETUP client.msi property, SMSSIGNCERT=<Full path and filename.cer>.

For more information about whether you need to use the SMSSIGNCERT property, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode).

For more information about installing clients with CCMSetup properties, see About Configuration Manager Client Installation Properties.

Important
Before performing this procedure, ensure that the site server signing certificate is already deployed to the site server. For more information, see Deploying the Site Server Signing Certificate to the Site Server.

To export a copy of the site server signing certificate so that it can be included during client installation

  1. On the Windows Server 2003 computer that is the Configuration Manager site server, click Start, click Run, type MMC in the Run dialog box, and then click OK.

  2. In the empty console, click File, and then click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, click Add.

  4. Select Certificates from Available snap-ins, and then click Add.

  5. In the Certificates snap-in dialog box, click Computer account, and then click Next.

  6. In the Select Computer dialog box, ensure that the option Local computer: (the computer this console is running on) is selected, and then click Finish.

  7. In the Add or Remove Snap-ins dialog box, click OK.

  8. In the console, expand Certificates (Local Computer).

  9. Expand Personal, and then click Certificates.

  10. In the results pane, locate the site server signing certificate. You can identify this certificate by using the following display columns:

    • The Issued To field will display The site code of this site server is <site_code>.
    • The Intended Purposes column will display Document Signing.

  11. Right-click the site server signing certificate, click All Tasks, and then click Export.

  12. In the Certificate Export Wizard, click Next.

  13. On the Export Private Key page, ensure that No, do not export the private key is selected, and then click Next.

  14. On the Export File Format page, ensure that DER encoded binary X.509 (.CER) is selected, and then click Next.

  15. On the File to Export page, specify the path and file into which you will export a copy of the certificate (there is no need to specify the .cer extension, which will be added automatically), and then click Next.

  16. To close the wizard, click Finish in the Certificate Export Wizard, and then click OK to acknowledge the successful export completion.

  17. Store the file securely, and ensure that you can access it securely when you need to specify the SMSSIGNCERT parameter during client installation.

    Important
    Do not access the file using a file share, unless the connection uses IPsec with encryption. Connections to file shares use server message blocks (SMB), which does not encrypt data communication.

See Also

Tasks

How to Export Certificates For Use With Operating System Deployment
How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

Concepts

Administrator Checklist: Deploying the PKI Requirements for Native Mode
Certificate Requirements for Native Mode
Configuration Manager Site Modes
Deploying the Client Computer Certificates to Clients and the Management Point


About Client Policy in Configuration Manager

When you make a change in the Microsoft System Center Configuration Manager 2007 console, the site server creates a policy to communicate the change to the client. The site server sends the policy to the management point and the client polls for policy at the interval configured on the Computer Client Agent properties.

Policy Assignments and Policy Bodies

For efficiency, policies are created and accessed in two parts, policy assignments and policy bodies. Policy assignments can contain applicability rules so the clients download only the policy assignments that apply to them. If there is no applicability rule in the policy, it applies to all clients. Policy assignments contain pointers to the actual policy, which is contained in the policy body. The pointer is actually a URL to the policy body on the management point. The URL in the policy assignment does not actually contain the name of the management point, just a variable that the client replaces with the name of the assigned management point or, if at a secondary site, the proxy management point. For information about how clients locate their management point, see Configuration Manager and Service Location (Site Information and Management Points).

Full and Delta Policy

The first time a client requests policy assignments it requests full policy but thereafter it usually requests only the policy assignments it does not already have. The server uses a reference with the date and time stamp to determine which policy assignments the client has already received. Certain situations can trigger a full policy request, such as changing the site mode, assigning a client to a new site, or using the PolicySpy tool to request assignments.

Policy Caching

Policy assignments are never cached. Every time the client asks for policy assignments the management point contacts the site database so the client always gets the most recent assignments. If the client is at a secondary site that is the child of its assigned site, it can request policy assignments from the proxy management point at the secondary site. If the client is roaming to another primary or secondary site in the hierarchy, the client requests policy from the assigned management point.

Policy bodies can be cached by the management point to help preserve bandwidth. If the policy is frequently requested by clients, it remains in cache (space permitting) and if it is not requested, it ages out. The policy body is never updated. If the body requires a change, the policy body is marked as obsolete and the policy assignment will point to a new policy body.

Policy and BITS

Most policy is downloaded using BITS. Client BITS settings can be configured on the BITS tab of the Computer Client Agent properties. If you configure throttling settings to apply to clients, it might take longer for clients to receive policy.

See Also

Concepts

About Client Roaming in Configuration Manager

Other Resources

Planning and Deploying Clients for Configuration Manager 2007
Technical Reference for Configuration Manager Client Deployment


Example Assignment Scenarios for Configuration Manager: Primary Sites

Topic last updated -- August 2007

The scenarios in this topic will help you understand how site assignment works in Configuration Manager 2007 using some scenarios that assign clients to sites in a fictitious company multi-site deployment of Configuration Manager.

Before reading these scenarios, see About Client Site Assignment in Configuration Manager.

The scenarios covered are the following:

  • Auto-Site Assignment Succeeds with Manual Installation
  • Auto-Site Assignment Fails with Manual Installation
  • Auto-Site Assignment Assigns Client to Wrong Site
  • Successful Client Push Installation Using the Client Push Installation Wizard from the Central Site
  • Site Assignment for Internet-Based Clients
  • Site Assignment When a Configuration Manager Client is Assigned to an SMS 2003 Site
  • Site Assignment When the Client's Communication Mode Doesn't Match its Assigned Site's Mode

These scenarios cover site assignment when a client's network location during the assignment process falls within the defined boundaries of a primary site. For example, the client's Active Directory site is defined as a boundary, or the client's IP address or subnet falls within an IP address range or subnet that is defined as a boundary.

For example scenarios of assignment when a client's network location falls within the boundaries of a secondary site, see Example Assignment Scenarios for Configuration Manager: Secondary Sites.

For an example scenario for when a client's network location doesn't fall within any of the defined boundaries for the hierarchy, see Example Roaming Scenarios for Configuration Manager: Complex.

Each assignment scenario is explained in terms of whether clients have global roaming capability, or only regional roaming capability:

  • Global roaming capability refers to the ability of clients to access site information from Active Directory Domain Services. This requires that the Active Directory schema is extended for Configuration Manager 2007, that all sites are publishing to Active Directory Domain Services, and the client belongs to the same forest. For more information, see How to Extend the Active Directory Schema for Configuration Manager.
  • Regional roaming capability refers to the roaming behavior of clients when global roaming is not possible because the Active Directory schema has not been extended for Configuration Manager 2007, or it has been extended but not all sites are publishing to Active Directory Domain Services, or the client doesn't belong to the same forest (for example, is a workgroup client).

Hierarchy Used in All Roaming Scenario Examples

The hierarchy has three tiers of primary sites:

  • At the top of the hierarchy is the central site, a primary site in Toronto named TOR.
  • At the second level of primary sites, there are three primary child sites in Houston, London, and Shanghai, named HOU, LON, and SHA respectively.
    • The Houston child primary site has two secondary sites in Seattle and Boston: SEA, BOS.
    • The LON child primary site has one secondary site in Manchester: MAN.
    • The SHA child primary site has no secondary sites.
  • At the third level of primary sites, there are two primary grandchild sites in Sydney and Helsinki, named SYD and HEL respectively.
    • The SYN grandchild primary site has two secondary sites in Melbourne and Brisbane: MEL, BRI.
    • The HEL grandchild primary site has no secondary sites.

This hierarchy is shown in the following illustration.

ConfigMgr Hierarchy Used with Scenarios

Auto-Site Assignment Succeeds with Manual Installation

An administrator in Houston (HOU) manually installs a Configuration Manager 2007 client using auto-site assignment, and wants the client to assign to the Sydney site. The network location of the computer falls within the configured boundaries of the Sydney site (SYD).

This scenario is depicted in the following illustration.

Auto-Site Assignment Succeeds

Global Roaming Capability

When site assignment is triggered, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Sydney site (SYD) and then looks for the site compatibility information for the Sydney site. The site compatibility succeeds (the site is running Configuration Manager 2007, and the client is not running Windows 2000 and assigned to a native mode site), and the client assigns to the site and configures it default management point for the Sydney site.

Regional Roaming Capability

When site assignment is triggered, the Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point looks for a match with the list of boundaries defined for each site. It finds a match for the Sydney site (SYD) and sends site information for SYD to the client. The client checks the site compatibility information for the Sydney site. The site compatibility succeeds (the site is running Configuration Manager 2007, and the client is not running Windows 2000 and assigned to a native mode site), and the client assigns to the site and configures its default management point for the Sydney site.

Critical Configuration Steps

The following configuration steps are required for this scenario to succeed.

Requirement More Information

The Sydney site must be configured with boundaries that include the client's network location - such as Active Directory site, or IP subnets.

How to Configure Configuration Manager Boundaries

If you are installing clients with regionally roaming capability, they must be able to find a server locator point using one of these mechanisms:

  • Add the CCMSetup client.msi property SMSSLP on the command line as a Client Push Installation property.
  • Manually add an entry to WINS either in the Sydney site, or ensuring that it has replicated to the Sydney site.

About Configuration Manager Client Installation Properties

How to Manually Add Configuration Manager Site Information to WINS

Auto-Site Assignment Fails with Manual Installation

An administrator in Houston wants to assign a new computer to the Houston site (HOU) and manually installs the Configuration Manager 2007 client using auto-site assignment. The network location of the computer falls outside all the configured boundaries of the Configuration Manager 2007 hierarchy. This might happen in the following scenarios:

  • The DHCP Administrator added new scopes and did not inform the Configuration Manager.
  • The Active Directory Domain Services administrator added new Active Directory sites who did not inform the Configuration Manager administrator, who is using Active Directory sites to configure boundaries.
  • The Configuration Manager administrator did not realize the importance of making sure all possible network locations are represented as boundary information in the Configuration Manager hierarchy.

Global Roaming Capability

When site assignment is triggered, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It cannot find a match, site assignment fails and the client is unmanaged.

Regional Roaming Capability

When site assignment is triggered, the Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point looks for a match with the list of boundaries defined for each site. It cannot find a match, site assignment fails and the client is unmanaged.

Assignment Solutions

Resolve this situation by fulfilling one of the following configuration steps.

Requirement | More Information
The Houston site must be configured with boundaries that include the client's network location, such as its Active Directory site or its IP subnet. | How to Configure Configuration Manager Boundaries
Directly assign the client to the Houston site, rather than using auto-site assignment. | How to Assign Configuration Manager Clients to a Site

Auto-Site Assignment Assigns Client to Wrong Site

The administrator in London wants to install and assign 5 new laptops to the London site (LON). She adds logon script installation instructions for the Configuration Manager 2007 client using auto-site assignment. Although the network location of these laptops normally fall within the configured boundaries of the London site, one user travels to Sydney and the client installs when the computer is connected to the network in Sydney (SYD).

This scenario is depicted in the following illustration.

Client Assigned to Wrong Site

Global Roaming Capability

When site assignment is triggered for the laptop installing the client in Sydney, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Sydney site (SYD) and then looks for the site compatibility information for the Sydney site. The site compatibility succeeds (the site is running Configuration Manager 2007, and the client is not running Windows 2000 and assigned to a native mode site), and the client assigns to the site and configures it default management point for the Sydney site.

The laptop user returns to London (LON). Although London is supposed to be the laptop's assigned site, it is actually assigned to Sydney (SYD) and remains assigned despite its change in network location. When the laptop reconnects to the London site (LON) it continues to contact its default management point in Sydney for policy, and for sending it inventory and status information. However, it will ask the resident management point in London for software packages and software updates.

Regional Roaming Capability

When site assignment is triggered for the laptop installing the client in Sydney, the Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point looks for a match with the list of boundaries defined for each site. It finds a match for the Sydney site (SYD) and sends site information for SYD to the client. The client checks the site compatibility information for the Sydney site. The site compatibility succeeds (the site is running Configuration Manager 2007, and the client is not running Windows 2000 and assigned to a native mode site), and the client assigns to the site and configures it default management point for the Sydney site.

The laptop user returns to London (LON). Although London is supposed to be the client's assigned site, it is actually assigned to Sydney (SYD) and remains assigned despite its change in network location. When the laptop reconnects to the London site (LON) it continues to contact its default management point in Sydney for policy, and for sending it inventory and status information. The management point in Sydney has no knowledge of software packages and software updates in London, so when the client requests content, it returns a list of distribution points from the site in Sydney.

Similar Behavior

The same behavior would be seen if the laptop didn't roam but the following scenarios occurred:

  • Auto-site assignment was not used but the client was incorrectly assigned to a site other than London.
  • Another site was configured with a boundary that matched the client's network location. This can happen in an upgrade scenario when the boundary information has changed after the client was first installed.
  • The hierarchy is incorrectly configured with overlapping boundaries.

Assignment Solutions

To resolve this situation, reassign the client to the London site (LON). For more information, see How to Assign Configuration Manager Clients to a Site.

To prevent this situation, do not use auto-site assignment for laptops that roam outside their normal primary sites, unless it is to secondary sites that are attached to their normal primary site.

Successful Client Push Installation Using the Client Push Installation Wizard from the Central Site

New computers are added to the network at the Helsinki site without the Configuration Manager 2007 client installed, and are discovered as a resource by Configuration Manager using one of the discovery methods configured at the Helsinki site. These discovered computers replicate up the hierarchy so that they appear in the All Systems collection at the Toronto site.

These clients have IP network addresses that fall within the configured IP subnet boundaries in the Helsinki (HEL) site. The Helsinki site does not have the option Enable Client Push Installation to assigned resources enabled on the Client Push Installation Properties: General Tab.

The administrator at the central site in Toronto initiates installation for these clients by right-clicking on them, and running the Client Push Installation Wizard. She makes sure that the following option on the Installation Options Page in the wizard is not set: Include only clients in this site's boundaries.

This scenario is depicted in the following illustration.

Site Assignment with Client Push

Global Roaming Capability

The client is successfully installed and site assignment is triggered. The Configuration Manager client compares its current network location (IP address, IP subnet, and Active Directory site) with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Helsinki site (HEL) and then looks for the site compatibility information for the Helsinki site. The site compatibility succeeds (the site is running Configuration Manager 2007, and the client is not running Windows 2000 and assigned to a native mode site), and the client assigns to the site and configures it default management point for the Helsinki site (HEL).

Regional Roaming Capability

The client is successfully installed and site assignment is triggered. The Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point finds a match for the Helsinki site (HEL) and sends site information for HEL to the client. The client checks the site compatibility information for the Helsinki site. The site compatibility succeeds (the site is running Configuration Manager 2007, and the client is not running Windows 2000 and assigned to a native mode site), and the client assigns to the site and configures it default management point for the Helsinki site (HEL).

Critical Configuration Steps

The following configuration steps are required for this scenario to succeed.

Requirement More Information

The Helsinki site must be configured with boundaries that include the clients' network location - such as Active Directory site, or IP subnets.

How to Configure Configuration Manager Boundaries

A discovery method must be configured at the Helsinki site (or another site in the hierarchy) that finds the computer resources.

How to Enable a Discovery Method

A client push installation account must be configured at the Toronto site.

How to Configure the Configuration Manager Client Push Installation Account

Firewall settings must not block client installation traffic.

Firewall Settings for Configuration Manager Clients

If you are installing clients with regionally roaming capability, they must be able to find a server locator point using one of these mechanisms:

  • Manually add the CCMSetup client.msi property SMSSLP to the Client tab as a Client Push Installation property.
  • Manually add an entry to WINS either in the Helsinki site, or ensuring that it has replicated to the Helsinki site.

Client Push Installation Properties: Client Tab

How to Manually Add Configuration Manager Site Information to WINS

Do not select the following option on the Installation Options Page in the wizard: Include only clients in this site's boundaries.

Client Push Installation Wizard

Site Assignment for Internet-Based Clients

New laptops for traveling sales staff are added to the network at the Toronto site (TOR), which is in native mode and configured to support Internet-based client management. When these laptops return to the corporate network, they will be managed on the intranet. However, they spend most of their time connected to the Internet and traveling across the country.

The administrator at Toronto prepares an installation CD for the owners of these laptops, which is mailed to them with instructions. Some users install the client when they are on the intranet, and some when they are on the Internet.

This scenario is depicted in the following illustration.

Site Assignment for Internet Clients

Global Roaming Capability and Regional Roaming Capability

When a laptop is connected to the intranet, the client is successfully installed and site assignment is triggered. The Configuration Manager client is configured for Internet-based client management, and so does not perform a site compatibility check. The client assigns to the Toronto site and identifies that it is currently on the intranet. It locates its default management point for the Toronto site. When it moves to the Internet, it will contact its assigned Internet-based management point in Toronto (TOR).

When a laptop is connected to the Internet, the client is successfully installed and site assignment is triggered. The Configuration Manager client is configured for Internet-based client management, and so does not perform a site compatibility check. The client assigns to the Toronto site and identifies that it is currently on the Internet and so does not locate its default management point. It assigns directly to the Toronto site without checking site compatibility, and it assigns directly to the specified Internet-based management point.

Note
When a client is configured for Internet-based client management, it does not check site compatibility but assigns directly to the specified site.

Critical Configuration Steps

The following configuration steps are required for this scenario to succeed.

Requirement | More Information
The Toronto site must be in native mode, and configured for Internet-based client management. | Administrator Checklist: Deploying the PKI Requirements for Native Mode Administrator Checklist: Configuring a Site for Internet-Based Client Management
Clients must already have their native mode client certificate. | Deploying the Client Computer Certificates to Clients and the Management Point
An installation CD or similar must be prepared with all the required CCMSetup installation properties. | Decide How to Install Configuration Manager Clients for Internet-Based Client Management

Site Assignment When a Configuration Manager Client is Assigned to an SMS 2003 Site

New computers are added to the network at the Shanghai site (SHA), which is still running SMS 2003. The administrator in London has been asked to install these clients for the Shanghai site, but doesn't realize that the Shanghai site hasn't yet been upgraded to Configuration Manager 2007.

This scenario is depicted in the following illustration.

ConfigMgr client assigns to SMS 2003 site

Global Roaming Capability

The client is successfully installed and site assignment is triggered. The Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Shanghai site (SHA) and then looks for the site compatibility information for the Shanghai site. The site compatibility fails because the client is running Configuration Manager 2007 and the site is running SMS 2003. The client fails to assign and is unmanaged, sending this site assignment failure information to its assigned fallback status point in Toronto (TOR).

Regional Roaming Capability

The client is successfully installed and site assignment is triggered. The Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point looks for a match with the list of boundaries defined for each site. The server locator finds a match for the Shanghai site (SHA) and sends site information for SHA to the client. The client checks the site compatibility information for the Shanghai site. The site compatibility fails because the client is running Configuration Manager 2007 and the site is running SMS 2003. The client fails to assign and is unmanaged, sending this site assignment failure information to its assigned fallback status point in Toronto.

Assignment Solutions

Resolve this situation by fulfilling one of the following configuration steps.

Requirement | More Information
Uninstall the Configuration Manager 2007 client, and reinstall the SMS 2003 client. | How to Uninstall the Configuration Manager Client
Reassign this client to another site running Configuration Manager 2007. This will result in the client permanently roaming to the Shanghai site, with some additional WAN traffic to its assigned site. | How to Assign Configuration Manager Clients to a Site
Upgrade the Shanghai site, and then reinstall the Configuration Manager 2007 client. | Configuration Manager Upgrade and Interoperability Planning and Deployment

Site Assignment When the Client's Communication Mode Doesn't Match its Assigned Site's Mode

New computers are added to the network at the Toronto site (TOR), which is configured for native mode. These computers already have their client computer certificates required for native mode. The administrator manually installs the clients without the CCMSetup installation property for native mode.

This scenario is depicted in the following illustration.

Mixed mode client assigns to native mode site

Global Roaming Capability

The client is successfully installed and site assignment is triggered. The Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Toronto site (TOR) and then looks for the site compatibility information for the Toronto site. The site checks pass (the site is running Configuration Manager 2007, and the client is not running Windows 2000).

The client successfully assigns, finds its default management point in Toronto (TOR), and then reads site settings from Active Directory Domain Services. The site settings include the site mode configuration for native mode, so the client automatically changes its client communication mode to match the native site mode configuration.

This client can now successfully communicate with its native mode site in Toronto (TOR).

Regional Roaming Capability

The client is successfully installed and site assignment is triggered. The Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point looks for a match with the list of boundaries defined for each site. The server locator finds a match for the Toronto site (TOR) and sends site information for TOR to the client. The client checks the site compatibility information for the Toronto site. The site checks pass (the site is running Configuration Manager 2007, and the client is not running Windows 2000).

The client successfully assigns, finds its default management point in Toronto (TOR), but cannot communicate with it because the client communication mode does not match the native site mode configuration. Without the ability to locate the site mode setting from Active Directory Domain Services, a client with regional roaming capability cannot automatically reconfigure its client communication mode.

The client successfully assigns, but is unmanaged. It sends this failure information to its assigned fallback status point in Toronto (TOR).

Assignment Solutions

Resolve the unmanaged client that doesn't have global roaming capability with one of the following configuration steps.

Requirement | More Information
Reinstall the client using the CCMSetup command line property /native: [<native mode option>]. | About Configuration Manager Client Installation Properties
Reinstall the client using the Client Push Wizard from the Toronto site. | How to Install Configuration Manager Clients Using Client Push

See Also

Tasks

How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

About Client Site Assignment in Configuration Manager
Determine If You Need a Server Locator Point for Configuration Manager Clients
Example Assignment Scenarios for Configuration Manager: Secondary Sites
Example Roaming Scenarios for Configuration Manager: Simple
Configuration Manager Site Assignment Data Flow
Understanding Configuration Manager Sites

Other Resources

Technical Reference for Configuration Manager Client Deployment


Example Assignment Scenarios for Configuration Manager: Secondary Sites

Topic last updated -- August 2007

The scenarios in this topic will help you understand how clients use secondary sites when they are assigned to a site, and their network location falls within the boundaries of a secondary site that is attached to their assigned site. These scenarios build on the assignment scenarios in Example Assignment Scenarios for Configuration Manager: Primary Sites, and use the same fictitious company multi-site deployment of Configuration Manager.

Before reading these scenarios, see About Client Site Assignment in Configuration Manager.

The scenarios covered are the following:

  • Assignment with Secondary Site that Has No Proxy Management Point
  • Assignment with Secondary Site That Has a Proxy Management Point
  • Client Moves between Secondary Sites that Are Attached to the Client's Assigned Site
  • Assignment with Secondary Site that Isn't Attached to the Client's Assigned Site

To help explain secondary site concepts, all scenarios that follow assume that advertisements and software update deployments allow installation when a client is connected on a slow boundary, that all boundaries within the sites are configured as fast boundaries, there are no protected distribution points, and that the content required by clients always exists in their assigned site. See Example Roaming Scenarios for Configuration Manager: Complex for example scenarios that cover a combination of these configurations and factors.

Although these scenarios cover site assignment, and for computers that might never move from their location, the behavior of clients in finding secondary sites that are attached to their assigned site is the same as if they are roaming. Therefore, each secondary site scenario is explained in terms of whether clients have global roaming capability, or only regional roaming capability:

  • Global roaming capability refers to the ability of clients to access site information from Active Directory Domain Services. This requires that the Active Directory schema is extended for Configuration Manager 2007, that all sites are publishing to Active Directory Domain Services, and the client belongs to the same forest. For more information, see How to Extend the Active Directory Schema for Configuration Manager.
  • Regional roaming capability refers to the roaming behavior of clients when global roaming is not possible because the Active Directory schema has not been extended for Configuration Manager 2007, or it has been extended but not all sites are publishing to Active Directory Domain Services, or the client doesn't belong to the same forest (for example, is a workgroup client).

Configuration Manager Secondary Site Terminology

These scenarios cover how clients use secondary sites, and proxy management points in secondary sites. Use the following table as a quick definition reference of these terms, and for more information see Understanding Configuration Manager Sites and Determine If a Proxy Management Point is Needed at a Secondary Site.

Site Terminology Description

Secondary Site

A secondary site that has no Configuration Manager 2007 site database, but is attached to and reports to a primary site.

The secondary site forwards the information it gathers from Configuration Manager 2007 clients, such as computer inventory data and Configuration Manager 2007 system status information, to its parent site.

Proxy Management Point

A site system role which clients can use in place of their default management point when it is installed in a secondary site that is attached to their assigned site. Clients with a network location that falls within the boundaries of a secondary site with a proxy management can use the proxy management point to send inventory data, discovery data, and status messages. This client information is then compressed and sent to the primary site as part of standard site-to-site communication.

Clients also contact their proxy management point for client policy, both policy assignments and policy bodies. Policy bodies can be cached at proxy management points to help conserve bandwidth between the secondary site and its parent site. For more information about policy assignments and policy bodies, see About Client Policy in Configuration Manager.

When a proxy management point is not installed at a secondary site, clients communicate directly with their default management point for policy and content, and all client information is sent uncompressed directly to the primary site.

Clients can also use proxy management points to ask for content, such as software packages to run advertisements, and software updates to install software update deployments.

Hierarchy Used in All Roaming Scenario Examples

The hierarchy has three tiers of primary sites:

  • At the top of the hierarchy is the central site, a primary site in Toronto named TOR.
  • At the second level of primary sites, there are three primary child sites in Houston, London, and Shanghai, named HOU, LON, and SHA respectively.
    • The Houston child primary site has two secondary sites in Seattle and Boston: SEA, BOS.
    • The LON child primary site has one secondary site in Manchester: MAN.
    • The SHA child primary site has no secondary sites.
  • At the third level of primary sites, there are two primary grandchild sites in Sydney and Helsinki, named SYD and HEL respectively.
    • The SYN grandchild primary site has two secondary sites in Melbourne and Brisbane: MEL, BRI.
    • The HEL grandchild primary site has no secondary sites.

This hierarchy is shown in the following illustration.

ConfigMgr Hierarchy Used with Scenarios

Assignment with Secondary Site that Has No Proxy Management Point

The administrator in London (LON) installs the Configuration Manager 2007 client on a computer whose network location falls within the boundaries of its secondary site in Manchester (MAN), and uses auto-site assignment. The secondary site in Manchester has distribution points, but does not have a proxy management point.

This scenario is depicted in the following illustration.

Secondary site and no proxy management point

Global Roaming Capability

When the computer in Manchester installs the Configuration Manager 2007 client and site assignment is triggered, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Manchester site (MAN) and realizes that this is a secondary site of London. It assigns to London and finds the default management point in London. It then looks for a proxy management point in the Manchester site. There is no proxy management point in Manchester so all policy requests are sent to the default management point in London, and it sends inventory data and status messages to the default management point in London (LON).

However, when it needs software packages or software updates, the default management point returns a list of distribution points in the Manchester site (MAN) so that the client can download content locally.

Regional Roaming Capability

When the computer in Manchester installs the Configuration Manager 2007 client and site assignment is triggered, the Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point looks for a match with the list of boundaries defined for each site. It finds a match for the Manchester site (MAN) and realizes that this is a secondary site of London and sends site information for LON to the client. The client assigns to London and finds the default management point in London. The client then contacts its default management point, which has no proxy management point information to give the client for the Manchester site. All policy requests are sent to the default management point in London (LON), and the client sends inventory data and status messages to the default management point in London (LON).

However, when the client needs software packages or software updates, the default management point in London returns a list of distribution points in the Manchester site (MAN) so that the client can download content locally.

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: LON site (found from Active Directory Domain Services) | Yes
Regional Roaming | Default Management Point: LON site (found using the server locator point) | Yes

Assignment with Secondary Site That Has a Proxy Management Point

The administrator in Houston installs the Configuration Manager 2007 client on a computer whose network location falls within the boundaries of its secondary site in Seattle (SEA), and uses auto-site assignment. The secondary site in Seattle has distribution points and a proxy management point.

This scenario is depicted in the following illustration.

Secondary site and proxy management point

Global Roaming Capability

When the computer in Houston installs the Configuration Manager 2007 client, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Seattle site (SEA) and realizes that this is a secondary site of Houston. The client assigns to Houston (HOU) and finds the default management point in Houston. It then looks for a proxy management point in Active Directory Domain Services for the Seattle site. It finds the proxy management point in Seattle, which it then uses instead of its default management point for most operations.

The client uses this proxy management to request and receive client policy, and send inventory data and status messages.

When the client needs software packages and software updates, it first asks the proxy management point in Seattle for a list of distribution points. If the content does not exist in the Seattle site, the client falls back to asking its default management point in Houston, which returns a list of distributions points from the Houston site (HOU).

Regional Roaming Capability

When the computer in Houston installs the Configuration Manager 2007 client and site assignment is triggered, the Configuration Manager client sends its network location (IP address, IP subnet, and Active Directory site if it has one) to a server locator point. The server locator point looks for a match with the list of boundaries defined for each site. The server locator point finds a match for the Seattle site (SEA) and realizes that this is a secondary site of Houston (HOU). The server locator point sends site information for HOU to the client, and the client assigns to Houston.

The client then finds the default management point in Houston. The client contacts the default management point in Houston, which looks at the client's network location and realizes that it falls within the boundaries of its secondary site in Seattle that has a proxy management point. It instructs the client about the proxy management point in Seattle, which the client then uses instead of its default management point for most operations.

The client uses this proxy management to request and receive client policy, and send inventory data and status messages.

When the client needs software packages and software updates, it first asks the proxy management point in Seattle for a list of distribution points. If the content does not exist in the Seattle site, the client falls back to asking its default management point in Houston, which returns a list of distributions points from the Houston site (HOU).

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: HOU site (found from Active Directory Domain Services) Proxy Management Point: SEA site (found from Active Directory Domain Services) | Yes
Regional Roaming | Default Management Point: HOU site (found using the server locator point) Proxy Management Point: SEA site (found from the default management point) | Yes

Similar Assignment Behavior

The same assignment behavior would be seen in the following scenarios, on the assumption that all secondary sites except Manchester had a proxy management point:

  • Client is assigned to Houston (HOU) and its network location resides within the boundaries of the secondary site in Boston (BOS)
  • Client is assigned to Sydney (SYD) and its network location resides within the boundaries of the secondary site in Melbourne (MEL)
  • Client is assigned to Sydney (SYD) and its network location resides within the boundaries of the secondary site in Brisbane (BRI)

Client Moves between Secondary Sites that Are Attached to the Client's Assigned Site

The administrator in Houston installs the Configuration Manager 2007 client on a laptop computer whose network location falls within the boundaries of its secondary site in Seattle (SEA), and uses auto-site assignment. The secondary site in Seattle has distribution points and a proxy management point. A week later, the user who owns the laptop travels to Boston, which is also a secondary site (BOS) that is attached to its assigned site.

This scenario is depicted in the following illustration.

Moves between secondary sites attached to assigned

Global Roaming Capability

The computer in Houston is already installed and assigned to the Houston site (HOU), and using the proxy management point in Seattle (SEA).

The laptop moves to Boston and when it connects to the network in Boston, the Configuration Manager client checks for its default management point in its assigned site. It compares its current network location with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Boston site (BOS) and realizes that this is a secondary site of Houston. It keeps its default management point in Houston but looks for a proxy management point in Active Directory Domain Services for the Boston site. It finds the proxy management point in Boston, which it then uses instead of its default management point for most operations.

The client uses the proxy management in Boston to request and receive client policy, and send inventory data and status messages.

When the client needs software packages and software updates, it first asks the proxy management point in Boston for a list of distribution points. If the content does not exist in the Boston site, the client falls back to asking its default management point in Houston, which returns a list of distributions points from the Houston site (HOU).

When the laptop returns to Seattle, it performs the same service location request from Active Directory Domain Services, with the result that its default management point remains in Houston, but its proxy management point then changes back to the proxy management point in Seattle.

Regional Roaming Capability

The computer in Houston is already installed and assigned to the Houston site (HOU), and using the proxy management point in Seattle (SEA).

The laptop moves to Boston and when it connects to the network in Boston, the Configuration Manager client checks for its default management point in its assigned site. It keeps its default management point in Houston. The client contacts the default management point in Houston, which looks at the client's network location and realizes that it falls within the boundaries its secondary site in Boston that has a proxy management point. It instructs the client about the proxy management point in Boston, which the client then uses instead of its default management point for most operations.

The client uses the proxy management in Boston to request and receive client policy, and send inventory data and status messages.

When the client needs software packages and software updates, it first asks the proxy management point in Boston for a list of distribution points. If the content does not exist in the Boston site, the client falls back to asking its default management point in Houston, which returns a list of distributions points from the Houston site (HOU).

When the laptop returns to Seattle, it performs the same service location request for its default management point, with the result that its default management point remains in Houston, but its proxy management point then changes back to the proxy management point in Seattle.

Secondary Site Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: HOU site (found from Active Directory Domain Services) Proxy Management Points: SEA and BOS sites (found from Active Directory Domain Services) | Yes
Regional Roaming | Default Management Point: HOU site (found from the server locator point) Proxy Management Points: SEA and BOS sites (found from the default management point) | Yes

Similar Assignment Behavior

The same assignment behavior would be seen in the following scenarios, on the assumption that all secondary sites except Manchester had a proxy management point:

  • On assignment, client is assigned to Houston (HOU) and its network location resides within the boundaries of the secondary site in Boston (BOS), but the client subsequently moves to the Seattle site (SEA)
  • On assignment, client is assigned to Sydney (SYD) and its network location resides within the boundaries of the secondary site in Melbourne (MEL), but the client subsequently moves to the Brisbane site (BRI)
  • On assignment, client is assigned to Sydney (SYD) and its network location resides within the boundaries of the secondary site in Brisbane (BRI), but the client subsequently moves to the Melbourne site (MEL)

Assignment with Secondary Site that Isn't Attached to the Client's Assigned Site

The administrator in Sydney installs the Configuration Manager 2007 client on a computer using the wrong Group Policy object, which results in assigning the computer to the Houston site (HOU), instead of the Sydney site (SYD).

The client's network location falls within the boundaries of the secondary site, Melbourne (MEL), which has a proxy management server.

This scenario is depicted in the following illustration.

Secondary site not attached to assigned site

Global Roaming Capability

When the computer in Melbourne installs the Configuration Manager 2007 client, the Configuration Manager client identifies its assigned site (HOU) in Active Directory Domain Services. The client assigns to Houston and compares its IP address, IP subnet and Active Directory site with the list of boundaries defined for the hierarchy. The client identifies that its network location falls within the boundaries of the secondary site in Melbourne. There is a proxy management point in Melbourne which the client can use, but Melbourne is a secondary site that is not attached to its assigned site. In this scenario, the proxy management point can be used for content location requests only.

The client uses the default management point in Houston for client policy, and to send inventory data and status messages. It uses the proxy management point in Melbourne to ask for the nearest distribution points when it needs software packages and software updates. The proxy management point in Melbourne returns a list of distribution points from the Melbourne site (MEL).

Regional Roaming Capability

When the computer in Melbourne installs the Configuration Manager 2007 client, the Configuration Manager client confirms its assigned site (HOU) using the server locator point. The client assigns to Houston and finds the default management point in Houston. The management pint in Houston identifies that the client's network location falls outside the boundaries of its assigned site and any secondary site that it owns. Because Melbourne is a secondary site that is not attached to its assigned site, the client behaves as if roaming.

The client uses the default management point in Houston for requesting and receiving client policy, and to send inventory data and status messages. It also asks the management point in Houston for the nearest distribution points when it needs software packages and software updates, and the management point in Houston returns distribution points from the Melbourne site (MEL).

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: HOU site (found from Active Directory Domain Services) Proxy Management Point: MEL site (found from Active Directory Domain Services) | Yes
Regional Roaming | Default Management Point: HOU site (found from the server locator point) Proxy Management Point: None | Yes

Assignment Solutions

Although this scenario works in that the client is assigned and can download content locally, it creates unnecessary WAN traffic between sites because the client's default management point is not local, and the client with global roaming capability cannot take full advantage of the proxy management in the secondary site, while the client with regional roaming capability cannot use the proxy management point in the secondary site:

  • Although the client is located in Melbourne, it regularly contacts its default management point in Houston for client policy, and to send it inventory data and status messages. It cannot use the proxy management point in Melbourne for these operations.
  • Although the client is located in Melbourne, only a client with globally roaming capabilities can ask the proxy management point in Melbourne for software packages and software updates..

To prevent the unnecessary WAN traffic, reassign the client to the Sydney site.

Similar Assignment Behavior

The same assignment behavior would be seen if the client's network location fell within the boundaries of a secondary site that was not attached to the client's assigned site:

  • Client is assigned to Houston (HOU) and its network location resides within the boundaries of the secondary site in Brisbane (BRI)
  • Client is assigned to London (LON) and its network location resides within the boundaries of the secondary site in Seattle (SEA)
  • Client is assigned to London (LON) and its network location resides within the boundaries of the secondary site in Boston (BOS)
  • Client is assigned to London (LON) and its network location resides within the boundaries of the secondary site in Melbourne (MEL)
  • Client is assigned to London (LON) and its network location resides within the boundaries of the secondary site in Brisbane (BRI)
  • Client is assigned to Shanghai (SHA) and its network location resides within the boundaries of the secondary site in Seattle (SEA)
  • Client is assigned to Shanghai (SHA) and its network location resides within the boundaries of the secondary site in Boston (BOS)
  • Client is assigned to Shanghai (SHA) and its network location resides within the boundaries of the secondary site in Manchester (MAN)
  • Client is assigned to Shanghai (SHA) and its network location resides within the boundaries of the secondary site in Melbourne (MEL)
  • Client is assigned to Shanghai (SHA) and its network location resides within the boundaries of the secondary site in Brisbane (BRI)
  • Client is assigned to Toronto (TOR) and its network location resides within the boundaries of the secondary site in Seattle (SEA)
  • Client is assigned to Toronto (TOR) and its network location resides within the boundaries of the secondary site in Boston (BOS)
  • Client is assigned to Toronto (TOR) and its network location resides within the boundaries of the secondary site in Manchester (MAN)
  • Client is assigned to Toronto (TOR) and its network location resides within the boundaries of the secondary site in Melbourne (MEL)
  • Client is assigned to Toronto (TOR) and its network location resides within the boundaries of the secondary site in Brisbane (BRI)

See Also

Tasks

How to Install a Proxy Management Point at a Secondary Site

Concepts

Example Assignment Scenarios for Configuration Manager: Primary Sites
Example Roaming Scenarios for Configuration Manager: Simple
Example Roaming Scenarios for Configuration Manager: Complex
Site Systems Planning Worksheet

Other Resources

Technical Reference for Configuration Manager Client Deployment


Example Roaming Scenarios for Configuration Manager: Simple

Topic Last Updated—August 2008

The scenarios in this topic will help you understand how roaming works in Configuration Manager 2007 using some basic scenarios that use the same fictitious company multi-site deployment of Configuration Manager.

Before reading these scenarios, see About Client Roaming in Configuration Manager.

The scenarios in this topic focus on which management points clients communicate with when they roam to another site in the Configuration Manager hierarchy, and whether they can download content for advertisements and software updates from that site:

  • Roaming From the Client's Assigned Primary Site Down the Hierarchy to Another Primary Site
  • Roaming From the Client's Assigned Primary Site Across the Hierarchy to Another Primary Site
  • Roaming From the Client's Assigned Primary Site Down the Hierarchy to a Secondary Site that Belongs to Another Primary Site
  • Roaming From the Client's Assigned Site's Secondary Site Down the Hierarchy to Another Secondary Site that Doesn't Belong to the Client's Assigned Site
  • Roaming From the Client's Assigned Site's Secondary Site Up the Hierarchy to Another Secondary Site that Doesn't Belong to the Client's Assigned Site

These scenarios do not include a client moving from its assigned site to one of its assigned site's secondary sites, or between secondary sites that belong to its assigned site. These scenarios are covered in Example Assignment Scenarios for Configuration Manager: Secondary Sites.

To help explain the basic roaming concepts, all scenarios that follow assume that advertisements and software update deployments allow installation over slow or unreliable boundaries, all boundaries within the sites are configured as fast boundaries, there are no protected distribution points, and that the content required by clients always exists in their assigned site. The more complex roaming scenarios that factor in these variables are covered in Example Roaming Scenarios for Configuration Manager: Complex.

Each roaming scenario is explained in terms of whether clients have global roaming capability, or only regional roaming capability:

  • Global roaming capability refers to the ability of clients to access site information from Active Directory Domain Services. This requires that the Active Directory schema is extended for Configuration Manager 2007, that all sites are publishing to Active Directory Domain Services, and the client belongs to the same forest. For more information, see How to Extend the Active Directory Schema for Configuration Manager.
  • Regional roaming capability refers to the roaming behavior of clients when global roaming is not possible because the Active Directory schema has not been extended for Configuration Manager 2007, or it has been extended but not all sites are publishing to Active Directory Domain Services, or the client doesn't belong to the same forest (for example, is a workgroup client).

Configuration Manager Site Terminology

The scenarios use a combination of primary and secondary sites, and parent and child sites. Use the following table as a quick definition reference of these terms, and for more information, see Understanding Configuration Manager Sites.

Site Terminology Description

Primary Site

A primary site stores Configuration Manager 2007 data for itself and all the sites beneath it in the Configuration Manager 2007 site database. Primary sites have an administrative tool called the Configuration Manager 2007 console that enables the Configuration Manager 2007 administrator to directly manage the site.

Secondary Site

A secondary site has no Configuration Manager 2007 site database, but is attached to and reports to a primary site.

The secondary site forwards the information it gathers from Configuration Manager 2007 clients, such as computer inventory data and Configuration Manager 2007 system status information, to its parent site.

Parent Site

A parent site is a primary site that has one or more sites attached below it in the hierarchy. Only a primary site can have child sites.

Child Site

A child site is a site that is attached to a site above it in the hierarchy, and reports to is its parent site. A child site is either a primary site or a secondary site.

Central Site

A central site has no parent site and typically aggregates information from its child and grandchild sites to provide centralized management and reporting.

Hierarchy Used in All Roaming Scenario Examples

The hierarchy has three tiers of primary sites:

  • At the top of the hierarchy is the central site, a primary site in Toronto named TOR.
  • At the second level of primary sites, there are three primary child sites in Houston, London, and Shanghai, named HOU, LON, and SHA respectively.
    • The Houston child primary site has two secondary sites in Seattle and Boston: SEA, BOS.
    • The LON child primary site has one secondary site in Manchester: MAN.
    • The SHA child primary site has no secondary sites.
  • At the third level of primary sites, there are two primary grandchild sites in Sydney and Helsinki, named SYD and HEL respectively.
    • The SYN grandchild primary site has two secondary sites in Melbourne and Brisbane: MEL, BRI.
    • The HEL grandchild primary site has no secondary sites.

This hierarchy is shown in the following illustration.

ConfigMgr Hierarchy Used with Scenarios

Roaming From the Client's Assigned Primary Site Down the Hierarchy to Another Primary Site

A user whose laptop is assigned to the Houston site, visits Sydney. The laptop is connected to the network and gets an IP address that falls within one of the boundaries configured for the child site, SYD.

This scenario is depicted in the following illustration.

Roaming Down the Hierarchy to Primary Site

Global Roaming Capability

When the laptop connects to the network in Sydney, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Sydney site (SYD) and then looks for the default management point in the Sydney site. This then becomes the client's resident management point while roaming and it contacts it only when it needs content, never to download policy or send inventory information and status messages. It continues to communicate with its own default management point in Houston (HOU) for these operations.

The resident management point in Sydney returns to the roaming client a list of distribution points in the Sydney site (SYD).

If the content doesn't exist in the Sydney site, the client falls back to asking its default management point in Houston for distribution points so that it can download source packages from its assigned site in Houston (HOU).

Regional Roaming Capability

When the laptop connects to the network in Sydney, the Configuration Manager client contacts its default management point in Houston (HOU) and asks it for distribution points that are closest to its current IP address (and Active Directory site if it has one) and that host the content it needs.

The default management point in Houston provides the client with a list of distribution points in Sydney (SYD) if the content is hosted there. If the content is not hosted in Sydney, the default management point provides the client with a list of distribution points from the Houston site (HOU).

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: HOU site Resident Management Point: SYD site | Yes
Regional Roaming | Default Management Point: HOU site | Yes

Similar Roaming Behavior

The same behavior would be seen in the following roaming scenarios:

  • From Toronto (TOR) to Houston (HOU)
  • From Toronto (TOR) to Sydney (SYD)
  • From Toronto (TOR) to Shanghai (SHA)
  • From London (LON) to Helsinki (HEL)

Roaming From the Client's Assigned Primary Site Across the Hierarchy to Another Primary Site

A user whose laptop is assigned to the Houston site, visits London. The laptop is connected to the network and gets an IP address that falls within one of the boundaries configured for the London primary site, LON.

This scenario is depicted in the following illustration.

Roaming to Sibling Site

Global Roaming Capability

When the laptop connects to the network in London, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the London site (LON) and then looks for the default management point in the London site. This then becomes the client's resident management point while roaming and it contacts it only when it needs content, never to download policy or send inventory information and status messages. It continues to communicate with its own default management point in Houston (HOU) for these operations.

The resident management point in London returns to the roaming client a list of distribution points in the London site (LON).

If the content doesn't exist in the London site, the client falls back to asking its default management point in Houston for distribution points so that it can download source packages from its assigned site in Houston (HOU).

Regional Roaming Capability

When the laptop connects to the network in London, the Configuration Manager client contacts its default management point in Houston (HOU) and asks it for distribution points that are closest to its current IP address (and Active Directory site if it has one) and that host the content it needs.

The default management point in Houston has no knowledge of the distribution points in London, so downloading content locally is not possible. Instead, the client's default management point provides the client with a list of distribution points from the Houston site (HOU).

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: HOU site Resident Management Point: LON site | Yes
Regional Roaming | Default Management Point: HOU site | No

Similar Roaming Behavior

The same behavior would be seen in the following roaming scenarios:

  • From London (LON) to Shanghai (SHA)
  • From London (LON) to Houston (HOU)
  • From Houston (HOU) to Shanghai (SHA)
  • From Shanghai (SHA) to London (LON)
  • From Shanghai (SHA) to Houston (HOU)
  • From Sydney (SYD) to Helsinki (HEL)
  • From Helsinki (HEL) to Sydney (SYD)

Roaming From the Client's Assigned Primary Site Down the Hierarchy to a Secondary Site that Belongs to Another Primary Site

A user whose laptop is assigned to the Houston site, visits Melbourne. The laptop is connected to the network and gets an IP address that falls within one of the boundaries configured for the secondary site MEL that belongs to the grandchild site in Sydney (SYD).

This scenario is depicted in the following illustration.

Roaming Down the Hierarchy to Secondary Site

Global Roaming Capability

When the laptop connects to the network in Melbourne, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Melbourne site (MEL), and discovers the proxy management point in Melbourne. This then becomes the client's resident management point while roaming and it contacts it only when it needs content, never to download policy or send inventory information and status messages. It continues to communicate with its own default management point in Houston (HOU) for these operations.

The proxy management point in Melbourne returns to the roaming client a list of distribution points in the Melbourne site (MEL).

If the content doesn't exist in the Melbourne site, the client falls back to asking its default management point in Houston (HOU) for distribution points so that it can download source packages from its assigned site in Houston (HOU).

Regional Roaming Capability

When the laptop connects to the network in Melbourne, the Configuration Manager client contacts its default management point in Houston (HOU) and asks it for distribution points that are closest to its current IP address (and Active Directory site if it has one) and that host the content it needs.

The default management point in Houston provides the client with a list of distribution points in Melbourne (MEL) if the content is hosted there. If the content is not hosted in Melbourne, the default management point provides the client with a list of distribution points from the Houston site (HOU).

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: HOU site Resident Management Point: MEL site | Yes
Regional Roaming | Default Management Point: HOU site | Yes

Similar Roaming Behavior

The same behavior would be seen in the following roaming scenarios:

  • From Houston (HOU) to Brisbane (BRI)

Roaming From the Client's Assigned Site's Secondary Site Down the Hierarchy to Another Secondary Site that Doesn't Belong to the Client's Assigned Site

A user whose laptop is assigned to the Houston site (HOU), but whose IP address falls within the boundaries of the secondary site in Boston (BOS), visits Melbourne. The laptop is connected to the network and gets an IP address that falls within one of the boundaries configured for the secondary site MEL that belongs to the grandchild site in Sydney (SYD).

This scenario is depicted in the following illustration.

Roaming Down the Hierarchy to Secondary Site

Global Roaming Capability

When the laptop connects to the network in Melbourne, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Melbourne site (MEL), and discovers the proxy management point in this site. This then becomes the client's resident management point while roaming and it contacts it only when it needs content, never to download policy or send inventory information and status messages. It continues to communicate with its own default management point in Houston (HOU) for these operations, and no longer communicates with the proxy management point in Boston (BOS).

The resident management point in Melbourne returns to the roaming client a list of distribution points in the Melbourne site (MEL).

If the content doesn't exist in the Melbourne site, the client falls back to asking its default management point in Houston (HOU) for distribution points so that it can download source packages from its assigned site in Houston (HOU).

Regional Roaming Capability

When the laptop connects to the network in Melbourne, the Configuration Manager client contacts its default management point in Houston (HOU), and no longer communicates with the proxy management point in Boston (BOS). It asks its default management point for distribution points that are closest to its current IP address (and Active Directory site if it has one) and that host the content it needs.

The default management point in Houston (HOU) provides the client with a list of distribution points in Melbourne (MEL) if the content is hosted there. If the content is not hosted in Melbourne, the default management point provides the client with a list of distribution points from the Houston site (HOU).

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: HOU site Resident Management Point: MEL site | Yes
Regional Roaming | Default Management Point: HOU site | Yes

Similar Roaming Behavior

The same behavior would be seen in the following roaming scenarios:

  • From Boston (BOS) to Brisbane (BRI)
  • From Seattle (SEA) to Melbourne (MEL)
  • From Seattle (SEA) to Brisbane (BRI)

Roaming From the Client's Assigned Site's Secondary Site Up the Hierarchy to Another Secondary Site that Doesn't Belong to the Client's Assigned Site

A user whose laptop is assigned to the Sydney site (SYD), but whose IP address falls within the boundaries of the secondary site in Brisbane (BRIS), visits Seattle. The laptop is connected to the network and gets an IP address that falls within one of the boundaries configured for the secondary site in Seattle (SEA) that belongs to the primary site in Houston (HOU).

This scenario is depicted in the following illustration.

Roaming Up the Hierarchy to Secondary Site

Global Roaming Capability

When the laptop connects to the network in Seattle, the Configuration Manager client compares its current IP address, IP subnet, and Active Directory site with the list of boundaries defined for each site in Active Directory Domain Services. It finds a match for the Seattle site (SEA), and discovers the proxy management point in the Seattle site (SEA). This then becomes the client's resident management point while roaming and it contacts it only when it needs content, never to download policy or send inventory information and status messages. It continues to communicate with its own default management point in Sydney (SYD) for these operations, and no longer communicates with the proxy management point in Brisbane (BRI).

The resident management point in Seattle (SEA) returns to the roaming client a list of distribution points in the Seattle site (SEA).

If the content doesn't exist in the Seattle site, the client falls back to asking its default management point in Sydney (SYD) for distribution points so that it can download source packages from its assigned site in Sydney (SYD).

Regional Roaming Capability

When the laptop connects to the network in Seattle, the Configuration Manager client contacts its default management point in Sydney (SYD), and no longer communicates with the proxy management point in Brisbane. It asks its default management point for distribution points that are closest to its current IP address (and Active Directory site if it has one) and that host the content it needs.

The default management point in Sydney (SYD) has no knowledge of the distribution points in Seattle (SEA), so downloading content locally is not possible. Instead, the client's default management point provides the client with a list of distribution points from the Sydney site (SYD).

Roaming Behavior Summary

The following table summarizes the client behavior in this scenario.

Roaming Capability | Communication with Management Points | Download Content Locally
Global Roaming | Default Management Point: SYD site Resident Management Point: SEA site | Yes
Regional Roaming | Default Management Point: SYD site | No

Similar Roaming Behavior

The same behavior would be seen in the following roaming scenarios:

  • From Brisbane (BRI) to Boston (BOS)
  • From Melbourne (MEL) to Seattle (SEA)
  • From Melbourne (MEL) to Boston (BOS)
  • From Melbourne (MEL) to Manchester (MAN)

See Also

Concepts

About Client Roaming in Configuration Manager
Configuration Manager and Service Location (Site Information and Management Points)
Example Assignment Scenarios for Configuration Manager: Primary Sites
Example Assignment Scenarios for Configuration Manager: Secondary Sites

Other Resources

Technical Reference for Configuration Manager Client Deployment


Example Roaming Scenarios for Configuration Manager: Complex

Topic last updated—November 2007

The scenarios in this topic will help you understand how roaming and related scenarios work in Configuration Manager 2007, using some more complex scenarios that build on the basic scenarios in Example Roaming Scenarios for Configuration Manager: Simple and using the same fictitious company multi-site deployment of Configuration Manager.

Before reading these scenarios, see About Client Roaming in Configuration Manager.

The following scenarios focus on clients obtaining content for advertisements and software updates when their network location is outside their assigned site in the Configuration Manager hierarchy:

  • User Cannot Download Content When Roaming Because of Default Advertisement Setting
  • User Cannot Download Content When Roaming Because of Protected Distribution Points
  • Client Assigned to Site but Outside Its Site's Boundaries Cannot Run Advertisements or Install Software Updates
  • Mixed Mode Client Roams to Native Mode Site
  • Native Mode Client Roams to Mixed Mode Site
  • Client Roams into Another Configuration Manager Hierarchy

Configuration Manager 2007 supports both the concept of clients being managed anywhere in a distributed environment and of protecting wide area networks (WANs) so that they don't become saturated with network traffic. These two concepts can sometimes come into conflict, and a combination of configurations and factors can sometimes result in unexpected or unwanted results.

For example, to ensure that clients can always access the content they need, clients that roam into another site will fall back to asking their assigned site for content if it is not available locally. However, the default configuration for advertisements and software update packages is to not allow this content to be downloaded when a client connects on a slow boundary. Configuring distribution points to be protected can also prevent clients from another site from downloading content and can also prevent clients in the same site from downloading content.

The scenarios in this topic cover some typical situations where the behavior of clients with respect to downloading content and communication across WAN links is unexpected and usually not wanted. However, there might be some situations where the outcome is wanted because of a specific business requirement.

Some best practices to avoid these conflicts are the following:

  • Make sure that clients' network location on the intranet fall within a defined boundary in the Configuration Management hierarchy. Collaborate with other service administrators, such as Active Directory administrators, who define the Active Directory sites, and DHCP administrators, who define the ranges of addresses that will be used by clients (including addresses for VPN connections).
  • Make sure that the defined boundaries do not contain a client’s IP address (or subnet) or Active Directory site for more than one Configuration Manager (or SMS 2003) site. When this configuration occurs, it causes overlapping boundaries and is not supported because the client behavior then cannot be determined.
  • When you configure the boundaries to be fast or slow, be aware of the possible consequences if clients can download content when they are not connected to a fast boundary.
  • If you need to prevent WAN traffic for a particular site, configure the distribution points in that site as protected.
  • To minimize traffic between a primary site and its secondary site, install a proxy management point in the secondary site.
  • To minimize traffic over WAN links when clients roam, extend the Active Directory schema for Configuration Manager 2007.

For more information about boundaries, see the following topics:

  • Planning Configuration Manager Boundaries
  • Choose Configuration Manager Boundaries
  • How to Configure Configuration Manager Boundaries
  • How to View Configuration Manager Boundaries

Hierarchy Used in All Roaming Scenario Examples

The hierarchy has three tiers of primary sites:

  • At the top of the hierarchy is the central site, a primary site in Toronto named TOR.
  • At the second level of primary sites, there are three primary child sites in Houston, London, and Shanghai, named HOU, LON, and SHA respectively.
    • The Houston child primary site has two secondary sites in Seattle and Boston: SEA, BOS.
    • The LON child primary site has one secondary site in Manchester: MAN.
    • The SHA child primary site has no secondary sites.
  • At the third level of primary sites, there are two primary grandchild sites in Sydney and Helsinki, named SYD and HEL respectively.
    • The SYN grandchild primary site has two secondary sites in Melbourne and Brisbane: MEL, BRI.
    • The HEL grandchild primary site has no secondary sites.

This hierarchy is shown in the following illustration.

ConfigMgr Hierarchy Used with Scenarios

User Cannot Download Content When Roaming Because of Default Advertisement Setting

A user whose laptop is assigned to Houston (HOU) travels to Sydney (SYD).

The administrator in Houston created an advertisement for Microsoft Office 2007, with the option When a client is connected within a slow or unreliable network boundary: Do not run program on the Advertisement Name Properties: Distribution Points Tab. The advertisement package is added to the distribution points at Houston (HOU), Seattle (SEA), and Boston (BOS), as shown in the following illustration.

Roaming Client Can't Obtain Content

Global Roaming Capability

When the laptop connects to the network in Sydney, the user tries to run the advertisement. The Configuration Manager client contacts the resident management point in Sydney, but the content is not available in that site.

The client falls back to asking its default management point in Houston for distribution points so that it can download source packages from its assigned site in Houston (HOU).

However, although the contents exists in Houston, the advertisement configuration prevents the content from downloading because the default management point realizes that the client's network location does not fall within the fast boundaries configured for Houston.

The user returns but makes a stopover in Seattle, visiting its assigned site's secondary site, SEA.

When the laptop is connected to the Seattle network, it identifies the site it is in and finds the proxy management point from Active Directory Domain Services. It communicates with the proxy management in SEA for policy, sending hardware inventory and content location requests.

The user tries to run the advertisement again, and this time it succeeds because the proxy management point finds distribution points in SEA that host the content. The client is now within fast boundaries for the Seattle site.

Regional Roaming Capability

When the laptop connects to the network in Sydney, the user tries to run the advertisement. The Configuration Manager client contacts its default management point in Houston, which has no knowledge of the site in Sydney. However, the management point knows about the distribution points in Sydney, but those distribution points do not host the content that the client is requesting.

The default management point in Houston returns a list of distribution points in Houston that host the content needed for the advertisement.

Although the contents exists in Houston, the advertisement configuration prevents the content from downloading because the default management point realizes that the client's IP address does not fall within its fast boundaries.

The user returns but makes a stopover in Seattle, visiting its assigned site's secondary site, SEA.

When the laptop is connected to the Seattle network, it communicates with the default management point in Houston. The default management point informs the client of the proxy management point to use in SEA.

The user tries to run the advertisement again, and this time it succeeds because the proxy management point finds distribution points in SEA that host the content and the client is on a fast boundary for the Seattle site.

User Cannot Download Content When Roaming Because of Protected Distribution Points

A user whose laptop is assigned to Shanghai (SHA) travels to London (LON).

The Shanghai site has deployed an add-on for Microsoft Office and hosts the software package on all distribution points in the Shanghai site.

WAN links to and from Shanghai are slow and expensive, so to prevent these links from being saturated with content downloads, all distributions points in the Shanghai site are configured to be protected with the boundaries that are configured for the Shanghai site.

The content is not available in the London site, so the laptop roaming from Shanghai falls back to asking its default management point in Shanghai for a list of distribution points. Although the content is available in Shanghai, the client's network location in London is not within the boundaries that are configured for the protected distribution points in Shanghai, and the user cannot install the advertisement until she returns to the Shanghai site.

This scenario is depicted in the following illustration.

Roaming Client and Protected Distribution Points

Similar Behavior

When the protected distribution points in Shanghai are configured for fast boundaries only, the same behavior would be seen in the following circumstances:

  • If the Shanghai site has a slow boundary defined for a VPN scope for remote users, users connecting over the VPN will not be able to download the content until they connect directly to the network in Shanghai (on fast boundaries).
  • If a client is assigned to the Shanghai site but its network location is not within the configured boundaries for the Shanghai site, it is automatically considered to be connecting over a slow boundary. This user will never be able to download content from the distribution points in its assigned site until its network location is added to one of the boundaries configured for the protected distribution points.

Client Assigned to Site but Outside Its Site's Boundaries Cannot Run Advertisements or Install Software Updates

A client has a network location that falls within a fast boundary for the London site but is mistakenly assigned to the Houston site.

A software update is deployed at Toronto and hosted on all distribution points in the hierarchy, and the software update deployment is configured with the default setting to not run if clients are on a slow boundary. This scenario is depicted in the following illustration.

Client Outsides Its Site Boundaries

Global Roaming Capability

The client receives the software update notification and contacts the resident management point in the London site (LON). The management point in London returns a list of distribution points in London that have the content needed for the software update. The client is on fast boundary in the London site, and the software update installs.

Regional Roaming Capability

The client receives the software update notification and contacts its default management point in Houston. The management point in Houston returns a list of distribution points in Houston that have the content needed for the software update. However, the client is not within a fast boundary in the Houston site, and the software update installation is not initiated.

Without reconfiguration of the software update or reassigning the client, the only way this client can obtain the software update for this deployment is to roam to London, where its network location would then fall within a fast boundary for the site.

Similar Behavior

Clients would also fail to obtain the software update if the Houston site had a slow boundary defined for a VPN scope (or no boundary defined for the VPN scope) for remote users. In this case, users connecting over the VPN will not be able to obtain the content when they are connected over the VPN.

Scenario Solutions

Resolve the situation of clients being unable to obtain the content by fulfilling one of the following reconfiguration steps.

Reconfiguration More Information

If a client that doesn't have global roaming capability is assigned to a site but its network location falls within the configured boundaries of another site (that isn't a secondary site of the assigned site), reassign the client.

In the given scenario, the client should be reassigned to the London site.

How to Assign Configuration Manager Clients to a Site

As a failsafe, you might want to consider configuring important advertisements and software update deployments to download content and run locally instead of the default option to not install when clients are connected within a slow network boundary.

Note
This configuration can result in other clients also installing this content when they are roaming to another site if they fall back to asking their default management point for content

Configure these options on the following dialog boxes:

  • Advertisement Name Properties: Distribution Points Tab
  • Deployment Name Properties: Download Settings Tab
  • Deployment Name Properties: SMS 2003 Settings Tab

Reconsider the slow boundaries that you have configured for the site. For example, a VPN connection might be fast enough and reliable enough to be configured as a fast boundary so that VPN users can always install content that is hosted at their assigned site.

Planning Configuration Manager Boundaries

Mixed Mode Client Roams to Native Mode Site

A laptop user from Houston roams to the Toronto site just after a critical software update is deployed and hosted on all distribution points in the hierarchy, with the configuration to download and run locally when clients connect from a slow boundary, as shown in the following illustration.

Mixed Mode Client Roams to Native Mode Site

Global Roaming Capability

A client that has global roaming capability will identify that it's now connected to the Toronto site and attempts to communicate with the resident management point. However, the Toronto site is in native mode and will not allow communication from a mixed mode client. The client falls back to communicating with its default management point in Houston and installs the software update from a distribution point in Houston.

Regional Roaming Capability

A client that has regional roaming capability does not identify that it has roamed into another site. It continues to communicate with its default management point in Houston and asks it for the nearest distribution points from which it can download the software update. The management point in Houston cannot find distribution points in Toronto, so it returns a list of distribution points from the Houston site, and the client installs the software update from a distribution point in Houston.

Scenario Solutions

There are no solutions to this extra traffic between the client that roams to the Toronto site and its assigned site in Houston. When a site is in native mode, it rejects client communication from mixed-mode clients to ensure the integrity of the site.

If the Houston site were migrated to native mode, a client with global roaming capability would be able to communicate with the resident management point in Toronto and download content from the Toronto distribution points.

Native Mode Client Roams to Mixed Mode Site

A laptop user from Toronto roams to the Houston site just after a critical software update is deployed and hosted on all distribution points in the hierarchy, with the configuration to download and run locally when clients connect from a slow boundary, as shown in the following illustration.

Native Mode Client Roams to Mixed Mode Site

Global Roaming Capability

A client that has global roaming capability will identify that it's now connected to the Houston site and attempts to communicate with the resident management point. However, the Houston site is in mixed mode, and mutual authentication using a certification authority between the client and resident management point fails.

If the client is configured with the option Allow HTTP communication for roaming and site assignment, it can communicate with the resident management point in Houston, using mixed mode communication, and ask it for distribution points in the Houston site.

However, if the client is not configured with the option Allow HTTP communication for roaming and site assignment, it cannot communicate with the resident management point in Houston using mixed mode communication. It falls back to its default management point in Toronto and downloads the software update from one of the distribution points in the Toronto site.

Regional Roaming Capability

A client that has regional roaming capability does not identify that it has roamed into another site. It continues to communicate with its default management point in Toronto and asks it for the nearest distribution points from which it can download the software update. The management point in Toronto returns a list of distribution points in Houston.

If the client is configured with the option Allow HTTP communication for roaming and site assignment, it can communicate with the distribution points in Houston, using mixed mode communication, and then installs the software update from the Houston site.

However, if the client is not configured with the option Allow HTTP communication for roaming and site assignment, it cannot communicate with the distribution points in Houston using mixed mode communication. Instead, it installs the software update from its assigned site in Toronto.

Critical Configuration Steps

The following configuration step is required for this scenario to succeed.

Configuration More Information

If you want a native mode client to roam into a mixed-mode site and download content locally from the mixed-mode site, configure it with the option Allow HTTP communication for roaming and site assignment.

Note
This a less secure configuration than not allowing HTTP communication.

Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)

Client Communication in Mixed Mode and Native Mode

How to Configure HTTP Communication for Roaming and Site Assignment

Client Roams into Another Configuration Manager 2007 Hierarchy

A consultant from the Houston site visits another company in Michigan where it also has Configuration Manager 2007 installed. When the laptop is connected to the other company's network, it receives an IP address from a DHCP server and has network connectivity. The consultant tries to run a previously received optional advertisement to install an add-on for Microsoft Office 2007.

The Microsoft Office 2007 add-on is also available as an optional advertisement on the other company's Configuration Manager 2007 hierarchy, so the user expects it to install. However, the content is not available to this user with the other company's hierarchy, as shown in the following illustration.

Client Roams to Another Hierarchy

Global Roaming Capability

A client that has global roaming capability will query Active Directory Domain Services for its site and default management point.

On another network, the client computer will not be authenticated and cannot access Active Directory Domain Services. When global roaming capability fails, the client reverts to regional roaming behavior.

Regional Roaming Capability

A client that has regional roaming capability will attempt to find its assigned site’s default management point when it connects to the new network.

The most likely scenario is that the client will fail to find a management point for its assigned site on the new network. If the same site code is not used in the new network or if the client cannot locate a management point, the client falls back to attempting to use its currently assigned management point in Houston. Unless the two hierarchies have a network connection between them, this will fail and the client will be unable to download the content until it returns to its own Configuration Manager 2007 hierarchy.

If the client’s assigned site code matches that of the site code on the new network, the client will attempt to locate its site’s default management point using DNS, the server locator point, and WINS. For this to succeed, the new hierarchy must contain the same site code as the client’s assigned site and one of the following must also be true:

  • For the client to find a management point for its assigned site code using DNS publishing, the client must be configured for DNS servers on the new network, and either the management point on the new network must have the same domain suffix as the management point in Houston or the value for the option Specify or modify a DNS suffix for site assignment below is reconfigured on the client.
  • For the client to find a management point using a server locator point, exactly the same server locator point name or IP address must be used in the new network if the client was assigned a server locator point, or the client must be configured for WINS servers on the new network that have a manual entry WINS entry for a server locator point. Additionally, for a native mode client to communicate with a server locator point, it must be configured with the option Allow HTTP communication for roaming and site assignment.
  • For the client to find a management point using WINS, the client must be operating in mixed mode and be configured for WINS servers on the new network.

If any one of these conditions is met, the client will update its assigned management point with a management point on the alternative hierarchy. However, the client cannot be managed because the client will not trust the management point in the new hierarchy for one of the following reasons:

  • Mutual authentication fails in native mode.
  • The client communication mode is different from the management point’s site mode.
  • The client is configured with a different Client Request port number than the site is using.
  • The client fails to authenticate the management point’s certificate using its own hierarchy’s trusted root key.

Scenario Solutions

If the advertisement is configured as mandatory with the configuration of download and install locally, this scenario would have succeeded if the content had completed its download before the laptop was removed from the Houston site.

Internet-based client management offers another possible solution for laptops that regularly disconnect from their company's intranet. On another company's intranet, the client will attempt to connect to its Internet-based management point and retrieve content over the Internet. For this to succeed, the user might have to configure the Configuration Manager client to use a local proxy server for Internet access. For more information, see the following:

  • Deploying Configuration Manager Sites to Support Internet-Based Clients
  • How to Configure Configuration Manager Client Computers to Access Their Internet-Based Management Point with a Proxy Server

See Also

Tasks

How to Designate a Distribution Point

Concepts

About Client Site Assignment in Configuration Manager
About Client Roaming in Configuration Manager
About Distribution Points
Example Assignment Scenarios for Configuration Manager: Primary Sites
Example Assignment Scenarios for Configuration Manager: Secondary Sites
Example Roaming Scenarios for Configuration Manager: Simple

Other Resources

Technical Reference for Configuration Manager Client Deployment


How to Configure Configuration Manager 2007

Use the following sections to understand how to configure Configuration Manager 2007.

In This Section

Configuration Manager Tasks for Configuring a Single Site

Describes the tasks for configuring a single site.

Configuration Manager Tasks for Configuring Multiple Sites

Describes the optional configuration tasks needed after deploying multiple sites into a site hierarchy.

Checklist for Required Post Setup Configuration Tasks

Describes how to configure additional client agents or modify the default client configurations.

How to Configure Configuration Manager Clients

Describes how to configure the Configuration Manager Clients.

How to Configure Configuration Manager Features

Describes how to configure the features of Configuration Manager.

See Also

Concepts

Configuration Manager Documentation Library


Checklist for Required Post Setup Configuration Tasks

A Microsoft System Center Configuration Manager 2007 site usually requires a management point and clients and might require additional site system roles such as fallback status points, reporting points, and server locator points. If you are using Configuration Manager 2007 native mode, you must also deploy certificates for native mode authentication. Some client agents are configured by default, but you might want to configure additional client agents or modify the default client configurations.

Some features of Configuration Manager 2007, such as software updates, require extensive preparation prior to configuring the options in the Configuration Manager 2007 console, while other features, such as software metering, are ready to use with no additional preparation. Some features also have dependencies on technologies external to Configuration Manager 2007.

While you can deploy clients and features in any order, deploying a few test clients before planning and deploying a Configuration Manager 2007 feature allows you to verify that the fundamentals of the site are in place.

Post Setup Configuration Checklist - Mixed Mode

Task Reference

Configure a management point

Note
The management point role can be assigned during setup, or assigned post setup. Only one default management point is required for each Configuration Manager 2007 primary site hosting intranet based clients.

Configure Your Management Point

Configure Site Boundaries

Choose Configuration Manager Boundaries

Determine if you need a server locator point

Determine If You Need a Server Locator Point for Configuration Manager Clients

Configure your fallback status point and reporting point

Configure your Fallback Status Point and Reporting Point

Install Configuration Manager 2007 Clients

Install the Configuration Manager Client (Mixed Mode)

Configure Configuration Manager Client Agent Settings

Configure Your Client Agents

Post Setup Configuration Checklist - Native Mode

Task Reference

Configure a management point

Note
The management point role can be assigned during setup, or assigned post setup. Only one default management point is required for each Configuration Manager 2007 primary site hosting intranet based clients.

Configure Your Management Point

Configure Site Boundaries

Choose Configuration Manager Boundaries

Deploy a Web server certificate to your site systems

Deploy a Web Server Certificate to Your Site Systems

Determine if you need a server locator point

Determine If You Need a Server Locator Point for Configuration Manager Clients

Configure your fallback status point and reporting point

Configure your Fallback Status Point and Reporting Point

Deploy authentication certificates to all clients and the management point

Deploy Authentication Certificates to All Clients and the Management Point

Install Configuration Manager 2007 Clients

Install the Configuration Manager Client (Mixed Mode)

Install the Configuration Manager Client (Native Mode)

Configure Configuration Manager Client Agent Settings

Configure Your Client Agents

See Also

Concepts

Configuring Reporting
Configuring Remote Tools

Other Resources

Configuring Software Distribution
Configuring Software Updates
Configuring Operating System Deployment
Configuring Desired Configuration Management
Configuring Mobile Device Management
Configuring Network Access Protection
Configuring Inventory
Configuring Wake On LAN
Configuring the Application Compatibility Toolkit Connector


Configuration Manager Tasks for Configuring a Single Site

After you install Microsoft System Center Configuration Manager 2007, you must configure the new site. You begin the site configuration process by defining site characteristics and configuring site systems at a single site. After completing basic site system configuration, you must prepare the site to manage clients and additional feature installation and configuration. After installing primary sites, there are some mandatory tasks, and others which are optional.

Note
Each Configuration Manager 2007 site is configured individually (child sites do not inherit the properties of their parent sites).

In This Section

Mandatory Tasks

You must perform the following tasks after installing a Configuration Manager 2007 site if the site will have assigned clients:

How to Configure Configuration Manager Boundaries

Describes how to configure site boundaries, which are used to assign Configuration Manager clients to the site.

How to Configure the Default Management Point for a Site

Describes how to configure a default management point site system for a site.

How to Configure Site Systems

Describes how to add, modify, or delete site systems for a site.

How to Configure Site System Roles

Describes how to add, modify, or delete site system roles for a site.

How to Configure Site Components

Describes how to configure site components for a site.

Optional Tasks

Although you do not need to perform the following tasks when configuring a single site, depending on your environment, you may choose to do so.

How to Install the Configuration Manager Console

Describes how to install the Configuration Manager console on a remote computer, such as an administrator's workstation computer.

How to Identify the Site Mode of a Site

Describes how to determine the site mode a Configuration Manager site is configured to use.

How to Configure Native Mode

Describes how to configure a Configuration Manager site to use native mode.

How to Revert a Configuration Manager Site to Mixed Mode

Describes how to revert a Configuration Manager site from native mode site operations to mixed mode site operations.

How to Configure Custom Web Sites for Configuration Manager Sites

Describes how to configure custom Web sites for Configuration Manager client to site system communications.

How to Configure a Configuration Manager Site to Use a Custom Web Site

Describes how to configure Configuration Manager sites to use a custom Web site.

How to Configure Network Load Balancing for Configuration Manager Site Systems

Describes how to configure Network Load Balancing (NLB) for Configuration Manager site systems.

How to Configure SQL Server Site Database Replication

Describes how to configure SQL Server database replication for Configuration Manager sites.

How to Migrate the Site Database to a SQL Server Cluster Instance

Describes how to migrate the site database from a stand-alone SQL Server computer to a virtual SQL Server cluster instance.

How to Encrypt Client to Management Point Data in Mixed Mode

Describes how to encrypt client to management point data in mixed mode.

How to View Configuration Manager Boundaries

Describes how to view Configuration Manager boundaries configured for sites in the hierarchy.

See Also

Other Resources

How to Configure Configuration Manager 2007


How to Configure Configuration Manager Boundaries

Computers are assigned as clients to Microsoft System Center Configuration Manager 2007 sites according to the boundaries configured in the Configuration Manager console. Boundaries are defined by Internet Protocol (IP) subnets, Active Directory site names, IPv6 Prefix, or IP ranges.

When creating Configuration Manager 2007 boundaries, you must also specify the type of network connection that the boundary will operate on. You must decide whether the site boundary will be used for either a Slow or unreliable or Fast (LAN) network connection.

To add a new boundary

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Boundaries.

  2. On the New Boundary properties page, enter the following information:

    • Description
    • Site Code
    • Boundary Type
    • Boundary-type specific settings

  3. Select the network connection type, either Slow or unreliable or Fast (LAN).

    Note
    When new boundaries are added, it might take up to a minute for the boundary information displayed in the Configuration Manager console to update. When creating boundaries for child sites, the boundary changes must be updated at the child site and replicated back to the parent site before they appear in the Configuration Manager console at the parent site.

To modify a boundary

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Boundaries.

  2. In the console results pane, right-click the boundary that you want to modify and click Properties.

  3. Modify the site boundary information as required on the boundary properties General and Protected tabs.

To delete a boundary

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Boundaries.

  2. In the console results pane, right-click the boundary name that you would like to delete and click Delete.

  3. Confirm that you want to delete the boundary by clicking Yes on the delete confirmation dialog box.

See Also

Reference

Boundary Properties: General Tab
Boundary Properties: Protected Tab

Concepts

Choose Configuration Manager Boundaries


How to Configure the Default Management Point for a Site

Topic last updated—March 2008

A default management point is required for sites supporting intranet clients, or both intranet- and Internet-based clients. Sites supporting only Internet-based clients do not require a management point to be set as default.

Before beginning this procedure, the management point site system role must be installed on one or more site systems for the site. For more information about adding site system roles to Configuration Manager 2007 site systems, see How to Add New Site System Roles.

Important
You must download, install, and configure WebDAV manually on management points running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

To configure the default management for a site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Component Configuration.

  2. Right-click Management Point, and then click Properties.

  3. If the default management point for the site will be a standard site system, click Management Point, and then select an available management point site system from the Server name list.

  4. If the default management point for the site will be an NLB clustered management point, click Network Load Balancing cluster virtual server and configure the IP Address or FQDN information for the NLB cluster configuration.

    Important
    When configuring a network load balancing cluster as the default management point for a site in native mode, you must configure the FQDN properties. If an NLB cluster will be the default management point for a site in mixed mode, you must register a Service Principal Name (SPN) in Active Directory Domain Services. For more information about configuring the SPN for a default management point NLB cluster for sites operating in mixed mode, see How to Configure an SPN for NLB Management Point Site Systems.

  5. Click OK to save configuration changes and close the management point properties.

See Also

Tasks

How to Configure Network Load Balancing for Configuration Manager Site Systems

Concepts

Configuration Manager Tasks for Configuring a Single Site


How to Configure Site Systems

Site systems are computers running supported Microsoft Windows Server operating systems or server shares that provide Configuration Manager 2007 functionality to your site. Each site system can provide one or more roles to support the site.

In This Section

How to Add a New Site System

Describes how to add a new site system to a site.

How to Modify Site System Properties

Describes how to modify site system general properties.

How to Delete a Site System

Describes how to delete a site system from a site.

How to Configure Windows Server 2008 for Site Systems

Describes how to configure Windows Server 2008 computers to host Configuration Manager 2007 SP1 site system roles.

See Also

Concepts

How to Configure Site System Roles
Configuration Manager Tasks for Configuring a Single Site


How to Add a New Site System

You can add a new site system to the existing Configuration Manager 2007 site using the Configuration Manager console by following the procedures described in this topic.

Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

When adding a new site system, you must choose to add either a server or server share site system.

Note
Server share site systems can be assigned only the distribution point site server role.

To add a new server site system

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>/ Site Settings / Site Systems.

  2. Right-click Site Systems, click New, and then click Server to launch the New Site System Server Wizard.

  3. Complete the New Site System Server Wizard to add the new server site system.

To add a new server share site system

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>/ Site Settings / Site Systems.

  2. Right-click Site Systems, click New, and then click Server to launch the New Site System Server Share Wizard.

  3. Complete the New Site System Server Share Wizard to add the new server share site system.

See Also

Concepts

New Site System Server Wizard
How to Configure Site Systems

Other Resources

New Site System Server Share Wizard


How to Modify Site System Properties

You can delete a site system using the Configuration Manager console by performing the procedure described in this topic.

Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To modify a site system's properties

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. In the details pane, right-click ConfigMgr site system and click Properties.

  3. Modify the site system properties necessary on the site system properties General Tab.

See Also

Reference

Site System Properties: General Tab
Site System Server Share Properties: General Tab

Concepts

How to Configure Site Systems


How to Delete a Site System

You can delete a site system using the Configuration Manager console by performing the procedure described in this topic. If you want to delete only a site system role, you do not need to delete the site system. For more information about deleting site system roles, see How to Delete Site System Roles From Site Systems.

Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To delete a site system, all previously administrator-defined site system roles must be deleted. The ConfigMgr site system role is automatically added to any new site system created by the site component manager. Depending on the site role added, the Site component server role might also be assigned to the site system. These two roles cannot be added to a site system by the administrator and cannot be manually removed using the Configuration Manager console.

A site system can be deleted when it is still assigned the ConfigMgr site system server role, but it cannot be deleted if it is still assigned the Site component server server role.

When removing administrator assigned site system roles from a site system, it may be necessary to refresh the Configuration Manager console view to ensure the most current site system role information is displayed before deleting the site system.

After all administrator-definable server roles are removed from the site system, site component manager is instructed to remove the following from the server:

  • All site role component installation files on the server
  • The SMS Executive service (if present)
  • Site role-specific registry entries

When site component manager has finished removing site role components from the server, the Site component server server role is removed and the site system can be deleted from within the Configuration Manager console.

To delete a site system

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. Verify that no site roles are currently assigned to the site system other than the ConfigMgr site system role.

  3. Right-click <site system name> for the site system that you want to delete, and click Delete.

  4. Click Yes on the Confirm Delete dialog box.

See Also

Tasks

How to Delete Site System Roles From Site Systems

Concepts

How to Configure Site Systems


How to Configure Windows Server 2008 for Site Systems

Topic Last Updated—August 2008

When Configuration Manager 2007 SP1 site systems will be installed on Windows Server 2008 computers, additional configuration changes might be required to ensure successful installation and operation.

The procedures in this topic can be used to configure Windows Server 2008 to support Configuration Manager 2007 SP1 site system installation.

To Install Internet Information Services (IIS) to support Configuration Manager 2007 SP1 site systems on Windows Server 2008 Computers

This procedure describes how to install Internet Information Services (IIS) 7.0 Windows Server 2008 to support the following site system roles:

  • Management point.
  • Background Intelligent Transfer Service (BITS)-enabled distribution point.
  • Reporting point.
  • Software Update Point.
  • Server locator point.
To install and configure WebDAV for IIS 7.0 to support management point and BITS-enabled distribution point site system computers

Because WebDAV IIS extensions required for the management point and BITS-enabled distribution point site system roles are not installed by default with IIS 7.0, WebDAV extensions must be manually installed and configured after installing IIS 7.0.

To add Remote Differential Compression for site server and branch distribution point computers

If a site system will be used only to host the site server or branch distribution point site system roles, IIS is not required. However, site servers and branch distribution point site systems require Remote Differential Compression (RDC) to generate package signatures and perform signature comparison. RDC is not installed by default on computers running Windows Server 2008 and must be enabled manually.

Note
Installing Configuration Manager 2007 SP1 primary and secondary site systems is supported on Windows Server 2008 read-only domain controller (RODC) computers. During site installation using the Configuration Manager 2007 Setup Wizard, the wizard will identify that the site is being installed on an RODC and search for a writable domain controller to create the necessary groups required by the type of site installation. However, when installing secondary sites using the Install Secondary Site Installation Wizard from a Configuration Manager console, the groups required for the secondary site installation must be pre-created in Active Directory Domain Services before beginning the installation.

To modify the requestFiltering section on BITS-enabled distribution point computers

If package source files distributed to BITS-enabled distribution points contain file extensions that are blocked by default in IIS 7.0, the requestFiltering section of the applicationHost.config file must be modified to allow required extensions.

Important
Enabling WebDAV and modifying the requestFiltering section of the applicationHost.config file for the Web site increases the attack surface of the computer. Enable WebDAV only when required for management points and BITS-enabled distribution points. If you enable WebDAV on the default Web site, it is enabled for all applications using the default Web site. If you modify the requestFiltering section, it is modified for all Web sites on that server. The security best practice is to run Configuration Manager 2007 on a dedicated Web server. If you must run other applications on the Web server, use a custom Web site for Configuration Manager 2007. For more information, see Best Practices for Securing Site Systems.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To Install Internet Information Services (IIS) on Windows Server 2008 Computers

  1. On the Windows Server 2008 computer, navigate to Start / All Programs / Administrative Tools / Server Manager to start Server Manager. In Server Manager, select the Features node and click Add Features to start the Add Features Wizard.

  2. On the Select Features page of the Add Features Wizard:

    • Select BITS Server Extensions. When prompted, click Add Required Role Services to add the dependent components, including the Web Server (IIS) role.
    • Select Remote Differential Compression, and then click Next.

  3. On the Web Server (IIS) page of the Add Features Wizard, click Next.

  4. On the Select Role Services page of the Add Features Wizard:

    • Under Application Development, select ASP.NET and, when prompted, click Add Required Role Services to add the dependent components.
      Note
      ASP should also be selected if the site system will be configured as a reporting point.

    • Under Security, select Windows Authentication.
    • In the Management Tools node, under IIS 6 Management Compatibility, ensure that both IIS 6 Metabase Compatibility and IIS 6 WMI Compatibility are selected and then click Next.

  5. On the Confirmation page, click Install, and then complete the rest of the wizard.

  6. Click Close to exit the Add Features Wizard, and then close Server Manager.

To install and configure WebDAV for IIS 7.0 to support management point and BITS-enabled distribution point site system computers

  1. Depending on your server operating system platform, download either the x86 or x64 version of WebDAV from: http://go.microsoft.com/fwlink/?LinkId=108052.

  2. Depending on which version was downloaded, run either the webdav_x86_rtw.msi or the webdav_x64_rtw.msi file to install WebDAV IIS 7.0 extensions.

  3. Enable WebDAV and create an Authoring Rule, as follows:

    1. Navigate to Start / All Programs / Administrative Tools / Internet Information Services (IIS) Manager to start Internet Information Services 7 Application Server Manager. In Server Manager, select the Features node, and click Add Features to start the Add Features Wizard.
    2. In the Connections pane, expand the Sites node in the navigation tree, and then click Default Web Site if you are using the default Web site for the site system or SMSWEB if you are using a custom Web site for the site system.
    3. In the Features View, double-click WebDAV Authoring Rules.
    4. When the WebDAV Authoring Rules page is displayed, in the Actions pane, click Enable WebDAV.
    5. After WebDAV has been enabled, in the Actions pane, click Add Authoring Rule.
    6. In the Add Authoring Rule dialog box, under Allow access to, click All content.
    7. Under Allow access to this content to, click All users.
    8. Under Permissions, click Read, and then click OK.

  4. Change the property behavior as follows:

    1. In the WebDAV Authoring Rules page, in the Actions pane, click WebDAV Settings.
    2. In the WebDAV Settings page, under Property Behavior, set Allow anonymous property queries to True.
    3. Set Allow Custom Properties to False.
    4. Set Allow property queries with infinite depth to True.
    5. If this is a BITS-enabled distribution point, under WebDAV Behavior, set Allow hidden files to be listed to True.
    6. In the Action pane, click Apply.

  5. Close Internet Information Services (IIS) Manager.

To add Remote Differential Compression for site server and branch distribution point computers

  1. In Server Manager, on the Features node, click Add Features to start the Add Features Wizard.

  2. On the Select Features page, select Remote Differential Compression, and then click Next.

  3. Complete the rest of the wizard.

  4. Close Server Manager.

To modify the requestFiltering section on BITS-enabled distribution point computers:

  1. Open the applicationHost.config file located in the %windir%\System32\inetsrv\config\ directory on the BITS-enabled distribution point site system.

  2. Search for the <requestFiltering> section.

  3. Determine the file extensions that you will have in the packages on that distribution point. For each file extension that you require, change allowed to true.

    For example, if your package will contain a file with an .mdb extension, change the line <add fileExtension=".mdb" allowed="false" /> to <add fileExtension=".mdb" allowed="true" />.

    Allow only the file extensions required for your packages.

  4. Save and close the applicationHost.config file.

See Also

Concepts

How to Configure Site Systems


How to Configure Site System Roles

Configuration Manager 2007 site system roles are assigned to site systems within the Configuration Manager 2007 site. Each site system role serves a different purpose in supporting the site and its clients.

Site system roles are viewed, assigned, and deleted using the Configuration Manager console.

In This Section

How to View Site System Roles Assigned to Site Systems

Describes how to view the site system roles assigned to site systems.

How to Add New Site System Roles

Describes how to add new site system roles to site systems using the New Site System Role Wizard.

How to Delete Site System Roles From Site Systems

Describes how to delete site system roles from site systems.


How to View Site System Roles Assigned to Site Systems

Configuration Manager 2007 site systems are assigned site system roles to help support the site and its clients. Each site system can be individually assigned different site system roles. The site system roles assigned to individual site systems can be viewed in the Configuration Manager console.

To view site system roles assigned to site systems

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. In the results pane, you can view the site system roles assigned to the site system. You can double-click the site system role in the results pane to view the site system role properties.


How to Add New Site System Roles

Configuration Manager 2007 site systems are assigned site system roles to help support the site and its clients. Each site system can be individually assigned different site system roles. Site system roles for individual server, or server share, site systems can be assigned in the Configuration Manager console.

To add new site system roles to site systems

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. Right-click <site system name>, and click New Roles to start the New Site Systems Role Wizard.

  3. On the General tab, you have the options to do the following:

    • Specify a Fully Qualified Domain Name (FQDN) for intranet-based clients to communicate with this site system. This configuration is recommended, but not required.
    • Specify a Fully Qualified Domain Name (FQDN) for Internet-based clients to communicate with this site system. This option is required for supporting Internet-based client systems.
    • Select the account to install the site system files. The site server machine account is used if a Windows domain user account is not specified.
    • Enable the site system as a protected site system (responding to client requests only from specifically configured site boundaries).
    • Configure communication between the site system and site server to be initiated only by the site server.

  4. On the System Role Selection page, you can select from the roles available to assign roles to the site system.

  5. For each site system role selected, configure the site-role-specific properties (if applicable).

  6. On the Summary page, review the settings for the site system and the roles assigned to the site system before continuing. To make changes to any settings or site roles assigned to the site system, click Previous until you return to the page in the wizard where you set the detail. Once you are finished, return to the Summary page. To begin site system role installation, click Next.

  7. The Progress page displays the progress of saving the site system settings to the site server.

  8. The Confirmation page displays whether or not the site system settings were successfully saved in the site database.

See Also

Concepts

Determine If You Will Use FQDN Server Names
Overview of Internet-Based Client Management


How to Delete Site System Roles From Site Systems

Configuration Manager 2007 site systems are assigned site system roles to help support the site and its clients. Each site system can be individually assigned different site system roles. The site system roles assigned to individual site systems can be deleted in the Configuration Manager console.

To delete site system roles from site systems in the Configuration Manager console

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>/ Site Settings / Site Systems / <site system name>.

  2. In the results pane, right-click the site system role currently assigned to the site system and click Delete.

  3. Verify that you are sure you want to delete this site system role by clicking Yes on the Confirm Delete dialog box.

    Note
    After confirmation, the site server will begin the process of removing the site roles from the computer which may take several minutes.


How to Configure Site Components

In the Microsoft System Center Configuration Manager 2007 console, you can use Site Settings Component Configuration to specify software distribution, status reporting, and settings for some site roles.

In This Section

How to Configure Status Reporting Components

All major Configuration Manager 2007 components generate status messages. You can specify that status messages be reported to the status system, to the event log, or both. You can configure where status messages are reported and stored for both the server and the client.

How to Configure Site Status Configuration

All major Configuration Manager 2007 components generate status messages. Although, the default status configuration settings will be usable for most sites, it may be necessary to modify them to meet the specific needs of an individual site.

See Also

Tasks

How to Configure the Default Management Point for a Site
How to Create and Configure an Active Software Update Point

Concepts

Configuration Manager Tasks for Configuring a Single Site

Other Resources

Configuring Software Distribution
How to Configure the System Health Validator Point for Network Access Protection


How to Configure Status Reporting Components

All major Microsoft System Center Configuration Manager 2007 components generate status messages. You can specify that status messages be reported to the status system, to the event log, or both. You can configure where status messages are reported and stored for both the server and the client.

Note
You must have Modify right for the Site security object class or instance to perform this procedure.

To Configure Status Reporting Components

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Component Configuration.

  2. Right-click Status Reporting, and then click Properties.

  3. In the Status Reporting Properties dialog box, click the General tab.

  4. Specify the server and client component messages you want to report or log, and then click OK.

See Also

Other Resources

How to Configure Site Components


How to Configure Site Status Configuration

All major Configuration Manager 2007 components generate status messages. The Configuration Manager 2007 status system need not be configured to work; its default settings are reasonable for most environments. However, you can configure three aspects of the Configuration Manager 2007 status system:

  • Status reporting
  • Status filter rules
  • Status summarizers

In This Section

About Status Message Properties and Property Values

About Status Summarizers

About Threshold Periods

Status Filter Rules Configuration Overview

How to Create a Status Filter Rule

How to Change the Order of Status Filter Rules

How to Modify a Status Filter Rule

How to Disable a Status Filter Rule

How to Delete a Status Filter Rule

Command-Line Parameters for Status Filter Rules

How to Configure the Status Message Display Interval

How to Reset Status Message Counts

See Also

Other Resources

How to Configure Site Components


About Status Message Properties and Property Values

Status message properties provide a consistent way for different Configuration Manager 2007 components to report status messages about Configuration Manager objects. A status message can have one of these optional properties:

Advertisement ID

A status message associated with an advertisement.

Collection ID

A status message associated with a collection.

Package ID

A status message associated with a package.

User Name

An audit message associated with a user.

Messages with properties can also have property values, which are associated with a particular instance of a property:

Advertisement ID

Can have a property value that is the ID of a particular advertisement.

Collection ID

Can have a property value that is the name of a particular collection.

Package ID

Can have a property value that is the ID of a particular package.

User Name

Can have a property value that is the name of a particular user.

Note
Not all status messages have properties, and not all those with properties have property values.

See Also

Other Resources

How to Configure Site Status Configuration


About Status Summarizers

Status summarizers provide a high-level real-time view of the health of the following four Microsoft System Center Configuration Manager 2007 features and subsystems, so that you can quickly identify and resolve problems:

  • Components
  • Site systems
  • Advertisements
  • Packages

Component Status and Advertisement Status Summarizers

These summarizers count the different types of messages generated by components and advertisements. If too many messages of a certain type occur within a specific time period, a status message threshold is crossed, and the status indicator of the status summarizer changes. For example, you can specify that if any component generates more than five messages a day, its status becomes Warning, and if it generates more than ten messages a day, its status becomes Critical.

Site System Status and Package Status Summarizers

These summarizers track state changes instead of counting error messages. For example, the Site System Status summarizer reacts to changes in free disk space on site systems. If the free space falls below the threshold you set, the Site System Status summarizer's status indicator changes. The Package Status Summarizer tracks such changes as how many clients have installed each package.

All the summarizers except Site System Status are event driven; they respond in real time to changes taking place in Configuration Manager 2007. Only the Site System Status summarizer polls for its information, according to a schedule you can set.

The following table describes each of the four status summarizers.

 | Component | Site System | Advertisement | Package
Configurable | Yes | Yes | Yes |
Thresholds | Yes | Yes |  |
Status indicators | Yes | Yes |  |
Tracks state or counts messages | Counts | Tracks | Counts | Tracks
Schedule or event driven | Event | Sched | Event | Event

There is one Component Status summarizer and one Site System Status summarizer per site, but only one Advertisement Status summarizer and one Package Status summarizer per site database, and they cover all the sites in that site database.

See Also

Other Resources

How to Configure Site Status Configuration


About Threshold Periods

The threshold period is the length of time that status messages are counted before the counts are reset to zero. If there were no threshold period, every status message threshold, no matter how high, would eventually be crossed, but it would not be meaningful; a hundred messages in three months is not as significant as a hundred messages in one day.

Therefore, choose a threshold period appropriate for how often you plan to check the status summarizer. The threshold period should be the same as or greater than how often you plan to check the status summarizer; that way, any threshold crossings will not be reset before you have a chance to look at them.

If you want to reset the message count on any particular component or site system, you can right-click it and choose Reset Counts.

See Also

Other Resources

How to Configure Site Status Configuration


Status Filter Rules Configuration Overview

Status filter rules provide a way to automatically process status messages when they arrive at a site (status messages are passed up from child sites). You can have an unlimited number of filter rules. Each one specifies certain message criteria, such as the component that generated the message, its severity, and its properties. Each message passes through the site's status message filter until it matches all criteria in a filter rule. If you want to achieve behavior when fewer criteria are met, create multiple filter rules, each with a single criterion. Messages then need only match one of the criteria.

When a status message matches a filter rule, the actions specified for that filter rule are performed, such as running a program, writing the message to the Configuration Manager site database, or replicating the message to the parent site.

Status filter rules are evaluated in the order in which they are listed, from top to bottom, in the results pane of Status Filter Rules. However, a possible status filter rule action is "Do not process lower-priority status filter rules." In this case, when a status message matches that filter rule, no other lower priority filter rules are evaluated.

See Also

Other Resources

How to Configure Site Status Configuration


How to Create a Status Filter Rule
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To create a new status filter rule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Status Filter Rules.

  2. Right-click Status Filter Rules, point to New, and then click New Status Filter Rule.

  3. On the General page of the New Status Filter Rule Wizard, specify a name for the new status filter rule and message-matching criteria for the rule.

  4. On the Actions page of the New Status Filter Rule Wizard, specify the actions to be taken when a status message matches the filter rule.

    Note
    Configuration Manager 2007 only requires that the new status filter rule has a name. If the rule is created but not given any criteria for processing status messages, it will have no effect. This allows you to create and organize rules before actually configuring the status filter criteria for each rule.

See Also

Other Resources

How to Configure Site Status Configuration


How to Change the Order of Status Filter Rules
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To change the order of status filter rules

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Status Filter Rules.

  2. In the results pane, right-click a status filter rule, and then click Increment Priority or Decrement Priority.

  3. Repeat step 2 until the status filter rule is where you want it. Status filter rules are evaluated starting from the top of the list. If the Do not process lower-priority status filter rules option has been set for any rule, evaluation stops when a message matches that rule; otherwise, a message can match several rules.

See Also

Other Resources

How to Configure Site Status Configuration


How to Modify a Status Filter Rule
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To modify a status filter rule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Status Filter Rules.

  2. In the results pane, right-click a status filter rule, and then click Properties.

  3. In the Status Filter Rule Properties dialog box, complete the settings as needed to define status filter rules:

    • To change the message-matching criteria for a status filter rule, use the General tab.
    • To change the actions to be taken when a status message matches the filter rule, use the Actions tab.

See Also

Other Resources

How to Configure Site Status Configuration


How to Disable a Status Filter Rule
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To Disable a Status Filter Rule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Status Filter Rules.

  2. In the results pane, right-click the status filter rule to disable and then click Disable.

See Also

Other Resources

How to Configure Site Status Configuration


How to Delete a Status Filter Rule
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To delete a status filter rule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Status Filter Rules.

  2. In the results pane, right-click a status filter rule, and then click Delete.

See Also

Other Resources

How to Configure Site Status Configuration


Command-Line Parameters for Status Filter Rules

The following information lists all valid command-line parameters that you can include status message filter rules that allows you to pass properties of the status message to the program that runs. Microsoft System Center Configuration Manager 2007 replaces the parameters with the data they represent

Properties of the Status Message

%msgsc

Site code that reported the message

%msgsys

Name of the computer that reported the message

%msgsrc

Source that reported the message ("SMS Server", for example)

%msgcomp

Component that reported the message

%msgpid

Process ID of the process that reported the message

%msgtid

Thread ID of the thread of the process that reported the message

%msgtype

One character message type: A is Audit, M is Milestone, D is Detail, N is NT Event

%msgsev

One character message severity: E is Error, W is Warning, I is Informational

%msgid

Message ID of the message

%msgdesc

Complete message description text

%msgis01

First "insertion string"

%msgis02

Second "insertion string"

%msgis03

Third "insertion string"

%msgis04

Fourth "insertion string"

%msgis05

Fifth "insertion string"

%msgis06

Sixth "insertion string"

%msgis07

Seventh "insertion string"

%msgis08

Eighth "insertion string"

%msgis09

Ninth "insertion string"

%msgis10

Tenth "insertion string"

%msglta

Time the message was reported, converted to local time: Abbreviated weekday name

%msgltA

Time the message was reported, converted to local time: Full weekday name

%msgltb

Time the message was reported, converted to local time: Abbreviated month name

%msgltB

Time the message was reported, converted to local time: Full month name

%msgltd

Time the message was reported, converted to local time: Day of month as decimal number (01 – 31)

%msgltH

Time the message was reported, converted to local time: Hour in 24-hour format (00 – 23)

%msgltI

Time the message was reported, converted to local time: Hour in 12-hour format (01 – 12)

%msgltj

Time the message was reported, converted to local time: Day of year as decimal number (001 – 366)

%msgltm

Time the message was reported, converted to local time: Month as decimal number (01 – 12)

%msgltM

Time the message was reported, converted to local time: Minute as decimal number (00 – 59)

%msgltp

Time the message was reported, converted to local time: Current locale's A.M./P.M. indicator for 12-hour clock

%msgltS

Time the message was reported, converted to local time: Second as decimal number (00 – 59)

%msgltU

Time the message was reported, converted to local time: Week of year as decimal number, with Sunday as first day of week (00 – 51)

%msgltw

Time the message was reported, converted to local time: Weekday as decimal number (0 – 6; Sunday is 0)

%msgltW

Time the message was reported, converted to local time: Week of year as decimal number, with Monday as first day of week (00 – 51)

%msglty

Time the message was reported, converted to local time: Year without century, as decimal number (00 – 99)

%msgltY

Time the message was reported, converted to local time: Year with century, as decimal number

%msgltZ

Time the message was reported, converted to local time: Time-zone name or abbreviation; no characters if time zone is unknown

%msggmta

Time the message was reported, converted to GMT: Abbreviated weekday name

%msggmtA

Time the message was reported, converted to GMT: Full weekday name

%msggmtb

Time the message was reported, converted to GMT: Abbreviated month name

%msggmtB

Time the message was reported, converted to GMT: Full month name

%msggmtd

Time the message was reported, converted to GMT: Day of month as decimal number (01 – 31)

%msggmtH

Time the message was reported, converted to GMT: Hour in 24-hour format (00 – 23)

%msggmtI

Time the message was reported, converted to GMT: Hour in 12-hour format (01 – 12)

%msggmtj

Time the message was reported, converted to GMT: Day of year as decimal number (001 – 366)

%msggmtm

Time the message was reported, converted to GMT: Month as decimal number (01 – 12)

%msggmtM

Time the message was reported, converted to GMT: Minute as decimal number (00 – 59)

%msggmtp

Time the message was reported, converted to GMT: Current locale's A.M./P.M. indicator for 12-hour clock

%msggmtS

Time the message was reported, converted to GMT: Second as decimal number (00 – 59)

%msggmtU

Time the message was reported, converted to GMT: Week of year as decimal number, with Sunday as first day of week (00 – 51)

%msggmtw

Time the message was reported, converted to GMT: Weekday as decimal number (0 – 6; Sunday is 0)

%msggmtW

Time the message was reported, converted to GMT: Week of year as decimal number, with Monday as first day of week (00 – 51)

%msggmty

Time the message was reported, converted to GMT: Year without century, as decimal number (00 – 99)

%msggmtY

Time the message was reported, converted to GMT: Year with century, as decimal number

Properties of the Current Site

%sc

site code of the current site

%parentsc

site code of the parent site

%sitesvr

name of the site server for the current site

%sqlsvr

name of the SQL server for the current site

Current Time

%%

% character

%lta

Current local time: Abbreviated weekday name

%ltA

Current local time: Full weekday name

%ltb

Current local time: Abbreviated month name

%ltB

Current local time: Full month name

%ltd

Current local time: Day of month as decimal number (01 – 31)

%ltH

Current local time: Hour in 24-hour format (00 – 23)

%ltI

Current local time: Hour in 12-hour format (01 – 12)

%ltj

Current local time: Day of year as decimal number (001 – 366)

%ltm

Current local time: Month as decimal number (01 – 12)

%ltM

Current local time: Minute as decimal number (00 – 59)

%ltp

Current local time: Current locale's A.M./P.M. indicator for 12-hour clock

%ltS

Current local time: Second as decimal number (00 – 59)

%ltU

Current local time: Week of year as decimal number, with Sunday as first day of week (00 – 51)

%ltw

Current local time: Weekday as decimal number (0 – 6; Sunday is 0)

%ltW

Current local time: Week of year as decimal number, with Monday as first day of week (00 – 51)

%lty

Current local time: Year without century, as decimal number (00 – 99)

%ltY

Current local time: Year with century, as decimal number

%ltZ

Current local time: Time-zone name or abbreviation; no characters if time zone is unknown

%gmta

Current GMT time: Abbreviated weekday name

%gmtA

Current GMT time: Full weekday name

%gmtb

Current GMT time: Abbreviated month name

%gmtB

Current GMT time: Full month name

%gmtd

Current GMT time: Day of month as decimal number (01 – 31)

%gmtH

Current GMT time: Hour in 24-hour format (00 – 23)

%gmtI

Current GMT time: Hour in 12-hour format (01 – 12)

%gmtj

Current GMT time: Day of year as decimal number (001 – 366)

%gmtm

Current GMT time: Month as decimal number (01 – 12)

%gmtM

Current GMT time: Minute as decimal number (00 – 59)

%gmtp

Current GMT time: Current locale's A.M./P.M. indicator for 12-hour clock

%gmtS

Current GMT time: Second as decimal number (00 – 59)

%gmtU

Current GMT time: Week of year as decimal number, with Sunday as first day of week (00 – 51)

%gmtw

Current GMT time: Weekday as decimal number (0 – 6; Sunday is 0)

%gmtW

Current GMT time: Week of year as decimal number, with Monday as first day of week (00 – 51)

%gmty

Current GMT time: Year without century, as decimal number (00 – 99)

%gmtY

Current GMT time: Year with century, as decimal number

See Also

Other Resources

How to Configure Site Status Configuration


How to Configure the Status Message Display Interval

You can change the Display Interval to show status messages from a given time. Microsoft System Center Configuration Manager 2007 does not save the Display Interval.

To configure status message display interval

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Status / <site name> / Component Status.

  2. Right click Component Status.

  3. Click Display Interval, and then click the desired display interval to to display component status since the time chosen.

See Also

Other Resources

How to Configure Site Status Configuration


How to Reset Status Message Counts

You can reset the message count on any component or site system. Message counts are automatically reset at the end of threshold periods, but you can reset them manually after you correct a problem to clear its Critical or Warning status.

Note
You must manually refresh the view of a component or site system to immediately view changes initiated by resetting a count.

To reset status message counts

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Status.

  2. In the Configuration Manager console tree, right-click Site Status.

  3. Click Reset Counts, and then click the type of count to reset.

See Also

Other Resources

How to Configure Site Status Configuration


How to Install the Configuration Manager Console

Before you install the Microsoft System Center Configuration Manager 2007 console, verify that you have met the prerequisites. For more information, see Prerequisites for Installing Configuration Manager.

You must be logged on using a domain account. If Configuration Manager 2007 is installed on a computer where the logged-on user account is a local account and not part of a domain, Setup might appear to succeed, but access to the Configuration Manager 2007 console fails and you will need to reinstall.

Important
Any administrators who will use a remote Configuration Manager console require Remote Activation DCOM permissions on both the site server computer and SMS Provider computer. For more information, see How to Configure DCOM Permissions for Configuration Manager Console Connections.

To install the Configuration Manager console

  1. From the product DVD, if the startup screen does not run automatically, double-click splash.hta.

  2. On the Start page, click Configuration Manager 2007.

  3. On the Welcome page, click Next.

  4. On the Available Setup Options page, click Install or upgrade an administrator console and then click Next until you reach the end of the wizard.

See Also

Concepts

About the Account Used To Install Configuration Manager

Other Resources

Using the Configuration Manager Console
Configuration Manager Supported Configurations


How to Identify the Site Mode of a Site

To find out if a Configuration Manager 2007 site is operating in mixed mode or native mode, use one of the following procedures.

To identify the site mode of a site using the site database home page:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager

  2. Click Site Database, and then view the home page in the results pane.

  3. The home page will display one of the following to identify the current site mode:

    • This site is running in mixed mode
    • This site is running in native mode

To identify the site mode of a site using the Site Properties:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name> and then click Properties.

  3. Click the Site Mode tab in the Site Properties dialog box, and then view the Site mode setting, which will display one of the following:

    • Mixed
    • Native

  4. Click OK.

    Note
    For information about the options in this dialog box, see Site Properties: Site Mode Tab.

See Also

Tasks

How to Verify Native Mode Migration Is Complete
How to Determine the Site Mode for a Configuration Manager Client
How to Monitor Changes in Configuration Manager Client Site Modes

Concepts

Configuration Manager Site Modes
Administrator Workflow: Migrating a Site to Native Mode
Administrator Checklist: Migrating a Site to Native Mode

Other Resources

How to Configure Native Mode


How to Configure Native Mode

This section contains the administrative tasks related to configuring native mode settings for Configuration Manager 2007.

Important
Native mode operation requires that the supporting public key infrastructure (PKI) certificates be deployed to computers before configuring native mode in Configuration Manager 2007. For more information, see Deploying the PKI Certificates Required for Native Mode.

How to Configure the Site Server with its Site Server Signing Certificate

How to Enable or Disable Certificate Revocation Checking (CRL) on Clients

How to Configure HTTP Communication for Roaming and Site Assignment

How to Specify the Client Certificate Store

How to Specify the Client Certificate Selection Criteria

How to Determine Whether Client Computers Are Ready for Native Mode

How to Migrate the Site Mode from Mixed Mode to Native Mode

How to Verify Native Mode Migration Is Complete

How to Identify Client Certificate Issues in Native Mode

See Also

Tasks

How to Revert a Configuration Manager Site to Mixed Mode

Concepts

Administrator Checklist: Migrating a Site to Native Mode
Administrator Workflow: Migrating a Site to Native Mode
Configuration Manager Site Modes
Prerequisites for Native Mode


How to Configure the Site Server with its Site Server Signing Certificate

The Configuration Manager 2007 site server's signing certificate is required to sign all client policies in native mode. The creation and deployment of this certificate is external to Configuration Manager 2007 and requires integration with a public key infrastructure (PKI) deployment. Before you can select the site server signing certificate in Configuration Manager 2007, the certificate must be in the certificate store of the site server.

You will need to select the site server signing certificate when you migrate the site to native mode, or if you need to specify a new certificate, for example, if the existing site server signing certificate is about to expire. If you are selecting a new certificate from a different certification authority than the site was configured to use previously, see the topic Renewing or Changing the Site Server Signing Certificate.

The site server signing certificate must be configured directly on each primary site database. You cannot configure the site mode for a child primary site from a parent primary site because the certificate cannot be validated correctly in this scenario.

Follow this procedure to specify the site server signing certificate.

Important
Ensure that all the required PKI certificates are in place before specifying the site server signing certificate. If any certificates are missing or invalid, all clients might become unmanaged. For more information about the required certificates, see Certificate Requirements for Native Mode.

To configure the site server with its site server signing certificate:

  1. Open the Configuration Manager console in the primary site in which you need to configure the site server signing certificate, and navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site code> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, select Native for the Site mode option, if it is not already selected.

  4. In the Site server signing certificate section, click Browse.

  5. In the Available Certificates dialog box, select the site server signing certificate which has the following values:

    • ConfigMgr site server for site <site code> in the field Issued to, where <site code> displays the site code for this site.
    • Document Signing displayed in the field Intended Purpose.

  6. Click OK to select the certificate and return to the Site Mode tab.

  7. The friendly name of the certificate now appears in the Certificate box, which indicates that validation of the certificate was successful.

  8. If you are unable to browse to the certificate store, and you have the thumbprint of the site server signing certificate, enter it into the Thumbprint text box.

    Note
    If you can browse to the site server's certificate store, it is highly recommended you browse for the certificate so that Configuration Manager 2007 can validate the certificate. Only if you are unable to browse the site server's certificate store, and have the certificate thumbprint, should you manually enter the certificate thumbprint.

    Reasons why you cannot browse to the certificate store include not having local administrator rights on the site server computer, or a temporary network failure. However, it is also possible that the certificate has not yet been installed, but you want to specify it here in advance.

  9. Click OK, which invokes validation of the certificate. If you have not selected a certificate or entered a certificate thumbprint, you will not be able to save your changes. If you have entered a thumbprint which cannot be mapped to a friendly name, you will see a warning message that the thumbprint could not be validated and ask if you want to proceed.

    Note
    For more information about the options in this dialog box, see Site Properties: Site Mode Tab.

See Also

Tasks

How to Determine Whether Client Computers Are Ready for Native Mode

Concepts

Certificate Requirements for Native Mode
Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)
Renewing or Changing the Site Server Signing Certificate

Other Resources

Deploying the PKI Certificates Required for Native Mode


How to Enable or Disable Certificate Revocation Checking (CRL) on Clients

Follow these procedures to enable or disable certificate revocation checking on Configuration Manager 2007 client computers in a native mode site.

Note
Mobile device clients do not use certificate revocation lists.

The default setting for a native mode site is for client computers to check their certificate revocation list (CRL), but this option can be disabled. To verify this setting for individual clients, see How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management and the Https State Flags value. You cannot configure CRL checking of native mode site systems in Configuration Manager 2007; this setting is on by default and inherited with IIS configuration.

Important
The publishing and maintenance of the CRL is an integral part of the public key infrastructure (PKI), and external to Configuration Manager 2007. Do not enable this option until you have confirmed that a CRL is supported in your PKI environment.

There are two supported procedures you can use for this configuration. Choose the procedure that is suitable for your environment. The two procedures are as follows:

  • Configure the option as a site property. Client computers that can access site properties published to Active Directory Domain Services will be automatically configured with this option on a periodic basis (including at site assignment time, every time the client starts, and every 25 hours). Clients installed using the client push installation method will be configured with the option at installation time only.
    For installed clients to be configured with the setting using Active Directory Domain Services, the following conditions must all apply:
    • Active Directory Domain Services must be extended with the Configuration Manager 2007 schema extensions
    • The site must be publishing to Active Directory Domain Services
    • Clients must be on the intranet
    • Clients must be from the same Active Directory forest as the site server's forest.
  • Specify the setting using CCMSetup.exe command line options. You can use CCMSetup options when the client is first installed, or supplied as a script to run after installation, which will reinstall the client with the new configuration. If the client is already installed, you can use the software distribution feature to send the CCMSetup commands to the client, or use a Configuration Manager 2007 task sequence to achieve this.
    Note
    If the settings supplied with CCMSetup conflict with those published to Active Directory Domain Services, and clients can access the settings in the Active Directory Domain Services, the settings from Active Directory Domain Services will take precedence and the settings specified with CCMSetup will not be used.

Additionally, you can also specify the setting using your in-house client management tools, which might include incorporating the settings in a standard build image and deploying custom scripts to edit the registry.

To configure certificate revocation checking (CRL) on clients in a native mode site by configuring the setting as a site property

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site code> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, select or cancel Enable CRL checking on clients.

  4. Click OK.

To configure certificate revocation checking (CRL) on clients in a native mode site by specifying the setting using CCMSetup.exe command line options

  • To enable CRL checking: Use CCMSetup.exe with the command line property /native:CRL (for native mode communication and CRL checking), or /native:CRLANDFALLBACK (for native mode communication and CRL checking and HTTP communication for roaming and site assignment).

    To disable CRL checking: Use CCMSetup.exe with the command line property /native: (for native mode communication without CRL checking), or /native:FALLBACK (for native mode communication and HTTP communication for roaming and site assignment without CRL checking).

    For more information about CCMSetup installation properties, see About Configuration Manager Client Installation Properties.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push
How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management

Concepts

Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)


How to Configure HTTP Communication for Roaming and Site Assignment

If you have decided to change the behavior of Configuration Manager 2007 native mode clients for HTTP communication for roaming and site assignment, follow these procedures to enable or disable this option for a native mode site.

The default setting for a native mode site is that this option is not enabled. To verify this setting for individual clients, see How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management and the Https State Flags value.

There are two supported procedures you can use for this configuration. Choose the procedure that is suitable for your environment. The two procedures are as follows:

  • Configure the option as a site property. Client computers that can access site properties published to Active Directory Domain Services will be automatically configured with this option on a periodic basis (including at site assignment time, every time the client starts, and every 25 hours). Clients installed using the client push installation method will be configured with the option at installation time only.
    For installed clients to be configured with the setting using Active Directory Domain Services, the following conditions must all apply:
    • Active Directory Domain Services must be extended with the Configuration Manager 2007 schema extensions
    • The site must be publishing to Active Directory Domain Services
    • Clients must be on the intranet
    • Clients must be from the same Active Directory forest as the site server's forest
  • Specify the settings using CCMSetup.exe command line options. You can use CCMSetup options when the client is first installed, or supplied as a script to run after installation, which will reinstall the client with the new configuration. If the client is already installed, you can use the software distribution feature to send the CCMSetup commands to the client, or use a Configuration Manager 2007 task sequence to achieve this.
    Note
    If the settings supplied with CCMSetup conflict with those published to Active Directory Domain Services, and clients can access the settings in the Active Directory Domain Services, the settings from Active Directory Domain Services will take precedence and the settings specified with CCMSetup will not be used.

Additionally, you can also specify the settings using your in-house client management tools, which might include incorporating the settings in a standard build image and deploying custom scripts to edit the registry.

To configure HTTP communication for roaming and site assignment by configuring the setting as a site property:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, select or cancel the option Allow HTTP communication for roaming and site assignment.

  4. Click OK.

To enable HTTP communication for roaming and site assignment by specifying the setting using CCMSetup.exe command line options:

  • Use CCMSetup.exe with the command line property /native:FALLBACK (for native mode communication and HTTP communication for roaming and site assignment), or /native:CRLANDFALLBACK (for native mode communication and CRL checking and HTTP communication for roaming and site assignment).

    For more information about CCMSetup installation properties, see About Configuration Manager Client Installation Properties.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push
How to Identify Client Configuration Details for Native Mode and Internet-Based Client Management

Concepts

Client Communication in Mixed Mode and Native Mode
Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)


How to Specify the Client Certificate Store

When Configuration Manager 2007 is operating in native mode, clients communicate with the site using a client certificate that is managed externally to Configuration Manager 2007.

By default, a Configuration Manager 2007 client will look for a suitable certificate in the Computer Personal store. If this is the location of the deployed client certificate, there is nothing further to configure. However, if the client certificate is stored in an alternative location, you must specify the client certificate store.

There are two supported procedures you can use for this configuration. Choose the procedure that is suitable for your environment. The two procedures are as follows:

  • Publish the settings to Active Directory Domain Services. To publish the settings to Active Directory Domain Services, specify the settings on the Site Properties: Site Mode tab. For clients to be configured with the settings using this configuration method, the following conditions must all apply:
    • Active Directory Domain Services must be extended with the Configuration Manager 2007 schema extensions.
    • The site must be publishing to Active Directory Domain Services.
    • Clients must be on the intranet.
    • Clients must be from the same Active Directory forest as the site server's forest.
  • Specify the settings using CCMSetup.exe command-line options. You can use CCMSetup options when the client is first installed or when they are supplied as a script to run after installation, which will reinstall the client with the new configuration. If the client is already installed, you can use the software distribution feature to send the CCMSetup commands to the client, or you can use Configuration Manager 2007 task sequences to achieve this. If the settings supplied with CCMSetup conflict with those published to Active Directory Domain Services and clients can access the settings in the Active Directory Domain Services, the settings from Active Directory Domain Services will take precedence and the settings specified with CCMSetup will not be used.

Additionally, you can also specify the settings using your in-house client management tools, which might include incorporating the settings in a standard build image and deploying custom scripts to edit the registry.

To specify the client certificate store by publishing the setting to Active Directory Domain Services:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, ensure that the site mode is configured for Native and enter the alternative certificate store you want to use in the text box for Certificate store name.

  4. Click OK.

To specify the client certificate store by specifying the setting using CCMSetup.exe command-line options:

  • Use CCMSetup.exe with the client.msi parameter ccmcertstore. For more information about CCMSetup options, see About Configuration Manager Client Installation Properties.

See Also

Concepts

Certificate Requirements for Native Mode
Determine If You Need to Specify Client Certificate Settings (Native Mode)


How to Specify the Client Certificate Selection Criteria

Topic last updated—January 2008

When Configuration Manager 2007 is operating in native mode, clients communicate with the site using a client certificate that is managed externally to Configuration Manager 2007. When there is more than one certificate that can be used, it is important that the correct certificate is selected for Configuration Manager 2007 client communication. In this scenario, specify a certificate selection method.

There are two supported procedures you can use for this configuration. Choose the procedure that is suitable for your environment. The two procedures are as follows:

  • Publish the settings to Active Directory Domain Services. To publish the settings to Active Directory Domain Services, specify the setting on the Site Properties: Site Mode tab. For clients to be configured with the settings using this configuration method, the following conditions must all apply:
    • Active Directory Domain Services must be extended with the Configuration Manager 2007 schema extensions.
    • The site must be publishing to Active Directory Domain Services.
    • Clients must be on the intranet.
    • Clients must be from the same Active Directory forest as the site server's forest.
  • Specify the settings using CCMSetup.exe command-line options. You can use CCMSetup options when the client is first installed or when they are supplied as a script to run after installation, which will reinstall the client with the new configuration.
    If the client is already installed, you can use the software distribution feature to send the CCMSetup commands to the client or use Configuration Manager 2007 task sequences to achieve this. If the settings supplied with CCMSetup conflict with those published to Active Directory Domain Services, and clients can access the settings in the Active Directory Domain Services, the settings from Active Directory Domain Services will take precedence and the settings specified with CCMSetup will not be used.

Additionally, you can also specify the settings using your in-house client management tools, which might include incorporating the settings in a standard build image and deploying custom scripts to edit the registry.

To specify the client certificate selection criteria by publishing the settings to Active Directory Domain Services:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, ensure that the site mode is configured for Native and locate the section Client settings published to Active Directory.

  4. For the Certificate criteria, select one of the following options, and if you select an option that uses a string or attribute match, enter it in the text box:

    • Check only certificate purpose
    • Subject or alt name contains:
    • Subject or alt includes attributes:

  5. For the option If multiple certificates match criteria, select one of these options:

    • Select any certificate that matches. Select this option if the client should attempt communication with its site by selecting a certificate at random from the list of possible certificates that meet the certificate selection criteria. However, if the client is running Configuration Manager 2007 SP1, the certificate with the longest validity period is selected.
    • Fail selection and send error message. Select this option if the client should not select a certificate for communication with its site. In this scenario, the client will not attempt to connect to its management point, but it will send an error message to its fallback status point. This is the more secure and more reliable option when more than certificate can be used.

  6. Click OK.

    Note
    For more information about the options in this dialog box, see Site Properties: Site Mode Tab

To specify the client certificate selection criteria by specifying the settings using CCMSetup.exe command-line options:

  • Use CCMSetup.exe with the client.msi parameter CCMCERTSEL. For more information about CCMSetup options, see About Configuration Manager Client Installation Properties.

See Also

Tasks

How to Specify the Client Certificate Store

Concepts

Certificate Requirements for Native Mode
Determine If You Need to Specify Client Certificate Settings (Native Mode)


How to Determine Whether Client Computers Are Ready for Native Mode

Topic last updated—March 2008

For a Configuration Manager 2007 site to function successfully in native mode, you must have all the required certificates installed in a Configuration Manager 2007 site before migrating the site to native mode.

To help you determine if Configuration Manager 2007 client computers have a valid certificate for successful native mode communication before you migrate the site into native mode, run a utility called the Configuration Manager Native Mode Readiness Tool. This utility is installed with Configuration Manager 2007 clients, in the folder %windir%\system32\CCM and should be run with local administrator privileges. To run the utility, run Sccmnativemodereadiness.exe from the CCM folder.

Without any command line arguments, this utility selects the first computer certificate in the default local store on the computer. To see alternative options that you can specify, from a command prompt type: Sccmnativemodereadiness.exe /?

The available options and examples are listed in the following table.

Sccmnativemodereadiness Option Description

/criteria:<criteria>

Specifies the certificate selection criteria if the client has more than one certificate that can be used for native mode communication (a valid certificate that includes client authentication capability).

For more information about whether you need to specify this option, see Determine If You Need to Specify Client Certificate Settings (Native Mode).

The criteria options are as follows:

  • SubjectStr:<subjectstring>. This is a case-insensitive substring match <subjectstring> against the certificate’s subject name.
  • Subject:<subjectstr>. This is a case-sensitive match <subjectstr> against the certificate’s subject name or subject alternative name (SAN).
  • SubjectAttr:<OID>=<OIDstr>. This matches any valid object identifier (OID) to <OIDstr>. The object identifier can be a distinguished name attribute or an OID number.

Examples:

  • sccmnativemodereadiness.exe /criteria:”SubjectStr:contoso.com”
  • Sccmnativemodereadiness.exe /criteria:”Subject:computer1.contoso.com”
  • Sccmnativemodereadiness exe /criteria:”SubjectAttr:2.5.4.11=Workstations”
  • Sccmnativemodereadiness exe /criteria:”SubjectAttr:OU=Workstations”

For the complete list of attributes that can be used for the SubjectAttr option, see the table in Determine If You Need to Specify Client Certificate Settings (Native Mode).

/store:<name>

Specifies an alternate certificate store name if the client certificate to be used for native mode communication is not located in the default certificate store of Personal in the Computer store.

Example: Sccmnativemodereadiness.exe /store:”ConfigMgr”

/selectfirstcert

Specifies that the client should select any valid and matching certificate for native mode communication if multiple valid certificates are found in the certificate store. However, if the client is running Configuration Manager 2007 SP1, the certificate with the longest validity period will be selected. This setting might be required if you are using Network Access Protection with IPsec enforcement.

Example: Sccmnativemodereadiness.exe /selectfirstcert

Although you can run this utility individually for a specific computer before you migrate the site into native mode, ensure that all client computers are ready for native mode by running the utility as a mandatory advertisement to all client computers assigned to the site.

Note
This utility requires the Configuration Manager 2007 client to be installed.

You can then view the results of the utility with the following reports:

  • Clients incapable of native mode
  • Summary information of clients capable of native mode

You should resolve any client certificate issues before migrating the site to native mode. Clients that do not have a valid certificate when the site is migrated to native mode will be unmanaged.

Important
The Configuration Manager Native Mode Readiness Tool validates the client computer certificate only, and does not validate the certificates required by site systems, or by devices. Configuration Manager will verify the site server certificate when the site is installed for native mode, or migrated from mixed mode. However, server certificates for the web sites and for mobile client devices must be checked manually.

To determine whether Configuration Manager 2007 client computers are ready for native mode, follow these procedures to run the Configuration Manager Native Mode Readiness Tool, and then view the resulting reports.

To determine whether client computers are ready for native mode:

  1. In the administrator console, navigate to the Software Distribution node, and create a software distribution package with no source files.

  2. Click the software distribution package you have just created, then right-click Programs and select New.

  3. In the New Program Wizard, specify the command to run the Configuration Manager Native Mode Readiness Tool (for example, %windir%\system32\CCM\Sccmnativemodereadiness.exe).

  4. On the Environment page of the wizard, select the Run mode of Run with administrative rights, and complete the wizard.

  5. Right-click the Advertisements node, select New, and then select Advertisement.

  6. In the New Advertisement Wizard, select the package and the program you have just created, and then select a collection that contains all the client computers assigned to the site.

  7. In the Schedule page of the New Advertisement Wizard, create a mandatory advertisement so that the command runs automatically, and complete the wizard.

  8. When the advertisement has successfully run on clients, in the administrator console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  9. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports with the category Site - Client Information.

  10. Right-click one of the following reports, and then select Run:

    • Clients incapable of native mode
    • Summary information of clients capable of native mode

  11. In the Report Information page, supply any additional information required, and then click Display to view the report. Note any computers that do not have a valid certificate, and the identifying reason.

  12. Close the report.

  13. Resolve the client certificates issues reported and rerun the advertisement and reports until there are no client certificate failures reported.

See Also

Concepts

Certificate Requirements for Native Mode


How to Migrate the Site Mode from Mixed Mode to Native Mode

You should not migrate the site mode from mixed mode to native mode until you are sure the site is correctly provisioned with the following:

  • The required public key infrastructure (PKI) certificates. For more information, see Certificate Requirements for Native Mode.
  • A custom Web site if the default Web sites are being used for anything other than Configuration Manager 2007. For more information, see Configuration Manager Custom Web Site Overview.
  • You have verified that there are no SMS 2003 clients assigned to the site and the site does not contain clients running Microsoft Windows 2000 Professional. For more information, see Configuration Manager Supported Configurations.

Additionally, if the site contains clients that cannot read site settings published in Active Directory Domain Services, you must also have the following in place:

  • An external mechanism such as Group Policy or a script to instruct clients to migrate over to native mode communication.
  • A server locator point for the hierarchy if you are using a network load balanced management point.
  • An external mechanism such as Group Policy or a script to run CCMSetup.exe with command-line options if you need to configure clients with the client settings specified in the Site Properties: Site Mode Tab. These options are the following:
    • Enable CRL checking on clients
    • Allow HTTP communication for roaming and site assignment
    • Certificate store
    • Certificate selection criteria

It is optional, but recommended, that you have a fallback status point installed in the site and that clients are assigned to it. The fallback status point can help you identify clients that cannot communicate with their management point (and so are unmanaged) when the site is operating in native mode. For more information, see About the Fallback Status Point in Configuration Manager.

Caution
The migration process that Configuration Manager 2007 undergoes when you perform this procedure can take some time to complete, and for a sustained period of time, clients might not be able to communicate with the site. Therefore, plan to perform this procedure during a quiet period when it is acceptable that the site will be unavailable because of maintenance downtime.

To migrate the site mode from mixed mode to native mode:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, select Native mode.

  4. In the Site server signing certificate section, click Browse to view the available certificates on the site server's local store in the Available Certificates dialog box. Select the site server signing certificate that contains the site code in the Issued to field and includes Document Signing in the Intended Purpose field. Then click OK to close the Available Certificates dialog box.

  5. If you are unable to browse to the site server's certificate store, you can manually enter the certificate's thumbprint in the Thumbprint text box. Configuration Manager will attempt to match the thumbprint to a certificate, and if this is successful, the certificate friendly name will be displayed in the Thumbprint field. If Configuration Manager is unable to match the thumbprint to a certificate, you will be prompted to choose whether you want to continue.

  6. When you have either selected the certificate or entered the thumbprint, click OK to close the site properties dialog box.

    Note
    For more information about the options in this dialog box, see Site Properties: Site Mode Tab.

See Also

Tasks

How to Configure HTTP Communication for Roaming and Site Assignment
How to Enable or Disable Certificate Revocation Checking (CRL) on Clients
How to Specify the Client Certificate Selection Criteria
How to Specify the Client Certificate Store
How to Verify Native Mode Migration Is Complete

Concepts

Administrator Checklist: Migrating a Site to Native Mode
Administrator Workflow: Migrating a Site to Native Mode
Certificate Requirements for Native Mode
Configuration Manager Custom Web Site Overview
Determine If You Need to Specify Client Certificate Settings (Native Mode)
Determine If You Should Install a Fallback Status Point for Configuration Manager Clients

Other Resources

Configuration Manager Supported Configurations


How to Verify Native Mode Migration Is Complete

Configuration Manager records the following status message IDs when the site has successfully completed migration to native mode:

  • 4629: The management point has successfully reinstalled.
  • 5116: The site server has signed all policies with the site server signing certificate.

Use the following procedure to find status messages to verify that native mode migration for the site is complete.

To verify that native mode migration for the site is complete:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. In the results pane, right-click the query All Status Messages, and then click Show Messages.

  3. In the All Status Messages dialog box, you are prompted for the time period for which you want to check status messages. Enter the time period or date and time, and then click OK.

  4. All status messages are displayed in the SMS Status Message Viewer. Click the Component column, and locate status messages with the components named SMS_MP_CONTROL_MANAGER and SMS_POLICY_PROVIDER.

  5. Identify the following status messages:

    • 4629
    • 5116

  6. For more information about any of the status messages, right-click a status message, and then select Detail.

  7. View the information in the Status Message Details dialog box, and then click OK to close this dialog box, or click Previous or Next to view the details of other status messages.

  8. Click OK to close the Status Message Details dialog box, and close the SMS Status Message Viewer.

See Also

Tasks

How to Determine the Site Mode for a Configuration Manager Client
How to Identify Client Certificate Issues in Native Mode

Concepts

Administrator Checklist: Migrating a Site to Native Mode


How to Identify Client Certificate Issues in Native Mode

When a Configuration Manager 2007 site is configured for native mode, clients that fail to mutually authenticate with site systems will be unmanaged. Possible reasons for the failure include an expired certificate on the client, an invalid certificate, a certificate from an untrusted source, or a missing certificate.

Note
The certificates used in Configuration Manager 2007 native mode are managed externally to Configuration Manager 2007 and are dependent on your public key infrastructure (PKI) deployment. For more information, see Deploying the PKI Certificates Required for Native Mode.

If clients are assigned a fallback status point, they will send it state messages if they experience certificate issues, which are then relayed back to the site. To view these reported certificate issues when the site is configured for native mode, run the following reports that have the report category of Site - Client Information:

  • Issues by incidence detail report for a specific collection
  • Issues by incidence summary report for a specific collection
  • Issues by incidence detail report for a specific site
  • Issues by incidence summary report
Important
If clients are not assigned a fallback status point, these reports will not contain any information.

To view these reports, follow this procedure.

To identify client certificate issues in native mode by running reports:

  1. In the administrator console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports with the category Site - Client Information.

  3. Right-click one of the following reports, and then select Run:

    • Issues by incidence detail report for a specific collection
    • Issues by incidence summary report for a specific collection
    • Issues by incidence detail report for a specific site
    • Issues by incidence summary report

  4. In the Report Information page, supply any additional information required and then click Display to view the report.

  5. Close the report.

See Also

Tasks

How to Determine Whether Client Computers Are Ready for Native Mode
How to Specify the Client Certificate Selection Criteria
How to Specify the Client Certificate Store
How to Assign the Fallback Status Point to Configuration Manager Client Computers

Concepts

Certificate Requirements for Native Mode


How to Revert a Configuration Manager Site to Mixed Mode

When the site mode is changed (either migrated to native mode or reverted to mixed mode) for a Configuration Manager 2007 primary site, all secondary sites are automatically configured with the following information:

  • The site mode the site is operating in (mixed or native)
  • The ports used for client-to-server communication
  • Whether or not the site is using a custom Web site

The new site settings information is published to Active Directory Domain Services to enable clients to be reconfigured for client-to-site server communications. If the site contains clients that cannot read site settings published in Active Directory Domain Services, you must also have an external mechanism such as Group Policy or a script to instruct clients to revert to mixed mode communication.

Caution
The migration process that Configuration Manager 2007 undergoes when you perform this procedure can take some time to complete, and for a sustained period of time, clients might not be able to communicate with the site. Therefore, plan to perform this procedure during a quiet period when it is acceptable that the site will be unavailable because of maintenance downtime.

Use the following procedure if you need to revert a Configuration Manager site from native mode to mixed mode site.

To revert the site mode from native mode to mixed mode:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, select Mixed for the option Site mode.

  4. Configure other mixed mode options as required.

  5. Click OK.

    Note
    For information about the options in this dialog box, see Site Properties: Site Mode Tab.

See Also

Tasks

How to Identify the Site Mode of a Site


How to Configure Custom Web Sites for Configuration Manager Sites

Topic last updated -- November 2007

For Configuration Manager 2007 sites to communicate with clients using a custom port, the Web site used by Configuration Manager 2007 site systems must be configured to accept connections on custom ports. Although it is supported, changing the port used for connecting to the default Web site is not recommended when other applications that depend on Internet Information Services (IIS), such as Microsoft Windows® SharePoint® Services, are also installed on the site system. Changing the port for the default web site in these cases may cause the shared application to fail.

Important
Using Configuration Manager site systems to run additional applications increases the attack surface on those site systems and is not recommended. The best practice for Configuration Manager site systems requiring IIS is to use a server solely dedicated to providing Configuration Manager services.

By creating a custom Web site for Configuration Manager 2007 use and setting it to accept client connections on the port that you specify for client communications, you can allow other applications to continue to function using the default Web site. For information about which Configuration Manager 2007 site systems require IIS, see Configuration Manager Supported Configurations.

When creating a custom Web site, it is important that you define custom ports for the new Web site that are different from those in use on the default Web site. The default Web site and the custom Web site cannot be started at the same time if both are configured to operate on the same TCP/IP ports.

Important
When configuring the custom Web site to use https ports to support native mode site operations, the custom Web site must be configured to use a Web server certificate issued by a trusted certification authority. For more information about certificate requirements for native mode see, Certificate Requirements for Native Mode.

Configuring a custom Web site is a site-wide operation. If you choose to use a custom Web site, it is recommended that you implement custom Web sites at every site in the hierarchy. You should also switch the ports used by clients to communicate with site systems in parallel by configuring the sites to use custom Web sites.

When you enable a custom Web site, the site roles installed on the server computer will automatically be uninstalled and reinstalled. The TCP/IP ports configured in IIS for the custom Web site after the site roles have been reinstalled should be the same as the client communication ports configured for the site. After configuring a custom Web site, you should verify that the ports configured for the custom Web site match those configured for the site.

When you change from using the default Web site to using a custom Web site, Configuration Manager 2007 does not automatically remove the old virtual directories. You should manually remove the virtual directories created under the default Web site. For more information, see Software Distribution Security Best Practices and Privacy Information.

Create and Configure the Custom Web Site in Internet Information Services (IIS)

To create a custom Web site in Internet Information Services (IIS)

  1. Open the Internet Information Services Manager console on the Configuration Manager 2007 site system by clicking Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

  2. Start the Web Site Creation Wizard in the Internet Information Services Manager console by right-clicking Web Sites, clicking New, and clicking Web Site.

  3. Using the Web Site Creation Wizard, create a custom Web site named SMSWEB.

    Important
    SMSWEB is the only allowed custom Web site name for Configuration Manager 2007 custom Web sites.

  4. Configure the custom Web site to use a custom client connection port.

  5. If you are configuring a custom Web site for use in Configuration Manager 2007 sites operating in mixed mode, you must enable the Allow anonymous access to this web site check box.

  6. If you are configuring a custom Web site for use in Configuration Manager 2007 sites operating in native mode, you should disable the Allow anonymous access to this web site check box and also configure the site to use a Web certificate issued by a trusted certification authority to secure client connections to the Web site. For more information about configuring the custom Web site to use a Web certificate, see Deploying the Web Server Certificates to Site System Servers.

Verify Custom Web Site Creation Success

To verify that the custom Web site creation process was successful

  1. Review the smsprov.log file to verify that the site control file for the site was successfully updated.

  2. Review the hman.log file to verify that the site control file changes were successfully processed.

  3. Review the site role setup logs to verify that the site roles were successfully uninstalled and reinstalled with the new settings. For example, if you are configuring a custom Web site for a site server hosting the management point role, review the mpsetup.log.

  4. If the Active Directory schema has been extended for Configuration Manager 2007 and the site is publishing site information, you should also review the sitecomp.log to verify that the site component manager successfully updated the site information published to Active Directory Domain Services.

  5. Review the custom Web site in the Internet Information Services Manager console. Verify that the custom Web site is running and the virtual directories for site roles installed on the server computer have been created.

See Also

Tasks

How to Configure a Configuration Manager Site to Use a Custom Web Site

Concepts

Configuration Manager Custom Web Site Overview


How to Configure a Configuration Manager Site to Use a Custom Web Site

Configuring a custom Web site is a site-wide operation. If you choose to use a custom Web site, it is recommended that you implement custom Web sites at every primary and secondary site in the hierarchy. You should also switch the ports used by clients to communicate with the site systems in parallel with configuring the site to use a custom Web site.

Important
Before enabling the use of a custom Web site for client communication in the Configuration Manager console, you must manually create a custom Web site named SMSWEB on all site systems that require Microsoft Internet Information Services (IIS) in the site. For information about which site systems require IIS, see Configuration Manager Supported Configurations.

To configure a Configuration Manager site to use a custom Web site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name>.

  2. Right-click <site server> - <site name> and click Properties.

  3. On the Ports tab, select the Use custom web site check box.

See Also

Tasks

How to Configure Custom Web Sites for Configuration Manager Sites

Concepts

Configuration Manager Custom Web Site Overview


How to Configure an SPN for SQL Server Site Database Servers

Topic last updated – January 2008

Running the SQL Server service using the local system account of the SQL Server computer is not a SQL Server best practice. For the most secure operation of SQL Server site database servers, a low rights domain user account should be configured to run the SQL Server service.

A Service Principal Name (SPN) must be registered for the SQL Server service account (when the local system account will not be used) to allow clients to identify and authenticate the service using Kerberos authentication. The SetSPN utility can be used to register an SPN for the site database server SQL Server service account. The SetSPN utility must be run on a computer that resides in the SQL Server's domain and it must be run using Domain Administrator credentials. To properly configure an SPN for the SQL Server service account using the SetSPN utility, follow the steps in these procedures.

Note
To use the SetSPN utility, or to open an ADSIEdit MMC console, you must first install the Microsoft Windows Server support tools. These tools are included in the support tools folder on both Windows 2000 Server and Windows Server 2003 CDs. To install the Windows Server support tools, navigate to \SUPPORT\TOOLS\ on the server's installation CD and run suptools.msi.

To manually create a domain user Service Principle Name (SPN) for the SQL Server service account

  1. Click Start, click Run and then enter cmd in the Run dialog box.

  2. From the command line, navigate to Windows Server support tools installation directory. By default, these tools are located in the C:\Program Files\Support Tools directory.

  3. Enter a valid command to create the SPN. The command should be in the form of: setspn –A MSSQLSvc/<SQL Server computer name>:1433 <Domain\Account>.

    Note
    The command to register an SPN for a SQL Server named instance is the same as that used when registering an SPN for a default instance except that the port number should match the port used by the named instance.

  4. Verify that the command completed successfully by reviewing the command’s output for the updated object line.

To verify the domain user SPN is registered correctly using the ADSIEdit MMC console

  1. Click Start, click Run, and enter adsiedit.msc to launch the ADSIEdit MMC console.

  2. If necessary, connect to the site server's domain.

  3. In the console pane, expand the site server's domain, expand DC=<server distinguished name>, expand CN=Users, and right-click CN=<Service Account User>. On the context menu, click Properties.

  4. In the CN=<Service Account User> Properties dialog box, review the servicePrincipalName value to ensure that a valid SPN has been created and associated with the correct SQL Server.

To change the SQL Server service account from local system to a domain user account

  1. Create or select a domain or local system user account that will be used as the SQL Server service account.

  2. Open SQL Server Configuration Manager.

  3. Click SQL Server 2005 Services and then double click SQL Server <INSTANCE NAME>.

  4. On the Log on tab, select This account and enter the user name and password for the domain user account created in step 1 or click Browse to find the user account in Active Directory and then click Apply.

  5. Click Yes on the Confirm Account Change dialog box to confirm the service account change and restart the SQL Server Service.

  6. Click OK after the service account has been successfully changed.

See Also

Concepts

Configuration Manager Service Principal Name Requirements


How to Configure an SPN for NLB Management Point Site Systems

Topic last updated -- August 2007

When management point site systems are configured in network load balancing (NLB) clusters in mixed mode sites, running the Internet Information Services (IIS) Web site application pool for the site system Web site using the local system account of the site system computer does not allow clients to authenticate the site system using Kerberos authentication. When site systems are configured in an NLB cluster, a domain user account must be configured to run the relevant IIS Web site application pools for the site systems.

Important
Configuring a Service Principal Name (SPN) for management point site systems configured in network load balancing clusters is not required for sites operating in native mode.

To use Kerberos as the authentication protocol, the application pool identity on the IIS application pool for the site system must be configured to use a domain user account and an SPN registered in Active Directory Domain Services for the account. The SetSPN utility can be used to register an SPN for the domain user account configured to run the IIS application pool for NLB site systems. The SetSPN utility must be run on a computer that resides in the site server's domain and it must be run using Domain Administrator credentials. To properly configure an SPN for site systems configured for network load balancing using the SetSPN utility, follow the steps in these procedures.

Note
To use the SetSPN utility, or to open an ADSIEdit MMC console, you must first install the Microsoft Windows Server support tools. These tools are included in the support tools folder on both Windows 2000 Server and Windows Server 2003 CDs. To install the Windows Server support tools, navigate to \SUPPORT\TOOLS\ on the server's installation CD and run suptools.msi.

To manually create a domain user Service Principle Name (SPN) for the IIS application pool service account

  1. Click Start, click Run and then enter cmd in the Run dialog box.

  2. From the command line, navigate to Windows Server support tools installation directory. By default, these tools are located in the C:\Program Files\Support Tools directory.

  3. Enter a valid command to create the SPN. The command should be in the form of: Setspn –A HTTP/<NLB cluster name> <domain\username>

  4. Verify that the command completed successfully by reviewing the command’s output for the updated object line.

To verify that the SPN is registered correctly using the ADSIEdit MMC console

  1. Create or select a domain user account that will be used as the IIS service account.

  2. Click Start, click Run, and enter adsiedit.msc to launch the ADSIEdit MMC console.

  3. If necessary, connect to the site server's domain.

  4. In the console pane, expand the site server's domain, expand DC=<server distinguished name>, expand CN=Users, and right-click CN=<Service Account User>. On the context menu, click Properties.

  5. In the CN=<Service Account User> Properties dialog box, review the servicePrincipalName value to ensure that a valid SPN has been created and associated with the correct NLB cluster name.

To configure Kerberos authentication for management points configured in a load balancing cluster

  1. Add the domain user account that will be configured as the IIS application pool service account for the site system to the local administrator group on each site system configured as part of the NLB cluster.

  2. Add the domain user account that will be configured as the IIS application pool service account for the site system to the local IIS_WPG group on each site system configured as part of the NLB cluster.

  3. Open Internet Information Services from the Administrative Tools Start menu programs group.

  4. Expand Application Pools in IIS Manager.

  5. Right click CCM Windows Auth Server Framework Pool and click Properties.

  6. Click the Identity tab.

  7. In the Application pool identity option group, ensure that Configurable is selected and click Browse to select the domain user account created to act as the IIS service account. Enter the password for the account in the Password textbox.

  8. Click OK. Re-enter the IIS service account password in the Confirm Password dialog and click OK.

See Also

Concepts

Configuration Manager Service Principal Name Requirements


How to Configure Network Load Balancing for Configuration Manager Site Systems

Topic Last Updated—August 2008

Windows Server 2003 network load balancing distributes client requests across a set of servers and supports up to 32 computers running Windows Server 2003 in a single cluster. When network load balancing is installed as a network driver on each of the member servers, or hosts, in a cluster, the cluster presents a virtual Internet Protocol (IP) address or FQDN to client requests. The client requests go to all the hosts in the cluster, but only the host to which a given client request is mapped accepts and handles the request.

Using network load balanced site systems allows for scalability and support of Configuration Manager 2007 clients when supporting more than 25,000 clients at one site. It is supported to configure the management point, software update point, and server locator point site systems in network load balancing configurations. Default management point and the active software update point site roles can be configured to use network load balanced virtual server site systems from within the Configuration Manager console. However, server locator point site systems configured as network load balancing clusters must be defined during client installation using the /SMSSLP=<server locator point NLB cluster name> command line option.

Before beginning these procedures, ensure that the site systems that will be part of the NLB cluster have been properly installed and are functioning correctly. For more information about adding site system roles to Configuration Manager 2007 site systems, see How to Add New Site System Roles.

Note
Each member of the NLB cluster must be configured using a static IP address. Dynamic updates, where the name of the cluster is automatically registered by the host when the host starts, are not supported for site system network interface cards configured as part of the NLB cluster. In order for clients to locate the NLB cluster name using DNS, a host (A) record must be manually created in DNS for the NLB cluster name before beginning this procedure.

Configuring Network Load Balancing for Configuration Manager Site Systems

Only unicast mode is supported when configuring network load balancing for Configuration Manager 2007 site systems. When the site systems that will be part of the NLB cluster have only one network interface card installed, the following procedure should be performed from a domain member server that will not be part of the NLB cluster.

Note
The following procedures can be used to implement network load balancing for Windows Server 2003 Configuration Manager 2007 site systems. For information about implementing network load balancing for Configuration Manager 2007 SP1 Windows Server 2008 site systems, see Implementing a New Network Load Balancing Cluster.

To configure Network Load Balancing for Configuration Manager site system computers using NLB.exe

  1. Click Start, click All Programs, click Administrative Tools, and then click Network Load Balancing Manager.

  2. On the menu bar, click Cluster, and then click New to open the Cluster Parameters dialog box.

  3. On the Cluster Parameters dialog box, enter the network load balancing cluster IP configuration information:

    • IP address: NLB cluster IP address registered in DNS
    • Subnet mask: NLB cluster IP address subnet mask registered in DNS
    • Full Internet name: FQDN of NLB cluster name registered in DNS

  4. Ensure Unicast is selected in Cluster operation mode (default) and click Next.

  5. On the Cluster IP Addresses page, click Next.

  6. On the Port Rules page, click Edit to define the ports that the NLB cluster will respond to, and configure the ports used for client to site system communication defined for the site, or click Next to allow the NLB cluster IP address to respond to all TCP/IP ports.

  7. On the Connect page, enter a site system host name that will be part of the NLB cluster in Host: and click Connect.

  8. In Interfaces available for configuring a new cluster, select the networking interface that will be configured to respond to NLB cluster communication and click Next.

  9. On the Host Parameters page, review the information displayed to ensure that the Dedicated IP configuration settings display the dedicated host IP configuration for the correct NLB cluster host, the Initial host state Default state: is Started, and click Finish.

    Note
    The Host Parameters page also displays the NLB cluster host priority (1-32). As new hosts are added to the NLB cluster, the host priority must be different than previously added hosts. The priority is automatically incremented when using the Network Load Balancing Manager.

  10. Click <NLB cluster name> and ensure that the NLB host interface Status displays Converged before continuing (this step may require refreshing the NLB cluster display as the host TCP/IP configuration is being modified by NLB manager).

  11. To add additional hosts to the NLB cluster, right-click <NLB cluster name>, click Add Host to Cluster, and repeat steps 7 through 10 for each site system that will be part of the NLB cluster.

Additional Requirements for Management Point Site Systems Configured as Part of NLB Clusters

When configuring network load balancing for Configuration Manager 2007 management point site system computers for sites configured to operate in mixed mode, additional steps must be taken to enable Configuration Manager 2007 client approval.

Important
This procedure is unnecessary for sites configured to operate in native mode. In native mode client authentication is accomplished using SSL certificates and configuring an application pool service account SPN in Active Directory Domain Services is not required.

After configuring the NLB cluster in mixed mode sites, an Internet Information Services (IIS) application pool service account must be created in Active Directory Domain Services and a Service Principal Name (SPN) registered for the account. Once the service account has been created, and the SPN registered, the account must be configured to run the CCM Windows Auth Server Framework Pool in Internet Information Services (IIS) Manager on each management point configured as part of the network load balancing cluster.

For more information about registering an SPN for Configuration Manager management point site systems configured in an NLB cluster, see How to Configure an SPN for NLB Management Point Site Systems.

Important
Before beginning this procedure, the IIS application pool service account must be added to the Administrators and IIS_WPG local groups on each management point configured as part of the NLB cluster.

To configure the IIS Application Pool Service Account for Management Point Site Systems Configured in Network Load Balancing Clusters

  1. Click Start, click All Programs, click Administrative Tools, and click Internet Information Services (IIS) Manager to open the Internet Information Services (IIS) Manager console.

  2. Expand <computer name>, expand Application Pools, right-click CCM Windows Auth Server Framework Pool and click Properties.

  3. In the CCM Windows Auth Server Framework Pool Properties, click the Identity tab.

  4. Select Configurable and enter the application pool service account User name: and Password: information and click OK. Confirm the application pool service account password in the Confirm Password dialog box.

See Also

Tasks

How to Configure an SPN for NLB Management Point Site Systems
How to Configure the Default Management Point for a Site
How to Configure the Intranet FQDN of an NLB Management Point
How to Configure HTTP Communication for Roaming and Site Assignment

Concepts

Configuration Manager and Network Load Balancing Clusters
Configuration Manager and Service Location (Site Information and Management Points)


Planning for SQL Server Site Database Replication

For improved scalability Configuration Manager 2007 sites, it is supported to configure the management point or server locator point site systems to access a site database replica. Configuring site systems to use a site database replica allows read activity to be scaled across multiple SQL Server computers and decrease the processing load on the site database server.

Replication administration is typically handled by a Database Engine administrator, who plans and runs daily operations in such areas as system availability, performance monitoring and optimization, deployment, upgrades, troubleshooting, and configuration. Small and medium organizations may have only one administrator; larger organizations may subdivide the administrator role into multiple jobs.

Note
Configuration Manager 2007 sites support transactional replication between the site database server and remote SQL Server site database replica computers. The procedures in this section can be used to configure transactional replication by configuring the site database server as a publisher using a local distributor.

SQL Server Replication Components

Microsoft SQL Server replication uses a publishing industry metaphor to represent the components in a replication topology, which include Publisher, Distributor, Subscribers, publications, articles, and subscriptions. It is helpful to think of Microsoft SQL Server replication in terms of a magazine:

  • A magazine publisher produces one or more publications
  • A publication contains articles
  • The publisher either distributes the magazine directly or uses a distributor
  • Subscribers receive publications to which they have subscribed
Publisher

The Publisher is a database instance that makes data available to other locations through replication. The Publisher can have one or more publications, each defining a logically related set of objects and data to replicate.

Distributor

The Distributor is a database instance that acts as a store for replication specific data associated with one or more Publishers. Each Publisher is associated with a single database (known as a distribution database) at the Distributor. The distribution database stores replication status data, metadata about the publication, and, in some cases, acts as a queue for data moving from the Publisher to the Subscribers. In many cases, a single database server instance acts as both the Publisher and the Distributor. This is known as a local Distributor. When the Publisher and the Distributor are configured on separate database server instances, the Distributor is known as a remote Distributor.

Subscribers

A Subscriber is a database instance that receives replicated data. A Subscriber can receive data from multiple Publishers and publications. Depending on the type of replication chosen, the Subscriber can also pass data changes back to the Publisher or republish the data to other Subscribers.

Article

An article identifies a database object that is included in a publication. A publication can contain different types of articles, including tables, views, stored procedures, and other objects. When tables are published as articles, filters can be used to restrict the columns and rows of the data sent to Subscribers.

Publication

A publication is a collection of one or more articles from one database. The grouping of multiple articles into a publication makes it easier to specify a logically related set of database objects and data that are replicated as a unit.

Subscription

A subscription is a request for a copy of a publication to be delivered to a Subscriber. The subscription defines what publication will be received, where, and when.

Transactional Replication Overview

Transactional replication typically starts with a snapshot of the publication database objects and data. As soon as the initial snapshot is taken, subsequent data changes and schema modifications made at the Publisher are usually delivered to the Subscriber as they occur (in near real time), but you can configure a schedule to control the network bandwidth used during site database replication. When configuring a replication schedule for site database replication, you should plan for the latency between the time changes are made at the Publisher and arrive at the Subscriber.

While transactional replication does offer options that allow updates at the Subscriber to replicated database information, by default, Subscribers to transactional publications should be treated as read-only, because changes are not propagated back to the Publisher.

Additional Disk Space Requirements for Transactional Replication

Transaction Log Disk Space

For each database that will be published using transactional replication, ensure that the transaction log has enough space allocated. The transaction log of a published database might require more space than the log of an identical unpublished database, because the log records are not truncated until they have been moved to the distribution database.

If the distribution database is unavailable, or if the Log Reader Agent is not running, the transaction log of a publication database continues to grow. The log cannot be truncated past the oldest published transaction that has not been delivered to the distribution database. A SQL Server recommendation is to set the transaction log file to auto grow so that the log can accommodate these circumstances.

Another SQL Server recommendation is to set the sync with backup option on the distribution database to delay the truncation of the log on the publication database until the corresponding transactions in the distribution database have been backed up. This can result in a larger transaction log in the publication database.

Distribution Database Disk Space

Ensure that you have enough disk space to store replicated transactions in the distribution database. If you do not make a snapshot file available to Subscribers immediately (which is the default) transactions are stored until they have been replicated to all Subscribers or until the retention period has been reached, whichever is shorter.

If you create a transactional publication and make the snapshot files available to Subscribers immediately: transactions are stored until they have been replicated to all Subscribers or until the Snapshot Agent runs and creates a new snapshot, whichever is longer. If the elapsed time between Snapshot Agent runs is greater than the maximum distribution retention period for the publication, which has a default of 72 hours, transactions older than the retention period are removed from the distribution database.

Although making the snapshot available to Subscribers immediately improves the speed with which new Subscribers have access to the publication, the option can result in increased disk storage for the distribution database. It also means that a new snapshot is generated each time the Snapshot Agent runs. If the option is not used, a new snapshot is generated only if there is a new subscription.

See Also

Other Resources

How to Configure SQL Server Site Database Replication


How to Perform Required Pre-Replication Setup Tasks

Before beginning the SQL Server site database replication process, ensure that you perform the required pre-replication setup tasks.

Some tasks are required on both the publisher computer (site database server) and the subscriber computer (SQL Server that will host the site database replica). Other tasks are specific to the publisher or subscriber SQL Server computer.

For both the publisher and subscriber SQL Server computers you must run the SQL Server 2005 Surface Area Configuration Wizard to configure required services and connections and CLR integration.

Additionally, on the publisher SQL Server computer, you should configure the maximum text character replication size to enable long character text replication. A shared network path should also be created to store the site database information publication information that will be accessed by subscriber SQL Server computers before configuring replication.

On the subscriber SQL Server computer, an empty SQL Server database must be created to store the site database replica information retrieved from the site database publication stored in the shared network path created on the publisher computer during publication of the site database information.

Configure SQL Server Settings

SQL Server 2005 includes the SQL Server Surface Area Configuration Tool, which provides an intuitive graphical user interface (GUI) for configuring the server. The tool opens with a brief explanation of its purpose, and a link to documentation. It includes a link to configure services and protocols and another to configure other features.

Before beginning the SQL Server site database replication process, the SQL Server 2005 Surface Area Configuration wizard should be run on all SQL Servers involved in the site database replication process to configure the necessary network communication protocols and SQL Server settings.

To configure SQL Server settings using the SQL Server 2005 Surface Area Configuration wizard

  1. Click Start \ All Programs \ Microsoft SQL Server 2005 \ Configuration Tools \ SQL Server Surface Area Configuration to start the SQL Server 2005 Surface Area Configuration Wizard.

  2. Select Surface Area Configuration for Services and Connections. On the View by Instance tab, expand Database Engine and click Remote Connections. Ensure Local and remote connections is selected, select Using TCP/IP only and click Apply.

    Note
    TCP/IP is required for network communications to allow Kerberos authentication. Named pipes communication is not required for Configuration Manager 2007 site database operations and should only be used to troubleshoot Kerberos authentication issues.

  3. Select SQL Server Agent and select Automatic from the Startup type list and click Start to start the SQL Server Agent service and click OK.

    Note
    The SQL Server Agent service must be running to schedule site database replication actions.

  4. Select Surface Area Configuration for Features. On the View by Instance tab, expand Database Engine and select CLR Integration. Select Enable CLR integration.

    Note
    This step is required to support the desired configuration management feature. Failing to enable the common language runtime (CLR) integration option will result in clients being unable to download desired configuration baselines that are assigned to them; consequently they will be unable to send their current compliance status.

  5. Close the SQL Server 2005 Surface Area Configuration Wizard.

Configure the Publisher SQL Server Computer to Replicate Long Character Text Data

When using SQL Server replication to send data from your primary site database server to a replicated site database, the length of some data to be replicated may be longer than the SQL Server default maximum length size of 64KB. Specifically, some software update assignment data may be truncated or not replicated at all.

To enable SQL Server replication for replication data to succeed for required Configuration Manager 2007 data, you can run the following SQL command on your publishing SQL Server to set the size of replicated data to the maximum size allowed:

To enable SQL Server to replicate long character text data

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server hosting the site database, expand Databases, right click the site database name and click New Query.

  2. In the query results pane, enter the following command:

    EXEC sp_configure ‘max text repl size’, 2147483647

  3. Click Execute.

  4. In the query results pane, delete the previous command and enter the following command:

    RECONFIGURE WITH OVERRIDE

  5. Click Execute to begin reconfiguration.

  6. Verify that the maximum text replication size has been changed in the Messages pane.

Create a SQL Server Database to Host the Site Database Replica

An empty SQL Server database must be created to host the site database replica. When creating the database to host the site database replica, ensure that the database collation for the site database and new database created to host the site database replica are the same.

To create the SQL Server database to host the site database replica

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server that will host the site database replica, right click Databases and click New Database…

  2. In the New Database dialog, General page, enter a name for the replicated site database in Database name:.

    Note
    There is no required name for the database that will host the site database replica, but a common practice is to name the database similarly to the site database name to be replicated with the additional characters _REP. This allows administrators to more easily identify the replicated database in the future as well as which Configuration Manager 2007 site database this replica represents. For example, a site database replica for a site database named SMS_XYZ would be named SMS_XYZ_REP.

  3. Click OK to close the New Database dialog.

See Also

Tasks

How to Configure the SQL Server Publisher Computer

Other Resources

How to Configure SQL Server Site Database Replication


How to Configure the SQL Server Publisher Computer

Topic Last Updated—August 2008

The publication step allows you to select the data and database objects you want to replicate so that subscribers receive only the data that is needed. Configuration Manager 2007 does not support full site database replication and only specific site database objects should be replicated.

Note
In Configuration Manager 2007 installations, there are 98 objects that must be replicated to support site systems accessing site database replicas (48 tables, 44 stored procedures, 4 views, and 2 user defined functions). In Configuration Manager 2007 SP1 installations, there are 99 objects that must be replicated to support site systems accessing site database replicas (49 tables, 44 stored procedures, 4 views, and 2 user defined functions).

Before starting these procedures, ensure that the pre-replication required tasks have been completed. For more information about pre-replication setup required tasks, see How to Perform Required Pre-Replication Setup Tasks.

The following procedures can be used to configure the SQL Server hosting the site database to publish the site database for replication and act as its own distributor.

To configure the SQL Server hosting the site database to publish the site database for replication

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server hosting the site database, right click Replication and click Configure Distribution to start the Configure Distribution Wizard.

  2. Click Next on Welcome Page (if displayed).

  3. On the Distributor page, select '<Site Server Name>' will act as its own Distributor; SQL Server will create a distribution database and log.

  4. If the SQL Server Agent service is not already started, it must be started on the SQL Server Agent Start page.

    Note
    If the SQL Server service account does not have administrative rights on the SQL Server computer, the SQL Server Agent service must be started manually and configured to start automatically when the SQL Server starts.

  5. On the Snapshot Folder page, enter an empty shared network resource that will be accessed by subscriber SQL Servers to retrieve site database snapshot information stored there.

    Important
    A valid UNC share path must be specified for the snapshot folder. Using a local drive path for the snapshot folder will not support pull subscriptions created on the subscriber SQL Server computer.

  6. On the Distribution Database Name page, specify the database name and database file installation directories of the system database to be created to support site database distribution.

    Note
    The distribution database file installation paths must be local to the SQL Server computer and start with a drive letter and colon (for example, C:).

  7. On the Publishers Page, select the SQL Server hosting the site database to use the distributor database when it becomes a publisher.

  8. On the Wizard Actions page, select Configure distribution.

  9. On the Complete the Wizard page, verify the settings that will be used to configure distribution and click Finish.

  10. After distribution configuration has completed, click Close on the Configuring page.

To configure a new local publication for required SQL Server replica site database information

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server hosting the site database, expand Replication, right click Local Publications and click New Publication to start the New Publication Wizard.

  2. Click Next on the New publication Wizard welcome page.

  3. Select the site database on the Publication Database page.

  4. On the Publication Type page, select Transactional publication.

  5. On the Articles page, select the required site database objects to publish as replication articles. To determine the required site database objects to be published:

    • In the SQL Server Management Studio console, right click the site database name and select New Query.
    • In the SQL Server Management Studio results pane, enter the following query: Select ObjectName from ReplicatedObjects where SiteSystemType = 'MP' and click Execute.
      Note
      The objects required to support server locator point site systems to access SQL Server site database replicas are returned as part of the management point replicated objects query. No further objects need to be configured for replication after this step is completed to support server locator point site systems configured to access the site replica. If you are only configuring SQL Server site database replication to support server locator point access to the SQL Server replica, you can use the following query: Select ObjectName from ReplicatedObjects where SiteSystemType = 'SLP'.

  6. On the Article Issues page, ensure that the listed tables and objects have been selected for replication.

  7. On the Filter Table Rows, do not add any table filters.

  8. On the Snapshot Agent page, select Create a snapshot immediately and keep the snapshot available to initialize subscriptions. Select the Schedule the Snapshot Agent to run at the following times: and accept the default schedule. Alternatively, you can click Change to configure the daily schedule frequency for the snapshot agent to occur according to your replication requirements.

  9. On the Agent Security page, click Security Settings… and configure the accounts used for the Snapshot Agent and Log Reader Agent.

  10. On the Wizard Actions page, verify that Create the publication is selected.

  11. On the Complete the Wizard page, enter a name for the Publication and review the publication settings and click Finish.

  12. On the Creating Publication page, click close after the publication is created.

See Also

Tasks

How to Configure the SQL Server Subscriber Computer

Other Resources

How to Configure SQL Server Site Database Replication


How to Configure the SQL Server Subscriber Computer

The subscription step allows you to subscribe to the site database information needed to support site systems configured to access SQL Server replica of the site database from the published site database information located on the SQL Server computer acting as the publisher.

Before starting this procedure, ensure that the pre-replication required tasks have been completed. For more information about pre-replication setup required tasks, see How to Perform Required Pre-Replication Setup Tasks.

The following procedure can be used to configure the SQL Server that will host the SQL Server site database replica.

Note
These procedures must be performed in the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server that will subscribe to the published SQL Server site database information.

To configure the SQL Server subscriber computer

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server that will host the site database replica, expand Replication, right click Local Subscriptions and click New Subscriptions…

  2. Click Next on the New Subscription Wizard welcome page (if displayed).

  3. On the Publication page, select the SQL Server computer hosting the site database and configured as the publisher. To select SQL Server computer hosting the site database, select <Find SQL Server Publisher> from Publisher: and connect to the remote SQL Server computer. Select the publication created for the site database.

  4. On the Distribution Agent Location page, select Run each agent at its Subscriber (pull subscription).

  5. On the Subscribers page, Select the SQL Server computer that will host the site database replica and select the database created to host the site database replica from the Subscription Database list.

    Note
    If an empty database was not created before this step, you can select <New database…> from the Subscription Database list and create the new database to be used to host the site database replica.

  6. On the Distribution Agent Security page, click … and enter the security account settings used for Connection to Distributor and Connection to Subscriber.

  7. On the Synchronization Schedule page, select <Define schedule…> from the Agent Schedule list and set the Frequency to occur Daily. Configure the Daily frequency to occur every 15 minutes.

    Note
    Depending on the amount of site database table information to be replicated, you may need to adjust the synchronization frequency to be greater than every 15 minutes.

  8. On the Initialize Subscriptions page, select the defaults (initialize immediately) and click Next.

  9. On the Wizard Actions page, accept the default to Create the subscription and click Next.

  10. On the Complete the Wizard page, review the subscription settings and click Finish.

  11. On the Creating Subscription(s) page, click Close after the subscription has completed successfully.

See Also

Tasks

How to Perform Required Post-Replication Setup Tasks

Other Resources

How to Configure SQL Server Site Database Replication


How to Perform Required Post-Replication Setup Tasks

After you successfully complete the SQL Server site database replication process, you must grant the necessary permissions to site systems to access the site database replica data.

Note
It is not recommended to grant site system computers database owner (dbo) rights to the replicated SQL Server site database.

You can use the following procedures to configure remote site systems permissions to access replicated site database information from the SQL Server site database replica:

  • Create required database roles.
  • Grant the necessary security permissions to database roles to access database objects.
  • Create database user accounts for site systems to access the site database replica.
  • Add site system database user accounts to the appropriate database roles.

Create Required Database Roles

During Configuration Manager 2007 primary site setup, SQL Server 2005 database roles are created to secure site database access. When you configure a SQL Server database to host a replica of the site database, you must create these database roles manually.

For more information about SQL Server database roles that are created by setup, see About the Database Roles for Configuration Manager.

To create required database roles on the site database replica

  1. In the SQL Server 2005 SQL Server Management Studio console, navigate to <site database replica name>.

  2. Right-click <site database replica name>, and then click New Query to open a new query editor window.

  3. In the new query editor window, enter the following commands, and then click Execute to create the required database roles on the site database replica:

    Copy Code
    CREATE ROLE [smsdbrole_MP] AUTHORIZATION [dbo]
CREATE ROLE [smsdbrole_DMP] AUTHORIZATION [dbo]
CREATE ROLE [smsdbrole_SLP] AUTHORIZATION [dbo]

Grant the Necessary Security Permissions to Database Roles to Access Database Objects

During Configuration Manager 2007 primary site setup, SQL Server 2005 database roles are granted the necessary security permissions to access site database information. When you configure a SQL Server database to host a replica of the site database, you must grant these security permissions manually.

To configure security permissions for site systems to access site database replica information

  1. In the SQL Server 2005 SQL Server Management Studio console, navigate to <site database replica name>.

  2. Right-click <site database replica name>, and then click New Query to open a new query editor window.

  3. In the new query editor window, enter the following commands, and then click Execute to configure security permissions to database objects for Configuration Manager 2007 database roles:

    Copy Code
    GRANT SELECT ON Sites TO [smsdbrole_SLP]
GRANT SELECT ON SysResList TO [smsdbrole_SLP]
GRANT SELECT ON RoamingBoundaryIPSubnet TO [smsdbrole_SLP]
GRANT SELECT ON RoamingBoundaryIPv6Prefix TO [smsdbrole_SLP]
GRANT SELECT ON RoamingBoundaryIPRange TO [smsdbrole_SLP]
GRANT SELECT ON RoamingBoundaryADSite TO [smsdbrole_SLP]
GRANT EXECUTE ON MP_GetAllInventoryClasses TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetClientIDFromMacAddress TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetClientIDFromSmbiosID TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetInventoryClassProperties TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetSiteInfoFromADSite TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetSiteInfoFromIPAddress TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetSiteInfoFromIPv6Prefix TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetSiteInfoUnified TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetContentDPInfoProtected TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetContentDPInfoUnprotected TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetProtectedSMPSites TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetUnprotectedSMPSites TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetStateMigClientInfo TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetStateMigAssocInfo TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetMigrationInfoForRestoreClient TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetMigrationInfoUsersForRestoreClient TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetSelectiveDownloadMap TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetPeerDPList TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetWSUSServerLocations TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetPendingPackagesForBranchDP TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetPolicyBody TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetPolicyBodyAfterAuthorization TO [smsdbrole_MP]
GRANT EXECUTE ON MP_IsPolicyBodyAuthorized TO [smsdbrole_MP]
GRANT EXECUTE ON MP_IsClientRegistered TO [smsdbrole_MP]
GRANT EXECUTE ON sp_GetPublicKeyForSMSID TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetEncryptionCertificateForSMSID TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetProvisioningModePolicyAssignments TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetMachinePolicyAssignments TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetUserAndUserGroupPolicyAssignments TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetListOfMPsInSite TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetHINVLastUpdateTime TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetLocalSitesFromAssignedSite TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetMPSitesFromAssignedSite TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetMPListForSite TO [smsdbrole_MP]
GRANT EXECUTE ON MP_GetSdmPackageBody TO [smsdbrole_MP]
GRANT EXECUTE ON MP_MatchDrivers TO [smsdbrole_MP]
GRANT EXECUTE ON sp_GetPublicKeySMSUID TO [smsdbrole_MP]
GRANT EXECUTE ON DMP_GetMachinePolicies TO [smsdbrole_DMP]
GRANT EXECUTE ON DMP_GetPackageVersion TO [smsdbrole_DMP]
GRANT EXECUTE ON DMP_GetSettings TO [smsdbrole_DMP]
GRANT EXECUTE ON DMP_GetSoftwareDistBody TO [smsdbrole_DMP]
GRANT EXECUTE ON DMP_GetSoftwareDistIDs TO [smsdbrole_DMP]
GRANT EXECUTE ON DMP_GetHinvTranslations TO [smsdbrole_DMP]
GRANT EXECUTE ON DMP_GetDiscoveryTranslations TO [smsdbrole_DMP]

Create Database User Accounts for Site Systems to Access the Site Database Replica

During Configuration Manager 2007 primary site setup, SQL Server 2005 database roles are granted the necessary security permissions to access site database information. When you configure a SQL Server database to host a replica of the site database, you must grant these security permissions manually.

Note
When using a database connection account for the management point or server locator point site system roles instead of using the computer account of the site system to access the database replica, you must create a database user account for the domain user account that is configured for the site system database connection account instead of the site system computer account.

For more information about the management point database connection account, see About the Management Point Database Connection Account.

For more information about the server locator point database connection account, see About the Server Locator Point Database Connection Account.

To create database user accounts for site systems to access the site database replica

  1. In the SQL Server 2005 SQL Server Management Studio console, navigate to <site database replica name>.

  2. Right-click <site database replica name>, and then click New Query to open a new query editor window.

  3. In the new query editor window, enter the following command, and then click Execute to create database user accounts for site systems that require access to site database replica information.

    Copy Code
    CREATE USER [<DOMAIN\COMPUTERNAME$>] FOR LOGIN [<DOMAIN\COMPUTERNAME$>] WITH DEFAULT_SCHEMA=[dbo]
    Note
    <DOMAIN\COMPUTERNAME> should be replaced by the domain name and computer name of the site server computer account that requires access to the site database replica information.

Add Site System Database User Accounts to the Appropriate Database Roles

During Configuration Manager 2007 primary site setup, and when new site systems are added to a site, the computer account of the site system is automatically added to the appropriate database role if required. When you configure a SQL Server database to host a replica of the site database, you must grant these security permissions manually.

To add site system database user accounts to the appropriate database roles

  1. In the SQL Server 2005 SQL Server Management Studio console, navigate to <site database replica name>.

  2. Right-click <site database replica name>, and then click New Query to open a new query editor window.

  3. In the new query editor window, enter the following command, and then click Execute to add site system database user accounts to the appropriate database role.

    Copy Code
    EXEC sp_addrolemember '<dbrole name>' , '<dbuser name>'
    Note
    Replace <dbrole name> with smsdbrole_MP, smsdbrole_DMP, or smsdbrole_SLP. The <dbuser name> must be the name of the database user name that is created for the site system that hosts the management point, device management point, or server locator point site system role.

See Also

Other Resources

How to Configure SQL Server Site Database Replication


How to Configure Site Systems to Access a SQL Server Site Database Replica

Management point and server locator point site systems can use a SQL Server site database replica to access site information instead of connecting to the site database server itself. You can configure the management point and server locator point site systems to access a SQL Server site database replica from within the Configuration Manager console using the following procedures.

To configure a management point site system computer to access a SQL Server site database server replica

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. In the results pane, right click ConfigMgr management point and click Properties.

  3. Select Use a database replica.

  4. In SQL Server name:, enter the SQL Server database computer hosting the SQL Server site database replica.

  5. In Database name:, enter the name of the replicated site database.

  6. Click OK to save changes and close the ConfigMgr management point properties dialog box.

To configure a server locator point site system computer to access a SQL Server site database server replica

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. In the results pane, right click ConfigMgr server locator point and click Properties.

  3. Select Use a database replica.

  4. In SQL Server name:, enter the SQL Server database computer hosting the SQL Server site database replica.

  5. In Database name:, enter the name of the replicated site database.

  6. Click OK to save changes and close the ConfigMgr server locator point properties dialog box.

See Also

Other Resources

How to Configure SQL Server Site Database Replication


How to Disable SQL Server Database Replication

Microsoft SQL Server replication must be disabled before upgrading a site (with either a new service pack or version). After the site has been successfully upgraded, you can reconfigure SQL Server database replication.

Local subscriptions to the site database replica are not deleted on SQL Server subscriber computers. After disabling SQL Server database replication on the site database server (publisher), you must manually delete local subscriptions on SQL Server subscriber computers.

The following procedures can be used to disable SQL Server database replication for the site database.

Note
These procedures must be performed in the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server hosting the site database.

To disable SQL Server 2005 database replication

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server hosting the site database, navigate to <SQL Server name> \ Replication.

  2. Right-click Replication and click Disable Publishing and Distribution to launch the Disable Publishing and Distribution Wizard.

  3. On the Disable Publishing and Distribution Wizard welcome page, click Next (if displayed).

  4. On the Disable Publishing page, select Yes, disable publishing on this server. Disabling publishing on the server will:

    • Drop all publications on the server.
    • Drop all subscriptions to all publications on the server.
    • Disable the server as a distributor.

  5. On the Confirm Dropping of Publications page, click Next.

  6. On the Wizard Actions page, select Disable publishing and distribution and click Next.

  7. On the Compete the Wizard page, click Finish.

  8. On the Disabling Distribution page, review the progress as SQL Server disables publishing and distribution. Once publishing and distribution has successfully been disabled, click Close to exit the Disable Publishing and Distribution Wizard.

To delete local subscriptions to the replicated site database

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server subscriber computer, navigate to <SQL Server name> \ Replication \ Local Subscriptions \ <site database replica subscription name>.

  2. Right-click <site database replica subscription name> and then click Delete.

  3. Click Yes to confirm subscription deletion when prompted.

See Also

Other Resources

How to Configure SQL Server Site Database Replication


How to Migrate the Site Database to a SQL Server Cluster Instance

It is supported to move the Configuration Manager 2007 site database from a remote SQL server or the primary site server to a remote Microsoft SQL Server cluster. However, once the site database has been moved from the primary site server computer, you cannot move the site database back to the site server computer.

To move the site database to a remote SQL Server cluster instance

  1. If the Microsoft Systems Management Server (SMS) Provider is located on a remote SQL server, the SMS provider must be moved to the local site server or another computer not hosting a SQL Server cluster node before moving the site database.

  2. Stop all Configuration Manager 2007 services on the site server. After all services are stopped, back up the SQL database on the standalone system and restore it to the SQL cluster database server using the Backup Site Server maintenance task and the Configuration Manager 2007 Site Repair Wizard.

  3. Run Configuration Manager 2007 Setup, and select the clustered SQL Server instance to host the site database.


How to Encrypt Client to Management Point Data in Mixed Mode
Note
This procedure applies only to sites operating in mixed mode. Because sites operating in native mode use an existing public key infrastructure (PKI), the data sent between clients and their management point in native mode is automatically signed and encrypted using the Secure Sockets Layer (SSL) protocol.

To encrypt client to management point data in mixed mode

  1. Navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Site Mode tab, select the Encrypt data before sending to Management Point check box.


How to View Configuration Manager Boundaries

Boundaries assigned to the site that the Configuration Manager console is attached to, and all of the boundaries assigned to child sites of the current site, are displayed in the Boundaries node of the Configuration Manager console.

Boundaries displayed in the results pane of the Boundaries node in the Configuration Manager console are not sorted by default. However, boundaries can be sorted by clicking the Boundary column header in the results pane of the Configuration Manager console.

When you manually sort boundaries by clicking the Boundary column header, the displayed boundaries are sorted first by the site the boundary is assigned to and then by the type of boundary:

  • Active Directory boundaries are sorted alphabetically based on the Active Directory site name.
  • IP address range-based boundaries are sorted in ascending order based on the first byte of the starting IP address (first octet of the IP address).
  • IP subnet boundaries are sorted in ascending order based on the first byte of the address (first octet of the IP subnet).
  • IPv6 prefix boundaries are sorted alphabetically based on prefix string values.

To view Configuration Manager boundaries

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Boundaries.

  2. View the boundaries listed in the results pane of the Configuration Manager console.

See Also

Tasks

How to Configure Configuration Manager Boundaries

Concepts

Planning Configuration Manager Boundaries


Configuration Manager Tasks for Configuring Multiple Sites

After deploying multiple sites into a site hierarchy, there are optional configuration tasks that you may need to perform.

In This Section

Configuring Site Communications

Describes how site communications can be configured to optimize communications, reduce network traffic between sites, or change the type of sender used.

How to Copy Site Settings from One Site to Another

Describes the several different ways to make sites have consistent configurations and objects.

How to Change a Site's Parent Site

Describes how to change a site's parent.

See Also

Other Resources

How to Configure Configuration Manager 2007


Configuring Site Communications

During the Configuration Manager 2007 hierarchy deployment phase, the addresses and senders necessary for site-to-site communications within the Configuration Manager 2007 hierarchy are created. After deployment, site communications can be configured to optimize communications, reduce network traffic between sites, or change the type of sender used.

Existing addresses and senders can be viewed and modified from within the Configuration Manager console by navigating to the following locations:

  • For address configuration, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.
  • For sender configuration, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Senders.

Tasks for Configuring Site Addresses

How to View Site Addresses

Describes how to view the addresses configured for a site.

How to View Address Properties

Describes how to view the site address properties.

How to Modify Address Properties

Describes how to modify the site address properties.

How to Set the Site Address Connection Account

Describes how to set the site address connection account for site addresses.

How to Set Address Schedules

Describes how to set address schedules for site addresses.

How to Set Address Data Transfer Rates

Describes how to set address data transfer rates for site addresses.

How to Delete an Address

Describes how to delete a site address.

Tasks for Configuring Site Senders

How to View Site Senders

Describes how to view the senders configured for a site.

How to View Sender Properties

Describes how to view the site sender properties.

How to Modify a Sender

Describes how to modify the site sender properties.

How to Delete a Sender

Describes how to delete a site sender.

See Also

Tasks

How to Create Configuration Manager Site Addresses

Concepts

Configuration Manager Site to Site Communications
How to Install Configuration Manager Senders


How to View Site Addresses
Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To view site addresses

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. The addresses installed at the current site will be displayed in the results pane.


How to View Address Properties
Note
You must have Modify permission for the site security object class or instance to perform this procedure.

How to view address properties

  1. Navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, right-click the address you want to modify, and then click Properties.


How to Modify Address Properties
Note
You must have Modify permission for the site security object class or instance to perform this procedure.

How to modify an address

  1. Navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, right-click the address you want to modify, and then click Properties.

  3. Modify the settings in the appropriate sender properties, and then click OK.


How to Set the Site Address Connection Account

Site address connection accounts are used to authenticate the sender communication between sites. By default, the site server's computer account is used to connect to a destination site. Alternatively, you can define a user account, with permissions to the destination site, to be used when connecting to the destination site.

Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To set the site address connection account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, right-click the address that you want to modify the site address connection account for, and then click Properties.

  3. On the General tab of the site address properties, click Set and enter the account information for the site address to use when communicating with the destination site. The user account must be in the form of <domain\user>.

  4. Enter and confirm a password of up to 14 characters for the address connection account, and click OK.


How to Set Address Schedules

By default, all addresses can be used all the time for data of all priority levels. However, you can set schedules for addresses to determine when certain priorities of data are sent.

Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To set the schedule of a sender address

  1. Navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, right-click the sender address that you want to schedule data priorities for, and then click Properties.

  3. In the sender address properties, click the Schedule tab.

  4. Select a time period during which the data can be transferred by dragging the rectangle over the hours you want. The selected time period appears in the box below Scheduled availability for selected time period. (For example, Monday through Friday, 8 A.M. to 5 P.M.).

  5. Specify the priorities of the data that can be sent to this address during the specified time period. To do so, select an option in the Availability list.

  6. Configuration Manager 2007 can use this address as a substitute if another address to this site fails. To prevent this address from being used as a substitute during the selected time period, select Unavailable to substitute for inoperative addresses.

  7. To specify other time periods, repeat steps 4 through 6.


How to Set Address Data Transfer Rates

By default, the data transfer rate that Configuration Manager 2007 sites will use to send data to an address (another site) is unlimited at all times. This means that when a site is transmitting data to another site, it could potentially consume 100% of the available bandwidth during the data transfer. However, you can limit how much connection bandwidth is used at different times of the day by setting maximum data transfer rate for the address. Setting limits on data transfer rates prevents Configuration Manager 2007 from consuming all the available bandwidth of the connection between the current site and the destination site. When you configure a maximum transfer rate for an address, the originating site will calculate the available bandwidth, and then apply the maximum transfer rate during the transmission process.

For example, if the maximum transfer rate for an address is set to 50%, Configuration Manager 2007 will achieve 50% bandwidth utilization by sending a block of data to the destination site, and then pausing for the same amount of time it took to send the data, before sending another block of data. Repeating this process for each block of data sent to the address will effectively provide 50% bandwidth utilization during the transfer.

Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To set maximum data transfer rates for an address

  1. Navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, right-click the sender address that you want to limit the transfer rate for, and then click Properties.

  3. In the sender address properties, click the Rate Limits tab.

  4. Click Limited to specified maximum transfer rates by hour.

  5. Select a time period during which the data transfer rate limits will be in effect by dragging the rectangle over the hours you want. The selected time period appears in Time period (for example, 8 A.M. to 5 P.M.).

  6. To specify the maximum-connection bandwidth to be used when sending data to this address, click a percentage in the Limit (% of connection bandwidth) list.

  7. Multiple time periods can be configured for each sender. To specify settings for other time periods, repeat steps 4 and 5.


How to Delete an Address
Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To view site addresses

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, right-click the address you want to delete, and then click Delete.


How to View Site Senders
Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To view a site's senders

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Senders.

  2. The senders installed at the current site will be displayed in the results pane.


How to View Sender Properties
Note
You must have Modify permission for the site security object class or instance to perform this procedure.

How to view sender properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Senders.

  2. In the results pane, right-click the sender whose properties you want to view, and then click Properties.


How to Modify a Sender

Topic last updated—November 2007

You can edit sender settings if you want to change the maximum number of concurrent sends or the retry settings for the sender. Increasing the maximum number of concurrent sends can increase the throughput of data between sites, but it can also result in higher demand on network bandwidth. Edit the retry settings to specify the number of times the sender retries a sending if the first attempt fails, and to specify how long it waits between retries.

Note
You must have Modify permissions for the site security object class or instance to perform this procedure.

To modify a sender

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Senders.

  2. In the results pane, right-click the sender you want to modify, click Properties, and then click the Advanced tab.

    Important
    When configuring the total number of concurrent sending threads to be used when communicating with other sites, the total number of sending threads should be configured as a greater number than the threads configured for the per site setting. If the total number of sending threads is equal to the number configured to be used per site, and a receiving site is unavailable, it could cause all sending threads to become used when attempting to communicate with the unavailable site and prevent site-to-site communication to other sites.

  3. Modify settings as needed in the Sender Properties dialog box, and then click OK.


How to Delete a Sender

You can delete senders if site operation no longer requires them. Before you delete a sender, ensure that you do not need to use that type of connection again. If you need to use that type of connection again and you have deleted the sender, you will have to reinstall it.

Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To delete a sender

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Senders.

  2. In the results pane, right-click the sender you want to delete, and then click Delete.


How to Copy Site Settings from One Site to Another

If you have sites in a Microsoft System Center Configuration Manager 2007 hierarchy, the child sites automatically receive copies of packages and collections from the parent site, but the child site does not automatically receive the same site settings as the parent site. There are several different ways to make sites have consistent configurations and objects.

  • If you want to transfer site settings under the site management node, use the Transfer Site Settings Wizard or command-line tool.
    Note
    The Transfer Site Settings Wizard and command-line tool can transfer only settings that would be common on all sites and do not require local context. For example, you can transfer whether heartbeat discovery is enabled but you cannot transfer the list of subnets to search for network discovery because it is not likely to be relevant at any other site.

    Also, you can transfer settings for a category only if that category is enabled. For example, you can transfer the hardware inventory schedule only if hardware inventory is enabled at the destination site.

  • If you want to transfer the properties for a package, use the Transfer Site Settings Wizard or command-line tool. However, the wizard and command-line tool transfer only properties of a package such as refresh schedule and sending priorities, but do not transfer the actual packages.
  • If you want to transfer the properties for a collection, use the Transfer Site Settings Wizard or command-line tool. However, the wizard and command-line tool transfer only the refresh schedule of a collection, not the actual collection. If you want to transfer a collection, use the Export Object Wizard and Import Object Wizard.
  • If you want to transfer reports and queries, use the Export Object Wizard and Import Object Wizard. The Transfer Site Settings Wizard does not support transferring settings for reports or queries.
  • The Transfer Site Settings wizard does not transfer account information, but you can use the Manage Site Accounts tool (MSAC.exe) to set accounts in a site and its child sites. For more information, see How to Manage Accounts from the Command-Line.

For more information about the Export Object Wizard and Import Object Wizard, see How to Use the Export and Import Object Wizards.

You can use the Transfer Site Settings Wizard to transfer settings between the following types of sites:

  • Between Configuration Manager 2007 sites, including primary and secondary sites
  • From Configuration Manager 2007 sites to Systems Management Server 2003 secondary sites
Note
Settings that do not apply to secondary sites will not be transferred. For example, client agent configuration settings cannot be transferred to secondary sites because secondary sites cannot have clients assigned. Any settings that do not apply to the destination site will be discarded but reported in the wizard summary.

You cannot transfer settings from a Configuration Manager 2007 primary site to an SMS 2003 primary site using the wizard, but you can install the Systems Management Server 2003 Administration Feature Pack and use that to transfer settings between SMS 2003 sites. You cannot transfer settings from an SMS 2003 site to a Configuration Manager 2007 site.

The Transfer Site Settings Wizard has options for transferring settings. If you have network connectivity and you have permissions on both sites, you can transfer settings in realtime between two sites. If the sites are not connected, for example one site is on a lab network and one site is on the production network, or if you do not have permissions, for example if the two sites are in forests with no trust relationship, you can export the settings from one site into an XML file and then import them on the destination site. The wizard also allows you to export the settings while you are transferring them in real-time.

Important
On the Export or Transfer Settings page, you have the option Include the current values for each setting. If you do not have connectivity or permissions to the source site, you must select this option because Configuration Manager 2007 will not be able to transfer the settings in real-time.

To transfer site settings using the wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and then click Transfer Site Settings.

    Note
    You can also start the wizard by right-clicking the Collections or Packages nodes.

  3. On the Gather Settings page, click Export Settings and Site settings and then click Next.

  4. On the Select Source Site page, select the source site that contains the settings you want and then click Next.

    Note
    If both sites are in the same hierarchy and you have permissions, you can run the wizard on either the source or the destination site server. The Connected Site box tells you the site from which you are running the wizard.

  5. On the Select Site Settings page, select the settings you want to transfer and then click Next.

    Note
    Not all settings can be transferred. For example, client agent settings cannot be transferred to a secondary site because secondary sites cannot have assigned clients to receive the settings and network discovery is not available as an option. For more information, see Transfer Site Settings Parameters.

  6. On the Destination Site Selection page, select the site to receive the settings and then click Next.

    Note
    If you cannot connect to the destination site, click Next. You will see a message telling you that you can only export settings. Click OK to continue to the Export or Transfer settings page.

  7. On the Export or Transfer settings page, select Transfer settings now or Export settings for later use. If you want to export, specify a path and XML file name. Click Next.

  8. On the Summary page, verify the settings and then click Next.

  9. On the Completing Transfer Site Settings Wizard, click Close.

To transfer package and collection properties using the wizard

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and then click Transfer Site Settings.

  3. On the Gather Settings page, click Export Settings and Package and collection properties and then click Next.

  4. On the Select Package and Collection Source page, select a collection, a package, or both, and then click Next.

  5. On the Select Package and Collection Properties page, select the properties for the objects you selected in the previous step. If you selected only one object, the other properties are disabled. Click Next.

  6. On the Destination Collection and Package Page, select the destination package and collection and then click Next.

  7. On the Export or Transfer settings page, select Transfer settings now or Export settings for later use. If you want to export, specify a path and XML file name. Click Next.

  8. On the Summary page, verify the settings and then click Next.

  9. On the Completing Transfer Site Settings Wizard, click Close.

To import an xml settings file

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name> and then click Transfer Site Settings.

  3. On the Gather Settings page, select Import settings and enter the path and filename of an .xml file you have previously exported using this wizard. If you import an .xml file from a site that you cannot connect to from your current site, you are asked to verify that you want to continue. Click OK to proceed or click Cancel to enter a different .xml file. Click Next.

  4. On the Select Source Site page, or the Select Package and Collection source page, select the source site or collection or package that contains the settings you want and then click Next.

  5. On the Select Site Settings page, or the Select Collection and Package properties, select the settings you want to transfer and then click Next.

  6. On the Destination Site Selection page, or the Destination Collection and Package page, select the destination to receive the settings and then click Next.

  7. On the Export or Transfer settings page, select Transfer settings now. Even though you are importing, you can also select Export settings for later use. If you want to export, specify a path and XML file name. Click Next.

  8. On the Summary page, verify the settings and then click Next.

  9. On the Completing Transfer Site Settings Wizard, click Close.

To transfer site settings using the command line

  • From a command prompt, run <ConfigMgrInstallDir>\AdminUI\Bin\Replstcfg.exe For more information, see Transfer Site Settings Command-Line Parameters.

Security

You must have Modify rights to the site to be able to run this tool.

See Also

Tasks

How to Use the Export and Import Object Wizards

Concepts

Transfer Site Settings Command-Line Parameters
Configuration Manager Tasks for Configuring Multiple Sites

Other Resources

Transfer Site Settings Wizard


Settings to Export or Transfer

Topic last updated -- August 2007

The Microsoft System Center Configuration Manager 2007 Transfer Site Settings Wizard transfers the following site settings. If a setting is marked as "not available" it means the setting appears in the properties but does not appear in the Transfer Site Settings Wizard and cannot be transferred. If a setting is marked as "not used", it appears in the Transfer Site Settings Wizard but does not correspond to a setting in the properties; selecting these settings has no effect whatsoever.

Client Agents

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
Advertised Programs Client Agent | -- | -- | -- | --
 | Notification opens Add or Remove programs (corresponds to New program notification icon opens Add or Remove Programs) | Yes | No | No
 | Allow user target advertisement requests | Not available | Not available | Not available
 | Show notifications in the notification area (this does not correspond to a setting in the Advertised Programs Client Agent) | Not used | Not used | Not used
 | New advertised program notification (display message) | Yes | No | No
 | New advertised program notification (Play a sound) | Yes | No | No
 | When Scheduled Program about to run (Provide countdown) | Yes | No | No
 | When Scheduled Program about to run (Countdown length) | Yes | No | No
 | Enable Software distribution to clients | Yes | No | No
Computer Client Agent | -- | -- | -- | --
 | Network Access Account | Not available | Not available | Not available
 | Organization Name | Yes | No | No
 | Software Updates (Sub branding) | Yes | No | No
 | Software distribution (branding) | Yes | No | No
 | Operating system deployments (Sub branding) | Yes | No | No
 | Deadline (greater than 24 hours) | Yes | No | No
 | Deadline (less than 24 hours) | Yes | No | No
 | Deadline (less than 1 hour) | Yes | No | No
 | BITS - settings for clients or branch distribution points (corresponds to the options Apply to branch distribution points only or Apply to branch distribution points and all clients) | Yes | No | No
 | Throttling window start time | Yes | No | No
 | Throttling window end time | Yes | No | No
 | Maximum transfer rate during throttling window | Yes | No | No
 | Allow BITS downloads outside of transfer window | Yes | No | No
 | Maximum transfer rate outside throttling window | Yes | No | No
 | Policy polling interval | Yes | No | No
 | Restart countdown (minutes) | Yes | No | No
 | Restart final notification (minutes) | Yes | No | No
 | State message reporting cycle (minutes) | Yes | No | No
Configuration Management Agent (Desired Configuration Management Client Agent) | -- | -- | -- | --
 | Schedule | Yes | No | No
 | Enable Configuration Management (corresponds to Enable Desired configuration management on computers) | Yes | No | No
Mobile Device Client Agent | -- | -- | -- | --
 | Retry delay | Yes | No | No
 | Poll interval | Yes | No | No
 | Number of retries | Yes | No | No
 | Enabled Software Distribution (to device clients) | Yes | No | No
Mobile Device Client Agent - File collection | -- | -- | -- | --
 | (File collection) Schedule | Yes | No | No
 | Files to be collected | Yes | No | No
 | Enable file collection (on device clients) | Yes | No | No
Mobile Device Client Agent -Hardware Inventory | -- | -- | -- | --
 | (Hardware inventory) Schedule | Yes | No | No
 | Enable Hardware Inventory (on device clients) | Yes | No | No
Mobile Device Client Agent -Software Inventory | -- | -- | -- | --
 | (Software inventory) Schedule | Yes | No | No
 | File Types (Inventoried files) | Yes | No | No
 | Enable software inventory (on device clients) | Yes | No | No
Hardware Inventory Agent (Hardware Inventory Client Agent) | -- | -- | -- | --
 | (Inventory) Schedule | Yes | No | No
 | Maximum MIF size | Yes | No | No
 | MIF Collection (combines Collect IDMIF files and Collect NOIDMIF files) | Yes | No | No
 | Enable Hardware Inventory (on clients) | Yes | No | No
Remote Tools Client Agent | -- | -- | -- | --
 | Visual status indicators (corresponds to Display a visual indicator) | Yes | No | No
 | Remote Assistance User Settings (corresponds to Remote Assistance tab, Manage Remote Assistance Settings) | Yes | No | No
 | Play sound | Yes | No | No
 | Permitted viewers | Yes | No | No
 | Level of remote access (on General tab, transfers both Clients running Windows 2000 and Clients running Windows XP or later) | Yes | No | No
 | Level of Remote Assistance access (corresponds to Remote Assistance tab, Remote Assistance settings, Level of access allowed) | Yes | No | No
 | Enable remote tools (on clients) | Yes | No | No
 | Allow clients to change policy (corresponds to Users cannot change policy or notification settings in the Remote Control Control Panel) | Yes | No | No
 | Access permission (corresponds to Ask for permission when an administrator tries to access clients) | Yes | No | No
 | Manage Remote Desktop Settings | Not available | Not available | Not available
Software Inventory Client Agent | -- | -- | -- | --
 | (Inventory and file collection) Schedule | Yes | No | No
 | Report detail (Reporting detail) | Yes | No | No
 | Files to be collected | Not available | Not available | Not available
 | Files to be Collected, maximum traffic per client | Yes | No | No
 | File Types | Yes | No | No
 | Enable software inventory (on clients) | Yes | No | No
 | Inventory Names | Not available | Not available | Not available
Software Metering Client Agent | -- | -- | -- | --
 | (Data collection) Schedule | Yes | No | No
 | Enable Software Metering (on clients) | Yes | No | No
Software Updates Client Agent | -- | -- | -- | --
 | Hide all deployments from end users | Not available | Not available | Not available
 | Deployment Re-evaluation | Yes | No | No
 | Enable Software Updates (on clients) | Yes | No | No
 | Deadlines (this does not correspond to a setting in the Software Updates Client Agent) | Not used | Not used | Not used
 | Scan Schedule | Yes | No | No
 | Enforce mandated (corresponds to Enforce all mandatory deployments) | Yes | No | No
Network Access Protection Agent | -- | -- | -- | --
 | Schedule (v4 only) | Yes | No | No
 | Enable NAP (v4 only) (corresponds to Enable Network Access Protection on clients) | Yes | No | No
 | Force Scan (v4 only) (corresponds to Force a fresh scan for each evaluation) | Yes | No | No
 | UTC (Coordinated Universal Time) | Yes | No | No

Client Installation Methods

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
Client Push Installation | -- | -- | -- | --
 | General | -- | -- | --
 | System types (Servers, Workstations, Domain controllers) | Yes | No | No
 | Enable client push installation to site systems | Yes | No | No
 | Enable client push installation to assigned resources | Yes | No | No
 | Client push installation accounts | Yes | No | No
 | Installation properties | Yes | No | No
Software Update Point Client Installation | -- | -- | -- | --
 | Enable Software Updates Point Client Installation | Yes | No | No
 | Client Package | Not available | Not available | Not available

Component Configuration

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
Software Distribution | -- | -- | -- | --
 | Stored package location (corresponds to Drive on site server) | Yes | Yes | Yes
 | Package processing thread limit (transfers both Maximum number of packages and Maximum threads per package) | Yes | Yes | Yes
 | Distribution manager retry settings (transfers both Number of retries and Delay before retrying (minutes)) | Yes | Yes | Yes
 | Send package from nearest site in hierarchy | Yes | Yes | Yes
Status Reporting - Server Component | -- | -- | -- | --
 | Server status reporting | Yes | Yes | Yes
 | Server status log | Yes | Yes | Yes
Status Reporting - Client Component | -- | -- | -- | --
 | Client status reporting | Yes | Yes | Yes
 | Client status log | Yes | Yes | Yes
Software Update Point Component | -- | -- | -- | --
 | General | Not available | Not available | Not available
 | Sync Settings | Not available | Not available | Not available
 | Update Classifications | Not available | Not available | Not available
 | Products | Not available | Not available | Not available
 | Sync Schedule | Yes | Yes | No
 | Languages | Not available | Not available | Not available

Discovery Methods

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
Active Directory System Discovery | -- | -- | -- | --
 | Polling schedule | Yes | Yes | Yes
 | Enable Active Directory System Discovery | Yes | Yes | Yes
 | Active Directory Containers | Not available | Not available | Not available
 | Extended AD attributes | Yes | Yes | No
Active Directory Security Group | -- | -- | -- | --
 | Enable Active Directory Security Group discovery | Yes | Yes | No
 | Polling schedule | Yes | Yes | No
Active Directory System Group Discovery | -- | -- | -- | --
 | Enable Active Directory System group discovery | Yes | Yes | No
 | Polling schedule | Yes | Yes | No
Active Directory User Discovery | -- | -- | -- | --
 | Enable Active Directory User discovery | Yes | Yes | Yes
 | Polling schedule | Yes | Yes | Yes
Heartbeat Discovery | -- | -- | -- | --
 | Heartbeat Schedule | Yes | Yes | Yes
 | Enable Heartbeat discovery | Yes | Yes | Yes
Network Discovery (Configuration) | -- | -- | -- | --
 | Enable Network Discovery | Yes | Yes | Yes
 | Types of discovery | Yes | Yes | Yes
 | SNMP devices | Yes | Yes | Yes
 | SNMP community names | Yes | Yes | Yes
 | SNMP Maximum hops | Yes | Yes | Yes
Network Discovery (Component) | -- | -- | -- | --
 | Search local domain | Not available | Not available | Not available
 | Search local subnets | Not available | Not available | Not available
 | Always use the site's DHCP server | Not available | Not available | Not available
 | DHCP servers | Not available | Not available | Not available
 | Schedule | Not available | Not available | Not available

Senders

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
<sender name> | -- | -- | -- | --
 | Retry Settings | Yes | Yes | Yes
 | Maximum concurrent sendings | Yes | Yes | Yes

Site Maintenance

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
Tasks | -- | -- | -- | --
 | Backup ConfigMgr Site Server | -- | -- | --
 | Schedule | Yes | No | No
 | Backup location | Yes | No | No
 | Enable task | Yes | No | No
 | Clear Install Flag | -- | -- | --
 | Schedule | Yes | No | No
 | Client Rediscovery period | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Client Access License Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Collected Files | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Computer Association Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Configuration Management Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Discovery Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Inventory History Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Software Metering Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Software Metering Summary Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Aged Status Messages | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Inactive Client Discovery Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Delete Obsolete Client Discovery Data | -- | -- | --
 | Schedule | Yes | No | No
 | Delete older than | Yes | No | No
 | Enable task | Yes | No | No
 | Monitor Keys | -- | -- | --
 | Schedule | Yes | No | No
 | Enable task | Yes | No | No
 | Rebuild Indexes | -- | -- | --
 | Schedule | Yes | No | No
 | Enable task | Yes | No | No
 | Summarize Software Metering File Usage Data | -- | -- | --
 | Schedule | Yes | No | No
 | Enable task | Yes | No | No
 | Summarize Software Metering Monthly Usage Data | -- | -- | --
 | Schedule | Yes | No | No
 | Enable task | Yes | No | No
 | Summarize Software Metering Weekly Usage Data | -- | -- | --
 | Schedule | Yes | No | No
 | Enable task | Yes | No | No

Site Settings (Site Properties)

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
General | -- | No | No | No
Advanced | -- | -- | -- | --
 | Conflicting records | Not available | Not available | Not available
 | Require secure key exchange (between sites) | Yes | Yes | Yes
 | Publish identity data to Active Directory (corresponds to Publish this site in Active Directory Domain Services) | Yes | Yes | Yes
 | Publish identity data to DNS (corresponds to Publish the default management point in DNS (intranet only)) | Yes | Yes | No
Wake On Lan | -- | -- | -- | --
 | Enable Wake On LAN for this site | Yes | No | No
 | Transmission method | Yes | No | No
 | Transmission retries | Yes | No | No
 | Transmission maximum | Yes | No | No
 | Transmission threads | Yes | No | No
 | Maximum Offset | -- | -- | --
 | Maximum offset (minutes) | Yes | No | No
Ports | Active ports | Not available | Not available | Not available
 | Use custom web site | Not available | Not available | Not available
Site Mode | -- | Not available | Not available | Not available
Security | -- | Not available | Not available | Not available

Status Filter Rules

Item | Setting | Transfers to Configuration Manager primary site | Transfers to Configuration Manager secondary site | Transfer to SMS 2003 secondary site
<rule name> | -- | -- | -- | --
 | Status Filter Properties | Yes | Yes | Yes
Component Status Summarizer | -- | -- | -- | --
 | Threshold period | Yes | Yes | Yes
 | Replicate to parent site with replication priority | Yes | Yes | Yes
 | Enable status summarizer | Yes | Yes | Yes
 | Component Threshold | Yes | Yes | Yes
Site System Status Summarizer | -- | -- | -- | --
 | Specific thresholds | Yes | Yes | Yes
 | Schedule | Yes | Yes | Yes
 | Replicate to parent site with replication priority | Yes | Yes | Yes
 | Enable status summarization | Yes | Yes | Yes
 | Default warning threshold | Yes | Yes | Yes
 | Default critical threshold | Yes | Yes | Yes
Advertisement Status Summarizer | -- | -- | -- | --
 | Replicate to parent site with replication priority | Yes | Yes | Yes
 | Enable status summarizer | Yes | Yes | Yes


Transfer Site Settings Command-Line Parameters

This utility is used to replicate package and collection properties or site configuration settings from an .xml file created in the Transfer Site Settings Wizard. You can use this tool as the command line in a program if you want to use Microsoft System Center Configuration Manager 2007 software distribution to push the settings to other sites.

Note
If you need to transfer settings to a site in an untrusted forest, you must either log on with an account that exists in both forests with the same user name and password, or you must export the settings from the first site and then import, but not transfer, the settings on the destination site.

Syntax

Use the following syntax and parameters to replicate the package and collection settings or the site configuration settings that are saved to the XML file from the Transfer Site Settings Wizard.

Copy Code
REPLSTCFG /DST <servername> /FILE filename
          [/DSTSITE <destinationSiteCode>]
          [/SRC <servername> /SRCSITE <sourceSiteCode>]
          [/V] [/T] [/POLLING]

Command-line Parameters for the Transfer Site Settings Wizard

Command-line Option Description

/DST <servername>

Specifies the name of the site server computer where you want the settings to be received. This parameter is required.

Note
If the site is a secondary site, specify the parent site server.

/DSTSITE <destinationSiteCode>

Specifies the site code where you want the settings to be received. If no destination site codes are specified in the .xml file, you must specify the /DSTSITE parameter.

Note
If SQL Server was installed as case-sensitive, then the site code is case sensitive.

/SRC <servername>

Specifies that the tool will transfer settings in real-time from this site server instead of importing the values in the .xml file. If values exist in the .xml file, they will be ignored. If values were not exported to the .xml file, you must specify the /SRC. The two sites must have a network connection to use this parameter.

Note
If the site is a secondary site, specify the parent site server.

/SRCSITE <sourceSiteCode>

Specifies that the tool will transfer settings in real-time from this source site code instead of importing the values in the .xml file. The two sites must have a network connection to use this parameter.

Note
If SQL Server was installed as case-sensitive, then the site code is case sensitive.

/V

Enables verbose mode for diagnostics.

/T

Simulates the command for testing purposes. No actual settings will be transferred but you will see potential errors.

/POLLING

Verifies that the sites are active before performing the transfer. If there are any sites that are not active, the user will be prompted to retry or discard.

/FILE filename

Specifies the .xml file created in the Transfer Site Settings Wizard containing the settings you wanted to import. If /SRC is specified, it will override values stored in this file.

Note
If the file name contains spaces, you must delimit the file name with quotation marks.

Example: /file "C:\tss pkgs\tss pkg.xml"

/?

Displays the command-line help.

Examples

  • To transfer the settings in the .xml file MySite.xml to site server ServerX, enter the following command-line parameters:

REPLSTCFG /DST ServerX /FILE MySite.xml

  • To transfer the settings but not the values in the .xml file MySite.xml to site server ServerX in site XYZ, while retrieving the values in real-time directly from site server ServerA in site ABC, with verbose mode on, enter the following command-line parameters:

REPLSTCFG /SRC ServerA /SRCSITE ABC /DST ServerX /DSTSITE XYZ /FILE MySite.xml /V

  • To transfer the settings in the .xml file MySite.xml to site server ServerX in site XYZ, while polling to verify that the site is active, enter the following command-line parameters:

REPLSTCFG /DST ServerX /DSTSITE XYZ /POLLING /FILE MySite.xml

  • If you want the tool to display command-line Help, enter the following command-line parameter:

REPLSTCFG /?

See Also

Tasks

How to Copy Site Settings from One Site to Another


How to Change a Site's Parent Site
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

Before changing the site's parent, ensure that an address to the new parent site is specified.

Changing a Primary Site's Parent Site

You can change a primary site's parent site to reconfigure your site hierarchy.

How to change a primary site's parent site

  1. Navigate to the site.

  2. Right-click the site, and then click Properties.

  3. In the Site Properties dialog box, click the General tab, and then click Set Parent Site.

  4. In the Set Parent Site dialog box, ensure that Report to parent site is selected and then specify a parent site.

    Caution
    If the site being added to the hierarchy uses the same site code that was previously used in the hierarchy, and if software distribution objects were modified since detachment, software distribution objects might be overwritten or corrupted. For instance, parent and child sites might have different definitions for the same package IDs. Carefully inspect any duplicates. After inspection, consider deleting packages that are no longer valid.

  5. Click OK to close the Set Parent Site dialog box.

After the child site has been attached, data starts to flow between the child site and the parent site. If the child site already has several clients, normal MIF file processing at the parent site is delayed while the child site data is added to the parent's site database.

Note
You cannot change a secondary site's parent site without uninstalling the secondary site and reinstalling it as assigned to a different primary site.

See Also

Tasks

How to Remove a Secondary Site Using the Configuration Manager Console


How to Configure Configuration Manager Clients

Microsoft System Center Configuration Manager 2007 requires client software to be installed on all managed clients.

  • For information about installing the client software on computers, see Planning and Deploying Clients for Configuration Manager 2007.
  • For information about installing the client software on mobile devices, see Mobile Device Management in Configuration Manager.
  • For information about configuring the client agents necessary for each feature, see the feature documentation in Configuration Manager 2007 Features.

See Also

Other Resources

How to Configure Configuration Manager 2007


How to Configure Configuration Manager Features

Some Microsoft System Center Configuration Manager 2007 features are configured independently of each other while some features depend on each other. Some features, such as software updates, require extensive preparation prior to configuring the options in the Configuration Manager 2007 console, while other features, such as software metering, are ready to use with no additional preparation. Some features also have dependencies on technologies external to Configuration Manager 2007.

For Information About Configuring Features

The following topics discuss how to configure features that require initial preparation prior to use.

Configuring Software Distribution

Configuring Software Updates

Configuring Operating System Deployment

Configuring Reporting

Configuring Desired Configuration Management

Configuring Mobile Device Management

Configuring Network Access Protection

Configuring Discovery in Configuration Manager

Configuring Inventory

Configuring Remote Tools

Configuring Wake On LAN

Configuring the Application Compatibility Toolkit Connector

See Also

Other Resources

How to Configure Configuration Manager 2007


Configuration Manager 2007 Features

Microsoft System Center Configuration Manager 2007 is a collection of features that help you fulfill your business requirements. After you deploy your site and install your clients, Configuration Manager 2007 will not fulfill any business functions unless you enable the features. Some features can be used individually with little or no dependence on other features. For example, after you enable remote control, you can start using the Configuration Manager 2007 console to control Configuration Manager 2007 client computers without additional configuration. On the other hand, if you want to use Network Access Protection, you have to have software updates properly configured, and for software updates to be properly configured, you need to install Windows Server Update Services (WSUS), configure at least one Configuration Manager 2007 distribution point, and enable the hardware inventory client agent.

This section contains information about how to understand, plan, configure, and operate each feature. Dependencies on Configuration Manager 2007 and Windows technology are indicated where required.

Many features also contain information about security and privacy. A compilation of security and privacy information for all features is included in the section "Security and Privacy for Configuration Manager 2007," along with security information that is not feature specific.

In This Section

Using the Configuration Manager Console

Provides information about the Configuration Manager 2007 console.

Collections in Configuration Manager

Provides information about the collections in Configuration Manager 2007.

Software Distribution in Configuration Manager

Provides information about the software distribution feature.

Software Updates in Configuration Manager

Provides information about the software updates feature.

Operating System Deployment in Configuration Manager

Provides information about the operating system deployment feature.

Asset Intelligence in Configuration Manager

Provides information about the Asset Intelligence feature.

Software Metering in Configuration Manager

Provides information about the software metering feature.

Reporting in Configuration Manager

Provides information about the reporting feature.

SQL Reporting Services in Configuration Manager 2007 R2

Provides information about the SQL Reporting Services feature in Configuration Manager 2007 R2.

Desired Configuration Management in Configuration Manager

Provides information about the desired configuration feature.

Queries in Configuration Manager

Provides queries for sets of database objects that you want to find.

Mobile Device Management in Configuration Manager

Provides information about the mobile device management feature.

Network Access Protection in Configuration Manager

Provides information about the Network Access Protection feature.

Discovery in Configuration Manager

Provides information about the discovery feature.

Inventory in Configuration Manager

Provides information about the inventory feature.

Remote Tools in Configuration Manager

Provides information about the remote control feature.

Wake On LAN in Configuration Manager

Provides information about the Wake On LAN feature.

Application Compatibility Toolkit Connector in Configuration Manager

Provides information about collecting data and producing reports about computers and applications on your network that will assist with Windows Vista deployment planning.

Out of Band Management in Configuration Manager 2007 SP1

Provides information about the out of band management feature in Configuration Manager 2007 SP1.

Client Status Reporting in Configuration Manager 2007 R2

Provides information about the client status reporting feature in Configuration Manager 2007 R2.

See Also

Concepts

Configuration Manager Documentation Library


Using the Configuration Manager Console

In Microsoft System Center Configuration Manager 2007, the Configuration Manager 2007 console is the primary interface you use to configure, run, and access Configuration Manager 2007 features and tools. As an administrator, you install and use the Configuration Manager 2007 console to accomplish the day-to-day tasks required to configure your sites, maintain your Configuration Manager 2007 site database, and monitor the status of your Configuration Manager 2007 hierarchy.

This section includes information about the Configuration Manager 2007 user interface and a description of Microsoft Management Console (MMC).

In This Section

Overview of the Configuration Manager Console

Provides an overview of the Configuration Manager 2007 console.

Planning for the Configuration Manager Console

Provides planning information for installing the Configuration Manager 2007 console.

How to Use the Configuration Manager Console

Provides a set of Configuration Manager 2007 console-related tasks.

Configuration Manager Console Security Best Practices and Privacy Information

Provides security and privacy information and best practices for the Configuration Manager 2007 console.

Troubleshooting the Configuration Manager Console

Provides troubleshooting information for the Configuration Manager 2007 console.


Overview of the Configuration Manager Console

The Microsoft System Center Configuration Manager 2007 console is a snap-in for Microsoft Management Console (MMC) version 3.0. A snap-in is an application built to run within MMC. MMC provides you with a console for administrative tools where a variety of network and server administration tasks can occur within a single, integrated interface.

By using MMC, you can create and save customized consoles. You can then make these consoles available to administrators when you want to delegate specific management tasks. For example, you can create a customized console where an administrator can use only software distribution. However, to ensure their access is limited using software distribution, you must also adjust Configuration Manager 2007 security appropriately.

Before you can add the Configuration Manager 2007 console snap-in to MMC, you must run Configuration Manager 2007 Setup.

In This Section

Understanding the Configuration Manager Console Tree

Provides a conceptual overview of the Configuration Manager Console tree.

About Navigating the Configuration Manager Console

Describes how to move through the Configuration Manager Console using the keyboard, mouse clicks, and MMC toolbar buttons.

About Folders and Search Folders

Provides a conceptual overview of how to use standard folders and search folders.

About Latency in the Configuration Manager Console

Discusses the delays you might encounter between the time when information is requested and when it is displayed in the Configuration Manager Console.

See Also

Concepts

About the Accounts Used to Run the Configuration Manager Console

Other Resources

Using the Configuration Manager Console


Understanding the Configuration Manager Console Tree

The console tree contains a hierarchical listing of System Center Configuration Manager 2007 objects. There are three panes by default in the Configuration Manager 2007 console: the console tree on the left, the results pane in the middle, and the Action pane on the right. The results pane displays the contents of an item in the console tree. For example, when you click a specific collection in the console tree, the contents of that collection are displayed in the results pane. The Action pane displays the same options you would see if you right-click an object and look at the shortcut menu.

You navigate the console tree by clicking items, expanding and collapsing branches to expose the items whose functional scope meets your administrative objectives. The following table describes console tree functions.

Use these console tree items | To perform these tasks
System Center Configuration Manager 2007 | Display the root item of the console tree, which represents the primary site server that the console is currently attached to.
Site Database | Select the site database for the site you want to manage. You can customize the console by connecting to multiple site databases.
Site Management | Configure site-wide settings for this site or any child sites in the hierarchy.
Computer Management | Use the Configuration Manager 2007 features to manage Configuration Manager 2007 clients.
System Status | Use the Configuration Manager 2007 status system for maintenance and troubleshooting tasks.
Security Rights | Set security rights for Configuration Manager 2007 security objects such as collections, packages, and advertisements.
Tools | Start and stop Configuration Manager 2007 service and thread component activity.

When you use the Configuration Manager 2007 console, follow this general pattern:

  1. Determine the task that you want to perform. Refer to the appropriate section in Help to assist you with identifying common Configuration Manager 2007 management tasks.
  2. Find the appropriate item in the console tree that makes it possible for you to accomplish the task.
  3. Expand the console tree to expose additional child items until you find the item you need to use. Or, right-click an item to open action menus that will guide you to the appropriate item.
  4. Configure the item's properties.

See Also

Other Resources

Configuration Manager 2007 Features


About Navigating the Configuration Manager Console

When you expand items in the console tree, the icon associated with any tree item changes to an hourglass while Configuration Manager 2007 enumerates the objects contained in that hierarchy. You can explore the console tree by using certain keystrokes, the mouse, or toolbar buttons.

Navigating the Console Tree with Keystrokes

The following table lists keystrokes that you can use to explore the Configuration Manager 2007 console tree.

Keystroke | Result
Right arrow | Expands the parent item to display all child items beneath it if the selected item is a parent to hidden child items.
Left arrow | Collapses all child items if the selected item is a parent to displayed child items. If the child items are already hidden, a left-arrow keystroke moves the cursor to the parent of the selected item.
Up arrow | Moves the cursor up the hierarchical tree toward the root item.
Down arrow | Moves the cursor down the hierarchical tree away from the root item.
TAB key | Moves the focus between the console tree and items in the results pane. You can also use Shift-TAB to move in the opposite direction.
F1 | Obtains Help information related to the selected item.
F3 | If filtering is available, moves the cursor to the Look for search box.
F5 | Refreshes the display. Note that refreshing the display is usually a separate action from retrieving new information from the database.
F6 | Moves the focus between the console tree and the results pane.
Shift+F10 | Displays the Action menu of the selected item.

For more information about keyboard shortcuts, see "MMC Keyboard Shortcuts" in the MMC Help.

Navigating the Console Tree with Mouse Actions

The following table lists mouse actions that you can use to explore the Configuration Manager 2007 console tree.

Action | Result
Click | Selects an item.
Double-click | Shows a display of the child items if child items exist beneath an item. Double-clicking expands or collapses the list of child items, depending on whether they are already displayed or not. If no child items exist, a double-click has the same result as a click.
Right-click | Displays the Shortcut menu of the selected item.

See Also

Tasks

How to Change the Summarization Data on the Home Pages
How to Display the Action and Shortcut Menu

Concepts

About Latency in the Configuration Manager Console


About Folders and Search Folders

In System Center Configuration Manager 2007, you can create standard folders and search folders to organize and manage objects that you have created. By using folders, you categorize and reduce the number of objects displayed at one time. If you have a lot of objects, grouping them in folders can reduce the amount of time it takes the console to display all of them.

You can create standard folders and actually move objects into the folder, or you can create search folders, which are a virtual representation of all objects that meet your search criteria. Search folders are powerful because they update dynamically as new objects are added that meet the criteria.

Important
Moving large numbers of objects can take a significant amount of time. Plan to move objects during off-peak hours.

When you create standard folders and search folders, they replicate down the site hierarchy.

You can create standard folders and search folders in the following console tree items in the Configuration Manager 2007 console:

  • Advertisements
  • Boot images
  • Computer associations
  • Configuration baselines (for desired configuration management)
  • Configuration Items (for desired configuration management)
  • Configuration packages
  • Driver packages
  • Drivers
  • Operating system images
  • Packages
  • Queries
  • Reports
  • Software metering rules
  • Software updates
  • Task sequences
Note
You cannot create folders under the Collections item. Instead, use subcollections to organize collections and then use queries to limit those collections to achieve the same results as search folders.

Folder Replication

Folders created at the parent site will replicate to any child sites. At the child site, the folder will appear locked and the administrator will not be able to modify the folder. There is one exception, however; if the replicated folder is at the central site, it can be moved to a new location by the administrator at a child site, but only one time. If administrator at the child site wants to move the folder a second time, the administrator at the central site must delete it and recreate it.

Search Folder Time

Even though some object properties indicate UTC in the object name, UTC is not used when evaluating the search folders. Search folder time is always evaluated using local time.

Folder Security

There is an object permission called Manage Folders that allows you to create, modify, and delete folders for a class. It also allows you to move folder objects between folders, within the same security class. If a user does not have permissions to manage folders, the user can only view folders and folder objects.


About Latency in the Configuration Manager Console

Due to Microsoft System Center Configuration Manager 2007 architectural design, you might not always see the data you expect to see in the Configuration Manager 2007 console.

Overview of Configuration Manager Data Flow

Configuration Manager 2007 can be very distributed. The site server sends information to site system roles, which can be on remote computers, and the site system roles send data to Configuration Manager 2007 clients. Then, Configuration Manager 2007 clients send data back to site system roles, which send the data back to the site server. The site server communicates with the SMS Provider to put the data into the Configuration Manager 2007 site database. Site servers transfer information to other site servers in the hierarchy using senders. The Configuration Manager 2007 console uses the SMS Provider to transfer information between the console and the database.

On the other hand, all of these roles, including the client, could be installed on a single computer. Even if all roles are installed on one computer, there are still latency issues when transferring information between the different roles.

Impact of Data Flow on Console Latency

Some of this communication happens fairly quickly due to triggers in the site database. Some communication happens at scheduled intervals. Communication can be delayed by external conditions. When you create new objects in the console, the object might not appear right away. If you refresh the screen, the object should appear. However, when you have existing objects you might need to retrieve updated information from the database and then refresh the screen to see changes.

Collections

Query-based collections usually update on a set schedule. If a new computer meets the criteria for the collection, you have to wait for the data to be stored in the database, then wait for the query to update on schedule, but you will not see the new computer in the collection until you refresh the screen. Even if you manually force the update to occur independently of the schedule, you still have to manually refresh the screen to see the changes. There is no confirmation or notification that summarization is complete.

Software Distribution

As soon as you copy a package to a standard distribution point, triggers in the site database cause the Configuration Manager 2007 Distribution Manager service to copy the files right away, however very large packages might take a long time to copy. When you create the advertisement, additional triggers add the advertisement to the client policy. Clients poll for new policy at a configurable interval. Even though a client receives the advertisement, it might not be available to the client because the advertisement start time hasn't arrived yet. If the client is retrieving package content from a branch distribution point and the package has been configured to download on demand, there might be an additional delay while the branch distribution point retrieves the content from a standard distribution point. After the client runs the program, it sends status back to the management point and the management point sends it to the site server, which gives it to the Provider to put in the database.

Feature Home Pages

Features that use home pages to summarize data, for example software distribution, run summarization tasks to have the Provider extract information from the database. The tasks are set to run on a schedule, by default every one hour, and you can configure the schedule from the Action pane on the home page. You can also force summarization to occur, but the results will not be visible until the summarization is complete and you refresh the page.

Network Access Protection

When you configure a policy in Network Access Protection, you have an option to begin evaluating the policy as soon as possible, but the policy evaluation might not be immediate.

Viewing Modified Objects

When you create a new object in the Configuration Manager 2007 console, the object might not display immediately. For example, if you are using a wizard and leave the wizard to create a new object, the new object will not be available until you exit and restart the wizard. Also, if you delete an object, for example a site boundary, you might have to refresh the display several times because the object will not be removed from the Configuration Manager 2007 console until the SMS Provider has actually deleted the object from the database.

If two users are managing the same site using different consoles, changes made from the first console session will not be reflected in the second console session until the second console refreshes the display. For example, if user one changes the security rights for a package object, user 2 will not see the changes to the security rights until he refreshes the display of the security rights for that object.

Managing Large Sets of Objects

If you have several thousand objects in a container, for example, if you have thousands of members in a collection or thousands of packages, Configuration Manager 2007 might take a long time to enumerate all of those objects in the console. For many types of objects, you can use folders and search folders to create smaller sets of objects which will enumerate more quickly. For collections, which do not support folders, you can create subcollections.

Moving large numbers of objects can take a significant amount of time. Plan major object moves for off-peak hours.

Starting the Configuration Manager Console

When you start the Configuration Manager 2007 console, the console might be slow to load because it is attempting to locate and display the last node that was accessed. To decrease the time it takes the console to load, you can start the console with the /sms:NoRestore options, which opens the console to the default view. For more information, see Command Line Options for Running the Configuration Manager Console.

Internet-based Clients Can Take Minutes to Display the Control Panel

When Internet-based clients are attempting to connect from Internet locations, it might take several minutes for the client control panel to display. This is because the client is attempting to connect to Active Directory before displaying the control panel.

Homepages Display Information after Feature is Disabled

If you disable a feature by disabling the client agent, the home page might continue to display data until the available data ages out.

Changes to security rights might not display in the Configuration Manager console

When assigning security rights to users in the Configuration Manager 2007 console, the assigned rights might not display until the console is closed and restarted.

Refreshing All Packages in the Packages Node

If you right-click the Packages node and then click Refresh, the package list is refreshed fairly quickly. However, if you select all of the packages, right-click the list of packages, and then click Refresh, it takes significantly longer.

See Also

Other Resources

Overview of the Configuration Manager Console


About Drag-and-Drop Support in the Configuration Manager Console

Topic last updated—January 2008

Microsoft System Center Configuration Manager 2007 supports dragging objects and dropping them onto other objects. The following objects can be moved to any folder in the same feature area:

  • Software distribution packages
  • Operating system deployment packages
  • Driver packages
  • Device packages
  • Software updates packages
  • Software update deployment packages
  • Boot images
  • Queries
  • Advertisements
  • Reports
  • Software metering rules
  • Folders
  • Search folders
    Note
    You cannot drag objects into search folders because the content of the search folder is determined by the search criteria.

  • Task Sequences
    Note
    You can also drag actions in task sequences to reorder them.

Wizards Initiated by Drag and Drop

The following objects initiate wizards when dragged and dropped.

Object | Destination | Wizard
Software update | Template | Distribute Software Updates Wizard
Software update | Existing deployment | Deploy Software Updates Wizard
Software update lists | Deployment template | Distribute Software Updates Wizard
Software update lists | Existing deployment | Deploy Software Updates Wizard
Driver | Boot image | Add Driver Package Wizard
Program | Collection | New Advertisement Wizard

Desired Configuration Management

The drag-and-drop operation is not available for any objects in desired configuration management, such as configuration baselines.

See Also

Other Resources

Overview of the Configuration Manager Console


Planning for the Configuration Manager Console

Because it is typically impractical for the Microsoft System Center Configuration Manager 2007 administrator to spend all day in the data center where the site server is installed, it is usually more efficient to install remote Configuration Manager 2007 consoles on the Configuration Manager 2007 administrators' workstation computer.

Planning a Remote Configuration Manager Console

If the SMS Provider in a site resides in a different domain from the remote Configuration Manager 2007 console that is attempting to connect to it, you must configure trust relationships or pass-through authentication so that the account in the remote domain has sufficient privileges to perform Configuration Manager 2007 administration.

Planning for Multiple Console Sessions

You can install as many sessions of the Configuration Manager 2007 as you need to support your management operations, though the more console sessions you install, the more resources you are consuming on the site server and the site database server. Each session of the Configuration Manager 2007 console saves its own state, so if a user named Bob last uses Software Updates, the console opens to that section, while a user named Alice reopens to Operating System Deployment if that is what she used last. If Bob deletes an object in his session, Alice won't see that change until she refreshes the console. If she tries to administer the object that Bob deleted, she will get an error message.

Planning to Administer Multiple Sites in a Hierarchy

If you have multiple Configuration Manager 2007 sites in your hierarchy, you can perform almost all the administration for the hierarchy by connecting to the central site. All child primary and secondary sites are displayed under the Site Management node, and you can change the site settings on the Configuration Manager 2007 child sites. If you create packages, collections, and advertisements at the parent site, they flow down to all child sites as read-only objects. If you want to create objects at a primary child site but not at the parent, you can connect the console directly to that site's database. A single MMC console can connect to multiple Configuration Manager 2007 sites simultaneously.

Planning to Support SMS 2003 Sites in the Hierarchy

If you have both Systems Management Server (SMS) 2003 primary sites and Configuration Manager 2007 sites in your organization, you must install an SMS 2003 Administrator console to manage the SMS 2003 sites and a Configuration Manager 2007 console to manage the Configuration Manager 2007 sites. You can install both the SMS 2003 and the Configuration Manager 2007 consoles on the same computer, however there are certain considerations.

  • You cannot install the SMS 2003 console on a computer that already has the Configuration Manager 2007 console installed. You must install the SMS 2003 console first.
  • After both versions of the console are installed on the same computer, you cannot uninstall either version of the console without also uninstalling the other version. You must uninstall both versions at the same time.
  • After both versions of the console are installed, you cannot upgrade the SMS 2003 version of the console as subsequent service packs are released.

If you have an SMS 2003 secondary site that is managed by a Configuration Manager 2007 primary parent site, you can use the parent site to administer everything except the password settings for accounts in the SMS secondary site.

The following table shows which settings can be changed on an SMS 2003 secondary site from the primary Configuration Manager 2007 parent site.

Site Setting | Changeable from Configuration Manager parent site?
Site properties, General tab | No
Site properties, Ports tab | Yes
Site properties, Advanced tab | Yes
Site properties, Security tab | Yes
Addresses | Yes, except for accounts
Boundaries | No, however a user could create new a boundary to override the existing one
Client Agents | Not applicable, because clients cannot be assigned to secondary sites.
Client Installation Methods | Yes, except for accounts
Component Configuration, Management Point | Yes
Component Configuration, Software Distribution | Yes
Component Configuration, Status Reporting | Yes
Component Configuration, Data processing and storage | Yes
Component Configuration, Software Update Point | No
Component Configuration, System Health Validator Point | No
Accounts | No
Discovery Methods | No
Senders | Yes
Site Maintenance, Tasks, Backup ConfigMgr Database | Yes
Site Maintenance, Tasks, all other tasks | No
Site Systems, Management Point | Yes
Site Systems, Distribution Point | Yes
Site Systems, all other site system roles | No
Status Filter Rules | Yes
Status Summary | Yes

If you need to change accounts or passwords on an SMS 2003 secondary site, use the Manage Site Accounts Tool in the Systems Management Server 2003 Administration Feature Pack, which is available on the Microsoft Download Center Web site (http://go.microsoft.com/fwlink/?LinkID=59811). The SMS 2003 Administration Feature Pack Manage Site Accounts Tool must be installed and run on a computer with the SMS 2003 Service Pack 1 (SP1) or SMS 2003 Service Pack 2 (SP2) Administrator console installed.

Note
The SMS 2003 Manage Site Accounts Tool cannot change the Client Push Installation account. There is no supported way to change this account for an SMS 2003 secondary site.

Issues with the Console when Upgrading the Secondary Site

If you install the SMS Administrator console on an SMS 2003 secondary site and then upgrade the secondary site to Configuration Manager 2007, you cannot uninstall the SMS 2003 Administrator console. The SMS Administrator console continues to work and can be upgraded but cannot be removed.

Important
A Configuration Manager console should not be installed on an SMS 2003 secondary site server computer. If the Configuration Manager console has been installed on an SMS 2003 secondary site server computer, the secondary site cannot be upgraded to Configuration Manager 2007.

See Also

Concepts

Configuration Manager Console Security Best Practices and Privacy Information

Other Resources

Using the Configuration Manager Console


How to Use the Configuration Manager Console

In This Section

How to Create a Custom Configuration Manager Console

Provides the procedure to create a custom configuration manager console.

How to Create Favorites in MMC

Provides the procedure to create favorites in the Microsoft Management Console (MMC).

How to Display the Action and Shortcut Menu

Provides the procedure to display or hide the Action pane and the shortcut menu.

How to Export List Views to a File

Provides the procedure to export MMC list views to a file.

How to View or Modify Properties

Provides the procedure to view or modify object properties.

How to Select Items

Provides the procedure to select items.

How to Use the Export and Import Object Wizards

Provides the procedure to export or import objects.

How to View and Configure Secondary Sites

Provides the procedure to view or configure secondary sites.

How to Change Options for Running Reports in the Console

Provides the procedure to change whether reports are launched in the MMC or in a separate window.

How to Change the Summarization Data on the Home Pages

Provides the procedure to change the summarization data interval and to refresh the home page.

How to Manage Folders

Provides the procedures to create, rename, and delete folders.

How to Manage Search Folders

Provides the procedures to create, modify, and delete search folders.

How to Move Folder Objects

Provides the procedure to move standard folders and search folders.

How to Start Windows Event Viewer from Configuration Manager

Provides the procedure to start Windows Event Viewer from Configuration Manager.

How to Start Performance Monitor from the Configuration Manager Console

Provides the procedure to start Performance Monitor from Configuration Manager.

How to Start Windows Diagnostics from the Configuration Manager Console

Provides the procedure to start Windows Diagnostics from Configuration Manager.

How to Opt In or Out of the Customer Experience Improvement Program

Provides the procedure to change your preferences about the Customer Experience Improvement Program (CEIP).

How to Start Service Manager

Provides the procedure to start Service Manager.

See Also

Other Resources

Using the Configuration Manager Console


How to Create a Custom Configuration Manager Console

Using a custom Microsoft System Center Configuration Manager 2007 console is useful for feature-specific Configuration Manager 2007 administrative functions. In this case, you might want to display less information than what is normally displayed in the Configuration Manager 2007 console.

Using MMC, you can create custom consoles by adding snap-ins from various applications. For example, you can customize the Configuration Manager 2007 console to allow access to various tools and then add the new Configuration Manager 2007 console as a snap-in to a custom MMC console. The custom console is saved as an .msc file.

Note
The administrator must have the Configuration Manager 2007 console installed on the computer to use the .msc file.

You can add only one instance of the Configuration Manager 2007 console to MMC, however one snap-in can connect to multiple Configuration Manager 2007 sites by using the Connect to Site Database wizard.

To add a snap-in to the MMC, the console must be in author mode. For more information about creating custom consoles, see the MMC Help.

To add a snap-in to the MMC

  1. Click Start, click Run, type MMC, and then click OK.

  2. On the Console menu, click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, click Add.

  4. In the Add Standalone Snap-in dialog box, select Systems Center Configuration Manager 2007, and then click Add.

  5. In the Database Connection Wizard, select the database that you want to connect to, and then select Load all console tree items (typical) to create a snap-in for all console items. Alternatively, if you want to select a subset of the console items, such as queries and software distribution, click Select console tree items to be loaded (custom).

  6. When you have finished the Database Connection Wizard, click Close. The snap-in appears in the Add/Remove Snap-in dialog box. When you see the snap-in, click OK.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Create Favorites in MMC

If you open the Microsoft Management Console (MMC) in author mode, you can add any item in the tree to a list of Favorites. For more information about authoring custom MMC consoles, see the MMC help.

To add an item to the Favorites list in a snap-in console

  1. In the tree, click the item that you want to add to the Favorites list.

  2. On the Favorites menu, click Add to Favorites.

  3. In Create in, do one of the following:

    • To add an item to an existing folder, click the folder in which you want the item to reside, and then click OK.
    • To add an item to a new folder, click the folder you want as the parent, and then click New Folder. In Folder name, type a name, click OK, and then click OK again.

To organize the Favorites list in a snap-in console

  • On the Favorites menu, click Organize Favorites, and then do any of the following:

    • To add a folder, click Create Folder, type a name in Folder name, and then click OK.
    • To move an item to a folder, click the item under the Favorites folder, click Move to Folder, click the folder where you want the item to appear, and then click OK.
    • To change the name of an item, click the item under the Favorites folder, click Rename, type a new name, and then press ENTER.
    • To remove an item, click the item under the Favorites folder, and then click Delete.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Display the Action and Shortcut Menu

The Microsoft System Center Configuration Manager 2007 Action menu and shortcut menu display choices appropriate to the currently selected console tree item. For example, when you select Site Systems, clicking the Action menu and then pointing to New displays choices appropriate for creating new site systems.

To display the Action and shortcut menu

  • In the Configuration Manager console, on the MMC menu bar, click Action.

Or:

  • Right-click an item.

Or:

  • Use the APPLICATION key on your keyboard to display action menus in dialog boxes.

To show or hide the Action pane

  1. In the Configuration Manager console, on the MMC menu bar, click View and then click Customize.

  2. In the Customize View dialog box, select the Action pane check box and then click OK.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Export List Views to a File

The Microsoft System Center Configuration Manager 2007 data displayed in all standard list views can be exported to a text file. The visible columns in the list view are exported to a text file in the order in which they appear in the results pane.

To export a list view

  • Click any item, and on the Action menu, click Export List.

See Also

Other Resources

How to Use the Configuration Manager Console


How to View or Modify Properties

To change the configuration of a Microsoft System Center Configuration Manager 2007 item, change the item's properties. If an item can be configured, you can display its Properties dialog box in several ways.

Important
The Configuration Manager 2007 does not prevent two administrators from modifying the same object at the same time. If your change does not take effect, verify that it has not been superseded by changes from another session of the Configuration Manager 2007 console.

To view or modify properties

  1. To display the properties, do one of the following:

    • On the MMC toolbar, click the Properties button.
    • On the Action menu, click Properties.
    • Right-click an item. On the shortcut menu that appears, click Properties.
    • Double-click an item.

  2. Fill in the data fields that are displayed on each tab of the dialog box as required to configure the item.

  3. Click OK to select and close the Properties dialog box, or click Apply to save the changes and keep the dialog box open.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Select Items

To select one or more items in a list

  • To select one or more items in a list, use one of the following procedures:

    • To select a single item, click it.
    • To select a range of items, click one end of the range, press the SHIFT key, and then click the other end of the range.
    • To cumulatively select items, hold down the CTRL key while clicking each item.
Note
Not all objects can be multi-selected.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Use the Export and Import Object Wizards

The Microsoft System Center Configuration Manager 2007 Import Object Wizard and Export Object Wizard can be used to import and export individual collections, queries, reports, or classes of objects. You can, for example, share these object definitions between sites.

Using the Export Object Wizard

The Export Object Wizard guides you through the steps necessary to export collections, queries, or reports from the site database into a Managed Object Format (MOF) file. You can use the Export Object Wizard to export individual collections, queries, or reports or classes of objects.

To export a collection, query, or report

  1. In the Configuration Manager console, navigate to and right-click the object or object class that you want to export (Collections, Queries, or Reports) and select Export Objects.

  2. Complete the Export Object Wizard, and then click Finish.

Using the Import Object Wizard

The Import Object Wizard guides you through the steps necessary to import collections, queries, or reports into the site database from a Managed Object Format (MOF) file.

To import a collection, query, or report

  1. In the Configuration Manager console, navigate to and right-click the object class that you want to import (Collections, Queries, or Reports) and select Import Objects.

  2. Complete the Import Object Wizard, and then click Finish.

Security

You must have Create permission to import objects.

You must have Read permission to export objects.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Concepts

Export Object Wizard
Import Object Wizard


How to View and Configure Secondary Sites

A Microsoft System Center Configuration Manager 2007 secondary site passes its data to its parent primary site. You cannot use the Configuration Manager 2007 console to connect directly to secondary sites, although you can use it to manage secondary sites. You must first connect the Configuration Manager 2007 console to a primary site that the secondary site reports to. The secondary site does not have to report directly to the primary site.

To view or configure secondary site settings

  1. In the Configuration Manager console, right-click System Center Configuration Manager 2007 and then click Connect to Site Database.

  2. In the Database Connection Wizard, on the Welcome page, click Next.

  3. On the Locate Site Database page, connect to the site database for the parent site server.

See Also

Concepts

Planning for the Configuration Manager Console
Connect to Site Database Wizard

Other Resources

How to Use the Configuration Manager Console


How to Change Options for Running Reports in the Console

The first time you run a report from the Microsoft System Center Configuration Manager 2007 console, you must configure whether the reports run in the Microsoft Management Console (MMC) or in a new window of Internet Explorer and which reporting point to use when running reports.

If you don't have a reporting point configured, you must configure one to use any reports, including reports from the home page.

The following features in Configuration Manager 2007 have home pages that allow you to view selected reports about the feature:

  • Software distribution
  • Software updates
  • Network Access Protection
  • Operating system deployment
  • Desired configuration management

To configure the default reporting point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager, right-click Site Database, and then click Report Options.

  2. In the Report Options dialog box, click the arrow to select a reporting point and then click OK.

To change the display window for reports

  1. In the Configuration Manager console, navigate to System Center Configuration Manager, right-click Site Database, and then click Report Options.

  2. In the Report Options dialog box, click to clear or select Open reports in a new window check box and then click OK.

See Also

Concepts

Reporting in Configuration Manager

Other Resources

How to Use the Configuration Manager Console


How to Change the Summarization Data on the Home Pages

Several features in Microsoft System Center Configuration Manager 2007 have home pages that allow you to view various types of information, such as the most active advertisements over a specified time period and a summary of the advertisement status on the software distribution home page. To display this type of data, Configuration Manager 2007 must summarize the data available in the site system database. Summarization happens on a configurable schedule. Decreasing the interval makes summarization happen more frequently but increases the load on the site database server. You can also force summarization to occur at any time.

Summarization is different than refreshing the home page. When you refresh the home page, Configuration Manager 2007 takes all the currently summarized data and displays it. The Last Updated date on the home page reflects the last time summarization completed successfully. Some data summarization tasks happen in seconds, but other tasks can take several minutes. Even if you refresh the screen immediately after forcing summarization, you might not see all the updated data you expect to see. There is no confirmation or notification that summarization is complete. If there are multiple console sessions running, one administrator might force a summarization and the administrator at a different session would see the new summarization data the next time the screen is refreshed.

To change the home page summarization schedule

  1. Navigate to any home page. The following features have home pages:

    • Software distribution
    • Software updates
    • Network Access Protection
    • Operating system deployment
    • Desired configuration management

  2. In the Actions menu, click Schedule Home Page Summarization.

  3. In the Custom Schedule dialog box, enter a new schedule in numbers and intervals and then click OK.

To force home page summarization

  1. Navigate to any home page.

  2. In the Actions menu, click Run Home Page Summarization.

To refresh the home page

  1. Navigate to any home page.

  2. In the Actions menu, click Refresh.

See Also

Concepts

About Latency in the Configuration Manager Console

Other Resources

How to Use the Configuration Manager Console


How to Manage Folders

You must have the Manage Folders permission for the security class to create, delete, move, or modify a folder.

You can create standard folders and search folders in the following console tree items in the Microsoft System Center Configuration Manager 2007 console:

  • Advertisements
  • Boot images
  • Computer associations
  • Configuration packages
  • Driver packages
  • Drivers
  • Operating system images
  • Packages
  • Queries
  • Reports
  • Software metering rules
  • Software updates
  • Task sequences

To create a standard folder

  1. Navigate to an applicable Configuration Manager 2007 console tree item.

  2. Right-click the console tree item, click New, and then click Folder.

  3. Complete the settings in the New Folder dialog box, and then click OK.

To rename a standard folder

  1. Navigate to an applicable Configuration Manager 2007 console tree item.

  2. Right-click the console tree item, and then click Rename.

  3. Type a new name for the folder and then press ENTER.

To delete a standard folder

  1. Navigate to the folder you want to delete and right-click the folder.

  2. On the Action menu, click Delete.

  3. In the Confirm Folder Delete dialog box, click Yes.

See Also

Reference

New Folder Dialog Box

Other Resources

How to Use the Configuration Manager Console


How to Manage Search Folders

You must have the Manage Folders permission for the security class to create, delete, move, or modify a search folder.

You can create search folders in the following console tree items in the Microsoft System Center Configuration Manager 2007 console:

  • Advertisements
  • Boot images
  • Computer associations
  • Configuration packages
  • Driver packages
  • Drivers
  • Operating system images
  • Packages
  • Queries
  • Reports
  • Software metering rules
  • Software updates
  • Task sequences
  • Configuration baselines (for desired configuration management)
  • Configuration item (for desired configuration management)

To create a search folder

  1. Navigate to an applicable Configuration Manager 2007 console tree item.

  2. Right-click the console tree item, point to New, and then click Search Folder.

  3. In Step 1: Select object properties to search, select the check box for the object properties.

  4. In Step 2: Edit the property's search criteria (click an underlined value), click the blue underlined value.

    Note
    To remove a property from the list, click to clear the check box in Step 1: Select object properties to search.

  5. In the Search Text dialog box, enter your search criteria and click OK.

  6. In Step 3: Specify search options, either select the Search all folders under this feature check box or leave the check box cleared to search only the current container.

  7. In Step 4: Enter a name for the search folder, enter a name.

  8. Click OK.

To modify a search folder

  1. Navigate to the search folder you want to modify, and right-click the search folder.

  2. On the Action menu, click Modify Search Folder Criteria.

  3. Modify the search folder criteria, and click OK.

To delete a search folder

  1. Navigate to the search folder you want to delete, and right-click the search folder.

  2. On the Action menu, click Delete.

  3. In the Confirm Folder Delete dialog box, click Yes.

See Also

Reference

Search Folder Criteria Dialog Box

Other Resources

How to Use the Configuration Manager Console


How to Move Folder Objects

You must have Microsoft System Center Configuration Manager 2007 Manage Folders rights for the applicable security class to create, delete, move, or modify a folder.

Note
If the folder has replicated from a parent site, the folder is locked and cannot be moved. There is one exception, however; if the replicated folder is at the central site, it can be moved to a new location by the administrator at a child site, but only one time. If administrator at the child site wants to move the folder a second time, the administrator at the central site must delete it and recreate it.

To move a folder

  1. Navigate to a folder that you previously created in the Configuration Manager 2007 console tree.

  2. Right-click the folder, and then click Move Folder Items.

  3. Complete the settings in the Move Folder Items dialog box, and then click OK.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Start Windows Event Viewer from Configuration Manager

You can start Windows Event Viewer from within the Microsoft System Center Configuration Manager 2007 console to view events that have occurred on Configuration Manager 2007 clients.

To start Windows Event Viewer from Configuration Manager

  • In the Configuration Manager 2007 console, right-click the client that you want to view events for, click Start, and then click Windows Event Viewer.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Start Performance Monitor from the Configuration Manager Console

You can start Windows Performance Monitor from within the Microsoft System Center Configuration Manager 2007 console to measure the performance of Configuration Manager 2007 clients. On each client computer, you can view the behavior of objects, such as processors, memory, cache, threads, and processes.

To start Performance Monitor

  • In the Configuration Manager 2007 console, right-click the client that you want to monitor, click Start, and then click Windows Performance Monitor.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Start Windows Diagnostics from the Configuration Manager Console

You can start Microsoft Windows System Information from within the Microsoft System Center Configuration Manager 2007 console to provide diagnostic information about Configuration Manager 2007 clients.

To start Windows Diagnostics

  • In the Configuration Manager 2007 console, right-click the client that you want to view diagnostics for, click Start, and then click Windows Diagnostics.

See Also

Other Resources

How to Use the Configuration Manager Console


How to Opt In or Out of the Customer Experience Improvement Program

When you install Microsoft System Center Configuration Manager 2007 you have the option of participating in the Customer Experience Improvement Program (CEIP). If you opt to participate, Configuration Manager 2007 collects anonymous statistical information about your system's configuration, the performance of some Configuration Manager 2007 components, and error events generated by Configuration Manager 2007. Windows periodically sends a small file to Microsoft with the summary data. Microsoft uses the anonymous data to identify ways to make the product better. You can change your participation status at any time.

Important
Your participation status applies to all Configuration Manager 2007 console sessions for the site. Changing the setting from one console session changes the setting for all console sessions.

To change the CEIP settings for the site

  1. In the Configuration Manager console, right-click on System Center Configuration Manager and then click Customer Experience Improvement Program.

  2. In the Customer Experience Improvement Program dialog box, click to clear or select the Allow Microsoft to collect information about how I use System Center Configuration Manager check box.

  3. Click OK.

See Also

Concepts

Overview of Configuration Manager Privacy

Other Resources

How to Use the Configuration Manager Console


How to Start Service Manager

You can use Configuration Manager Service Manager to control the services that Microsoft System Center Configuration Manager 2007 uses. In Service Manager, you can view the status of any Configuration Manager 2007 services or components that are running on any site system. You can start, stop, pause, resume, or query Configuration Manager 2007 components. You can also use Service Manager to enable or disable logging, configure the log file size, or set the log file path.

To start Service Manager

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Tools / ConfigMgr Service Manager.

  2. Right-click Service Manager and then click Start ConfigMgr Service Manager.

    Note
    Configuration Manager Service Manager does not have F1 Help, but you can find links to more information in the "See Also" section.

See Also

Concepts

Using Configuration Manager Service Manager

Other Resources

How to Use the Configuration Manager Console


How to Prevent the Home Page from Downloading the TechCenter Page on Microsoft.com

Topic last updated—March 2008

When the Microsoft System Center Configuration Manager 2007 console is running on a server with a connection to the Internet, the top node in the console automatically connects to the Microsoft TechNet site to display the System Center Configuration Manager TechCenter. In Configuration Manager 2007 SP1, you can modify the registry to prevent the console from contacting the Internet to display the TechCenter page.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To prevent the System Center Configuration Manager console from downloading the TechCenter home page

  1. In a registry editor, locate the key HKLM\Software\Microsoft\ConfigMgr\AdminUI.

  2. Create a new DWORD value DisableHomePage.

    You do not need to set any data for the DisableHomePage value; if the value exists, the console will not attempt to connect to the TechCenter home page.

See Also

Other Resources

How to Use the Configuration Manager Console


Configuration Manager Console Security Best Practices and Privacy Information

The Microsoft System Center Configuration Manager 2007 console is the interface to the SMS Provider. Protect the Configuration Manager 2007 console computers to help restrict unauthorized access to the site.

Best Practices

Always use an account with least permissions when running the Configuration Manager console If you install the Configuration Manager 2007 console on a remote server or workstation, do not log on to that server or workstation as the Configuration Manager Administrator account. Instead, log on as an ordinary user account, start the Configuration Manager 2007 console using Run As (Windows Server 2003 and Windows XP) or User Access Control (Windows Vista and Windows Server 2008 operating system), and provide the credentials for an account with Configuration Manager 2007 administrative rights.

Do not allow users who are not administrators to use the Configuration Manager console on the site server If Configuration Manager 2007 administrators do not require full administrative rights on the site server computer, do not allow them to run the console on the site server. Instead, install the Configuration Manager 2007 console on secure client computers and assign Configuration Manager 2007 object security rights to restrict user access to the least possible permissions.

Limit Web browsing from the Configuration Manager console The Configuration Manager 2007 can automatically display Web pages in the Microsoft Management Console (MMC) window to show reports and to present the product Start page. Browsing to other sites using the Web pages in the MMC increases the risk that an attacker can gain control of the console computer and possibly the site.

Do not allow low rights Terminal Service users to establish connections with site system roles Allowing low rights users to have direct access to a terminal server session, is excessive privilege.

Protect the XML output from the Transfer Site Settings wizard The Transfer Site Settings wizard allows you to export your site settings to an XML file to either a local folder or a network shared folder. If you save the XML file to a network location, the communication occurs over SMB and is not secured. Use IPsec to help secure the communication channel or save the file locally and transfer it to a network shared location using a secure method.

Do not allow users who are not administrators to access the site server via Remote Desktop or Terminal Services The way permissions are configured on the site server, terminal service users can access files that could allow them excessive privilege. Instead, install the Configuration Manager 2007 console on secure client computers and assign Configuration Manager 2007 object security rights to restrict user access to the least possible permissions.

Privacy Information

When you install Configuration Manager 2007 you have the option of participating in the Customer Experience Improvement Program. If you choose to participate, Configuration Manager 2007 will collect statistical information about your system's configuration, the performance of some Configuration Manager 2007 components, and error events generated by Configuration Manager 2007. Windows periodically sends a small file to Microsoft with the summary data. Microsoft uses the data to identify ways to make the product better.

Your participation status applies to all Configuration Manager 2007 console sessions for the site. You can change your participation status at any time. Changing the setting from one console session changes the setting for all console sessions. For additional, general information about CEIP, see http://go.microsoft.com/fwlink/?LinkId=81182.

See Also

Tasks

How to Opt In or Out of the Customer Experience Improvement Program

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features


Troubleshooting the Configuration Manager Console

Topic last updated—November 2007

Most problems with connecting to the Microsoft System Center Configuration Manager 2007 console involve permissions. Verify that the user account you are using to run the console is a member of the SMS Admins group, either directly or through nested groups. You can use the topics in this section to troubleshoot other related issues with the Configuration Manager 2007 console.

In This Section

Troubleshooting Configuration Manager Console Issues

Provides information to help you troubleshoot issues related to the Configuration Manager console.

How to Enable Verbose Logging for the Console

Describes how to enable verbose logging for the Configuration Manager 2007 console.

How to Verify Namespace and Server Connectivity

Describes how to verify namespace connectivity.

How to Verify WMI Permissions

Describes how to verify WMI permissions.

See Also

Other Resources

Troubleshooting Configuration Manager 2007


Troubleshooting Configuration Manager Console Issues

Topic last updated—November 2007

This section provides links to information about troubleshooting issues with the Microsoft System Center Configuration Manager 2007 console.

Issues with the System Center Configuration Manager console can be traced in the SMSAdminUI.log file. The SMSAdminUI.log file is not stored with the rest of the Configuration Manager 2007 log files; it is located in the <Installation Directory>\AdminUI\AdminUILog directory. By default, only Administrators and SMS Admins have permissions to the file.

User Without Sufficient Rights Cannot See Console Objects

If your account has not been assigned object rights in the Configuration Manager 2007 console, you see only the nodes you have rights to. You must also be a member of the SMS Admins group or have equivalent rights.

Solution

Ask someone with Administrator rights to grant you permissions to the classes and instances that you need to manage. Verify that your account is a member of the SMS Admins group on the site server and the SMS Provider computer. For more information, see How to Assign Rights for Objects to Users and Groups and About the SMS Admins Group.

Attempting to Connect to the Database Generates an Error

If your account does not have Remote Activation permission on the site server and the SMS Provider computer, you get an error message telling you that you cannot connect to the site database.

Solution

Grant Remote Activation permission on the site server and the SMS Provider computer. If you are attempting to manage a secondary site, you must have rights to the SMS Provider at the parent site. See How to Configure DCOM Permissions for Configuration Manager Console Connections.

Upgraded Administrators Do Not Have Access to All Objects

After upgrading, the user who ran the upgrade has access to all the objects in the Configuration Manager 2007 console, but existing administrators have access only to objects that existed prior to the upgrade.

Solution

This is a known issue. Only the user who runs Setup has access to the new objects after an upgrade. Manually grant administrators access to the new objects they will manage.

Note
This is true even for software updates objects. Users who had full rights to all SMS 2003 software updates objects will have full rights to the same objects in Configuration Manager 2007 but will not have any rights to new object types, such as templates.

Error Message: This Function Is Not Supported on This Site System

If you do not have permissions to the files and registry keys needed to run the Configuration Manager 2007 console, you get the error message "This function is not supported on this site system."

Solution

Verify that your account is a member of the SMS Admins group on the SMS Provider computer. You might also see this error if you are not a member of the local Administrators group; however, you can first run MMC and then add the Configuration Manager 2007 console as a snap-in instead of being a local Administrator on the Configuration Manager 2007 console computer. After the new console session is saved, you can also run the new console without being a local Administrator.

Text in Dialog Boxes Is Highlighted with a Blue Background

This is by design, to enable screen readers used for accessibility purposes to read the text in the dialog box.

Solution

None.

Configuration Manager Console Stops Responding When Creating Large Collections and Queries

By default, queries can return a maximum of 2000 entries. If you have a query that returns more than 2000 entries or if you have a collection based on a query that returns more than 2000 entries, the Configuration Manager 2007 console will stop responding.

Solution

Use a registry editor to add a new dword value called ValueLimit under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ConfigMgr\AdminUI\QueryProcessors. Set ValueLimit to a number large enough to return the necessary number of entries.

Configuration Manager Console Stops Responding When Connection Is Lost

When you are running a remote Configuration Manager 2007 console and the console loses connection with the site server, the console might stop responding but not return an error message. If you terminate the process in Windows Task Manager and then try to connect again, the console might continue to be unresponsive.

Solution

After terminating the console process in Windows Task Manager, start the console with the /sms:NoRestore option, which opens the console to the default view. For more information, see Command Line Options for Running the Configuration Manager Console.

See Also

Tasks

How to Verify Namespace and Server Connectivity
How to Verify WMI Permissions

Other Resources

Using the Configuration Manager Console


How to Enable Verbose Logging for the Console

Verbose logging is often useful in Microsoft System Center Configuration Manager 2007 when troubleshooting issues with the Configuration Manager 2007 console.

Important
Before sharing verbose log output with people outside of your organization, verify that no sensitive data is recorded in the log file.

To enable verbose logging for the Configuration Manager console

  1. Navigate to the <InstallationPath>\AdminUI\bin folder.

  2. Using a text editor, open adminui.console.dll.config

  3. Change the line <source name="SmsAdminUISnapIn" switchValue="Error" > to <source name="SmsAdminUISnapIn" switchValue="Verbose" >

  4. Restart the Configuration Manager 2007 console.

  5. Examine the <InstallationPath>\AdminUI\SMSAdminUI.log file for additional information.

  6. After verbose logging is no longer needed, reset the SwitchValue to Error again to remove the processing overhead.

See Also

Other Resources

Troubleshooting the Configuration Manager Console


How to Verify Namespace and Server Connectivity

Topic last updated—November 2007

If you are having problems connecting to the Microsoft System Center Configuration Manager 2007 console, it might be caused by a problem with connectivity to the Windows Management Instrumentation (WMI) namespace. The following procedures connect to the site server to enumerate the WMI namespace used by Configuration Manager 2007.

If you can successfully complete these procedures, you have verified that your problem is not caused by WMI connectivity issues. If you receive an access denied message, you do not have the appropriate security rights to connect to the WMI namespace.

If you have run the Security Configuration Wizard (SCW) (to help reduce the attack surface on your server), the SCW might have disabled the Remote WMI service. You should apply the Configuration Manager 2007 templates for the SCW to verify that all ports and services necessary for Configuration Manager 2007 are enabled. For more information, see http://go.microsoft.com/fwlink/?LinkId=93071.

To verify namespace connectivity

  1. On the computer where the SMS Provider is installed, click Start, click Run, and then type wbemtest.

  2. Click Connect, type \\<siteserver>\root\sms, and then click Login.

  3. Click Enum Classes, click Recursive, and then click OK.

  4. In the Query Result list, double-click SMS_ProviderLocation.

  5. Click Instances, and then double-click the line that contains the target site code. For example, SMS_ProviderLocation.SiteCode="ABC."

  6. In the Properties section, locate the NamespacePath line. You might have to double-click this line to see the whole line.

  7. Copy the NamespacePath value to the clipboard. For example, copy the following value:

    \\Server1\root\sms\site_ABC

To verify server connectivity

  1. Close all WBEMtest windows from the preceding procedure.

  2. Click Connect, paste the NamespacePath that you copied in the preceding procedure, and then click Login.

  3. Click Enum Classes, click Recursive, and then click OK.

  4. In the Query Result list, double-click SMS_Site.

See Also

Other Resources

Troubleshooting the Configuration Manager Console


How to Verify WMI Permissions

Topic last updated—November 2007

Access to the SMS Provider is required for viewing and modifying Microsoft System Center Configuration Manager 2007 security objects and data in the Configuration Manager 2007 console. Usually, access to the SMS Provider is granted by adding users to the SMS Admins group. The SMS Admins group is explicitly granted Enable Account and Remote Enable permissions on the Root\SMS namespace. If those default permissions are modified or if a different group is created to grant access to the SMS namespace, you can verify the permissions using the WMI Control MMC snap-in.

If you have problems connecting because of Windows Management Instrumentation (WMI) permissions, you might see the following entry in the SMSAdminUI.log in <ConfigMgrInstallationPath>\AdminUI\:

Error(ConnectServer): Possible UI connection error code is -2147217405 [0x80041003]

To verify WMI permissions

  1. On the SMS Provider computer, click Start, click Run, type wmimgmt.msc, and then click OK.

  2. Right-click WMI Control, and then click Properties.

  3. On the Security tab, expand Root, and then click SMS.

  4. Click Security in the results pane to see the permissions.

  5. Click Advanced, click SMS Admins, and then click View-edit.

  6. If the SMS Admins group does not have Enable Account and Remote Enable permissions, grant the permissions.

  7. Repeat this procedure for any groups used in addition to SMS Admins.

See Also

Other Resources

Troubleshooting the Configuration Manager Console


Collections in Configuration Manager

Microsoft System Center Configuration Manager 2007, collections provide a way to manage users, computers, and other resources in your organization. They not only give you a means to organize your resources, but they also give you a means to distribute Configuration Manager packages to clients and users.

Click the associated link in the following section for detailed information about creating, using, and changing collections and their associated resources in Configuration Manager 2007.

In This Section

Collections Overview

Provides an overview of the collections, subcollections, and resources within Configuration Manager.

Tasks for Collections

Provides a set of tasks for creating, modifying, and managing collections, subcollections and resources within Configuration Manager.

See Also

Other Resources

Configuration Manager 2007 Features


Collections Overview

Topic last updated—November 2007

The Configuration Manager 2007 collections feature provides a set of tools and resources to help you create, update, and otherwise manage resources in your Configuration Manager 2007 site by combining them into logical collections to use while distributing packages, assigning desired configuration management baselines, installing software updates, or accomplishing other Configuration Manager tasks.

Click any link in the following section for overview information about collections in Configuration Manager 2007.

In This Section

About Collections

Provides information about collections themselves, as well as information about the set of predefined collections and the types of collections you can create.

About Subcollections

Provides information about subcollections and creating links between existing collections.

About Resources

Provides information about the objects that are used as resources for collections.

About Collection Membership

Provides information about the methods you can use to create collections in Configuration Manager 2007.

About Membership Rules

Provides information about the different rules you can use to create collections in Configuration Manager 2007.

How Collections are Replicated to Child Sites

Provides information about the behavior of Configuration Manager 2007 collections in a multi-site hierarchy.

About Maintenance Windows

Provides information about maintenance windows, an important collection-based administrative feature for managing package distribution.

About Collection-Specific Settings

Provides information about Configuration Manager 2007 settings that can be configured for specific collections.

Collections Administrator Workflows

Lists the administrator workflows that are available to help you manage collections in Configuration Manager 2007.

See Also

Other Resources

Collections in Configuration Manager
Tasks for Collections


About Collections

Fundamental to the package distribution process in Configuration Manager is the creation and use of collections.

Within Configuration Manager, collections represent groups of resources and can consist not only of computers, but also of Microsoft Windows users and user groups as well as other discovered resources. For more information about resources, see About Resources.

Depending on the collection, these different types of resources can be treated in vastly different ways. For instance, a discovered computer resource might not be installed as a Configuration Manager client, and therefore it cannot be the recipient of an advertisement, because the Advertised Programs Client Agent is a Configuration Manager client component. At the same time, a resource consisting of a Windows user cannot be installed as a client because there is no equivalent user installation method. However, a discovered user can be the recipient of an advertisement when that user is logged on at a Configuration Manager client.

Collections provide you with the means to organize resources into easily manageable units, enabling you to create an organized structure that logically represents the kinds of tasks that you want to perform. Collections also serve as targets for performing Configuration Manager operations on multiple resources at one time (such as software distribution or software updates).

In the Configuration Manager console, the Collections node contains the collections that are defined for the current site. The results pane displays the resources that are contained in the selected collection.

Collection Membership

Collection membership can be either direct or query based.

Direct membership is a manual membership method, meaning that you specifically define which resources are to be members of the collection. As a result, direct membership collections must updated manually as new resources are added or removed.

Query-based membership is a dynamic method, meaning that you do not define the resources that are to be members of the collections; rather, you define the rules by which those members are placed in the collections. These rules form a query, and Configuration Manager periodically reruns the query to keep the collection up to date.

For more information on collection membership, see About Collection Membership.

Subcollections

Collections can also contain subcollections. This provides you with more flexibility in organizing your resources, allowing you to treat both the collection and subcollection as one unit when needed. Although actions performed on a main collection can also be performed on its subcollections, this does not happen automatically, as subcollections are not considered to be members of the collection that contains them.

For more information on subcollections, see About Subcollections.

Predefined Collections

Collections are used to group resources into more easily manageable units. To make this easier, when you install Configuration Manager 2007, the following 16 default collections are created:

Collection | Description
All Active Directory Security Groups | Displays all security groups discovered through the Active Directory Security Group Discovery method.
All Desktops and Servers | Displays all discovered desktop and server computers.
All Systems | Displays all computers and IP-addressable resources discovered through any discovery method except Active Directory User Discovery.
All User Groups | Displays all Windows user groups discovered through the Active Directory User Discovery method.
All Users | Displays all Windows users discovered through the Active Directory User Discovery method.
All Windows 2000 Professional Systems | Displays all discovered computers running the Windows 2000 Professional operating system.
All Windows 2000 Server Systems | Displays all discovered computer systems running the Windows 2000 Server family operating system.
All Windows Mobile Devices | Displays all discovered Windows mobile devices.
All Windows Mobile Pocket PC 2003 Devices | Displays all discovered Windows mobile devices running the Windows Mobile Pocket PC 2003 operating system.
All Windows Mobile Pocket PC 5.0 Devices | Displays all discovered Windows mobile devices running the Windows Mobile Pocket PC 5.0 operating system.
All Windows Mobile Smartphone 2003 Devices | Displays all discovered Windows mobile devices running the Windows Mobile Smartphone 2003 operating system.
All Windows Mobile Smartphone 5.0 Devices | Displays all discovered Windows mobile devices running the Windows Mobile Smartphone 5.0 operating system.
All Windows Server 2003 Systems | Displays all discovered computers running the Windows Server 2003 family operating system.
All Windows Server Systems | Displays all discovered computer systems running the Windows 2000 family and Windows Server 2003 family operating systems.
All Windows Workstation or Professional Systems | Displays all discovered computers running the Windows 2000 Professional, Windows XP Professional, Windows Vista Business, and Windows Vista Enterprise operating systems.
All Windows XP Systems | Displays all discovered computers running the Windows XP operating system.

You can modify this list or add other collections and subcollections to make it fit your organizational needs. Membership in the predefined collections is query based and updates once a day by default, although you can change that frequency by clicking the Schedule button in the Membership Rules tab in the collection's Properties dialog box.

Note
Default collections can be managed only from the central site; you cannot modify them from child sites.

See Also

Concepts

About Resources
About Subcollections
How Collections are Replicated to Child Sites
About Membership Rules


About Subcollections

You can associate one collection with another by specifying a subcollection. Members of subcollections are not considered to be members of the containing collection. A collection can be a subcollection of multiple collections. This is important because it means that multiple instances of a collection can appear throughout the hierarchy as subcollections of other collections (or subcollections). This also means that you can delete one instance of a collection and still have other instances of that same collection appear elsewhere as subcollections,

Subcollections do not inherit the attributes of the parent collection. Each subcollection has its own identity and membership rules, and the query that creates a collection is completely separate from the query that creates the subcollection. Subcollections function in the same way as nested distribution lists within an e-mail system, and their inclusion in the collection is simply a convenient way of gathering several diverse groups of clients into a single group to be acted on in some way.

Operations Across Collections and Subcollections

Most operations that you can perform on a collection can also be performed on its subcollections. If collection B is a subcollection of collection A, operations performed on collection A can optionally be performed on collection B as well.

For example, if you want to advertise a program to collection A, and collection B is a subcollection of A, you can choose to advertise it (or not) to collection B and its subcollections as well. If you choose not to advertise it to collection A's subcollections, it will be advertised only to the members of the original collection. (If any resources are members of both collection A and collection B, they will receive the advertisement.)

Note
By default, when advertising a program, the New Advertisement Wizard includes subcollections. If this is not desirable, you should clear the Include subcollections check box to avoid advertising the program to unwanted clients.

Creating Subcollections

Two types of subcollections can be created:

  • Dependent subcollections. Dependent subcollections are created as a new collection under an existing collection. When this is done, the subcollection is dependent on the collection under which it was created, as long as you do not link other collections to it. If the subcollection is linked to other collections, the subcollection becomes a linked collection while attached to more than one collection.When you delete a collection, any dependent subcollections of that collection are also deleted. Any advertisements, queries, or collection membership rules that are dependent on the subcollection are impacted by its deletion. Because of this, it is strongly recommended that you use the Delete Collection Wizard to delete any collections that may contain dependent subcollections.
  • Linked subcollections. Linked subcollections are created when one collection is linked with another existing collection. This can be one of the default collection, a collection created for your specific enterprise, or a subcollection of another collection. With linked collections, when you delete a collection, linked subcollections are not deleted if they still exist as either an independent collection or as the subcollection of another collection. This remains the case until all but one of the linking collections has been deleted (and the subcollection does not exist as an independent collection). At that point, the subcollection becomes a dependent subcollection of the remaining collection.

Subcollections can be created for existing subcollections to almost any depth. However, because each layer added contributes to the complexity of the collection, it is recommended that you do not create subcollections with more than 10 tiers in depth.

See Also

Tasks

How to Create a Subcollection

Concepts

About Collections

Other Resources

New Advertisement Wizard


About Resources

Topic last updated—November 2007

Within Microsoft System Center Configuration Manager 2007, a resource is a managed object discovered by one of the available Configuration Manager discovery methods. As such, a resource can take a variety of forms: it can be hardware such as a computer or a router, or it can be a user or a user group.

Configuration Manager 2007 divides resources into the following types, each of which has a number of attributes that can be used to describe the properties of that resource:

  • User Group resources. These consist of discovered user groups, with distinct attributes such as user group name, domain, creation date, and agent site.
  • System resources. These consist of discovered computers and IP-addressable resources, with distinct attributes such as operating system name and version, NetBIOS name, system role, and MAC address.
  • User resources. These consist of discovered users, with distinct attributes such as user name, organizational unit, and domain.

The operations you can perform on a resource vary with the type of resource. For example, if the resource has the Configuration Manager 2007 client agent installed, operations include the following:

  • Viewing hardware
  • Viewing software inventory
  • Starting remote tools
  • Distributing software packages.

If the resource is a user or a router, Configuration Manager 2007 cannot install any software agents, so the operations are more limited. Operations on non-client resources include the following:

  • Viewing the discovery information for that resource
  • Reporting on the resource
  • Grouping the resource into collections

In most cases, resources are more effectively managed and handled using collections. Depending on the resources of your organization and the membership rules governing them, these collections can be as small as a single user resource or can encompass thousands of client computers. A resource is often a member of more than one collection. For example, a client can belong to the "Engineering," "Northern California," and "All Windows XP Systems" collections.

You can define collections of resources to represent any useful groupings for your organization, such as the following:

  • Geographical area
  • IP network
  • Customer-specific departments
  • Areas of administrative responsibility
  • Computers that have a specific processor type

See Also

Concepts

About Collections

Other Resources

How to Manage Resources


About Collection Membership

When creating a collection, membership in that collection can either be direct or query based.

Direct Membership

Direct membership is a manual membership method in which you, as the administrator, specifically select the resources that are to be members of your new collection.

This can be a powerful tool for you, allowing you complete control over the members of the collection. Using the Create Direct Membership Rule Wizard, you can search one or all existing collections (such as the All Systems default collection, containing all discovered computers) for resources that match the requirements you specify. These requirements can be as restrictive as "all computers with the name X" or as open as "all resources that are clients." Configuration Manager then returns a list of those resources. From this list, you can then select the resources that you want to include in the collection.

Because of the level of control that you can use when selecting specific resources for the collection, creating a collection using the direct membership method can be extremely useful. It gives you the ability to specifically choose who to include and who not to include. For example, if you want to create a collection that's restricted to just a few uses in a specific department and absolutely cannot include any others, this method provides the means.

Despite the power of this method, however, the direct membership method has a very significant drawback. Because you specifically define which resources are to be members of the collection, you're also responsible for updating the membership in the collection over time. For example, if computers are added to or removed from the business group encompassed by the collection, you need to add or remove those computers manually. As a result, direct membership collections can be very useful under specific circumstances, but they are usually not effective for widespread use.

Note
Direct membership collections should only be created after your first Active Directory discovery run is complete. Creating a direct membership collection prior to the completion of the Active Directory discovery may result in collections with clients at the child sites in your enterprise that will not properly resolve.

Query-Based Membership

Unlike the direct membership method, query-based membership is a dynamic method for creating your collection. This means that you do not define the resources that are to be members of the collections; rather, you define the rules by which those members are placed in the collections. These rules form a query, and Configuration Manager periodically reruns the query to keep the collection up to date.

For example, suppose your company standard for naming computers is to include a departmental code in the name (say, all computers in the human resources department are named HR-PCx, where x is a value that's incremented each time a new computer name is needed). Creating a collection using the direct membership method would be inefficient unless the department was extremely small, and even then you'd have to return periodically to add or remove computers as needed. However, using the query-based method, you can create a collection called "Human Resources" whose membership rule is based on a query that searches the database for all computers whose names begin with "HR." Configuration Manager would then automatically populate the collection with all appropriate computers and then update the collection membership periodically when the next collection query is executed.

Although you do have less direct control over the membership of the collection with the query-based membership method, usually this dynamic method proves to be the most practical and efficient method for creating collections.

See Also

Concepts

About Collections
Queries in Configuration Manager

Other Resources

Create Direct Membership Rule Wizard
New Collection Wizard
Tasks for Collections


About Membership Rules

Configuration Manager 2007 adds resources to collections by one or more membership rules that are usually defined when the collection is created. Within a given collection, you can specify multiple membership rules.

A membership rule can specify the following information:

  • A specific resource or resources
  • A query that defines the resource parameters to search for

Resources that meet the query criteria that you specify are included in the collection. For example, a rule that states, "All computers running Windows 2000 with at least 128 MB of RAM" or "All users in the corporate domain," might define the membership criteria for your collection, or it might be as specific as, "The computer with the unique name 'Dave's computer.'"

If you define collections with query-based membership rules, Configuration Manager updates the list of resources that is included in a collection by using the latest information in the Configuration Manager site database when the collection membership is evaluated and updated This updating is usually done on a regular schedule, but you can force a collection membership update at any time.

Membership rules are defined when a collection is created, either through the Create Direct Membership Rule Wizard (for collections with direct membership) or through the Query Rule Properties dialog box (for query-based collections).

For more information on collection membership, including the differences between direct membership and query-based membership, see About Collection Membership.

The Create Direct Membership Rule Wizard provides a step-by-step process to walk you through creating a rule that can search for a specific resource or resources. The Query Rule Properties dialog box, however, doesn't provide a wizard because of the more flexible nature of creating a query.

Queries

To create a query, you need at least two parameters: where to search, and what to search for. As with the Create Direct Membership Rule Wizard, the Query Rule Properties dialog box allows you to search within a specific existing collection or across all collections. (All discovered resources will be included in one or more collections when using the predefined collections installed with Configuration Manager 2007.)

With the Query Rule Properties dialog box, you can import an existing query, and then you can either use that query or edit it.

When editing a query, you can establish specific criteria to narrow a query and limit the results that are returned, add joins to combine data from two different attribute classes, or manually change the query using WMI Query Language (WQL). In this way, you can specify a query that will retrieve the set of resources that you want as part of your collection.

For more information on how to create queries, as well as the Configuration Manager tools to help you do so, see Queries in Configuration Manager.

See Also

Concepts

About Collection Membership
About Collections
Overview of Queries


How Collections are Replicated to Child Sites

Configuration Manager 2007 propagates collection definitions that are created at a parent site to all that parent's child sites. However, by design, these propagated collections cannot be modified at the receiving child site. The following small lock icon is used in the Configuration Manager console to indicate that the collection is locked and cannot be modified:

locked collection icon

These collections are locked so that multiple versions of the same collection do not coexist within a site hierarchy. Therefore, collections created at a parent site can be modified only at that parent site. (Because collections created at a child site are not replicated to that child's parent site, if modifications were allowed, those changes would not move up the hierarchy to the parent, thus creating multiple versions of the collection.)

Note
If a collection is not updated within a week, Configuration Manager automatically sends the entire collection from a primary site to its child sites to ensure that the collections remain synchronized.

Primary Child Sites

Child sites that are primary sites receive all the data about a propagated collection (general data, membership rules, and a list of subcollections) except for the actual membership list, which each child primary site generates for its own site based on its site database. By having the child site generate the membership list, Configuration Manager helps to minimize network traffic and also enables the membership list to be updated more easily.

You can delete all the members of a locked collection by right-clicking the collection and then clicking Delete Special. However, if the deleted members are still valid according to the membership rules at the parent site, they can eventually be rediscovered and reappear in the collection.

Primary child sites can create their own collections just as a primary parent site can. These collections are fully managed at the child site by the child site's administrator and are not forwarded to the parent site. If the site has child sites of its own, these collections will be propagated to those child sites and will be locked there.

Secondary Child Sites

Child sites that are secondary sites receive the membership lists for resources that belong to their sites. Only the membership lists are propagated because child sites do not maintain a database and do not have a collection evaluator, and therefore cannot process a collection's membership rules. Whenever a collection is reevaluated at a primary site, its secondary sites receive updated membership lists that replace outdated lists.

See Also

Concepts

About Collection Membership
About Collections


About Maintenance Windows

Topic last updated -- November 2007

What are Maintenance Windows?

Within Microsoft System Center Configuration Manager 2007, maintenance windows (sometimes called "service windows") provide administrators with a way to define a period of time that limits when changes can be made on the systems that are members of a collection. These windows restrict the running of operating system advertisements, as well as software update deployments and software distribution advertisements. When a maintenance window is applied to the collection, configuration changes to collection member systems cannot normally be made outside of this timeframe through Configuration Manager. This provides a safety net for administrators to ensure that client configuration changes only occur during periods when little or no impact to the organization will occur.

Note
When creating an advertisement or deployment, you can set it to override the preset maintenance windows if the advertised program is critical.

Maintenance Windows are defined by collection, and when configured, can be set with an effective start date, start and end times, and a set recurrence pattern. Although a window can thus recur on a regular basis, each window must be less than 24 hours in duration. System restarts caused by an advertised program or deployment are normally not allowed outside of this window, but this can be overridden on a per advertisement or per deployment basis. Maintenance windows affect only when the program runs; packages configured to download and run locally can still download content outside of the maintenance window.

Note
Maintenance windows are not inherited by subcollections.

How Maintenance Windows are used on client computers

When a client computer has a maintenance window policy set, the following evaluation is made before an advertised program is be launched by Configuration Manager 2007:

  • Is the available time left in the defined maintenance window greater or equal to (>=) the Maximum allowed run time for the advertised program plus (+) the Advertised Programs Client Agent countdown duration?

If the answer is yes, the advertised program will run; if not, Configuration Manager 2007 will wait until the next scheduled maintenance window in which there is sufficient time available.

Important
Any advertised program will fail to run when the maintenance windows (or effective maintenance windows if multiple windows overlap) that are defined on the client computer are set for a period less than that program's Maximum allowed run time setting. In this case, a status message will alert the user that the advertised program will not run.

Advertised programs with the Maximum allowed run time option set to Unknown can run past the end of maintenance windows. As the program maximum allowed runtime (the program duration) is set to Unknown, client computers in the targeted collection will not evaluate the program runtime against the defined maintenance windows. For more information about the Maximum allowed run time setting, see Program Name Properties: Requirements Tab. For more information about the client agent's countdown length setting, see Advertised Programs Client Agent Properties: Notification Tab.

For additional information about program running sequences when using maintenance windows, including several sample scenarios, see Program Run Scenario using Maintenance Windows.

Security

By default, maintenance windows are not defined on Configuration Manager collections, but they can be set by administrators with appropriate security permissions. Specific permissions are required for defining a maintenance window or for overriding a maintenance window at the advertisement level. These permissions must be granted separately from other security rights for a collection and can only be granted by a site administrator.

Best Practice Recommendations

Maintenance windows are not intended to function as a primary scheduling method for programs. Instead, they are designed to limit the interference of software deployments or changes with critical system functions. For example, one likely use of a maintenance window would be to specifically restrict system changes on a collection of client computers to the period between midnight and 2:00 a.m., when network traffic is at a minimum or when those computers were not engaged in other activities.

It is recommended that if you use maintenance windows to restrict system changes, you should create specific collections for this purpose rather than use the default collections. Additionally, naming these new collections in a specific manner (such as "MW-<window name>") can be helpful. One or both of these methods will help you manage your collections more easily.

Additionally, it is strongly recommended that maintenance windows be defined after consultation with the appropriate server administrators. This is because different sites in a hierarchy often have different requirements governing their maintenance window needs and these should be taken into account. For example, a data center server administrator will know the best time frame for a maintenance window for the servers under their control, and the Configuration Manager can then create maintenance windows based on that schedule for the collection that includes those servers. However, if a server is assigned to a different site (perhaps in another city or country), the same maintenance windows should probably not be enforced on that server, and it should not be included in the same collection.

Multiple Maintenance Windows

When using maintenance windows on your network, it will not be uncommon for a client computer to be a member of more than one collection with active maintenance windows on them. When this happens, client computers that are members of two or more collections with active maintenance windows will adhere to all defined windows. The Configuration Manager report Maintenance Windows Available to a Particular Client can be used to determine the currently defined windows. For more information on using reports, see Reporting in Configuration Manager.

Depending on when each of the separate maintenance windows is set to occur, this may have differing impact on running programs on a client computer:

If the maintenance windows occur at different times and do not over lap, the client computer will have two (or more) separate maintenance windows on them. Each window will function independently and will be self-contained.

If the maintenance windows occur at different times but over lap, the client will effectively have a single maintenance window that encompasses the period covered by both active windows. In this way, a client that has two maintenance windows of 1 hour each that over lap by 30 minutes would have an effective maintenance window of 90 minutes. This window will behave as if it were 90 minutes long, with respect to allowing programs to run or restarts to occur.

Note
Because the client software forecasts system restarts based on the next available maintenance window (and not based on combined or merged windows), administrators may receive an inaccurate status message saying "...the program may never reboot..." (ID 10079). However, the actual runtime evaluation of programs and restarts is done based on the combined maintenance window. Thus, when there is enough time from a combined or merged window, the system will restart, despite that status message.

What Maintenance Windows Don't Do

The goal of maintenance windows is to limit program runs and system restarts outside of set windows. It is important to know that certain types of Configuration Manager network usage are not bound by any maintenance windows that are set: including:

  • Wake On LAN configurations (For more information, see Overview of Wake On LAN.)
  • Advertisements or deployments specifically set to ignore maintenance windows while running or restarting the client computer
  • Some types of content downloads and advanced downloads
  • Policy downloads
  • Inventory data and data collection
  • Baseline evaluation

If a program is set with Unknown as its Maximum allowed run time, it is not bound by the length of a maintenance window as long as the client countdown period is within the time left in the maintenance window.

Additionally, if settings (such as Restart Countdown) that utilize or affect the maintenance window are changed while the maintenance window is open, those changes will not be considered until the next applicable maintenance window. For example, if a maintenance window is currently open and has 4 minutes remaining in it, and the Restart Countdown is changed from 5 minutes to 1 minute, a queued program will not run in that maintenance window, even if it would otherwise have run with the new Restart Countdown.

See Also

Tasks

How to Set a Maintenance Window

Reference

Advertised Programs Client Agent Properties: Notification Tab
Program Name Properties: Requirements Tab

Concepts

About Collections
Program Run Scenario using Maintenance Windows

Other Resources

Overview of Wake On LAN


Program Run Scenario using Maintenance Windows

Maintenance windows provide administrators with an effective means of managing client changes. However, it is critical that administrators be aware of the possible conflict that may occur between the maintenance windows and the Maximum allowed run time setting on advertised programs.

When a client computer has a maintenance window policy set, the following evaluation is made before an advertised program is be launched by Configuration Manager 2007:

  • Is the available time left in the defined maintenance window greater or equal to (>=) the maximum allowed run time for the advertised program plus (+) the Advertised Programs Client Agent countdown duration.

If the answer is yes, the advertised program will run; if not, Configuration Manager 2007 will wait until the next scheduled maintenance window in which there is sufficient time available.

Important
Any advertised program will fail to run when the maintenance windows defined on the client computer are set for a period less than that program's Maximum allowed run time setting.

Program Run Sequences

Advertised programs are typically run in the order in which they are downloaded to the client computer, based on the advertisement start time and assignment time (if the program is mandatory). However, when maintenance windows are used, this order may not be followed.

When a maintenance window is in place, a program will only be launched according to the available time evaluation. If time remains in the maintenance window after the program is complete and additional programs are queued for launch, Configuration Manager 2007 will evaluate the next program in sequence. If the evaluation is positive and there is enough time available to run this program, it will be launched. If the evaluation is negative and there is insufficient time within the maintenance window to run the program, Configuration Manager 2007 will then evaluate the next program in sequence, leaving the skipped program to be run in the next maintenance window with sufficient available time. If necessary, this process will be run on all programs queued for launch.

When the Maximum Allowed Run Time option is Unknown

If an advertised program has the Maximum allowed run time option set to Unknown, however, the available time evaluation proceeds differently. Although an Unknown setting is evaluated by Configuration Manager 2007 as 12 hours, this is for monitoring purposes only. When determining whether there is sufficient time to run a program within a given maintenance window, a setting of Unknown is evaluated as 0 minutes, regardless of whether the program actually takes 1 minute to run or 3 hours.

As a result, a program with the maximum run time set to Unknown will start running during a maintenance window that has even 1 minute available and can continue to run even if it finishes outside the designated maintenance window.

Note
In determining whether a program with the maximum run time set to Unknown will run during a maintenance window, the countdown duration set for the Advertised Programs Client Agent will still be considered. For more information about this setting, see Advertised Programs Client Agent Properties: Notification Tab.

Sample Program Sequence Scenario

The following scenario provides an example of the sequences in which programs could run on a client computer subject to a daily 1 hour maintenance window. Each of four programs have a mandatory schedule, and are scheduled to be installed only once on Sunday at 1:00 pm. There is a maintenance window available every day at 5:00 pm for 1 hour. Each program requires the installation time as specified in the MaxRunTime field. The countdown duration is set to zero (0).

The following table indicates when each program will actually be installed.

 | Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday
Program 1 (30 min.) | 5:00pm (1) |  |  |  |  |  |
Program 2 (45 min.) |  | 5:00pm (2) |  |  |  |  |
Program 3 (90 min.) | (3) |  |  |  |  |  |
Program 4 (Unknown) | 5:30pm (4) |  |  |  |  |  |

(1) Program 1 runs on Sunday at 5:00 pm because there is sufficient time for installing the program based on the rule evaluating to true: (Remaining maintenance window duration – Countdown >= MaxRunTime of Program 1) or (60 – 0 >= 30).

(2) Program 2 does not run on Sunday because the rule evaluated to false: (Remaining maintenance window duration – Countdown >= MaxRunTime of Program 2.) or (30 – 0 >= 45). It will run on Monday at 5 PM because there is sufficient time for installing the program based on the rule evaluating to true: (Remaining maintenance window duration – Countdown >= MaxRunTime of Program 2) or (60 – 0 >= 45).

(3) Program 3 does not run on Sunday because the rule evaluated to false: (Remaining maintenance window duration – Countdown >= MaxRunTime of Program 3.) or (30 – 0 >= 90). In fact, Program 3 will never run because there is insufficient time for installing the program based on the rule evaluating to false: (Remaining maintenance window duration – Countdown >= MaxRunTime of Program 3) or (60 – 0 >= 90). When this program does not run, Configuration Manager 2007 evaluates if it will ever run and because the rule always evaluate to false, the program will fail on Sunday.

(4) Program 4 runs on Sunday at 5:30 pm because there is sufficient time for installing the program based on the rule evaluating to true: (Remaining maintenance window duration – Countdown >= MaxRunTime of Program 4) or (60 – 0 (because Unknown is resolved to 0) >= 0).

Note
Although the actual run time of Program 4 exceeds the length of the maintenance window, Configuration Manager 2007 will only stop the program if it is set to run with administrative rights and the allow users to interact with this program setting is not selected. Otherwise the program will not be stopped and will continue until the program completes or fails.

See Also

Tasks

How to Set a Maintenance Window

Reference

Advertised Programs Client Agent Properties: Notification Tab
Program Name Properties: Requirements Tab

Concepts

About Collections
About Maintenance Windows


About Collection-Specific Settings

Topic last updated—November 2007

Each Microsoft System Center Configuration Manager 2007 collection can have specific settings that apply only to that collection. The collection-specific settings are as follows:

  • Collection variables
  • Restart settings
  • Policy polling intervals
  • Maintenance windows

Per-collection task sequence variables are used for operating system deployment. For more information, see How to Create Per-Collection Task Sequence Variables.

Per-collection restart settings and policy polling intervals allow you to set values that override the values set in the Configuration Manager Computer Client Agent properties.

Important
If a client is a member of multiple collections with different polling and restart intervals, it will use the shortest configured interval.

Maintenance windows provide administrators with a way to define a period of time that limits when changes can be made on the systems that are members of a collection. For more information, see About Maintenance Windows.

See Also

Tasks

How to Configure the Client Policy Polling Interval for a Specific Collection
How to Configure the Configuration Manager Computer Client Agent

Reference

Collection Name Settings: Advanced Tab
Computer Client Agent Properties: General Tab
Computer Client Agent Properties: Restart Tab


Collections Administrator Workflows

The administrator workflows for collections in Configuration Manager 2007 provide both an end-to-end workflow for creating and modifying collections, as well as the workflows for collection-oriented wizards.

Click any link in the following section for more information about the available collections administrator workflows.

In This Section

Administrator Workflow: Creating and Modifying Collections

Provides an end-to-end process workflow for creating and modifying collections within Configuration Manager.

New Collection Wizard: Administrator Workflow

Provides an end-to-end workflow for the New Collection Wizard.

Delete Collection Wizard: Administrator Workflow

Provides an end-to-end workflow for the Delete Collection Wizard.

See Also

Concepts

About Collections

Other Resources

Delete Collection Wizard
How to Manage Collections
New Collection Wizard


Administrator Workflow: Creating and Modifying Collections

Fundamental to the package distribution process in Configuration Manager is the creation and use of collections. Collections represent groups of discovered resources within your enterprise and while a set of default collections is provided with a standard Configuration Manager installation, you can create new collections to meet your specific needs. Additionally, with collection-specific settings such as maintenance windows, restart settings, and so on, even the default collections are likely to be modified.

The following flowchart provides a high level visual workflow for the steps for creating and modifying collections, and the links at the end of this document provide detailed information about each process.

Creating and Modifying Collections End-to-End Workflow

Create Modify Collections Workflow

See Also

Tasks

How to Create a Collection
How to Create a Subcollection
How to Modify a Collection
How to Set a Maintenance Window

Concepts

About Collections
About Collection Membership
About Maintenance Windows
About Subcollections
About Resources


New Collection Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 New Collection Wizard.

For information about each step in this wizard, see New Collection Wizard.

Workflow of New Collection Wizard

See Also

Tasks

How to Create a Collection

Other Resources

New Collection Wizard


Delete Collection Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 Delete Collection Wizard.

For information about each step in this wizard, see Delete Collection Wizard.

Flow of Configuration Manager Delete Collection

See Also

Tasks

How to Delete a Collection

Other Resources

Delete Collection Wizard


Tasks for Collections

Collections are a building block necessary for much of the functionality in Microsoft System Center Configuration Manager 2007 and to use these effectively, there are a number of tasks necessary to create and manage your resources and collections. This section provides information about managing your resources, creating and modifying collections of those resources, and using them more effectively within your network environment.

Click the related link for detailed information about the associated collections task.

In This Section

How to Manage Collections

Describes how to add to or modify collections to more effectively manage your organization.

How to Manage Subcollections

Describes how to manage subcollections within your Configuration Manager collections.

How to Manage Resources

Describes how to manage the resources that make up your Configuration Manager collections and subcollections.

See Also

Concepts

About Collections
About Subcollections
About Resources

Other Resources

Collections Overview


How to Manage Collections

Collections are the primary means that Configuration Manager 2007 uses to define the recipients of packages. Although a number of collections come preinstalled with a standard Configuration Manager 2007 setup, it is frequently useful to add to or modify this selection to more effectively manage your organization. This section provides links to the tasks that help to manage collections within Configuration Manager.

Click the related link for detailed information about the associated collections management task.

In This Section

How to Create a Collection

Specifies how to create a new collection in Configuration Manager.

How to Modify a Collection

Specifies how to modify the properties and settings of an existing collection.

How to Delete a Collection

Specifies how to delete a collection from Configuration Manager.

How to Update Collections

Specifies how to update the membership of one or more collections on demand.

How to Schedule Collection Updates

Specifies how to schedule a collection to evaluate its membership rules and update collection membership on a recurring basis.

How to View the Advertisements for a Collection

Specifies how to view existing advertisements for a given collection.

See Also

Concepts

About Collections
About Resources
About Subcollections

Other Resources

How to Manage Subcollections


How to Create a Collection

The primary means of defining the recipients of Configuration Manager 2007 packages is to use collections—groups of Configuration Manager resources. Although a number of collections are already defined within Configuration Manager 2007, it is often useful to create additional collections based on the needs of your own organization.

Collection names must be unique, as multiple collections with the same name are not allowed.

Note
You must have Create permissions for the Collection security object type to create a new collection. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To create a collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management.

  2. Right-click Collections, and then click New Collection.

  3. Use the New Collection Wizard to create a collection to fit your needs, specifying general information, membership rules, an update schedule, and other information for the new collection.

    For additional information about this wizard, see New Collection Wizard.

See Also

Concepts

About Collections
About Resources

Other Resources

How to Manage Collections


How to Modify a Collection

There are two ways to modify an existing collection in Microsoft System Center Configuration Manager 2007.

Collection properties (attributes that reflect a collection's content) are modified through the <Collection Name> Properties dialog box. Attributes that can be modified there include the following:

  • General collection information
  • Membership rules
  • Advertisements to the collection
  • Security rights

Collection settings (attributes that reflect a collection's behavior) are modified through the <Collection Name> Settings dialog box. Attributes that can be modified there include the following:

  • Maintenance windows
  • Collection-specific variables
  • Collection-specific restart and policy polling settings
Note
To modify the properties of a specific collection, you must have Modify permission for the Collections security object type. To modify the settings of a collection, you must have Modify Settings permission for the Collection security object type. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To modify collection properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection that you want to modify, and then click Properties.

  3. In the <Collection Name> Properties dialog box, modify the settings as needed.

    For information about the specific pages in this dialog box, see Collection Name Properties.

To modify collection settings

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection that you want to modify, and then click Modify Collection Settings.

  3. In the <Collection Name> Properties dialog box, modify the settings as needed.

    For information about the specific dialog pages in this dialog box, see the individual help pages for those pages.

See Also

Concepts

About Collections
About Resources

Other Resources

How to Manage Collections


How to Delete a Collection

Deleting a collection within Configuration Manager 2007 is done using the Delete Collection Wizard. This provides you with the opportunity to view the effects of deleting the collection from your site. The same process is used for deleting a subcollection.

When you delete a collection, that collection is removed completely from the Configuration Manager 2007 database. This deletion also removes the following:

  • Any instances of the collection that are subcollections of another collection.
  • Any subcollections of the collection that are not linked to or subcollections of another collection.
  • Any advertisements for the collection.
  • Any baselines for the collection.
  • Any software update deployments for the collection.
  • All security rights to the collection.

Because all subcollections are removed when you delete a collection, you should delete any such subcollections before deleting this collection. This will give you the opportunity to see the impact of deleting each of those subcollections individually. Deleting a collection using the Delete Collection Wizard only shows the effects of deleting that collection; it does not show the extended effects of deleting associated subcollections.

Note
You must have Delete permissions for the Collection security object type to remove a collection. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager..

To delete a collection or subcollection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection that you want to delete, and then click Delete.

  3. Use the Delete Collection Wizard to delete the specific collection or subcollection.

    For additional information about this wizard, see Delete Collection Wizard.

See Also

Concepts

About Collections
About Resources
About Subcollections

Other Resources

How to Manage Collections
How to Manage Subcollections


How to Update Collections

Collections that are based on direct-membership rules need to be manually updated by the Configuration Manager administrator (in the same manner as each resource was originally added to the collection when it was created). Collections that are query-based, however, can be automatically updated by Configuration Manager. Normally, this is done based on the schedule that you set when creating a collection. (Pre-installed collections update once per day by default.) A collection is also automatically updated whenever a collection is modified or a linked collection is deleted.

It is sometimes useful, however, to update a collection outside of the normal schedule, a process referred to as "forcing an update." You can force an update to all collections at once or to any individual collection at any point in time. When you update a collection, Configuration Manager 2007 reevaluates the resources in the site against the membership rules that are defined for the collection. The updated resource list appears in the results pane.

Note
Forcing a collection update causes the request for reevaluation as well as the collection definition to be propagated to child sites, which will increase network traffic. Additionally, updating all collections at will can also increase network traffic, dramatically so in the case of large sites with many collections or clients.

You must have Read permissions for the Collection security object type to view the properties for resources in that collection. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To update an individual collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the specific collection that you want to update, and then click Update Collection Membership.

  3. If you also want to update all associated subcollections of the selected collection, select the Update subcollection membership check box.

  4. Click OK.

To update all collections at once

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management.

  2. Right-click Collections, and then click Update Collection Membership.

  3. Click OK.

See Also

Concepts

About Collection Membership
About Collections
About Resources
About Subcollections

Other Resources

How to Manage Resources


How to Schedule Collection Updates

By default, Configuration Manager 2007 schedules updates preinstalled collections for once per day. As administrator, it is up to you to set the schedule for updating new collections (by default the schedule for new collections is also set at once per day). However, depending on the number and size of your collections, as well as the frequency with which your resource list changes, you can optimize Configuration Manager 2007 performance by adjusting the length of time between collection updates.

You can schedule collection updates when you create a collection using the New Collection Wizard, or later, using the Collection Properties dialog box. Both use the same user interface.

Note
You must have Modify permissions for the Collection security object type to set a collection update schedule. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To schedule a collection update

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / <server name> / Computer Management / Collections.

  2. Right-click the collection that you want to schedule, and then click Properties.

  3. On the Membership Rules tab, select the Update this collection on a schedule check box if not already selected.

  4. Click Schedule.

  5. Specify when and how often you want to update collection membership in the Custom Schedule dialog box, specifying a start time and recurrence pattern for updating the collection membership.

    For more information about this dialog box, see Custom Schedule Dialog Box.

See Also

Concepts

About Collections
Custom Schedule Dialog Box

Other Resources

New Collection Wizard


How to Set a Maintenance Window

In order to set a maintenance window for a specific collection, you must have Modify Collection Settings permission for the Collections security object or instance type. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

Maintenance windows are set on a per collection basis.

Important
Advertised programs with the Maximum allowed run time option set to Unknown will fail on collections with a maintenance window set if that window is set to less than 12 hours (the default run time setting for Unknown). Similarly, any advertised program will fail when a maintenance window is set for a period less than that program's Maximum allowed run time setting. For more information about the Maximum allowed run time setting, see Program Name Properties: Requirements Tab.

To set a maintenance window on a collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection for which you want to set a maintenance window, and then click Modify Collection Settings.

  3. On the Maintenance Windows tab, click the New icon.

  4. In the Name box, type a name for this maintenance window.

  5. In the Time area, select an effective date for the window, as well as a start and end time for the window. The duration of the maintenance window is shown below the selected start and end times.

    Note
    Do not set the duration of the maintenance window for longer than 24 hours. If a longer maintenance window is required, use multiple windows.

  6. Select the UTC check box if you want the maintenance windows to be on a Coordinated Universal Time schedule rather than local time.

  7. Select a recurrence pattern for the maintenance window if desired.

    For more information about recurrence patterns in custom schedules, see Custom Schedule Dialog Box.

  8. Select the This schedule applies only to operating system deployment task sequences option, if desired.

  9. Click OK.

See Also

Concepts

About Collections
About Maintenance Windows
Custom Schedule Dialog Box
Program Run Scenario using Maintenance Windows


How to View the Advertisements for a Collection

In order to view the advertisements addressed to a specific collection, you must have Read permission for the Collection security object type. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To view the advertisements for a collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection that you want to view, and then click Properties.

  3. The advertisements currently available to the collection are displayed on the Advertisements tab.

    For more information about this page of the <Collection Name> Properties dialog box, see Collection Name Properties: Advertisements Tab.

See Also

Reference

Collection Name Properties: Advertisements Tab

Concepts

About Advertisements
About Collections


How to Manage Subcollections

Subcollections provide a means within Configuration Manager 2007 uses to link collections together, for administrative convenience or to emulate the structure of your enterprise by separating out organizational units. All subcollections are, by their nature, collections, so the tools used to manage collections, are also applicable to subcollections. This section provides links to those additional tasks specific to managing subcollections within Configuration Manager.

Note
When creating an advertisement, Configuration Manager includes subcollections as well as collections by default. You should review this option to avoid including undesirable subcollections in an advertisement.

Click the related link for detailed information about the associated subcollections management task.

In This Section

How to Create a Subcollection

Specifies how to create a subcollection within Configuration Manager, either by creating a link to an existing collection, or by creating an entirely new subcollection.

How to Delete a Subcollection

Specifies how to delete a subcollection from Configuration Manager.

See Also

Concepts

About Collections
About Resources
About Subcollections

Other Resources

How to Manage Collections


How to Create a Subcollection

Using subcollections within Configuration Manager 2007 can be an effective way of associating one collection with another within a site. When creating a subcollection, either by creating a new collection within another collection, or by linking two collections together, a subcollection is functionally still a collection, and so all rules applying to collections also apply to subcollections. Because of this, subcollection names must be unique among both collections and subcollections, as multiple collections and subcollections with the same name are not allowed.

Subcollections can be created for existing subcollections to almost any depth. However, because each layer added contributes to the complexity of the collection, it is recommended that you do not create subcollections with more than 10 tiers in depth.

Note
You must have Create permissions for the Collection security object type and Modify permission to the instance to create subcollections for a collection. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To create a new subcollection within an existing collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection (or subcollection) to which you want to add a subcollection, point to New, and then click Collection.

  3. Use the New Collection Wizard to create a new subcollection, specifying the general information, membership rules, update schedule, and other information for the new subcollection.

    For additional information about this wizard, see New Collection Wizard.

To create a subcollection by linking to an another existing collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection (or subcollection) to which you want to add a subcollection, point to New, and then click Link to Collection.

  3. In the Browse Collection dialog box, select the existing collection that you want to add as a subcollection.

    Note
    Any changes made to a linked subcollection will be reflected in all instances of that collection throughout the enterprise.

  4. Click OK.

See Also

Concepts

About Collections
About Subcollections
About Resources

Other Resources

How to Manage Collections


How to Delete a Subcollection

Deleting a subcollection is similar to deleting a collection, and is done using the Delete Collection Wizard. This provides you with the opportunity to view the effects of deleting the subcollection from your site.

When you delete a subcollection, that subcollection is removed completely from the Configuration Manager 2007 database. This deletion also removes the following:

  • Any instances of the subcollection that are subcollections of another collection.
  • Any child subcollections of this collection that are not linked to or subcollections of another collection.
  • Any advertisements for the subcollection.
  • All security rights to the subcollection.

Because all child subcollections are removed when you delete a subcollection, you should delete any such child subcollections before deleting this subcollection. This will give you the opportunity to see the impact of deleting each of those subcollections individually. Deleting a collection or subcollection using the Delete Collection Wizard shows the effects of deleting only that collection; it does not show the extended effects of deleting associated subcollections.

Note
You must have Delete permissions for the Collection security object type to remove a subcollection. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To delete a subcollection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the subcollection that you want to delete, and then click Delete.

  3. Use the Delete Collection Wizard to delete the specific subcollection.

    For additional information about this wizard, see Delete Collection Wizard.

See Also

Concepts

About Collections
About Subcollections

Other Resources

How to Manage Subcollections


How to Manage Resources

Within Configuration Manager 2007, resources are gathered using one of the various discovery methods, but are organized and managed along with collections. This section provides links to the tasks that help you manage your Configuration Manager resources.

Click the related link for detailed information about the associated resource management task.

In This Section

How to Display Resource Properties

Specifies how to display the properties of a given resource.

How to Delete a Resource

Specifies how to delete a resource from Configuration Manager.

How to View Advertisements for a Resource

Specifies how to view the advertisements that are currently directed at the given resource.

See Also

Concepts

About Collections
About Configuration Manager Discovery
About Resources


How to Display Resource Properties

Information about resources used within collections is available within the Resource Properties dialog box, including discovery data, advertisements to the given resource, and custom variables defined for the resource.

Additional information about resources can be found using the Resource Explorer. For more information about this tool, see About Resource Explorer.

Note
You must have Read permissions for the Collection security object type to display resource properties. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To display resource properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / <server name> / Computer Management / Collections.

  2. Click the collection that contains the resource that you want to display.

  3. Right-click the resource you want, and then click Properties.

    For more information about the specific pages of the Resource Properties dialog box, see Resource Properties.

See Also

Concepts

About Resources
About Resource Explorer


How to Delete a Resource

When deleting a resource in Configuration Manager 2007, that resource is removed from both the collections that utilize it and from the Configuration Manager database.

If you want to remove a resource from a specific collection but not from the Configuration Manager database, modify that collection's membership rules. For more information, see About Collection Membership.

Note
You must have Delete Resource permissions for the Collection security object type to delete a resource. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

Procedures

To delete a resource from all collections and the database

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Select the collection that contains the resource that you want to delete.

  3. Right-click the resource you want to delete.

  4. Click Delete.

  5. Click Yes to confirm that you want to delete the resource.

See Also

Concepts

About Resources


How to View Advertisements for a Resource

In order to view the advertisements addressed to a specific resource, you must have Read permission for the Collection security object type. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To view advertisements for a resource

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Click the collection that contains the resource that you want to display.

  3. Right-click the resource you want, and then click Properties.

  4. The advertisements currently available to the resource are displayed on the Advertisements tab.

    For more information about this page of the Resource Properties dialog box, see Resource Properties: Advertisements Tab.

See Also

Tasks

How to View the Advertisements for a Collection

Concepts

About Advertisements
About Resources


Troubleshooting Collections

Topic last updated—November 2007

The topics in this section provide troubleshooting information you can use for Microsoft System Center Configuration Manager 2007 collections.

In This Section

Troubleshooting Collection Issues

A description of common issues and possible solutions.

Collection Evaluator: Site Assignment Change Flowchart

A flowchart showing what happens when Collection Evaluator detects a site assignment change.

See Also

Other Resources

Collections in Configuration Manager


Troubleshooting Collection Issues

This section provides information to help troubleshoot collections issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93053.

List of supported platforms in programs will be evaluated incorrectly in mixed-version hierarchies

In a hierarchy with Configuration Manager 2007 parent sites and SMS 2003 child sites, if a program is configured to run only on specified client platforms but that platform is not in the list of platforms in the SMS 2003 site, the program will run on all client computers in the collection, regardless of platform. For example, if the parent Configuration Manager 2007 site has a program that can run only on Vista but the child SMS 2003 site does not have Vista in the list of platforms, the platform restriction is ignored on clients receiving the program and the program will run on all clients in the specified collection.

Solution

Create collections that contain only clients of the new platform, and send advertisements for programs needing new platforms only to those collections. Also, if you are creating the executable for the program, you might be able to evaluate the platform and terminate the executable gracefully if an unsupported platform is detected.

List of supported platforms in programs will be evaluated incorrectly in mixed-version hierarchies

In a hierarchy with Configuration Manager 2007 parent sites and SMS 2003 child sites, if a program is configured to run only on specified client platforms but that platform is not in the list of platforms in the SMS 2003 site, the program will run on all client computers in the collection, regardless of platform. For example, if the parent Configuration Manager 2007 site has a program that can run only on Vista but the child SMS 2003 site does not have Vista in the list of platforms, the platform restriction is ignored on clients receiving the program and the program will run on all clients in the specified collection.

Solution

Create collections that contain only clients of the new platform, and send advertisements for programs needing new platforms only to those collections. Also, if you are creating the executable for the program, you might be able to evaluate the platform and terminate the executable gracefully if an unsupported platform is detected.

See Also

Other Resources

Collections Overview


Collection Evaluator: Site Assignment Change Flowchart

Topic last updated—November 2007

The following flowchart shows the end-to-end process when Microsoft System Center Configuration Manager 2007 Collection Evaluator detects a site assignment change.

Flowchart of Collection Evaluation Behavior

See Also

Other Resources

Troubleshooting Collections


Software Distribution in Configuration Manager

The Microsoft System Center Configuration Manager 2007 software distribution feature provides a set of tools and resources that help you create and manage packages and advertisements used to distribute software to client resources within your enterprise.

The topics in this section provide detailed information about planning, configuring, managing, monitoring, and troubleshooting software distribution.

In This Section

Software Distribution Overview

Provides an overview of the software distribution feature in Configuration Manager.

Prerequisites for Software Distribution

Provides information about prerequisites necessary for using the software distribution feature.

Planning Software Distribution

Provides planning information for the software distribution feature.

Configuring Software Distribution

Provides the configuration checklist and tasks to configure software distribution within the Configuration Manager environment.

Tasks for Software Distribution

Provides a set of tasks to perform software distribution objectives, including how to create and manage packages, programs, and advertisements, as well as how to manage distribution points so as to distribute your software.

Troubleshooting Software Distribution

Provides troubleshooting information for software distribution in Configuration Manager.

Software Distribution Security Best Practices and Privacy Information

Provides security and privacy information and best practices for distributing software in Configuration Manager.

Technical Reference for Software Distribution

Provides optional technical details about software distribution.

See Also

Other Resources

Configuration Manager 2007 Features


Software Distribution Overview

Software distribution allows you to push almost anything to the client computers in your enterprise. It uses packages to deploy software applications, and within those packages, commands called programs that tell the client what executable file to run. A single package can contain multiple programs, each configured to run differently. Packages can also contain command lines to run files already present on the client, without actually containing additional source files. Advertisements are used to specify which collections receive the program and the package

Important
Configuration Manager 2007 can cause any executable file to run on the client, however it is important to understand that Configuration Manager 2007 does not actually package the executables or source files. Configuration Manager 2007 is like the delivery man; it gets the software or the command to the client, but the command must be able to run on the client independently of Configuration Manager 2007. If the software or command cannot run without Configuration Manager 2007 software distribution, it will never run with software distribution.

The Microsoft System Center Configuration Manager 2007 software distribution feature provides a set of tools and resources that can help manage the complex task of creating, modifying, and distributing software packages to client computers in your enterprise. Click any link in the following section for overview information about software distribution.

In This Section

Administrator Workflows for Software Distribution

Provides visual workflows for the software distribution as well as software distribution wizards.

About the Advertised Programs Client Agent

Provides information about the Advertised Programs Client Agent, used by software distribution.

About Packages

Provides information about packages, the main building block of software distribution.

About Package Definition Files

Provides information about package definition files, a preformed type of package that can be used to distribute software.

About Programs

Provides information about programs, the individual commands used to run executable files on clients.

About Distribution Points

Provides information about distribution points, the primary point of delivery for software distribution packages.

About Standard and Branch Distribution Points

Provides information about branch distribution points, for software package delivery with distributed branch offices.

About On-Demand Package Distribution

Provides information about on-demand package distribution, for use with branch distribution points for lower network traffic.

About Advertisements

Provides information about advertisements, the means for selecting which collections the packages and programs will be sent to, as well as the schedule on which they will be sent.

About Binary Differential Replication

Provides information about binary delta replication, used to pass specific changes in package and programs to distribution points with a minimum of extra network traffic.

About Package Access Accounts

Provides information about package access accounts, for increased control over access to the packages you place on distribution points.

About the Role of Collections in Distributing Software

Provides information about how collections affect the process of distributing software in Configuration Manager.

About Virtual Application Packages

Provides information about virtual application packages.

About Feature Reports for Software Distribution

Provides information about software distribution reports.

See Also

Concepts

Prerequisites for Software Distribution

Other Resources

Planning Software Distribution
Configuring Software Distribution
Tasks for Software Distribution


Administrator Workflows for Software Distribution

The administrator workflows for software distribution in Configuration Manager 2007 provide end-to-end workflows for distributing software to clients, including creating and modifying packages and programs, and advertisements, as well as distributing packages to distribution points. Also included are workflows for all software distribution-oriented wizards.

Click any link in the following section for more information about the available software distribution administrator workflows.

In This Section

Administrator Workflow: Distributing Software Packages Overview

Provides an overview process workflow for distributing software packages in Configuration Manager.

Administrator Workflow: Creating a Package

Provides a process workflow for creating a software distribution package.

Administrator Workflow: Creating a Program

Provides a process workflow for creating a software distribution program.

Administrator Workflow: Distributing Packages to Distribution Points

Provides a process workflow for distributing software distribution packages to distribution points.

Administrator Workflow: Creating and Modifying Advertisements

Provides a process workflow for creating and modifying advertisements for software distribution programs.

Administrator Workflows for Software Distribution Wizards

Provides end-to-end workflows for the wizards used by software distribution.

See Also

Concepts

About Advertisements
About Distribution Points
About Packages
About Programs

Other Resources

How to Manage Advertisements
How to Manage Distribution Points
How to Manage Packages
How to Manage Programs


Administrator Workflow: Distributing Software Packages Overview

Within Configuration Manager 2007, software packages can be delivered in several ways, using a number of different procedures. However, before the software can be distributed to the clients, a number of steps must be taken to configure the software distribution functionality of Configuration Manager. Once configured, each of the software distribution methods may vary in specifics, but nevertheless each follows a fairly standard pattern consisting of creating a package, creating one or more programs for that package, loading the package to distribution points for dissemination, and creating an advertisement to distribute the programs to specific clients or groups of clients at a given time.

The following flowchart provides a high level visual workflow for the overall process involved in distributing software to clients using Configuration Manager, and the links at the end of this document provide detailed information about the process.

Distributing Software Process: End-to-End Workflow

Workflow of Software Distribution

See Also

Tasks

How to Assign a Mandatory Advertisement
How to Create an Advertisement
How to Create a Package
How to Create a Package from a Package Definition File
How to Create a Program
How to Deploy a Branch Distribution Point
How to Designate a Distribution Point
How to Send a Package to Distribution Points

Concepts

About Advertisements
About Packages
About Programs


Administrator Workflow: Creating a Package

Within Configuration Manager 2007, packages provide one of the foundations of distributing software to clients. Although the specific software being delivered is contained in the programs within a package, the package itself provides a wrapper that dictates where source files are stored on the site server and distribution points, on what schedule the package will be updated on the distribution points, and other settings related to the overall package.

The following flowchart provides a high level visual workflow for the steps for creating a package, and the links at the end of this document provide detailed information about the process.

Creating a Package End-to-End Workflow

Create Package Workflow

See Also

Tasks

How to Create a Package
How to Create a Package from a Package Definition File
How to Set Up a Package Source Directory

Concepts

About Binary Differential Replication
About Packages
About Package Definition Files
Create New Package from Definition Wizard: Administrator Workflow
New Package Wizard: Administrator Workflow


Administrator Workflow: Creating a Program

Within Configuration Manager 2007, programs contain the applications, tools, or commands being delivered to clients. While packages provide a wrapper for the software, dictating how the software will be passed between site servers and distribution points, programs provide a wrapper for the software, telling the clients themselves how the application should interface and run on those computers.

The following flowchart provides a high level visual workflow for the steps for creating a program in Configuration Manager, and the links at the end of this document provide detailed information about the process.

Creating a Program End-to-End Workflow

Create Program Workflow

See Also

Tasks

How to Create a Program
How to Delete a Program

Concepts

About Programs
Delete Program Wizard: Administrator Workflow
New Program Wizard: Administrator Workflow

Other Resources

New Program Wizard


Administrator Workflow: Distributing Packages to Distribution Points

Within Configuration Manager 2007, once a software package has been created with its attendant programs, the package must then be disseminated to distribution points in order to convey it to clients. Whether a standard distribution point or a branch distribution point is used, from the software distribution point of view, this process is done in the same manner.

The following flowchart provides a high level visual workflow for distributing packages to distribution points in Configuration Manager, and the links at the end of this document provide detailed information about the process.

Distributing Software Process: End-to-End Workflow

Distributing Package to Distribution Points diagra

See Also

Tasks

How to Configure On-Demand Package Distribution to a Branch Distribution Point
How to Distribute a Package to a Branch Distribution Point
How to Prestage Packages on a Branch Distribution Point
How to Send a Package to Distribution Points

Concepts

About Standard and Branch Distribution Points
About Distribution Points
About On-Demand Package Distribution
Manage Distribution Points Wizard: Administrator Workflow

Other Resources

Manage Distribution Points Wizard


Administrator Workflow: Creating and Modifying Advertisements

Within Configuration Manager 2007, once a package and its associated programs have been created and distributed to its various distribution point, you need to get it to the clients. Advertisements do this in two ways: not only do they alert clients that the specific package is available for them to download and install, but it provides them with a path to doing so. Additionally, advertisements provide you as an administrator, with a means to push a mandatory (assigned) program to clients.

The following flowchart provides a high level visual workflow for creating and modifying advertisements for software distribution in Configuration Manager, and the links at the end of this document provide detailed information about the process.

Creating and Modifying Advertisements: End-to-End Workflow

Create Advertisement Workflow

See Also

Tasks

How to Assign a Mandatory Advertisement
How to Create an Advertisement
How to Delete an Advertisement
How to Modify an Advertisement

Concepts

About Advertisements
New Advertisement Wizard: Administrator Workflow

Other Resources

New Advertisement Wizard


Administrator Workflows for Software Distribution Wizards

The administrator workflows for software distribution wizards in Configuration Manager 2007 provide end-to-end workflows for creating packages, programs, and advertisements, as well as managing distribution points and distributing software, as used by the individual wizards.

Click any link in the following section for more information about the available software distribution wizard administrator workflows.

In This Section

New Package Wizard: Administrator Workflow

Provides an end-to-end workflow for the New Package Wizard.

Create New Package from Definition Wizard: Administrator Workflow

Provides an end-to-end workflow for the Create New Package from Definition Wizard.

Delete Package Wizard: Administrator Workflow

Provides an end-to-end workflow for the Delete Package Wizard.

New Program Wizard: Administrator Workflow

Provides an end-to-end workflow for the New Program Wizard.

Delete Program Wizard: Administrator Workflow

Provides an end-to-end workflow for the Delete Program Wizard.

New Advertisement Wizard: Administrator Workflow

Provides an end-to-end workflow for the New Advertisement Wizard.

Manage Distribution Points Wizard: Administrator Workflow

Provides an end-to-end workflow for the Manage Distribution Points Wizard.

Distribute Software Wizard: Administrator Workflow

Provides an end-to-end workflow for the Distribute Software Wizard.

See Also

Other Resources

Create Package From Definition Wizard
Delete Package Wizard
Delete Program Wizard
Distribute Software Wizard
Manage Distribution Points Wizard
New Advertisement Wizard
New Package Wizard
New Program Wizard


New Package Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 New Package Wizard.

For information about each step in this wizard, see New Package Wizard.

Workflow of the New Package Wizard

See Also

Tasks

How to Create a Package

Other Resources

New Package Wizard


Create New Package from Definition Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 Create New Package from Definition Wizard.

For information about each step in this wizard, see Create Package From Definition Wizard.

Workflow of Create New Package Definition Wizard

See Also

Tasks

How to Create a Package from a Package Definition File

Other Resources

Create Package From Definition Wizard


Delete Package Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 Delete Package Wizard.

For information about each step in this wizard, see Delete Package Wizard.

Workflow of the Delete Package Wizard

See Also

Tasks

How to Delete a Package

Other Resources

Delete Package Wizard


New Program Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 New Program Wizard.

For information about each step in this wizard, see New Program Wizard.

Workflow of the New Program Wizard

See Also

Tasks

How to Create a Program

Other Resources

New Program Wizard


Delete Program Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 Delete Program Wizard.

For information about each step in this wizard, see Delete Program Wizard.

Workflow of the Delete Program Wizard

See Also

Tasks

How to Delete a Program

Other Resources

Delete Program Wizard


New Advertisement Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 New Program Wizard.

For information about each step in this wizard, see New Advertisement Wizard.

Workflow of the New Program Wizard

See Also

Tasks

How to Create an Advertisement

Other Resources

New Advertisement Wizard


Manage Distribution Points Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 New Program Wizard.

For information about each step in this wizard, see Manage Distribution Points Wizard.

Workflow of the New Program Wizard

See Also

Other Resources

Manage Distribution Points Wizard
How to Manage Distribution Points


Distribute Software Wizard: Administrator Workflow

The following workflow demonstrates the basic flow of the Configuration Manager 2007 Distribute Software Wizard.

For information about each step in this wizard, see Distribute Software Wizard.

Workflow of the Distribute Software Wizard

See Also

Concepts

Administrator Workflow: Distributing Software Packages Overview

Other Resources

Distribute Software Wizard


Administrator Workflow: Distributing Virtual Application Packages Overview

Topic last updated – March 2008

Configuration Manager 2007 supports running sequenced applications created using the Microsoft Application Virtualization Platform. Configuration Manager 2007 virtual application packages can run on target computers without having to install the software application locally.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Distributing Virtual Application Packages

The following flowchart provides a high level overview of the process involved with creating, importing, and distributing virtual application packages in Configuration Manager 2007.

Virtual Application Package Overview

See Also

Other Resources

Administrator Workflows for Software Distribution


About the Advertised Programs Client Agent

When you distribute software to a collection of clients in Configuration Manager 2007, the Advertised Programs Client Agent determines which advertised programs are appropriate to the client or the user at the client. When an advertisement is found and the program is ready to run, the agent connects to an available distribution point to transfer or run the program. If the program runs an existing file on the client computer, the agent executes the program appropriately.

The Advertised Programs Client Agent controls how clients check for advertised programs and how they behave when an advertised program is available or scheduled to run. By configuring the Advertised Programs Client Agent, you can specify these client behaviors as well as other client settings and run options.

See Also

Tasks

How to Configure the Advertised Programs Client Agent

Concepts

About Advertisements


About Packages

Configuration Manager 2007 uses packages to distribute software to clients. A package generally represents a software application to be installed on a client computer, but it might also contain individual files, updates, or even an individual command.

Important
Although Configuration Manager enables you to easily install software on multiple computers, you must still agree to and follow the software license terms for any software installed using Microsoft System Center Configuration Manager. You can use software metering to help you track license usage. For more information about software metering, see Software Metering in Configuration Manager.

Using packages, you can deliver, install, and configure software to meet the individual needs of your clients. This is done using programs, which identify the actions that must occur on the client once the package is received. Each program defines for Configuration Manager the client platform and environment within which the package can run, and includes any and all appropriate references to script files or command switches. Each package must contain at least one program. For more information about programs, see About Programs.

Packages and programs are created and displayed using the Packages node in the Configuration Manager console. They are then stored in the database for the site you are administering.

Packages often contain files in addition to the programs, particularly when you are installing a software application or update. If the package requires such files, you must also specify the following information:

  • The source folder containing all the files needed for the package. If the package supports more than one platform, all files for all platforms are included in the source folder.
  • The distribution points for the package, on which the package files, programs, and scripts necessary for the package to run successfully will be stored. For more information about distribution points, see About Distribution Points.

After you create a package with a source folder, Configuration Manager sends the package source files to the distribution points that you've specified.

After programs have been defined for a package and the package data has been sent to one or more distribution points, you can create advertisements that make those programs available to the clients in your specified collection. For more information about advertisements, see About Advertisements.

See Also

Tasks

How to Create a Package

Concepts

About Programs

Other Resources

Software Distribution Overview
How to Manage Packages
How to Manage Programs


About Package Definition Files

Package definition files are predefined scripts that you can use to help automate package creation with Microsoft System Center Configuration Manager 2007. These are files that contain the package and program information needed to distribute a package to clients, with the exception of the source file location.

Package definition files often come with an application's source files or are available from the application's developer. Configuration Manager 2007 also has a selection of package definition files that are automatically imported and available in the Create Package from Definition Wizard.

You can also import Windows Installer files with .msi extensions and Configuration Manager 2007 can build packages from the Windows Installer information.

For more information about the format of these files, see About the Package Definition File Format.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About the Package Definition File Format
About Packages


About the Package Definition File Format

Topic last updated—November 2007

Package definition files are scripts that you can use to help automate package creation with Configuration Manager 2007. They provide the essential information that Configuration Manager 2007 needs to distribute a particular type of file, except for the location of package source files. Each package definition file is an ASCII text file following a standard .ini file format and containing the following sections:

  • [PDF]
  • [Package Definition]
  • [Program]

[PDF]

This section identifies the file as a package definition file and contains the following information:

  • Version: Specifies the version of the package definition file format used by the file, corresponding to the version of System Management Server (SMS) or Configuration Manager for which they were written. This entry is required.

[Package Definition]

This section of the package definition file specifies the overall properties of the package and provides the following information:

  • Name: The name of the package, up to 50 characters. This entry is required.
  • Version: The version of the package, up to 32 characters. This entry is optional.
  • Icon: Specifies the file containing the icon to use for this package. If used, this icon will replace the default package icon in the Configuration Manager console. This entry is optional.
  • Publisher: The publisher of the package, up to 32 characters. This entry is required.
  • Language: The language version of the package, up to 32 characters. This entry is required.
  • Comment: An optional comment about the package, up to 127 characters.
  • ContainsNoFiles: This entry indicates whether or not a source is associated with the package.
  • Programs: Specifies the programs defined for this package. Each program name corresponds to a [Program] section in this package definition file. This entry is required.
    Example:
    Programs=Typical, Custom, Uninstall
  • MIFFileName: The name of the Management Information Format (MIF) file that contains the package status, up to 50 characters.
  • MIFName: The name of the package (for MIF matching), up to 50 characters.
  • MIFVersion: The version number of the package (for MIF matching), up to 32 characters.
  • MIFPublisher: The software publisher of the package (for MIF matching), up to 32 characters.

[Program]

For each program specified in the Programs entry in the [Package Definition] section, the package definition file must include a section that defines that program. The file must contain a [Program] section for all programs contained within that package. This section provides the following information:

  • Name: The name of the program, up to 50 characters. This entry must be unique within a package and is used when defining advertisements. On client computers, the name of the program is shown in Run Advertised Programs in Control Panel. This entry is required.
  • Icon: Specifies the file containing the icon to use for this program. If used, this icon will replace the default program icon in the Configuration Manager console and will be displayed on client computers when the program is advertised. This entry is optional.
  • Comment: An optional comment about the program, up to 127 characters.
  • CommandLine: Specifies the command line for the program, up to 127 characters. The command is relative to the package source folder. This entry is required.
  • StartIn: The working folder for the program, up to 127 characters. This entry can be an absolute path on the client computer or a path relative to the package source folder. This entry is required.
  • Run: Specifies the program mode in which the program will run. You can specify Minimized, Maximized, or Hidden. If this entry is not included, the program will run in normal mode.
  • AfterRunning: Specifies any special action that occurs after the program is completed successfully. Options available are SMSRestart, ProgramRestart, or SMSLogoff. If this entry is not included, the program will not run a special action.
  • EstimatedDiskSpace: Specifies the amount of disk space that the software program requires to run on the computer. This can be specified as Unknown (the default setting) or as a whole number greater than or equal to zero. If a value is specified, units for the value must also be specified.
    Example:
    EstimatedDiskSpace=38MB
  • EstimatedRunTime: Specifies the estimated time (in minutes) that the program is expected to run on the client computer. This can be specified as Unknown (the default setting) or as a whole number greater than zero.
    Example:
    EstimatedRunTime=25
  • SupportedClients: Specifies the processors and operating systems on which this program will run. Each platform must be separated by a comma. If this entry is not included with the package definition file, supported platform checking will be disabled for this program.
  • SupportedClientMinVersionX, SupportedClientMaxVersionX: Specifies the beginning and ending range for version numbers for the operating systems specified in the SupportedClients entry.
    Example:
    Copy Code
    SupportedClients=Win NT (I386),Win NT (IA64),Win NT (x64)
Win NT (I386) MinVersion1=5.00.2195.4
Win NT (I386) MaxVersion1=5.00.2195.4
Win NT (I386) MinVersion2=5.10.2600.2
Win NT (I386) MaxVersion2=5.10.2600.2
Win NT (I386) MinVersion3=5.20.0000.0
Win NT (I386) MaxVersion3=5.20.9999.9999
Win NT (I386) MinVersion4=5.20.3790.0
Win NT (I386) MaxVersion4=5.20.3790.2
Win NT (I386) MinVersion5=6.00.0000.0
Win NT (I386) MaxVersion5=6.00.9999.9999
Win NT (IA64) MinVersion1=5.20.0000.0
Win NT (IA64) MaxVersion1=5.20.9999.9999
Win NT (x64) MinVersion1=5.20.0000.0
Win NT (x64) MaxVersion1=5.20.9999.9999
Win NT (x64) MinVersion2=5.20.3790.0
Win NT (x64) MaxVersion2=5.20.9999.9999
Win NT (x64) MinVersion3=5.20.3790.0
Win NT (x64) MaxVersion3=5.20.3790.2
Win NT (x64) MinVersion4=6.00.0000.0
Win NT (x64) MaxVersion4=6.00.9999.9999
  • AdditionalProgramRequirements: Optional text that can include any other information or requirements for client computers, up to 127 characters.
  • CanRunWhen: Specifies the user status that the program requires to run on the client computer. Available values are UserLoggedOn, NoUserLoggedOn, or AnyUserStatus. The default value is UserLoggedOn.
  • UserInputRequired: Specifies whether the program requires interaction with the user to complete running. Available values are True or False. The default value is True. This entry is set to False if CanRunWhen is not set to UserLoggedOn.
  • AdminRightsRequired: Specifies whether the program requires administrative credentials on the computer to run. Available values are True or False. The default value is False. This entry is set to True if CanRunWhen is not set to UserLoggedOn.
  • UseInstallAccount: Specifies whether the program uses the Client Software Installation Account when running on client computers. By default, this value is False. This value is also False if CanRunWhen is set to UserLoggedOn.
  • DriveLetterConnection: Specifies whether the program requires a drive letter connection to the package files on the distribution point. You can specify True or False. The default value is False, which allows the program to use a Universal Naming Convention (UNC) connection. When this value is set to True, the next available drive letter will be used (starting with Z: and proceeding backward).
  • SpecifyDrive: Specifies a drive letter that the program requires to connect to the package files on the distribution point. Using this entry forces the use of the specified drive letter for client connections to distribution points. This entry is optional.
  • ReconnectDriveAtLogon: Specifies whether the computer reconnects to the distribution point when the user logs on. Available values are True or False. The default value is False.
  • DependentProgram: Specifies a program (in this package) that must run before the current program. This entry uses the format DependentProgram=<ProgramName>, where <ProgramName> is the Name entry for that program in the package definition file. If there are no dependent programs, leave this entry empty.
    Example:
    DependentProgram=Admin
    DependentProgram=
  • Assignment: How the program is assigned to users. This value can be FirstUser (only the first user who logs on runs the program) or EveryUser (every user who logs on to the client runs the program). When CanRunWhen is not set to UserLoggedOn, this entry is set to FirstUser.
  • Disabled: Specifies whether this program can be advertised to clients. Available values are True or False. The default value is False.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Packages
About Programs


About Programs

Programs are commands associated with a Configuration Manager package that tell a client what should occur on the client computer when the package is received. You can associate almost any activity with a program. For example, a program can be used to install new software on clients, distribute data files, run virus-detection software, or update client configuration.

Every package must contain at least one program, but you can specify more than one if needed. A package can often have several programs associated with it, allowing the package to be run in different ways on different clients. This is often the case when you are installing a new application on a client computer and want to create programs to perform either a typical, minimum, or custom installation.

While the package contains the application, files, or information that need to be applied to the client computers, the program is responsible for defining how that application is to be used. As a result, the program must include all appropriate references to script files or command switches. The program also defines the platform and environment in which the package can run, which means that you might have a program for each suitable platform when you have clients using different operating systems.

After you create a program for a given package, you can make that program and package available to a collection of clients using an advertisement. For more information about advertisements, see About Advertisements.

See Also

Tasks

How to Create a Program

Concepts

About Advertisements
About Packages

Other Resources

How to Manage Programs


About Distribution Points

Topic Last Updated—August 2008

Microsoft System Center Configuration Manager 2007 uses distribution points to store files needed for packages to run on client computers. These distribution points function as distribution centers for the files that a package uses, allowing users to download and run these files, programs, and scripts when a package is advertised.

To run advertised programs requiring files that do not reside on the local computer, clients must have access to at least one distribution point from which they can download or run those files. Therefore, you should specify for each package at least one distribution point for each site in which the target collection has members.

Note
If a package does not contain any files, you do not need to specify any distribution points for that package.

Types of Distribution Points

There is only one site role called distribution point, but you can configure the distribution point to support various functions. The following table describes the configurations which you can apply to distribution points.

Type | Description | Procedure
Server and server share distribution point | Determines how Configuration Manager 2007 creates and writes the packages and support files for the distribution point role. | How to Specify a Server Share Site System Installation Drive How to Designate a Distribution Point
Standard and branch distribution point | Branch distribution points are optimized for remote branch offices with limited connectivity. Any distribution point not configured as a branch distribution point is a standard distribution point. | How to Designate a Distribution Point How to Deploy a Branch Distribution Point
BITS-enabled distribution point | Allows clients to download content from the distribution point using Background Intelligent Transfer Service (BITS) to provide bandwidth throttling. | How to Configure a BITS-Enabled Distribution Point
Protected distribution point | Site systems hosting the distribution point and state migration point roles can be protected to prevent clients outside designated boundaries from accessing the site system. | How to Configure a Protected Distribution Point
Mobile device distribution point | Enables mobile device clients to download content from the distribution point. | How to Enable Distribution Points to Support Mobile Devices
Distribution point supporting Internet-based clients | Accepts connections from clients using the Internet FQDN for the site system. | How to Configure a Distribution Point for Internet-Based Client Connections
Application Virtualization streaming-enabled distribution point | Allows you to stream virtual applications to software distribution clients. | How to Enable Streaming for Virtual Application Packages
Multicast-enabled distribution point | Uses multicast to distribute operating systems. | How to Enable Multicast for Operating System Deployment

Some distribution point types are not compatible with other distribution point types. For example, a branch distribution point cannot support Internet-based clients. The following table shows which types of distribution points can be combined and which are mutually exclusive.

 | Server | Server share | Branch | Standard | BITS-enabled | Protected | Mobile Device | Supporting Internet-based clients | Streaming | Multicast
Server | n/a | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes
Server share | No | n/a | No | No | Yes | Yes | Yes | No* | Yes | No
Branch | Yes | No | n/a | No | No | Yes | No | No | Yes2 | No
Standard | Yes | No | No | n/a | Yes | Yes | Yes | Yes | Yes | Yes
BITS-enabled | Yes | Yes | No | Yes | n/a | Yes | Required | Required | Yes | Yes
Protected | Yes | Yes | Yes | Yes | Yes | n/a | Yes | Yes | Yes | Yes
Mobile device | Yes | Yes | No | Yes | Required | Yes | n/a | Yes | No | Yes
Supporting Internet-based clients | Yes | No1 | No | Yes | Required | Yes | Yes | n/a | Yes | No
Streaming | Yes | Yes | Yes2 | Yes | Yes | Yes | No | Yes | n/a | Yes
Multicast | Yes | No | No | Yes | Yes | Yes | Yes | No | Yes | n/a

1 Configuring a server share on a site system already configured to support Internet-based clients will cause content location requests to fail.

2 On branch distribution points, enable File Streaming to support streaming using server message blocks (SMB).

For more information about specific types of distribution points, see the following topics:

  • About Standard and Branch Distribution Points
  • About Protected Distribution Points
  • About BITS-Enabled Distribution Points

For information about planning distribution point functionality, see the following topics:

  • Choose Between a Standard and Branch Distribution Point
  • Choose Between a Server and Server Share Distribution Point
  • Decide Whether to Enable BITS on a Distribution Point
  • Decide Whether to Protect the Distribution Point
  • About Configurations for Multicast for Operating System Deployment

Distributing the Load

Two types of load are involved with distribution points: the server load incurred when clients access the server for packages and the network load incurred as clients download or run the package.

No specific load balancing is performed on the server load. When clients ask for package source files, Configuration Manager 2007 uses an algorithm to attempt to assign the distribution point closest to the client. However, the load already assigned to the distribution point is not considered, and the closest distribution point might not always be available. For more information, see Configuration Manager and Content Location (Package Source Files).

By default, the site server is configured as a distribution point. However, you should assign this role to other site systems and remove it from the site server. This serves to reduce the site server's resource requirements and improve its performance and also assists in load balancing.

Bandwidth Control

Bandwidth controls are in place only between sites and from a standard distribution point to a branch distribution point. Package transmissions between the site server and standard distribution points do not use any type of time or bandwidth control. If you need to distribute large packages, plan a time to copy them to standard distribution points when they will not place a large burden on the network.

When Configuration Manager 2007 updates the source files for a package and the source files have already been distributed, it sends only the parts of the package that have changed since the last time the package was sent. For more information, see About Binary Differential Replication.

The following table summarizes the bandwidth controls as packages move through the Configuration Manager 2007 system.

Package Movement | Bandwidth Control | Uses Binary Differential Replication?
From package source directory to site server | None. | No
From site server to standard distribution point | None. | Yes
From parent site server to child site server | Bandwidth controlled by Address settings on the sender between sites. | Yes
From child site server to child standard distribution point | None. | Yes
From standard distribution point to branch distribution point | BITS or manually pre-staged on the branch distribution point. For more information, see How to Prestage Packages on a Branch Distribution Point. | Yes
From standard distribution point to client | BITS, if BITS-enabled distribution point is available and advertisement is configured to download and run locally. | No
From branch distribution point to client | None. | No

If you need to create a new distribution points, you can run the Copy Packages Wizard to copy the packages on an existing distribution point to the new distribution point. The Copy Packages Wizard does not provide any bandwidth control, but you can run it during off-peak hours. For more information, see How to Copy Multiple Packages to One Distribution Point.

Microsoft Distributed File System for Distribution Points

There is limited support for Microsoft Distributed File System (DFS) in Configuration Manager 2007. Distribution points can be targets of a DFS root, but packages must be deployed to the shared folder on the distribution point, not to the DFS link name. Clients can use programs that point to <DFS root>\<DFS link>\<executable>.

Grouping Distribution Points

You can create groups of distribution points to facilitate the processes of copying packages to distribution points. Packages can then be targeted to a distribution point group rather than to individual distribution points. For example, you might create a group of distribution points enabled to support mobile device clients and copy packages for mobile device clients only to that distribution point group.

If you add a distribution point to an existing group, the new distribution point does not automatically receive packages previously copied to that group. However, the new distribution point will receive all new packages copied to the group.

Note
If you bring a new distribution point online and want to copy several existing packages to that distribution point, use the Copy Package Wizard. For more information, see How to Copy Multiple Packages to One Distribution Point.

About the Common SMS Package Share on Distribution Points

If you create a distribution point server and choose to use the common package share on distribution points when creating a package, Configuration Manager uses the SMSPKGx$ share on the drive on the distribution point server with the most free disk space (where x is the drive letter). If that share does not already exist, Configuration Manager creates it.

If you create the distribution point as a server share, the common package share is the shared folder created as the server share.

You can verify whether or not a package uses the common package share on distribution points by right-clicking Packages in the Configuration Manager console, clicking Properties, and then selecting the Data Access tab.

Caution
Do not place any files directly on the common package share. This share should be used only by Configuration Manager. If you want to share files on a server that is performing the distribution point role, a separate shared folder should be used.

Site servers also have a folder named SMSPKGSIG on drives used for distribution points. This folder is used to download signatures for Microsoft Remote Differential Compression for branch distribution points when performing binary delta downloads from distribution points. Standard distribution points have the SMSSIG$ folder, which contains the package signatures to be used for branch distribution points. SMSSIG$ is created on the drive with the most free space.

Supported Configurations

Having one site system function as a distribution point for multiple Configuration Manager 2007 sites is not supported. Placing the distribution point role in a site system in a different forest than the site server is supported only when the distribution point supports Internet-based clients.

Branch distribution points cannot be installed on client computers running the Windows°2000 Professional operating system or the Windows°2000 Server operating system.

Installing a branch distribution point on a standard distribution points is not supported.

See Also

Tasks

How to Send a Package to Distribution Points

Concepts

About Standard and Branch Distribution Points
How to Configure Distribution Points

Other Resources

How to Manage Distribution Points


About Standard and Branch Distribution Points

Topic Last Updated—August 2008

A branch distribution is intended to allow smaller or distributed offices to host a Microsoft System Center Configuration Manager 2007 distribution point on an existing client computer without requiring a secondary site to be set up. However, they can also be installed in secondary sites.

Branch distribution points provide an option for efficient package distribution to a small office with limited bandwidth. Branch distribution points function much like standard distribution points and can be assigned packages in the same way by using the Configuration Manager console.

A branch distribution point does not function entirely on its own and depends on a standard distribution point from which it receives its content. To function properly, a branch distribution must contact a BITS-enabled standard distribution. This is a distribution point that is configured with the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS. For more information about this configuration, see How to Configure a BITS-Enabled Distribution Point.

If the branch distribution point cannot download content from a standard distribution point, the branch distribution point will not function. The branch distribution point is instructed to download the packages it is assigned by using client policy and then uses standard client components to download the content. This content download does not use courier senders, which are used only for site-to-site communication.

Important
If the standard distribution point is configured as a protected site system, ensure that the protected boundaries of the standard site system include the branch distribution point. If the computer running the branch distribution point is excluded from the protected boundaries of the standard distribution point, it will not be able to install the packages that it needs.

The following illustration demonstrates a common layout for a branch distribution point, where the branch distribution point could be in the same primary site as the standard distribution point, or in a secondary site:

Branch Distribution Point Diagram

You can also have multiple branch distribution points in the same location, to help distribute the requests from clients to download package source files. If you protect these branch distribution points with the same protected boundaries, these branch distribution points effectively work as a group.

If you have branch distribution point in the same site as a standard distribution point, by default, clients will always download content from a BITS-enabled standard distribution point rather than the branch distribution point. This is because clients automatically select distribution points that are configured for BITS over distribution points configured for SMB. To ensure that clients prefer the branch distribution point, protect the branch distribution point site system and verify that it is configured with protected boundaries that contain the clients that you want to use the branch distribution point. Make sure that this boundary is not added to the standard distribution point, if that is also protected. For more information about content location behavior, see Configuration Manager and Content Location (Package Source Files).

Although a branch distribution point functions as a site system role, it is not intended to replace the role of a site server, management point, or software update point. Branch distribution points can be installed in a primary site and in a secondary site, and on either a server-class computer or a workstation-class computer. If you install a branch distribution point on a workstation rather than a server, this operating system has a limitation of 10 concurrent client connections.

Important
The branch distribution point is the only Configuration Manager site system that can be installed on a workstation-class operating system. If it is installed on Windows Server 2008, it must be the full installation of the operating system and not Server Core.

Unlike standard distribution points, branch distribution points cannot be placed on server shares. Branch distribution points also have the following requirements:

  • The computer is running the Configuration Manager client and is assigned to the site.
  • The computer is not a workgroup client.
  • The computer is not running Windows 2000.
  • The computer is not configured to use an Internet-based management point.

If any of these conditions are detected by Configuration Manager, the option to enable the branch distribution point will be disabled. For more information about installing a branch distribution point, see How to Deploy a Branch Distribution Point.

If you need help deciding whether to install a branch distribution point or a standard distribution point, see Choose Between a Standard and Branch Distribution Point. You can also convert an existing standard distribution point to a branch distribution point without having to delete the original standard distribution point and redeploy the packages. For more information, see How to Convert a Standard Distribution Point to a Branch Distribution Point.

Branch Distribution points can be distinguished from standard distribution points in the Configuration Manager console by referencing the Type column in the results pane for the selected site system. This column will display Branch or Standard for the ConfigMgr distribution point role, and the ConfigMgr site system role will always display Server, even when it is installed on a workstation computer.

Because branch distribution points use client policy to discover which packages are assigned to them, you might consider creating a collection for branch distribution points so that you can configure a shorter client polling interval for these computers by using the collection specific settings. For more information, see How to Configure the Client Policy Polling Interval for a Specific Collection.

Limited Network Bandwidth

To support possible bandwidth limitations, a branch distribution point can use the Background Intelligent Transfer Service (BITS) to limit network traffic when downloading packages from the standard distribution point. BITS enables administrators to control the transfer rates to the branch distribution point as well as providing a checkpoint restart of a package download. If a package download is interrupted or the connection is lost because of slow or unreliable network connections, the download can continue from the point of interruption. However, clients should have good network connectivity (fast and reliable) to the branch distribution point because clients always use server message blocks (SMB) and never HTTP or HTTPS connections to download packages from a branch distribution point.

Note
Even if you install the branch distribution point on a server with IIS installed and enable BITS, clients continue to use SMB to connect to the branch distribution point.

The configuration for BITS transfers between the branch distribution point and the standard distribution point is sent to the branch distribution point with the computer’s client policy. By default, these settings apply to branch distribution points only but can also be applied to all clients or can be disabled. Settings include throttling windows and maximum transfer rates. Be aware that these settings can be overridden by Group Policy. To configure these settings, select the BITS tab on the Computer Client Agent Properties dialog box. For more information about these settings, see Computer Client Agent: BITS Tab. For more information about the Group Policy options related to BITS, see the information about Background Intelligent Transfer Service Bandwidth Management from the Infrastructure section of Windows XP Service Pack 2 Feature Management Using Group Policy (http://go.microsoft.com/fwlink/?LinkId=124012).

Branch distribution points also provide an option that allows packages to be downloaded to the branch distribution point only after the package has been specifically requested by a client, allowing more efficient bandwidth management. For more information, see About On-Demand Package Distribution.

Administrators also have the option to prestage the package on branch distribution points. When prestaging a package, the administrator manually creates the directory and copies the files to the directory. Prestaging requires more administrative overhead but provides maximum control over bandwidth and timing. For example, an administrator can copy the files from the standard distribution point onto a USB drive, ship the drive to the branch location, and then copy the files onto the branch distribution, incurring no network bandwidth. Prestaging is not available for standard distribution points. For more information, see How to Prestage Packages on a Branch Distribution Point,

Space Considerations on Branch Distribution Points

Branch distribution points can receive copies of large packages from a standard distribution point that can take up large amounts of disk space on the branch distribution point computer. While this might not be a significant problem if the branch distribution point has been placed on a server-class computer dedicated to that purpose, many branch distribution points are placed on personal workstation computers. In this case, it is possible to fill up so much available space with Configuration Manager packages that normal workstation functions become difficult. To avoid this, branch distribution points have a setting to reserve space for the operating system rather than filling up all the available hard disk space. This setting is 50 MB by default, but at least 1 GB is recommended. You can also select a specific partition for the packages.

Note
Because of the reserved hard disk space, the branch distribution point can report an error condition indicating that it has no hard disk space available when it reaches the configured reserved limit, even though the computer itself has free disk space.

Just like standard distribution points (and other site systems), Configuration Manager will not install the branch distribution point component files on a drive that contains the file no_sms_on_drive.sms. For more information about the no_sms_on_drive.sms file, see How to Prevent Configuration Manager From Installing Files on a Specific Drive.

Security Concerns with Branch Distribution Points

The branch distribution point should be created on a computer with site system-like physical and network mobility, because it is actually a site system role and part of the site core infrastructure. Because of this, care should be taken to protect the branch distribution point from theft or tampering just as if it were a server. You can use a workstation computer as a branch distribution point, but allowing physical access to this computer might allow an attacker to compromise the content stored on the branch distribution point. If the program is downloaded before running, tampering will cause the signature check to fail and the client will discard the package. However, if the program is run from the distribution point, no package validation occurs and the client could run a modified package.

Additionally, site reassignment, client deinstallation, and roaming should not be common scenarios for a branch distribution point. When one of these scenarios in necessary, you should follow the guidelines to remove the branch distribution point role from the client first and then proceed with the other operations. For more information about removing branch distribution points, see How to Remove a Branch Distribution Point.

Because clients always connect to branch distribution points by using server message blocks (SMB), this client-to-site system communication cannot be secured by using native mode operation. However, because the branch distribution point is also a client, the branch distribution point communication to the standard distribution point will use native mode communication. For more information, see Client Communication in Mixed Mode and Native Mode and Benefits of Using Native Mode.

Although convenient for distributed offices, branch distribution points, like standard distribution points, require formal planning, deployment, change control, and monitoring processes.

Availability of Branch Distribution Points

If a branch distribution point is configured on a client workstation, you must educate whoever logs on to the workstation not to shut down or restart the computer when it might be needed by other users in the office.

If a branch distribution point is in a sleep state, clients do not send wake-up packets to the branch distribution point, so they will not be able to retrieve packages from the branch distribution point until it is online again.

Branch Distribution Points and Internet-Based Clients

Do not create branch distribution points on Internet-based clients. This combination is not supported by Configuration Manager and will be blocked. Because clients use SMB connections to branch distribution points, branch distribution points cannot accept client connections from the Internet.

Distribution Points and Configuration Manager 2007 R2 Features

Standard distribution points and branch distribution points support streaming virtual application packages. For more information, see About Virtual Application Packages.

Standard distribution points that are configured as server site systems support multicast for the operating system deployment feature. Branch distribution points and standard distribution points that are configured as server share site systems do not support multicast. For more information about multicast, see About Multicast for Operating System Deployment.

See Also

Concepts

About Distribution Points

Other Resources

How to Configure Branch Distribution Points
How to Manage Branch Distribution Points


About Protected Distribution Points

Topic last updated—November 2007

Protecting a Microsoft System Center Configuration Manager 2007 site system means that clients outside of the protected boundaries will not be able to access the distribution point or state migration point roles on that site system. Protection is applied to the entire site system, not to the properties of the site role. However, protection has no effect on any site system roles except distribution points and state migration points.

Fallback to Unprotected Distribution Points

Protecting the distribution point does not necessarily prevent clients inside the protected boundaries from accessing content from an unprotected distribution point. If the package is not present on a protected distribution point, the client might fall back to using an unprotected distribution point, depending on how you configure your advertisement for each package and how much time has elapsed. If the distribution point has been offline or has not been provisioned for more than eight hours, and if you select the setting Allow clients to fallback to unprotected distribution points when the content is not available on the protected distribution point, clients can receive content from unprotected distribution points.

The following table shows the how the advertisement configuration works depending on whether the content is available on the protected distribution point.

Scenario Option: Do not allow clients to fall back to unprotected distribution points when the content is not available on the protected distribution point. Option: Allow clients to fall back to unprotected distribution points when the content is not available on the protected distribution point.

At least one distribution point meets the following criteria:

  • Is added to the package
  • Is in the protected boundary of the client
  • Is online and accessible
  • Is either a standard or a branch distribution point

Only protected distribution points are returned. The client downloads the package from the protected distribution point.

Protected distribution points are returned if the content is present on the distribution point.

If the content is not present on the distribution point, any unprotected distribution points that contain the content are returned.

If no unprotected distribution points contain the content, the client fails with the message "Content is not available."

  • One or more standard distribution points meet the following criteria:
    • Is in the protected boundary of the client
    • Is online and accessible
  • The protected standard distribution points are not added to the package.
  • No branch distribution points are in the protected boundary of the client.

No distribution points are returned. The client fails with the message "Content is not available."

Any unprotected distribution points that contain the content are returned.

If no unprotected distribution points contain the content, the client fails with the message "Content is not available."

  • One or more branch distribution point meet the following criteria:
    • Is in the protected boundary of the client
    • Is online and accessible
  • The protected branch distribution points are not added to the package.
  • The package is configured for on-demand package distribution.

The management point sends a message to Distribution Manager to add the protected branch distribution point to the package.

The client downloads the package from the protected branch distribution point.

When the next client in the boundaries of the protected distribution point requests content location, the protected branch distribution point is returned.

The management point sends a message to Distribution Manager to add the protected branch distribution point to the package. Future content location requests should return the protected branch distribution point.

If the content is not present on the protected branch distribution point, any unprotected distribution points that contain the content are returned.

The client downloads the package from either the protected branch distribution point or the unprotected distribution point.

  • One or more branch distribution points meet the following criteria:
    • Is in the protected boundary of the client
    • Is online and accessible
  • The protected branch distribution points are not added to the package.
  • The package is not configured for on-demand package distribution.
  • No standard distribution points are in the protected boundary of the client.

No distribution points are returned. The client fails with message "Content is not available."

No distribution points are returned. The client fails with the message "Content is not available."

  • The distribution point meets the following criteria:
    • Is added to the package
    • Is in the protected boundary of the client
    • Is either a branch or a standard distribution point
  • The distribution point is not online and accessible.

Only protected distribution points are returned. After eight hours, the client fails with the message "Content is not available."

Only protected distribution points are returned. After eight hours, the client fails with the message "Content is not available."

Examples

In the following diagram, the subnet 192.168.11.0 is in a branch office in Naperville but is part of the Chicago site. The branch distribution point in the branch office is protected so that only clients in 192.168.11.0 can access it. The standard distribution point in the main office is not protected. Clients on the network 192.168.10.0 cannot access packages on the protected branch distribution point on 192.168.11.0. The default configuration for an advertisement is to Allow clients to fallback to unprotected distribution points when the content is not available on the protected distribution point. So clients on the 192.168.11.0 network can get the package from either distribution point. If you change the setting, the clients in 192.168.11.0 will attempt to retrieve the package only from the protected branch distribution point, even if the package has not been copied to that distribution point. (If you configure the package for on-demand package distribution, the management point will notify Distribution Manager to copy the package to the distribution point.) If a client from ORD roams to the LON site and an advertised package is not available on the LON distribution point, the client can fall back to using the distribution point on 192.168.10.0 (assuming the package is copied to that distribution point), but it can never access the protected distribution point because it is not on the 192.168.11.0 network.

graphic showing protected Chicago site

It is possible to protect every distribution point in the site, but doing so eliminates the redundancy provided by multiple distribution points. In the following diagram, if the distribution point in Milpitas is unreachable, the clients in the Milpitas branch office cannot retrieve the content because all other distribution points are protected.

graphic showing all protected distribution points

See Also

Tasks

How to Configure a Protected Distribution Point

Concepts

About Distribution Points
Configuration Manager and Content Location (Package Source Files)
Content Location Flowchart for Distribution Point Selection
Decide Whether to Protect the Distribution Point


About BITS-Enabled Distribution Points

Topic last updated—November 2007

If you have configured the Microsoft System Center Configuration Manager 2007 distribution point as a standard distribution point, you can choose to enable the distribution point for Background Intelligent Transfer Service (BITS). However, enabling BITS does not guarantee that the client will always download content from the distribution point using BITS. For example, if an advertisement is configured to run from the distribution point, the client computer always uses server message blocks (SMB) instead of BITS. Also, mobile device clients require that the distribution point be BITS-enabled, but they do not actually use BITS when downloading content.

Using BITS-enabled distribution points helps control bandwidth throttling between client computers and distribution points. Also, when a computer is downloading from a BITS-enabled distribution point and is interrupted, it can resume where it left off, even if the client computer connects to a different distribution point.

Note
BITS is never used to transfer content from the site server to the distribution point. The site server always uses SMB to copy packages to distribution points and does not use any throttling or fault tolerance.

A BITS-enabled distribution point must have Internet Information Services (IIS) installed and WebDAV enabled.

BITS-Enabled Distribution Points and Multiple Virtual Directories

If the distribution point is BITS-enabled, Configuration Manager 2007 creates virtual directories for BITS downloading. If you did not configure a custom Web site on the site server properties, the virtual directories are created under the Default Web Site. The virtual directories that Configuration Manager 2007 creates depend on the distribution point and package configuration.

Mixed Mode

In mixed mode, when the distribution point is a server instead of server share, the following virtual directories are created:

  • SMS_DP_SMSSIG$
  • SMS_DP_SMSPKG<driveletter>$

When the distribution point is a server share, instead of the SMS_DP_SMSPKG<driveletter>$ virtual directory, Configuration Manager 2007 creates SMS_DP_<sharedfolder>, where sharedfolder is the name of the folder created for the server share.

If you create a custom shared folder for a package, an additional virtual directory is created called SMS_DP_<CustomShare>.

In mixed mode, client computersare authenticated using Windows authentication.

Native Mode

In native mode, if the distribution point is configured to support intranet clients, the following virtual directories are created on distribution point servers:

  • SMS_DP_SMSSIG$
  • SMS_DP_SMSPKG<driveletter>$
  • NOCERT_SMS_DP_SMSPKG<driveletter>$
  • NOCERT_SMS_DP_SMSSIG$

When the native mode distribution point is a server share, Configuration Manager 2007 creates SMS_DP_<sharedfolder> and NOCERT_SMS_DP_<sharedfolder>, where sharedfolder is the name of the folder created for the server share.

If you create a custom shared folder for a package, the following additional virtual directories are created:

  • SMS_DP_<CustomShare>
  • NOCERT_SMS_DP_<CustomShare>

Clients accessing the NOCERT_SMS_DP virtual directory, such as NOCERT_SMS_DP_SMSPKG<driveletter>$, are authenticated using Windows authentication. Clients accessing the SMS_DP_ virtual directory, such as SMS_DP_SMSPKG<driveletter>$, are authenticated based on their native mode client authentication certificates.

If the distribution point is configured to support only Internet-based clients, the NOCERT_SMS_DP virtual directories are not created and authentication can occur only by using certificates.

Certificate Authentication in Native Mode

For a client to authenticate using the certificate, the authenticating entity must have access to the private key of the client authentication certificate. For example, if the advertisement is run on a schedule with no user logged on, the Local System account has administrative rights and can access the private key of the computer's authentication certificate. However, if a program is advertised to and initiated by a user and that user does not have administrative rights on the computer, the user cannot access the private key of the computer's authentication certificate, assuming the certificate store has the appropriate permissions.

Content Location Requests on the Intranet

When an intranet-only client issues a content location request, the management point returns the virtual directories as though they are separate distribution points. The client evaluates the content location response and selects a distribution point as described in Configuration Manager and Content Location (Package Source Files). While a client might prefer one distribution point over another based on several factors, at a certain point the client will choose randomly from distribution points that meet the same criteria.

In native mode, this means that it is not possible to predict whether the client will connect to the SMS_DP or the NOCERT_SMS_DP virtual directory on a given distribution point. If the client cannot access the package content by using the SMS_DP virtual directory, it will attempt to access the content again by using the NOCERT_SMS_DP virtual directory, and vice versa. If multiple distribution points are returned and are sorted into the same category, it is possible for the client to connect to the SMS_DP_SMSPKG<driveletter>$ on one distribution point, fail to access the content, and then attempt to connect to the NOCERT_SMS_DP_SMSPKG<driveletter>$ virtual directory on a different distribution point.

Content Location Requests from the Internet

When an Internet-based client makes a content location request, the management point returns only the SMS_DP virtual directory on that distribution point, provided that distribution point has been configured to support Internet clients. If the client is unable to authenticate using the client authentication certificate, the client fails to receive the content because Internet-based clients do not receive the NOCERT_SMS_DP virtual directory. If the program is initiated in the context of a user who is not an administrator, the user cannot access the computer certificate's private key and cannot be authenticated by the distribution point, and the advertisement fails. If the program is initiated by a schedule, the Local System account runs the program and can access the computer certificate's private key to authenticate with the distribution point.

See Also

Tasks

How to Configure a BITS-Enabled Distribution Point

Concepts

Decide Whether to Enable BITS on a Distribution Point


About On-Demand Package Distribution

Topic last updated—November 2007

In Microsoft System Center Configuration Manager 2007, by default, branch distribution points normally receive packages in the same way that standard distribution points do. When an administrator selects the distribution points to which a package will be copied, branch distribution points can also be selected at that point. When this is done, branch distribution points selected will download the package just as a standard distribution point would.

However, the administrator can specify that the package should not be downloaded from the standard distribution point to the branch distribution point until it is requested by a client computer. This preserves bandwidth in the following ways:

  • The package is not transferred to the branch office until at least one client requests the package.
  • When the package is transferred to the branch distribution point, it uses Background Intelligent Transfer Service (BITS) instead of server message blocks (SMBs).

This option is called on-demand package distribution. This functionality is set on a package-by-package basis, using either the New Package Wizard (when a package is first created) or the Package <Name> Properties dialog box (for existing packages).

Important
On-demand package distribution is available only for protected branch distribution points and only from clients within the protected boundaries. If a client is not within those protected boundaries or the branch distribution point is not protected, on-demand distribution will fail.

If a package has been set to allow on-demand package distribution, the client that wants to receive the advertised program sends a standard request for the program to its branch distribution point. If the branch distribution point has downloaded the program already, it will be provided to the client. (This might be because the program was originally copied to the branch distribution point or because it previously went through the on-demand process, which stores a copy of the package on the branch distribution point.)

When the client asks the management point for content location, if the package is configured for on-demand package distribution and is copied to a branch distribution point, the management point includes the branch distribution point on the list but indicates that the content is pending. The pending designation creates an advertisement to send the package to the branch distribution point, but like any advertisement, the branch distribution point does not receive the advertisement until the next policy polling interval. After the branch distribution point receives the advertisement, it sends its own content location request and then downloads the content.

On-demand package distribution is transparent to the client; however, the client might experience a delay in receiving the package depending on the following factors:

  • The size of the package
  • The available bandwidth to the branch office
  • How frequently the branch distribution point client component checks for policy
  • BITS throttling settings

On-demand package distribution is a good choice if you have packages that might be needed by only a few clients at the branch office. However, if you have packages that require urgent distribution, such as critical software updates, consider the possible package delay before marking the package for on-demand package distribution.

Another way to preserve bandwidth to the branch office is to prestage the content on the distribution point by using an out-of-band process. For more information, see How to Prestage Packages on a Branch Distribution Point.

If you use a long polling interval for client policy retrieval, you can enable a collection-specific policy polling interval on a collection and add your branch distribution points to that collection. For more information, see Collection Name Settings: Advanced Tab.

Note
Packages created using the Distribute Software Wizard cannot have on-demand distribution set when the package is created. For these packages, it must be set by using the Package <Name> Properties dialog box.

See Also

Tasks

How to Configure On-Demand Package Distribution to a Branch Distribution Point

Reference

Computer Client Agent: BITS Tab

Concepts

About Standard and Branch Distribution Points


About Advertisements

Once a software distribution package has been created, along with programs to tell client computers what to do with the package, you need to advertise the program that you want the clients to run. Advertising the program makes a program available to a specified collection of clients.

Advertisements are evaluated by Configuration Manager to determine which clients will receive a specific program to run on their computers. An advertisement specifies the following information:

  • The specific program to run on the client. (For more information, see About Programs.)
  • The target collection of computers, users, or user groups that to receive the program. (For more information, see About Collections.)
  • The schedule that specifies when the program is available to clients. In the case of assigned (mandatory) advertisements, additional options such as Wake On LAN and ignoring maintenance windows may be used in conjunction with this schedule. For more information, see How to Assign a Mandatory Advertisement.

The site's clients will not be able to receive advertised programs until you enable the software distribution client agent on the site's clients. The Advertised Programs Client Agent performs the necessary software distribution-related tasks on these clients, primarily allowing the clients to receive and run the programs that you advertise.

See Also

Tasks

How to Create an Advertisement
How to Assign a Mandatory Advertisement

Concepts

About Collections
About Programs

Other Resources

How to Manage Advertisements


About Binary Differential Replication

Binary Differential Replication, sometimes known as "delta replication," is used by Configuration Manager 2007 to update package source files with a minimum of additional network traffic.

When Configuration Manager 2007 updates the source files for a package, and the source files have already been distributed, it sends the parts of the package that have changed since the last time the package was sent (originally, as an update, or as a refresh). This minimizes the network traffic between sites, especially when the package is large and the changes are relatively small. A file is considered to be changed if it has been renamed, moved, or its contents have changed.

The originating site keeps the differences between the current version of a package and the previous five versions. If a child site or distribution point has one of the previous five versions of the package, the originating site will send the appropriate changes to that site. If the child site has an older version of the package, the originating site will send the entire package.

If the originating site sends the changed files for a package but the receiving site no longer has the package, or the package has been altered at that site, the receiving site will send a status message to the originating site reporting the problem.

Note
In order for Configuration Manager 2007 to use binary differential replication, all receiving sites must first have received at least the initial version of the package. Until all receiving sites have the initial version, Configuration Manager 2007 will not use differential replication.

Care should be taken when distributing changes to a package's source files. If the path to a receiving site is closed, it is important that you not attempt to update the distribution point multiple times before the site address is again available. Each update will include the files from the previous update because the receiving sites will not yet have the previous update. As a result, the updates will include multiple redundant files, wasting network bandwidth.

Note
The processing time for large packages can take an extended period of time (20-30 minutes in some cases or even longer, depending on the size of the package). During this package compression/decompression and hashing/signature-creating process, distmgr.log might appear to be idle, even though the process is continuing.

See Also

Tasks

How to Modify a Package

Concepts

About Standard and Branch Distribution Points


About Package Access Accounts

By default, when Configuration Manager 2007 creates the package share on a distribution point, it grants Read access to the local Users group and Full Control to the Administrators group. However, it is often useful to exercise greater control over who can access the packages on this share, and package access accounts provide that means.

Package access accounts enable you to set permissions to specify the users and user groups that can access a package folder. In this way, if packages contain sensitive data or should otherwise have restricted access, you can configure package access accounts to limit access to specific users and user groups. If a client does not have sufficient rights to the package folder, the advertised programs within the package will not run.

Note
When adding a new access account or modifying an existing one, it's highly recommended that you refresh all distribution points associated with your package to ensure that the current access account information will be propagated to each distribution point.

Two types of access accounts are available:

  • Windows User Access Accounts- This account defines a Windows User or group account and specifies the level of permissions assigned. Windows User access accounts are specified using the Windows Account dialog box.
  • Generic Access Accounts- This account defines additional or replacement user, guest, or administrator accounts and specifies the level of permissions assigned, mapping them to an operating system-specific account. Generic access accounts are specified using the Generic Account dialog box.

The following permissions can be specified for users and user groups:

Permission | Description
No Access | Prevents the account from reading, writing, or deleting files on the package share.
Read | Enables the account to view and copy files, run programs, change folders within the shared folder, and read extended attributes of files.
Change | Enables the account to change the contents and extended attributes of files and to delete files. Change permission is required for applications that need to write information back to the shared package folder on the distribution point.
Full Control | Enables the account to view or change the contents and extended attributes of files. This includes all rights specified by both the Read and Change permissions.
Important
If you remove the Administrators default account, Configuration Manager 2007 components cannot update and modify the package data.

See Also

Tasks

How to Delete a Package Access Account
How to Modify a Package Access Account
How to Specify a Package Access Account

Concepts

About Packages
Generic Account Dialog Box
Windows Account Dialog Box


About the Role of Collections in Distributing Software

Fundamental to Configuration Manager's software distribution process is the use of collections to manage resources within a site. Using these collections allows you to group your clients (and other resources) together and control when and to whom software packages are distributed, based on the membership rules designated for that collection. For more information about collections, see About Collections.

To distribute a software package to clients, you must specify a collection, which is then used by Configuration Manager as a set of clients to which the program will be advertised.

Subcollections provide you with the ability to link collections together for better resource management. This can be especially useful when a particular collection of resources can be further divided into smaller units, which can then become subcollections. For more information about subcollections, see About Subcollections.

See Also

Concepts

About Collections
About Subcollections
About Membership Rules


About Virtual Application Packages

Topic last updated—March 2008

Configuration Manager 2007 supports running sequenced applications created using the Microsoft Application Virtualization Platform. Virtual application packages run on Configuration Manager 2007 client computers without having to install the software application on the local computer. Target computers must be running Windows XP or above to run virtual application packages.

After you create a sequenced application using the Microsoft Application Virtualization Sequencer, you must import the package into Configuration Manager 2007 and deploy the virtual application package to Configuration Manager 2007 clients.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Terminology for Virtual Application Packages

The following terms are used to describe virtual application packages and the components of virtual application packages.

Application Virtualization Streaming enabled distribution point

A Configuration Manager 2007 distribution point that has been enabled to stream virtual application packages to Configuration Manager 2007 clients.

Microsoft Application Virtualization Desktop Client

An application that resides on a Configuration Manager 2007 client computer running Windows XP or Windows Vista that communicates and authenticates with the Configuration Manager 2007 site to receive the virtual application package and allows a sequenced application to be run locally.

Microsoft Application Virtualization platform

The name for the Microsoft products that are used to create, store, distribute, and run sequenced applications.

Microsoft Application Virtualization Terminal Services Client

An application that resides on a Terminal Server and communicates and authenticates with the Configuration Manager 2007 site to receive the virtual application package and allows a sequenced application to be run locally.

Sequenced application

An application that has been created by the Microsoft Application Virtualization Sequencer, streamed to a computer running the Microsoft Application Virtualization Terminal Services Client or the Microsoft Application Virtualization Desktop Client, and that can run inside of its own virtual environment.

Sequencing

The process of creating an application package by using the Microsoft Application Virtualization Sequencer. In this process, an application is monitored, its shortcuts are configured, and a sequenced application package is created containing the .osd, .sft, .sprj, and .ico files.

Streaming

The process of running a virtual application packages from an Application Virtualization Streaming-enabled distribution point.

Virtual Application Package

A Microsoft application virtualization sequenced application that has been imported into Configuration Manager 2007.

Importing a New Virtual Application Package

To deploy a virtual application package to Configuration Manager 2007 clients, you must import a Microsoft Application Virtualization sequenced application into Configuration Manager 2007. When you import a virtual application into Configuration Manager 2007 the associated XML file is used to provide information about the virtual application and the Name and Version is assigned to the Configuration Manager 2007 virtual application package properties. Although the Name and Version fields are populated by the associated XML file, these fields can be updated. The XML file is a manifest of the virtual application and also contains additional information associated with the package. The .sft file name is also changed and any associated .osd files are configured to reference the new .sft file.

Before you import a new sequenced application into Configuration Manager 2007 you should create a source and destination directory. You can assign any name to the source and destination directories. The source directory should contain the sequenced application created using the Microsoft Application Virtualization Sequencer. You can use the New Virtual Application Package Wizard to specify the sequenced application source directory location. The source location can be one of the following:

  • The network location specified when the virtual application was initially sequenced.
  • The network location where an existing virtual application is currently saved.

The destination directory is the location where the sequenced application will be saved in Configuration Manager 2007.

Note
The Destination directory must be a different directory than the Source directory. When you import a virtual application all files in the specified Destination directory will be overwritten with the new files.

Virtual application packages in the destination folder can be distributed to distribution points and deployed to Configuration Manager 2007 clients. Only virtual application packages that have been imported into a destination folder using the New Virtual Application Package Wizard can be distributed to Configuration Manager 2007 clients. For more information about importing a virtual application package, see How to Import Virtual Application Packages into Configuration Manager.

After you have successfully completed the New Virtual Application Package Wizard, the new virtual application package object is visible in the results pane of the Configuration Manager console when you select Packages under the Software Distribution node.

Virtual Application Package Software Components

Virtual application packages are able to run regardless of which applications have been installed on the target computer. The required software applications are included in the virtual application package. When you import a virtual package into Configuration Manager 2007, all applications associated with the virtual package are displayed on the Package Properties page of the New Virtual Application Package Wizard.

Virtual application packages do not have associated programs like standard Configuration Manager 2007 software packages. The required programs are contained within the virtual application package therefore you do not need to specify programs when you distribute virtual application packages.

Preparing a Configuration Manager Client to Run Virtual Application Packages

For Configuration Manager 2007 clients to run virtual application packages, you must enable the advertised programs client agent . For more information about enabling the advertised programs client agent for running virtual application packages, see How to Configure the Advertised Programs Client Agent for Running Virtual Applications.

The advertised programs client agent determines which advertised virtual application packages are appropriate for the client or the user. When an advertisement is found and the package is ready to run, the agent connects to an available distribution point to download and run the package locally or runs the package directly from the distribution point. If you configure virtual application packages to download and run locally on the target computer they will be stored in the Configuration Manager 2007 client cache. The default Configuration Manager 2007 client cache size is 5 GB. You should increase the default cache size depending on the size and amount of virtual application packages you deploy in your Configuration Manager 2007 environment. For more information about configuring the Configuration Manager 2007 client cache see How to Configure the Temporary Program Download Folder (Cache) for Configuration Manager Clients. Only the most recent version of each virtual application package will reside in the client cache. When a newer version of a virtual application package is started, any previous version of the virtual application package is then deleted and the newer version is stored in the client cache. When a virtual application is deleted the virtual application package is also deleted from the client cache.

The advertised programs client agent also controls how clients check for advertised packages and how they behave when an advertised package is available or scheduled to run. By configuring the advertised programs client agent, you can specify these client behaviors as well as other client settings and run options.

You must also install the Configuration Manager 2007 SP1 client software and the Microsoft Application Virtualization Desktop 4.5 client for target computers to run virtual application packages. For more information about installing Configuration Manager 2007 client software, see Tasks for Installing Configuration Manager Clients and How to Install the Microsoft Application Virtualization Client. Target computers must be running Windows XP and above or Windows Server 2003 and above to run virtual application packages.

If you use the Install Software task sequence step to deploy a virtual application package and configure the advertisement to Download on Demand, the Configuration Manager 2007 will not maintain the virtual application package in the Configuration Manager 2007 client cache.

Enabling Virtual Application Package Streaming

If you want to run virtual application packages directly from a distribution point, you must enable an accessible distribution point for streaming virtual application packages. When you enable streaming, virtual application packages are saved in the Configuration Manager 2007 package share and any existing virtual application packages located on the distribution point are refreshed with the latest version. Configuration Manager 2007 clients will run assigned virtual application packages directly from the distribution point across the network until the virtual application package has been cached on the target computer.

Note
Virtual application package streaming to Configuration Manager 2007 workgroup clients is not supported.

When streaming is enabled, a separate copy of the associated virtual application package .sft file is saved in the streaming cache location so the original package source can be updated without having to disconnect active streaming sessions. When you disable streaming for a distribution point all copies of the .sft file are deleted from the streaming cache location. Configuration Manager 2007 clients require a connection to a Configuration Manager 2007 distribution point to stream virtual application packages. For more information about enabling distribution points for streaming, see How to Enable Streaming for Virtual Application Packages. Streaming is also supported for Configuration Manager 2007 clients assigned to a branch distribution point. For more information about branch distribution points see How to Configure Branch Distribution Points

Important
Configuration Manager 2007 clients assigned to a branch distribution point run virtual application packages using SMB file streaming regardless of the Configuration Manager 2007 site mode.

Configuration Manager 2007 clients connect to, and run virtual application packages from distribution points using port 80 (HTTP) in mixed mode environments, and port 443 (HTTPS) to stream virtual application packages in native mode environments. However, target computers will connect and run virtual application packages from branch distribution points using SMB. The following table displays how target computers will connect and run virtual application packages depending on the Configuration Manager 2007 site mode:

Distribution Point Type | Default Port, protocol
Standard distribution point in a mixed mode environment | 80, HTTP
Standard distribution point in a native mode environment | 443, HTTPS
Branch distribution point in a mixed mode environment | SMB
Branch distribution point in a native mode environment | SMB

Streaming virtual application packages with .sft file less than 1 kb is not supported.

Note
If you plan to have only target computers download and run virtual application packages, you are not required to configure a distribution point for streaming.

Advertising a Virtual Application Package

You can advertise a virtual application package to any Configuration Manager 2007 collection. By default, virtual application packages are also made available to associated subcollections. Each target computer in the collection will receive the advertisement and all required applications are contained in the virtual application package

The Configuration Manager 2007 client will use normal Configuration Manager 2007 client polling methods to locate the advertisement. For more information about Configuration Manager 2007 client polling methods, see How to Initiate Policy Retrieval for a Configuration Manager Client.

You can also use a task sequence to deploy a virtual application package. When you use a task sequence to deploy a virtual application package, you do not need to specify a program that will be associated with the package as all required programs are included with the virtual application package. For more information about installing software using a task sequence, see How to Install Software Packages as Part of a Task Sequence. When you select a virtual application package to install as part of the task sequence, the associated Program line will not be available. You must also advertise the virtual application package task sequence. If you plan to stream the virtual application package select Access content from a distribution point when need by running task sequence when advertising the task sequence. If you plan to have target computers run virtual application packages locally select Download all contents locally before starting the task sequence or Download content locally when needed by running task sequence. If you select Download all contents locally when needed by running task sequence the Configuration Manager 2007 task sequence will download the virtual application package to a temporary cache location on the target computer, register the virtual application package, load the package into the Microsoft Application Virtualization (App-V) cache and delete the package from the temporary cache location. To use this option the App-V RequireAuthorizationIfCached registry entry must be disabled.

Running a Virtual Application Package

A virtual application package can run directly from a distribution point, which is known as streaming, or you can configure the virtual application package advertisement to require the Configuration Manager 2007 client to download and run the application locally.

If you plan to stream virtual application packages from a distribution point, you should consider the available bandwidth because the application will be accessed and run across the network. Streaming virtual application packages to target computers connected to the network by way of a slow connection is not supported. Additionally, if you plan to configure the advertisement for the virtual application package to download to the Configuration Manager 2007 client and run locally, you must ensure that sufficient space is available in the Configuration Manager 2007 client cache to save the virtual application package.

If you plan to run a virtual application package that requires dynamic suite composition you must configure the virtual application package advertisement to Download content from distribution point and run locally. Dynamic suite composition is a Microsoft Application Virtualization platform feature that enables a virtual application package to allow dependent plug-ins or middleware packages installed on the local computer to use the virtual environment.

Updating a Virtual Application Package

You can update virtual application packages that have been imported into Configuration Manager 2007 to a new version of the application or to apply service packs or software updates. However, if you want multiple versions of the same application you must create a new sequenced application and import the application into Configuration Manager 2007. When a virtual application package is updated Configuration Manager 2007 evaluates the data source for the package and makes the necessary file updates to the advertised application. Configuration Manager 2007 clients must restart the virtual application for the updated version to be available. For more information about updating a virtual application package, see How to Update an Existing Virtual Application Package.

Deleting a Virtual Application Package

To delete a virtual application package you must select Remove this virtual application package when it is no longer advertised on the General page of the New Virtual Application Package Wizard. You can then delete a virtual application package from Configuration Manager 2007 clients by deleting the associated advertisement. Removing the advertisement from the collection it was assigned to will remove the virtual application package from all computers in the collection that received the advertisement.

Note
When you uninstall Configuration Manager 2007 R2, existing virtual application packages are not deleted from target computers and distribution points.

If you want to remove the package from one computer, you must remove the computer from the collection that receives the advertisement. For more information about removing a virtual application package, see How to Delete a Virtual Application Package from a Configuration Manager Client.

Virtual Application Package Tools

The following list displays the name and brief description of tools that are available to help manage virtual application packages in your Configuration Manager 2007 environment. By default, these files are located in the following directory: <ConfigMgrInstallationPath> \ SMS \ Tools \ VirtualApp.

  • ManageVAppPackage.vbs – Use the ManageVAppPackage.vbs file to update an existing virtual application package or to import a new virtual application.
  • SetRetensionRules.vbs – Use the SetRetensionRules.vbs file to configure the retention policy for virtual application packages in Configuration Manager 2007.
  • AppVirtMgmtClient.sms – Use the AppVirtMgmtClient.sms file to create a Configuration Manager 2007 package to install the App-V client.
  • AppVirtMgmtSequencer.sms – Use the AppVirtMgmtSequencer.sms to install the App-V sequencer into your Configuration Manager 2007 environment.

For more information about using these tools see the Configuration Manager 2007 Virtual Application Package Tool ReadMe which can be viewed by opening the file VAppPackageToolsReadme.htm located in the <ConfigMgrInstallationPath> \ SMS \ Tools \ VirtualApp directory.

Virtual Application Package Reports

There are seven virtual application package reports that retrieve data about virtual application packages in Configuration Manager 2007. The following list displays the Name and associated Category for each report:

  • Computers with a specific virtual application – Virtual Applications
  • Count all instances of virtual application packages – Virtual Applications
  • Computers with a specific virtual application package – Virtual Applications
  • Count all instances of virtual applications – Virtual Applications
  • All distribution points with virtual application streaming enabled – Software Distribution - Packages
  • All virtual application packages in the streaming store of a distribution point - Software Distribution - Packages
  • Streaming store distribution status of a specific virtual application package – Software Distribution - Packages

You can use these reports to obtain virtual application package usage and distribution information in your Configuration Manager 2007 environment. For more information about virtual application reports see About Feature Reports for Software Distribution.

See Also

Other Resources

How to Configure Virtual Application Components


About Windows Installer Source Location Manager

Topic last updated—November 2007

When you install an application using Windows Installer, those Windows Installer applications try to return to the path they were installed from when they need to install new components, repair the application, or update the application. This location is called the Windows Installer source location. Windows Installer Source Location Manager can automatically search Configuration Manager 2007 distribution points for the source files, even if the application was not originally installed from a distribution point. To enable Windows Installer source location, you configure the Windows Installer tab on the program properties in Configuration Manager 2007 packages.

Important
The Windows Installer Source Location Manager was designed and tested for a maximum of 1000 Windows Installer programs. Configuring the Windows Installer tab increases the policy size for all clients. Configuring more than 1000 Windows Installer programs can degrade client performance.

Scenarios Addressed by Windows Installer Source Location Manager

Problem Scenario 1: A user installs Microsoft Office from a CD. The user chooses Minimal installation, yet no longer retains the original installation CD. On first use of the speech tools, Windows Installer prompts the user to insert the Microsoft Office CD so that it can find the speech tools files. The user does not know the location of the Microsoft Office files and is unable to complete the speech tools installation.

Problem Scenario 2: A user installs Microsoft Office from a CD. The Contoso Company uses Configuration Manager 2007 to manage its Office security updates. When Windows Installer attempts to apply the security update, it requests files from the original CD. The user might or might not know the location of the files, and the security update might not be applied.

Problem Scenario 3: A network share is used as the installation location for a Windows Installer product. Some time after computers have installed the product from that share, the computer hosting the share is decommissioned or fails and is no longer on the network. When Windows Installer attempts to reconnect to that server, it will fail and display a dialog box to the user prompting for the original source files.

Definitions

The following terms relate to Windows Installer source location management.

Windows Installer

Refers to the Windows Installer technology for bundling applications and providing a simplified and programmatic installation experience.

MSI

Acronym for Microsoft Installer. Equivalent in meaning to Windows Installer.

Product code

A unique identifier assigned to each Windows Installer bundled application.

Package code

A unique identifier assigned to each Windows Installer bundled application that typically indicates minor revisions have occurred from the original Windows Installer bundled application (such as the application of a language-specific transform).

.MSI file

A reference to the file extension associated with a Windows Installer bundled application.

Product Source Update Manager

An agent running on the Configuration Manager 2007 client that updates the list of network locations where Windows Installer can find source files.

Windows Installer Interactions

There are some specific interactions between Configuration Manager 2007 and Windows Installer that should be considered when using the Windows Installer source location management.

Managing Products that Have Identical Product Codes

Most Windows Installer-based products use different product codes for each version of the application. In some cases, Windows Installer application bundles might have identical product codes, yet differentiate versions by establishing a different package code. One example of this is Microsoft Visio 2002. In this example, the product code for the original release of Visio 2002 Professional ENU version is {90510409-6D54-11D4-BEE3-00C04F990354}. The SR1 version product code is also {90510409-6D54-11D4-BEE3-00C04F990354}. If the administrator has two Configuration Manager 2007 packages configured for Windows Installer source location management where one contains the original release version and the other contains the SR1 version, Product Source Update Manager will update the source location list on the clients with the entire list of distribution points for both products (because they have the same product code). Windows Installer will then match up the appropriate release when it attempts to find its specific files.

If you have products that have identical product codes for different versions, you should use Configuration Manager 2007 to update all the older version applications before adding the Windows Installer product code to the package for Windows Installer source location management.

Registry Values for Source Lists

Windows Installer maintains the list of source directories as part of its database. The information is then exposed in the registry. The specific registry hive and key that contains the source list varies depending on the type of installation (managed or unmanaged) and the associated privileges during installation (elevated or non-elevated). You will find the majority of the source lists in the following locations:

HKEY_CLASSES_ROOT\Installer\Products\<product code>\SourceList\Net

HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\<product code>\SourceList\Net

Install Applications for All Users

If you plan to configure the Configuration Manager 2007 program to install a Windows Installer file in an administrative context by using the Run with administrative rights option, ensure that you use the Per-Machine Installation option as described in the Windows Installer documentation on MSDN http://go.microsoft.com/fwlink/?LinkId=103664. Otherwise, the application will run only for the Local System user. For example, if smstest.msi is a Windows Installer application, you might run it with the following command line:

msiexec /I smstest.msi ALLUSERS=2

Removing Existing Network Source Locations

Product Source Update Manager will find any distribution points for Configuration Manager 2007 programs that have Windows Installer information and will add the network source paths for those Windows Installer packages. When a source location is already stored (for example, if the program was installed from a locally available server instead of the Configuration Manager 2007 distribution point), Product Source Update Manager will append the Configuration Manager 2007 distribution point locations to the existing source location.

To fully understand this functionality and how source locations could be removed, consider the following scenario:

  1. Microsoft Office XP is installed by user initiation (not by using Configuration Manager 2007) from \\server1\share.
  2. Windows Installer adds \\server1\share to the last-used source registry key and stores \\server1\share as the installation source.
  3. The user initiates a repair of Office and Windows Installer to go to \\server1\share to get the source files.
  4. The Configuration Manager administrator now adds Office XP to Configuration Manager 2007 and adds the Windows Installer information for the PROPLUS.MSI file.
  5. The client receives the update and appends \\smsserver\dpshare to the list of sources for Office XP.
  6. The network administrator decommissions \\server1. The \\server1\share folder is no longer accessible to the client computer.
  7. A security update is applied to Office XP; \\server1\share is checked first and not found. Windows Installer rolls to the next location and \\smsserver\dpshare is used to complete the update process; \\smsserver\dpshare is now listed in the last-used source registry and becomes the official installation source.
  8. Any subsequent security updates or repairs now start with a pointer to \\smsserver\dpshare for Office XP.

Updating Windows Installer Source Location Manager

Several events can occur on the Configuration Manager 2007 client that will cause the Product Source Update Manager agent to update source locations for one or more Windows Installer products:

  • Management Point Change Whenever a client’s resident or proxy management point changes, a full Windows Installer Source List Update Cycle will be run.
  • Network Change If a client changes from one network subnet to another, a Windows Installer source list update cycle is triggered. If there are multiple network interfaces on the computer (for example, a docking station NIC and a wireless PC card), a Windows Installer source list update cycle will not be triggered if one of the subnets remains the same. Computers that use dial-up to connect to a corporate network will generate a network change, as well as computers that make a virtual private network (VPN) connection to another network. Whenever a client’s network subnet changes and remains in that subnet for more than eight hours, a full Windows Installer source list update cycle will be run.
  • Control Panel Item Action The Configuration Manager Control Panel item has a Windows Installer Source List Update Cycle action. Selecting this action and clicking the Initiate Action button causes the Product Source Update Manager to complete a full update cycle.
  • Running a Program with Associated Windows Installer Information If a program is installed on the client, and Windows Installer information is stored for that program (product code and file name), Product Source Update Manager will update the network locations after the program is installed. Whenever a single Windows Installer application is installed by using Configuration Manager 2007, a Windows Installer source list update cycle will be run for that one application only.
  • Programmatic Trigger via API A Configuration Manager 2007 program can be run with a VBScript to enable a Windows Installer source list update cycle.
  • User Logon/Logoff When a user logs on to the computer, Product Source Update Manager updates source paths for per-user installations of Windows Installer products for that logged-on user. When a user logs off, a flag is toggled indicating that only per-machine installations should be evaluated on any of the normal update cycle triggers.

See Also

Tasks

How To Configure Windows Installer Source Update Management

Concepts

Script Sample for API-Based Triggering of the Product Source Update Manager


Software Distribution Checklists

The checklists in this section provide recommended steps to help you complete essential software distribution tasks in Configuration Manager 2007.

In This Section

Administrator Checklist: Software Distribution Checklist

Provides the end-to-end steps for distributing software to clients using Configuration Manager.

Administrator Checklist: Configuring Your Site for Running Virtual Application Packages

Provides the steps necessary to configure Configuration Manager 2007 to run virtual applications.

Administrator Checklist: Migrating Existing Virtual Application Management Solutions

Provides the steps necessary to migrate existing virtual application management solutions for use with Configuration Manager 2007.

Administrator Checklist: Software Distribution Configuration Checklist

Provides the steps to set up the software distribution infrastructure so that you can distribute software packages.

Administrator Checklist: Software Distribution Planning Checklist

Provides the steps to consider when distributing software packages to your clients.

See Also

Other Resources

Software Distribution Overview


Administrator Checklist: Software Distribution Checklist

The following checklists provide a generalized path in Configuration Manager 2007 to the process of distributing software to client resources.

Prior to distributing software to your clients, you need to complete the following tasks:

Step | Reference
Configure the default software distribution component settings if necessary. | How to Configure Software Distribution Components
Configure the Advertised Programs Client Agent. | How to Configure the Advertised Programs Client Agent
Designate one or more distribution points to provide clients with access to software distribution packages. | How to Designate a Distribution Point How to Deploy a Branch Distribution Point
Prepare collections of clients. | About Collections How to Create a Collection
Ensure that administrators and users have sufficient rights to run the programs you advertise. | How to Configure Package Access Accounts How to Assign Rights for Objects to Users and Groups

Each time you distribute software to your clients, you must do the following:

Step Reference

Create a package source directory.

How to Set Up a Package Source Directory

Create a package.

How to Create a Package

How to Create a Package from a Package Definition File

Create one or more programs for that package.

How to Create a Program

Specify distribution points from which clients can access the package.

This is normally done while creating a package, but it can be done separately for an existing package.

How to Send a Package to Distribution Points

If using a branch distribution point for client access to packages, specify which ones will be used for client access.

As with standard distribution points, this is normally done when creating a package, but several options are available with branch distribution points.

How to Prestage Packages on a Branch Distribution Point

How to Configure On-Demand Package Distribution to a Branch Distribution Point

Create an advertisement for the program.

How to Create an Advertisement

If the advertisement is mandatory (assigned), do the following:

  • Specify the assignment schedule.
  • Specify whether it will enable Wake On LAN.
  • Specify how it will interact with maintenance windows.

How to Assign a Mandatory Advertisement

Overview of Wake On LAN

About Maintenance Windows

Monitor program and advertisement status as needed.

How to View the Status of A Package

How to View the Status of an Advertisement

See Also

Other Resources

Software Distribution Checklists


Administrator Checklist: Configuring Your Site for Running Virtual Application Packages

Topic last updated—March 2008

The following checklist includes the basic steps to consider when configuring your Configuration Manager 2007 site for running virtual application packages. You must have a sequenced virtual application created using the Microsoft Application Virtualization Platform and target computers must be running the Configuration Manager 2007 SP1 client and the Microsoft Application Virtualization Desktop 4.5 client to use virtual application packages in Configuration Manager 2007. For more information about virtual application packages, see About Virtual Application Packages.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Step | Reference
Install the Configuration Manager 2007 SP1 client and the Microsoft Application Virtualization Desktop 4.5 client. | Tasks for Installing Configuration Manager Clients How to Install the Microsoft Application Virtualization Client
Enable the advertised programs client agent to run virtual application packages. | How to Configure the Advertised Programs Client Agent for Running Virtual Applications
Determine whether you will stream virtual applications from a distribution point or download and run virtual application packages locally on Configuration Manager 2007 client computers. | How to Enable Streaming for Virtual Application Packages
Use the Microsoft Application Virtualization Platform to create and import a new sequenced application package or import an existing sequenced application into Configuration Manager 2007. | How to Import Virtual Application Packages into Configuration Manager
Advertise the virtual application package to Configuration Manager 2007 computers. | How to Advertise Virtual Application Packages

See Also

Other Resources

Software Distribution Checklists


Administrator Checklist: Migrating Existing Virtual Application Management Solutions

Topic Last Updated—August 2008

Running multiple virtual application management solutions and Configuration Manager 2007 is not supported. You should prepare your current virtual application management environment for use with Configuration Manager 2007. The following checklist includes the basic steps necessary for migrating from existing Microsoft Application Virtualization platform installations. After you have enabled the Configuration Manager 2007 site for running virtual application packages, you should deploy virtual applications only by using Configuration Manager 2007.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Step | Reference
You must install the correct version of the Microsoft Application Virtualization Desktop Client on all target computers that will run virtual application packages. | How to Install the Microsoft Application Virtualization Client
You must enable the Configuration Manager 2007 advertised programs client agent to run virtual application packages. When you enable this setting, all virtual application packages must be run using Configuration Manager 2007. | How to Configure the Advertised Programs Client Agent for Running Virtual Applications
When you enable the advertised programs client agent to run virtual application packages, all existing virtual applications not deployed using Configuration Manager 2007 are removed from target computers. You must import the virtual applications into Configuration Manager 2007 and advertise the virtual application packages for Configuration Manager 2007 clients to run them. | How to Import Virtual Application Packages into Configuration Manager How to Advertise Virtual Application Packages
If you plan to stream virtual application packages to target computers, you must enable a Configuration Manager 2007 distribution point for streaming. | How to Enable Streaming for Virtual Application Packages

See Also

Concepts

About Virtual Application Packages


Administrator Checklist: Software Distribution Configuration Checklist

The following checklists provide a generalized path in Configuration Manager 2007 to the process of setting up and configuring the Configuration Manager infrastructure necessary for distributing software to client resources.

Prior to distributing software to your clients, you need to complete the following tasks:

Step | Reference
Configure the default software distribution component settings if necessary. | How to Configure Software Distribution Components
Configure the Advertised Programs Client Agent. | How to Configure the Advertised Programs Client Agent
Designate one or more distribution points to provide clients with access to software distribution packages. | How to Designate a Distribution Point How to Deploy a Branch Distribution Point
Prepare collections of clients. | About Collections How to Create a Collection
Ensure that administrators and users have sufficient rights to run the programs you advertise. | How to Configure Package Access Accounts How to Assign Rights for Objects to Users and Groups

See Also

Other Resources

Software Distribution Checklists


Administrator Checklist: Software Distribution Planning Checklist

The following checklists provide planning considerations that you should take into account before distributing software to your clients.

Note
These checklists are not exhaustive and are intended only as guidelines. Some steps may be removed or added depending on the needs and policies of your site.

Prior to distributing software to your clients, you should make the following determinations for your site:

Step | Reference
Determine whether to display a notification message when an advertised program is available on a client. | Advertised Programs Client Agent Properties: Notification Tab
Determine whether to set a countdown period on the client before running the advertised program and how long it will be. | Advertised Programs Client Agent Properties: Notification Tab About Maintenance Windows Program Run Scenario using Maintenance Windows
Determine what the restart countdown and notification period will be for required restarts caused by Configuration Manager. | Computer Client Agent Properties: Restart Tab
Determine the location of stored packages on the site server. | Software Distribution Properties: General Tab
Determine the concurrent package and retry settings for site distribution points. | Software Distribution Properties: Distribution Point Tab
Determine if you have adequate distribution points and branch distribution points to deliver the software to your clients. | About Distribution Points How to Designate a Distribution Point About Standard and Branch Distribution Points
Determine bandwidth throttling and BITS settings for branch distribution points as appropriate. | Computer Client Agent: BITS Tab
Determine if administrators and users will require specific rights (beyond the basic rights of most users) to run the programs you advertise. | About Package Access Accounts Classes and Instances for Object Security in Configuration Manager

Each time you distribute software packages to your clients, you should also take into account the following questions or considerations before creating a software distribution package:

Step | Reference
Does a package source directory need to be set up for this package? | How to Set Up a Package Source Directory
Does a package definition file exist for the new package? | About Package Definition Files About the Package Definition File Format
Create or locate the files, scripts, or applications that you are going to use in the package and programs being distributed. | About Packages About Programs
Will any specific security rights or access accounts be needed to access the package (beyond basic access rights)? | About Package Access Accounts Classes and Instances for Object Security in Configuration Manager
Which standard or branch distribution points will be used to distribute the package to clients? | About Distribution Points How to Designate a Distribution Point About Standard and Branch Distribution Points
If using a branch distribution point for client access, how will the package be sent to the branch distribution point? | About Standard and Branch Distribution Points About On-Demand Package Distribution How to Prestage Packages on a Branch Distribution Point
To which collections will the package be advertised? | About Collections About the Role of Collections in Distributing Software
Should the package be advertised to subcollections as well? | About Subcollections
Should the package be assigned (mandatory)? | How to Assign a Mandatory Advertisement
What schedule should be set for the advertisement or assignment? | Advertisement Name Properties: Schedule Tab Assignment Schedule Dialog Box
Does Wake On LAN need to be enabled for this advertisement? | Overview of Wake On LAN
Do the collections have maintenance windows that the advertised programs will have to work within? If there are conflicts, how will they be resolved? | About Maintenance Windows Program Run Scenario using Maintenance Windows Advertisement Name Properties: Schedule Tab
What will the program re-run behavior be for this advertised program? | Advertisement Name Properties: Schedule Tab
How should the program be run from the distribution points? | Advertisement Name Properties: Distribution Points Tab

See Also

Other Resources

Software Distribution Checklists


About Feature Reports for Software Distribution

Reports have been created for software distribution in Configuration Manager 2007. These reports provide information about general software distribution status.

The available software distribution reports can be used to provide high-level information about overall software distribution progress and information about the status of specific software distribution tasks.

In This Section

About Software Distribution Reporting

See Also

Other Resources

Software Distribution Overview


About Software Distribution Reporting

Microsoft System Center Configuration Manager 2007 reporting provides you with a number of predefined reports that you can use as is or that you can modify to view information about software distribution subjects, including advertisements, packages and distribution points. For more information about using and customizing reports, see Reporting in Configuration Manager.

The following predefined reports are available for software distribution:

Report Name Description Category

Advertisement status messages for a client being upgraded to the Advanced Client

Displays the most recent status message reported for a particular computer while upgrading to Advanced Client.

Software Distribution - Advertisement Status

Advertisement status messages for a particular client and advertisement

Displays the most recent status message reported for a particular client computer and advertisement.

Software Distribution - Advertisement Status

All system resource advertisements with status

Displays all advertisements for the site, along with a summary of the status of each advertisement.

Software Distribution - Advertisement Status

All system resources for a specific advanced client distribution in a specific state

Displays all resources that are in a specific state (such as a successfully run state) for a specific advanced client distribution.

Software Distribution - Advertisement Status

All system resources for a specific advertisement in a specific state

Displays all resources that are in a specific state (such as a successfully run state) for a specific advertisement.

Software Distribution - Advertisement Status

Chart - Hourly advertisement completion status

Displays the percentage of targeted computers that have successfully installed the advertisement for every hour since the advertisement was created. The average time for deployment for an advertisement can also be tracked.

Software Distribution - Advertisement Status

Status of an advanced client distribution

Displays a status summary of all resources that have been targeted by an advertisement to upgrade the Configuration Manager client. Two types of status summary are displayed:

  • Acceptance status, which summarizes how many resources have received, rejected, or not yet received the advertisement.
  • Delivery status, which summarizes resources that have run or attempted to run the program being advertised.

Software Distribution - Advertisement Status

Status of a specific advertisement

Displays a status summary of all resources targeted by an advertisement. Two types of status summary are displayed:

  • Acceptance status, which summarizes how many resources have received, rejected, or not yet received the advertisement.
  • Delivery status, which summarizes resources that have run or attempted to run the program being advertised.

Software Distribution - Advertisement Status

All advertisements

Displays all advertisements at this site.

Software Distribution - Advertisements

All advertisements for a specific collection

Displays all advertisements for a specified collection.

Software Distribution - Advertisements

All advertisements for a specific computer

Displays all advertisements that apply to a specific computer.

Software Distribution - Advertisements

All advertisements for a specific package

Displays all advertisements for a specified package.

Software Distribution - Advertisements

All collections

Displays all collections at this site.

Software Distribution - Collections

All resources in a specific collection

Displays all resources in a specific collection.

Software Distribution - Collections

Maintenance Windows Available to a Particular Client

Displays all maintenance windows applicable to the specified client.

Software Distribution - Collections

All active package distributions

Displays all distribution points on which a package is currently being installed or removed.

Software Distribution - Packages

All distribution points

Displays all distribution points for a site.

Software Distribution - Packages

All packages

Displays all packages at a site.

Software Distribution - Packages

All packages on a specific distribution point

Displays all packages currently deployed to a specified distribution point.

Software Distribution - Packages

All status messages for a specific package on a specific distribution point

Displays all status messages for a specific package on a specific distribution point.

Software Distribution - Packages

Distribution status of a specific package

Displays the installation status of a package on each of its distribution points.

Software Distribution - Packages

The following reports are available for virtual application packages:

Note
The information in the following table applies only to Configuration Manager 2007 R2.

Report Name | Description | Category
Computers with a specific virtual application | Returns a list of all computers which have a specific virtual application. | Virtual Applications
Count all instances of virtual application packages | Returns a count of all detected virtual application packages. | Virtual Applications
Computers with a specific virtual application package | Returns a list of computers that have a specific virtual application package installed. | Virtual Applications
Count all instances of virtual applications | Returns a list of all detected virtual application packages. | Virtual Applications
All distribution points with virtual application streaming enabled | Displays a list of all Configuration Manager 2007 distribution points that have been enabled to stream virtual application packages. | Software Distribution - Packages
All virtual application packages in the streaming store of a distribution point | Returns a list of all virtual application packages located in the streaming cache of a specific Configuration Manager 2007 distribution point. | Software Distribution - Packages
Streaming store distribution status of a specific virtual application package | Returns a list of all virtual application packages currently deployed to a streaming enabled Configuration Manager 2007 distribution point. Only the most recent version of each virtual application package is displayed. | Software Distribution - Packages

See Also

Concepts

Reporting in Configuration Manager


Prerequisites for Software Distribution

Topic Last Updated—August 2008

Unlike many features of Configuration Manager 2007, software distribution does not have any specific prerequisites beyond a functional installation of Configuration Manager.

Some dependencies exist within the Configuration Manager software distribution feature, however. These are explored in greater depth in Configuring Software Distribution.

Dependencies Internal to Software Distribution

Dependency | More Information
Software distribution component configuration | Before software packages can be distributed, the software distribution component settings must be configured if necessary. For more information about configuring these settings, see How to Create a Reporting Point.
Advertised Programs Client Agent | The Advertised Program Client Agent, which manages the software distribution feature's client connection, must be enabled. For more information about this and other client agents, see Understanding Configuration Manager Clients. For information about enabling the Advertised Programs Client Agent, see How to Configure the Advertised Programs Client Agent.
Distribution points | Before any packages can be sent to clients, at least one distribution point must be designated. By default, the site server has a distribution point site role enabled during a standard installation. The distribution point should be moved to another site server (or server share), however, to allow for network traffic. The number and location of distribution points (and for distributed offices, branch distribution points) will vary with the specifics of your enterprise. For more information on setting up a distribution point, see How to Designate a Distribution Point.
Collections | Although not specifically internal to software distribution, collections are essential to this feature, as they contain the clients to which the software distribution packages will be conveyed. A number of default collections are installed with Configuration Manager, or you can set your own collections to more effectively administer your enterprise. For more information about collections, see About Collections.
Package Access Accounts | In order for clients and administrators to access the packages once they are copied to distribution points, they must have adequate rights to do so. In most cases, the default settings will be sufficient, but care should be taken to ensure this in your situation. For more information, see How to Configure Package Access Accounts.

Other Requirements for Software Distribution Functionality

In addition to the internal dependencies, a number of software distribution features have specific requirements or considerations that must be addressed for that aspect of software distribution.

Drive Format When Using Compressed Source Files

When creating a software distribution package, one available option for administrators is to store compressed versions of the package source files on the site server. When defining a location for storing a compressed source file, the folder/drive must be formatted as NTFS, as the FAT format will not support compressed package source files.

Space Considerations for Site Servers and Distribution Points

Before creating a package for distribution by Configuration Manager 2007, it is important that you verify that enough disk space is available on the site server and on distribution points (and on any required child site servers).

When you are distributing a package within a site, the following general guidelines will help you to compute the disk space required on a site server:

  • If Configuration Manager 2007 will use the source files directly when distributing the package and the site server performs the distribution point role, the site server needs disk space equal to the size of the package.
  • If the package will be sent to child sites, the site server needs additional disk space equal to 0.5 times the size of the package.
  • If you store a compressed version of the source files, the site server needs additional disk space equal to 1.5 times the size of the original source files.
  • Each distribution point requires disk space equal to approximately equal to 1.1 times the size of the uncompressed package source folder. This is necessarily because the distribution stores not only the package source folder but a delta signature recording changes to the folder as well.
  • If the site server performs a distribution point role, it generally needs disk space between 1.0 and 2.5 times the size of the original package source files.

Software distribution will be quickest and most efficient if you have enough disk space to compress and decompress files. If there is not enough space, the site server will have to wait for the removal of temporary package directories before it can proceed with distributing the packages.

If a system runs out of disk space during the software distribution process, the Configuration Manager 2007 services will continue to try to complete the package compression and decompression. However, you should free the recommended amount of disk space. If free disk space can be made available before Configuration Manager 2007 services time out, Configuration Manager 2007 components will complete the actions that were prevented by a lack of disk space.

Note
When using a branch distribution point, you can configure the amount of disk space available using the ConfigMgr Distribution Point Properties dialog box. For more information, see ConfigMgr Distribution Point Properties: General Tab.

Prerequisites for Standard and Branch Distribution Points

Some prerequisites do exist that must be taken into account when utilizing either standard or branch distribution points for software distribution.

Note
These prerequisites are required by the appropriate distribution point in order to permit it to function properly. In some cases, it is still possible to create a distribution point without conforming to one or more of these requirements. Such a distribution point will, however, not function properly on a Configuration Manager 2007 site.

Prerequisites for this Distribution Point type Standard Distribution Point Branch Distribution Point

Operating System type allowed

Server class operating systems (for more information on configuration requirements, see Configuration Manager Supported Configurations).

Server and workstation-class operating systems (for more information configuration requirements, see Configuration Manager Supported Configurations).

Note
Windows 2000 SP4 clients cannot be used as branch distribution points.

Must this distribution point be a Configuration Manager client?

No

Yes, and it must be successfully assigned to the site.

Note
To be a branch distribution point, it must be a Configuration Manager 2007 client; an SMS 2003 client cannot be used. Additionally, the client must not be configured for Internet-based client management.

Must the hosting computer be domain-joined?

Yes

Yes

Can the hosting computer be workgroup-joined?

No

No

Must IIS be installed?

No (Yes if BITS is enabled)*

No

Must there be a standard distribution point installed?

No

Yes, there must be a standard distribution point in the hierarchy that is configured for BITS and from which the branch distribution point can download assigned packages.

Must Remote Differential Compression (RDC) be installed?

No

Yes.*

*You must download, install, and configure WebDAV manually on BITS-enabled distribution points running Windows Server 2008. Branch distribution points require RDC to generate package signatures and perform signature comparison. RDC is not installed by default on computers running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

Dependencies for Virtual Application Packages

You must install the Microsoft Application Virtualization Client software on Configuration Manager 2007 clients to run virtual application packages in Configuration Manager 2007. The following table lists the dependencies for virtual application packages. If you plan to stream virtual application packages, the supported operating systems for the Application Virtualization Streaming enabled distribution point is also listed.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Dependency More Information

Application Virtualization Streaming enabled distribution point
  • The Windows Server 2003 operating system, Standard Edition, Service Pack 1
  • The Windows Server 2003 operating system, Enterprise Edition, Service Pack 1
  • Windows Server 2008 Standard operating system
  • Windows Server 2008 Enterprise operating system

Microsoft Application Virtualization Desktop Client 4.5
  • The Windows XP Professional operating system, Service Pack 1
  • The Windows Vista Ultimate operating system
  • The Windows Vista Business operating system
  • The Windows Vista Enterprise operating system

Microsoft Application Virtualization Terminal Services Client 4.5
  • The Windows Server 2003 operating system, Standard Edition, Service Pack 1
  • The Windows Server 2003 operating system, Enterprise Edition, Service Pack 1
  • Windows Server 2008 Standard operating system
  • Windows Server 2008 Enterprise operating system

See Also

Concepts

Administrator Checklist: Software Distribution Checklist
Administrator Workflow: Distributing Software Packages Overview
Choose Between a Standard and Branch Distribution Point

Other Resources

Configuration Manager Supported Configurations
Configuring Software Distribution


Planning Software Distribution

The Microsoft System Center Configuration Manager 2007, software distribution feature does not require extensive planning before it can be used. However, some planning is necessary to effectively deliver software packages to the appropriate clients.

The topics in this section provide checklists that will help you anticipate the end-to-end process of software distribution in Configuration Manager, as well as factors to consider when planning software distribution.

In This Section

Choose Between a Server and Server Share Distribution Point

Provides information to help you choose between configuring a site system as a server or a server share.

Choose Between a Standard and Branch Distribution Point

Provides information to help you choose between configuring a standard distribution point or a branch distribution point.

Decide Whether to Enable BITS on a Distribution Point

Provides information to help you decide whether you should enable Background Intelligent Transfer Service (BITS) on a distribution point.

Decide Whether to Protect the Distribution Point

Provides information to help you decide whether you should protect the distribution point.

Decide Whether Clients Should Download Content If They Are on a Slow or Unreliable Network Boundary

Provides information to help you decide whether clients should download content if they are on a slow or unreliable network boundary.

Choose Between Updating and Refreshing a Package

Provides information to help you choose between updating and refreshing packages.

See Also

Concepts

Administrator Workflow: Distributing Software Packages Overview

Other Resources

Configuring Software Distribution
Tasks for Software Distribution


Choose Between a Server and Server Share Distribution Point

Topic last updated—November 2007

A distribution point is the only site system role that can be created as a server share. All other site system roles must be created as servers. The main reason for you to create a share on a server and define that share as a distribution point is that this allows you to choose a specific drive where Configuration Manager will create and write the support files for the distribution point role. However, if you choose to make the distribution point a server, there are still a few options to control how the packages are stored.

Note
Both the server and the server share option allow support for mobile device clients.

The following table describes the advantages and disadvantages of opting for a server versus a server share.

Option Advantage Disadvantage

Server

Configuration Manager 2007 automatically creates a common package share when the first package is copied to the distribution point.

There is less chance of failing to copy a package because Configuration Manager 2007 creates a new SMSPKGx$ share when more space is needed.

The server can be configured as a branch distribution point.

The server can be configured to support Internet-based clients.

Every time Configuration Manager 2007 copies a package to the distribution point, it chooses the NTFS drive with the most free space, making it difficult to determine which drive letter will hold the new package.

Configuration Manager 2007 can take over all available NTFS disk space on the server.

Server share

Configuration Manager 2007 will not use space reserved for other functions on other partitions.

Administrator must manually create a shared folder before creating the new site system server share.

Configuration Manager 2007 might fail to create a package if there is no free space on the partition where the shared folder was created.

Configuration Manager 2007 does not create a data discovery record (DDR) to monitor the health of the site system.

The server share cannot be configured as a branch distribution point.

The server share cannot be configured to support Internet-based clients.

See Also

Tasks

How to Prevent Configuration Manager From Installing Files on a Specific Drive

Reference

Package Name Properties: Data Access Tab

Other Resources

Planning Software Distribution


Choose Between a Standard and Branch Distribution Point

Although they are not limited to installation in branch offices, Microsoft System Center Configuration Manager 2007 branch distribution points are specifically designed to support branch offices, which typically have fewer clients and use a slow network connection.

Configure a distribution point as a branch distribution point if any of the following conditions apply:

  • You have a remote location connected to the main Configuration Manager 2007 site location by a slow connection and want to optimize software distribution to clients in that location without creating a primary or secondary site for that location.
  • You do not have a computer running Windows Server 2003 that can function as a distribution point in a branch location, but you want to allow clients in that office to access content from a local distribution point.
  • You want to use a client operating system to provide the distribution point function and do not need more than 10 concurrent connections.
  • You want the package to be copied to the distribution point only when a client actually requests to install the package. For more information, see About On-Demand Package Distribution.

Do not configure a distribution point as a branch distribution point if any of the following conditions are true:

  • The computer does not yet have the Configuration Manager 2007 client installed or it is not assigned to the site.
  • You have not yet configured one standard distribution point for the branch distribution point to retrieve content.
  • The computer needs to roam between Configuration Manager 2007 sites.
  • The computer is an Internet-based client.
  • The distribution point must provide content to Internet-based clients.
  • The distribution point is a server share instead of a server.
  • The distribution point must support mobile device clients.
  • The computer is running Windows 2000 Server or Windows 2000 Workstation
  • The computer is not joined to an Active Directory domain.
  • The computer is likely to be turned off when Configuration Manager 2007 needs to process advertisements. For example, if an end user uses the branch distribution point as a workstation, you must educate the user not to shut down the computer when it might be needed by other users in the office.
  • You want clients to download content from the distribution point using Background Intelligent Transfer Service (BITS).
    Note
    Configuring a distribution point for BITS does not guarantee that the download will use BITS. However, clients always use server message blocks (SMBs) when communicating with a branch distribution point, even when the site is configured for native mode. Branch distribution points download their content using BITS from a BITS-enabled distribution point, but they cannot be BITS-enabled themselves.

  • You want to use multicast with operating system deployment in Configuration Manager 2007 R2.

See Also

Concepts

About Standard and Branch Distribution Points
About Multicast for Operating System Deployment
About Protected Distribution Points
How to Configure Distribution Points

Other Resources

How to Configure Branch Distribution Points


Decide Whether to Enable BITS on a Distribution Point

Topic last updated—March 2008

Enabling Background Intelligent Transfer Service (BITS) on a Microsoft System Center Configuration Manager 2007 distribution point helps control bandwidth when downloading content from a standard distribution point to a Configuration Manager 2007 client. When a computer is downloading from a BITS-enabled distribution point and is interrupted, it can resume where it left off, even if the client computer connects to a different distribution point.

A BITS-enabled distribution point must have Internet Information Services (IIS) installed and WebDAV enabled, which increases the attack surface on that computer and can increase administrative overhead. However, if you do not enable BITS, clients will always use server message blocks (SMBs) to download content, even in native mode. In native mode, you should enable BITS to permit clients to download content using HTTPS. In mixed mode, you should enable BITS on your distribution points to provide a better download experience for your clients.

You must enable BITS if the Configuration Manager 2007 distribution point must support the following clients:

  • Mobile device clients
  • Internet-based clients

If you will have branch distribution points, you must have at least one BITS-enabled standard distribution point from which to download content.

Important
You must download, install, and configure WebDAV manually on BITS-enabled distribution points running Windows Server 2008. You might also have to edit the requestFiltering section of the applicationHost.config file if your packages contain extensions that are blocked. For more information, see How to Configure Windows Server 2008 for Site Systems.

See Also

Tasks

How to Configure a BITS-Enabled Distribution Point

Concepts

About BITS-Enabled Distribution Points
About Distribution Points


Decide Whether to Protect the Distribution Point

Topic last updated—November 2007

When you protect a Microsoft System Center Configuration Manager 2007 site system, only clients in that boundary can access the distribution point or state migration point role on that site system. You protect these site roles to help control network utilization.

However, before protecting any distribution points, you should consider the effect on software distribution. Careful configuration of protected distribution will preserve network bandwidth, but haphazard configuration of protected distribution points might prevent clients from accessing crucial content, including software updates and operating system deployment packages.

Before deciding to protect any distribution points, you need to know the following information:

  • The location of all distribution points in the site
  • The location of all distribution points in the hierarchy if you support roaming
  • The location and available bandwidth of any slow network links
  • The largest package sizes you tend to distribute

You should consider protecting a distribution point if any of the following are true:

  • The distribution point is across a slow network link from other clients in the site
  • The distribution point is a branch distribution point
  • You frequently distribute large packages and want only clients closest to the distribution point to download content from it

You should be careful about protecting all distribution points in the site for the following reasons:

  • If all distribution points in the site are protected but not all boundaries are assigned to protected distribution points, a client belonging to an unassigned boundary will be unable to access any distribution points and the package will fail.
  • If a client roams to a new site and the package is not available in the resident site, the client will attempt to fall back to the assigned site but will fail if all of the distribution points in the assigned site are protected. For more information about roaming scenarios involving protected distribution points, see Example Roaming Scenarios for Configuration Manager: Complex.

If you protect your distribution points, for each advertisement or software update deployment that you create, you must consider whether to allow clients to fall back to unprotected distribution points when the content is not available on the protected distribution point. Before making the decision, consider the following factors:

  • If the package is very large and would consume too much bandwidth, you can prevent fallback to unprotected distribution points, understanding that the clients might not receive the content at all.
  • If the package is small or if the content is critical, you can allow fallback to unprotected distribution points.

See Also

Tasks

How to Configure a Protected Distribution Point

Concepts

About Protected Distribution Points

Other Resources

Planning Software Distribution


Decide Whether Clients Should Download Content If They Are on a Slow or Unreliable Network Boundary

The default for every Microsoft System Center Configuration Manager 2007 advertisement and software update deployment is to not download software packages and software updates when the client is connected within a slow or unreliable network boundary. This default assumes that you do not want clients downloading content over slow or unreliable network connections, thereby saving network bandwidth.

However, in some scenarios, this default setting might unexpectedly prevent clients from installing the software packages and software updates that you want them to have. Consider changing this default if you want to ensure that clients always install software packages and software updates when requested and if any of the following scenarios apply:

  • Clients are not within a configured boundary for their assigned site because boundaries are not configured correctly or because the clients have been incorrectly assigned.
    In this scenario, clients will never install the software package or software updates. For these clients to install the software package or software update with the default configuration, all boundaries must be configured correctly.
  • Clients are within a boundary that is configured as slow or unreliable, such as a virtual private network (VPN) or wireless network.
    In this scenario, clients will not be able to install the software package or software updates unless their network location changes to a fast and reliable boundary. Alternatively, reconfigure the slow or unreliable boundary to be fast and reliable.
  • Clients have roamed into another site that does not host the content.
    In this scenario, clients will not be able to install the software package or software updates until they return to their assigned site.

For more information about planning and configuring boundaries, see the following:

  • Planning Configuration Manager Boundaries
  • Choose Configuration Manager Boundaries

See Also

Reference

Advertisement Name Properties: Distribution Points Tab
Deployment Name Properties: Download Settings Tab
Deployment Name Properties: SMS 2003 Settings Tab

Concepts

About Client Roaming in Configuration Manager
Configuration Manager and Content Location (Package Source Files)
Example Roaming Scenarios for Configuration Manager: Complex


Choose Between Updating and Refreshing a Package

Topic last updated—November 2007

Updating and refreshing Microsoft System Center Configuration Manager 2007 packages are two different operations. Use the following table to help decide when to update and when to refresh a package.

Criterion | Package Update | Package Refresh
Use when | You make a modification to the package source, such as adding, changing, or deleting a file or folder. | You need to repair a package at a specific distribution point.
What it does | Builds a new, complete, compressed package file and a delta compressed package file from the updated package source files. The delta file is passed to all distribution points. | Recopies the compressed package from the local site server to the distribution point but does not copy files from the package source.
Resets access control list (ACL)? | No. | Yes, if you have made changes to the Package Access Accounts.
Resets the Virtual Directory? | Yes, if you have enabled or disabled BITS on the distribution point since the last package update. | Yes, if you have enabled or disabled BITS on the distribution point since the last package refresh.
Updates the package source version? | Yes. | No.
Increments package version in client policy? | Yes. | No.

See Also

Tasks

How to Refresh Package Data on Distribution Points
How to Update Package Data on Distribution Points

Other Resources

Planning Software Distribution


Best Practices for Virtual Application Packages

Topic Last Updated—August 2008

Use the following best practices for configuring and running virtual application packages in Configuration Manager 2007.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Best Practices - General

  • Streaming virtual application packages requires a fast network connection.
    If you plan to stream virtual application packages to target computers, all target computers must be within a boundary of a Configuration Manager 2007 distribution point using a Fast (LAN) network connection. For more information about Configuration Manager 2007 boundaries see Choose Configuration Manager Boundaries.

Best Practices for Configuration Manager 2007 Clients

  • Increase the default Configuration Manager 2007 client cache size.
    The default Configuration Manager 2007 client cache size is 5 GB. Depending on how many virtual application packages you deploy in your environment you should increase the default size. For more information about the Configuration Manager 2007 client cache, see How to Configure the Temporary Program Download Folder (Cache) for Configuration Manager Clients. You should plan on having twice the amount of client cache space available that is required for the virtual application packages in your environment. For example, if you require 1 GB of disk space for virtual application packages you should configure 2 GB of disk space in the client cache. The additional disk space will be used for virtual application package audit and version control.

Best Practices for Windows Server 2008

  • Running virtual application packages on Windows Server.
    If you plan to deploy virtual application packages to computers running Windows Server 2008 with the Download content from distribution point and run locally option you must install remote differential compression (RDC) on the target computer before you deploy the virtual application package. Configuration Manager 2007 clients use RDC to download available virtual application package updates. RDC is not installed by default.
  • Virtual Application Package Advertisements on computers running Terminal Services.
    If you plan to have target computers access virtual application packages using terminal services you should use a mandatory advertisement and target the advertisement to the computer running terminal services. If you target the advertisement to a specific user or user group collection, only the users logged on to the terminal services console session will receive and be able to run the advertisement.

Best Practices for Securing Virtual Application Packages

  • Configuring access to streamed virtual application packages.
    You can control which users will have access to streamed virtual application packages by using Configuration Manager 2007 package security. Configuration Manager 2007 package security allows administrators to block access to virtual application packages to users who are currently logged in on a target computer with the virtual application package installed.
    For example; to provide access to a virtual application package for User A the administrator should configure the package access so that only User A has access by granting permissions to a group that only User A is a member of and User B is not. You must also grant permissions to the target computer that User A will be running the virtual application package on so that the virtual application package can be registered.
    For more information about package security scenarios, see Example Package Access Scenarios.

See Also

Other Resources

How to Configure Virtual Application Components


Configuring Software Distribution

Before distributing software to clients, you must first configure the supporting infrastructure. This includes not only configuring the built-in components and client agents, but also designating distribution points (or branch distribution points) to disseminate the software packages to clients, making sure you have the collections that fit your needs, and ensuring that administrators and clients have the rights necessary to access the software.

This section provides links to a checklist that provides detail about the software distribution configuration process, as well as configuration procedures for the software distribution infrastructure.

Click the related link for detailed information about the associated software distribution configuration topic.

In This Section

How to Configure Software Distribution Components

Specifies how to configure the Configuration Manager components specific to software distribution.

How to Configure the Advertised Programs Client Agent

Specifies how to configure the Advertised Programs Client Agent to enable software distribution.

How to Configure Distribution Points

Specifies how to set up and configure standard distribution points to distribute packages to your clients.

How to Configure Branch Distribution Points

Specifies how to set up and configure branch distribution points to distribute packages to your clients in distributed offices.

How to Configure Package Access Accounts

Specifies how to configure package access accounts to ensure that appropriate administrators and clients can access the software packages.


How to Configure Software Distribution Components

Although the default software distribution component settings will be usable for most Configuration Manager 2007 sites, it may be necessary to modify them to meet the specific needs of an individual site.

Note
You must have Modify permissions for the Site object type to configure software distribution components. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To configure software distribution components

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / <server name> / Site Management / <site name> / Site Settings / Component Configuration.

  2. Right-click Software Distribution, and then click Properties.

  3. In the Software Distribution Properties dialog box, modify the settings as needed.

    For information about the specific pages in this dialog box, see Software Distribution Properties.

See Also

Other Resources

Configuration Manager Single Site Planning and Deployment
Configuring Software Distribution


How to Configure the Advertised Programs Client Agent

The Advertised Programs Client Agent, like other client agents, is installed on all clients by Configuration Manager 2007, but it is necessary to configure the agent to match the needs of your site.

Note
Although the Advertised Programs Client Agent is automatically enabled when doing a standard installation on a client computer, it is not automatically enabled when performing a custom installation.

To configure the Advertised Programs Client Agent

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Client Agents.

  2. Right-click Advertised Programs Client Agent, and then click Properties.

  3. On the General tab, enable software distribution if necessary and configure the client agent.

    For more information about the tabs in this dialog box, see Advertised Programs Client Agent Properties.

  4. On the Notification tab, configure additional client options as desired.

See Also

Concepts

About the Advertised Programs Client Agent

Other Resources

Advertised Programs Client Agent Properties


How to Configure Distribution Points

In order to distribute packages using Configuration Manager 2007, packages must be copied to distribution points in preparation for being disseminated to designated clients. However, in order to use these distribution points, they must first be configured. This section provides links to the tasks that set up, as well as remove a distribution point in your Configuration Manager site.

Click the related link for detailed information about the associated deployment package task.

In This Section

How to Designate a Distribution Point

Specifies how to designate a distribution point site role on either a server site system or a server share.

How to Remove a Distribution Point

Specifies how to remove the distribution point role from a site system.

See Also

Concepts

About Distribution Points
Administrator Workflow: Distributing Software Packages Overview

Other Resources

How to Manage Distribution Points
How to Configure Branch Distribution Points


How to Designate a Distribution Point

Topic Last Updated—August 2008

To use a server as a distribution point for providing packages to distribute packages to your client computers, you must first designate a site system as a distribution point. For more information on adding the distribution point role to an existing site system, see New Site Role Wizard.

You can designate a distribution point either when creating a new site system or by adding the distribution point site role to an existing site system. Although you can also add this site role to an existing server share, this will be rare, as the distribution point role is the only one available for a server share and so this site role will usually be installed already.

Note
To move a distribution point from one drive to another, you must remove all the packages from the distribution point before the drive can be moved.

Server or Server Share

The main reason for you to create a share on a server and defining that share as a distribution point is that this allows you to choose a specific drive where Configuration Manager will create and write the support files for the distribution point role. This is done by creating a server share on the site system and directing it to a specific drive on the computer. You can then designate it as a distribution point. (This is the only site role that can be created on a server share. For more information about creating a server share with the distribution point role, see New Site System Server Share Wizard.

It is important to note, however, that if you use a server share as your distribution point, Configuration Manager will not create a data discovery record (DDR) for that site system. Without a DDR, the Heartbeat Discovery method will not monitor the health of the site system.

Note
If you do need a discovery record for a distribution point that you've placed on a server share, create the site system as both a Server Share and as a Server. Assign the distribution point role to the Server Share site system entry and don't assign any site system roles to the Server site system entry. It is important to note, however, that configuring both as a distribution point is not supported, as it will cause consistency problems between the two distribution points.

Important
Do not create distribution point shares or branch distribution points on Internet-based clients. While Configuration Manager might not prevent you from doing so, creating any type of distribution point on an Internet-based client greatly increases your attack surface and should be avoided. Create distribution points only on site systems that can be managed within the intranet or the perimeter network.

For more information about creating a site system server with the distribution point role, see New Site System Server Wizard.

Note
Do not create a custom share on a distribution point using Configuration Manager's reserved package share naming convention. Doing so will break the distribution point functionality.

In order to designate a distribution point, you must have Modify permissions for the Site class or object type. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

For more complete information on the prerequisites for standard and branch distribution points, see Prerequisites for Software Distribution.

To designate a distribution point on a new server or server share

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings.

  2. Right-click Site Systems, point to New, and then click Server or Server Share, depending on which you want to create.

  3. If you are creating a new server, use the New Site System Server Wizard to create the site system server, and select the Distribution Point check box from the Available Roles on the System Role Selection page to designate this server as a distribution point. For more information on this wizard, see New Site System Server Wizard.

    If you care creating a new server share, use the New Site Server Share Wizard to create the server share, and select the Distribution Point check box from the Available Roles on the System Role Selection page to designate this server share as a distribution point. For more information on this wizard, see New Site System Server Share Wizard.

    For additional information, see How to Configure Site System Roles.

    Note
    When designating a distribution point, the site server or share name is case sensitive. As a result, if you are renaming or recreating a previously existing distribution point, it may not be correctly discovered in some locations (such as the Manage Distribution Points Wizard) if the case does not match the original distribution point entry.

To designate a distribution point on an existing server or share

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings..

  2. Click Site Systems.

  3. Right-click the specific site system server or server share to which you want to assign the distribution point role to, and then click New Roles.

  4. Use the New Site Role Wizard to select the Distribution Point check box from the Available Site Roles on the System Role Selection to designate this server or share as a distribution point. For more information on this wizard, see New Site Role Wizard.

    For additional information, see How to Configure Site System Roles.

    Note
    When designating a distribution point, the site server or share name is case sensitive. As a result, if you are renaming or recreating a previously existing distribution point, it may not be correctly discovered in some locations (such as the Manage Distribution Points Wizard) if the case does not match the original distribution point entry.

See Also

Reference

ConfigMgr Distribution Point Server Share Properties: General Tab
Site System Properties: General Tab
Site System Server Share Properties: General Tab

Concepts

About Distribution Points
How to Configure Site System Roles


How to Remove a Distribution Point

Removing a distribution point is sometimes necessary when maintaining a Configuration Manager 2007 site. It is important to note that removing a distribution point will also delete that distribution point from all packages.

To remove a distribution point

  1. Remove all distribution package folders and the SMSPKGSIG signature folder from the distribution point computer.

    Important
    You must manually remove these components before removing the distribution point role.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Site Systems.

  3. Click the specific distribution point to be removed.

  4. Right-click the ConfigMgr distribution point role in the results pane, and then click Delete.

  5. Click Yes in the Confirm Delete dialog box.

See Also

Concepts

About Distribution Points
How to Configure Distribution Points


How to Configure a BITS-Enabled Distribution Point

Topic last updated—March 2008

Using BITS-enabled distribution points in Microsoft System Center Configuration Manager 2007 helps control bandwidth throttling between the clients and distribution points. Enabling the BITS setting does not guarantee that the client will always download content from the distribution point using BITS. However, if this setting is not enabled, the client will never download packages using BITS.

You cannot configure branch distribution points to be BITS-enabled. You must make the distribution point BITS-enabled to support Internet-based clients and mobile device clients.

Important
You must download, install, and configure WebDAV manually on BITS-enabled distribution points running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

To configure a distribution point to be BITS-enabled

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server that is configured with the distribution point role.

  3. In the results pane, right-click ConfigMgr distribution point, and then select Properties.

  4. On the General tab, select the option Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients).

  5. Click OK.

    Note
    For more information about the options in this dialog box, see ConfigMgr Distribution Point Properties: General Tab.

See Also

Concepts

About BITS-Enabled Distribution Points
Decide Whether to Enable BITS on a Distribution Point
How to Configure Distribution Points


How to Configure a Protected Distribution Point

Topic last updated—November 2007

Protecting a Microsoft System Center Configuration Manager 2007 site system means that clients outside of the protected boundaries will be unable to access the distribution point or state migration point roles on that site system. Protection is applied to the entire site system, not just to the properties of the site role. However, protection has no effect on any site system roles except distribution points and state migration points.

To configure a protected distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server that is configured with the distribution point role that you want to protect.

  3. In the results pane, right-click ConfigMgr site system, and then select Properties.

  4. Click Enable this site system as a protected site system.

  5. Click Select Boundaries.

  6. In the Boundaries dialog box, click New.

  7. In the New Boundaries dialog box, select a boundary from the list, and then click OK.

    Note
    Boundaries appear in the list only if they have been configured for the site and have not already been assigned as protected boundaries to another site system.

  8. Click OK twice.

See Also

Tasks

How to Configure Configuration Manager Boundaries
How to View Configuration Manager Boundaries

Concepts

About Protected Distribution Points
Boundaries Dialog Box
Choose Configuration Manager Boundaries
Configuration Manager and Content Location (Package Source Files)
Decide Whether to Protect the Distribution Point
New Boundaries Dialog Box
Planning Configuration Manager Boundaries


How to Configure Branch Distribution Points

While in most ways, branch distribution points in Configuration Manager 2007 function in the same manner as standard distribution points, setting up branch distribution points is different. This section provides links to the tasks that help to set up, as well as remove a branch distribution point in your Configuration Manager site.

Click the related link for detailed information about the associated deployment package task.

In This Section

How to Deploy a Branch Distribution Point

Specifies how to set up a branch distribution point role on a site system.

How to Remove a Branch Distribution Point

Specifies how to remove the branch distribution point role from a site system.

How to Back Up a Branch Distribution Point

Specifies how to back up the packages on a branch distribution point.

See Also

Concepts

About Standard and Branch Distribution Points
About Distribution Points
Administrator Workflow: Distributing Software Packages Overview
How to Configure Distribution Points

Other Resources

How to Manage Branch Distribution Points


How to Deploy a Branch Distribution Point

Topic Last Updated—August 2008

In Microsoft System Center Configuration Manager 2007, branch distribution points provide administrators with the option of placing distribution point functionality within a small or distributed office without having to set up a primary or secondary Configuration Manager site. Branch distribution points can be installed in primary and secondary sites and can be installed on either a server-class or a workstation-class computer, depending on the requirements of the branch office. For more information, see About Standard and Branch Distribution Points.

If you are not sure whether to create a branch distribution point or a standard distribution point, see Choose Between a Standard and Branch Distribution Point.

Note
Do not create a custom shared folder on a branch distribution point using Configuration Manager's reserved package share naming convention. Doing so will break the branch distribution point functionality. For example, if you specify a drive in the branch distribution point's properties (for example, "D$:") and there is an existing share on the client computer's drive C (for example, SMSPKGD$), when the client gets the branch distribution point policy, it will start the download and provisioning to D:\SMSPKGD$ but will keep the existing share C:\SMSPKGD$. This will prevent other clients from downloading from the branch distribution point.

Before installing a branch distribution point, ensure that the following prerequisites are met:

  • The computer is running the Configuration Manager client.
  • The computer is not a workgroup computer.
  • The computer is not running Windows 2000.
  • The computer is not configured to use an Internet-based management point.

For more complete information about the prerequisites for branch and standard distribution points, see Prerequisites for Software Distribution.

To deploy a branch distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings.

  2. Right-click Site Systems, point to New, and then click Server.

  3. Use the New Site System Server Wizard to deploy the branch distribution point on the specific client on which you want to install it.

    • On the System Role Selection page, select the Distribution Point role.
    • On the Distribution Point page, select the Enable as a branch distribution point option. If you want to limit the branch distribution point installation and package files to a specific partition on the client computer or if you want to reserve a specific amount of disk space for the operating system or workstation files, you can set those preferences on this page.

    For more information about configuring the options on this wizard page, see ConfigMgr Distribution Point Properties: General Tab.

See Also

Tasks

How to Back Up a Branch Distribution Point
How to Remove a Branch Distribution Point

Reference

ConfigMgr Distribution Point Properties: General Tab

Concepts

About Standard and Branch Distribution Points
Choose Between a Standard and Branch Distribution Point
New Site System Server Wizard
Prerequisites for Software Distribution

Other Resources

How to Manage Branch Distribution Points


How to Remove a Branch Distribution Point

Removing a branch distribution point is sometimes necessary when maintaining a Configuration Manager 2007 site. Removing a branch distribution point will also delete that branch distribution point from all packages.

When a branch distribution point role is removed from Configuration Manager, it is necessary to wait a short time (usually about 15 minutes) for this change to propagate through the entire site before deleting the resource from a collection.

To remove a branch distribution point

  1. Remove all distribution package folders and the SMSPKGSIG signature folder from the branch distribution point computer.

    Important
    You must manually remove these components before removing the branch distribution point role.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Site Systems.

  3. Click the specific branch distribution point to be removed.

  4. Right-click the ConfigMgr distribution point role in the results pane, and then click Delete.

  5. Click Yes in the Confirm Delete dialog box.

See Also

Tasks

How to Back Up a Branch Distribution Point
How to Deploy a Branch Distribution Point

Concepts

About Standard and Branch Distribution Points

Other Resources

How to Manage Branch Distribution Points


How to Back Up a Branch Distribution Point

In the event of a system failure or other problem, restoration of packages on a branch distribution point is greatly simplified if you have been periodically backing up those packages. These packages can be backed up and then restored locally, minimizing the bandwidth that would otherwise be required to redistribute the packages to the branch distribution point.

Note
Although Configuration Manager 2007 does provide backup and recovery maintenance tasks through the Configuration Manager console, the contents of a branch distribution point are not backed up by this method. For more information about these maintenance tasks, see Overview of Backup and Recovery.

To back up packages on a branch distribution point

  1. If necessary, disconnect users from the SMSPKG<driveletter>$ share on the branch distribution point.

  2. Copy the contents of the SMSPKG<driveletter>$ share to backup media.

See Also

Tasks

How to Restore Packages on a Branch Distribution Point

Concepts

About Standard and Branch Distribution Points

Other Resources

How to Manage Branch Distribution Points


How to Convert a Standard Distribution Point to a Branch Distribution Point

If you have a standard distribution point in Configuration Manager 2007 that you want to be a branch distribution point, ensure that you use the same package location (for example, do not chose a different partition when you select the branch distribution point option) and use the following procedure to convert the standard distribution point into a branch distribution point.

To convert a standard distribution point to a branch distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server that is configured with the standard distribution point role that will be converted to a branch distribution point.

  3. In the results pane, right-click ConfigMgr distribution point, and then select Properties.

  4. On the General tab, cancel the option Allow clients to transfer content from the distribution point using BITS, HTTP, and HTTPS, and then click Apply.

  5. Select the option Enable as a branch distribution point, and click OK.

    Note
    This action causes the branch distribution policy to be downloaded to the client, and the packages that are assigned to it are checked. If a package is already downloaded to the same location and if the hash matches, the package will not be downloaded again. If the package is not already downloaded to the same location or if the hash does not match, the package will be downloaded. If the location is different, the old package is not deleted before downloading the package to the new location.

  6. If you need to add new packages to the branch distribution point, follow the procedure in How to Send a Package to Distribution Points.

See Also

Tasks

How to Back Up a Branch Distribution Point
How to Remove a Branch Distribution Point

Concepts

About Standard and Branch Distribution Points
New Site System Server Wizard
Prerequisites for Software Distribution

Other Resources

How to Manage Branch Distribution Points


How to Configure Package Access Accounts

Package access accounts allow you to control access to the packages on distribution point with a greater degree of flexibility than the default option. This section provides links to the tasks that help to manage these package access accounts.

Click the related link for detailed information about the associated task.

In This Section

How to Specify a Package Access Account

Specifies how to set up a package access account for specifying the user or user groups who will access the package share on the distribution point.

How to Modify a Package Access Account

Specifies how to update or change an existing package access account.

How to Delete a Package Access Account

Specifies how to delete an existing package access account.

See Also

Concepts

About Package Access Accounts
Classes and Instances for Object Security in Configuration Manager
Overview of Configuration Manager Object Security and WMI


How to Specify a Package Access Account

Specifying or defining an access account in Configuration Manager 2007 enables you to grant, limit, or revoke access to package source files on distribution points. Although the package share on a distribution point is, by default, a hidden share, controlling this access can be a useful security measure.

By default, when Configuration Manager creates the package share, it grants Read access to the local Users group and Full Control to the Administrators group. For more information, see About Package Access Accounts.

Important
In some cases, removing the Users group as a package access account might cause software distribution to fail. If the distribution point is in a native mode site, you must add IUSR_<computername> as a package access account with the permissions required to access to the package. If a distribution point is configured to allow anonymous access for mobile device clients, you must also add the Internet Guest account as a package access account.

Note
You must have Modify permissions for the Package security object class to specify an access account. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To specify a package access account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand to the package for which you want to specify an access account.

  3. Right-click Access Accounts, point to New, and then click the type of access account you want to define:

    • Generic Access Account
    • Windows User Access Account

  4. Click Set.

    • If you are creating a generic access account, click the account type to create and then click OK.
    • If you are creating a Windows User access account, type the account name you want to grant permissions to, in the form domain\user. Click the account type to create, and then click OK.

  5. From the Permissions drop-down list, select the level of permissions to grant to the account. For more information about the permissions available, see About Package Access Accounts.

  6. Click OK.

  7. Refresh all distribution points associated with the package to ensure that all distribution points have the new access account information:

    • Click Distribution Points to show all distribution points associated with the package.
    • Select each distribution point displayed in the results pane, right-click, and then click Refresh Distribution Points.
    • Click Yes.
    Note
    Each distribution point must be refreshed individually. Selecting all available distribution points, right-clicking, and then clicking Refresh will refresh only the results pane and will not resend the package to the distribution points.

See Also

Tasks

How to Delete a Package Access Account
How to Modify a Package Access Account

Concepts

How to Configure Distribution Points
About Package Access Accounts


How to Modify a Package Access Account

In order to modify a package account, you must have Modify permissions for the Package security object. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To modify a package access account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand to the package for which you want to modify the access account.

  3. Click Access Accounts, right-click the account you want to modify in the results pane, and then click Properties.

  4. From the Permissions drop-down list, select the level of permissions to grant to the account. For more information about the permissions available, see About Package Access Accounts.

    Important
    In some cases, removing the Users group as a package access account might cause software distribution to fail. If the distribution point is in a native mode site, you must add IUSR_<computername> as a package access account with the permissions required to access to the package. If a distribution point is configured to allow anonymous access for mobile device clients, you must also add the Internet Guest account as a package access account.

  5. Click OK.

  6. Refresh all distribution points associated with the package to ensure that all distribution points have the modified access account information:

    • Click Distribution Points to show all distribution points associated with the package.
    • Select each distribution point displayed in the results pane, right-click, and then click Refresh Distribution Points.
    • Click Yes.
    Note
    Each distribution point must be refreshed individually. Selecting all available distribution points, right-clicking, and then clicking Refresh will refresh only the results pane and will not resend the package to the distribution points.

See Also

Tasks

How to Delete a Package Access Account
How to Specify a Package Access Account

Concepts

How to Configure Distribution Points
About Package Access Accounts


How to Delete a Package Access Account

In order to delete a package account, you must have Modify permissions for the Package security object. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To delete a package access account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand to the package for which you want to delete the access account.

  3. Click Access Accounts, right-click the account you want to delete in the results pane, and then click Delete.

  4. Click Yes to confirm that you want to delete the selected account.

See Also

Tasks

How to Modify a Package Access Account
How to Specify a Package Access Account

Concepts

About Package Access Accounts


How to Configure Virtual Application Components

Topic last updated—March 2008

Click the related link for detailed information about the associated virtual application configuration tasks.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

How to Configure the Advertised Programs Client Agent for Running Virtual Applications

Specifies the procedures for configuring the Advertised Programs Client agent for running virtual applications.

How to Enable Streaming for Virtual Application Packages

Specifies how to enable Configuration Manager 2007 distribution points for streaming virtual application packages.

How to Install the Microsoft Application Virtualization Client

Describes how to install the Microsoft Virtual Application Desktop Client using a package definition file.

See Also

Other Resources

Configuring Software Distribution


How to Configure the Advertised Programs Client Agent for Running Virtual Applications

Topic last updated—January 2008

When the Advertised Programs Client Agent is enabled to advertise and run virtual application packages in Configuration Manager 2007, a policy that requests that the virtual application package components are enabled on client computers is assigned to the site. These components allow you to advertise and run virtual application packages on Configuration Manager 2007 client computers.

Note
When you enable the advertised programs client agent to run virtual application packages, all Configuration Manager 2007 client computers in the site will be configured to run virtual application packages. It is not possible to enable a single computer or collection to run virtual application packages.

Use the following procedure to enable the Advertised Programs Client Agent for running virtual application packages.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To configure the advertised programs client agent for running virtual application packages

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. Right-click Advertised Programs Client Agent, and then select Properties.

  3. On the General tab, to enable the client agent for running virtual applications, click Allow virtual application package advertisement.

  4. Click OK to exit the properties dialog box.

See Also

Other Resources

How to Configure Virtual Application Components


How to Enable Streaming for Virtual Application Packages

Topic Last Updated—August 2008

By default, Configuration Manager 2007 distribution points are not enabled to stream virtual application packages. If you plan to stream virtual application packages to Configuration Manager 2007 clients, you must enable the distribution point for streaming virtual application packages. Configuration Manager 2007 clients will access and run virtual applications from their assigned application virtualization enabled distribution point or branch distribution point. If the client is assigned to a branch distribution point, virtual application packages will be accessed and streamed using server message block (SMB) regardless of the site mode.

Use the following procedure to enable Configuration Manager 2007 distribution points for streaming virtual application packages.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To enable a distribution point for streaming

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems, and then click the name of the server.

  2. To open the ConfigMgr Distribution Point Properties, in the results pane, right-click ConfigMgr distribution point, and then click Properties. On the General tab ensure Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients). has been selected. Configuration Manager 2007 client computers that connect to a branch distribution point will run virtual application packages using SMB.

    Important
    You must select Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and internet based clients). or Enable virtual application streaming option on the Virtual Applications tab will not be available.

  3. On the Virtual Applications tab, select Enable virtual application streaming.

  4. To close the distribution point properties, click OK.

See Also

Other Resources

How to Configure Virtual Application Components


How to Install the Microsoft Application Virtualization Client

Topic Last Updated—August 2008

For Configuration Manager 2007 client computers to run virtual application packages you must install the appropriate version of the Microsoft Application Virtualization Client. You can use a package definition file to install the Microsoft Application Virtualization Client. Package definition files are scripts that help automate package creation with Configuration Manager 2007. For more information about package definition files, see About Package Definition Files. You must use the AppVirtMgmtClient.sms file to create the package definition file. After you create the package definition file you must add the package to a distribution point and advertise the package to the computers you want to install it on. For more information about adding packages to a distribution point see How to Manage Distribution Points.

The Microsoft Application Virtualization Desktop Client requires the following prerequisites be installed on the Configuration Manager 2007 client computer:

  • Microsoft Application Error Reporting – For more information about installing Microsoft Application Error Reporting, see http://go.microsoft.com/fwlink/?LinkId=116684
  • Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) – For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) see http://go.microsoft.com/fwlink/?LinkId=116683
Note
The information in this topic applies only to Configuration Manager 2007 R2.

To install the Microsoft Virtual Application Virtualization Desktop Client

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. If necessary, expand the Software Distribution node and select Packages. To open the Create Package from Definition Wizard, right-click Packages, and then click New / Package From Definition.

  3. On the welcome page, click Next.

  4. On the Package Definition page, to specify the publisher and definition for the new package, click Browse. Locate and select the AppVirtMgmtClient.sms file. The default location for the AppVirtMgmtClient.sms file is <ConfigMgrInstallationPath> \ SMS \ Tools \ VirtualApp \ AppVirtMgmtClient.sms. The Name, Version, and Language associated with the specified .sms file are displayed in the Package definition pane. Click Next.

  5. On the Source Files page, select Always obtain files from a source directory to help ensure the latest version of the client software will be available, and then click Next.

  6. On the Source Directory page, specify the directory that contains the source files for the package. This is the directory that contains the Microsoft Application Virtualization Desktop Client or the Microsoft Application Virtualization for Terminal Services installation file depending on the version of the client you are planning to install. Specify the source location by providing the UNC path. Alternatively, click Browse to specify the location that contains the setup files for the type of client you want to install. Click Next.

  7. On the Summary page, review the Details for the package definition file. To create the package definition file and close the wizard, click Finish. To access the new package select the Packages node and the package will be available in the results pane.

  8. If you installed the Microsoft Application Virtualization for Terminal Services client, after the package has been created, you should select the Packages node, right-click the package in the in the Results pane and select Properties. On the General tab, update the Name of the package so that it reflects that it is the terminal services version of the client.

See Also

Tasks

How to Install the Microsoft Application Virtualization Client

Other Resources

How to Manage Advertisements


Tasks for Software Distribution

Many tasks need to be performed to effectively distribute software to clients in Configuration Manager 2007. This section provides information about managing software distribution packages, programs, and advertisements, as well as how to manage standard distribution points and branch distribution points once they've been established in your site system.

Click the related link for detailed information about the associated software distribution task.

In This Section

How to Manage Packages

Describes how to create, modify and delete packages, as well as how to monitor the status of those packages.

How to Manage Programs

Describes how to create, modify, and delete programs, as well as how to disable and enable those packages.

How to Manage Distribution Points

Describes how to send packages to distribution points, as well as how to update those packages, and how to remove packages from distribution points.

How to Manage Branch Distribution Points

Describes how to distribute package to branch distribution points, as well as how to prestage packages, configure on-demand distribution, and remove packages from branch distribution points,

How to Manage Advertisements

Describes how to create advertisements, as well as how to modify, disable, and re-run advertisements, along with other tasks for managing advertisements.

How to Manage Virtual Application Packages

Describes how to import and use virtual application packages in Configuration Manager 2007.

See Also

Concepts

Prerequisites for Software Distribution

Other Resources

Configuring Software Distribution
Administrator Workflows for Software Distribution
Software Distribution Overview


How to Manage Packages

Configuration Manager 2007 uses packages to distribute software to clients. Every package must contain at least one program, identifying what actions should occur on the client when the package is received.

Packages are created and maintained from the Packages node in the Configuration Manager console.

In This Section

How to Set Up a Package Source Directory

How to Create a Package

How to Create a Package from a Package Definition File

How to Modify a Package

How to Copy Multiple Packages to One Distribution Point

How to Delete a Package

How to View the Status of A Package

See Also

Concepts

About Packages
About Package Definition Files
About the Package Definition File Format

Other Resources

How to Manage Programs


How to Set Up a Package Source Directory

A package source folder contains all the files and subdirectories needed to run the programs in a package. When you create a package that utilizes source files, you specify the package source directory and Configuration Manager 2007 sends all the files and subdirectories to the distribution points specified for the package.

Note
When creating a source directory, all files and subdirectories under the specified folder are included in the package. Because of this, you should avoid placing the source files for multiple packages within the same folder, as this may result in unwanted redundant data in the packages.

To set up a package source directory

  • Create a folder on a local or network location that can be accessed by the site server computer$ account, and copy all needed files and subdirectories to that folder.

-or-

Insert the software disk or CD in a drive that the site server can access.

  • If any of the package's programs requires an installation script, place the script in the newly created package source folder.
    Note
    To simplify the program, place the installation script or other auxiliary files in the source folder instead of one of its subdirectories.

See Also

Tasks

How to Create a Package
How to Create a Package from a Package Definition File

Concepts

About Packages


How to Create a Package

The primary method of creating a package within Configuration Manager 2007 is to create the package manually in its entirety.

You can also create a package using a package definition file as a template. For information about how to do this, see How to Create a Package from a Package Definition File. To find out more about package definition files, see About Package Definition Files.

Additionally, you can use the Distribute Software Wizard to create a package if you want to create and distribute the package and associated programs, advertisements and (optionally) collections at the same time.

Once created, Configuration Manager 2007 displays the new package in the Configuration Manager console, and by default, it adds Read permission for the local user access account and Full control permissions for the administrator group.

Note
You must have Create permissions for the Package Security object type to create a package. You can edit package security settings using the Package Properties dialog box or through the Security Rights node on the Configuration Manager Console. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

How to create a package manually

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. Right-click Packages, point to New, and then click Package.

  3. Use the New Package Wizard to create a software distribution package, specifying general information, data source, distribution settings, and other information for the new package.

    For additional information about this wizard, see New Package Wizard.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Packages

Other Resources

Distribute Software Wizard
Software Distribution Overview
New Package Wizard


How to Create a Package from a Package Definition File

In addition to being created manually, packages can also be created using a previously existing package definition file. This package definition file is a template that specifies all the information that Configuration Manager 2007 needs about a package except where to find its source files. (For more information about package definition files, see About Package Definition Files. In addition, information about the format is available at About the Package Definition File Format.)

Once created, Configuration Manager 2007 displays the new package in the Configuration Manager console, and by default it adds Read permission for the local user access account and Full control permissions for the administrator group.

It is recommended that you review all the settings for the package after importing it from a package definition file to ensure the settings are appropriate for your installation requirements.

Note
You must have Create permissions for the Package Security object type to create a package. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To create a package from a package definition file

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. Right-click Packages, point to New, and then click Package from Definition.

  3. Use the Create Package from Definition Wizard to create a software distribution package based on an existing package definition file, specifying general information, data source, distribution settings, and other information for the new package.

    For additional information about this wizard, see Create Package From Definition Wizard.

See Also

Concepts

About Package Definition Files
About Packages
About the Package Definition File Format

Other Resources

Software Distribution Overview
Create Package From Definition Wizard


How to Modify a Package

In order to modify the properties of a specific package, you must have Modify permission for the Package security object type. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

How to modify package properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click the package you want to modify, and then click Properties.

  3. In the Package Properties dialog box, modify the settings as needed.

    For information about the specific pages in this dialog box, see Package Name Properties.

See Also

Concepts

About Packages

Other Resources

Software Distribution Overview
Package Name Properties


How to Copy Multiple Packages to One Distribution Point

Topic last updated—November 2007

Use the Copy Packages Wizard in Microsoft System Center Configuration Manager 2007 from the Configuration Manager console to help you copy existing packages to a new distribution point. The wizard can effectively create a copy of an existing distribution point by allowing you to select all the packages on that distribution point. Specifying a source distribution point is not required because by default Configuration Manager 2007 displays all available packages.

The Copy Packages Wizard filters the source packages to copy based on the package type so that when this wizard is run from the Software Distribution node, only software packages are displayed. If you want to copy different package types to a new distribution point, run this wizard from the appropriate package-type node, such as Software Updates or Operating System Deployment.

Note
To copy a package to a distribution point, you must have Distribute permission for that Package security object. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To copy one or more packages to a distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. Right-click the Packages node, and then click Copy Packages.

  3. Use the Copy Package Wizard to select the destination distribution point and the specific packages to copy.

    For information about this wizard, see Copy Packages Wizard.

See Also

Concepts

About Packages

Other Resources

Copy Packages Wizard


How to Delete a Package

You can delete a package from the site where it was created. However, the system cannot delete a package from a distribution point if a user has locked a network file.

When a package is deleted, Configuration Manager 2007 removes it from the database. If the package was sent to child sites, the package information at those child sites is also deleted. If a compressed version of source files for the package exists, Configuration Manager 2007 deletes that file from the site server.

Note
Deleting a package does not remove the package source folder, nor does it remove any programs that have already run on clients.

Package data is also removed from the distribution points. All advertised programs linked to the package are also deleted from the Configuration Manager 2007 database and from clients.

Note
You must have Delete permission for the Package Security object type in order to delete a package. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To delete a package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click the package you want to delete, and then click Delete.

  3. Use the Delete Package Wizard to assess the effects of deleting the package and to delete it.

    For information about this wizard, see Delete Package Wizard.

See Also

Concepts

About Packages

Other Resources

Delete Package Wizard


How to View the Status of A Package

Monitoring the ongoing status of a package is a common task for Configuration Manager 2007 administrators. This status can be viewed for either a single package or for all available packages.

For a description of each status detail, see About the Package Status Node.

To view the status of a single package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status.

  2. Expand Package Status.

  3. To view the overall status of a specific package, click the package name. Status details will be displayed in the Results pane.

    Note
    You can also view status messages by right-clicking the package name, pointing to Show Messages, and then clicking the type of message you want to view: All, Error, Warnings, or Info. For more information about the Status Message Viewer, see ConfigMgr Status Message Viewer Overview.

  4. To view the status of a specific package based on the sites associated with it, expand the package name and click the site name you want to view. Status details will be displayed in the Results pane.

To view the status of all packages

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status.

  2. Click Package Status. Status details will be displayed in the Results pane.

    Note
    You can view status messages for individual packages in the Results pane by right-clicking the specific package name, pointing to Show Messages, and then clicking the type of message you want to view: All, Error, Warnings, or Info. For more information about the Status Message Viewer, see ConfigMgr Status Message Viewer Overview.

See Also

Concepts

About Packages
About the Package Status Node
ConfigMgr Status Message Viewer Overview


How to Manage Programs

Although a package contains the application, files, or information that need to be applied to the client computers, the program is responsible for defining how that application is to be used. As a result, the program must include all appropriate references to script files or command switches. The program also defines the platform and environment in which the package can run, which means that you might have a program for each suitable platform when you have clients using different operating systems.

Every package must contain at least one program, identifying what actions should occur on the client when the package is received.

Packages are created and maintained from the Packages node in the Configuration Manager console.

In This Section

How to Create a Program

How to Modify a Program

How to Disable a Program

How to Enable a Program

How to Delete a Program

See Also

Concepts

About Packages
About Programs

Other Resources

How to Manage Packages


How to Create a Program

To be functional, each Configuration Manager 2007 package must contain at least one program, although many contain more than one. These programs are used to define how the application from the package will be used on that client. As a result, the program must include all appropriate references to script files or command switches.

To create a program within a package, you must have Modify permission for the Package Security object type or for the specific package instance. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

Note
The use of software deployed by Configuration Manager may be subject to license terms. All applicable license terms should be reviewed prior to deploying software.

To create a program

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Package / <package name>.

  2. Right-click Programs, point to New, and then click Program.

  3. Use the New Program Wizard to create a program for a software distribution package, specifying general information, program requirements, runtime environment, and other information for the new package.

    For additional information about this wizard, see New Program Wizard.

See Also

Concepts

About Programs

Other Resources

New Program Wizard
How to Manage Programs


How to Modify a Program

To modify a program within a package, you must have Modify permission for the Package Security object type or for the specific package instance. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To modify a program within a package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / <server name> / Computer Management / Software Distribution / Packages / <package name> / Programs.

  2. Right-click the program you want to modify, and then click Properties.

  3. In the Program Property dialog box, update the settings as needed.

    For additional information about this dialog box, see Program Name Properties.

See Also

Reference

Program Name Properties

Concepts

About Programs

Other Resources

How to Manage Programs


How to Disable a Program

You can disable a program to prevent Configuration Manager 2007 from running it on client computers where it is currently advertised. When a program is disabled, the program is still sent to distribution points and is still advertised on client computers, but it will not be displayed or run on the client. This behavior is the same that occurs when an advertisement with which the program has been associated has been disabled.

You can enable an advertisement that has been disabled to resume availability of the program to client computers.

Note
When you disable a program, all advertisements of that program are also affected.

To disable a program

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand the package to which the program belongs, and then click Programs.

  3. Right-click the program name, and then click Properties.

  4. On the Advanced tab, select the Disable this program on computers where it is advertised check box.

  5. Click OK.

    Note
    You can also disable a program by disabling an advertisement associated with it. For more information about how to do this, see How to Disable an Advertisement.

See Also

Tasks

How to Disable an Advertisement
How to Enable an Advertisement

Concepts

About Packages


How to Enable a Program

You can enable a program that has been disabled in order to resume availability of that program to client computers.

To enable a program

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand the package to which the program belongs, and then click Programs.

  3. Right-click the program name, and then click Properties.

  4. On the Advanced tab, clear the Disable this program on computers where it is advertised check box.

  5. Click OK.

    Note
    You can also enable a program by enabling an advertisement that was used to disable it. For more information about how to do this, see How to Enable an Advertisement.

See Also

Tasks

How to Disable a Program
How to Enable an Advertisement

Concepts

About Programs


How to Delete a Program

When a program is deleted from a package, the package information is updated in the Configuration Manager 2007 site database. All of the advertisements for this program are also deleted from the database and removed from clients that have received them. If the advertised program has already been run on the client computer, however, that software is not removed.

Note
To delete a program from a package, you must have Modify permission for the Package security object type or for the specific package instance. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To delete a program from a package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages / <package name> / Programs.

  2. Right-click the program you want to remove, and then click Delete.

  3. Use the Delete Program Wizard to assess the effects of deleting the package and to delete it.

    For information about this wizard, see Delete Program Wizard.

See Also

Concepts

About Programs

Other Resources

Delete Program Wizard
How to Manage Programs


How To Configure Windows Installer Source Update Management

Topic last updated—November 2007

To enable source location updates to the Windows Installer product, the Windows Installer product code and file name must be associated with a Microsoft System Center Configuration Manager 2007 program. After a distribution point is added to the package, Configuration Manager 2007 generates a policy update for all Configuration Manager 2007 clients. After they receive the policy, clients update their source paths for the Windows Installer application specified in the package.

No advertisements are necessary to allow the Windows Installer information to be sent to the Configuration Manager 2007 clients. You can create a Configuration Manager 2007 package, distribute it to your distribution points, and update the Windows Installer information for the package, and all of your clients will now point their source locations to the Configuration Manager 2007 distribution points that have the package.

Note
If you have several Windows Installer products in the same Configuration Manager 2007 package, add each product code and corresponding Windows Installer file name in a separate Configuration Manager 2007 program. Configuration Manager 2007 will not allow the same product code to reside within a Configuration Manager 2007 package more than once.

To enable the Windows Installer source location

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand the package to which the program belongs, and then click Programs.

  3. Right-click the program name, and then click Properties.

  4. On the Windows Installer tab, click Import to import a Windows Installer file. The Windows Installer product code is filled in automatically.

  5. Click OK.

To disable the Windows Installer source location

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand the package to which the program belongs, and then click Programs.

  3. Right-click the program name, and then click Properties.

  4. On the Windows Installer tab, click Clear.

  5. Click OK.

See Also

Reference

Program Name Properties: Windows Installer Tab

Concepts

About Windows Installer Source Location Manager
Script Sample for API-Based Triggering of the Product Source Update Manager


How to Manage Distribution Points

Configuration Manager 2007 uses distribution points to store the source files needed for packages to run on client computers. When an advertised program requires files that do not reside on the local computer, clients must have access to at least one distribution point from which they can download those files.

For more information about distribution points, see About Distribution Points.

In This Section

How to Send a Package to Distribution Points

How to Update Package Data on Distribution Points

How to Remove a Package from a Distribution Point

How to Manage Branch Distribution Points

See Also

Concepts

About Distribution Points
About Standard and Branch Distribution Points


How to Send a Package to Distribution Points

To distribute packages to client computers, Configuration Manager 2007 sends a copy of the package data to distribution points from which the clients download the package. When one or more distribution points have been selected for the package, the source files and other data will be stored on that distribution point as specified when the package was created.

Note
You must have Distribute permission for the Package Security object type to send a package to a distribution point. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To send a package to distribution points

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Expand the package that you want to send to a distribution point, right-click Distribution Points, and then click Manage Distribution Points.

  3. Use the Manage Distribution Points Wizard to select which distribution points to which you want to send the package.

    For information about this wizard, see Manage Distribution Points Wizard.

    Note
    You can also use the New Distribution Points Wizard to send a package to a distribution point. For more information about this wizard, see New Distribution Points Wizard.

See Also

Concepts

About Packages

Other Resources

Software Distribution Overview
Manage Distribution Points Wizard
New Distribution Points Wizard


How to Update Package Data on Distribution Points

Although you can schedule recurring updates to a distribution point by using the Data Source tab in the properties of a package, you can also manually update package data on associated distribution points at any time. Manually updating the distribution points will not interfere with the recurring update schedule. (For more information about setting a recurring update schedule for a package, see Package Name Properties: Data Access Tab.)

Note
To update a package on its associated distribution points, you must have Distribute permission for the Package Security object type or for the specific package instance. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

When you update package data on a distribution point, the existing copy of the package files is first deleted from the distribution point. Configuration Manager 2007 then sends a new copy of the package data to the distribution point. The version of the package is incremented every time the package is updated.

To update package data on a distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Package / <package name>.

  2. Right-click Distribution Point, and then click Update Distribution Points.

    Note
    You can also update a package's distribution points by right-clicking the package name and then clicking Update Distribution Points.

  3. Click Yes to confirm that you want to update the package on the selected distribution point with a new version of the package.

See Also

Concepts

About Distribution Points
Choose Between Updating and Refreshing a Package

Other Resources

Software Distribution Overview


How to Refresh Package Data on Distribution Points

Topic last updated—November 2007

When you refresh package data on a Microsoft System Center Configuration Manager 2007 distribution point, the package is copied from the compressed version on the site server but not updated from the original source. Refreshing the package does not increment the package version.

To refresh package data on a distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Package / <package name>.

  2. Right-click Distribution Point, and then click Refresh Distribution Points.

    Note
    You can also update a package's distribution points by right-clicking the package name and then clicking Refresh Distribution Points.

  3. Click Yes to confirm that you want to update the package on the selected distribution point with a new version of the package.

See Also

Concepts

About Distribution Points
Choose Between Updating and Refreshing a Package

Other Resources

Software Distribution Overview


How to Remove a Package from a Distribution Point

When you choose to remove a package from a distribution point, Configuration Manager 2007 removes all package data from the specified distribution point. You can remove a package from a single distribution point to which it has been distributed or from any number of such distribution points. If an advertised program no longer has any distribution points available, Configuration Manager 2007 removes the advertisement from clients.

To remove a package from a distribution point, you must have Distribute permission for the Package security object type or for the specific package instance. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

Note
You cannot delete a package from a distribution point if a user has locked an associated network file.

To remove a package from a distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Package / <package name>.

  2. Right-click Distribution Points, and click Manage Distribution Points.

  3. Use the Manage Distribution Points Wizard to remove the package from one or more distribution points within your site.

    For additional information about this wizard, see Manage Distribution Points Wizard.

    Note
    You can also remove package data from a single distribution point by navigating to Configuration Manager / <server name> / Computer Management / Software Distribution / Package / <package name> / Distribution Point, right-clicking the specific distribution point from which you want to remove the package data, and then clicking Delete.

See Also

Concepts

About Distribution Points
How to Configure Distribution Points

Other Resources

Manage Distribution Points Wizard
How to Manage Distribution Points


How to Manage Branch Distribution Points

Configuration Manager 2007 uses branch distribution points for small or distributed offices, allowing them distribution point functionality without requiring a secondary site to be set up. Branch distribution points can be installed on server or workstation computers with the Configuration Manager client.

For more information about branch distribution points, see About Standard and Branch Distribution Points.

This section discusses tasks encountered when using an existing branch distribution point. For more information about setting up a branch distribution point, see How to Configure Branch Distribution Points.

In This Section

How to Prestage Packages on a Branch Distribution Point

How to Distribute a Package to a Branch Distribution Point

How to Configure On-Demand Package Distribution to a Branch Distribution Point

How to Delete a Package from a Branch Distribution Point

How to Restore Packages on a Branch Distribution Point

See Also

Concepts

About Standard and Branch Distribution Points

Other Resources

How to Configure Branch Distribution Points


How to Prestage Packages on a Branch Distribution Point

Prestaging packages on a branch distribution point will minimize the bandwidth otherwise necessary to download the packages.

This is done as part of the Branch Distribution Point Maintenance task. When initiated, this task will verify the prestaged package and download any packages that do not exist on the branch distribution point. A success status message is sent to the management point, and server records are updated to reflect the availability of the package on the branch distribution point.

Note
The Branch Distribution Point Maintenance task will run these jobs only for an existing branch distribution point server role; it will not create the role. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To prestage a package on a branch distribution point

  1. If one does not already exist, create an SMSPKG<driveletter>$ directory and share on the branch distribution point.

    Note
    When creating an SMSPKG<driveletter>$ directory and share, the <driveletter> is the relevant drive on the branch distribution point. For example, SMSPKGC$ would be the directory and share created on drive C of the branch distribution point.

  2. Using a standard distribution point as the original source for the package, copy the packages into the SMSPKG<driveletter>$ directory.

  3. On the branch distribution point computer, double-click Configuration Manager in Control Panel.

  4. On the Actions tab, select Branch Distribution Point Maintenance Task and then click Initiate Action.

See Also

Tasks

How to Deploy a Branch Distribution Point

Concepts

About Standard and Branch Distribution Points

Other Resources

How to Manage Branch Distribution Points


How to Distribute a Package to a Branch Distribution Point

After a branch distribution point has been deployed using Configuration Manager 2007, those points are treated similarly to standard distribution points when distributing a package.

Note
Some features are available for packages when targeted to branch distribution points that are not available on standard distribution points and vice versa. See Package Name Properties for settings that affect only standard or branch distribution points.

To distribute a package to a branch distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click the specific package you want to distribute, and then click Manage Distribution Points.

  3. Use the Manage Distribution Points Wizard to specify how you want to distribute the package to the distribution point.

    For additional information about this wizard, see Manage Distribution Points Wizard.

See Also

Concepts

About Standard and Branch Distribution Points

Other Resources

How to Manage Branch Distribution Points
Manage Distribution Points Wizard


How to Configure On-Demand Package Distribution to a Branch Distribution Point

Clients of a branch distribution point Configuration Manager 2007 will sometimes wish to receive a package that has been advertised, but which has not specifically been copied to that branch distribution point. This can be done using the branch distribution point's on-demand functionality, but first must be configured for the specific package by the administrator. It can be configured using the New Package Wizard when a package is initially created or subsequently, using the Distribution Settings tab of the Package <Name> Properties dialog box. If a package is created using the Distribute Software Wizard, this is not available in the wizard, but must be done afterward, using the Package <Name> Properties dialog box.

On-demand package distribution is visible only from the administrator point of view; for the client, this functionality will be transparent.

Note
On-demand package distribution is only available for protected branch distribution points, from clients within the protected boundaries. If a client is not within those protected boundaries or the branch distribution point is not protected, on-demand distribution will fail.

To configure on-demand package distribution to a branch distribution point using the New Package Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click the Packages node, point to New, and then click Package.

  3. Use the New Package Wizard to create a new package.

    On the Distribution Settings page:

    • Click Branch distribution points automatically download this package when they receive the advertisement. This option should be selected by default.
    • Select the Make this package available on protected distribution points when requested by clients within the protected boundaries checkbox.

    For additional information about this wizard, see New Package Wizard.

To configure package properties to allow on-demand package distribution to a branch distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click the specific package you want to modify, and then click Properties.

  3. On the Distribution Settings tab:

    • Click Branch distribution points automatically download this package when they receive the advertisement if this option is not already selected.
    • Select the Make this package available on protected distribution points when requested by clients within the protected boundaries checkbox.

  4. Click OK to close the package properties.

See Also

Reference

Package Name Properties: Distribution Settings Tab

Concepts

About Standard and Branch Distribution Points
About On-Demand Package Distribution

Other Resources

How to Manage Branch Distribution Points
New Package Wizard


How to Delete a Package from a Branch Distribution Point

When you choose to remove a package from a branch distribution point, Configuration Manager 2007 removes all package data in the same manner as with a standard distribution point. You can remove a package from a single distribution point to which it has been distributed or from any number of such distribution points. If an advertised program no longer has any distribution points available, Configuration Manager 2007 removes the advertisement from clients.

To remove a package from a branch distribution point, you must have Distribute permission for the Package Security object type or for the specific package instance. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

Note
As with standard distribution points, you cannot delete a package from a branch distribution point if a user has locked an associated network file.

To remove a package from a distribution point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Package / <package name>.

  2. Right-click Distribution Points, and click Manage Distribution Points.

  3. Use the Manage Distribution Points Wizard to remove the package from one or more branch distribution points.

    For additional information about this wizard, see Manage Distribution Points Wizard.

    Note
    You can also remove package data from a single branch distribution point by navigating to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Package / <package name> / Distribution Point, right-clicking the specific branch distribution point from which you want to remove the package data, and then clicking Delete.

See Also

Concepts

About Standard and Branch Distribution Points

Other Resources

How to Manage Branch Distribution Points
How to Configure Branch Distribution Points
Manage Distribution Points Wizard


How to Restore Packages on a Branch Distribution Point

To restore packages on a branch distribution point

  1. If necessary, reinstall the Configuration Manager client and redeploy the branch distribution point. For information about how to do this, see How to Deploy a Branch Distribution Point.

  2. If the share does not exist, create an SMSPKG<driveletter>$ directory on the branch distribution point, where <driveletter> is the relevant drive on the branch distribution point.

  3. Restore the package directories and files from their backup location.

  4. On the branch distribution point:

    • Double-click Configuration Manager in Control Panel.
    • On the Actions tab, select Branch Distribution Point Maintenance Task.
    • Click Initiate Action.

    The Branch Distribution Point Maintenance Task will verify the prestaged packages and download any packages that do not exist on the branch distribution point. A success status message is sent to the management point, and the server’s records are then updated to reflect the availability of the packages.

See Also

Tasks

How to Deploy a Branch Distribution Point

Other Resources

How to Manage Branch Distribution Points


How to Manage Advertisements

Configuration Manager 2007 uses advertisements to distribute programs to clients. You create and maintain these advertisements using the Advertisements node in the Configuration Manager console.

In This Section

How to Create an Advertisement

How to Delete an Advertisement

How to Disable an Advertisement

How to Enable an Advertisement

How to Re-run an Advertisement

How to View the Status of an Advertisement

How to Retain an Advertisement Status Summary

How to Assign a Mandatory Advertisement

How to Modify an Advertisement

See Also

Concepts

About Advertisements


How to Create an Advertisement

Once a package has been created, along with programs to tell client computers what to do with the package, you need to advertise the program that you want the clients to run. Advertising the program makes a program available to a specified collection of clients. (For information about collections, see About Collections.)

When creating advertisements, it is strongly recommended that you test advertised programs in a controlled environment before you create advertisements for the clients in your site hierarchy.

Important
When creating an advertisement, Configuration Manager includes subcollections as well as collections by default. You should review this option to avoid including undesirable clients in an advertisement.

In order to create an advertisement, you must have Create permission for the Advertisement security object type, Advertise permission for the collection, and Read permission for the package. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

Note
When creating an advertisement reusing packages from earlier version of System Management Server (SMS) where no hash was created, you need to update the package first before sending out the advertisement. Without doing this, Configuration Manager clients will fail to run the advertisement.

To create an advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. Right-click Advertisements, point to New, and then click Advertisement.

  3. Use the New Advertisement Wizard to create an advertisement, specifying general information, the collection to which the advertisement should be distributed, the run schedule, and other information for the new advertisement.

    For additional information about this wizard, see New Advertisement Wizard.

See Also

Concepts

About Advertisements

Other Resources

Advertisements Property Pages
New Advertisement Wizard


How to Delete an Advertisement

When an advertisement is deleted, Configuration Manager 2007 will remove the advertisement from the database and from clients that have already received it.

To delete an advertisement, you must have Delete permission for the Advertisement security object or instance type, and Read permission for both the collection and package associated with the advertisement. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To delete an advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. In the results pane, right-click the advertisement you want to delete and then click Delete.

  3. Click Yes to confirm that you want to delete the advertisement.

See Also

Concepts

About Advertisements

Other Resources

Advertisements Property Pages


How to Disable an Advertisement

You can disable an advertisement to prevent Configuration Manager 2007 from running the associated program on client computers where it is currently advertised. When an advertisement is disabled, the program is still sent to distribution points and is still advertised on client computers, but it will not be displayed or run on the client. This behavior is the same that occurs when a program has been disabled directly.

You can enable an advertisement that has been disabled to resume availability of the program to client computers.

Note
When you disable an advertisement, all advertisements of the associated program are affected, not just the advertisement you select.

To disable an advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click the advertisement you want to disable, and click Disable Program.

  3. Click Yes.

    Note
    You can also disable a program directly from that program's properties dialog box. For more information about how to do this, see How to Disable a Program.

See Also

Tasks

How to Disable a Program
How to Enable an Advertisement

Concepts

About Advertisements


How to Enable an Advertisement

You can enable an advertisement that has been disabled in order to resume availability of the associated program to client computers.

How to enable an advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click the advertisement you want to enable, and click Enable Program.

  3. Click Yes.

    Note
    You can also enable a program directly from that program's properties dialog box. For more information about how to do this, see How to Enable a Program.

See Also

Tasks

How to Disable an Advertisement
How to Enable a Program

Concepts

About Advertisements


How to Re-run an Advertisement

Advertisements can only be rerun if the original advertisement has a mandatory scheduled assignment that has not expired. The Re-run advertisement functionality creates a new mandatory assignment for the advertised program, scheduled to the current time and date. This forces all clients in the target collection to rerun the advertisement, even if they have already run it.

Note
A maximum of 15 mandatory assignments (including rerun advertisements) are allowed at one time for each program.

To rerun an advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click the advertisement you want to rerun, and then click Re-run Advertisement.

  3. Click Yes.

See Also

Concepts

About Advertisements

Other Resources

How to Manage Advertisements


How to View the Status of an Advertisement

When managing a large number of advertised programs within Configuration Manager 2007, it is often convenient to monitor the ongoing status of advertisements..

Procedures

To view the status of an advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Advertisement Status.

  2. In the results pane, view the status information.
Note
You can also view status information by using Status Message Viewer.

See Also

Tasks

How to View the Status of a Single Advertisement


How to Retain an Advertisement Status Summary

When an advertisement is deleted, Configuration Manager 2007 will also remove the status summary for that advertisement, thereby preventing a buildup of obsolete status summaries.

Occasionally, however, it is useful to retain a status summary after you are no longer using an advertisement. This can be especially useful in the following situations:

  • When evaluating advertisement status information over time.
  • When status information is continuing to arrive from child sites.
  • When analysis of the summary data is continuing, such as when the advertisement was for a pilot project.

To retain an advertisement status summary, you must have Modify permission for the Package security object type, Advertise permission for the Collection security object or instance type, and Read permission for the Package security object or instance type.

For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To retain an advertisement status summary

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click the advertisement for which you want to retain the status summary, and then click Properties.

  3. On the Schedule tab, set the Advertisement will expire value to a time in the past. As short a time as a minute before the present time is sufficient.

See Also

Concepts

About Advertisements

Other Resources

Advertisements Property Pages
How to Manage Advertisements


How to Assign a Mandatory Advertisement

Adding an assignment schedule to an advertisement makes the advertised program run at a specific time or upon a specific event. Making this advertisement mandatory can be done either when creating an advertisement or at a later time. For more information about assigning an advertisement when creating it, see Schedule Page for the New Advertisement Wizard.

Note
A maximum of 15 mandatory assignments (including rerun advertisements) are allowed at one time for each program.

To make an existing advertisement mandatory

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click the desired advertisement, and then click Properties.

  3. On the Schedule tab, click the New icon for Mandatory Assignments.

  4. To assign the advertisement to a specific schedule, select the Assign to the following schedule option, and then click Schedule. This will open the Custom Schedule dialog box, where you can set a specific schedule for the assignment. For more information about this dialog box, see Custom Schedule Dialog Box.

  5. To assign the advertisement so that it runs after a specific event, select the Assign immediately after this event option, and from the drop-down list, select one of the following events:

    • As soon as possible
    • Logon
    • Logoff.

    For more information about this dialog box, see Assignment Schedule Dialog Box.

See Also

Concepts

About Advertisements

Other Resources

How to Manage Advertisements


How to Modify an Advertisement

Modifying an advertisement that you've already created is sometimes necessary to meet changing circumstances. This is done through the properties dialog box of the specific advertisement.

It is important to note that if an advertisement has already run from a schedule and you modify the advertisement schedule to run immediately after an event, that advertisement will not run. To specify a start time for an advertisement that has already run from a schedule, you should schedule a specific time to run in the future.

Note
To modify an advertisement, you must have Modify permission for the Package security object type, Advertise permission for the collection, and Read permission for the package. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To modify an advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. In the results pane, right-click the advertisement you want to modify and then click Properties.

  3. In the Advertisement Property dialog box, update the settings as needed.

    For additional information about this dialog box, see Advertisement Name Properties.

See Also

Concepts

About Advertisements

Other Resources

How to Manage Advertisements


How to Manage Virtual Application Packages

Topic last updated—March 2008

You can import virtual application packages into Configuration Manager 2007 which can be distributed and used by Configuration Manager 2007 clients.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

How to Import Virtual Application Packages into Configuration Manager

How to Advertise Virtual Application Packages

How to Delete a Virtual Application Package from a Configuration Manager Client

How to Distribute a Virtual Application Package Using a Task Sequence

How to Update an Existing Virtual Application Package

See Also

Other Resources

Tasks for Software Distribution


How to Import Virtual Application Packages into Configuration Manager

Topic last updated—January 2008

Use the New Virtual Application Package Wizard to import virtual application packages created using the Microsoft Application Virtualization Sequencer into Configuration Manager 2007 that can be distributed to Configuration Manager 2007 clients. You must be logged in with a user account that has read/write access to the destination directory or the import will fail

Note
You must use the New Virtual Application Package wizard to import the virtual application into Configuration Manager 2007 before you can advertise the virtual application package to Configuration Manager 2007 clients.

The following procedure provides the steps necessary to add virtual application packages to Configuration Manager 2007.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To import virtual application packages into Configuration Manager

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. To open the New Virtual Application Package Wizard, right-click Packages and select New / Virtual Application Package.

  3. On the Package Source page, specify the location of the virtual application that you want to import into Configuration Manager 2007 by clicking Browse. The directory you select must contain the manifest.XML file for the virtual application. This is usually the location of the sequenced application created using the Microsoft Application Virtualization Platform. A list of all applications associated with the selected application is displayed. You should review the list to ensure the applications should be part of the selected virtual application package. Click Next.

  4. On the General page, provide identifying information for the virtual application package. You can specify the Name, Version, Manufacturer, Language, and an optional Comment that will be associated with the virtual application package. Also specify if the virtual package should be removed from Configuration Manager 2007 clients when the associated advertisement has been deleted. Click Next.

    Important
    If you plan to advertise this virtual application package to target computers that are members of a dynamic collection you should consider deselecting Remove this virtual application when it is no longer advertised. If this option is selected, computers that are members of the target collection will run the advertisement and install the virtual application and uninstall the virtual application if they are removed from the target collection. For more information about Configuration Manager 2007 collection types see About Collection Membership.

  5. On the Data Source page, specify the destination location that will be used as the Configuration Manager 2007 package source. This is the location where virtual application packages will be copied to distribution points from. The files for the sequenced application will be copied to the specified directory and the .sft file will be renamed and any associated .osd files will reference the new .sft file. The Destination directory cannot be the same location as the Source directory. After the virtual application package is created the destination directory cannot be changed. Click Next.

  6. On the Security page, configure the security that will be associated with the virtual application package and click Next.

  7. On the Summary page, verify the settings that have been configured with the virtual application package and click Next.

  8. On the Confirmation page, confirm that the virtual application package was successfully imported and click Close to exit the New Virtual Application Package Wizard.

See Also

Other Resources

How to Manage Virtual Application Packages


How to Advertise Virtual Application Packages

Topic last updated—January 2008

After you have imported a virtual application package into Configuration Manager 2007, for Configuration Manager 2007 clients to run it you must add the virtual application package to a distribution point and advertise the virtual application package to a Configuration Manager 2007 collection. You can advertise virtual application packages by using the Distribute Package wizard or the New Advertisement wizard. By default, virtual application packages are also advertised to any associated sub collections.

If you want to make virtual application packages available to Configuration Manager 2007 clients, you must advertise the package by using the New Advertisement wizard or by using a task sequence. For more information about using a task sequence see How to Distribute a Virtual Application Package Using a Task Sequence

The following procedures provide the steps necessary to copy a virtual application package to distribution points and advertise virtual application packages to Configuration Manager 2007 clients.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To advertise virtual application packages using the distribute package wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution .

  2. If necessary, expand the Packages node. To open the Distribute Package wizard, right-click the virtual application package you want to advertise, and click Distribute / Software.

  3. On the Welcome page, click Next.

  4. On the Distributions Points page, select the distribution points that Configuration Manager 2007 clients will use to access the package. Click Next.

    Note
    If the selected virtual package already exists on a distribution point, the associated distribution point will already be selected. You can specify additional distribution points, or just click Next.

  5. On the Advertise Program page, to advertise the virtual package, select Yes. Click Next.

  6. On the Select Program page, confirm the virtual package that will be advertised.

  7. On the Advertisement Target page, specify an existing collection that will receive the advertisement by clicking Browse. To create a new collection, select Create a new collection and advertise the virtual application to it.

    Note
    If you have chosen to create a new collection, go on to step 8. If you are advertising the package to an existing collection, skip to step 10.

  8. On the New Collection page, specify the Name and optional Comment that will be associated with the new collection. Click Next.

  9. On the Collection Membership Rules page, specify the rules that will be evaluated for collection membership. For more information about creating collections, see Collections Overview. Click Next.

  10. On the Advertisement Name page, specify a Name and optional Comment for the new advertisement. Click Next.

  11. On the Advertisement Subcollections page, specify whether the new advertisement should be made available to any subcollections associated with the selected collection. Click Next.

    Important
    When creating an advertisement, Configuration Manager includes subcollections as well as collections by default. Review this option to avoid including undesirable clients in an advertisement.

  12. On the Advertisement Schedule page, configure when the advertisement will be made available to Configuration Manager 2007 clients. You can also configure when the advertisement will expire and no longer be available to Configuration Manager 2007 clients by selecting Yes, this advertisement should expire and specifying the expiration date. If the package is not available on a protected distribution point, specify whether the Configuration Manager 2007 client should download the package and run it locally from an unprotected distribution point, which is the default. Click Next.

  13. On the Assign Program page, specify whether the advertisement will be assigned to Configuration Manager 2007 clients. Assigned advertisements are mandatory and will run on all Configuration Manager 2007 clients that have not already run the advertisement. If this advertisement is mandatory, configure the properties for the advertisement by selecting the desired assignment options. Click Next.

  14. On the Summary page, confirm the settings associated with the new advertisement. Click Next.

  15. On the Confirmation page, click Close.

To advertise virtual application packages using the new advertisement wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. If necessary, expand the Packages node. To open the New Advertisement wizard right-click Advertisements, select New, and then click Advertisement.

  3. On the General page, specify the advertisement Name and an optional descriptive Comment. Select the virtual application package that will be associated with this advertisement by clicking Browse and selecting the package in the Select a Package dialog box. To specify the collection that will receive the advertisement, click Browse and select the collection that will receive the advertisement. Click Next.

    Note
    You must add the virtual application package to a distribution point for Configuration Manager 2007 clients to access them by using this advertisement. For more information about adding a package to a distribution point, see How to Send a Package to Distribution Points.

  4. On the Schedule page, specify the properties of the advertisement. Click Next.

  5. On the Distribution Points page, specify how target computers will run the advertised virtual application package. If you want Configuration Manager 2007 clients to run the package from a distribution point, select Stream virtual applications from distribution point. Selecting this option will configure Configuration Manager 2007 clients to run the virtual application across the network. Click Next.

  6. On the Interaction page, specify how users are notified and interact with the advertisement. Click Next.

  7. On the Security page, configure the security that will be associated with the virtual application package and click Next.

  8. On the Summary page, verify the settings that have been configured with the virtual application package and click Next.

  9. On the Confirmation page, confirm that the virtual application package was successfully imported and click Close to exit the New Virtual Application Package Wizard.

See Also

Tasks

How to Delete a Virtual Application Package from a Configuration Manager Client

Other Resources

How to Manage Virtual Application Packages


How to Delete a Virtual Application Package from a Configuration Manager Client

Topic last updated—January 2008

You can use the following methods to delete a virtual application package from Configuration Manager 2007 client computers:

  • Delete the Configuration Manager 2007 advertisement for the virtual application package.
  • Remove the Configuration Manager 2007 client computer from the collection that receives the virtual application package advertisement.

If you use the first method and delete the associated package advertisement, Configuration Manager 2007 will remove the package and all of the associated applications from all computers that are members of the collection that originally received the advertisement.

If you want to remove the package from a specific computer, you must use the second method and remove the computer from the collection that receives the advertisement. If you use query based or dynamic collections, target computers that are members of a dynamic collection that did receive the virtual application package advertisement will not run the advertisement unless you deselect Remove this virtual application package when it is no longer advertised on the General page of the New Virtual Application Package Wizard. For more information about the collection types see About Collection Membership.

For information about deleting a package from the Configuration Manager 2007 site, see How to Delete a Package.

Use the following procedures to delete a virtual application package from a specific collection or from a specific computer.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To delete a virtual application package advertisement for members of a collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. In the results pane, right-click the advertisement associated with the virtual application package you want to delete, and then click Delete.

  3. Click Yes to confirm that you want to delete the advertisement.

To delete a virtual application package from a specific computer

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. To initiate the deletion of the virtual application package on the Configuration Manager 2007 client, select the computer that should no longer run the virtual application package and remove the computer from the collection by clicking Delete in the Actions pane. After the computer has been deleted from the collection, the virtual application package will be removed from the computer.

    Important
    For the computer to remove the virtual application, it must not be a member of any collection that receives the virtual application package advertisement.

See Also

Tasks

How to View the Advertisements for a Collection

Other Resources

Collections in Configuration Manager
How to Manage Virtual Application Packages


How to Distribute a Virtual Application Package Using a Task Sequence

Topic last updated—January 2008

You can use the Install Software task sequence step to distribute virtual application packages that have been imported into Configuration Manager 2007. All target computers must have the Microsoft Application Virtualization Desktop Client installed to run virtual application packages. You can add a task sequence step to install the Microsoft Application Virtualization Desktop Client as part of the task sequence. Distributing multiple virtual application packages using a task sequence is not supported.

For more information about installing software using task sequences, see How to Install Software Packages as Part of a Task Sequence.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To distribute virtual application packages using a task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. Create a new task sequence, or edit an existing task sequence. If necessary, add the Install Software task sequence step. For more information about editing an existing task sequence, see How to Edit an Existing Task Sequence.

  3. To specify the virtual application package you want to distribute to Configuration Manager 2007 clients, select Install a single application.

  4. To specify the virtual application package you want to install with the task sequence, click Browse and then select the virtual application package from the list of available packages.

    Note
    You cannot specify an associated program with a virtual application package. After you select a virtual application package, the associated program line will not be available. All required programs are contained in the virtual application package.

  5. To save the task sequence, click OK.

  6. Advertise the task sequence to Configuration Manager 2007 clients. For more information about how to advertise a task sequence, see How to Advertise Task Sequences.

See Also

Concepts

About Task Sequences

Other Resources

How to Manage Virtual Application Packages


How to Update an Existing Virtual Application Package

Topic Last Updated—August 2008

You can update a virtual application package that has been imported into Configuration Manager 2007 using one of the following methods:

  • Using the Virtual Application Package Update Wizard.
  • Editing the Source directory of an existing virtual application package.

Regardless of the method you use, you must first create a new version of the virtual application package source using the Microsoft Application Virtualization Sequencer. After the new version of the package has been created, you must configure the updated virtual application package so that it references the updated Manifest XML file. The updated virtual application package must also be copied to the applicable Configuration Manager 2007 distribution points and re-advertised to target computers.

Use one of the following procedures to update an existing virtual application package.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To update an existing virtual application package using the virtual application package update wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. If necessary expand the Software Distribution node and then click Packages. To open the Virtual Application Package Update Wizard, in the results pane, right-click the virtual application package you want to update and then click Update Package. Alternatively, you can click Update Package in the Actions pane.

  3. On the Update Package page, specify the network location of the updated Manifest XML file that you created when you upgraded the sequenced application. Click Browse to locate the directory. This is the location specified when you upgraded the virtual application using the Microsoft Application Virtualization Sequencer. The applications that are contained in the new virtual application package are displayed, as well as the applications contained in the previous version. Click Next.

  4. On the General page, type the Name that will be assigned to the updated virtual application package. You must also specify the Version, Manufacturer, Language, and an optional Comment that will be assigned to the updated package.

  5. To update all associated distribution points with the new version of the virtual application package, select Update all distribution points with a new package source version. Target computers will run previous versions of the virtual application package until the updated version has been advertised and made available on an accessible distribution point.

  6. To re-run associated mandatory advertisements for the virtual application package select Re-run advertisements with existing mandatory assignments. Existing mandatory advertisements will continue to reference previous versions of the virtual application package until the updated version has been made available on an accessible distribution point. Click Next.

  7. To apply the new settings, on the Summary page, click Next. To close the wizard, on the Confirmation page, click Close.

To update an existing virtual application package by editing the source directory

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution.

  2. If necessary expand the Software Distribution node, and then click Packages. To access the Data Source tab of the virtual application package, in the results pane, right-click the virtual application package that you want to update, and then click Properties.

  3. To update the Source directory for the selected virtual application package, click the Data Source tab. To specify the new source directory, click Set and type the new path to the directory that contains the updated virtual application Manifest XML. Alternatively, click Browse to specify the location of the updated virtual application package Manifest XML.

    Note
    You cannot change the ConfigMgr data source directory associated with a virtual application package. The ConfigMgr data source directory location is specified when you import the virtual application package into Configuration Manager 2007. For more information about importing new virtual application packages, see How to Import Virtual Application Packages into Configuration Manager.

  4. You must refresh any associated distribution points with the updated version of the package. For more information about updating Configuration Manager 2007 distribution points see, How to Refresh Package Data on Distribution Points.

  5. To close the virtual application package properties, click OK.

    Note
    You must manually re-run the virtual application package advertisement for existing Configuration Manager 2007 distribution points and clients to receive the updated version of the virtual application package.

See Also

Tasks

How to Refresh Package Data on Distribution Points

Other Resources

How to Manage Virtual Application Packages


Troubleshooting Software Distribution

Topic last updated—November 2007

The topics in this section provide detailed information you can use when troubleshooting various software distribution issues.

In This Section

Troubleshooting Software Distribution Issues

Common issues and solutions for software distribution.

Software Distribution Troubleshooting Flowcharts

Flowcharts depicting processes in software distribution.

Troubleshooting Software Distribution Using Custom Error Codes

A list of error codes you might see in reports, and common resolutions.

See Also

Other Resources

Software Distribution in Configuration Manager


Troubleshooting Software Distribution Issues

Topic Last Updated—August 2008

This topic provides information to help troubleshoot software distribution issues in Microsoft System Center Configuration Manager 2007. This content might have been updated. For the most recent version, see Software Distribution Troubleshooting http://go.microsoft.com/fwlink/?LinkId=93052.

Processing Delays in Binary Delta Replication

The processing time for large packages can take an extended period of time (20–30 minutes in some cases or even longer, depending on the size of the package). During this package compression/decompression and hashing/signature-creating process, the distmgr.log might appear to be idle even though the process is continuing.

Settings That Are Changed During a Maintenance Window Are Not Immediately Effective

If settings (such as Restart Countdown) that use or affect the maintenance window are changed while the maintenance window is open, those changes will not be considered until the next applicable maintenance window. For example, if a maintenance window is currently open and has 4 minutes remaining in it, and the Restart Countdown is changed from 5 minutes to 1 minute, a queued program will not run in that maintenance window even if it would otherwise have run with the new Restart Countdown.

Packages Are Not Replicated to a Branch Distribution Point After an Extended Wait

Occasionally, when provisioning a branch distribution point, packages might not be replicated properly even after waiting for an extended period of time. A typical symptom of this can be the branch distribution point continuing to remain in "downloading" status for an extended period of time. This can occur because the job thread has failed before the main process thread, causing a known issue between the content transfer manager and the branch distribution point agent.

Solution

Retry the branch distribution point by refreshing (updating) the package. This should solve the issue.

Advertising Option "Run only when a user is logged on" Does Not Work Reliably on Windows XP Embedded

That the Run only when a user is logged on option does not work reliably when advertising a program to a Windows XP embedded system is a known issue.

Solution

The recommended course of action is to use Run whether or not a user is logged on to make sure the advertisement is executed by the Windows XPe clients.

Creating a Package from Definition via Remote Configuration Manager Console Results in an Incorrect Source Directory by Default

When creating a package from a package definition file located on the local computer, the Source Directory page might display the path to the .msi file on the local drive, but it will not work on the site.

This is because the Create Package from Definition Wizard attempts to set the source directory to where the package definition is located, but when creating the package, Configuration Manager will use the directory on the site server itself. As a result, Configuration Manager will attempt to use the displayed path (which is appropriate only to the remote computer) as if it exists on the site server.

Solution

When creating packages from definition by using a remote Configuration Manager console, administrators must define the source directory as the path on the site server (rather than the remote computer running the admin console) where the package file or files exist.

Packages Are Stuck in the "Pending" State on a Branch Distribution Point After Deleting and Re-adding Them

When deleting a package and re-adding the same package to a branch distribution point within a short period of time (such as less than one hour or before the next branch distribution point policy cycle has occurred, whichever is shorter), the package will be stuck at the pending state for this branch distribution point.

Solution

After deleting and re-adding a package to a branch distribution point, if the branch distribution point seems to be staying in a "Pending" state for a very long time, one of the following options can be tried:

  1. On the Configuration Manager console, on the package node, update the distribution points for this package. This will cause the most recent version of the package to be sent to all distribution points to which this package is assigned. For more information, see How to Update Package Data on Distribution Points.
  2. Delete this package from the branch distribution point, wait for one hour (or a length of time sufficient for the next branch distribution point cycle to have occurred), and then add the package back to the branch distribution point.
  3. Restart the client SMS Agent Host service.

New Advertisement Wizard Gives Incorrect Summary Information

When you run the New Advertisement Wizard, the summary page might say that the advertisement was not assigned, even though it was configured to run as soon as possible, and that the assignment will ignore maintenance windows. However, when you check the resulting advertisement, the assignment and maintenance window settings are configured correctly.

This is a known issue in Configuration Manager 2007. When the advertisement is configured with the assignment schedule setting Assign immediately after this event, the summary page does not report this as an assignment, and settings for maintenance windows and Wake On LAN are not verified in the summary information. The summary information is incorrect, and the advertisement requires no additional configuration.

Additionally, if you configure an optional advertisement with the setting Always rerun program, the summary page incorrectly displays the program rerun behavior as "never rerun advertised program."

Cannot Create Advertisement Using Distribute Software Wizard from a Folder Under Advertisements

Under the Advertisements node, if you create a folder, right-click the folder, and then click Distribute Software, the Distribute Software Wizard appears to complete successfully but no advertisement is created. This is a known issue.

Client Fails to Install Package from Branch Distribution Point

If the advertisement is configured with the setting Run program from distribution point but is not configured with the setting Allow clients to fallback to unprotected distribution points when the content is not available on the protected distribution point, the advertisement will fail. Branch distribution points do not allow clients to run the program directly from the distribution point.

Solution

Configure the advertisement with the setting Download content from distribution point and run locally. You could also have the client fall back to an unprotected distribution point; however, running the content from the distribution point is less secure because there is no way to validate the integrity of the package. Also, running the program from a fallback distribution point might mean the client is trying to run from a distribution point across a slow wide area network (WAN) link, which could create performance problems.

Parcel Created in Courier Sender Manager Fails on SMS 2003 Site

When you create a parcel in Configuration Manager 2007 Courier Sender Manager, you cannot import that parcel into Courier Sender Manager on the SMS 2003 child sites. You get the error message "The parcel was read but there were no objects for this site." This is a known issue. There is no workaround.

The Network Access Account Fails After Changing Account Name

You change the user account configured for the Network Access Account but use the same password as the old account. In this case, the Network Access Account cannot access package content.

Solution

When changing the Network Access Account, you must also enter a password for the new account, even if the new account uses the same password as the old account.

Cannot Multi-Select and Delete More Than 479 Advertisements

If you select a large number of advertisements, usually more than 479, you delete the advertisements, confirm the deletion, and find that the advertisements have not been deleted. This is a known issue.

Solution

Delete fewer than 479 advertisements at a time.

Advertisements Fail to Run on the Internet

Advertisements fail to run on the Internet when you are using the Internet-based client management feature. However, other features, such as hardware inventory and software updates, succeed on the Internet.

Solution

See http://go.microsoft.com/fwlink/?LinkId=112041.

Cannot Create Branch Distribution Point Because the Option Is Disabled

Configuration Manager automatically detects some scenarios that would prevent a branch distribution point from working. In these circumstances, the option Enable as a branch distribution point cannot be selected in the distribution point properties.

These scenarios include the following:

  • The Configuration Manager client is not installed on the site system and assigned to the site.
  • The site system is not a member of an Active Directory domain.
  • The site system is running Windows 2000.
  • The Configuration Manager client is configured for Internet-based client management.

Solution

Verify and correct the conditions that prevent the branch distribution option from being selected:

  • Ensure that the Configuration Manager client is installed and displays in the Configuration Manager console with Yes in the Client column and Yes in the Assigned column. If necessary, troubleshoot client installation and site assignment.
  • Either select a domain-joined computer to be a branch distribution point or join the workgroup computer to the domain.
  • Select a computer that is not running Windows 2000 as the operating system.
  • If the client has been configured for Internet-based client management by using the CCMHOSTNAME client installation property, follow these steps:
    1. Remove this configuration by deleting the Internet-based management point (FQDN) value in the Internet tab in the Configuration Manager client properties, and then click OK.
    2. In the Configuration Manager console, use the Collections node to locate the client object, and delete it.
    3. On the computer running the Configuration Manager client, restart the client service, SMS Agent Host.
    4. On the computer running the Configuration Manager client, initiate a discovery data collection cycle by performing the following steps:
      1. In the Configuration Manager properties, click the Actions tab.
      2. Click Discovery Data Collection Cycle, click Initiate Action, and then click OK to close the pop-up dialog box.
      3. Click OK to close Configuration Manager Properties.
      Wait for the discovery data cycle to complete and the information to be sent to the site server before attempting to select the option to enable the branch distribution point.

If none of these solutions resolve the issue, check for the following:

  • Confirm that the selected computer does not have a conflicting record. Check the Conflicting Records node to ensure that there are no unresolved conflicting records for this computer.
  • Verify that the selected computer does not have any errors reported for the client or site system components. Check for errors in the status messages and log files, and if necessary, uninstall and reinstall to correct any problems.
  • Try closing and reloading the Configuration Manager console to ensure that it is not a timing display error.

Branch Distribution Point Fails to Install Packages in a Native Mode Site

Although Configuration Manager does not support branch distribution points on clients that are configured for Internet-based client management, Configuration Manager cannot always detect this combination and can let you select the option Enable as a branch distribution point in the distribution point properties when the client is configured for Internet-based client management. In this scenario, the branch distribution point will successfully install but packages will not install on it. The package status will remain as Install Pending, and the status message ID 11377 will be reported by the Peer DP Agent component. On the client, the log file PeerDPAgent.log will contain the following text:

The client is internet enabled, therefore can not be marked as a Branch DP

Solution

Decide whether this client should be a branch distribution point or configured for Internet-based client management, and then reconfigure the client accordingly:

  • If the client should be managed over the Internet, delete the branch distribution point role, and then delete the site system.
  • If the client should be a branch distribution point, follow these steps:
    1. In the client Configuration Manager properties, click the Internet tab, delete the Internet-based management point (FQDN) value, and click Apply.
    2. Click the Actions tab, click Branch Distribution Point Maintenance Task, click Initiate Action, and then click OK to close the pop-up message. Packages will now start to install.
    3. Click OK to close Configuration Manager Properties.

Virtual Application Package Does Not Run After Restarting Computer

Virtual applications packages that have been configured for streaming do not run after you restart the computer.

Solution

This can occur when applications that are configured to run at startup run before the SMS Agent Host service (Ccmexec.exe) is started. When this occurs, virtual application packages configured to stream will not successfully run unless the package has been fully downloaded to the Microsoft Application Virtualization Desktop Client cache. You can configure the virtual application package advertisement with the setting Download content from distribution point and run locally or wait until the package has been completely downloaded to the client cache.

See Also

Concepts

Troubleshooting Software Distribution Using Custom Error Codes

Other Resources

Software Distribution Overview


Software Distribution Troubleshooting Flowcharts

Topic last updated—November 2007

You can use the flowcharts in this section to help you troubleshoot software distribution issues in Microsoft System Center Configuration Manager 2007.

In This Section

Software Distribution Package Creation and Distribution Flowchart

Flowchart showing the Microsoft System Center Configuration Manager 2007 process for package creation and distribution.

Software Distribution Advertisement Flowchart

Flowchart showing the Configuration Manager 2007 process for advertisements.

Client Program Download Request Flowchart

Flowchart showing the Configuration Manager 2007 process for downloading a request.

Package Replication with File Delta Replication Flowchart

Flowchart showing the Configuration Manager 2007 process for file delta replication.

Service Location Flowchart for Distribution Point Selection

Flowchart showing the Configuration Manager 2007 process for locating a management point for software distribution.

Content Location Flowchart for Distribution Point Selection

Flowchart showing the Configuration Manager 2007 process for selecting a distribution point.

Package Access Flowchart When Running from Distribution Point

Flowchart showing which security context is used to run a package from a distribution point.

Package Access Flowchart When Downloading from an Intranet Distribution Point

Flowchart showing which security context is used to download and run a package on the intranet.

Package Access Flowchart for Internet-Based Clients

Flowchart showing which security context is used to download and run a package on the Internet.

See Also

Other Resources

Troubleshooting Software Distribution


Software Distribution Package Creation and Distribution Flowchart

Topic last updated—November 2007

The following flowchart shows the process for Microsoft System Center Configuration Manager 2007 package creation and distribution.

flowchart: software distribution package creation

See Also

Other Resources

Troubleshooting Software Distribution


Software Distribution Advertisement Flowchart

Topic last updated—November 2007

The following flowchart shows the advertisement process in Microsoft System Center Configuration Manager 2007.

Flowchart of software distribution advertisements

See Also

Other Resources

Software Distribution Troubleshooting Flowcharts


Client Program Download Request Flowchart

Topic last updated—November 2007

The following flowchart shows the process when a Microsoft System Center Configuration Manager 2007 client requests a program download.

flowchart client program download request

See Also

Other Resources

Troubleshooting Software Distribution


Package Replication with File Delta Replication Flowchart

Topic last updated—November 2007

The following flowchart shows how file delta replication works in Microsoft System Center Configuration Manager 2007.

Flowchart Package Replication with file deltas

See Also

Other Resources

Troubleshooting Software Distribution


Service Location Flowchart for Distribution Point Selection

Topic last updated—November 2007

The following flowchart shows the process used by Microsoft System Center Configuration Manager 2007 computers to locate a management point for content location requests as described in Configuration Manager and Service Location (Site Information and Management Points). This flowchart does not include processes for locating other services.

flowchart for selecting management point

See Also

Concepts

Content Location Flowchart for Distribution Point Selection


Content Location Flowchart for Distribution Point Selection

Topic last updated—November 2007

The following flowchart shows the process used by Microsoft System Center Configuration Manager 2007 clients to select a distribution point, including protected distribution points.

shows how distribution points are selected

See Also

Concepts

About Distribution Points
About On-Demand Package Distribution
About Protected Distribution Points
About Standard and Branch Distribution Points
Service Location Flowchart for Distribution Point Selection


Package Access Flowchart When Running from Distribution Point

Topic last updated—November 2007

The following flowchart shows the security context that Microsoft System Center Configuration Manager 2007 clients use when running a package from a distribution point.

Flowchart of package access from distribution poin

See Also

Concepts

About BITS-Enabled Distribution Points
About the Network Access Account
Example Package Access Scenarios
Package Access Flowchart When Downloading from an Intranet Distribution Point
Package Access Flowchart for Internet-Based Clients


Package Access Flowchart When Downloading from an Intranet Distribution Point

Topic last updated—November 2007

The following flowchart shows the security context that Microsoft System Center Configuration Manager 2007 clients use when downloading a package from a distribution point on the intranet.

Important
Although the Network Access Account can be used as the security context to access content on a distribution point, the package runs only in the context of the logged-on user; or, if the program was configured to run with administrative rights, it runs in the context of the Local System account. The Network Access account is never used to actually run the program.

If a native-mode client is accessing a native-mode BITS-enabled distribution point, the client will randomly select between the NOCERT_SMS_DP_ and the SMS_DP_ virtual directories. If an intranet client cannot authenticate using the first selected virtual directory, the client automatically tries the other virtual directory. The flowchart shows the client using the SMS_DP_ virtual directory first as an example, but the actual process used is not deterministic.

flowchart for package access on intranet

See Also

Concepts

About the Network Access Account
Example Package Access Scenarios
Package Access Flowchart for Internet-Based Clients
Package Access Flowchart When Running from Distribution Point


Package Access Flowchart for Internet-Based Clients

Topic last updated—March 2008

The following flowchart shows the security context that Microsoft System Center Configuration Manager 2007 and Configuration Manager 2007 SP1 clients use when downloading a package from a distribution point configured to support Internet-based clients.

Flowchart of access for Internet-based clients

See Also

Concepts

About BITS-Enabled Distribution Points
About the Network Access Account
Example Package Access Scenarios
Package Access Flowchart When Downloading from an Intranet Distribution Point
Package Access Flowchart When Running from Distribution Point


Troubleshooting Software Distribution Using Custom Error Codes

The following table lists the Software Distribution custom error codes, possible problems and possible solutions.

Software Distribution Custom Error Codes

Error Code Possible Problem Possible Resolution

E_FAIL_EXECUTION_PENDING 0x80008001

The program cannot be run now from the client UI because :

A restart is in progress.

or

Software Distribution is paused because of a task sequence running

or

Another program is currently running

NOTE: This error code is only returned to the UI and is not present in status messages.

Wait for the restart to finish or the task sequence to finish running.

E_FAIL_DUPLICATE_REQUEST 0x80008002

The program cannot be run again from the client UI because it is already pending, an optional (initiated from the UI) run request already exists for it.

NOTE: This error code is only returned to the UI and is not present in status messages.

Wait for the original application to finish.

E_FAIL_PROGRAM_DISABLED 0x80008004

The program cannot run because it is currently disabled.

Enable the program.

E_FAIL_INVALID_POLICY 0x80008005

This error code can be returned on the client if policy cannot be found or the policy is not valid to run or cancel the requested program.

NOTE: This error code is currently not sent in status messages.

The policy for this program does not exist or is invalid. Create a policy.

E_FAIL_INVALID_PROGRAM 0x80008006

The requested program is not currently pending.

This error code can be returned on the client if the user attempts to continue or cancel the program that is not currently pending. It can also be returned to the task sequence manager (TSM) when TSM requests download locations for packages that are not referenced by the currently running task sequence.

NOTE: This error code is not raised in status messages by Software distribution, but could be raised by task sequence.

The user must not continue or cancel the action of a program.

E_FAIL_SET_CACHEDCONTENTINUSE 0x80008008

Unable to set the CachedContentInUse flag. Failed to indicate the client cache is currently in use.

Check to see if the client cache is in use.

E_FAIL_WMI_ERROR 0x80008009

Failed to read data from WMI. The program could not continue because a system restart is in progress or there is already a run request for this program that requires a reboot.

Wait for the restart/reboot to finish.

E_FAIL_REQUEST_NOT_FOUND 0x80008011

Used for Task Sequence. Failed to reconnect to Task Sequence job because a request cannot be found with the given job ID.

NOTE: Not sent in status message by Software Distribution, but may be used by task sequence.

Start the task sequence job again.

E_FAIL_DEPENDENCY_NOT_RUN 0x80008013

This program cannot run because it depends on another program that has not run successfully before. This error code is returned to task sequence manager when a task sequence Install Software Action step cannot be run because the step has a child program which has not been run before.

Check the program dependency.

E_FAIL_USER_REQUIRED
0x80008014

This error code is returned to task sequence manager when an “Install Software” step cannot be run because the software distribution program in this step is targeted to a user, requires user input or is set to run in user context

User input required.

E_FAIL_INVALID_HASH
0x80008017

The content hash string or hash versions are empty or incorrect in the software distribution policy or the hash verification failed.

Check the hash version.

E_FAIL_CANNOT_RUN_ON_INTERNET 0x80008018

The program cannot run at this time because the client is on the internet.

Wait for client to get off internet.

E_FAIL_EXECUTION_NONFATAL 0x80008100

A non fatal error has been encountered while attempting to run the program. The program execution will be retried if the retry count has not been exceeded.

Wait for the retry.

E_FAIL_EXECUTION_FATAL
0x80009101

A fatal error has been encountered while attempting to run the program. The program execution will not be retried.

Re-run the program.

E_FAIL_INVALID_PROGRAM_OBJECT 0x80009102

An error occurred while creating the execution context.

This is error code indicates that an error was encountered while creating the internal execution context object. This is most likely not due to configuration errors, but could be because of low memory conditions, COM failures or other external errors.

Check the memory and COM failures.

E_FAIL_BAD_ENVIRONMENT_NONFATAL 0x80008103

A non fatal error occurred while preparing to run the program, for example when creating the program execution environment, making a network connection, impersonating the user, determining the file association information, or when attempting to launch the program. This program execution will be retried if the retry count has not been exceeded.

Let the program execution retry.

E_FAIL_BAD_ENVIRONMENT_FATAL 0x8000910A

A fatal error occurred while preparing to run the program, for example when creating the program execution environment, making a network connection, impersonating the user, determining the file association information, or when attempting to launch the program. This program execution will not be retried.

Retry the program execution.

E_FAIL_INVALID_CMDLINE 0x80009104

The command line for this program is invalid.

Try another command line.

E_FAIL_PROGRAM_NOT_MONITORED 0x80008105

An error was encountered while getting the process information for the launched program and the program execution will not be monitored.

Monitor the program.

E_FAIL_NO_CONTENT 0x80009106

Failed to verify the executable file is valid or to construct the associated command line.

Verify the executable file.

E_FAIL_NO_SOURCE 0x80008107

Failed to access all the provided program locations. This program may retry if the maximum retry count has not been reached.

Let program retry to access all of the provided program locations.

E_FAIL_INACCESSIBLE_SOURCE 0x80009108

Failed to access all the provided program locations. This program will not retry.

Retry to access provided programs locations.

E_FAIL_INVALID_MSI 0x80009109

Failed to verify that the given file is a valid installation package.

Verify the installation package.

E_NO_SPACE_IN_CACHE 0x80008201

The content download cannot be performed because there is not enough available space in cache or the disk is full.

Increase cache or disk space.

E_CACHE_TOO_SMALL 0x80008202

The content download cannot be performed because the total size of the client cache is smaller than the size of the requested content.

Increase the cache size.

E_CACHE_IN_USE 0x80008203

The client cache is currently in use by a running program or by a download in progress.

Wait for the running program or download to finish.

E_NO_DP_FOUND 0x80008204

NOTE: this error code is sent at least in status message 10051.

No distribution points were found for the requested content.

Check the distribution points.

E_SWDIST_POLICY_NOT_FOUND 0x80002004

The software distribution policy was not found.

Confirm the software policy exists.

E_FAIL_JOB_PENDING 0x80008250

The computer restart cannot be initiated because a software installation job is in progress.

Wait for software installation to finish or stop the installation.

See Also

Concepts

Custom Error Codes for Configuration Manager 2007

Other Resources

Troubleshooting Software Distribution


Software Distribution Security Best Practices and Privacy Information

Topic Last Updated—August 2008

Software distribution is a powerful feature that can be used as a major point of attack if not secured properly. When installing packages, Microsoft System Center Configuration Manager 2007 can use elevated rights in either the user or the system context, even if the user does not have administrative rights. This particular capability of Microsoft System Center Configuration Manager 2007 can be used by an attacker to effectively run any attacks that elevate rights.

Best Practices

Always configure advertisements to download content Configuring to Download content from distribution point and run locally is more secure because Configuration Manager 2007 verifies the package hash after the content is downloaded and discards the package if the hash does not match the hash in the policy. If you configure the advertisement to Run program from distribution point, no verification takes place and attackers can tamper with the content. If you must run the program from the distribution point, use NTFS least permissions on the packages on the distribution points and use Internet Protocol security (IPsec) to secure the channel between the client and the distribution point and between the distribution point and the site server.

Do not allow users to interact with programs if run with administrative rights is required When you configure a program, you can set the option Allow users to interact with this program so that users can respond to any required prompts in the user interface. If the program is also configured to Run with administrative rights, an attacker at the computer running the program could use the user interface to escalate privileges on the client computer. You should use Windows Installer-based setup programs with per-user elevated privileges for installations that require administrative credentials but that must be run in the context of a user who does not have administrative credentials. Using Windows Installer per-user elevated privileges provides the most secure way of deploying applications with this requirement.

Do not create subcollections if you need to restrict software distribution on them An advertisement to a collection with subcollections is sent to all members of the collection and subcollections, even if the administrator has only the Advertise right to the collection (not the subcollections). Any administrator who can link a collection to another collection can cause that collection to receive the advertisements targeted to the other collection, even if they do not have Advertise permissions on any collection. For this reason, you should watch for the addition of subcollections to collections with advertisements, and be cautious of whom you give permission to for reading collections that receive advertisements.

Set package access permissions at package creation Changes to the access accounts on the package files (as opposed to the distribution point shared folders) become effective only when you refresh the package. Therefore, you should set the package access permissions carefully when you first create the package, especially if the package is large, if you are distributing the package to many distribution points, or if your network capacity for package distributions is limited. To quickly initiate the refresh of all distribution points, you can use the Update Distribution Points task for the package.

Secure software at the package access level By default, the package files on distribution points are fully accessible by administrators and readable by users. Users with administrative rights on client computers can set the client to join any site, even if the computer is not within the boundaries of the site. When the clients have joined the site, they can receive any software distributions that are available at that site and for which the computer or user meets the qualifications of the relevant collections. For this reason, software that should be limited to specific users should be secured at the package access level to those users, rather than being limited by site availability or collection criteria. However, restricting the access of the Internet Guest account to packages will cause package access to fail for Internet-based clients. For more information, see Example Package Access Scenarios.

After upgrading, if you had packages in SMS 2003, update all packages SMS 2003 (released version) used MD5 to hash packages; Configuration Manager 2007 and SMS 2003 service packs later than SP1 use SHA-1. To rehash all of the packages with SHA-1, you should update all packages created in SMS 2003 (released version) that have not already been updated with an SMS service pack. Failing to do so might cause clients to discard valid packages if the advertisement is configured to download the package and run it locally.

Best Practices for Distribution Points

Remove the distribution point role from the site server By default, the site server is set up as a standard distribution point. However, you should assign this role to other site systems and remove it from the site server to reduce the attack surface. Clients have no valid reason to talk directly to the site server or any role configured on the site server. This is especially important if you chose to enable Background Intelligent Transfer Service (BITS) on the distribution point, because installing Internet Information Services (IIS) to create a BITS-enabled distribution point greatly increases the attack surface of the site system.

Do not create distribution point shares or branch distribution points on Internet-based clients Although Configuration Manager 2007 might not block you from doing so, creating any type of distribution point on an Internet-based client greatly increases your attack surface and should be avoided. Create distribution points only on site systems that can be managed within the intranet or the perimeter network.

After switching to a custom Web site, remove the default virtual directories When you change from using the default Web site to using a custom Web site, Configuration Manager 2007 does not automatically remove the old virtual directories. You should manually remove the virtual directories created under the default Web site. This is especially important if you configured the distribution point to Allow clients to connect anonymously (Required for mobile device clients) while using the default Web site and then you disable anonymous connections after switching to the custom Web site. In this case, the old virtual directories will still be configured for anonymous access. For the list of virtual directories created on BITS-enabled distribution points, see About BITS-Enabled Distribution Points.

Implement access controls to protect branch distribution points Branch distribution points can be installed on any Configuration Manager 2007 client, including Microsoft Windows XP Professional workstation computers. Workstation computers are generally not subject to the same physical access controls as server computers, so you must monitor your usage of branch distribution points. Do not distribute sensitive source files to branch distribution points if there is a risk of an attacker stealing the hard drive or the entire branch distribution point. You should configure all advertisements so that clients download packages from a branch distribution point and run them locally rather than running them across the network. Configuration Manager 2007 verifies the hash on downloaded packages and discards any packages it cannot verify, but there is no package verification on packages run from the distribution point.

Enable the encrypted mode for Application Virtualization Streaming–enabled distribution points In Configuration Manager 2007 R2, when you configure an Application Virtualization Streaming–enabled distribution point, you have the option of choosing Real Time Streaming Protocol (RTSP) or RTSP over TLS (RTSPS). Enabling encryption helps protect against attackers tampering with the data stream.

Security Issue

The following issue has no mitigation.

Packages are not validated until after they are downloaded Configuration Manager 2007 validates the signatures on packages only after they have been downloaded to the client cache. If an attacker has tampered with a package, the client could waste considerable bandwidth in downloading the package only to have it discarded due to an invalid signature.

Privacy Information

Software distribution allows you to run any program or script on any client in the site. Configuration Manager 2007 has no control over what types of programs or scripts you run or what type of information they transmit. During the software distribution process, Configuration Manager 2007 might transmit information between clients and servers that identify the computer and logon accounts.

Configuration Manager 2007 maintains status information about the software distribution process. Software distribution status information is not encrypted during transmission unless you enable native mode. Status information is not stored in encrypted form in the database.

Status information is stored in the site database and deleted by default every 30 days. The deletion behavior is configurable by setting both the Status Filter Rule properties and the site maintenance task. No status information is sent back to Microsoft.

The use of Configuration Manager 2007 software installation to remotely, interactively, or silently install software on clients might be subject to software license terms for that software and is separate from the Software License Terms for Configuration Manager 2007. You should always review and agree to the Software Licensing Terms prior to installing the software using Configuration Manager 2007.

Software distribution does not happen by default and requires several configuration steps. Before configuring software distribution, consider your privacy requirements.

See Also

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features
Software Distribution in Configuration Manager


Technical Reference for Software Distribution

Topic last updated—November 2007

The topics in this section provide helpful reference information about working with Microsoft System Center Configuration Manager 2007 software distribution.

In This Section

Script Sample for API-Based Triggering of the Product Source Update Manager

A sample script you can use to enable a Windows Installer source list update cycle.

Frequently Asked Questions for Software Distribution

A set of frequently asked questions about software distribution.

Example Package Access Scenarios

Package access scenarios related to Configuration Manager 2007 software distribution.

See Also

Other Resources

Software Distribution in Configuration Manager


Script Sample for API-Based Triggering of the Product Source Update Manager

Topic last updated—November 2007

Several events can occur on the Microsoft System Center Configuration Manager 2007 client that will cause the Product Source Update Manager agent to update source locations for one or more Windows Installer products. Use the following VBScript script to enable a Windows Installer source list update cycle.

Script

Copy Code
' Name of script is updateps.vbs.

dim oSrcList
dim oSrcLocs
dim sLoc

Set objArgs = WScript.Arguments

If objArgs.Count < 1 then
    WScript.echo "Usage: updateps.vbs {Product Code}"
    WScript.quit
end if

set oSrcList = CreateObject ("SrcUpdateMgr.ProductSourceList")

if oSrcList is nothing then
    wscript.echo "Could not create Product Source List Object - quitting"
    wscript.quit
end if

oSrcList.UpdateSourceList objArgs(0), FALSE

oSrcLocs = oSrcList.GetSourceList(objArgs(0))

dim nIndex
for nIndex = LBound(oSrcLocs) To UBound(oSrcLocs)
    WScript.echo oSrcLocs(nIndex)
next

WScript.echo "Successfully update source list for product" + objArgs(0)

See Also

Tasks

How To Configure Windows Installer Source Update Management

Concepts

About Windows Installer Source Location Manager


Frequently Asked Questions for Software Distribution

Topic last updated—January 2008

This topic addresses frequently asked questions related to software distribution and is divided into the following categories:

  • Client caching
  • Package replication
  • Using BITS with software distribution
  • Distribution points
  • General questions about software distribution

Frequently Asked Questions About Client Caching

The following are common questions about how Microsoft System Center Configuration Manager 2007 manages the cache maintained on Configuration Manager 2007 clients for running advertisements.

If the size of the package is greater than the size of the cache, both the mandatory and the optional downloads will fail. If the package download fails because of insufficient cache size, Configuration Manager 2007 generates status message 10050. If the cache size is increased later, the download does not automatically retry and must be reinitiated.

If the size of the package is less than the size of the cache but the cache is currently full, mandatory downloads will keep retrying until the cache space is available, until the download times out, or until the cache space failure retry limit is reached. If the cache size is increased later, Configuration Manager 2007 attempts to download again during the next retry interval. The client tries to download the content every four hours until it has tried 18 times.

No, it does not automatically delete the associated package. After being downloaded, all packages are guaranteed to stay in the cache for at least one day after the cached content was last referenced. If you configure the package properties with Persist content in the client cache, the package is never deleted. If all your space is used by packages that have been downloaded within the last 24 hours and you need to download new packages, you can either increase your cache size or force existing packages to be deleted.

I want to create an advertisement that will download, execute, and recur on a schedule. Will it download once and then run each time from the cache? Must it download every time the advertisement recurs?

Before running any program, the Configuration Manager 2007 client checks to see whether content is available in the cache. If content is in the cache and if it is the correct version, it always runs the program from the cache, whether or not the advertisement is set to recur. If the version has changed or if the content was deleted to make room for another package, it is downloaded again.

The client downloads the mandatory content as soon as it receives the advertisement. The program then waits to run until the assigned time.

Frequently Asked Questions About Package Replication

The following are common questions about delta replication and binary differential replication.

What is the difference between delta replication and binary differential replication?

In SMS 2003, only file level changes were replicated (delta replication), but in Configuration Manager 2007, changes at the byte level can be detected and replicated if you enable binary delta replication on the package properties. A file is considered to be changed if it has been renamed, moved, or its contents have changed. If you do not enable binary delta replication, Configuration Manager 2007 still detects and replicates changes at the file level.

Do clients participate in delta replication or binary differential replication?

No, delta replication and binary delta replication occur when moving packages between two sites or from a site server and a distribution point.

With replication of programs, how does source version incrementing work?

Configuration Manager 2007 keeps track of the source version of a package on each distribution point it is assigned to. For example, when originally distributing a package, the source version would be 1. When you update the package source files and tell Configuration Manager 2007 to update distribution points with a new package source version, the local version would change to 2. Configuration Manager 2007 detects the version on each distribution point, so it would update each distribution point with version 2.

What does it mean that replication on distribution points only supports five deltas?

If a site or distribution point is more than five versions out of sync with the source files, it will receive the entire package.

Frequently Asked Questions About Using BITS with Software Distribution

The following are common questions about BITS and Configuration Manager 2007 software distribution.

What happens when the connection with the distribution point is unexpectedly broken? Can the client resume the download in the middle of a file?

Yes, interrupted client downloads from BITS-enabled distribution points resume at the point at which they stopped transferring, even if the client connects to a different distribution point.

Does the client use BITS or SMB by default?

It depends. If the advertisement has been set to run the program from the network, the client always uses server message block (SMB). If the advertisement has been configured to download and run locally and if the distribution point has been configured to use BITS, the client tries to use BITS but might fail over to SMB if the content cannot be accessed over BITS.

How can I tell if my Advanced Client is using BITS or SMB?

Look at the DataTransferService.log on the client. BITS downloads have a URL that starts with http://<distributionpoint>, and SMB downloads have a URL that starts with \\<distributionpoint>. For details about the BITS download, you can run bitsadmin /list /allusers /verbose | more from the command line. If the client used SMB, you can also get details in the FileBits.log on the client.

Frequently Asked Questions About Distribution Points

The following are common questions about distribution points.

How do clients choose a distribution point?

See Configuration Manager and Content Location (Package Source Files).

Does my distribution point require IIS?

It depends. If you configure the distribution point to be BITS-enabled, you must install IIS and enable WebDAV. If you do not configure the distribution point to be BITS-enabled, IIS is not required. A distribution point must be BITS-enabled to support Internet-based clients and mobile device clients. If a distribution point is not BITS-enabled, clients will always use server message blocks (SMB) when retrieving content from the distribution point, even in native mode. If the distribution point is BITS-enabled, clients attempt to use BITS first but might fall back to SMB.

Can I use a SAN for my distribution point?

Yes. Using a storage area network (SAN) is supported as long as a supported Windows server is attached directly to the volume hosted by the SAN.

Can I use a SIS volume for my distribution point?

No. Configuring distribution point package and signature folders to be configured on a Single Instance Storage (SIS) volume is not supported.

Can I use DFS for my distribution point?

There is limited support for Microsoft Distributed File System (DFS) in Configuration Manager 2007. Distribution points can be targets of a DFS root, but packages must be deployed to the shared folder on the distribution point, not to the DFS link name. Clients can use programs that point to <DFS root>\<DFS link>\<executable>.

General Questions About Software Distribution

The following are common questions about Configuration Manager 2007 software distribution.

Does Configuration Manager include an application to create packages?

No. Configuration Manager 2007 can distribute any package you create, but it does not actually create the packages for you. Applications vary greatly in how they are installed.

Very simple applications might be installed with a batch file or script.

If the application is installed with Windows Installer, you typically include all of the Setup files in the package and create the program to run the .msi file. However, the application might require you to do an administrative installation first to decompress the source files, or it might be advisable to create Windows Installer transforms to modify how the application is installed.

If the application does not use Windows Installer, you might be able to use the Setup file included with the application. Generally, if you can copy the installation files to a network share and run the Setup file from a client computer, the installation is likely to work with Configuration Manager 2007. However, some applications have specific requirements. For example, one application might run only from drive letters while others might run only from UNC paths, so you might have to modify the Configuration Manager 2007 program properties. Also, the Setup file might require user input when you would prefer to install without any user intervention.

Several commercial applications exist to assist in repackaging applications, including converting varied Setup formats into Windows Installer packages. Macrovision makes available a limited-featured version of AdminStudio Enterprise Edition called AdminStudio Configuration Manager Edition. For more information, see http://go.microsoft.com/fwlink/?LinkId=103420.

During the SMS 2.0 timeframe, Microsoft released a program called SMS Installer to provide a simple interface for packaging applications. The most recent version includes the Windows Installer Step-up Utility (ISU) to convert packages to Windows Installer format. The program is still available for download and will still install on a Configuration Manager 2007 site server, although it has not been updated for Configuration Manager 2007. For more information, see http://go.microsoft.com/fwlink/?LinkId=103421.

How do I uninstall software using Configuration Manager?

Configuration Manager 2007 does not provide a specific way to uninstall an application. However, Configuration Manager 2007 can run any program that you configure, including a script or executable file to uninstall an application. Consult the documentation for the application to see whether there is an option for uninstalling. For example, if you create a Configuration Manager 2007 package with a Configuration Manager 2007 program to run a Windows Installer file to install an application, you might be able to create an additional Configuration Manager 2007 program in the same package using the /x option to uninstall the application.

Configuration Manager 2007 could also theoretically uninstall an application that was not distributed with Configuration Manager 2007, if you can build a script or executable to cleanly uninstall the application.

Is there any way to make software distribution happen faster?

Software distribution is always a balance between how quickly things happen and how much bandwidth they consume. For example, for a client to run an advertisement, you must create the package, program, and advertisement. The client is configured to poll at a certain interval for new advertisements. If you make that interval smaller, clients poll more frequently but consume more bandwidth with their polling. Also, if the package contains source files, the client cannot run the package until the package is on the distribution point. If the client is at a child site, the Sender between the sites might restrict the transmission of the package to off-peak hours, further delaying the time until the client can install the package.

If you have time to plan a large deployment, you can pre-deploy the package and advertisement but configure the advertisement so that it is not available until a future time. The advertisement will be delivered to the clients but will not be displayed until the time you specify. This allows time for packages to be copied to all distribution points and for clients to retrieve the policy containing the advertisement.

If I select "Always obtain files from source directory for a package", will a package refresh copy source file changes to the distribution point?

Package refresh generally operates on a single distribution point/package pair.

  • On the source site server, package source files are copied directly to the distribution points for that site, which include changes made at the source.
  • On a child site server, the existing local compressed package is copied to the distribution points for that site. Therefore, no changed source files are included.
  • On a child site server, if the compressed package file is missing, the source site server passes its existing compressed file to the child. No changed source files are included.
    Note
    If you choose to refresh all or several distribution points in the site hierarchy, only the source site distribution points receive changed files. The source site server does not pass down a new compressed package file to child sites. In this situation, child site distribution points do not receive changed source files.

If you want changes to source files to be copied to all distribution points, use package update instead of package refresh.

If there are multiple advertisements, in what order do they run?

If multiple advertisements are available at the same time, there is no guaranteed order in which they will run. You can create program dependencies if you must run another program first. For more information, see Program Name Properties: Advanced Tab. You can also create a task sequence to perform tasks in a specific order. For more information, see About Task Sequences.

Important
Dependent programs are not installed when a program is run in a task sequence. The Install Software action checks to see whether the dependent program is already installed and, if so, will proceed with installing the main program. However, if the dependent program is not already installed, the installation of the main program will fail. You must explicitly install the dependent programs as part of your task sequence.

See Also

Other Resources

Troubleshooting Software Distribution


Example Package Access Scenarios

Topic last updated—March 2008

For software distribution to occur in Microsoft System Center Configuration Manager 2007, Configuration Manager 2007 creates a package, program, and advertisement. If the package contains source files, the administrator must copy the package to a distribution point. By default, the access control lists (ACLs) on the file are set to allow Administrators Full Control and Users Read access. It is possible to change the package access, but you should understand how Configuration Manager 2007 attempts to access the packages in various scenarios so that you can reduce the chance of allowing unauthorized users access to restricted packages or denying valid users access to packages they need to get their jobs done.

Before reading these scenarios, you must be familiar with basic Windows concepts such as users, groups, ACLs, and forest architecture. You should also be familiar with the concepts of software distribution described in Software Distribution Overview.

This topic contains the following common scenarios:

  • Advertisement Configured to Run from the Distribution Point
  • Advertisement Configured to Download and Run from Cache
  • Internet-Based Clients Running Advertisements

These scenarios do not contain examples of roaming between sites. Package access still follows the same process whether the client is roaming or not. For more information about roaming, see Example Roaming Scenarios for Configuration Manager: Simple and Example Roaming Scenarios for Configuration Manager: Complex.

Hierarchy Used in All Scenario Examples

The following diagram shows one Configuration Manager site with six different domains and an Internet-based user.

graphic showing hierarchy for the example

Advertisement Configured to Run from the Distribution Point

Todd receives an advertisement configured to run from a distribution point. The management point returns SJC-DP1 in response to the content location request.

When an advertisement is configured to run from the distribution point, the file access is always over server message blocks (SMBs), even in native mode, and Windows authentication is used instead of certificate authentication.

Todd is in a trusted domain in the forest, but he is in a different domain than SJC-DP1. Whether Todd can access the package depends on whether the administrator has configured the local, domain local, universal, or global groups to permit resources in dev.corp.contoso.com to access the server in corp.contoso.com. Todd's access also depends on the Package Access Accounts configured by the Configuration Manager 2007 administrator to automatically set the ACLs on the package directory.

If Todd's computer account and his user account cannot access SJC-DP1, Todd might still access the package if the administrator has configured a Network Access Account and if the Network Access Account has permissions to the package directory based on the Package Access Account configuration, either directly or through group membership.

Note
There is no need to add the Network Access Account as a Package Access Account because it is a member of Users and therefore included by default. Also, restricting the ACLs of a package to only the Network Access Account does not prevent any client from accessing the package because Configuration Manager 2007 clients can request use of the Network Access Account when necessary.

Accessing the Package from a Different Domain

Referring to the flowchart in Package Access Flowchart When Running from Distribution Point, the following process is used to evaluate Todd's access to the package.

Is program configured to run with admin rights?

No.

Do package permissions allow logged-on user access?

No. The administrator has neither added the dev.corp.contoso.com Domain Users group to the local Users group on SJC-DP1 nor configured any other group access that would allow Todd's user account to have direct access.

Is there a Network Access Account configured?

Yes. Todd's administrator has created an account in the corp.contoso.com domain and configured it to be the Network Access Account in the Configuration Manager 2007 console.

Do permissions allow the Network Access Account access to the package directory?

Yes. Todd's administrator has not modified the default Package Access Accounts, so the ACLs on the package directory allow Users Read access and Administrators Full Control. The Network Access Account is a user in the corp.contoso.com domain.

Tom's computer uses the Network Access Account to connect to SJC-DP1 for purposes of running the package.

Is this a Windows Installer package? (Is the installation file in .msi format?)

Yes. The application is an internal application, and the internal development team created a Windows Installer package.

Do package permissions allow Todd-PC$ to access the package directory?

No. The administrator has not configured any groups or Package Access Accounts that would allow Todd-PC$ to access SJC-DP1.

Is there a Network Access Account configured?

Yes.

Do permissions allow the Network Access Account access to the package directory?

Yes. The Network Access Account has already been able to connect to the package shared folder on SJC-DP1, but because the installation file is a Windows Installer file, the Configuration Manager 2007 client assumes that the installation will require Administrative rights on Todd-PC. When the program runs, any actions that require administrative rights will connect to the distribution point using the Network Access Account. On Todd's computer, the program runs under Todd's user account, because the program was not configured to run with Administrator rights.

Todd successfully installs the package.

Accessing the Package from the Same Domain

If Cliff tries to run the same advertisement with his account in corp.contoso.com, he does not need the Network Access Account. The Configuration Manager 2007 client components connect to SJC-DP1 using his own user account, and if there are actions that require elevation, the client connects using the Cliff-PC$ account.

Accessing the Package from a Trusted Forest

If April tries to run the same advertisement with her account in treyreasearch.net, she will have a similar experience. Even though there is a forest trust between corp.contoso.com and treyresearch.net, the administrator must either configure appropriate access using groups and Package Access Accounts or configure a Network Access Account; otherwise, April cannot access the package.

Accessing the Package from an Untrusted Forest

If Torsten tries to run the package from adatum.com, he cannot be granted access using groups and Package Access Accounts because there is no trust between adatum.com and corp.contoso.com. In this scenario, if there is no Network Access Account with appropriate ACLs, Torsten cannot access the package.

Advertisement Configured to Download and Run from Cache

When advertisements are configured to download and run from the local cache on the client computer, several factors influence which account is used to download the package. However, the package always runs with either the Local System security context, if the program is configured to run with admin rights, or with the logged-on user's security context, regardless of the account used to download the program.

Important
Before you read this section, you should read About BITS-Enabled Distribution Points and understand the virtual directories created on Binary Intelligent Transfer Service (BITS)-enabled distribution points to support native-mode clients.

Accessing the Package from a Trusted Forest

Marcus has an advertisement to download a finance application and run it locally. Referring to the flowchart in Package Access Flowchart When Downloading from an Intranet Distribution Point, the following process is used to evaluate Marcus' access to the package.

Is the site in native mode?

Yes. All domains are in the SJC site, and the site is configured for native mode.

Is SJC-DP1 BITS-enabled?

Yes. The administrator has configured all distribution points in the SJC site to be BITS-enabled to improve download efficiency.

Does the client connect to the Windows authentication virtual directory (SMS_DP_SMSPKGE$) or the certificate authentication virtual directory (NOCERT_SMS_DP_SMSPKGE$)?

The client randomly selects the SMS_DP_SMSPKGE$ virtual directory.

Can the security context access the client certificate private key?

Yes. Marcus is logged on as a local administrator, so his user account can access the private key of the client authentication certificate.

Do package permissions allow the Internet Guest (IUSR) account access to the package directory?

No. By default the Internet Guest account would be a member of the Users group on SJC-DP1 and therefore could access the package. However, the administrator has changed the default Package Access Accounts. Users are not permitted to read the package directory on SJC-DP1, but members of the Finance domain local group are. The IUSR account is not a member of the Finance security group.

Note
Allowing anonymous access to package content is not considered a significant risk because the client must first be authenticated by a valid client authentication certificate before accessing the package content by using the IUSR account.

Is the program advertised to a user or a user group?

Yes. The advertisement is sent to a collection that contains only users in the Finance security group.

Do package permissions allow Marcus to access the package directory?

No. Even if there were groups configured to allow Marcus' account to be a member of the local Users group on SJC-DP1, the administrator has removed the ACL for Users. Marcus can access the package directory only if he is a local administrator on SJC-DP1 or if he is a member of the Finance domain local group.

Do package permissions allow the Network Access Account access?

No. The Network Access Account is not a member of the Finance group. If the administrator had violated best practices and added the Network Access account as a Package Access Account, Todd would be able to access the package even though he is not a member of the Finance group.

Do package permissions allow Marcus-PC$ to access the package directory?

No. Marcus-PC$ is neither an administrator nor a member of the Finance group.

Do package permissions allow the Network Access Account access?

Even though the Configuration Manager 2007 client has already attempted and failed to use the Network Access Account to reach the package directory, the client tries again.

If in native mode, have we already attempted to connect to the SMS_DP_SMSPKGE$ virtual directory?

Yes. The client randomly attempted the SMS_DP_SMSPKGE$ directory first. If the client had started with the NOCERT_ SMS_DP_ directory, the client would then attempt to authenticate the client using a certificate, which would succeed. Then the client would attempt to download the package by using the Internet Guest account, which would fail. The result is the same: Marcus cannot download and run the program.

Accessing the Package from the Same Domain

Cliff tries to run the same advertisement. Cliff is a member of the Global Finance Users group, which is a member of the Finance domain local group on SJC-DC1. Cliff's client randomly connects to the SMS_DP_SMSPKGE$ virtual directory and is authenticated using the client certificate. However, the IUSR account is not a member of the Finance group, so the client fails over to the NOCERT_ directory. Because the ACLs on the package directory allow Finance users Read access, Cliff is allowed to access the package.

Accessing the Package from a Different Domain

Todd fails to run the advertisement because he is not a member of the Finance group. When his client connects first to the NOCERT_SMS_DP_SMSPKGE$ virtual directory, his access fails because his account, the Network Access Account, and his computer account are not members of Finance. Even though Windows authentication failed, the client attempts access using the NOCERT_SMS_DP_SMSPKGE$ virtual directory with certificate authentication. However, IUSR is not a member of Finance, so Todd cannot access the package.

Accessing the Package from an Untrusted Forest

Torsten cannot be a member of the Finance group because there is no trust with the Adatum.com forest, so Torsten cannot successfully download and run the finance program. If the package truly should be restricted to Finance users, this is the desired result. If the administrator added IUSR to the list of package access accounts, Torsten would be able to access the package certificate using authentication and anonymous access.

Important
In native mode, adding IUSR to the Package Access Accounts allows clients authenticated by certificates to bypass all other Package Access Accounts. In mixed mode, only Windows authentication is used, so adding IUSR to the Package Access Accounts does not allow clients to bypass all other Package Access Accounts.

Assume that the administrator creates a new advertisement for Microsoft Office 2003 but does not change the Package Access Accounts. The administrator also changes the Network Access Account in Active Directory Domain Services but does not reconfigure the account in the Configuration Manager 2007 console. When Torsten-PC attempts to run the advertisement, the following process is used.

Is the site in native mode? | Yes.
Is SJC-DP1 BITS-enabled? | Yes.
Does the client connect to the Windows authentication virtual directory (SMS_DP_SMSPKGE$) or the certificate authentication virtual directory (NOCERT_SMS_DP_SMSPKGE$)? | The client randomly selects the SMS_DP_SMSPKGE$ virtual directory.
Can the client be authenticated using a client certificate? | Yes. Torsten-PC has a valid client authentication certificate for native mode.
Do package permissions allow the Internet Guest (IUSR) account access to the package directory? | Yes. By default, the Internet Guest account is a member of the Users group on SJC-DP1, so it can access the package even though there is no trust relationship and the Network Access Account is not valid until the administrator configures the correct password. If Torsten's client had connected to the NOCERT_SMS_DP_SMSPKGE$ virtual directory first, it would have tried to authenticate Torsten by using Windows authentication. When that failed, it would have fallen back to the SMS_DP_SMSPKGE$ directory and would have been authenticated by the certificate.

Internet-Based Clients Running Advertisements

Internet-based clients can only download and run advertisements; they can never run them from the distribution point.

Intranet clients randomly select between the SMS_DP_ and NOCERT_SMS_DP_ virtual directories; then they fail over to the other virtual directory if the first one fails to provide authentication and access to download the content. Internet-based clients receive only the SMS_DP_ virtual directory on distribution points that are enabled to support Internet-based clients. If clients cannot be authenticated using a certificate, they cannot download the package. This is by design, to require certificate authentication for Internet-based clients.

If the logged-on user is an administrator, the user can access the local certificate store to present the client authentication certificate to the distribution point. If the program is initiated on a schedule, the program is initiated by the Local System account, which can access the local certificate store to present the certificate.

If the Internet-based client can present a certificate for native-mode authentication, the IUSR account must still have permissions to access the package directory or the program will fail.

Ed has an advertisement to download the corporate antivirus application and run it locally. The following process is used to evaluate Ed's access to the antivirus package. (See the flowchart in Package Access Flowchart for Internet-Based Clients.)

Is the site running Configuration Manager 2007 SP1?

No.

Note
In Configuration Manager 2007 SP1, advertisements can run without being scheduled, even if the logged on user is not an administrator.

Is the logged-on user a local administrator?

No. Following best security practices, Ed logs on as an ordinary user on his Windows Vista computer and uses User Access Control when he needs administrative access.

Is the program configured to run as a scheduled assignment?

Yes. The antivirus program runs weekly.

Because the program is scheduled, it runs within the Local System context. Local System has rights to access the private key of the client authentication certificate to prove its identity to the distribution point.

Is the private key authenticated?

Yes. The client authentication certificate is from a trusted CA.

Do package permissions allow the Internet Guest account access to the package directory?

Yes. The administrator has not changed the default Package Access Accounts. The package is downloaded using anonymous access.

Is the program set to run with administrative rights?

Yes. The administrator configures the program to run whether or not the user is logged on.

The program runs within the Local System security context.

Ed needs access to the finance application. He receives the advertisement to download the finance application and run it locally. The following process is used to evaluate Ed's access to the package. (See the flowchart in Package Access Flowchart for Internet-Based Clients.)

Is the site running Configuration Manager 2007 SP1? | No.
Is the logged-on user a local administrator? | Yes. Ed has logged on as the local administrator to receive this package. Because Ed is an administrator, he has rights to access the private key of the client authentication certificate to prove its identity to the distribution point.
Is the private key authenticated? | Yes. The client authentication certificate is from a trusted CA.
Do package permissions allow the Internet Guest account access to the package directory? | No. By default, the Internet Guest account would be a member of the Users group on IBCM-DP1, so it could access the package. However, the administrator has changed the default Package Access Accounts. Users are not permitted to read the package directory on IBCM-DP1, but members of the Finance domain local group are. The IUSR account is not a member of the Finance security group.
Important
Internet-based clients must use certificates to authenticate and then download the package using anonymous access, so Package Access Accounts cannot be used to restrict access based on user or group accounts.

Administrators have to consider the desired outcome when removing default Package Access Accounts on packages copied to distribution points supporting Internet-based clients. If the package should be restricted to members of the Finance group, Ed's failure to access the package is the desired result. If the Internet-based user must access the package, the Internet Guest account must have NTFS permissions to access the package source files.

See Also

Other Resources

Software Distribution in Configuration Manager


Software Updates in Configuration Manager

The Microsoft System Center Configuration Manager 2007 software updates feature provides a set of tools and resources that can help manage the complex task of tracking and applying software updates to client computers in the enterprise. Click the associated link in the following section for detailed information about the concepts, planning, configuring, managing, security, and troubleshooting software updates.

In This Section

Overview of Software Updates

Provides an overview of the software updates feature.

Prerequisites for Software Updates

Provides information about the internal and external software updates requirements.

Planning for Software Updates

Provides planning information for the software updates feature.

Configuring Software Updates

Provides the configuration checklist and tasks to configure software updates in the environment.

Tasks for Software Updates

Provides a set of tasks to perform software updates objectives.

Software Updates Security Best Practices and Privacy Information

Provides security and privacy information and best practices for software updates.

Troubleshooting Software Updates

Provides troubleshooting information for software updates.

Technical Reference for Software Updates

Provides technical reference information for software updates.

See Also

Other Resources

Configuration Manager 2007 Features


Overview of Software Updates

Providing updates to software and maintaining managed resources is a reality of networked, distributed computing. An effective software update management process is necessary to maintain operational efficiency, overcome security issues, and maintain the stability of the network infrastructure. However, because of the changing nature of technology and the continual appearance of new security threats, the task of effective software update management can be challenging.

The Microsoft System Center Configuration Manager 2007 software updates feature provides a set of tools and resources that can help manage the complex task of tracking and applying software updates to client computers in the enterprise. Click any link in the following section for overview information about software updates.

In This Section

Administrator Workflows for Software Updates

Provides visual workflows for software updates processes.

Administrator Checklists for Software Updates

Provides checklists for software updates processed.

About the Software Updates Process

Provides information about the end-to-end software updates process.

About the Software Updates Objects

Provides information about the objects that are used for software updates.

About the Software Update Point

Provides information about the software update point site system role.

About the Software Updates Client Agent

Provides information about the client agent used for software updates.

About Software Updates Metadata

Provides information about software updates metadata.

About Software Update Files

Provides information about software update files.

About Software Updates Synchronization

Provides information about software updates synchronization.

About the Icons for Software Updates

Provides information about the icons displayed for individual software updates.

About Software Updates Compliance

Provides information about the compliance for software updates

About Update Lists in Software Updates

Provides information about update lists.

About Deployment Templates in Software Updates

Provides information about software update deployment templates

About Software Update Deployment Packages

Provides information about software update deployment packages.

About Software Update Deployments

Provides information about software update deployments.

About the Software Updates End User Experience

Provides information about the end user experience when software updates are deployed to client computers.

About Phased and Expedited Software Update Deployments

Provides information about phased and expedited software update deployments.

About the Software Updates Wizards

Provides information about the software updates wizards.

About the Inventory Tool for Microsoft Updates

Provides information about the Inventory Tool for Microsoft Updates.

About System Center Updates Publisher

Provides information about System Center Updates Publisher that custom updates to be published to Windows Server Update Services and then synchronized with the Configuration Manager site server.

See Also

Other Resources

Configuring Software Updates
Planning for Software Updates
Software Updates in Configuration Manager


Administrator Workflows for Software Updates

The administrator workflows for software updates in Configuration Manager 2007 provide the end-to-end workflow for software updates, the workflow for configuring the software update point when the site server is in mixed mode, and the workflow for configuring the software update point when the site server is in native mode.

Click any link in the following section for more information about the available software updates administrator workflows.

In This Section

Administrator Workflow: Software Updates End to End Workflow

Provides the end-to-end workflow for software updates.

Administrator Workflow: Configuring the Software Update Point In Mixed Mode Site

Provides the workflow for configuring the software update point when the site server is in mixed mode.

Administrator Workflow: Configuring the Software Update Point In Native Mode Site

Provides the workflow for configuring the software update point when the site server is in native mode.

See Also

Other Resources

Administrator Checklists for Software Updates


Administrator Workflow: Software Updates End to End Workflow

Software updates in Configuration Manager 2007 must be configured before deploying updates to clients. Several additional steps should also be considered when planning for a deployment. After Configuration Manager is installed, the dependent components for software updates must be installed and configured, an active software update point must be enabled and configured, synchronization must occur between the software update point and Windows Server Update Services (WSUS), clients must scan for software updates compliance, software updates must be selected for deployment, and finally the deployment can be created and sent to clients.

The following flowchart provides a high level visual workflow for these steps, and the links at the end of this document provide detailed information about each process. For a complete list of the steps shown in this workflow and links to the detailed information about each step, see the Administrator Checklists for Software Updates.

Administrator Workflow Software Updates End to End

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure the Software Updates Client Agent
How to Create a Deployment Template
How to Create an Update List
How to Deploy Software Updates
How to Download Software Updates
How to Configure NAP Evaluation for Software Updates
How to Install and Configure the Inventory Tool for Microsoft Updates
How to Synchronize Software Updates

Concepts

Determine What Software Updates to Deploy
Monitoring Software Updates
Planning for a Software Update Deployment
Planning for the Software Update Point Installation
Planning for Software Updates Client Settings
Planning for Software Updates Server Settings
Prerequisites for Software Updates

Other Resources

Administrator Checklists for Software Updates
Overview of Software Updates


Administrator Workflow: Configuring the Software Update Point In Mixed Mode Site

The active software update point in Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a server that has Windows Server Update Services (WSUS) 3.0 installed. The software update point interacts with the WSUS services to configure update settings, request synchronization to the upstream update server, and synchronize the updates from the WSUS database to the site server database. Before software updates can be deployed to client computers, the active software update point must be installed, configured, and synchronized.

The following flowchart provides a visual workflow for the steps necessary to configure the active software update point in a mixed mode site, and the links at the end of this document provide detailed information about each process. For a complete list of the steps shown in this workflow and links to the detailed information about each step, see Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site.

Configure the Software Update Admin Workflow mixed

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Add the Web Server Certificate to the Custom WSUS Web Site
How to Configure a Firewall for Software Updates
How to Configure the WSUS Web Site to Use SSL
How to Create and Configure an Active Software Update Point
How to Determine the Port Settings Used by WSUS
How to Install the Windows Server Update Services 3.0 Administration Console
How to Install Windows Server Update Services 3.0

Concepts

About the Software Update Point
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Administrator Workflow: Configuring the Software Update Point In Native Mode Site

The active software update point in Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a server that has Windows Server Update Services (WSUS) 3.0 installed. The software update point interacts with the WSUS services to configure update settings, request synchronization to the upstream update server, and synchronize the updates from the WSUS database to the site server database. Before software updates can be deployed to client computers, the active software update point must be installed, configured, and synchronized.

When the site is in native mode, an active software update point can accept communication from both client computers on the intranet and Internet. Or the active software update point can accept communication from client computers on the intranet, and an additional active Internet-based software update point can accept communication from client computers on the Internet.

The following flowchart provides a visual workflow for the steps necessary to configure the active software update point in a native mode site, and the links at the end of this document provide detailed information about each process. For a complete list of the steps shown in this workflow and links to the detailed information about each step, see Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site.

Configure the Software Update Admin Workflow nativ

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Add the Web Server Certificate to the Custom WSUS Web Site
How to Configure a Firewall for Software Updates
How to Configure the WSUS Web Site to Use SSL
How to Create and Configure an Active Internet-Based Software Update Point
How to Create and Configure an Active Software Update Point
How to Determine the Port Settings Used by WSUS
How to Install the Windows Server Update Services 3.0 Administration Console
How to Install Windows Server Update Services 3.0

Concepts

About the Software Update Point
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Administrator Checklists for Software Updates

The administrator checklists for software updates in Configuration Manager 2007 provide the steps necessary to plan for and prepare the software updates components, configure the software updates components, assess software updates for compliance, deploy software updates, and monitor deployment progress.

Click any link in the following section for more information about the available software updates administrator checklists.

In This Section

Administrator Checklist: Planning and Preparing Software Updates

Provides the steps to plan for software updates and prepare the software updates environment.

Administrator Checklist: Configuring Software Updates

Provides the steps to configure the components for software updates.

Administrator Checklist: Assessing and Deploying Software Updates

Provides the steps to scan for software updates compliance and to deploy software updates to client computers.

Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site

Provides the steps to configure the software update point when the site server is in mixed mode.

Administrator Checklist: Configuring the Software Update Point in a Native Mode Site

Provides the steps to configure the software update point when the site server is in native mode.

See Also

Concepts

Administrator Workflows for Software Updates


Administrator Checklist: Planning and Preparing Software Updates

The following checklist for Configuration Manager 2007 software updates provides the steps necessary to learn about the software updates concepts, verify the prerequisites for software updates, plan for software updates depending on your environment, and prepare the software updates dependencies.

Step More Information

Review the Configuration Manager 2007 software updates concepts.

Overview of Software Updates

Review the software updates prerequisites, and then install any software update dependencies or make any required changes.

Prerequisites for Software Updates

Review the planning information about creating a test environment for software updates.

Planning the Test Environment for Software Updates

If the site server has been, or will be, upgraded from Systems Management Server (SMS) 2003, review the planning information to get important information about the upgrade process and what needs to be done to deploy software updates to both Configuration Manager and SMS 2003 client computers.

Planning the SMS 2003 Software Updates Upgrade

Determine what computer will become a site system server with the acting software update point site system role, what computer will become a site system server with an acting Internet-based software update point (if needed), and whether the software update point will be configured as a Network Load Balancing (NLB) cluster.

Determine the Software Update Point Infrastructure

Plan for the software update point installation. There are several dependent components that are required by the software update point, such as Windows Server Update Services (WSUS) 3.0. Depending on whether the site server is in native mode or mixed mode will determine the additional configuration requirements, such as configuring specific virtual directories in Internet Information Services (IIS) to be configured for Secure Sockets Layer (SSL).

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

Planning for the Software Update Point Installation

For details about configuring the software update point installation in a mixed mode or native mode site, see:

  • Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
  • Administrator Checklist: Configuring the Software Update Point in a Native Mode Site

Review the software updates server settings for information about the options available when setting up the software update point, information about maintenance windows, and the settings that can be configured for each software update.

Planning for Software Updates Server Settings

Review the software updates client settings for information about the Software Updates Client Agent, Computer Client Agent settings that are relevant to software updates, and the settings configured from the Configuration Manager Properties on client computers.

Planning for Software Updates Client Settings

Review the planning information for deploying software updates.

Planning for a Software Update Deployment

Create and configure a reporting point site system role to enable reporting for software updates.

How to Create a Reporting Point

If Network Access Protection (NAP) evaluation will be enabled on software updates at the site, several configuration steps must be performed prior to configuring the software updates. Until NAP is configured on a site, the NAP evaluation option is not available on software updates.

Administrator Checklist: Configure Network Access Protection for Configuration Manager

Create and configure distribution points for software update deployments. By default, the site server is configured as a standard distribution point. It is recommended that BITS be enabled on the distribution points for software updates. If Internet-based client computers are in the hierarchy, the distribution point must be configured to allow connections from them.

How to Designate a Distribution Point

See Also

Concepts

Administrator Checklist: Configuring a Site for Internet-Based Client Management

Other Resources

Administrator Checklists for Software Updates


Administrator Checklist: Configuring Software Updates

The following checklist for Configuration Manager 2007 software updates provides the steps necessary to configure the Software Updates Client Agent settings; plan for, create, and configure the software update point at the site; and synchronize the software updates metadata to the site server database.

Step | More Information
Configure the Software Updates Client Agent settings. By default, the client agent is enabled and the settings are sufficient for software update deployment. However, you should determine whether the default settings meet your needs and configure the settings as appropriate. | Planning for Software Updates Client Settings How to Configure the Software Updates Client Agent
Plan for the active software update point at the site. Multiple software update point site system roles can be created at each site, but only one software update point can be active, unless the site is in native mode. When the site is in native mode, one active software update point can be configured to accept both client connectivity from the Internet and intranet or two software update points can be configured for the site: one active software update point that accepts only client connectivity from the Internet and a second active software update point that accepts only client connectivity from the intranet. | Determine the Software Update Point Infrastructure Planning for the Software Update Point Installation Planning for the Software Update Point Settings
Create and configure the software update point infrastructure using the steps in the appropriate administrator checklist. | Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
If it was determined to be required when planning for the software update point, configure an NLB cluster to be used as the active software update point. | How to Configure the Active Software Update Point Component to Use an NLB Cluster
Synchronize the software updates metadata from Microsoft Update on the highest site in the Configuration Manager hierarchy (most often the central site) to the site server database. | How to Synchronize Software Updates
If the active Internet-based software update point is isolated and cannot connect to the active software update point to synchronize software updates, use the export and import function of the WSUSUtil tool to transfer the software updates metadata. | How to Synchronize Updates Using Export and Import

See Also

Concepts

Administrator Workflows for Software Updates

Other Resources

Administrator Checklists for Software Updates


Administrator Checklist: Assessing and Deploying Software Updates

The following administrator checklist provides information to help you determine what software updates are required by client computers, the required and optional steps for deploying software updates, and how to monitor software update deployments.

Important
Before deploying software updates, you must address certain planning considerations, install and configure external dependencies, install and configure software updates components, and so on. For more information, see Administrator Checklist: Planning and Preparing Software Updates and Administrator Checklist: Configuring Software Updates.

Step More Information

Determine what software updates are required on client computers by running compliance reports, or by reviewing the Required column on the Software Updates home page, under the Update Repository console tree node, or by creating a search folder that displays required software updates.

Determine What Software Updates to Deploy

Learn about deployment templates and how they can save you time and provide consistency when using them to create software update deployments. Templates can be created for different deployment scenarios and used to automatically populate many of the properties when creating a deployment.

Create deployment templates for the deployment scenarios at the site.

About Deployment Templates in Software Updates

How to Create a Deployment Template

Learn about update lists and why they should be used as part of the deployment workflow, particularly because of the reports available for update lists, how software updates are added to an update list, and how the update list is deployed.

Create an update list with the software updates that need to be deployed.

About Update Lists in Software Updates

How to Create an Update List

How to Use an Update List to Deploy Software Updates

Learn about deployment packages and provisioning distribution points with software updates. Software update files can be provisioned to distribution points prior to creating a deployment. The update files can be downloaded, packaged, and copied to the package shared folder on the distribution points so that they are available when the deployment is created. Software updates downloaded at a child site must be downloaded to a deployment package created at the child site.

Note
Software update source files are downloaded and packaged when creating deployments if the source files have not already been added to a deployment package.

About Software Update Deployment Packages

How to Download Software Updates

Choose whether to enable Network Access Protection (NAP) evaluation on software updates. NAP must already be configured on the site.

How to Configure NAP Evaluation for Software Updates

Plan for and deploy software updates to client computers.

Planning for a Software Update Deployment

How to Deploy Software Updates

Monitor the progress of software update deployments by using state-based deployment reports.

How to Monitor Software Update Deployments

Troubleshoot deployment issues.

Troubleshooting Software Updates Issues

See Also

Concepts

Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Administrator Workflows for Software Updates


Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site

The active software update point in Microsoft System Center Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a server that has Windows Server Update Services (WSUS) 3.0 installed. The software update point interacts with the WSUS services to configure update settings, request synchronization to the upstream update server, and synchronize the updates from the WSUS database to the site server database. Before software updates can be deployed to client computers, the active software update point must be installed, configured, and synchronized.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

The following checklist for Configuration Manager 2007 software updates provides the steps necessary to plan for and configure the active software update point for a mixed mode site.

Step | More Information
Review the software update point concepts. | About the Software Update Point
Learn about and plan for the software update point installation. | Planning for the Software Update Point Installation
Learn about and plan for the software update point settings. | Planning for the Software Update Point Settings
Determine what computer will be created as a site system server and be assigned the software update point site system role. | Determine the Software Update Point Infrastructure
If the acting software update point will be on a remote site system server, install the Windows Server Update Services (WSUS) 3.0 Administration Console on the site server computer. | How to Install the Windows Server Update Services 3.0 Administration Console
Install WSUS 3.0 on the computer that will be assigned the active software update point site system role. | How to Install Windows Server Update Services 3.0
If the active software update point will communicate using SSL, configure WSUS for Secure Sockets Layer (SSL) on the computer that will be assigned the active software update point role. | How to Configure the WSUS Web Site to Use SSL
Create the site system server with the software update point site system role, configure the server as the active software update point, and then configure the active software update point settings. | How to Create and Configure an Active Software Update Point
Verify that the active software update point is configured to use the correct ports. If you installed WSUS with a custom WSUS Web site, the custom WSUS Web site defaults to HTTP port 8530 and HTTPS (SSL) port 8531. If you used the existing Internet Information Services (IIS) Default Web site, the default ports are HTTP port 80 and HTTPS (SSL) 443. | How to Determine the Port Settings Used by WSUS How to Create and Configure an Active Software Update Point

See Also

Concepts

Administrator Workflow: Configuring the Software Update Point In Mixed Mode Site


Administrator Checklist: Configuring the Software Update Point in a Native Mode Site

The active software update point in Microsoft System Center Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a server that has Windows Server Update Services (WSUS) 3.0 installed. The software update point interacts with WSUS services to configure update settings, request synchronization to the upstream update server, and synchronize the updates from the WSUS database to the site server database. Before software updates can be deployed to client computers, the active software update point must be installed, configured, and synchronized.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

When the site is in native mode, an active software update point can accept communication from both client computers on the intranet and Internet, the active software update point can accept communication from client computers on the intranet, and an additional active Internet-based software update point can accept communication from client computers on the Internet.

The following checklist for Configuration Manager 2007 software updates provides the steps necessary to plan for and configure the active software update point for a native mode site, and links to where you can locate more information about those steps.

Step More Information

Review the software update point concepts.

About the Software Update Point

Learn about and plan for the software update point installation.

Planning for the Software Update Point Installation

Learn about and plan for the software update point settings.

Planning for the Software Update Point Settings

Determine what computer will be created as a site system server and be assigned the software update point site system role.

Determine the Software Update Point Infrastructure

If the acting software update point will be on a remote site system server, install the Windows Server Update Services (WSUS) 3.0 Administration Console on the site server computer.

How to Install the Windows Server Update Services 3.0 Administration Console

Install WSUS 3.0 on the computer that will be assigned the active software update point site system role.

How to Install Windows Server Update Services 3.0

Create the site system server with the software update point site system role, configure the server as the active software update point, and then configure the active software update point settings.

How to Create and Configure an Active Software Update Point

Verify that the active software update point is configured to use the correct ports. If you installed WSUS with a custom WSUS Web site, the custom WSUS Web site defaults to HTTP port 8530 and HTTPS (SSL) port 8531. If you used the existing Internet Information Services (IIS) Default Web site, the default ports are HTTP port 80 and HTTPS (SSL) 443.

How to Determine the Port Settings Used by WSUS

How to Create and Configure an Active Software Update Point

If an Internet-based software update point is needed, do the following:

  • Install WSUS 3.0 on the computer that will be assigned the active Internet-based software update point site system role.

How to Install Windows Server Update Services 3.0

  • Configure WSUS for Secure Sockets Layer (SSL) on the computer that will be assigned the active Internet-based software update point site system role.

How to Configure the WSUS Web Site to Use SSL

  • Create the site system server with the software update point site system role.

How to Add the Software Update Point Site Role to a Site System

  • Configure the site system server as the acting Internet-based software update point.

How to Create and Configure an Active Internet-Based Software Update Point

See Also

Concepts

Administrator Workflow: Configuring the Software Update Point In Native Mode Site


About the Software Updates Process

Software updates in Microsoft System Center Configuration Manager 2007 are composed of two main parts. The metadata is the information about each software update, and it is stored in the site server database. The second part is the software update file, which is what client computers download and run to install the software update. There are three main operational phases. The synchronization phase is when the software update metadata is synchronized from the upstream Windows Server Update Services (WSUS) server, or from Microsoft Update, and inserted into the site server database. The compliance assessment phase is when client computers scan for software update compliance and report their compliance state for synchronized software updates. The deployment phase is when software updates selected for deployment by the administrator, the software updates policy sent to client computers, and then the software update files are downloaded to and installed on client computers. Each phase is described in detail later in this section.

Before software update compliance assessment data can be displayed in the Configuration Manager 2007 console and software updates can be deployed to client computers, considerable planning should take place for software updates in the hierarchy. Then the software updates components must be configured to meet the needs of the environment.

Planning Phase

The planning phase for software updates involves learning the Configuration Manager 2007 concepts, becoming familiar with the software updates in a test environment, collecting information about your production environment, planning for software updates when there are Systems Management Server (SMS) 2003 child sites, planning software updates when there are Internet-based client computers, determining whether Network Load Balancing (NLB) should be used on the software update point, and so on. For more information about planning for software updates in your environment, see Planning for Software Updates. For a list of planning and preparation steps, see Administrator Checklist: Planning and Preparing Software Updates.

Configuration Phase

After Configuration Manager 2007 is installed, the software updates feature must be configured. The configuration phase for software updates involves installing and configuring the software update point, as well as reviewing the configuration settings for other software updates components and modifying the settings to suit your needs. For more information about configuring software updates, see Administrator Checklist: Configuring Software Updates.

Synchronization Phase

Software updates synchronization in Configuration Manager 2007 is the process of retrieving the software updates metadata that meets the configured criteria from the upstream Windows Server Update Services (WSUS) server or Microsoft Update. Synchronization can be scheduled on the central site as part of the software update point properties or manually initiated by using the Run Synchronization action on the Update Repository console tree node. Child sites initiate synchronization only after receiving a request from their parent site. For more information about the synchronization process, see About Software Updates Synchronization.

Compliance Assessment Phase

The Software Updates Client Agent is enabled in Configuration Manager 2007 by default, which installs components used on client computers to manage the compliance assessment and evaluation scanning for software updates, and the installation of software updates that are deployed to them. When the software update point is installed and synchronized, a site-wide machine policy is created that informs client computers that software updates has been enabled for the site and the client computer initiates a scan for software updates compliance. The compliance results are sent to the management point using state messages, forwarded to the site server, and then inserted into the site database. For more information, see About Software Updates Compliance.

Deployment Phase

The Configuration Manager 2007 console displays the software updates compliance assessment data for client computers in the hierarchy. Software update deployments are created for required software updates using the Deploy Software Updates Wizard. Deployments can be created so that client computers have the option to install the updates (optional deployment) or automatically initiate software update installation on client computers at the configured deadline (mandatory deployment). For more information, see About Software Update Deployments. For the steps to assess and deploy software updates, see Administrator Checklist: Assessing and Deploying Software Updates.

See Also

Tasks

How to Configure Software Updates Synchronization
How to Deploy Software Updates

Concepts

About Software Updates Compliance
About Software Update Deployments
About the Software Update Point
About the Software Updates Client Agent
About Software Updates Synchronization
Administrator Checklist: Assessing and Deploying Software Updates
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates

Other Resources

Configuring Software Updates
Planning for Software Updates


About the Software Updates Objects

Each feature in Configuration Manager 2007 uses and provides the ability to create objects. In most cases, class and instance security rights can be configured for the object and administrative actions can be run against the object to initiate a process. The following software updates objects are available in the Configuration Manager console:

Object | Description
Deployments | Deployments are used to deploy software updates to clients in the target collection. Deployment objects are replicated to child sites where they are read-only.
Deployment packages | Deployment packages host the software update source files. Deployment package objects are replicated to child sites where they are read-only.
Deployment templates | Deployment templates store many of the deployment properties that might not change from deployment to deployment and are used to save time and ensure consistency when creating deployments.
Search folders | Search folders provide an easy way to retrieve a set of software updates that meet the defined search criteria.
Software updates | Each software update is a configuration item object that is created during the software update synchronization process.
Update lists | Update lists are a fixed set of software updates and can be used for delegated administration and creating software update deployments. There are also several reports that provide information about update lists.

Objects Replicated to Child Sites

Software updates deployment and deployment package objects are replicated from the site where they were created to all child sites in the Configuration Manager hierarchy. Each of the objects replicated to a child site contain read-only properties. Even though the properties for these objects must be modified at the site where they were created, the actions available for deployments at child sites are the same as on the site where they were created and deployment packages can be used to host the software updates that are deployed on the child sites.

Icons for Software Updates Objects

Each software updates object displays an icon in the Configuration Manager console. Depending on the state of the object, there might be different icons for the same software updates object. For example, a software update typically displays an icon with a green arrow, but a software update that has been superseded by another update displays an icon with a yellow arrow. For a complete list of the icons used by software updates objects, see Icon Glossary for Software Updates.

See Also

Tasks

How to Configure Search Folders for Software Updates

Concepts

About Software Update Deployments
About Software Update Deployment Packages
About Deployment Templates in Software Updates
About Software Updates Metadata
About Update Lists in Software Updates
Icon Glossary for Software Updates


About the Software Update Point

Topic last updated—November 2007

The software update point in Microsoft System Center Configuration Manager 2007 is a required component of software updates on primary sites, is an optional component of software updates on secondary sites, and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a server that has Windows Server Update Services (WSUS) 3.0 installed. The software update point interacts with the WSUS services to configure update settings, to request synchronization to the upstream update source, and on the central site, to synchronize software updates from the WSUS database to the site server database.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

There can be multiple site system servers with the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in native mode, the active software update point can be configured to accept communication from all client computers. Alternatively, an active Internet-based software update point can be assigned to a remote site system server that accepts communication from only Internet-based client computers and the active software update point accepts communication from client computer on the intranet.

Requirements for the Software Update Point

WSUS 3.0 must be installed on each site system server before it is assigned the software update point site system role, and other requirements might be necessary depending on your environment and the Configuration Manager 2007 site server infrastructure. For information about planning for the software update point requirements, see Planning for the Software Update Point Installation.

Software Update Point Settings

The software update point settings are initially specified when creating an active software update point, and they can be modified from the Software Update Point Component properties. The software update point settings configure what site system server is the active software update point; what site system server is the active Internet-based software update point if one is specified at the site; the synchronization source; the synchronization schedule; and the products, classifications, and languages for which software updates will be synchronized. For more information about the settings for the software update point, see Planning for the Software Update Point Settings. After the active software update point is installed at a site, it must be synchronized to retrieve the software updates metadata.

Active Software Update Point

When the software update point site system role is created and configured as the active software update point, the software update point components are installed and enabled. As part of the installation, the WSUS Control Manager component is installed on the software update point computer and is responsible for periodically checking the health of WSUS. The WSUS Configuration Manager component of the SMS Executive service on the site server initially configures the WSUS settings with the settings that were specified while creating the software update point site system role. The WSUS settings are verified every hour, by default, and if any settings have been changed WSUS Configuration Manager will change them to coincide with the software update point settings. This emphasizes the fact that all settings should be made in the Software Update Point Component properties in Configuration Manager and not from within the WSUS console.

Active Internet-based Software Update Point

When the primary site server is configured for native mode, you have the option to install a second software update point to handle connections from Internet-based client computers. A new software update point site system is created but not configured as active. Then, from the Software Update Point Component Properties dialog box, you specify the site system as the Internet-based software update point. The initial configuration is the same as an active software update point except that there are additional requirements when the site is in native mode.

Note
Internet-based software update points are only supported on site systems for primary site servers. Even though the option to install an Internet-based software update point on secondary sites is available, it will not be accessed by client computers and is not supported.

For more information about the requirements for installing software updates in native mode, see Administrator Checklist: Configuring the Software Update Point in a Native Mode Site.

Installing a Software Update Point at a Secondary Site

At a secondary site, you have the option of installing an active software update point for the site. Having a software update point at a secondary site provides local access to client computers when scanning for software updates compliance. When the secondary site does not have a configured software update point, client computers will connect to the active software update point on the parent site. You will need to determine whether client computers at the remote site have sufficient connectivity to WSUS running on the parent site or whether WSUS running on a local software update point is required.

Note
WSUS running on the software update point for the secondary site is configured to be a replica of the active software update point for the parent site.

Important
Internet-based software update points are not supported on secondary sites.

For more information about when to install a software update point at a secondary site, see Determine the Software Update Point Infrastructure.

See Also

Tasks

How to Configure a Software Update Point for Internet-Based Client Connections
How to Add the Software Update Point Site Role to a Site System
How to Install Windows Server Update Services 3.0

Concepts

About Software Updates Synchronization
About the Software Updates Client Agent
Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


About the Software Updates Client Agent

The Software Updates Client Agent in Configuration Manager 2007 is enabled by default and client agent components are installed on client computers with the other Configuration Manager client components. The Software Updates Client Agent handles compliance assessment scan requests, software update evaluation requests, deployment policies for the client, and content download requests. The Software Updates Client Agent properties contain several sitewide client agent settings.

Note
Before software updates can be deployed, other components and settings need to be configured. See the Administrator Checklists for Software Updates for a detailed list.

Software Updates Client Agent Settings

The Software Updates Client Agent settings are configured in the Software Updates Client Agent Properties dialog box, which is accessed from the Client Agents Configuration Manager console tree node. The following client agent settings can be configured:

General Settings

The Enable Software Updates on Clients setting specifies whether to enable the Software Updates Client Agent and the Scan Schedule specifies how often the client agent initiates compliance assessment scans on client computers. Disabling the Software Updates Client Agent puts the client agent components on client computers into a dormant state, but does not remove the components. Reenabling the Software Updates Client Agent will initiate a policy to request that the components on clients be enabled. The Software Updates Client Agent is configured on a site-by-site basis. Disabling the client agent on a site affects only the client computers assigned to that site and prevents compliance assessment scanning and deployments from being received on client computers.

Update Installation Settings

The Enforce all mandatory deployments setting specifies whether to enforce all mandatory software update deployments that have deadlines within a specified period of time. When a deadline is reached for a mandatory software update deployment, installation is initiated on clients for the updates defined in the deployment. This setting determines whether to also initiate the installation for software updates defined in other mandatory deployments that have a configured deadline within the specified period of time. The Hide all deployments from end users setting provides the ability to hide deployments when they are received and installed on client computers.

Deployment Reevaluation Setting

The Deployment Reevaluation setting specifies how often the Software Updates Client Agent reevaluates software updates for installation status. When software updates that have been previously installed are no longer found on client computers, and still required, they are reinstalled.

See Also

Tasks

How to Configure the Software Updates Client Agent

Concepts

Planning for Software Updates Client Settings


About Software Updates Metadata

Software updates in Configuration Manager 2007 consist of software update files and metadata. The software update file is the actual file that the client computer downloads, such as an executable (.exe) or Windows Installer (.msi) file, and then installs to update a component or application. The metadata provides the information about the software update, such as name, description, products that the update supports, update classification, article ID, download URL, applicability rules, and so on.

Software Update Products, Classifications, and Languages

Software updates are synchronized based on product (or product family), classification, and language. Each of these can be configured in the Software Update Point Configuration Properties dialog box, which can be accessed by using the following procedure.

To open the Software Update Point Configuration Properties dialog box

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. Right-click Software Update Point Component, and then click Properties.

Products Synchronized by Configuration Manager

The metadata for each software update defines what products are applicable to the update. A product is a specific edition of an operating system or application (for example, Microsoft Windows Server 2003). A product family is the base operating system or application from which the individual products are derived. An example of a product family is Microsoft Windows, of which Microsoft Windows Server 2003 is a member. You can specify a product family or individual products within a product family. The products are configured from the Products tab of the Software Update Point Component Properties dialog box on the active software update point highest in the Configuration Manager hierarchy, which is most often the central site.

Note
When software updates are applicable to multiple products and at least one of the products has been selected for synchronization, all the products will appear in the Configuration Manager console even if some have not been selected. For example, if Windows Server 2003 is the only operating system that you have subscribed to and a software update applies to product "Windows Server 2003" and "Windows Server 2003 Datacenter Edition," both products will show up in the Configuration Manager repository.

Update Classifications Synchronized by Configuration Manager

The metadata for each software update defines what classification type the update is a member of. The update classification represents what type of software the software update will update on client computers. For any given product or product family, software updates can be defined with many different update classifications. The following update classifications are currently available for software updates in Configuration Manager:

  • Critical Updates: Specifies a broadly released update for a specific problem that addresses a critical, non-security-related bug.
  • Definition Updates: Specifies an update to virus or other definition files.
  • Drivers: Specifies an update to software components designed to support hardware.
  • Feature Packs: Specifies new product features that are distributed outside of a product release and typically are included in the next full product release.
  • Security Updates: Specifies a broadly released update for a product-specific, security-related issue.
  • Service Packs: Specifies a cumulative set of hotfixes that are applied to an application. These hotfixes can include security updates, critical updates, software updates, and so on.
  • Tools: Specifies a utility or feature that helps to complete one or more tasks.
  • Update Rollups: Specifies a cumulative set of hotfixes that are packaged together for easy deployment. These hotfixes can include security updates, critical updates, updates, and so on. An update rollup generally addresses a specific area, such as security or a product component.
  • Updates: Specifies an update to an application or file currently installed.

The update classifications are configured from the Classifications tab of the Software Update Point Component Properties dialog box on the active software update point highest in the Configuration Manager hierarchy, which is most often the central site.

Update Language

The metadata for each software update defines what languages the update file is applicable to, and it provides the summary information for the software update in one or more languages. The summary information includes the title and description for the software update and is configured from the Languages tab of the Software Update Point Component Properties dialog box on the active software update point highest in the Configuration Manager hierarchy, which is most often the central site.

Important
It is very important that you select all of the summary details languages that will be needed in your Configuration Manager hierarchy. When the active software update point on the central site is synchronized, the selected summary details languages determine what software update metadata is retrieved. If the summary details languages are modified after the synchronization has run at least one time, the metadata is retrieved for the modified summary details languages for only new or updated software updates. The software updates that have already been synchronized will not retrieve metadata for different languages unless there is a change to the update on Microsoft Update.

Software Updates Metadata After a Site Upgrade

During a site server upgrade, supported software updates are migrated into the Configuration Manager 2007 database and the Expired attribute for each update is set to Yes, putting them in an expired state. Before Configuration Manager client computers are able to scan for software update compliance and before software update deployments can be created at the site server, the updates must be put back into an active state by running software updates synchronization. For more information about planning software updates for an upgrade, see Planning the SMS 2003 Software Updates Upgrade. For more information about synchronizing software updates in Configuration Manager, see About Software Updates Synchronization.

Software Updates Supersedence

Supersedence occurs when a new software update contains the same fixes that were in a previously released software update. In the past, new and previously released software updates, which contained the same fix, might have both been marked as required when the only one that was necessary was the newer software update.

In Configuration Manager 2007, when new software updates are released that contain fixes for previously released updates, Microsoft Update is refreshed with information relating to the new software update and any software updates that it supersedes. As client computers scan for software update compliance, any required software updates that supersede previous updates are returned with the compliance state but the previously released software updates are not returned. The exception to this is when a Service Pack contains a required software update. The Windows Update Agent returns both the software update and the service pack with a required compliance state. This provides administrators with the flexibility to deploy individual software updates or full service packs.

See Also

Concepts

About Software Update Files
About Software Updates Synchronization
About the Software Update Point
Planning for the Software Update Point Settings
Planning the SMS 2003 Software Updates Upgrade

Other Resources

Software Update Point Component Properties


About Software Update Files

Software updates in Configuration Manager 2007 consist of metadata and software update files. The metadata provides the information about the software update, such as name, description, products that the update supports, update classification, article ID, download URL, applicability rules, and so on. The software update file is the actual file that the client computer downloads, such as an executable (.exe), Windows Installer (.msi) file, or Windows Installer Patch (.msp), and then installs to update a component or application. The software update file might be stored on a Windows Server Update Services (WSUS) 3.0 server that is configured to be an active software update point, and is always stored on distribution points for the site when the software update is downloaded or deployed.

How WSUS Stores Update Files

When software updates are synchronized at the central site, the software updates metadata is synchronized from Microsoft Update, but depending on how the Windows Server Update Services (WSUS) server is synchronized, the update files might or might not be copied down to a shared folder on the WSUS server. When synchronization completes on the WSUS server, only the metadata is synchronized from the WSUS server database to the Configuration Manager site database. For more information about synchronization in Configuration Manager, see About Software Updates Synchronization.

Note
When System Center Updates Publisher is used to publish software updates, the update files are automatically stored in the shared folder on the WSUS server.

How Configuration Manager Stores Update Files

Software update files are retrieved and copied to distribution points when the software update is downloaded using the Download Updates Wizard or deployed to client computers using the Deploy Software Updates Wizard. Both methods download the software update file to a temporary location on the site server hard drive, which creates and stores a compressed package file containing the software update, decompresses the package file, and then copies the update file to the package shared folder on the distribution point. For more information about deployment packages, see About Software Update Deployment Packages. When client computers receive a deployment with the update, they will download the software update file from the distribution point, store the update file in the local cache, and then run the update file.

Note
When a software update has an associated license terms, the license terms is not downloaded by Configuration Manager. Client computers retrieve the license terms during installation by accessing them from the WSUS server (when updates are stored locally) or from the Internet. When a client computer cannot access the license terms, the software update installation will fail.

The logged-on user account and proxy settings configured in Internet Explorer for the user are used by default when the site server downloads software update files from the Internet. The command-line utility, UpdDwnldCfg.exe, is provided on the Configuration Manager 2007 DVD and on every site server and can be used to modify the default server and account settings used when downloading software update files from the Internet. For more information about using the UpdDwnldCfg.exe utility, see How to Configure Proxy Settings Used When Downloading Software Update Files.

See Also

Tasks

How to Download Software Updates
How to Synchronize Software Updates

Concepts

About Software Update Deployment Packages
About Software Updates Metadata
About Software Updates Synchronization


About Software Updates Synchronization

Topic last updated—November 2007

Software updates synchronization in Configuration Manager 2007 is the process of retrieving the software updates metadata that meets the configured criteria from Microsoft Update or Windows Server Update Services (WSUS) 3.0 running on the active software update point for the parent site. The highest site in the Configuration Manager hierarchy with an active software update point (most likely the central site, as it is referred to in this topic) synchronizes with Microsoft Update, which can be scheduled as part of the software update point properties or manually initiated by using the Run Synchronization action on the Update Repository console tree node. Child sites initiate synchronization only when a synchronization request is received from the parent site.

When synchronization is initiated on a configured schedule, a full synchronization is performed and all changes to the software updates metadata since the last scheduled synchronization are inserted into the site database. This includes new software updates metadata or metadata that has been modified, has been removed, or has expired. When synchronization is initiated manually, only new software updates metadata since the last synchronization is inserted into the site database. Therefore, the manual synchronization completes faster than the scheduled synchronization. Child sites always perform a full synchronization.

What Software Updates Are Available for Synchronization?

The active software update point on the central site synchronizes with Microsoft Update, and therefore, any software updates that are available on Microsoft Update can be synchronized in Configuration Manager 2007. You can also select the Local Publisher items on the Products tab of the Software Update Point Component properties to synchronize custom updates that were published using System Center Updates Publisher. For more information, see About System Center Updates Publisher.

Synchronization Process

The software update point site system role must be created on a computer running WSUS 3.0. After the active software update point has been installed, the WSUS Synchronization Manager component on the software update point initiates the synchronization process.

Note
When the active software update point is remote from the site server, the WSUS Administration console must be installed on the site server so that the WSUS API files are available.

When synchronization completes at each site, a site-wide machine policy is created that allows client computers to retrieve the location of the WSUS server and to initiate a scan for software updates compliance. For more information, see About Software Updates Compliance.

If synchronization fails at a site, there is a default retry interval of 60 minutes. The WSUS Synchronization Manager component will schedule the synchronization in 60 minutes from the failed process and then initiate the synchronization process again. WSUS Synchronization Manager will create status message 6703 when synchronization fails. For more information about synchronization issues, see Troubleshooting Software Updates Synchronization Failures.

Synchronization on the Central Site

When synchronization is initiated at the central site, WSUS Synchronization Manager requests that Update Services (a component of WSUS) running on the active software update point for the site initiates a manual synchronization. The software updates metadata is then synchronized from Microsoft Update, and any changes are inserted or updated in the WSUS database. When WSUS completes synchronization, WSUS Synchronization Manager synchronizes the software updates metadata from the WSUS database to the Configuration Manager database. Metadata that changed since the last synchronization is inserted or updated in the site server database, and then the software updates metadata is replicated to child sites using the standard site-to-site replication process. When synchronization completes, the WSUS Synchronization Manager component, SMS_WSUS_SYNC_MANAGER, creates status message 6702.

When an active Internet-based software update point is configured on the central site, the same synchronization process is followed as described above, except that the active Internet-based WSUS server synchronizes with the active software update point configured for the site, not Microsoft Update, and the site server database is not synchronized as part of the process.

Synchronization on Child Sites

As software updates synchronization runs on the central site, the software updates metadata is replicated down the Configuration Manager hierarchy. When the child site receives the software updates metadata, it is inserted into the site database.

When synchronization completes on the parent primary site, a synchronization request is then sent to the child site. WSUS Synchronization Manager on the child site receives the request, and it requests that Update Services, running on the active software update point for the site, initiate a manual synchronization. The software updates metadata is then synchronized from WSUS running on the active software update point for the parent site, and any changes are inserted or updated in the WSUS database. When there is an Internet-based software update point, the synchronization process is initiated for WSUS on that site system.

After synchronization completes successfully on the site, a synchronization request is sent to child sites and the process continues throughout the hierarchy.

Synchronization for Internet-Based Software Update Points

When synchronization completes for the active software update point at a site, synchronization is initiated for the active Internet-based software update point for the site, if configured. This process is much like the synchronization process on child sites, except that WSUS running on the active Internet-based software update point synchronizes with WSUS running on the active software update point for the same site.

When the synchronization source configured for the Internet-based software update point is not configured to synchronize with an upstream update server, the export and import functions of the WSUSutil tool can be used to synchronize software updates metadata from an active software update point for the site. For more information, see How to Synchronize Updates Using Export and Import.

Synchronizing Software Updates for SMS 2003 Clients

Systems Management Server (SMS) 2003 clients use the Inventory Tool for Microsoft Update to scan for the software updates that are defined in the Microsoft Update catalog. The Microsoft Update catalog must be synchronized for the client computers to scan for the most recent software updates. By default, the catalog is synchronized every seven days using the Microsoft Update Tool Sync advertisement on the site where the Inventory Tool for Microsoft Updates is installed, most likely the central site. For more information, see About the Inventory Tool for Microsoft Updates.

See Also

Tasks

How to Synchronize Software Updates
How to Synchronize the Microsoft Update Catalog for SMS 2003 Clients
How to Synchronize Updates Using Export and Import
Troubleshooting Software Updates Synchronization Failures

Concepts

About Software Updates Compliance
About Software Updates Metadata
About the Inventory Tool for Microsoft Updates
About the Software Updates Process
Planning for the Software Update Point Settings


About the Icons for Software Updates

Topic Last Updated—August 2008

Every software update that has been synchronized displays in the Microsoft System Center Configuration Manager 2007 console, and the first column for each software update contains one of four icons. This section provides information about each icon that can be associated with a software update.

Normal Icon

Normal Update Software Icon The green icon represents a normal software update.

Description:

Software updates that have been synchronized available for deployment.

Operational Concerns:

There are no operational concerns.

Expired Icon

Software Update Icon The grey icon represents an expired software update. Expired software updates can also be identified by viewing the Expired column for the software update when it displays in the Configuration Manager console.

Description:

Expired software updates were previously deployable to client computers, but once a software update is expired, new deployments can no longer be created for the updates. Existing deployments that contain an expired update continues to work.

Operational Concerns:

Expired software updates should be replaced when possible. Expired software updates that have been deployed continue to work and will continue to be tracked for software update compliance. Expired software updates are considered "not required" for reporting purposes.

Superseded Icon

Supersede Software Update Icon The yellow icon represents a software update that has been superseded by another update. Superseded updates can also be identified by viewing the Superseded column for the software update when it displays in the Configuration Manager console.

Description:

Superseded software updates have been replaced with newer versions of the update, but are still deployable. For example, a software update that has been included in a service pack or update rollup would be superseded.

Operational Concerns:

When possible, you should deploy the superseding software update to client computers instead of the update that was superseded. When selecting a superseded software update in the Configuration Manager console, the Superseded tab displays that provides a list of the software updates that supersede the selected update.

Invalid Icon

Invalid Software Update Icon The red icon represents an invalid software update.

Description:

Invalid software updates are deployed but for some reason, the content (update file) is not available. There are 2 main ways this could happen – first is that updates get deployed successfully but sometime later someone deletes the update binary from a package; second is one a child site, where the deployment created at a parent site has been replicated successfully, but for some reason, the deployment packages have not been replicated to a distribution point for the child site

Operational Concerns:

The invalid software update needs to be redeployed. When content is missing for an update in a deployment created at a parent site, the software update needs to replicated or re-downloaded on child sites.

Metadata-Only Icon

Software Updates Metadata Only Icon The blue icon represents a metadata-only software update.

Description:

Metadata-only software updates are available in the Configuration Manager console for reporting and cannot be deployed or downloaded because an update file is not associated with the software updates metadata.

Operational Concerns:

Metadata-only software updates are available for reporting purposes and are not intended to be used in software update deployments.

Locked Software Update Icons

The software updates metadata is synchronized at the highest site in the Configuration Manager hierarchy that has an active software update point, which is usually the central site. The properties for the software updates can be modified at the central site, but at child sites the properties are locked. This is indicated by a lock displayed on the software update icon.

See Also

Tasks

How to Download Software Updates
How to Deploy Software Updates

Concepts

About Software Update Deployments
About Software Update Files
About Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

Overview of Software Updates


About Software Updates Compliance

Topic last updated—November 2007

Before you deploy software updates to client computers in Configuration Manager 2007, a scan for software updates compliance should be initiated on client computers. For each software update, a state message is created that contains the compliance state for the update. The state messages are sent in bulk to the management point and then to the site server, where the compliance state is inserted into the site database. Compliance state for software updates is displayed in the Configuration Manager console, and software updates can be deployed and installed on client computers that require the updates. The following sections provide information about the compliance states and describe the process for scanning for software updates compliance.

Software Updates Compliance States

The following table lists and describes each compliance state that is displayed in the Configuration Manager console for software updates.

State Description

Required

Specifies that the software update is applicable and required on the client computer. Any of the following conditions could be true when the software update state is Required:

  • The software update has not been deployed to the client computer.
  • The software update has been installed on the client computer, but the most recent state message has not yet been inserted into the database on the site server. The client computer rescans for the update after the installation completes. There might be a delay of up to two minutes before it sends the updated state to the management point, which then forwards it to the site server.
  • The software update has been installed on the client computer, but the software update installation requires a computer restart before it completes.
  • The software update has been deployed to the client computer but not yet installed.

Not Required

Specifies that the software update is not applicable on the client computer, and therefore, the software update is not required.

Installed

Specifies that the software update is applicable on the client computer and that the client computer already has the software update installed.

Unknown

Specifies that the site server has not received a state message from the client computer, typically because:

  • The client computer did not successfully scan for software updates compliance.
  • The scan completed successfully on the client computer, but the state message has not been processed yet on the site server, possibly due to backlog state message backlog.
  • The scan completed successfully on the client computer, but the state message has not been received from the child site.
  • The scan completed successfully on the client computer, but the state message file was corrupted in some way and could not be processed.

Scan for Software Updates Compliance Process

When the active software update point is installed and synchronized, a site-wide machine policy is created that informs client computers that the Configuration Manager 2007 software updates feature has been enabled for the site. When a client computer receives the machine policy, a compliance assessment scan is scheduled to start randomly within the next two hours. When the scan is initiated, a component of the Software Updates Client Agent clears the scan history, submits a request to find the WSUS server that should be used for the scan, and updates the local Group Policy with the WSUS server location.

Note
Internet-based clients and clients attached to a site configured for native mode must connect to the WSUS server by using Secure Sockets Layer (SSL).

A scan request is passed to the Windows Update Agent (WUA). The WUA then connects to the WSUS server location listed in the local policy, retrieves the software updates metadata that has been synchronized on the WSUS server, and scans the client computer for the updates. A component of the Software Updates Client Agent detects that the scan for compliance has completed, and it creates state messages for each software update that had a change in compliance state since the last scan. The state messages are sent to the management point in bulk every five minutes. The management point then forwards the state messages to the site server, where the state messages are inserted into the site server database.

After the initial scan for software updates compliance, the scan is initiated at the scan schedule. However, if the client has scanned for software updates compliance within the time frame indicated by the Time-to-Live (TTL) value, the client will use the software updates metadata that is stored locally. When the last scan is outside of the TTL, the client must connect to WSUS running on the active software update point and update the software updates metadata stored on the client.

Including the scan schedule, the scan for software updates compliance can initiate in the following ways:

  • Scan schedule: The scan for software updates compliance initiates at the configured scan schedule, which is configured on the General tab in the Software Updates Client Agent properties.
  • Configuration Manager Properties action: The user can initiate the Software Updates Scan Cycle or Software Updates Deployment Evaluation Cycle action from the Configuration Manager Properties dialog box on the client computer.
  • Deployment reevaluation schedule: The deployment evaluation and scan for software updates compliance initiates at the configured deployment reevaluation schedule, which is configured on the Deployment Re-evaluation tab in the Software Updates Client Agent properties.
  • Prior to downloading update files: When a client computer receives an assignment policy for a new mandatory deployment, the software update files are downloaded to the local cache. Prior to downloading the update files, a scan is initiated to verify that the update is still required.
  • Prior to update installation: Just prior to software update installation, a scan is initiated to verify that the update is still required.
  • After update installation: Just after a software update installation completes, a scan is initiated to verify that the update is no longer required and to create a new state message that indicates the update has been installed. When the installation has finished but a restart is necessary, the state will indicate that the client computer is pending a restart.
  • After system restart: When a client computer was pending a system restart for the software update installation to complete, a scan is initiated after the restart to verify that the update is no longer required and to create a state message that indicates the update has been installed.

Time to Live Value

The software updates metadata that is required for the scan for software updates compliance is stored on the local client computer and is relevant for up to 24 hours by default. This value is known as the Time to Live (TTL).

Scan for Software Updates Compliance Types

The client will scan for software updates compliance using an online or offline scan and a forced or non-forced scan, depending on the way the scan for software updates compliance is initiated. The following table describes which methods for initiating the scan are online or offline and whether the scan is forced or non-forced.

Scan Method | Scan Type | Description
Scan schedule | Non-forced online scan | At the configured scan schedule, the client will connect to WSUS running on the active software update point to retrieve the software updates metadata only when the last scan was outside of the TTL.
Software Updates Scan Cycle Software Updates Deployment Evaluation Cycle | Forced online scan | The client computer always connects to WSUS running on the active software update point to retrieve the software updates metadata prior to scanning for software updates compliance. After the scan completes, the TTL counter is reset. For example, if the TTL is 24 hours, after a user initiates a scan for software updates compliance, the TTL is reset to 24 hours.
Deployment reevaluation schedule | Non-forced online scan | At the configured deployment reevaluation schedule, the client will connect to WSUS running on the active software update point to retrieve the software updates metadata only when the last scan was outside of the TTL.
Prior to downloading update files | Non-forced online scan | Prior to downloading update files in mandatory deployments, the client will connect to WSUS running on the active software update point to retrieve the software updates metadata only when the last scan was outside of the TTL.
Prior to update installation | Non-forced online scan | Prior to installing software updates in mandatory deployments, the client will connect to WSUS running on the active software update point to retrieve the software updates metadata only when the last scan was outside of the TTL.
After update installation | Forced offline scan | After a software update has been installed, a scan is initiated using the local metadata. The client will never connect to WSUS running on the active software update point to retrieve software updates metadata.
After system restart | Forced offline scan | After a software update has been installed and the computer has been restarted, a scan is initiated using the local metadata. The client will never connect to WSUS running on the active software update point to retrieve software updates metadata.

See Also

Concepts

About the Software Updates Process
Planning for Software Updates Client Settings

Other Resources

Overview of Software Updates


About Update Lists in Software Updates

An update list in Configuration Manager 2007 contains a set of software updates. Using the update list provides several benefits when deploying and monitoring software updates and is, therefore, part of the recommended software updates workflow. The update lists are displayed in System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Lists. The software updates contained in each update list are displayed by selecting an update list in the Update Lists console tree node. For more information, see Update Lists Home Page.

The following sections provide information about using update lists, how an update list can be used for delegated administration, and how using update lists for deploying software updates provides a better reporting experience for retrieving the compliance state for software updates.

Creating an Update List

You create an update list by selecting one or more software updates, and then initiating the Update List action to open the Update List Wizard. You must have Create rights on the Configuration items class to create an update list. For the step-by-step procedures for creating an update list, see How to Create an Update List.

Adding Software Updates to an Update List

Software updates are added to an update list by using the Update List Wizard. Software updates are selected in the Configuration Manager console and the Update List action is used to open the wizard. You can add the software updates to an existing update list or create a new one. You must have Modify rights on the Configuration items class to add software updates to an update list. For more information about how to add software updates to an update list, see How to Add Software Updates to an Update List.

Delegated Administration

Using an update list provides the ability to delegate the administration for approving and deploying software updates. For example, an administrator at the central site can select the software updates that need to be deployed and add the updates to an update list. Administrators at child sites, with restricted object rights, can then use the update list and deploy the updates in the update list to an appropriate collection.

The following table provides the minimum object class rights for an administrator at a child site when the update list, deployment template, and collection have been created, and when the software updates have been downloaded to a deployment package:

ConfigMgr Object | Read | Distribute | Create | Advertise
Collection | * |  |  | *
Configuration Items | * | * |  |
Deployment | * |  | * |
Deployment Package | * | * |  |
Deployment Template | * |  |  |
Site | * |  |  |

Example Deployment Scenario

The Configuration Manager administrator at the central site reviews software updates on a monthly basis for her phased deployment scenario. The administrator has several deployment templates that she has created for her typical deployment scenarios. She adds the software updates to the update list and chooses to download the updates as part of the Update List Wizard. She creates a user group for her child site administrators, gives the user group the rights from the table above, and adds the child site administrators to the user group. She then instructs the Configuration Manager administrators at child sites to deploy the update list, using a specific deployment template, to all of the client computers at their sites.

The child site administrator expands the Deployment Templates console tree node, expands the Update Lists console tree node, and then drags the appropriate update list to the appropriate deployment template. The child site administrator selects an appropriate target collection, specifies the deployment schedule, and specifies whether to enable NAP evaluation.

Using an Update List to Deploy Software Updates

The update list is used to open the Deploy Software Updates Wizard to create software update deployments for the updates that are contained within the update list. This provides an easy method for creating multiple deployments for the same set of software updates without having to manually select the updates each time the deployment is created. Update lists can also be used to add software updates to an existing deployment.

The following methods open the Deploy Software Updates Wizard to create a new deployment for the software updates in the update list:

  • Right-click the update list, and click Deploy Software Updates.
  • Drag the update list to an existing deployment template.

The following method opens the Deploy Software Updates Wizard and adds the software updates in the update list to an existing deployment:

  • Drag the update list to an existing deployment.

Using Update Lists to Track Deployment State

Tracking the compliance state for the software updates in deployments is an important task for Configuration Manager administrators. When deployments are created without using update lists, it is very difficult to get the overall compliance state for the same set of software updates that have been deployed using multiple deployments. When update lists are used to create the deployments, you can run the Compliance 1 - Update list overall report to get the overall compliance for the set of software updates in the update list. You can also run the Compliance 3 - Update list (per update) report to get a list of the software updates in the update list and the overall compliance for each update. These reports provide another reason to use update lists as part of the normal software updates administrator workflow.

See Also

Tasks

How to Add Software Updates to an Update List
How to Create an Update List
How to Deploy Software Updates Using an Update List

Reference

Update Lists Home Page

Concepts

About the Update List Wizard
About Software Updates Reports

Other Resources

Update List Wizard


About Deployment Templates in Software Updates

Deployment templates in Configuration Manager 2007 store many of the software update deployment properties, and they can be created for consistency and to save time when creating deployments. Templates are created prior to deploying software updates by running the Deployment Template Wizard, and they are configured with the following deployment properties:

Setting | Description
Collection | Specifies the collection that will be targeted for the software update deployment. This setting is optional when creating a deployment template.
Display/Time Settings | Specifies whether the user will be notified of pending software updates, the installation progress for software updates, whether a client evaluates the deployment schedule based on local or Coordinated Universal Time (UTC), and the default duration between software update availability and mandatory installation on clients.
Restart Settings | Specifies the system restart behavior when a software update installs on a client and requires a restart to complete.
Event Generation | Specifies whether Microsoft Operation Manager alerts are disabled while the software updates install and whether an Operation Manager alert is created when a software update installation fails.
Download Settings | Specifies how clients will interact with distribution points when they receive a software update deployment.
SMS 2003 Settings | Specifies whether to deploy software updates to SMS 2003 clients that are in the target collection.

The deployment properties can also be saved to a deployment template when creating a deployment in the Deploy Software Updates Wizard. This allows the template to be used in future deployments.

Strategy for Using Deployment Templates

Deployment templates store many of the deployment properties that might not change from deployment to deployment, and they can save a lot of time for administrators when creating software update deployments. Templates can be created for different deployment scenarios in your environment. For example, you can create a template for expedited software update deployments and planned deployments. The template for the expedited deployment can suppress display notifications on client computers, set the deadline for 0 days from the deployment schedule, and allow system restarts outside of maintenance windows. The template for a planned deployment can allow display notifications on client computers and set the deadline for 14 days from the deployment schedule.

Pre-creating deployment templates for typical deployment scenarios in your environment allows you to create deployments using templates that populate many of the deployment properties that are most often static for the particular deployment scenario. Using the deployment template also reduces the number of wizard pages in the Deploy Software Updates Wizard by up to seven pages, which saves time and helps to prevent mistakes when configuring the deployment.

Configuring a Collection in a Deployment Template

The collection setting in a deployment template is optional. Depending on your deployment strategy, you might want to leave the collection setting blank. When there are a lot of collections in your environment that will be used for deploying software updates, you might want to leave the collection setting blank and configure the collection when creating the deployment. When there are a few collections, configuring the collection in the template might be desired.

Using Deployment Templates

The configured deployment properties that are defined in a deployment template are used when creating a deployment. An update list or individually selected software updates can be dragged-and-dropped onto an existing template to open the Deploy Software Updates Wizard, or an existing template can be selected when in the wizard.

Drag-and-Drop to a Deployment Template

To start the Deploy Software Updates Wizard using a deployment template, you can select either the update list that contains the software updates to deploy or the individual software updates, and then drag-and-drop the update list to an existing deployment template. This starts the Deploy Software Updates Wizard using the configured deployment properties from the template.

Note
When starting the Deploy Software Updates Wizard using this method, the properties configured in the template are not displayed in the wizard and cannot be modified while creating the deployment. These properties can be modified after creating the deployment by going to the properties for the deployment.

Selecting a Template from the Deploy Software Updates Wizard

To use a deployment template when creating a deployment, navigate to the Deploy Software Updates Wizard: Deployment Template Page of the Deploy Software Updates Wizard and select from a list of previously created deployment templates. The deployment properties contained in the highlighted template are displayed in the Results pane. When an existing template is selected, the deployment properties configured in the template are used and the associated wizard pages are not displayed.

Templates that Specify SMS 2003 Settings

When deployment templates are created with the Deploy software updates to SMS 2003 clients setting enabled, the template will be available on the Deployment Template page of the Deploy Software Updates Wizard only when all software updates can be deployed to SMS 2003 clients. For example, if the software updates that are being deployed all have a value of Yes for the Deployable to SMS2003 setting, the Deploy Software Updates Wizard will show all templates regardless of configured SMS 2003 settings. If the software updates that are being deployed have a value of No for the Deployable to SMS 2003 setting, the Deploy Software Updates Wizard will not show templates that have the SMS 2003 settings configured.

See Also

Tasks

How to Deploy Software Updates

Concepts

About the Deploy Software Updates Wizard
About Software Update Deployments
About Update Lists in Software Updates
Deploy Software Updates Wizard: Deployment Template Page

Other Resources

Deployment Template Wizard


About Software Update Deployment Packages

The deployment package is the vehicle used to download software updates to a network shared folder and copy the software update source file to distribution points defined in the deployment. Software updates can be downloaded and added to deployment packages prior to deploying them by using the Download Updates Wizard. This wizard provides administrators with the ability to provision software updates on distribution points and verify that this part of the deployment process was successful.

When downloaded software updates are deployed using the Deploy Software Updates Wizard, the deployment automatically uses the deployment package that contains each software update. When software updates that haven't been downloaded are deployed, a new or existing deployment package must be specified in the Deploy Software Updates Wizard and the updates are downloaded to the package when the wizard completes.

Important
The shared folder for the deployment package source files must be manually created prior to specifying it in the wizard. Each deployment package must use a different shared folder.

Important
The SMS Provider computer account and the user who will actually download the software updates both require write access to the package source. Restrict access to the package source to reduce the risk of attackers tampering with the software updates source files in the package source.

When a new deployment package is first created, the content version is set to 1 before any software updates are downloaded. When the software update files are downloaded to the package, the content version is incremented to 2. Because of this all new deployment packages will start with a content version of 2. Each time the content changes in a deployment package, the content version is incremented by 1.

Deployment Packages Are Not Linked to Deployments

There is no hard link between a deployment and deployment package. Clients install software updates in a deployment by using any distribution point that has the software updates available, regardless of the deployment package. Even if a deployment package is deleted for an active deployment, clients are still able to install the software updates in the deployment as long as each update has been downloaded to at least one other deployment package and available on a distribution point accessible from the client. When the last deployment package that contains a software update is deleted, client computers will not be able to retrieve the update until the software update is downloaded again to a deployment package.Software updates display with a red arrow in the Configuration Manager console when the update files are not in any deployment packages. Deployments display with a double red arrow if they contain any updates in this condition. The Deployments Containing Deleted Software Updates section below provides more information.

Deployment Package Access Accounts

Deployment Package access accounts enable you to set permissions to specify users and user groups that can access a deployment package folder on distribution points. By default, Configuration Manager 2007 makes these folders available to all users. If deployment packages contain sensitive data or should otherwise have restricted access, you can configure deployment package access accounts to limit access to specific users and user groups.

For each account, you specify the permissions that users and user groups can have. The following table lists the permissions that can be specified.

Permission Description

No Access

Prevents the account from reading, writing, or deleting files on the shared folder for the deployment package.

Read

Enables the account to view and copy files, run programs, change folders within the shared folder, and read extended attributes of files.

By default, Configuration Manager grants the Users and Guests generic accounts Read permission to the shared folder for the deployment package on distribution points.

Change

Enables the account to change the contents and extended attributes of files and to delete files. Change permission is required for applications that need to write information back to the shared package folder on the distribution point.

Full Control

Enables the account to write the contents and extended attributes of files, and to delete files.

By default, the Administrators generic account has Full Control permission so that the Configuration Manager 2007 components can access the deployment package data.

The generic deployment package access accounts (Users, Guests, and Administrators) are mapped to operating system-specific accounts, and the appropriate rights on each operating system are applied to the deployment package folder on the distribution point.

Important
If you remove the Administrators default account, Configuration Manager 2007 components cannot update and modify the deployment package data.

Important
In some cases, removing the Users group as a package access account might cause deployment to fail. If the distribution point is in a native mode site, you must add IUSR_<computername> as a package access account with the permissions required to access to the package.

If a client computer does not have sufficient rights to the deployment package folder, the software update will fail to install.

Deployment Package Distribution Points

Configuration Manager 2007 uses distribution points to store the files needed to deploy software updates to client computers. To run a software update installation, client computers must have access to at least one distribution point that contains the update. Therefore, you should specify for each deployment package a group of distribution points that can be accessed by all targeted clients.

You can have multiple distribution points in each site. By default, the site server is the only site system used as a distribution point. To reduce the load on the site server, additional distribution points should be configured at each site. For more information, see About Distribution Points.

Selective Download

Configuration Manager 2007 client computers identify which targeted software updates are applicable and retrieve only the files for required updates from the deployment package contents that might contain both required and not required software updates. This allows administrators to have multiple software updates in a single deployment package and use the package in deployments that target client computers that need only a subset of the deployment package contents. As a best practice, it is recommended that less than 500 software updates are added to a single deployment package.

Important
Selective download is not available on SMS 2003 clients. These clients download the entire deployment package contents regardless of how many software updates are applicable in the package. When creating SMS 2003 deployments, it is recommended that you use deployment packages containing only the applicable software updates for the client. Otherwise, unnecessary hard drive space is used on the clients. Alternatively, SMS 2003 clients can be configured to install software updates directly from the distribution point (run from network).

Removing Updates from a Deployment Package

Before removing software updates from a deployment package, you should verify that the update is not part of an active software update deployment or that the update has been downloaded to a different deployment package. When the last deployment package that contains a software update is deleted, client computers will no longer be able to retrieve the update until the software update is downloaded again to a deployment package.

When deleting a software update from a deployment package, the Delete Updates dialog box appears to allow you to cancel the process or confirm it and choose whether to remove the update file from the distribution points configured for the package. If the software update is in an active deployment and no other deployment packages contain the update, the Software Update Deployment Deletion Confirmation dialog box is displayed. When a NAP enabled software update is deleted from a deployment package and no other deployment packages contain the update, a warning dialog box is displayed. For the step-by-step procedure, see How to Delete a Software Update from a Deployment Package.

When software updates are removed from a deployment package, the software update no longer displays in the \Deployment Packages\<package name>\Software Updates console tree node, the Downloaded property for the software updates displays as "No" if the update is not downloaded to another package, and the update file is removed from the deployment package source.

Deployments Containing Deleted Software Updates

When a software update is being removed from a deployment package, the update is not in any other packages at the site, and the update is in an active deployment, client computers will not be able to install the software update. Also, the icon for the software update in the Configuration Manager console displays a red arrow and the icon for the deployment that contains a software update that is missing content displays a red double arrow. For a list of the icons used by software updates, see Icon Glossary for Software Updates.

Deleting a NAP Enabled Software Update from a Deployment Package

When a software update is being removed from a deployment package, the update is not in any other packages at the site, and NAP evaluation has been enabled for the software update, a warning appears with a confirmation to delete the software update, and if accepted the NAP policy is deleted from the NAP Policies console tree node, and then the NAP policy is tombstoned from the site server database.

Checking for Deployment Package Status

The Package Status console tree node in Configuration Manager 2007 displays summary information about each package for each site to which the package is targeted. The Package Status node displays under each deployment package and provides information about the specific package or under the System Status console tree node where is displays all packages and deployment packages together. This allows you to easily verify that a deployment package has been successfully provisioned on distribution points.

See Also

Reference

Software Updates Package Status Home Page

Concepts

About Distribution Points
About Software Update Deployments
Icon Glossary for Software Updates
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Download Updates Wizard


About Software Update Deployments

Software updates are delivered to client computers in Configuration Manager 2007 by creating software update deployments. The Deploy Software Updates Wizard is used to create deployments and can be started by using several different methods. For more information about running the Deploy Software Updates Wizard, see How to Deploy Software Updates.

Software Update Deployment Settings

When creating a software update deployment, the following settings are configured:

Setting | Description
General | Specifies the name and description of the deployment.
* Collection | Specifies the collection that will be targeted for the software update deployment.
* Display/Time Settings | Specifies whether the user will be notified of pending software updates, the installation progress for software updates, whether a client evaluates the deployment schedule based on local or Coordinated Universal Time (UTC), and the default duration between software update availability and mandatory installation on clients.
* Restart Settings | Specifies the system restart behavior when a software update installs on a client and requires a restart to complete.
* Event Generation | Specifies whether Microsoft Operation Manager alerts are disabled while the software updates install and whether an Operation Manager alert is created when a software update installation fails.
* Download Settings | Specifies how clients will interact with distribution points when they receive a software update deployment.
* SMS 2003 Settings | Specifies whether to deploy software updates to SMS 2003 clients that are in the target collection.
Deployment Package | Specifies the deployment package that will be used to host the software updates in the deployment. This setting is not available when all software updates in the deployment have already been downloaded to a package.
Download Location | Specifies whether the software updates in the deployment are downloaded from the Internet or from the local network.
Language Selection | Specifies the languages for which the software updates in the deployment are downloaded.
Deployment Schedule | Specifies the schedule for when a software update deployment becomes active, when software update installation is enforced on clients, whether to enable Wake On LAN, and whether to ignore maintenance windows when installing updates.
NAP Evaluation | Specifies whether the software updates in this deployment will be included in a Network Access Protection (NAP) evaluation.

An asterisk (*) denotes the deployment properties that can be stored in a deployment template. An existing deployment template can be selected at the start of the wizard to automatically populate these properties. If a deployment template is not used when creating a deployment, the properties are manually entered and can optionally be saved as a deployment template within the wizard and used in future deployments. For more information, see About Deployment Templates in Software Updates.

Deployment Package Setting

The deployment package properties are not displayed when all software updates in the deployment have previously been downloaded and copied to a package shared folder on the distribution point. When previously downloaded, the deployment is automatically configured to use the package that hosts the downloaded software updates. When there are multiple software updates in a deployment and at least one software update has not been downloaded, a deployment package must be specified. Any software updates already downloaded to the deployment package will not be downloaded again, but just verified that they are in the package.

Deployment Deadline

When creating a software update deployment in the Deploy Software Updates Wizard, the Deployment Schedule page allows a deployment deadline date and time to be configured. Deployment deadlines can also be configured from the Deployment Schedule tab in the properties for the deployment.

Setting a deadline makes the deployment mandatory, and it enforces the software update installation on client computers by the configured date and time. If the deadline is reached and the software update deployment has not yet run on the client computer, the installation starts automatically whether or not a user is logged on to the computer. A system restart can be enforced if it is necessary for the software update installation to complete.

On client computers, display notifications will appear that inform the user that one or more software updates are ready to install and the date for the earliest deadline time displays. For example, if there are two deployments with deadlines that are two days apart, the deployment deadline that comes first displays in the notifications to users. Once the software updates have been installed for the deployment with the earliest deadline, the client computer will continue to receive notifications, but the deadline will now display the deadline for the second deployment.

In SMS 2003, deadlines were set to occur x days after the client received the policy to install the software updates. Deployment deadlines have been simplified in Configuration Manager 2007 and are now configured for an explicit date and time. SMS 2003 clients in the Configuration Manager hierarchy will also use the configured deadline date and time for deployments targeted to them.

NAP Evaluation Setting

The NAP evaluation page of the Deploy Software Updates Wizard does not display unless NAP is configured for the site. For more information, see About Network Access Protection in Configuration Manager Hierarchies.

License Terms for Software Updates

When a software update has an associated Microsoft Software License Terms and the License Terms has not yet been accepted, the Review/Accept License Terms Dialog Box displays before opening the Deploy Software Updates Wizard. Once the License Terms for a software update has been accepted, the wizard opens and the software updates can be deployed. Future deployments for the software update will not require license terms acceptance. When the license terms are declined, the process is cancelled.

Software Update Deployment Process

The compliance assessment data is used to determine which software updates are required on client computers. When you are creating a software update deployment in the Deploy Software Updates Wizard, the software updates in the deployment are downloaded from the location specified on the Download Location page of the wizard to the configured package source, if not previously downloaded. When the wizard completes, a deployment assignment policy is added to the machine policy for the site. The software updates are then copied from the package source to the configured shared folders on the distribution points defined in the package, where they are available for client computers.

When a client computer in the target collection for the deployment receives the machine policy, a software update client component initiates an evaluation scan. Software updates that are still required on the client are added to a class in Windows Management Instrumentation. The software updates in mandatory deployments are downloaded as soon as possible from the distribution point to the local cache on the client computer. The software updates in optional deployments are not downloaded until installation is manually initiated. If a deadline is added to an optional deployment, making it a mandatory deployment, client computers will download the software updates in the deployment as soon as they are made aware of the change.

Note
In Configuration Manager 2007, software updates are always downloaded to the local cache and then installed. Systems Management Server 2003 clients have an option to run the software updates installation directly from a distribution point.

If the client is unable to retrieve the location for the distribution point through Location Services, the client will retry for up to five days before failing. If the client is unable to connect to the distribution point to download the content or the download fails, the client will retry for up to 10 days before failing. When updates are manually initiated, the client retry intervals are 1 hour per distribution point with a four-hour maximum before the request fails.

When software updates that have a configured deadline become available on a client computer, the Available Software Updates icon appears in the notification area that informs the user of the pending deadline. Display notifications are presented on a periodic basis until all pending mandatory software update installations have completed. By default, they are displayed every three hours for deadlines more than 24 hours away, every hour for deadlines less than 24 hours away, and every 15 minutes for deadlines that are less than one hour away. For more information about the display notification settings, see Computer Client Agent: Reminders Tab.

Note
There is a site-wide setting available that hides deployments from client computers. If this setting is enabled, display notifications, notification area icons, and software update installation progress dialog boxes are not displayed. Only software updates from mandatory deployments can be run on client computers. For more information, see How to Hide Deployments on Client Computers.

Unless deployments are configured to be hidden, users can open the Express/Advanced dialog box to initiate installation for all mandatory software updates. Or they can open the Available Software Updates dialog box, where they can choose to install either mandatory or optional software updates.

When the configured deadline passes on mandatory software updates, a scan is initiated to verify that the software update is still required, the local cache on the client computer is checked to verify that the software update source file is still available, and then the software update installation is initiated. When the installation completes, it is verified that the software update is no longer required and a state message is sent to the management point that indicates that the update is now installed.

Note
State messages for deployments are replicated up the hierarchy to the site where the deployment was created. State messages for software updates are replicated to the site that synchronized with Microsoft Update, typically the central site. Reports run from a site higher in the hierarchy will not display information for the state messages that were replicated to a lower-level site.

Required System Restart

By default, when software updates from a mandatory deployment have installed on a client computer but a system restart is required for the installation to complete, the system restart will be initiated. For software updates that have been installed prior to the deadline, the automatic system restart will be postponed until the deadline, unless the computer is restarted prior to that for some other reason.

The system restart can be suppressed for servers and workstations. These settings are configured in the Restart Settings page of the Deploy Software Updates Wizard when creating a deployment and in the Restart Settings tab in the deployment properties. This setting can also be configured in a deployment template.

Deployment Reevaluation Cycle

Client computers initiate a deployment reevaluation cycle every 7 days, by default. During this evaluation cycle, the client computer scans for software updates that have been previously deployed and installed. If any are missing, the software updates are reinstalled from the local cache. If a software update is no longer available in the local cache, it is downloaded from a distribution point and then installed. The reevaluation cycle is configured on the Deployment Re-Evaluation tab of the Software Updates Client Agent Properties page. For more information, see Software Updates Client Agent Properties: Deployment Re-Evaluation Tab.

Deployment Packages

Deployment packages are not hard-linked to deployments. When client computers receive a new deployment, they will use the software update source files from any distribution point that has them, even from a deployment package and distribution point that was not configured in the deployment. For more information, see About Software Update Deployment Packages.

Managing Deployment Collections

When you are creating a deployment in the Deploy Software Updates Wizard, the software updates are deployed to the members of the specified target collection. Prior to creating a new deployment, you might want to create a new collection that contains client computers that require particular software updates. For more information about creating collections, see How to Create a Collection.

Caution
When a collection that is used in a deployment is deleted, the software update deployment is deleted as well. Do not delete collections that are used in active deployments.

See Also

Tasks

How to Create a Collection
How to Deploy Software Updates
How to Hide Deployments on Client Computers

Reference

Computer Client Agent: Reminders Tab
Deployment Name Properties: Restart Settings Tab
Review/Accept License Terms Dialog Box
Software Updates Client Agent Properties: Deployment Re-Evaluation Tab

Concepts

About Software Update Deployment Packages
About Deployment Templates in Software Updates
About Network Access Protection in Configuration Manager Hierarchies
Icon Glossary for Software Updates
Planning for a Software Update Deployment

Other Resources

Deployment Name Properties


About Software Updates Reports

Topic last updated -- August 2007

There are six software updates report categories, each with available reports that retrieve data used to accomplish a variety of objectives. This section lists each of the software updates reports by category and provides a brief description for each.

Note
Expired software updates are considered "not required" for reporting purposes.

Software Updates - A. Compliance

The reports in the Software Updates - A. Compliance category provide the scan results for software update compliance on client computers. More specifically, these reports provide information about what software updates are required, installed, or not required on clients. The following software updates reports are in this category:

  • Compliance 1 - Overall Compliance
    This report returns the overall compliance for the set of software updates in a specific update list and collection. The Collection ID and Update List ID are required parameters. You can drill into report "Compliance 8 - Computers in a specific compliance state for an update list <secondary>" to view the computers in the compliance state.
  • Compliance 2 - Specific software update
    This report returns the overall compliance data for a specified software update. The Collection ID and Update Title, Bulletin ID, or Article ID are required parameters. You can drill into report "Compliance 7 - Specific software update states <secondary>" to view the count and percentage of computers in each state for the update.
  • Compliance 3 - Update list (per update)
    This report returns the overall compliance data for software updates defined in an Update List. The Update List ID and Collection ID parameters are required. You can drill into report "Compliance 7 - Specific software update states <secondary>" to view the count and percentage of computers in each state for the update.
  • Compliance 4 - Deployment (per update)
    This report returns the overall compliance data for software updates defined in a deployment. The Deployment ID and Collection ID parameters are required. You can drill into report "Compliance 7 - Specific software update states <secondary>" to view the count and percentage of computers in each state for the update.
  • Compliance 5 -Updates by vendor/month/year
    This report returns the compliance data for software updates released by a vendor during a specific month and year. The Collection ID, Vendor, and Year parameters are required. To limit the amount of information returned, you can filter on the Update Class, Product, or Month parameters. You can drill into report "Compliance 7 - Specific software update states <secondary>" to view the count and percentage of computers in each state for the update.
  • Compliance 6 - Specific computer
    This report returns the software update compliance data for a specific computer. The Computer Name parameter is required. To limit the amount of information returned, you can filter on the Vendor and Update Class parameters.
  • Compliance 7 - Specific software update states <secondary>
    This report returns the count and percentage of computers in each compliance state for the specified software update. For best results, start with a compliance 2 - 5 report, and then drill into this report to return the count of computers in each compliance state. You can drill into report "Compliance 9 - Computers in a specific compliance state for an update <secondary>" to view the computers in the specific state for the update.
  • Compliance 8 - Computers in a specific compliance state for an update list <secondary>
    This report returns all computers that have a specific compliance state for the set of software updates in an update list. For best results, start with "Compliance 1 - Overall Compliance" to return the count of computers in each compliance state, and then drill into this report to return the computers in the selected compliance state. You can drill into report "Compliance 6 - Specific computer" to view the compliance data for the computer.
  • Compliance 9 - Computers in a specific compliance state for an update
    This report returns all computers in a specific compliance state for a software update. For best results, start with a compliance 2 - 5 report, drill into "Compliance 7 - Specific software update states <secondary>" to return the count of computers in each compliance state, and then drill into this report to return the computers in the selected compliance state. You can drill into report "Compliance 6 - Specific computer" to view the compliance data for the computer.

Software Updates - B. Deployment Management

The reports in the Software Updates - B. Deployment Management category provide information about the software update deployments. The following software updates reports are in this category:

  • Management 1 - Updates required but not deployed
    This report returns all vendor-specific software updates that have been detected as required on clients but that have not been deployed to a specific collection. The Collection ID and Vendor parameters are required. To limit the amount of information returned, you can specify the software update class.
  • Management 2 - Updates in a deployment
    This report returns the software updates that are contained in a specific deployment. The Deployment ID parameter is required. For each software update, you can drill down to report "States 5 - States for an update in a deployment <secondary>" to view the states for the specific software update.
  • Management 3 - Deployments that target a collection
    This report returns the deployments that have targeted a specific collection. The Collection ID parameter is required. You can drill down to report "Management 2 - Updates in a deployment" to view the software updates in the selected deployment.
  • Management 4 - Deployments that target a computer
    This report returns the deployments that have targeted a specific computer. The Computer Name parameter is required. You can drill down to report "Management 2 - Updates in a deployment" to view the software updates in the selected deployment.
  • Management 5 - Deployments that contain a specific update
    This report returns the deployments that contain a specific software update. The Update parameter is required. You can drill down to report "Management 2 - Updates in a deployment" to view the software updates in the selected deployment.
  • Management 6 - Deployments that contain an update list
    This report returns the deployments that were created using a specific update list. The Update List ID parameter is required. You can drill down to report "Management 2 - Updates in a deployment" to view the software updates in the selected deployment.
  • Management 7 - Updates in a deployment missing content
    This report returns the software updates in a specified deployment that do not have all the associated content retrieved, preventing clients from installing the update and achieving 100% compliance for the deployment. The Deployment ID parameter is required. You can drill down to report "Management 8 - Computers missing content <secondary>" to view the computers that require the software update files.
  • Management 8 - Computers missing content <secondary>
    This report returns all computers that require a specific software update contained in a specific deployment that is not provisioned on a distribution point. For best results, start with "Management 7 - Updates in a deployment missing content" to return all software updates in the deployment that do not have all the associated content retrieved, and then drill into this report to return all computers that require the software update.

Software Updates - C. Deployment States

The reports in the Software Updates - C. Deployment States category provide information about the evaluation and enforcement states on client computers for software update deployments. The following software updates reports are in this category:

  • States 1 - Enforcement states for a deployment
    This report returns the enforcement states for a specific software update deployment, which is typically the second phase of a deployment assessment. For the overall progress of the software update installation, use this report in conjunction with "States 2 - Evaluation states for a deployment." The Deployment ID parameter is required. You can drill down to report "States 4 - Computers in a specific state for a deployment <secondary>" to view all computers in the state.
  • States 2 - Evaluation states for a deployment
    This report returns the evaluation state for a specific software update deployment, which is typically the first phase of a deployment assessment. For the overall progress of the software update installation, use this report in conjunction with "States 1 - Enforcement states for a deployment." The Deployment ID parameter is required. You can drill down to report "States 4 - Computers in a specific state for a deployment <secondary>" to view all computers in the state.
  • States 3 - States for a deployment and computer
    This report returns the states for all software updates in the specified deployment for a specified computer. The Deployment ID and Computer Name parameters are required. You can drill into the Status Message Details page for any software update that contains an Error Record ID value.
  • States 4 - Computers in a specific state for a deployment <secondary>
    This report returns all computers in a specific state for a software update deployment. For best results, start with "States 1 - Enforcement states for a deployment " or "States 2 - Evaluation states for a deployment" to identify the states for the deployment, and then drill into this report to return all computers in the specific state. You can drill down to report "States 7 - Error status messages for a computer <secondary>" to view the status messages for the computer.
  • States 5 - States for an update in a deployment <secondary>
    This report returns a summary of states for a specific software update targeted by a specific deployment. For best results, start with "Management 2 - Updates in a deployment" to return the software updates contained in a specific deployment, and then drill into this report to return the state for the selected software update. You can drill down to report "States 6 - Computers in a specific enforcement state for an update <secondary>" to list the computers in the state.
  • States 6 - Computers in a specific enforcement state for an update <secondary>
    This report returns all computers in a specific enforcement state for a specific software update. For best results, start with " Management 2 - Updates in a deployment" to return the software updates contained in a specific deployment, drill into "States 5 - States for an update in a deployment <secondary>" to return the states for the selected software update, and then drill into this report to return all computers in the selected state.
  • States 7 - Error status messages for a computer <secondary>
    This report returns all status messages for a given Update or Deployment on a specific computer for a given status message. For best results, start with "States 1 - Enforcement states for a deployment" or "States 2 - Evaluation states for a deployment" to identify the states for the deployment, drill into "States 4 - Computers in a specific state for a deployment <secondary>" to return all computers in the specific state, and then drill into this report.

Software Updates - D. Scan

The reports in the Software Updates - D. Scan category provide information about computers in a specific scan state.

Note
Scan reports do not contain any information from clients that have not submitted any scan status. To see client computers that have not submitted scan status, see the report States 2 - Evaluation states for a deployment.

Note
If an SMS 2003 client sends scan results through hardware inventory, the client will appear as an SMS 2003 client in a separate section of these reports. To see the detail information about scan status for these SMS 2003 clients, go to the Software Distribution - Advertisement report category and check run a report that will show the status of the advertisement you use for your Inventory Tool for Microsoft Updates scanning.

The following software updates reports are in this category:

  • Scan 1 - Last scan states by collection
    This report returns the count of computers in each of the compliance scan states returned by client computers in a specific collection during their last scan for software updates compliance. The Update Source ID and Collection ID parameters are required. You can drill down to report "Scan 3 - Clients of a collection reporting a specific state <secondary>" to view the computers in a specific state.
  • Scan 2 - Last scan states by site
    This report returns the count of computers in each of the compliance scan states returned by client computers assigned to a specific site during their last scan for software updates compliance. The Update Source ID and Site Code parameters are required. You can drill down to report "Scan 4 - Clients of a site reporting a specific state <secondary>" to view the computers in a specific state.
  • Scan 3 - Clients of a collection reporting a specific state <secondary>
    This report returns the computers in a specific collection that returned a specific state during their last scan for software updates compliance. For best results, start with "Scan 1 - Last scan states by collection" to return the count of computers in each scan state, and then drill into this report. You can drill down to report "States 7 - Error status messages for a computer <secondary>" to view the status messages for the computer.
  • Scan 4 - Clients of a site reporting a specific state <secondary>
    This report returns the computers assigned to a specific site that returned a specific state during their last scan for software updates compliance. For best results, start with "Scan 2 - Last scan states by site" to return the count of computers in each scan state, and then drill into this report. You can drill down to report "States 7 - Error status messages for a computer <secondary>" to view the status messages for the computer.

Software Updates - E. Troubleshooting

The reports in the Software Updates - E. Troubleshooting category provide information about scan and deployment errors that occur on client computers. The following software updates reports are in this category:

  • Troubleshooting 1 - Scan errors
    This report returns the count of computers for each error that occurred during the last scan for software update compliance on client computers. The Update Source ID and Collection ID parameters are required. You can drill down to report "Troubleshooting 3 - Computers failing with a specific scan error <secondary>" to view a list of computers that returned the specific scan error.
  • Troubleshooting 2 - Deployment errors
    This report returns the count of computers for each deployment error that occurred on client computers. The Deployment ID parameter is required. You can drill down to report "Troubleshooting 4 - Computers failing with a specific deployment error <secondary>" to view a list of computers that returned the specific deployment error.
  • Troubleshooting 3 - Computers failing with a specific scan error <secondary>
    This report returns all computers that have returned a specific scan error. For best results, start with "Troubleshooting 1 - Scan errors" to return the count of computers for each error that occurred during the last scan for software update compliance, and then drill into this report and then drill into this report.
  • Troubleshooting 4 - Computers failing with a specific deployment error <secondary>
    This report returns all computers that have returned a specific deployment error. For best results, start with "Troubleshooting 2 - Deployment errors" to return the count of computers for each deployment, and then drill into this report.

Software Updates - F. Distribution Status

The reports in the Software Updates - F. Distribution Status category provide distribution status data for SMS 2003 clients that are targeted in a software updates deployment. The following software updates reports are in this category:

  • Distribution 1 - Advertisement Status for SMS 2003 clients
    This report lists all software distribution advertisements for the selected update. For each advertisement, it also shows the advertisement state and count of machines in that state. This report also covers additional advertisement states available for software update advertisements. The Type and Update Title, Bulletin ID, or Article ID parameters are required. You can drill down to report "Distribution 2 - SMS 2003 clients with a specific update advertisement state" to view the computers in the state.
  • Distribution 2 - SMS 2003 clients with a specific update advertisement state
    This report shows a list of computers that are in a specific state of an advertisement. This report also covers additional advertisement states available for software update advertisements. The Advertisement ID and Distribution Status parameters are required. You can limit the results by specifying a value for the Update Distribution Status parameter. You can drill down to report "Advertisement status messages for a particular client and advertisement" to shows the status messages reported for the computer and advertisement.

See Also

Other Resources

Technical Reference for Software Updates


About the Software Updates End User Experience

When software update deployments target client computers and software updates are available for installation, you can configure the end user experience for what is displayed and how software updates are received and installed.

Client Computer Machine Policy Polling Interval

When software updates are deployed to client computers, the software update deployment information is added to the Configuration Manager machine policy, and the client computer becomes aware of the deployment on the next Machine Policy Retrieval & Evaluation Cycle configured on the General tab of the Computer Client Agent Properties. The default setting is every 60 minutes.

Mandatory Software Updates

When a client receives a software update deployment policy with a configured deadline, it downloads the required software updates and stores them in the local cache. The client will run software update installation from the local cache when the deadline is reached or the installation is initiated manually from the Available Software Updates dialog box. If the software update no longer exists in the local cache at the time of install, it will be downloaded again from the distribution point and then installed.

When new software updates that have a configured deadline are available, a display notification is presented to users that informs them of the pending deadline. Display notifications are presented on a periodic basis until all pending mandatory software update installations have completed. By default, they display every 3 hours for deadlines more than 24 hours away, every hour for deadlines less than 24 hours away, and every 15 minutes for deadlines that are less than 1 hour away. For more information about the reminder settings, see Computer Client Agent: Reminders Tab.

When there is a maintenance window configured for the target collection in a mandatory deployment, the software update installation will be initiated after the deadline at the first available maintenance window. Users are not prevented from manually initiating a software update installation outside of the maintenance window from the Available Software Updates dialog box. For more information about maintenance windows, see About Maintenance Windows. For more information about planning for maintenance windows in software updates, see the "Planning for Maintenance Windows" section of Planning for Software Updates Server Settings.

Pending System Restarts

When there are software update installations that have run and require a restart for them to complete, new software updates that become available are not shown and the notification area icon will not be visible. A system restart will be forced on client computers when mandatory software updates have a pending restart and the deadline has been reached.

Optional Software Updates

When a client computer receives a software update deployment policy without an assigned deadline (optional deployment), it does not immediately download the optional software update files. The optional software updates are displayed in the Available Software Updates dialog box after the client computer receives the machine policy containing the deployment policy. When the end user manually initiates the installation for optional software updates, the update files are downloaded from a distribution point to the local cache on the client computer and then installed locally. There is an initial display notifications presented for optional software updates, but additional notification reminders do not display.

Note
When the site-wide setting is enabled to hide deployments, the end user will not be able to install optional software updates. For more information, see the "Hiding Software Update Installation from End Users" section of Planning for a Software Update Deployment.

Scheduling Software Update Installation

Mandatory software updates can be installed on client computers using a configured schedule. This provides the ability to initiate software update installation at a convenient time and install mandatory updates prior to the configured deadline. At the scheduled time, all software updates from mandatory deployments will install. The Install required updates on a schedule setting is on the Updates tab in the Configuration Manager Properties that is opened from the Control Panel on client computers.

Selecting Software Updates to Install

When new software updates are available, the user is notified by a display notification and a notification area icon. When the user double-clicks on the display notification or right-clicks on the notification area icon, a different dialog box is presented for the following conditions.

Mandatory Software Updates Are Available

If any of the available software updates are mandatory, a dialog box is presented asking the user how he or she would like to install the software updates. The user has the option to select Express Install or Custom Install.

Express Install: Opens the Required Software Updates dialog box displaying only the mandatory software updates, initiates software update installation for each update, and minimizes the dialog box that displays installation progress for each update. The user cannot initiate any action in the dialog box, and closing it will not affect the software updates installation.

Custom Install: Opens the Available Software Updates dialog box with all mandatory software updates selected and optional software updates listed but not selected. The user chooses which software updates to install. Even though the mandatory software updates are selected by default, the user has the option to deselect them and install them at a later time.

Only Optional Software Updates Are Available

If only optional software updates are available, the Available Software Updates dialog box is displayed. All available optional software updates are listed. No software updates are selected by default.

Installation Progress

During a software update installation, the Software Updates Installation Progress dialog box shows the Installation Progress for the selected updates. There are three states for software update installation:

  1. Preparing for download: The client computer is scanned to make sure the software update is still applicable.
  2. Downloading: The software update is downloaded from the distribution point to the client's local cache, if required.
  3. Installing: The software update installation is in progress. When the installation completes, a verification scan is initiated to ensure the software updates have successfully installed.

When a software update successfully installs, it no longer appears in the Available Software Updates dialog box.

Software Updates Installed Outside of Configuration Manager

When software updates that are required are installed outside of Configuration Manager, for example manually installing the software update or by using Automatic Updates, the Software Updates Client Agent will continue to show the software update as pending. During the next scan for software updates compliance on the client computer, the software update will no longer show as pending. Until the scan for software updates compliance, the software update will continue to display as pending, display notifications might appear on the client computer alerting them of a pending installation, and so on. If the end user selects to install the software update from the Available Updates dialog box, the client scans for software updates compliance before installing the update, detects that the software update is not longer required, and aborts the installation.

See Also

Tasks

How to Hide Deployments on Client Computers

Reference

Available Software Updates Dialog Box on Clients
Software Updates Installation Progress Dialog Box on Client

Concepts

About Maintenance Windows
Planning for a Software Update Deployment
Planning for Software Updates Server Settings

Other Resources

Computer Client Agent Properties


About Phased and Expedited Software Update Deployments

Typically, three operational scenarios are available for software updates in Configuration Manager 2007:

  • Phased deployment: Refers to a mandatory deployment that is created as part of a routine administrative task and usually contains software updates that are not of an urgent nature and must be installed on client computers by a configured future deadline.
  • Expedited deployment: Refers to a mandatory deployment that is created unexpectedly and usually contains software updates that fix potential vulnerabilities (zero-day exploit) and must be deployed to client computers as soon as possible.
  • Optional deployment: Refers to a deployment that contains optional software updates that might or might not be required on client computers and are not urgent in nature.

See Also

Tasks

How to Deploy Software Updates

Concepts

About Software Update Deployments
Administrator Checklist: Assessing and Deploying Software Updates
Planning for a Software Update Deployment


About the Software Updates Wizards

The software updates feature in Configuration Manager 2007 provides wizards to manage deployments and update lists, download software updates, and create deployment templates. Click any link in the following section for overview information about the software updates wizards.

In This Section

About the Deploy Software Updates Wizard

Provides information about the Deploy Software Updates Wizard, used to create software update deployments or add new updates to an existing deployment.

About the Download Updates Wizard

Provides information about the Download Updates Wizard, used to download and copy software updates to the deployment package folder on distribution points.

About the Deployment Template Wizard

Provides information about the Deployment Template Wizard, used to create a deployment template that stores many of the software update deployment properties.

About the Update List Wizard

Provides information about the Update List Wizard, used to add software updates to a new or existing update list.

See Also

Concepts

Administrator Workflow: Software Updates End to End Workflow
How to Manage Software Update Files
How to Manage Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

Administrator Checklists for Software Updates
How to Manage Software Update Deployments


About the Deploy Software Updates Wizard

The Deploy Software Updates Wizard allows you to create a deployment that deploys software updates to members of the target collection. Depending on whether the software updates have previously been downloaded, whether a deployment template is used, and whether Network Access Protection (NAP) is enabled will determine how many wizard pages appear, which processes are initiated, and what objects appear in the Configuration Manager console.

Opening the Deploy Software Updates Wizard

There are several methods that can be used to open the Deploy Software Updates Wizard.

Update List

Creating an update list that contains approved software updates is part of the recommended workflow for creating software update deployments. For more information about the benefits for using update lists, see About Update Lists in Software Updates. Use the following method to create a deployment using an update list:

To create a deployment using an update list

  1. Highlight an update list under the Update List node of the Configuration Manager console.

  2. Use one of the following methods to open the Deploy Software Updates Wizard:

    • Initiate the Deploy Software Updates action. The deployment settings are configured in the wizard.
    • Drag-and-drop the highlighted update list to a deployment template. The deployment is configured with the settings from the template, and the wizard requests information only about the collection (if not specified in the template), deployment package (if a software update in the update list is not in an existing package), download location (if a software update in the update list is not in an existing package), deployment schedule, and NAP effective date.
    • Drag-and-drop the highlighted update list to a deployment. The configured settings for the deployment are maintained, and the wizard requests information only about the deployment package (if a software update in the update list is not in an existing package), download location (if a software update in the update list is not in an existing package), deployment schedule, and NAP effective date.

Software Updates

Use the following method to create a deployment by selecting individual software updates:

To deploy selected software updates

  1. Highlight one or more software updates in the Configuration Manager console. For more information, see How to Find Software Updates in Configuration Manager.

  2. Use one of the following methods to open the Deploy Software Updates Wizard:

    • Initiate the Deploy Software Updates action. The deployment settings are configured in the wizard.
    • Drag-and-drop the highlighted software updates to a deployment template. The deployment is configured with the settings from the template, and the wizard requests information only about the collection (if not specified in the template), deployment package (if a software update is not in an existing package), download location (if a software update is not in an existing package), deployment schedule, and NAP effective date.
    • Drag-and-drop the highlighted software updates to a deployment. The configured settings for the deployment are maintained, and the wizard requests information only about the deployment package (if a software update is not in an existing package), download location (if a software update is not in an existing package), deployment schedule, and NAP effective date.

Properties Configured in the Deploy Software Updates Wizard

The following properties are defined in the Deploy Software Updates Wizard:

  • Name and Description
  • *Collection
  • *Display and time settings
  • *Restart settings
  • *Event generation
  • *Download settings
  • *SMS 2003 settings (available only when every software updates in the deployment is deployable to Systems Management Server 2003)
  • Deployment package (available only when at least one software update has not been already downloaded or when deploying to SMS 2003 clients)
  • Download location
  • Language selection
  • Deployment schedule
  • Set NAP evaluation

An asterisk (*) denotes the properties that can be automatically populated either by dragging and dropping selected software updates, or an update list, to a template or by selecting a template on the Deployment Template page of the wizard. If a template is not used when creating a deployment, the properties are manually entered and can be optionally saved as a deployment template on the Create Template page of the wizard and used in future deployments. For more information about planning for a deployment, see Planning for a Software Update Deployment. For more information about the Deploy Software Updates Wizard pages, see Deploy Software Updates Wizard.

See Also

Tasks

How to Create a Deployment Template
How to Deploy Software Updates
How to Deploy Software Updates to SMS 2003 Clients
How to Deploy Software Updates Using an Update List
How to Download Software Updates
How to Find Software Updates in Configuration Manager

Concepts

About Deployment Templates in Software Updates
About Update Lists in Software Updates
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard


About the Download Updates Wizard

The Download Updates Wizard in Configuration Manager 2007 downloads software updates to a new or existing deployment package. The software updates are downloaded from the download location specified in the wizard to the package source location, and then copied to the deployment package folder on the distribution points configured for the package. The Download Updates Wizard allows administrators to prepare, or provision, the distribution points with the software updates source files prior to deploying them. This allows the content to be copied to distribution points before creating the deployment and it enables delegated administration where you can restrict the permissions for administrators that are responsible for only deploying software updates, for example.

Opening the Download Updates Wizard

There are several methods that can be used to open the Download Updates Wizard. Use one of the methods in the following procedure to open the Download Updates Wizard and download software updates to a deployment package:

To download software updates

  • Highlight one or more software updates, and then initiate the Download Software Updates action. The highlighted software updates will be downloaded.

  • Highlight an update list under the Update List node of the Configuration Manager console, and then initiate the Download Software Updates action. The software updates contained in the update list will be downloaded.

  • When adding software updates to an update list, click Download the files associated with the selected software updates on the Update List page of the Update List Wizard to add the wizard pages from the Download Updates Wizard to the Update List Wizard. The software updates contained in the update list will be downloaded.

Properties Configured in the Download Updates Wizard

The following properties are defined in the Download Software Updates Wizard:

  • Deployment Package: Specifies the package that will be used to host the software updates in the deployment. For more information, see About Software Update Deployment Packages.
  • Distribution Points: Specifies the distribution points used to host the software update files defined in the deployment. This setting is only available when a new deployment package is created.
  • Data Access: Specifies where the deployment package is stored on distribution points and how it will be accessed. This setting is only available when a new deployment package is created.
  • Distribution Settings: Specify the sending priority and preferred sender for the deployment package when it is sent to child sites and the content settings for branch distribution points. This setting is only available when a new deployment package is created.
  • Download Location: Specifies whether the software updates in the deployment package should be downloaded from the Internet location specified in the vendor catalog or to use local copies of the software updates
  • Language Selection: Specifies the languages for which software update files are downloaded.

See Also

Tasks

How to Add Software Updates to a Deployment Package
How to Download Software Updates

Concepts

About Software Update Deployment Packages
About the Software Updates Wizards
About Update Lists in Software Updates
Administrator Workflow: Software Updates End to End Workflow
How to Manage Software Update Files
Planning for a Software Update Deployment
Update List Wizard: Update List Page

Other Resources

Administrator Checklists for Software Updates
Download Updates Wizard


About the Deployment Template Wizard

The Deployment Template Wizard allows you to create a template, which stores many of the software update deployment properties. Deployment templates can be used when creating software update deployments to ensure consistency in similar deployments and to save time. For more information, see About Deployment Templates in Software Updates.

Opening the Deployment Template Wizard

Use the following procedure to open the Deployment Template Wizard.

To open the Deployment Template Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Templates.

  2. Right-click Deployment Templates, and then click New Deployment Template.

Properties Configured in the Deployment Template Wizard

The following properties are configured in the Deployment Template Wizard and saved in a deployment template:

  • Template name and description: Specifies the name and description for the deployment template.
  • Collection: Specifies the target collection for the deployment. Members of the collection receive the software updates defined in the deployment. Templates can be created without a collection so that one deployment template can be used during a phased deployment where collections change over time.
  • Display settings: Specifies whether users are notified of pending software updates and see the update installation progress.
  • Time settings: Specifies whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.
  • Restart settings: Specifies the system restart behavior when a software update installs on a client and requires a restart to complete, and when maintenance windows are configured.
  • Event generation setting: Specifies whether to disable Microsoft Operations Manager alerts during software update installation and whether an Operation Manager alert is created when a software update installations fails.
  • Download settings: Specifies the behavior for software update installation when clients are within a "slow or unreliable" network boundary and when clients are within the boundaries of a protected distribution point that does not contain the software update.
  • SMS 2003 settings: Specifies whether to generate a special deployment for System Management Server (SMS) 2003 clients that are in the software updates target collection. When this setting is enabled, the template can only be used for software updates that are deployable to SMS 2003.

After successfully completing the Deployment Template Wizard, the new template is displayed in the Configuration Manager console at System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Templates. The Refresh action might be needed on the Deployment Templates console tree node before the new template displays.

See Also

Tasks

How to Create a Deployment Template

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Software Updates Wizards
Administrator Workflow: Software Updates End to End Workflow
Planning for a Software Update Deployment

Other Resources

Administrator Checklists for Software Updates
Deployment Template Wizard
Deployment Template Name Properties
How to Manage Software Update Deployments


About the Update List Wizard

The Update List Wizard in Configuration Manager 2007 adds software updates to a new or existing update list. Using the update list provides several benefits when deploying and monitoring software updates and is, therefore, part of the recommended software updates workflow. For more information, see About Update Lists in Software Updates.

Opening the Update List Wizard

The Update List Wizard is opened by selecting one or more software updates and initiating the Update List action. For more information about finding software updates, see How to Find Software Updates in Configuration Manager.

Properties Configured in the Update List Wizard

The following wizard pages are configurable:

  • Update List page: Specifies whether the selected software updates will be added to a new or existing update list and whether the updates are downloaded to a deployment package. When the updates are downloaded, you must specify the deployment package and download settings. For more information about these additional wizard pages, see Download Updates Wizard.
  • Security page: Specifies the class and instance security rights for the update list. This provides the ability to delegate the task of deploying software update to other administrators with restricted rights. For more information about configuring security on update lists, see About Update Lists in Software Updates.

See Also

Tasks

How to Create an Update List
How to Find Software Updates in Configuration Manager

Concepts

About the Software Updates Wizards
About the Software Updates Wizards
About Update Lists in Software Updates
How to Manage Software Updates Metadata

Other Resources

Update List Wizard


About the Inventory Tool for Microsoft Updates

The Inventory Tool for Microsoft Updates in Configuration Manager 2007 provides backward compatibility for Systems Management Server (SMS) 2003 clients to scan for software updates compliance using the Microsoft Update catalog. During the SMS 2003 site upgrade to Configuration Manager 2007, Setup detects whether a previous version of the Inventory Tool for Microsoft Updates is installed on the site and verifies that another installation of the tool is not installed on a site higher in the hierarchy. If both are true, Setup initiates an upgrade for the inventory tool on the site server. During the installation, you can specify whether to download the latest Microsoft Update catalog from the Internet or from a local location.

Note
When a site server is upgraded in silent mode (using the /UPGRADE, /HIDDEN, and /NOUSERINPUT command-line options), the Inventory Tool for Microsoft Updates Setup also runs in silent mode. During the inventory tool upgrade, Setup will automatically download the latest Microsoft Update catalog from the Internet. If the site server cannot access the Internet, the Inventory Tool for Microsoft Updates upgrade fails. For more information, see Troubleshooting Inventory Tool for Microsoft Updates Issues.

After the Inventory Tool for Microsoft Updates is upgraded on the site, the catalog is synchronized with the Microsoft Updates catalog, the new scan package is updated, and client computers upgrade the scan tool following their next Machine Policy Retrieval & Evaluation Cycle. Software updates will be scanned for compliance using the Microsoft Update catalog and will continue to work on SMS 2003 and Configuration Manager 2007 client computers.

After the site server synchronizes with the software update point and Configuration Manager client computers scan for software updates compliance, the Inventory Tool for Microsoft Updates is no longer required for Configuration Manager client computers, and it is recommended that the Microsoft Update Tool advertisement no longer targets these client computers. When all client computers in the hierarchy have been upgraded to Configuration Manager 2007, the Inventory Tool for Microsoft Updates can be removed from the site server.

Product Documentation

The Deployment Guide for the Configuration Manager Inventory Tool for Microsoft Updates is available in the help file for the tool. The help file includes introductory topics, such as overviews of features and concepts, as well as procedures and technical reference information.

You can access the help file using one of the following methods:

  • If you have not installed the Inventory Tool for Microsoft Updates yet, you can locate the file ITMU_CM07.chm under the Configuration Manager 2007 product DVD, in SMSSETUP\HELP. You can also copy the ITMU_CM07.chm file to any convenient location and run it locally, without installing the tool.
  • If you have installed the Inventory Tool for Microsoft Updates, you can access the help file in %windir%\Help.

See Also

Tasks

How to Install and Configure the Inventory Tool for Microsoft Updates
Troubleshooting Inventory Tool for Microsoft Updates Issues

Concepts

About Software Updates Synchronization
Planning for a Software Update Deployment
Planning the SMS 2003 Software Updates Upgrade


About System Center Updates Publisher

The System Center Updates Publisher has been built on the custom updates framework that was introduced in Systems Management Server 2003 R2. Updates Publisher is a stand-alone tool that enables independent software vendors or line-of-business application developers to import software update catalogs, create and modify software update definitions, export update definitions to catalogs, and publish software updates information to a configured Windows Server Update Services (WSUS) server. By using Updates Publisher to define software updates and publish them to the WSUS server, software updates in Configuration Manager 2007 is able to synchronize the custom updates from the WSUS server database to the site server database, enable client computers to scan for custom update compliance, and provide administrators the ability to deploy the custom updates to client computers.

For more information about Updates Publisher, visit the System Center Updates Publisher Web site (http://go.microsoft.com/fwlink/?LinkId=83534). The product documentation provides information that will help you to plan, deploy, operate, and troubleshoot System Center Updates Publisher.

Product Documentation

Comprehensive information about Updates Publisher is available in the Updates Publisher help file. The help file includes both introductory topics such as an overviews of features and concepts, as well as in-depth technical discussions and technical reference information.

There are several ways to access the Updates Publisher help file:

  • If you have not installed Updates Publisher yet, you can locate the file SC_UpdatesPublisher.chm under the Configuration Manager 2007 product DVD, in <DVD Drive>\SCUP. You can also copy the SC_UpdatesPublisher.chm file to any convenient location and run it locally, without installing Updates Publisher.
  • If you have installed Updates Publisher, you can access the help file in the Updates Publisher console by pressing F1, by clicking Help buttons, selecting Help from the Action menu, or by clicking some hyperlinks. After Updates Publisher is installed, the SC_UpdatesPublisher.chm file is available in %ProgramFiles%\System Center Updates Publisher\Help, by default.
  • The System Center Updates Publisher content is available on the System Center Updates Publisher Web site (http://go.microsoft.com/fwlink/?LinkId=83449).

See Also

Tasks

How to Install System Center Updates Publisher


Prerequisites for Software Updates

Before deploying software updates in Configuration Manager 2007, there are several components that must be installed and configured depending on the environment. The following table provides a list of these components, and then each is described in more detail in the following sections.

Dependencies External to Configuration Manager 2007

Dependency More Information

Windows Server Update Services (WSUS) 3.0

Software updates requires WSUS 3.0 for software updates synchronization and for the software update compliance assessment scan on clients. The WSUS server must be installed before creating the software update point site role, which uses the WSUS server as a prerequisite component. The software update point component handles synchronization requests to WSUS, inserting synchronized software updates metadata into the site server database and sending state messages to indicate the current status. Clients connect to the WSUS server when performing compliance assessment scans for software updates. The Windows Update Agent (WUA) on the client computer connects to the WSUS server to retrieve the relevant software updates metadata to perform the scan. WSUS 3.0 is available for download on the Microsoft Download Center Web site.

Note
Software updates in Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

For more information, see How to Install Windows Server Update Services 3.0

WSUS 3.0 Administration Console

The WSUS 3.0 Administration Console is required on the Configuration Manager 2007 site server when the active software update point is on a remote site system server and WSUS is not already installed on the site server. This component is required on the site server before it can communicate with the WSUS server on the remote active software update point, allowing the site server to configure the WSUS components and synchronize software updates.

Note
Configuration Manager 2007 SP1 site servers require the WSUS 3.0 SP1 Administration Console.

For more information, see How to Install the Windows Server Update Services 3.0 Administration Console

Windows Update Agent (WUA) 3.0

The WUA 3.0 client is required on clients to connect to the WSUS 3.0 server and retrieve the list of software updates that need to be scanned for compliance. When running the Configuration Manager installation, the latest version of the Windows Update Agent is downloaded, and then when the Configuration Manager client is installed the Windows Update Agent is upgraded if necessary. When the installation fails, the Windows Update Agent will need to be upgraded using another method. For more information about how to verify the Windows Update Agent on clients, see How to Check the Windows Update Agent Version on Clients.

Note
Clients computers connected to a Configuration Manager 2007 SP1 site require the WUA 3.0 SP1 client.

For more information about how to install the Windows Update Agent, see How to Install the Windows Update Agent on Client Computers.

Site server communication to the active software update point

There could be configuration settings that must be addressed depending on the software update point infrastructure and Configuration Manager 2007 site settings. For more information, see Planning for the Software Update Point Installation.

Network Load Balancing (NLB)

Each software update point can support up to 25,000 client computers when it is installed on a remote site system server and less when it is co-located with the site server. When you expect that more client computers will connect to the active software update point, WSUS and the active software update point must be configured for Network Load Balancing (NLB). For more information, see How to Configure the Active Software Update Point Component to Use an NLB Cluster.

Background Intelligent Transfer Server (BITS) 2.5

It is highly recommended that BITS 2.5 is enabled and configured for the site and also that distribution points are BITS enabled. When software updates install on client computers, the source files are first downloaded to the local cache and then installed. If BITS is enabled on the distribution point, disconnection from the network while software updates are downloading does not cause the deployment to fail because BITS resumes the download, starting where it was interrupted, the next time the client has network access. If BITS is not enabled on the distribution point and a network problem occurs while downloading software update files, the software update installation fails.

For more information about configuring a distribution point to allow client computers to transfer content using BITS, see How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS.

Windows Installer 3.1

Client computers must have Windows Installer 3.1 installed or certain software updates, such as Microsoft Office updates, will not be detected during a scan for software update compliance.

Most client computers should already have Windows Installer 3.1 installed, but if needed, it is available to download from the Microsoft Download Center Web site (http://go.microsoft.com/fwlink/?linkid=21788)

Dependencies Internal to Configuration Manager 2007

Dependency | More Information
Reporting Point Site System | The reporting point site system role must be installed before software updates Web reports can be displayed. For more information about creating a reporting point, see How to Create a Reporting Point.

See Also

Tasks

How to Check the Windows Update Agent Version on Clients
How to Create a Reporting Point
How to Install the Windows Server Update Services 3.0 Administration Console
How to Install Windows Server Update Services 3.0

Concepts

Administrator Checklist: Planning and Preparing Software Updates
Administrator Checklist: Configuring Software Updates
Administrator Workflow: Software Updates End to End Workflow

Other Resources

Administrator Checklists for Software Updates
Overview of Software Updates
Planning for Software Updates


Planning for Software Updates

Before implementing the software updates feature in the Configuration Manager 2007 site, it is highly recommended that you thoroughly review the planning content.

Click any link in the following section for overview information about software updates.

In This Section

Determine the Software Update Point Infrastructure

Provides information to help you determine what Configuration Manager sites must have an active software update point, which sites should have an active Internet-based software update point, and when a Network Load Balancing (NLB) cluster should be configured to be an active software update point.

Planning for the Software Update Point Installation

Provides information to help you plan for the software update point installation, and the several requirements that must be considered depending on your Configuration Manager infrastructure.

Planning for the Software Update Point Settings

Provides information to help you plan for the software update point settings, including the synchronization source, synchronization schedule, and the products, classifications, and languages for which software updates will be synchronized.

Planning the Test Environment for Software Updates

Provides information to help you create a test environment for software updates before implementing the feature into a production environment.

Planning the SMS 2003 Software Updates Upgrade

Provides information to help you plan for software updates when a site is upgraded from Systems Management Server (SMS) 2003 to Configuration Manager 2007.

Planning for Software Updates Client Settings

Provides information to help you plan for the software updates client agent settings, including scan and evaluation schedules, settings that affect how and when software updates are installed on client computers, and Group Policy settings that must be considered on client computers.

Planning for Software Updates Server Settings

Provides information to help you plan for the software updates server settings, including the software update point settings, settings that involve maintenance windows, and settings that are configured for each software update.

Determine What Software Updates to Deploy

Provides information to help you determine what software updates should be deployed.

Planning for a Software Update Deployment

Provides information to help you plan for a software update deployment.


Best Practices for Software Updates

Topic last updated—November 2007

This section provides best practices for software updates in Configuration Manager 2007. Review and consider the following recommendations when planning and using software updates in your environment.

Installation/Upgrade Best Practices

The following are best practices for the installation of or upgrade to Configuration Manager 2007:

  • Upgrade the Windows Update Agent on client computers in a phased software distribution before upgrading the WSUS server on the software update point.
    When Windows Server Update Services (WSUS) on the software update point is upgraded, there are scenarios, such as the self-update process, where every client computer assigned to the site will connect to the WSUS server at the same time to upgrade the Windows Update Agent (WUA). This could potentially result in high network bandwidth and performance issues on the WSUS server.
  • When Configuration Manager and WSUS use the same SQL Server, one should use a named instance and one should use the default instance of SQL Server.
    When the Configuration Manager 2007 and WSUS databases use the same SQL Server and share the same instance of SQL, it is difficult to determine the resource usage between the two applications. Using a different SQL instance for Configuration Manager 2007 and WSUS provides the ability to better troubleshoot and diagnose resource usage issues that might occur for each application.
  • Use a custom Web site during WSUS 3.0 installation.
    During the WSUS 3.0 installation, you can specify whether to use the default Internet Information Services (IIS) Web site or create a WSUS 3.0 Web site. It is recommended that you select Create a Windows Server Update Services 3.0 Web site so that IIS hosts the WSUS 3.0 services in a dedicated Web site instead of sharing the same Web site used by the other Configuration Manager 2007 site systems or other applications. When using a custom Web site for WSUS 3.0, the default port numbers are port 8530 for HTTP protocol and port 8531 for HTTPS protocol (Secure Sockets Layer, or SSL). These port settings will need to be specified when creating the active software update point for the site. For the step-by-step procedures for installing WSUS 3.0 for software updates, see How to Install Windows Server Update Services 3.0
  • Specify the Store updates locally setting during WSUS 3.0 installation.
    During the WSUS 3.0 installation, you should select Store updates locally so that any license terms associated with software updates are downloaded and stored on the local hard drive for the WSUS server during the synchronization process. When this setting is not selected, client computers might fail to scan for software updates compliance for updates that have a license terms. When the active software update point is installed, the Store updates locally setting in WSUS is automatically configured, and WSUS Synchronization Manager will verify that the setting is enabled every 60 minutes by default.

Operations Best Practices

The following are best practices for performing Configuration Manager 2007 operations:

  • Suppress display notifications for deployments that contain optional updates.
    When optional software updates are deployed to and available on a Configuration Manager 2007 client computer and the Install required updates on a schedule setting is enabled on the client computer, a display notification might appear every 3 hours that incorrectly indicates that the software update will automatically install at a specific time. Because the software update is optional, the notification is incorrect and the software update will not be automatically installed on the client computer. This issue does not occur on client computers that do not have the Install required updates on a schedule setting enabled. Specify the Suppress display notifications on clients setting on the Display/Time Settings page of the Deploy Software Updates Wizard when deploying optional software updates to client computers that have the Install required updates on a schedule setting enabled.
  • When creating test deployments, select one local distribution point and add additional distribution points when the deployment is ready.
    When a software update is added to a deployment that is configured with the Deploy software updates to SMS 2003 clients setting or when the start time setting in the deployment is modified, the package source will be updated, the deployment package version will be incremented, and the distribution points configured for the package will be updated.
    Note
    A package refresh does not occur when a software update is added to a deployment that targets only Configuration Manager 2007 client computers.

    When creating a deployment for testing, it is recommended that you configure the deployment package with a local distribution point so that the package refresh doesn't copy the update files from the deployment to all distribution points every time a new update is added or when a new start time is configured. This is especially true when the update files are large, such as service packs, when there are a large number of distribution points in your environment, or when the network bandwidth to your distribution points is limited.

Interop Best Practices

The following are best practices for the interoperability of Configuration Manager 2007 and SMS 2003:

  • Select Run update installation from distribution point when deploying software updates to SMS 2003 clients in the Deploy Software Updates Wizard.
    When creating a software update deployment that targets SMS 2003 clients, select Run update installation from distribution point on the SMS 2003 Settings page of the Deploy Software Updates Wizard. When this setting is selected, SMS 2003 clients will run the update installation from the distribution point only for required software updates. Following this practice is especially important when the deployment contains a large number of software updates, because unlike Configuration Manager 2007 client computers, which download only required software updates from a deployment, SMS 2003 clients download all software updates in the deployment regardless of whether they are required on the client.
  • Before removing the Inventory Tool for Microsoft Updates from the hierarchy, clear the Deploy software updates setting in all active deployments.
    After the Inventory Tool for Microsoft Updates is removed from the hierarchy, the software updates metadata specific to the tool will be set to an expired state. When there are active deployments that deploy software updates to SMS 2003 clients, the software updates in the deployment will display as expired but cannot be removed. The deployment will continue to work for the valid software updates, but the deployment will be displayed with a gray icon indicating that there are expired updates in the deployment.
    To prevent this issue, clear the Deploy software updates to SMS 2003 clients setting in the properties for all active deployments before removing the Inventory Tool for Microsoft Updates.
  • Download software updates before deploying software updates to SMS 2003 clients when some updates in the deployment are already downloaded.
    When creating a software update deployment that will target SMS 2003 clients and at least one software update has not yet been downloaded, all of the software updates not in the package configured for the deployment will be downloaded even when they were previously downloaded to another package. When all software updates have been downloaded prior to creating the deployment, when the downloaded updates were previously downloaded to the package selected in the deployment, or when the Deploy software updates to SMS 2003 clients setting is not selected in the deployment, the wizard downloads only the software updates that have not been previously downloaded.
    To prevent this behavior, download the software updates that have not yet been downloaded prior to creating the deployment to SMS 2003 clients by using the Download Updates Wizard or the Update List Wizard.


Determine the Software Update Point Infrastructure

Topic last updated—November 2007

The information provided in this topic can help you determine what Configuration Manager 2007 sites must have an active software update point, which sites should have an active Internet-based software update point, and when a Network Load Balancing (NLB) cluster should be configured to be the active software update point.

Active Software Update Point

The central site server is the primary site server at the top of the Configuration Manager hierarchy. An active software update point is configured on the central site so that software updates can be centrally managed and monitored. Many of the software updates synchronization settings are configured at the central site and not available at child sites, such as the synchronization schedule and languages synchronized for software updates summary information. The active software update point on the central site synchronizes with Microsoft Update.

All primary sites in the Configuration Manager hierarchy must have an active software update point. The child site synchronizes with the active software update point configured for the parent site. Secondary site servers can be configured with an active software update point, or client computers at the secondary site can connect directly to the active software update point on the parent primary site.

When the site is in native mode, the active software update point can be configured to accept connections from client computers both on the intranet and on the Internet or from only clients on the intranet. When Internet-based client computer connectivity is not accepted on the active software update point, an active Internet-based software update point can be created.

Active Internet-Based Software Update Point

When a site server is in native mode, you have an option to create an Internet-based software update point that allows connectivity from Internet-based client computers. This site system server role must be assigned to a site system server that is remote to the site server and active software update point. When there are Internet-based client computers assigned to a site and the active software update point has been configured not to accept connections from Internet-based client computers or access to the site server is not possible, you must configure an active Internet-based software update point.

Note
Internet-based software update points are supported only on site systems for primary site servers. Even though the option to install an Internet-based software update point on secondary sites is available, it will not be accessed by client computers and is not supported.

For more information about installing the Internet-based software update point, see the last four steps in Administrator Checklist: Configuring the Software Update Point in a Native Mode Site.

When the active Internet-based software update point does not have connectivity to the active software update point for the site, you must use the export and import function of the WSUSUtil tool to synchronize the software update metadata. For more information, see How to Synchronize Updates Using Export and Import.

NLB Cluster Configured as an Active Software Update Point

Using NLB provides enhanced scalability and availability for server applications. When the software update point is remote from the site server, WSUS supports up to 25,000 clients. Fewer clients are supported when installing the software update point on the site server, depending on the resources used on the computer. When more than the supported number of client computers will likely connect to WSUS on the active software update point site system server, an NLB cluster must be configured using two or more WSUS servers. When configuring the NLB cluster, there are several steps that must be taken. For more information, see How to Configure the Active Software Update Point Component to Use an NLB Cluster.

Software Update Point on a Secondary Site

The client computers assigned to secondary sites will automatically be configured to use the software update point at the parent site until an active software update point site system is configured for the secondary site. Creating an active software update point at the secondary site is recommended when there is limited network bandwidth from client computers to the software update point site system running WSUS or when the number of client computers connecting to the software update point is approaching capacity. Internet-based software update points are not supported on secondary sites.

Note
Generally, if you have decided that a proxy management point is necessary at the secondary site, you might want to consider an active software update point at the site as well.

After the active software update point is successfully installed and configured on the secondary site, the Group Policy is updated on client computers and they will start using the new software update point. For more information about how to install the software update point on a secondary site, see How to Create and Configure an Active Software Update Point on a Secondary Site.

See Also

Tasks

How to Configure the Active Software Update Point Component to Use an NLB Cluster
How to Create and Configure an Active Software Update Point on a Secondary Site

Concepts

About the Software Update Point
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings


Planning for the Software Update Point Installation

Before creating the active software update point site system role in Configuration Manager 2007, there are several requirements that must be considered depending on your Configuration Manager infrastructure. When the Configuration Manager 2007 active software update point will be configured to communicate using Secure Sockets Layer (SSL), or when the site server is in native mode, this section is especially important to review because additional steps must be taken before the software update points in the hierarchy will work properly. This section provides information about each step that is required to successfully plan and prepare for the software update point installation. The software update point infrastructure should be determined before installing the software update points in the hierarchy. For more information, see Determine the Software Update Point Infrastructure.

Important
When the site server is in native mode, make sure all native mode requirements have been met before implementing the steps described in this section. For more information, see How to Configure Native Mode.

Software Update Point System Requirements

The software update point site system role must be installed on a computer that meets the Windows Server Update Services (WSUS) 3.0 minimum requirements. For more information about the minimum requirements, see the WSUS 3.0 installation requirements on TechNet (http://go.microsoft.com/fwlink/?LinkId=99233).

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

Install WSUS on Servers

The software updates feature requires that WSUS 3.0 is installed on the all site system servers that are configured for the software update point site system role. Additionally, when the active software update point is remote from the site server, the WSUS 3.0 Administration Console is required on the site server computer when WSUS 3.0 is not already installed.

WSUS 3.0 Administration Console

The WSUS 3.0 Administration Console must be installed on the site server if the software update point is going to be installed on a remote site system server. This allows the site server to communicate with the WSUS components on the active software update point site system computer. For the step-by-step procedures for installing the WSUS 3.0 Administration Console, see How to Install the Windows Server Update Services 3.0 Administration Console.

WSUS 3.0 Full Installation

Before the software update point site system role can be successfully added to a site system server, WSUS 3.0 must be installed. When a Network Load Balancing (NLB) cluster is used as the active software update point or active Internet-based software update point, the full installation of WSUS 3.0 is required on all site system servers defined in the cluster. For more information about the software update point, where in the hierarchy to install this site system role, and whether to use an NLB cluster for an active software update point, see Determine the Software Update Point Infrastructure. For the step-by-step procedures for installing WSUS 3.0 for software updates, see How to Install Windows Server Update Services 3.0.

Use a WSUS 3.0 Web Site

During the WSUS 3.0 installation, you can choose to use the default Web site used by Internet Information Services (IIS) or create a WSUS 3.0 Web site. It is recommended that a WSUS 3.0 Web site is created so that IIS hosts the WSUS 3.0 services in a dedicated Web site instead of sharing the same Web site used by the other Configuration Manager 2007 site systems or other applications. This is especially true when installing the software update point on the site server. When using a custom Web site for WSUS 3.0, the default port numbers are port 8530 for HTTP protocol and port 8531 for HTTPS protocol (SSL). These port settings will need to be specified when creating the active software update point for the site.

Store Software Updates Locally on the WSUS Server

During the WSUS 3.0 installation, you should select Store updates locally so that any license terms associated with software updates are downloaded and stored on the local hard drive for the WSUS server during the synchronization process. When this setting is not selected, client computers might fail to scan for software updates compliance for updates that have a license terms. When the active software update point is installed, the Store updates locally setting in WSUS is automatically configured, and WSUS Synchronization Manager will verify that the setting is enabled every 60 minutes by default.

Using an Existing WSUS Server for a Software Update Point

You can use a WSUS server that was active in your environment before installing Configuration Manager 2007, but client computers connecting to the WSUS server will scan for all software updates in the WSUS database. This might result in client computers returning compliance state information for software updates outside of the configured classifications, categories, and languages. Before using an existing WSUS server as an active software update point site system, it is recommended that the software updates metadata is deleted from the WSUS database if possible. The WSUS server will be synchronized with new software updates metadata based on the settings configured for the active software update point.

WSUS Configured as a Replica Server

When creating the active software update point site system role on a primary site server, you cannot use a WSUS server that is configured as a replica of the upstream server. When the WSUS server is configured as a replica, Configuration Manager will fail to configure the WSUS server and WSUS synchronization will fail. When an active software update point is created on a secondary site, the WSUS server is configured to be a replica server for WSUS running on the active software update point at the parent primary site. For troubleshooting information, see Troubleshooting Software Update Point Configuration Issues.

Add the Web Server Certificate to the Custom Web Site

When the Configuration Manager 2007 site server is in native mode or when the active software update point is configured to use SSL, a Web server signing certificate must be assigned to the Web site used by WSUS. When the WSUS server uses a custom Web site, which is the recommended configuration, the WSUS Web site must be assigned a Web server certificate where the Subject Name or Subject Alternate Name contains the Internet fully qualified domain name (FQDN). The upstream WSUS server must be provisioned with the same certificate or SSL communication will fail between the servers. The certificate must also reside in Trusted Root Certification Authorities in the Computer certificate store on each client computer before they will able to access the WSUS Web site.

When the site server is in native mode, the Web server certificate that is used for Configuration Manager site systems can be assigned to the WSUS Web site. Alternatively, when WSUS uses the same Web site as the Configuration Manager 2007 site server, and the site server is configured for native mode, the default Web site might already be assigned an appropriate Web server certificate. The certificate would still need to be provisioned on the upstream WSUS server, but it should already reside in the local store on client computers.

For the step-by-step procedure to add the Web server certificate to the WSUS Web site, see How to Add the Web Server Certificate to the Custom WSUS Web Site. For more information about adding the Web server certificate to Configuration Manager 2007 site systems, see Deploying the Web Server Certificates to Site System Servers.

Configure SSL on the WSUS Server

When the site server is in native mode, or when the active software update point is configured to use SSL, the IIS settings must be configured on the WSUS server for the active software update point and the active Internet-based software update point, if configured. You must configure each of the following virtual directories to use SSL:

  • APIRemoting30
  • ClientWebService
  • DSSAuthWebService
  • ServerSyncWebService
  • SimpleAuthWebService

Software Updates requires that the following virtual directories not be configured to use SSL:

  • Content
  • Inventory
  • ReportingWebService
  • SelfUpdate

After the virtual directories have been configured, you must run the WSUSUtil tool to let the health monitoring component of WSUS know that it should use SSL. The command that must be run on the WSUS server is: WSUSUtil.exe configuressl <Name in Web server signing certificate>. For the step-by-step procedures for configuring the virtual roots to use a secured channel, see How to Configure the WSUS Web Site to Use SSL.

Certificates on Client Computers

When the site is in native mode, or when the active software update point is configured to use SSL, client computers must have the certificate that was configured for the WSUS Web site in the local Trusted Root Certification Authorities store. If the certificate is not located in the Trusted Root Certification Authorities store, client computers will fail to scan for software update compliance. For more information, see Deploying a Trusted Root Certification Authority to Configuration Manager Computers.

Configure Firewalls

Software updates on a Configuration Manager 2007 central site communicate with WSUS running on the active software update point site system, which in turn communicates with Microsoft Update to synchronize software updates metadata. The child sites communicate with the active software update point configured for the parent site. When there is an active Internet-based software update point on a site, the site server must communicate with the active Internet-based software update point, and the Internet-based software update point must communicate with the site's active software update point for synchronization to be successful.

When there is a firewall between the Configuration Manager 2007 active software update point and the Internet, an active software update point and its upstream server, or an active Internet-based software update point and the active software update point for the site, the firewall might need to be configured to accept the HTTP and HTTPS ports used for the WSUS Web site. You must configure the firewall to allow communication for the HTTP and HTTPS ports used by the WSUS server. By default, a WSUS server that is configured for the default Web site uses port 80 for HTTP and port 443 for HTTPS. By default, the WSUS server uses port 8530 for HTTP and port 8531 for HTTPS if it is using the WSUS custom Web site. For more information, see How to Determine the Port Settings Used by WSUS.

If your organization does not allow those ports and protocols to be open to all addresses on the firewall between the active software update point and the Internet, you can restrict access to the following domains so that WSUS and Automatic Updates can communicate with Microsoft Update:

  • http://windowsupdate.microsoft.com
  • http://*.windowsupdate.microsoft.com
  • https://*.windowsupdate.microsoft.com
  • http://*.update.microsoft.com
  • https://*.update.microsoft.com
  • http://*.windowsupdate.com
  • http://download.windowsupdate.com
  • http://download.microsoft.com
  • http://*.download.windowsupdate.com
  • http://test.stats.update.microsoft.com
  • http://ntservicepack.microsoft.com

When there is an active Internet-based software update point or when there are child sites with an active software update point, the following addresses might also need to be added to any firewall that is between the servers:

Child site active software update point

  • http://<FQDN for active software update point on child site>
  • https://<FQDN for active software update point on child site>
  • http://<FQDN for active software update point on parent site>
  • https://<FQDN for active software update point on parent site>

Active Internet-based software update point

  • http://<FQDN for active software update point for site>
  • https://<FQDN for active software update point for site>
  • http://<FQDN for active Internet-based software update point>
  • https://<FQDN for active Internet-based software update point>

Verify Connectivity to Remote WSUS Servers

Before installing the software update point site system role, you should verify that connectivity to the remote WSUS server is successful when using SSL. From the site server, you can open the WSUS Administration Console and connect to the remote WSUS server. Alternatively, you can check SSL communication to the remote WSUS server by using a Web browser and typing https://WSUSServerName. If the connection succeeds, a Web page displaying Under Construction appears.

Note
During software updates operations, connection from the site server to the WSUS server is in the context of the computer account. The tests in this section verify that the connection can be made to the WSUS server in the user context.

Install Software Update Point Site System

The software update point site system role is required before software updates can be synchronized, assessed for compliance on clients, and deployed. There can be multiple site system servers with the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in native mode, the active software update point can be configured to accept communication from all client computers. Alternatively, an active Internet-based software update point can be assigned to a remote site system server that accepts communication from only Internet-based client computers and the active software update point accepts communication from client computer on the intranet. Additionally, if the active software update point is configured as an NLB cluster, a site system server with the software update point site role should be created for each server in the NLB.

Important
Each site system server must have WSUS 3.0 installed and configured before the software update point site role is assigned or the software update point component installation will fail.

For each of the following scenarios, use the link to the associated procedure about how to install the active software update point:

Software Update Point Scenario | Link to Procedure
Create a non-active software update point site role. | How to Add the Software Update Point Site Role to a Site System
Create and configure an active software update point. | How to Create and Configure an Active Software Update Point
Create and configure an active Internet-based software update point, if required. | How to Create and Configure an Active Internet-Based Software Update Point
Create an active software update point configured as an NLB cluster, if required. | How to Configure the Active Software Update Point Component to Use an NLB Cluster

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Add the Web Server Certificate to the Custom WSUS Web Site
How to Configure the Active Software Update Point Component to Use an NLB Cluster
How to Configure the WSUS Web Site to Use SSL
How to Create and Configure an Active Internet-Based Software Update Point
How to Create and Configure an Active Software Update Point
How to Install the Windows Server Update Services 3.0 Administration Console
How to Install Windows Server Update Services 3.0
Troubleshooting Software Update Point Configuration Issues

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Benefits of Using Native Mode
Deploying a Trusted Root Certification Authority to Configuration Manager Computers
Deploying the Web Server Certificates to Site System Servers
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Settings

Other Resources

Configuring Internet-Based Client Management
How to Configure Native Mode
Software Update Point Component Properties


Planning for the Software Update Point Settings

The software update point in Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a site system server that has Windows Server Update Services (WSUS) 3.0 installed and that interacts with the WSUS components to configure update settings, to request synchronization to the upstream update server, and to synchronize the updates from the WSUS database to the site server database. For more information about software updates synchronization, see About Software Updates Synchronization.

Software Update Point Settings

The software update point settings configure which site system server is the active software update point, which site system server is the active Internet-based software update point if one is specified at the site, the synchronization source, synchronization schedule, and the products, classifications, and languages for which software updates will be synchronized.

General Settings

The general settings in the New Site Role Wizard and Software Update Point Component properties specify whether the active software update point is a local server or a remote server, or whether it uses a Network Load Balancing (NLB) cluster. These settings also specify which port settings are used for connectivity to the site system server that is assigned the software update point role, whether a Software Update Point Connection account should be used instead of the computer account when the site server connects to the WSUS components on the site system server, whether Internet-based clients are allowed to connect to the software update point when the site is in native mode, and whether Secure Sockets Layer (SSL) is used when synchronizing data from the active software update point and when clients connect to the WSUS server on the active software update point.

When the site is in native mode, the active software update point is configured to accept communication only from client computers on the intranet, and there are Internet-based client computers assigned to the site, you must follow a specific procedure to install and configure an active Internet-based software update point. For more information, see How to Create and Configure an Active Internet-Based Software Update Point.

Internet-Based Settings

When the Configuration Manager 2007 site server is in native mode and the active software update point is configured with Do not allow access from Internet-based clients, a software update point site system role must be created (not configured as the active software update point), and then you must configure the software update point site system server to be the active Internet-based software update point on the Internet-Based tab in the Software Update Point Component Properties dialog box. You can specify whether the active Internet-based software update point is a remote server or uses NLB, which port settings are used for connectivity to the software update point server, whether a Software Update Point Connection account should be used instead of the computer account when the site server connects to the WSUS components on the site system server, and whether the Internet-based software update point should synchronize with the active software update point for the site. If synchronization is not configured, the export and import function for the WSUSUtil tool must be used to synchronize software update metadata.

Synchronization Settings

The synchronization settings for the active software update point specify the synchronization source and whether WSUS reporting events are created during the synchronization process.

  • Synchronization Source: The synchronization source for the active software update point at the central site is configured to use Microsoft Update. The active software update points on child sites are automatically configured to use the active software update point on its parent site as the synchronization source. When there is an active Internet-based software update point, the active software update point for the site is automatically configured to be the synchronization source. Optionally, the active software update point or active Internet-based software update point can be configured not to synchronize with the configured synchronization source, but instead use the export and import function of the WSUSUtil tool. For more information, see How to Synchronize Updates Using Export and Import.
  • WSUS Reporting Events: The Windows Update Agent on client computers can create event messages that are used for WSUS reporting. These events are not used in Configuration Manager 2007 software updates, and therefore, the Do not create WSUS reporting events setting is selected by default. When these events are not created, the only time the client computer should connect to the WSUS server is during software update evaluation and compliance scans. If these events are needed for reporting outside of software updates in Configuration Manager 2007, you will need to modify this setting to create WSUS status reporting events or create all WSUS reporting events depending on your needs.

Synchronization Schedule

The synchronization schedule can be configured only at the active software update point on the central site. When the synchronization schedule is configured, the active software update point on the central site will initiate synchronization with Microsoft Update at the scheduled date and time. The custom schedule allows you to synchronize software updates on a date and time when the demands from the WSUS server, site server, and network are low, such as every week at 2:00 AM. Alternatively, synchronization can be initiated on the central site by using the Run Synchronization action from the Update Repository node in the Configuration Manager console.

Note
Scheduled synchronizations perform full synchronization, but using the Run Synchronization action performs only delta synchronization. Software updates are marked as expired if they are superseded by another software update or marked as expired in the catalog, but are marked as expired only during scheduled synchronization.

After the active software update point has successfully synchronized with Microsoft Update, a synchronization request is sent to the active Internet-based software update point, if installed, and to the active software update point on child sites. The process is repeated on every site in the hierarchy.

Update Classifications

Every software update is defined with an update classification that helps to organize the different types of updates. During the synchronization process, the software updates metadata for the specified classifications will be synchronized. Configuration Manager 2007 provides the ability to synchronize software updates with the following update classifications:

  • Critical Updates: Specifies a broadly released update for a specific problem that addresses a critical, non security-related bug.
  • Definition Updates: Specifies an update to virus or other definition files.
  • Drivers: Specifies an update to software components designed to support hardware.
  • Feature Packs: Specifies new product features that are distributed outside of a product release and typically included in the next full product release.
  • Security Updates: Specifies a broadly released update for a product-specific, security-related issue.
  • Service Packs: Specifies a cumulative set of hotfixes that are applied to an application. These hotfixes can include security updates, critical updates, software updates, and so on.
  • Tools: Specifies a utility or feature that helps to complete one or more tasks.
  • Update Rollups: Specifies a cumulative set of hotfixes that are packaged together for easy deployment. These hotfixes can include security updates, critical updates, updates, and so on. An update rollup generally addresses a specific area, such as security or a product component.
  • Updates: Specifies an update to an application or file currently installed.

The update classification settings are configured only on the central site. The update classification settings are not configured on the active software update point and active Internet-based software update point, if configured, on child sites because the software updates metadata is replicated from the central site down the hierarchy. When selecting the update classifications, be aware that the more classifications that are selected, the longer it takes to synchronize the software updates metadata.

Products

The metadata for each software update defines what product or products for which the update is applicable. A product is a specific edition of an operating system or application, for example, Microsoft Windows Server 2003. A product family is the base operating system or application from which the individual products are derived. An example of a product family is Microsoft Windows, of which Microsoft Windows Server 2003 is a member. You can specify a product family or individual products within a product family.

When software updates are applicable to multiple products, and at least one of the products has been selected for synchronization, all of the products will appear in the Configuration Manager console even if some have not been selected. For example, if Windows Server 2003 is the only operating system that you have subscribed to, and if a software update applies to Windows Server 2003 and Windows Server 2003 Datacenter Edition, both products will show up in the Configuration Manager repository.

The product settings are configured only on the active software update point on the central site. The product settings are not configured on the active software update point on child sites and active Internet-based software update point, if configured, because the software updates metadata is replicated from the central site down the hierarchy. When selecting the products, be aware that the more products that are selected, the longer it takes to synchronize the software updates metadata.

Languages

The language settings for the software update point allow you to configure the languages for which the summary details (software updates metadata) will be synchronized for a software update and the update file languages that will be downloaded for the software update.

Note
In Systems Management Server (SMS) 2003, the download.ini file stored the configuration settings for the languages that were used. The download.ini file is no longer used when synchronizing software updates.

Update File

The languages configured for the update file setting provide the default set of languages that will be available when downloading software updates at the site. When on the Language Selection page of the Deploy Software Updates Wizard or Download Software Updates Wizard, the languages configured for the active software update point are automatically selected, but can be modified each time updates are downloaded or deployed. When the wizard completes, the software update files for the configured languages are downloaded, if update files are available in the selected language, to the deployment package source location and copied to the distribution points configured for the package.

The update file language settings should be configured with the languages that are most often used in your environment. For example, if client computers in the site use mostly English and Japanese languages for the operating system or applications, and there are very few other languages used at the site, select English and Japanese in the Update File column and clear the other languages. This allows you to most often use the default settings on the Language Selection page of the wizards and also prevents unneeded update files from being downloaded. This setting is configured at each software update point in the Configuration Manager 2007 hierarchy.

Summary Details

During the synchronization process, the summary details information (software updates metadata) is updated for the software updates in the languages specified. The metadata provides the information about the software update, such as name, description, products that the update supports, update classification, article ID, download URL, applicability rules, and so on.

The summary details settings are configured only on the active software update point on the central site server. The summary details are not configured on the active software update point on child sites and Internet-based software update point, if configured, because the software updates metadata is replicated from the central site down the hierarchy. When selecting the summary details languages, you should select only the languages needed in your environment. The more languages that are selected, the longer it takes to synchronize the software updates metadata. The software updates metadata is displayed in the locale of the operating system where the Configuration Manager console is running. If the localized properties for the software updates are not available, the information displays in English.

Important
It is very important that you select all of the summary details languages that will be needed in your Configuration Manager hierarchy. When the active software update point on the central site is synchronized, the selected summary details languages determine what software updates metadata is retrieved. If the summary details languages are modified after the synchronization has run at least one time, the metadata is retrieved for the modified summary details languages for only new or updated software updates. The software updates that have already been synchronized will not retrieve metadata for different languages unless there is a change to the update on Microsoft Update.

Using Existing WSUS Servers for the Active Software Update Point

You can use a WSUS server that was active in your environment before installing Configuration Manager 2007. When the active software update point or active Internet-based software update point is configured, the synchronization settings are specified. A component of the software update point then configures the WSUS server with the same settings. When the WSUS server was previously synchronized with products or classifications that were not configured as part of the active software update point settings, the software updates metadata for the products and classifications will be synchronized for all of the software updates metadata from the WSUS server regardless of the synchronization settings for the active software update point. This might result in metadata for products or classifications that is unexpected. You will experience the same behavior when adding products or classifications directly in the WSUS console of the active software update point and immediately initiating synchronization. Every hour, by default, Configuration Manager will connect to WSUS running on the active software update point and reset any settings that were modified within the WSUS console.

See Also

Tasks

How to Configure Software Updates Synchronization
How to Create and Configure an Active Software Update Point
How to Create and Configure an Active Internet-Based Software Update Point

Concepts

About the Software Update Point
About Software Updates Synchronization
Administrator Workflows for Software Updates
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Administrator Checklists for Software Updates
Software Update Point Component Properties


Planning the Test Environment for Software Updates

It is important to understand how software updates will work in your environment, and one way this can be accomplished is to set up a test environment similar to your production environment. This section describes the operating systems and settings that are necessary to create a minimum configuration of a Microsoft System Center Configuration Manager 2007 site to use while you are testing or evaluating the software updates components. For example, if your enterprise uses Microsoft Windows Server 2003, Microsoft Windows 2000, and Microsoft Windows XP, you will need a minimum of one computer for each configuration.

In addition, you need computers that have other crucial line of business applications running on them (for example, accounting or sales-tracking software). When configuring a test collection, you should also account for variation in hardware within your enterprise (desktop versus laptop computers) and hardware configurations (low-memory versus multiprocessor servers).

Testing Requirements for Client Computers

One client is sufficient for minimum test purposes. However, if you want to have a representative sample of how software updates will work with all the computers used in your enterprise, it is recommended that you have representation for each configuration in your environment. For example, if you have computers that are running Windows XP SP2, Windows Server 2003, and Windows Vista, you should have a client computer for each of these operating systems in your test configuration. If you do not currently use a certain operating system (for example, Windows Server 2003 SP1) in your enterprise, but you plan to use it in the future, it is recommended that you add a computer that is running that operating system to your test configuration. This allows you to become familiar with how the software updates components and software updates work with the operating system before you deploy it in your enterprise.

Setting up this type of extended client test configuration allows you to become familiar with software updates in many different ways. By using more than one operating system you can do the following:

  • Review the specific software updates that Microsoft has published for those operating systems.
  • Start becoming familiar with software update management practices for each type of computer.
  • Learn how software updates work with different operating systems in a controlled environment.
  • Learn how to find information about specific software updates for specific operating systems when you need it.

Testing Requirements for Software Update Points

When using software updates in a test environment, create the software update point site role as it will be in the production site. You need to determine whether a single active software update point will be created or whether there will be an active software update point for connectivity from client computers on the intranet and an active Internet-based software update point for connectivity from client computers on the Internet. You also need to determine whether the software update point will be configured as a Network Load Balancing (NLB) cluster. For more information about planning for the software update points in a production environment and how to mirror the configuration in the test environment, see Planning for the Software Update Point Installation.

Testing Requirements for a Mixed Hierarchy

If you have a Systems Management Server (SMS) 2003 production environment, you should have at least two SMS 2003 test sites in the test hierarchy, with clients installed on each type of computer system and software updates working in the hierarchy. The central site should then be upgraded to Configuration Manager 2007 so that you can become familiar with the upgrade procedures and post-upgrade configuration that is necessary for software updates. For more information, see Planning the SMS 2003 Software Updates Upgrade.

Once the central site is upgraded and configured for software updates, you can create test deployments targeting both Configuration Manager and SMS 2003 client computers and become familiar with the Configuration Manager objects, as well as with the special SMS 2003 deployment objects that are created.

Network Access Protection

Network Access Protection (NAP) in Configuration Manager 2007 works in conjunction with policies on a Windows Server® 2008 computer running Network Policy Server to enforce compliance with selected software updates. Configuration Manager 2007 clients that can support NAP (such as Windows Vista) can have these software updates enforced through automatic remediation and can have restricted network access until these software updates are successfully installed. To achieve this, you must install a System Health Validator point on the computer running Network Policy Server, enable the Network Access Protection Client Agent for Configuration Manager 2007 clients capable of supporting NAP, and select the software updates you want to be included in NAP evaluation. If you do not require NAP enforcement of software updates in your environment or you do not have the supporting infrastructure for Network Access Protection, you do not need to configure Network Access Protection in your test environment or in the production environment. For more information, see Planning for Network Access Protection.

See Also

Concepts

Planning the SMS 2003 Software Updates Upgrade
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Administrator Checklists for Software Updates
Planning for Network Access Protection


Planning the SMS 2003 Software Updates Upgrade

Topic Last Updated—August 2008

There are important areas to consider when planning for software updates before and after a site upgrade from Systems Management Server (SMS) 2003 to Configuration Manager 2007. This section provides information about what software update information is upgraded and provides information about scanning computers for software updates compliance, software updates metadata, software updates synchronization, deploying software updates, and using software updates reporting. The information in this section assumes that the inventory scan tools have been installed on the highest site server in the SMS 2003 hierarchy, most likely the central site server. It also assumes that the site server highest in the hierarchy is the first site server upgraded to Configuration Manager 2007.

Important
For the most recent planning information, see the online version at http://go.microsoft.com/fwlink/?LinkId=92773.

For more information about upgrading from SMS 2003 to Configuration Manager 2007, as well as best practices and interoperability between the two versions, see the "System Center Configuration Manager 2007 Software Update Management Guidance - Migration from SMS 2003 Inventory Tool for Microsoft Updates" whitepaper at http://go.microsoft.com/fwlink/?LinkId=103710.

Upgraded Software Updates Metadata

The site server upgrade from SMS 2003 to Configuration Manager 2007 updates the SMS 2003 files and the Microsoft SQL Server database. The upgrade details are logged in the %systemdrive%\ConfigMgrSetup.log. For more information about the upgrading your site to Configuration Manager 2007, see Configuration Manager Upgrade and Interoperability Planning and Deployment.

During the site upgrade, the following software updates information is migrated from the SMS 2003 schema to the Configuration Manager 2007 schema:

  • Existing SMS 2003 software update distributions will be migrated and continue to work as expected only when the advertisement and program for the distribution is created at the site that is being upgraded. Software update installation programs created at the site being upgraded will not be migrated if the advertisement for the program was created at a child site. The programs that are not migrated will continue to work on SMS 2003 clients, but Configuration Manager client computers will not retrieve the updates deployed using these installation programs.
  • Information about the installed version of the Inventory Tool for Microsoft Updates. Other inventory scan tools are not compatible with Configuration Manager 2007, and information about these tools will not be migrated.
  • Software updates metadata, such as the name, description, applicability rules, article ID, the URL to more information about the update, the bulletin ID, the path to the software update source files, the associated product for the update, and so forth. Until the software updates are synchronized, all updates will be put in an expired state and their titles will be displayed in the Configuration Manager console with (LEGACY) appended to the end of the title.
    Note
    Before upgrading, verify that you have a valid package source for each package. If the package source is not valid, you must re-download all of the content in the package source or the package source validation check will fail and the content will be invalidated.

  • Compliance information for the software updates, such as the number of scanned clients in which the software update is required or not required.
  • Client status information, such as the revision for the Microsoft Update catalog that is used by clients when scanning for software updates compliance.
  • Security rights for SMS 2003 objects that were migrated to Configuration Manager 2007.
    Note
    After upgrading a site server, the user who ran the upgrade has access to all of the software updates objects in the Configuration Manager console but other administrators have access only to objects that existed prior to upgrade. For example, users who had full rights to all SMS 2003 software updates objects will have full rights to the same objects in Configuration Manager 2007 but will not have any rights to new object types such as deployment templates.

Scanning for Software Update Compliance After a Site Upgrade

There are several inventory scan tools in SMS 2003 that scan client computers for software update compliance. When a site is upgraded to Configuration Manager 2007, the Inventory Tool for Microsoft Updates is fully operational on all client computers, the Inventory Tool for Custom Updates is supported, but with conditions, and the other scan tools have very limited support.

Inventory Tool for Microsoft Updates

During the SMS 2003 site upgrade to Configuration Manager 2007, Setup detects whether a previous version of the Inventory Tool for Microsoft Updates is installed on the site and verifies that another installation of the tool is not installed on a site higher in the hierarchy. If both are true, Setup initiates an upgrade for the inventory tool on the site server. During the installation, you can specify whether to download the latest Microsoft Update catalog from the Internet or from a local location.

After the Inventory Tool for Microsoft Updates is upgraded on the site, the catalog will be synchronized with the latest Microsoft Updates catalog, the scan package will be updated, and client computers will upgrade the scan tool following their next machine policy cycle.

Important
During the June 10, 2008 release of the Microsoft Update catalog, additional metadata that is associated with Microsoft Office 2003 Service Pack 1 was added to the Wsusscn2.cab file. The catalog synchronization process (UpdateWUSCatalog.exe) was not designed to handle the specific changes, and as a result, synchronization for the Inventory Tool for Microsoft Updates fails and the latest updates are not available to SMS 2003 clients. To resolve this issue, a change has been made to the UpdateWUSCatalog.exe file to accommodate the new metadata. The update must be installed on the Configuration Manager site server, and then catalog synchronization must be manually run before a client using the Inventory Tool for Microsoft Updates will successfully scan for software updates. The update is available and described in Knowledge Base article 954474 (http://go.microsoft.com/fwlink/?LinkId=123771).

The client will scan for software updates compliance using the Microsoft Update catalog. Only SMS 2003 clients should be in the target collection for the Microsoft Updates Tool advertisement. The Inventory Tool for Microsoft Updates is supported only for SMS 2003 clients in the hierarchy. Configuration Manager 2007 client computers must use the software updates feature. For more information, see Administrator Checklist: Assessing and Deploying Software Updates.

Important
When all client computers in the hierarchy have been upgraded to Configuration Manager 2007, the Inventory Tool for Microsoft Updates should be removed from the site server.

Inventory Tool for Custom Updates

After a site upgrade, SMS 2003 clients in the hierarchy will continue to scan custom software updates for compliance using the scan package for the Inventory Tool for Custom Updates. For Configuration Manager client computers to scan for the custom software updates, the custom catalog must be republished to the update server using System Center Updates Publisher, and then the software update point must be synchronized with the published updates.

Other Inventory Scan Tools

After a site upgrade, scanning for update compliance using all other inventory scan tool catalogs is supported only for SMS 2003 client computers in the hierarchy. Configuration Manager 2007 client computers do not support the inventory tools for other scan tools.

Synchronizing Software Updates After a Site Upgrade

During a site server upgrade, all software updates are migrated into the Configuration Manager 2007 database and the Expired attribute for each update is set to Yes, putting them in an expired state. Before Configuration Manager client computers are able to scan for software update compliance and before software update deployments can be created at the site server, the updates must be put back into an active state by running software updates synchronization.

Synchronizing the Microsoft Updates Catalog

After the Inventory Tool for Microsoft Updates is upgraded, the Microsoft Updates catalog is automatically synchronized using the Microsoft Updates Tool Sync advertisement. When it is complete, the synchronized software updates from the Microsoft Updates catalog are reset to an active state.

Note
The synchronization task for the Inventory Tool for Microsoft Updates might take longer than an hour complete.

Synchronizing the Software Update Point

After a site upgrade, the software update point site role must be created and configured and then synchronized with the Windows Server Update Services (WSUS) server. For more information about creating the software update point, see How to Add the Software Update Point Site Role to a Site System. For more information about synchronizing the software updates point, see How to Synchronize Software Updates.

Software updates from only the Microsoft Updates and custom software updates catalogs can be synchronized. All other software updates will remain in an expired state, will not be scanned for software update compliance on Configuration Manager client computers, cannot be deployed to client computers from the Configuration Manager site server, and will eventually be removed from the Configuration Manager site database.

LEGACY Appended to Migrated Software Updates Metadata

During the upgrade process, Configuration Manager 2007 Setup appends (LEGACY) to the title for each software update. This helps you identify software updates that were migrated among the new software updates metadata that is synchronized after the upgrade. Software updates with (LEGACY) in the title should not be deployed to clients and are only migrated for migrated software update distributions and for reporting purposes. You can run a script to hide these software updates in the Configuration Manager console so only deployable software updates are displayed. A sample script is available from the Microsoft Script Center Script Repository (http://go.microsoft.com/fwlink/?LinkId=102377).

Note
Migrated software updates that are in a software update deployment that was also migrated will not be hidden until the migrated deployment is deleted or the updates are removed from the deployment.

Republishing the Custom Updates Catalog

Custom catalogs that have been published to the site server using the Custom Updates Publishing Tool must be republished to WSUS using System Center Updates Publisher after the site server has been upgraded. Until the custom catalog is republished, the custom updates will not be synchronized to the site database and the updates will remain in an expired state. For information about publishing software updates using Updates Publisher, see "Publishing Software Updates" in the Updates Publisher help file, SC_UpdatesPublisher.chm. For more information about Updates Publisher and how to access this help file, see About System Center Updates Publisher.

Deploying Software Updates to Client Computers

After the site upgrade, advertisements that were active prior to the site upgrade will continue to work on SMS 2003 client computers. These advertisements are moved to the SMS 2003 Advertisements node under Software Updates \ Deployment Management in the Configuration Manager console. After the software update point site role is created and configured, the software updates are synchronized with the upstream update server, Configuration Manager client computers are scanned for software updates compliance, and new software update deployments can be created.

In Configuration Manager 2007, the Deploy Software Updates Wizard is used to deploy software updates to both Configuration Manager and SMS 2003 client computers. Software updates only from Microsoft Update and published custom updates can be deployed to SMS 2003 clients. New deployments are not supported for software updates that are in catalogs from other inventory scan tools. For more information about deployments, see About Software Update Deployments.

Using Deployment Templates That Specify SMS 2003 Settings

When deployment templates are created with the Deploy software updates to SMS 2003 clients setting enabled, the template will be available on the Deployment Template page of the Deploy Software Updates Wizard only when all software updates can be deployed to SMS 2003 clients. For example, if the software updates that are being deployed all have a value of Yes for the Deployable to SMS2003 setting, the Deploy Software Updates Wizard will show all templates regardless of configured SMS 2003 settings. If the software updates that are being deployed have a value of No for the Deployable to SMS 2003 setting, the Deploy Software Updates Wizard will not show templates that have the SMS 2003 settings configured. For more information, see About Deployment Templates in Software Updates.

Using the Software Updates Reports

The predefined software updates reports and underlying software updates SQL Server views have been modified in Configuration Manager 2007 to work with the new software updates infrastructure. Existing views from SMS 2003 will mostly work, but you should use the Configuration Manager views when creating or modifying reports.

During a site upgrade, the SMS 2003 reports are migrated, but they are deprecated and might fail to run or retrieve the expected data. You should not use the SMS 2003 software updates reports. Several new reports have been created to support software updates in Configuration Manager and are grouped in the following categories:

  • Software Updates - A. Compliance
  • Software Updates - B. Deployment Management
  • Software Updates - C. Deployment States
  • Software Updates - D. Scan
  • Software Updates - E. Troubleshooting
  • Software Updates - F. Distribution Status

When customized reports were created on the site prior to the upgrade, it is recommended that a similar Configuration Manager report should be customized or a new report should be created to retrieve the desired data instead of using the migrated customized report. For more information about the reports for software updates in Configuration Manager 2007, see About Software Updates Reports.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Deploy Software Updates
How to Synchronize Software Updates

Concepts

About Software Update Deployments
About System Center Updates Publisher
Administrator Checklist: Assessing and Deploying Software Updates
Planning for a Software Update Deployment
Planning for the Software Update Point Installation
About Software Updates Reports


Planning for Software Updates Client Settings

The software updates client settings in Configuration Manager 2007 are site wide and configured with default values. There are software updates client agent settings and general settings that affect when software updates are scanned for compliance, and how and when software updates are installed on client computers. The client settings specific to software updates are configured within the Software Updates Client Agent properties, the site-wide general settings that affect software updates are configured within the Computer Client Agent properties, and the software updates installation schedule can be configured from the Configuration Manager in the Control Panel on the client computer. There are also Group Policy settings on the client computer that might need to be configured depending on your environment.

Important
Before client computers can scan for software update compliance and before deployments can be created that target client computers, the software updates environment must be planned and configured. For more information, see Administrator Checklist: Planning and Preparing Software Updates.

On This Page

Software Updates Client Agent Settings

Computer Client Agent Settings

Configuration Manager Control Panel Settings

Group Policy Settings

Software Updates Client Agent Settings

The Software Updates Client Agent properties contain three tabs that provide configuration settings to enable software updates and configure the software updates settings on client computers. Use the following procedure to open the properties dialog box.

To open the Software Updates Client Agent properties

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. Right-click the Software Updates Client Agent, and then click Properties.

The following client settings are available in the Software Updates Client Agent properties:

General Tab

Enable Software Updates on Clients

This setting specifies whether the Software Updates Client Agent is enabled or disabled for the site. The Software Updates Client Agent is installed on Configuration Manager 2007 clients by default. If the client agent is disabled, the client agent components are put into a dormant state but not removed on clients. Existing deployment policies will be removed from client computers when the client agent is disabled. Re-enabling the Software Updates Client Agent initiates a policy to request that the components on clients be enabled and the deployment metadata be downloaded. The Software Updates Client Agent is configured on a site-by-site basis and affects only clients assigned to that site. Disabling the Software Updates Client Agent at a site prevents software update compliance assessment and software updates from being deployed.

Scan schedule

This setting specifies how often the client computer initiates a scan for software updates compliance. By default, a simple schedule is configured to run the scan for compliance every 7 days and the site database is updated with any changes since the last scan. The minimum value allowed for the scan schedule is 1 day and the maximum is 31 days. This setting is available to configure only after an active software update point site role has been installed on a site system server for the site.

Note
When a custom schedule is selected, the actual start time on client computers is the start time plus a random amount of time up to 2 hours. This prevents client computers from initiating the scan and connecting to Windows Server Update Services (WSUS) on the active software update point server at the same time.

Update Installation Tab

Enforce all mandatory deployments

This setting specifies whether to enforce all mandatory software update deployments that have deadlines within a specified period of time. When a deadline is reached for a mandatory software update deployment, installation is initiated on clients for the updates defined in the deployment. This setting determines whether to also initiate the installation for software updates defined in other mandatory deployments that have a configured deadline within the specified period of time.

The benefit of this setting is that it expedites software update installation for mandatory updates, might increase security, might decrease display notifications, and might decrease system restarts on client computers. By default, this setting is not enabled.

For deployment deadlines within

This setting specifies the timeframe for the Enforce all mandatory deployments setting. The minimum value allowed is 1 to 23 hours and 1 to 365 days. By default, this setting is configured for 7 days.

Hide all deployments from end users

This setting specifies that all deployments are hidden when they are received on client computers. Use this setting to deploy software updates to computers without any display notifications or notification area icons. Also, end users will not be able to open the Available Software Updates dialog box to manually install updates. By default, this setting is not enabled.

Important
When this setting is enabled, only software updates in mandatory deployments will be installed on client computers.

Deployment Re-Evaluation Tab

The setting on this tab configures how often the Software Updates Client Agent reevaluates software updates for installation status. When software updates that have been previously installed are no longer found on client computers and are still required, they are reinstalled. The deployment reevaluation schedule should be adjusted based on company policy for software update compliance, whether users have the ability to uninstall software updates, and so on, and with the consideration that every deployment reevaluation cycle results in some network and client computer CPU activity. The minimum value allowed for the deployment reevaluation schedule is 1 day and the maximum is 31 days. By default, a simple schedule is configured to run deployment reevaluation every 7 days.

Note
When a custom schedule is selected, the actual start time on client computers is the start time plus a random amount of time up to 2 hours. This prevents client computers from initiating the scan and connecting to Windows Server Update Services (WSUS) on the active software update point server at the same time.

Computer Client Agent Settings

The Computer Client Agent properties contain four tabs that provide configuration settings that affect the software updates reminders and the customization for software update deployments on client computers. Use the following procedure to open the properties dialog box.

To open the Computer Client Agent properties

  1. In the Configuration Manager console of the primary site server, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. Right-click the Computer Client Agent, and then click Properties.

The following settings are applicable to software updates in the Computer Client Agent properties:

General Tab

Interval

The Policy polling interval (minutes) setting specifies how often client computers retrieve machine policy. This setting is relevant to software updates in that when new deployments are created, the machine policy is updated with the deployment information. Clients can take up to the Policy polling interval (minutes) value to receive the deployment policy. The default value for this setting is 60 minutes.

State messages

The State message reporting cycle (minutes) specifies how often client computers sent state messages to the management point. The software updates client creates state messages for scan, software updates compliance, deployment evaluation, and deployment enforcement. The default value for this setting is 5 minutes.

Customization Tab

Organization name

This setting specifies the name of the organization authoring the software update installation. By default, the text box displays "IT Organization." The organization name displays in software updates display notifications, the Available Software Updates dialog box, and the restart countdown dialog box on clients that receive deployed software updates. It is recommended that this setting be customized with something more appropriate for your organization.

Software updates

This setting specifies an optional subheading used by software updates dialog boxes on client computers. By default, the text box displays "Protecting your computer." The software updates setting displays in the Available Software Updates and restart countdown dialog boxes on client computers that receive deployed software updates.

Reminders Tab

The settings on this tab specify how often display notifications are displayed on client computers when a deployment deadline is approaching for software updates. The reminder intervals can be configured for when the deadline is greater than 24 hours, when the deadline is less than 24 hours away, and when the deadline is less than an hour away. For more information about this tab, see Computer Client Agent: Reminders Tab.

BITS Tab

The settings on this tab specify whether bandwidth throttling is configured for the site. These settings apply to Configuration Manager client computers when they use BITS to download software update files from distribution points. For more information about the settings on this tab, see Computer Client Agent: BITS Tab.

Restart Tab

The settings on this tab configure the restart countdown timeframe and restart final notification when a software update is installed on client computers and a restart is required for it to complete. By default, the initial countdown is 5 minutes and a final notification is displayed when there is 1 minute before the restart will be initiated. For more information about this tab, see Computer Client Agent Properties: Restart Tab.

Configuration Manager Property Settings

The Configuration Manager Properties dialog box provides software updates actions and configuration settings. Use the following procedure to open the properties dialog box.

To open the Configuration Manager properties

  1. On a client computer, open the Control Panel.

  2. Double-click the Configuration Management icon.

The following actions and settings are applicable to software updates in the Configuration Manager properties:

Actions

The following actions are applicable to software updates:

  • Machine Policy Retrieval & Evaluation Cycle: Bypasses the automatic policy polling interval on clients to get the machine policy as soon as possible.
  • Software Updates Deployment Evaluation Cycle: Evaluates the state of new and existing deployments and their associated software updates. This includes scanning for software updates compliance, but may not always catch scan results for the latest updates. This is a forced online scan and requires that the WSUS server is available for this action to succeed.
  • Software Updates Scan Cycle: Scans for software updates compliance for updates that are new since the last scan. This action does not evaluate deployment policies as the Software Updates Deployment Evaluation Cycle does. This is a forced online scan and requires that the WSUS server is available for this action to succeed.

Updates Tab

The setting on this tab configures whether there is a schedule for installing mandatory software updates that are required on the client computer. When this setting is not enabled, mandatory software updates will be installed at the deadline date and time scheduled by the Configuration Manager administrator or manually installed prior to the deadline.

When this setting is enabled, it allows you to schedule software update installation at a time that is convenient, for example, every day at 2 AM. When multiple users are using a client computer and this setting is modified, the setting that was configured last is used.

Install required updates on a schedule

This setting specifies whether required software updates that have been deployed to this client computer will install on a specified schedule. When it is enabled, you can specify a recurrence pattern of every day or a specific day of the week, and a specific time. Local users and administrators can modify this setting.

Group Policy Settings

The following Group Policy settings are required for the Windows Update Agent (WUA) on client computers to connect to WSUS on the active software updates point and successfully scan for software update compliance.

Note
If users running the Windows Vista® operating system on Configuration Manager 2007 clients use Windows Update to check for new updates, they will see only updates that have been approved in WSUS instead of all applicable updates. To prevent confusion, you should consider preventing users from checking for updates using Group Policy. For more information about using Group Policy to control the Windows Update experience, see http://go.microsoft.com/fwlink/?LinkId=94680.

Specify intranet Microsoft update service location

When the active software update point is created for a site, client computers receive a machine policy that provides the active software update point server name and configures the Specify intranet Microsoft update service location local policy on the computer. The WUA retrieves the server name specified in the Set the intranet update service for detecting updates setting, and then connects to this server when it scans for software updates compliance. When a domain policy has been created for the Specify intranet Microsoft update service location setting, it overrides the local policy, and the WUA might connect to a server other than the active software update point. If this happens, the client computer might scan for software update compliance based on different products, classifications, and languages. It is recommended that this domain policy not be configured for Configuration Manager 2007 client computers.

Allow signed content from intranet Microsoft update service location

Before the WUA 3.0 on computers will scan for updates that were created and published with the System Center Updates Publisher, the Allow signed content from intranet Microsoft update service location Group Policy setting must be enabled. When the policy setting is enabled, WUA 3.0 will accept updates received through an intranet location if the updates are signed in the Trusted Publishers certificate store on the local computer. For more information about the Group Policy settings required for Updates Publisher, see the Updates Publisher help file. For more information about Updates Publisher, see About System Center Updates Publisher.

Automatic Updates Configuration

Automatic Updates allows security updates and other important downloads to be received on client computers. Automatic Updates is configured through the Configure Automatic Updates Group Policy setting or the Control Panel on the local computer. When Automatic Updates is enabled, client computers will receive update notifications and, depending on the configured settings, download and install required updates. When Automatic Updates coexists with software updates, each might display notification icons and popup display notifications for the same update. Also, when a restart is required, each might display a restart dialog box for the same update.

Self Update

When Automatic Updates is enabled on client computers, the WUA automatically does a self update when a newer version becomes available or when there are problems with a WUA component. When Automatic Updates is not configured or disabled and client computers have an earlier version of the WUA, the client computers must run the WUA installation file. For more information about installing the WUA on client computers, see How to Install the Windows Update Agent on Client Computers.

See Also

Tasks

How to Install the Windows Update Agent on Client Computers
Troubleshooting Software Updates Client Issues

Concepts

About the Software Updates Client Agent
About the Software Updates Process
Administrator Checklist: Planning and Preparing Software Updates
Planning for Software Updates Server Settings

Other Resources

Computer Client Agent Properties
Software Updates Client Agent Properties


Planning for Software Updates Server Settings

There are software updates settings and general site settings that have an impact on software updates in Configuration Manager 2007. These settings configure the active software update point and determine what updates are synchronized, whether there are maintenance windows for installing updates, how much time software updates have to complete, whether software updates are included in a Network Access Protection (NAP) evaluation, and so on.

Important
Before client computers can scan for software update compliance and before deployments can be created that target client computers, the software updates environment must be planned and configured. For more information, see Administrator Checklist: Planning and Preparing Software Updates.

Software Update Point Settings

The software update point site system role is required before software updates can be synchronized, assessed for compliance on clients, and deployed. Multiple site system servers can have the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in Native mode, an additional active Internet-based software update point can be assigned to a remote site system server that allows communication from only Internet-based client computers. Additionally, if the active software update point is configured as a Network Load Balancing (NLB) cluster, a site system server with the software update point site role should be created for each server in the NLB cluster. For information about planning for the software update point in your environment, see Planning for the Software Update Point Settings.

Planning for Maintenance Windows

Maintenance windows provide administrators with a way to define a period of time that limits when changes can be made on the systems that are members of a collection. Maintenance windows restrict when the software updates in deployments can be installed on client computers, as well as operating system advertisements and software distribution advertisements. For more information about how to configure maintenance windows, see How to Set a Maintenance Window.

Client computers determine whether there is enough time to start a software update installation by using the following three settings:

  • Restart countdown: Specifies the length of the client restart notification (in minutes) for computers in this site. The default setting is 5 minutes. This setting is available as a global setting in the Computer Client Agent Properties dialog box.
  • System restart turnaround Time: Specifies the length of time given for computers to initiate the system restart and reload the operating system. This setting is stored in the site control file for the site and has a default value of 10 minutes.
  • Maximum run time: Specifies the amount of time that is estimated for a software update to install. The default setting is 20 minutes for updates and 60 minutes for service packs. This setting can be modified for individual software updates on the Maximum Run Time tab for the properties for the software update.

When these settings are used to determine the available maintenance window, each software update has a default of 35 minutes (75 minutes for service packs). When planning for maintenance windows, take these defaults into consideration. When planning software update deployments to client computers, be aware of the configured maintenance window, how many software updates are in a deployment (so that you can forecast whether client computers will be able to install the updates within the maintenance window) and whether the update installation will span multiple maintenance windows. When software update installation has completed, but there is not enough time in the maintenance window for the computer to restart, the computer will wait until the next maintenance window and initiate the restart before installing pending update installations.

When there are multiple software updates to be installed on a client computer with a configured maintenance window, the update with the lowest maximum run time installs first, the update with the next lowest maximum run time installs next, and so on. Before installing each update, the client verifies that the available maintenance window is long enough to install the update. After an update starts installing, it will continue to install even if the installation goes beyond the end of the maintenance window.

When creating a software update deployment, there are two settings that allow maintenance windows to be ignored as follows:

  • Allow system restart outside of maintenance windows: Specifies whether to allow system restarts for both workstations and servers outside of configured maintenance windows. By default, this setting is not enabled. This setting is beneficial when you want your software update installation to complete on client computers as soon as possible. When this setting is not specified, a system restart will not be initiated if the maintenance window ends in 10 minutes or less. This could prevent the installation from completing and leave the client computer in a vulnerable state until the next maintenance window. This setting is available on the Restart Settings page of the Deployment Template Wizard or Deploy Software Updates Wizard.
  • Ignore maintenance windows and install immediately at deadline: Specifies whether the software updates in the deployment are installed at the deadline regardless of a configured maintenance window. By default, this setting is not enabled and is available only when there is a deadline configured for the deployment. This setting is beneficial when there are software updates that must be installed on client computers as soon as possible, such as the updates in an expedited deployment. This setting is available on the Schedule page of the Deploy Software Updates Wizard.

Planning for Settings on Software Updates

The Software Updates Client Agent properties dialog box contains three tabs that provide configuration settings to enable software updates and configure the software updates settings on client computers. Use the following procedure to open the properties dialog box.

To open the properties dialog box for a software update

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository. For information about where software updates can be displayed, see How to Find Software Updates in Configuration Manager.

  2. Right-click the software update, and then click Properties.

The following client settings can be configured in the properties for the software update.

Maximum Run Time Tab

The Maximum Run Time tab in the properties dialog box for a software update allows you to set the maximum amount of time a software update has to complete installation on client computers. If the maximum run-time value has been reached, a status message is created and the deployment is no longer monitored for software update installation. This setting is also used to determine whether the software update installation should be initiated within a configured maintenance window. If the maximum run-time value is greater than the time left in the maintenance window, software update installation is not initiated until the start of the next maintenance window. This setting can be configured only on the site that synchronizes with Microsoft Update, most likely the central site.

Important
Ensure that the maximum run-time value is not set for more time than the configured maintenance window or the software update installation will never initiate.

Some software updates might take more time to install than the default setting allows. Increasing the Maximum run time (minutes) setting to accommodate larger software updates is recommended.

The Maximum run time (minutes) setting specifies the maximum number of minutes that a software update installation has to complete before the installation is no longer monitored by Configuration Manager. This setting is also used to determine whether there is enough time to install the update before the end of a maintenance window. The default setting is 60 minutes for service packs and 20 minutes for all other software update types. Values can range from 5 to 9999 minutes.

NAP Evaluation Tab

The NAP Evaluation tab is used to specify whether the software update is required for compliance when using Network Access Protection (NAP). Enable NAP evaluation to include the software update in a NAP policy that will become effective on NAP-capable clients based on the configured schedule. When the policy becomes effective, NAP-capable clients might have restricted access until they comply with the selected software update. Network restriction and remediation is dependent on how the policies are configured on the Windows Network Policy Server. This setting can be configured only on the site that synchronizes with Microsoft Update, most likely the central site.

Custom Severity Tab

The Custom Severity tab can be used to configure custom severity values for software updates if predefined severity values do not meet your needs. The custom values are listed in the Custom Severity column in the Configuration Manager console. The software updates can be sorted by the defined custom severity values, the search folder can be created based on these values, queries and reports can be created that can filter on these values, and so on. This setting can be configured only on the site that synchronizes with Microsoft Update, most likely the central site.

See Also

Tasks

How to Find Software Updates in Configuration Manager
How to Set a Maintenance Window

Concepts

Administrator Checklist: Planning and Preparing Software Updates
Planning for Software Updates Client Settings
Planning for the Software Update Point Settings

Other Resources

Computer Client Agent Properties
Deploy Software Updates Wizard
Deployment Template Wizard
Planning for Software Updates
Software Update Name Properties


Determine What Software Updates to Deploy

The software updates feature in Configuration Manager 2007 provides the ability to identify whether the software updates that are scanned for are installed or required on client computers. There are several ways to determine what software updates need to be installed. The reports in the Software Updates - A. Compliance category provide the best interface for finding the software updates that are required on client computers. You can also use the Software Updates home page, the Update Repository console tree node, or Web reports. Use the following procedures as a guide to help you identify when software updates are required on clients in the Configuration Manager hierarchy.

Software Updates Reports

Compliance information can be retrieved by running reports within the Software Updates - A. Compliance category. The reports provide useful information about the compliance of software updates. Use the following procedure to display a list of software updates with associated compliance state.

To use Web reports to identify required software updates

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. A list of all the reports will be displayed in the results pane. Right-click Compliance 5 - Updates by vendor/month/year, and then click Run. Specify the Collection ID, Vendor, and Year. To filter the list of updates, also specify Update Class, Product, and Month. Click Display.

    The software updates that meet the criteria are displayed. Many columns present information about each software update. The Required column identifies the number of client computers that require a software update. The report also lists the software updates that have been deployed by listing an asterisk (*) in the Approved column. For more information about the software update, you can click the Information URL link to open a Web site with specific information about the selected software update. The Web site provides information about the issue that the software update resolves.

  3. Click the drill-down link in the first column for any software update to open the Compliance 7 - Specific software update states report that displays a count of computers in each compliance state.

Software Updates Home Page

The Software Updates home page allows you to find software updates for a specific vendor, during a specific month and year, and for a specific update classification. The following procedure provides the steps to determine what software updates are required using the Software Updates home page.

To use the Software Updates home page to identify software updates for deployment

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. The software updates are displayed in the Software Update Compliance Status Summary pane based on the article ID of the update. By default, the software updates from the month when software updates were last synchronized will be displayed. You can modify the criteria and then click Go to update the display. You can determine what software updates are required on client computers, and how many computers need the updates, by reviewing the Required column. Highlight multiple software updates to display the overall compliance level in a graph. The software updates displayed in the results pane can be downloaded, added to an update list, or deployed by selecting the associated action.

    For more information about the software update, you can click the article ID for the software update to open a Web site with specific information about the selected software update. The Web site provides information about the vulnerability if the software update is not installed, the maximum severity rating, recommendations, affected software, affected components, and so forth. For more information, see Software Updates Home Page.

Update Repository

The Update Repository node in the Configuration Manager 2007 console tree organizes software updates by update classification and then by product. You can browse for software updates by classification, vendor, or product, or you can create a search folder to find the updates that should be deployed. The following procedure provides the steps to find software updates in the Updates Repository console tree node.

To use the Updates Repository node to display software updates

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Expand the desired classification. All software updates are displayed for the classification by clicking All Updates, you can expand a vendor node and get all updates for the vendor within the classification, or you can click a product node to get the updates within the classification for a specific product by a vendor.

    The software updates are displayed by article ID. You can determine what software updates are required on client computers, and how many computers need the updates, by reviewing the Required column. Click any column header to sort the data. For example, click the Required column header to sort by the software updates that are required by the most client computers. The software updates displayed in the results pane can be downloaded, added to an update list, or deployed by selecting the associated action. For more information, see Update Repository Home Page.

Software Updates Search Folders

You can create search folders that specify a set of criteria to help you find software updates that are required on client computers. For example, you could create a search folder that displays only required software updates that were released in the previous month. Using search folders is part of the recommended software updates workflow. For example, you can create a search folder with specific criteria to display a set of software updates, add the set of updates to an update list, use software updates reports to display compliance information for the update list, and create a deployment using the update list. For more information, see How to Configure Search Folders for Software Updates.

The following procedure provides the steps to use search folders to find the software updates that are required on client computers.

To use the search folders to display software updates

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository / Search Folders.

  2. Right-click Search Folders, and then click New Search Folder.

  3. Specify one or more object properties for the search criteria.

  4. Specify the search criteria for the object property by clicking the underlined property in the Step 2: Edit the property's search criteria window.

  5. Click Search all folders under this feature.

  6. Specify the name of the search folder, and then click OK.

  7. Expand the Search Folders console tree node, and then click the search folder that you just created.

    The software updates are displayed by article ID based on the criteria that was specified for the search folder. You can determine what software updates are required on client computers, and how many computers need the updates, by reviewing the Required column. Click any column header to sort the data. For example, click the Required column header to sort by the software updates that are required by the most client computers. The software updates displayed in the results pane can be downloaded, added to an update list, or deployed by selecting the associated action. For more information, see Update Repository Home Page.

Software Updates Supersedence

Supersedence is when a new software update contains the same fixes that were in a previously released software update. It is recommended that the software update that supersedes another update be deployed to avoid installing outdated software updates on client computers. Superseded software updates are identified in the Configuration Manager console by an icon that contains a yellow arrow. You can highlight a software update in the Configuration Manager console and click the Supersedence Information tab to display updates that the highlighted update supersedes and the updates that supersede the highlighted update. For more information, see "Software Updates Supersedence" in About Software Updates Metadata.

See Also

Tasks

How to Deploy Software Updates
How to Deploy Software Updates Using an Update List

Reference

Update Repository Home Page

Concepts

About Software Updates Metadata
Planning for a Software Update Deployment
Software Updates Home Page
About Software Updates Reports

Other Resources

Planning for Software Updates


Planning for a Software Update Deployment

Topic last updated—November 2007

Before creating a software update deployment in Configuration Manager 2007, there are several settings that must be considered depending on your Configuration Manager 2007 hierarchy. You should also consider creating deployment templates for common deployment scenarios, understand how maintenance windows and client computer restart behavior works on client computers, determine whether the deployments tasks will be delegated, and plan for deployments to Systems Management Server (SMS) 2003 clients.

On This Page

Software Update Point Settings

Software Update Deployment Settings

Using Deployment Templates When Creating Deployments

Maintenance Windows

Deployment Actions that Will Result in a Package Refresh

Restart Behavior on Client Computers

Hiding Deployments from End Users

Software Updates with License Terms

Delegated Administration

Planning for SMS 2003 Deployments

Software Update Point Settings

When creating the active software update point, you configure the update classifications, products, and languages for which the software update metadata is synchronized. The synchronized software updates are displayed in the Configuration Manager console and can then be deployed to client computers. These settings can be modified at any time, but you should pay special attention to the Summary Details language setting before synchronizing and deploying software updates.

It is very important that you select all of the summary details languages that will be needed in your Configuration Manager hierarchy. When the active software update point on the central site is synchronized, the selected summary details languages determine what software update metadata is retrieved. If the summary details languages are modified after the synchronization has run at least one time, the metadata is retrieved for the modified summary details languages for only new or updated software updates. The software updates that have already been synchronized will not retrieve metadata for different languages unless there is a change to the update on Microsoft Update.

For more information about the software update point settings, see Planning for the Software Update Point Settings.

Software Update Deployment Settings

When creating a software update deployment in the Deploy Software Updates Wizard, many deployment settings need to be considered. The following sections provide information about the settings on each page of the Deploy Software Updates Wizard.

General Page

The General page allows you to provide the name and description for the deployment. The name must be unique for the site.

Recommendation

Provide a name and description that will help you to distinguish this deployment from any others. Deployments are sorted in the Configuration Manager console by name. Deployments are easy to find when there are a small number of them, but they can be difficult to find when there are many. Before creating deployments, think about the naming convention that will be used at your site.

Collection Page

The Collection page specifies the collection that will be targeted for the software update deployment. Members of the collection and subcollections, if configured, receive available deployments during their next Machine Policy Retrieval & Evaluation Cycle. The following settings are available on the Collection page:

  • Collection: Specifies the target collection for the deployment. Members of the collection receive the software updates defined in the deployment.
  • Include members of subcollection: Specifies whether members of any subcollection of the main collection receive the software updates defined in the deployment. By default, this setting is enabled and members of both the collection and subcollection are targeted for the deployment.

Recommendation

When creating deployment templates, you do not have to specify the collection as part of the template. This allows you to use the template when creating multiple deployments that target different collections.

Display/Time Settings Page

The Display/Time Settings page specifies whether the user will be notified of pending software updates, the installation progress for software updates, whether a client evaluates the deployment schedule based on local or Coordinated Universal Time (UTC), and the default duration between software update availability and deployment deadline. The following settings are available on the Display/Time Settings page:

  • Display Settings
  • Select one of the following settings:
  • Allow display notifications on clients: Specifies that display notifications are used on clients that inform end users of available software updates and progress indicators are displayed during software update installation. By default, this setting is selected and display notifications are allowed on clients.
  • Suppress display notifications on clients: Specifies that display notifications are not used on clients and progress indicators are not displayed during update installation. Software update notification icons will still display on clients and users can click this icon to see available updates.
  • Time Settings
  • Select one of the following settings:
  • Client Local Time: Specifies that clients use their local time to evaluate schedules for the time when software updates become available on clients and when deadlines enforce software update installation, if enabled.
  • UTC: Specifies that clients use UTC to evaluate schedules for the time when software updates become available on clients and when deadlines enforce software update installation. By default, this setting is selected and UTC is used to evaluate deployment schedules.
  • Duration Setting
  • Duration: Specifies the duration, which is used only when creating a deployment using a template. The deadline setting in the deployment defaults to the time when an update is available plus the configured duration setting. By default, the duration is set at 2 weeks.

Restart Settings Page

The Restart Settings page specifies the system restart behavior when a software update installs on a client computer and requires a restart to complete. The following settings are available on the Restart Settings page:

Suppress the system restart on:

  • Servers: Specifies whether to suppress a system restart on servers. This action is requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and servers will restart if required by the software update installation.
  • Workstations: Specifies whether to suppress a system restart on workstations. This action is requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and workstations will restart if required by the software update installation.

Specify whether to allow a system restart outside of maintenance windows both for servers and for workstations:

  • Allow system restart outside of maintenance windows: Specifies whether to allow system restarts for both workstations and servers outside of configured maintenance windows. By default, this setting is not enabled, and when a system restart is required for a software update installation to complete, it is initiated only when more than 10 minutes are left in the configured maintenance window.

Recommendation

Suppressing system restarts can be useful in server environments or in cases in which you do not want the computers that are installing the software updates to restart by default. However, forcing a system restart after software update installation ensures that updates fully complete, whereas suppressing post-installation restart requests can leave systems in an insecure or unstable state.

Event Generation Page

The Event Generation page specifies whether Microsoft Operation Manager alerts are disabled while the software updates install and whether an Operation Manager alert is created when a software update installation fails. The following settings are available on the Event Generation page:

  • Disable Operations Manager alerts while software updates run: Specifies that Operation Manager alerts are disabled during the software update installation. This is useful when deploying software updates will impact an application that is being monitored by Operations Manager. By default, this setting is not enabled.
  • Generate Operation Manager alert when a software update installation fails: Specifies that an Operations Manager alert is created for each software update installation failure. By default, this setting is not enabled.

Recommendation

These settings are useful when deploying software updates will impact an application that is being monitored by Operations Manager. Disabling alerts while the update is being installed will prevent alerts from triggering, such as a notification that a service has stopped, as a result of the update installation. By default, these settings are not enabled.

Download Settings Page

The Download Settings page specifies how Configuration Manager 2007 client computers will interact with distribution points when they receive a software update deployment. The following settings are available on the Download Settings page:

When a client is connected within a slow or unreliable network boundary:

  • Do not install software updates: Specifies that clients do not install software updates if they are within network boundaries that are designated as slow or unreliable. This is the default selection.
  • Download software updates from distribution point and install: Specifies that clients download the software updates from the distribution point and install them if they are within network boundaries that are designated as slow or unreliable. This is the same behavior as if the client was within a local area network boundary.

Specify whether to allow clients that are within the boundaries for one or more protected distribution points to download and install software updates from unprotected distribution points when the updates are not available from any protected distribution point:

  • Do not install software updates: Indicates that when protected distribution points do not have the software updates available for clients that are within the protected distribution point boundaries, software updates will not be installed.
  • Download software updates from unprotected distribution point and install: Indicates that when protected distribution points do not have the software updates for clients that are within the protected distribution point boundaries, the client will download the software updates from an unprotected distribution point and install them. This is the default selection.

SMS 2003 Settings Page

The SMS 2003 Settings page specifies whether to deploy software updates to SMS 2003 clients that are in the target collection. This setting is available only when all of the software updates in the deployment have been synchronized using the Inventory Tool for Microsoft Updates and have a value of Yes for the Deployable to SMS 2003 setting. The following settings are available on the SMS 2003 Settings page:

Deploy software updates to SMS 2003 clients

This setting specifies whether to deploy the software updates in the deployment to SMS 2003 clients that are in the target collection. A package, package instruction files, and advertisement are created and sent to child SMS 2003 sites to support the update installation on SMS 2003 clients. By default, this setting is not enabled.

Important
When this setting is disabled in an active deployment that includes SMS 2003 clients, this setting cannot be enabled again. The corresponding program and advertisement created for SMS 2003 clients are disabled. Before permanently disabling this deployment for SMS 2003 clients, make sure this is the intended action.

When this setting is selected, the following settings are available:

  • Collect hardware inventory immediately: Specifies whether to collect hardware inventory on SMS 2003 clients immediately following software update installation. This increases reporting accuracy but might increase system activity on the SMS 2003 clients. By default, this setting is not enabled and hardware inventory is collected during its scheduled hardware inventory cycle.
  • When a distribution point is available locally: Specifies that SMS 2003 clients handle software update installation when the updates are available on a local distribution point according to the following options:
    • Run update installation from distribution point: Specifies that the software updates are installed from the distribution point. This is the default setting.
    • Download updates from distribution point and then run installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client.
  • When a client is connected within a slow or unreliable network boundary: Specifies that SMS 2003 clients handle software update installation when the updates are available only on remote distribution points according to the following options:
    • Do not run update installation: Specifies that the software update installation will not run. This is the default setting.
    • Download updates from a remote distribution point prior to update installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client.
    • Run update installation from a remote distribution point: Specifies that the software updates are installed from the remote distribution point.

For more information about deploying software updates to SMS 2003 clients, see Planning for SMS 2003 Deployments later in this section.

Recommendation

When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. If deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

Deployment Package Page

The Deployment Package page specifies the deployment package that will be used to host the software updates in the deployment. The software updates in the deployment are downloaded and copied to the deployment package folder on the distribution points configured for the package. If all software updates in the deployment have previously been downloaded and copied to a shared package folder on the distribution point, the Deployment Package page of the wizard does not display and the deployment is automatically configured to use the package that downloaded the update. If the deployment targets SMS 2003 clients, the wizard will always ask for a deployment package regardless of whether the updates have been previously downloaded. The following settings are available on the Deployment Package page:

  • Select deployment package: Specifies that an existing package is used for the software updates in the deployment. Deployment packages that were created at the site can be selected. Packages created at a parent site are not available.
  • Create a new deployment package: Specifies that a new package is created for the software updates in the deployment. The following properties are configured as part of the deployment package:
    • Deployment package name: Specifies the name of the deployment package. The package should have a unique name, describe the package content, and is limited to no more than 50 characters.
    • Deployment package description: Specifies the description of the deployment package. The package description should describe the package contents in detail and is limited to no more than 127 characters.
    • Deployment package source: Specifies the location of the software update source files. When the deployment is generated, the source files are compressed and copied to the distribution points that are associated with the deployment package. The source location must be entered as a network path (for example, \\server\sharename\path), or the Browse button can be used to find the network location. The shared folder for the deployment package source files must be manually created before proceeding to the next page.
      Important
      The deployment package source location must not be used by another deployment or software distribution package.

      Important
      The SMS Provider computer account and the user who will actually download the software updates to the download location both require write access to the download location. Restrict access to the download location to reduce the risk of attackers tampering with the software updates source files in the download location.

    • Deployment package sending priority: Specifies the sending priority for the deployment package. The sending priority is used for the deployment package when it is sent to distribution points at child sites. Packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. Unless there is a backlog, the package will process immediately regardless of its priority.
    • Enable binary differential replication: Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings when transferring the changes for large files, compared with the traditional method in which the entire file is transferred. For more information, see About Binary Differential Replication. This setting can be modified for existing packages in the properties for the package.

Download Location Page

The Download Location page specifies whether the software updates in the deployment should be downloaded from the Internet or from the local network. The following settings are available on the Download Location page:

  • Download software updates from the Internet: Specifies that the software updates are downloaded from the location on the Internet that is defined in the software update definition. This setting is enabled by default.
  • Download software updates from a location on the local network: Specifies that the software updates are downloaded from a local directory or shared folder. Use this setting if the site server does not have Internet access or if the software updates are available on the local network. The software updates can be downloaded from any computer that has Internet access and stored in a location on the local network that is accessible from the site server. For more information, see How to Manually Download Software Updates.

Recommendation

If the software updates have already been downloaded to the Microsoft Windows Server Update Services (WSUS) server on the active software update point, you can specify Download software updates from a location on the local network and configure \\<WSUS Server Name>\<WSUSContentPath> to download the software updates from the WSUS server instead of the Internet.

Language Selection Page

The Language Selection page specifies the languages that are downloaded for the selected software updates. The software updates are downloaded only if they are available in the selected languages. Software updates that are not language specific are always downloaded.

If all software updates in the deployment have previously been downloaded and copied to the shared folder for the package on the distribution point, the Language Selection page of the wizard does not display. The deployment is automatically configured to download the updates in the languages that were previously downloaded. The following settings are available on the Language Selection page:

  • Update File: Specifies the languages for which software update files are downloaded. By default, the languages configured in the software update point properties are selected. Selecting additional languages does not add them to the configured software update point language settings. At least one language must be selected before proceeding to the next page. If a language is selected on this page that is not supported by the software update, the download will fail for the software update.

Deployment Schedule

The Deployment Schedule page specifies when a software update deployment will become active and whether software update installation will be enforced on clients. The following settings are available on the Deployment Schedule page:

Select the data and time that software updates will be made available to clients:

  • As soon as possible: Specifies that the software updates in the deployment are made available to clients as soon as possible. When the deployment is created, the machine policy is updated, clients are made aware of the deployment at their next machine policy evaluation cycle, and then the updates are available for installation.
  • Date and time: Specifies that the software updates in the deployment will not be made available to clients until a specific date and time. When the deployment is created, the machine policy is updated and clients are made aware of the deployment at their next machine policy evaluation cycle, but the software updates in the deployment are not available for installation until the configured date and time.

Specify whether the software updates should automatically install on clients at a configured deployment deadline:

  • Do not set a deadline for software update installation: Specifies that the software updates in the deployment are optional and do not require automatic installation by a specific date and time.
  • Set deadline for software update installation: Specifies that the software updates in the deployment are mandatory and require automatic installation by a specific date and time. If the deadline is reached and the software updates in the deployment are still required on the client, the update installation will automatically be initiated. When a deadline is configured, the following additional settings are available:
    • Enable Wake On LAN: Specifies whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more updates in the deployment. The computers that are not running are started at the deadline so the update installation can be initiated. Clients that do not require any updates in the deployment are not started. By default, this setting is not enabled and available only when there is a deadline configured for the deployment.
    • Ignore maintenance windows and install immediately at deadline: Specifies whether the software updates in the deployment are installed at the deadline regardless of a configured maintenance window. By default, this setting is not enabled and available only when there is a deadline configured for the deployment.

More Information

Setting a deadline makes the deployment mandatory, and it enforces the software update installation on client computers by the configured date and time. If the deadline is reached and the software update deployment has not yet run on the client computer, the installation starts automatically whether or not a user is logged on to the computer. A system restart can be enforced if it is necessary for the software update installation to complete.

On client computers, display notifications will appear that inform the user that one or more software updates are ready to install and the date for the earliest deadline time displays. For example, if there are two deployments with deadlines that are two days apart, the deployment deadline that comes first displays in the notifications to users. After the software updates have been installed for the deployment with the earliest deadline, the client computer will continue to receive notifications, but the deadline will now display the deadline for the second deployment. SMS 2003 clients in the Configuration Manager hierarchy will also use the configured deadline date and time for deployments targeted to them.

NAP Evaluation Page

The NAP Evaluation page specifies whether the software updates in this deployment are required for compliance when using Network Access Protection (NAP). Enable NAP evaluation to include the software updates in a NAP policy that will become effective on NAP-capable clients based on the configured schedule. When the policy becomes effective, NAP-capable clients might have restricted access until they comply with the selected software update. Network restriction and remediation are dependent on how the policies are configured on the Windows Network Policy Server. The following settings are available on the Deployment Schedule page:

  • Enable NAP evaluation: Specifies whether the software update is included in the NAP policy and evaluated on NAP-capable clients. When this setting is selected, the following settings are available:
  • Specify when these settings become effective:
  • As soon as possible: Specifies that the software update is included in the NAP policy, which becomes effective on NAP-capable clients as soon as possible.
  • Date and time: Specifies that the software update is included in the NAP policy, which becomes effective on NAP-capable clients on the specified date and time. The default date and time value is determined by adding 14 days to the deployment deadline date and time that was configured on the Deployment Schedule page.

The NAP evaluation page of the Deploy Software Updates Wizard does not display unless NAP is configured for the site. For more information, see About Network Access Protection in Configuration Manager Hierarchies.

Using Deployment Templates When Creating Deployments

Deployment templates store many of the deployment properties that might not change from deployment to deployment, and they can save a lot of time for administrators when creating software update deployments. Templates can be created for different deployment scenarios in your environment. For example, you can create a template for expedited software update deployments and planned deployments. The template for the expedited deployment can suppress display notifications on client computers, set the deadline for 0 days from the deployment schedule, and allow system restarts outside of maintenance windows. The template for a planned deployment can allow display notifications on client computers and set the deadline for 14 days from the deployment schedule.

Pre-creating deployment templates for typical deployment scenarios in your environment allows you to create deployments using templates that populate many of the deployment properties that are most often static for the particular deployment scenario. Using the deployment template also reduces the number of wizard pages in the Deploy Software Updates Wizard by up to seven pages, which saves time and helps to prevent mistakes when configuring the deployment. The deployment settings from the following wizard pages can be configured in a deployment template:

  • Collection
  • Display/Time Settings
  • Restart Settings
  • Event Generation
  • Download Settings
  • SMS 2003 Settings

If a deployment template is not used when creating a deployment, the properties are manually entered and can optionally be saved as a deployment template within the wizard and used in future deployments. For more information, see About Deployment Templates in Software Updates.

Maintenance Windows

When maintenance windows are configured on collections that will be targeted for software update deployments, you should consider the following:

  • Each software update is given a default setting of 35 minutes to install and restart, if necessary (75 minutes for service packs). When the available time left in a maintenance window is less than this, the software update installation will not start until the next maintenance window. When planning a deployment to a collection with maintenance windows, take these defaults into consideration. For example, if a 2-hour maintenance window is configured on the collection and there are four software updates in a deployment, only three software updates will be installed during the first maintenance window and the last update will be installed during the second maintenance window.
  • The following deployment settings affect how software updates are installed on client computers that have maintenance windows:
    • Allow system restart outside of maintenance windows: Specifies whether to allow system restarts for both workstations and servers outside of configured maintenance windows. By default, this setting is not enabled. This setting is beneficial when you want your software update installation to complete on client computers as soon as possible. When this setting is not specified, a system restart will not be initiated if the maintenance window ends in 10 minutes or less. This could prevent the installation from completing and leave the client computer in a vulnerable state until the next maintenance window. This setting is available on the Restart Settings page of the Deployment Template Wizard or Deploy Software Updates Wizard.
    • Ignore maintenance windows and install immediately at deadline: Specifies whether the software updates in the deployment are installed at the deadline regardless of a configured maintenance window. By default, this setting is not enabled and is available only when there is a deadline configured for the deployment. This setting is beneficial when there are software updates that must be installed on client computers as soon as possible, such as the updates in an expedited deployment. This setting is available on the Schedule page of the Deploy Software Updates Wizard.

For more information about maintenance windows and planning for them when using software updates, see the "Planning for Maintenance Windows" section of Planning for Software Updates Server Settings.

Deployment Actions that Will Result in a Package Refresh

Every time a software update is added to a deployment that targets both Configuration Manager and SMS 2003 client computers, or when the start time setting in the deployment is modified, the package source will be updated, the deployment package version will be incremented, and the distribution points configured for the package will be refreshed. Adding software updates to a deployment that does not deploy software updates to SMS 2003 clients will use the update source files from a deployment package that contains the software updates and the package is not refreshed.

Restart Behavior on Client Computers

When software update installations have run and require a restart for them to complete, new software updates that become available are not shown and the notification area icon will not be visible on client computers. A system restart will be automatically initiated on client computers when the deadline has been reached on mandatory deployments. When multiple deployments have the same deadline, the software updates will all be installed at the deadline and then one system restart will be initiated.

Note
Some software updates must be installed exclusively, and a system restart might be initiated for these software updates before installing other updates in the same deployment or in deployments with the same deadline.

Hiding Deployments from End Users

To hide software update deployment and installation on client computers, use the Hide all deployments from end users setting on the Update Installation tab of the Software Updates Client Agent properties. This setting specifies that display notifications and notification area icons for the software updates in all deployments will not display on client computers. This setting is not enabled by default. When this setting is enabled, the software updates only in mandatory deployments are available for installation and the silent installation will initiate by the configured deadline. Hidden deployments will become visible on client computers when this setting is not enabled. For more information, see How to Hide Deployments on Client Computers.

Software Updates with License Terms

When a software update has associated Microsoft Software License Terms and the terms have not yet been accepted, the Review/Accept License Terms dialog box displays before opening the Deploy Software Updates Wizard. After the license terms for a software update have been accepted, the wizard opens and the software updates can be deployed. Future deployments for the software update will not require license terms acceptance. If the license terms are declined, the process is cancelled. The license terms can also be accepted from the Configuration Manager console by highlighting one or more software updates, and then initiating the Review/Accept License Terms action.

Delegated Administration

Using an update list provides the ability to delegate the administration for deploying software updates. For example, an administrator at the central site can select the software updates that need to be deployed and add the updates to an update list. Administrators at the site or child sites, with restricted object rights, can then use the update list and deploy the updates in the update list to an appropriate collection. For more information, see the "Delegated Administration" section of About Update Lists in Software Updates.

Planning for SMS 2003 Deployments

If SMS 2003 clients are in the Configuration Manager 2007 hierarchy, additional steps must be taken and special considerations should be made before deploying software updates to them. For more information about the steps required for software updates to continue to work for SMS 2003 clients after a site upgrade, see Planning the SMS 2003 Software Updates Upgrade.

What Software Updates Can Be Deployed to SMS 2003 Clients

All software updates that have been synchronized using the Inventory Tool for Microsoft Updates can be deployed to SMS 2003 clients. After the Microsoft Update catalog has been synchronized, the Deployable to SMS 2003 setting is set to Yes. The option to deploy to SMS 2003 clients is available only when every update in the deployment is deployable to SMS 2003.

Migrated Software Updates Metadata After an Upgrade

During the upgrade process, Configuration Manager 2007 Setup appends (LEGACY) to the title for each software update. This helps you identify software updates that were migrated among the new software updates metadata that is synchronized after the upgrade. Software updates with (LEGACY) in the title should not be deployed to clients and are only migrated for software update distributions that were migrated and for reporting purposes. You can run a script to hide these software updates in the Configuration Manager console so only deployable software updates are displayed. A sample script is available from the Microsoft Script Center Script Repository (http://go.microsoft.com/fwlink/?LinkId=102377).

Note
Migrated software updates that are in a software update deployment that was also migrated will not be hidden until the migrated deployment is deleted or the updates are removed from the deployment.

Software Updates Might Be Downloaded in Deploy Software Updates Wizard When They Have Already Been Downloaded

When creating a software update deployment that will target SMS 2003 clients, and at least one software update has not yet been downloaded, all of the software updates not in the package configured for the deployment will be downloaded even when they were previously downloaded to another package. When all software updates have been downloaded prior to creating the deployment, when the downloaded updates were previously downloaded to the package selected in the deployment, or when the Deploy software updates to SMS 2003 clients setting is not selected in the deployment, the wizard downloads only the software updates that have not been previously downloaded. To prevent this behavior, download the software updates that have not yet been downloaded prior to creating the deployment by using the Download Updates Wizard or the Update List Wizard.

Using Deployment Templates When Creating SMS 2003 Deployments

If all the software updates that are selected for deployment are deployable to SMS 2003, you can select a deployment template that has the Deploy software updates to SMS 2003 clients setting enabled. If at least one software update is not deployable to SMS 2003 clients, templates that deploy updates to SMS 2003 clients are not available for use when creating the deployment.

Selective Download Is Not Available for SMS 2003 Clients

Configuration Manager 2007 client computers download only the software updates from a deployment package that they require. This allows administrators to create large deployment packages that support multiple deployments. By default, when deploying software updates to SMS 2003 clients, the software update installation is run directly from a distribution point. When it is configured to download software updates and then install on the SMS 2003 Settings page of the Deploy Software Updates Wizard, the SMS 2003 client will download all updates contained in the deployment package regardless of applicability. If a deployment package contains a lot of updates that might not be applicable to the SMS 2003 clients, it is recommended that you run the update installation directly from the distribution point.

See Also

Tasks

How to Deploy Software Updates
How to Deploy Software Updates to SMS 2003 Clients
How to Create a Deployment Template
How to Hide Deployments on Client Computers
How to Manually Download Software Updates

Concepts

About Deployment Templates in Software Updates
About Network Access Protection in Configuration Manager Hierarchies
About Software Update Deployments
About the Deploy Software Updates Wizard
About Update Lists in Software Updates
Administrator Checklist: Assessing and Deploying Software Updates
Administrator Workflows for Software Updates
Planning the SMS 2003 Software Updates Upgrade
Planning for the Software Update Point Settings
Planning for Software Updates Server Settings

Other Resources

Administrator Checklists for Software Updates


Configuring Software Updates

Before software update compliance assessment data is displayed in the Configuration Manager 2007 console and before software updates can be deployed to client computers, the software update point must be installed and configured, and the configuration settings for other software updates components should be considered. This section provides links to installation and configuration procedures for software updates components.

Click the related link for detailed information about the associated software updates configuration task.

In This Section

How to Configure the Software Updates Client Agent

Specifies the procedures for configuring the Software Updates Client Agent.

How to Install Windows Server Update Services 3.0

Specifies the procedures for installing Windows Server Update Services (WSUS) 3.0 on the server.

How to Install the Windows Server Update Services 3.0 Administration Console

Specifies the procedures for installing the WSUS 3.0 Administration console using the wizard or installed silently from a command line.

How to Add the Web Server Certificate to the Custom WSUS Web Site

Specifies the procedures for adding the Web server certificate to the WSUS Web site.

How to Configure the WSUS Web Site to Use SSL

Specifies the procedures to configure SSL on the WSUS server.

How to Determine the Port Settings Used by WSUS

Specifies the procedure to determine the port settings used by WSUS.

How to Configure a Firewall for Software Updates

Specifies the settings required by software updates when using a firewall.

How to Add the Software Update Point Site Role to a Site System

Specifies the procedure to create a non-active software update point site role on a site system server.

How to Create and Configure an Active Software Update Point

Specifies the procedure to create an active software update point site role on a site system server and configure the software update point properties.

How to Create and Configure an Active Software Update Point on a Secondary Site

Specifies the procedure to create a software update point site role on a site system server on a secondary site.

How to Create and Configure an Active Internet-Based Software Update Point

Specifies the procedure to create an active Internet-based software update point site role on a site system server and configure the software update point properties.

How to Configure the Active Software Update Point Component to Use an NLB Cluster

Specifies the procedure to configure the active software update point to use a software update point site system NLB cluster.

How to Configure Software Updates Synchronization

Specifies the procedure to configure synchronization for software updates.

How to Install System Center Updates Publisher

Specifies the procedure to install Updates Publisher.

How to Check the Windows Update Agent Version on Clients

Specifies the procedure to verify the Windows Update Agent version.

How to Install the Windows Update Agent on Client Computers

Specifies the procedure to install the Windows Update Agent on client computers.

How to Configure the Languages for Software Updates

Specifies the procedure to configure the languages for software updates and update properties.

How to Install and Configure the Inventory Tool for Microsoft Updates

Specifies the procedure to install the Inventory Tool for Microsoft Updates, monitor the synchronization process for the Microsoft Update catalog, and verify that the installation completed successfully.

How to Configure NAP Evaluation for Software Updates

Specifies several procedures about how to enable NAP evaluation for software updates.

How to Configure Proxy Settings Used When Downloading Software Update Files

Specifies the procedure to configure the proxy settings used when downloading software update files when the default settings are not sufficient.

How to Enable CRL Checking for Software Updates

Specifies how to enable CRL checking for software updates.

See Also

Concepts

Prerequisites for Software Updates

Other Resources

Overview of Software Updates
Planning for Software Updates
Tasks for Software Updates
Troubleshooting Software Updates Issues


How to Configure the Software Updates Client Agent

When the Software Updates Client Agent in Configuration Manager 2007 is enabled, a policy that requests that the software updates components are enabled on client computers assigned to the site. These components work together to perform compliance assessment scans, install software updates at their configured deadline or when they are manually initiated, and reevaluate whether previously installed software updates are still installed, and if not, install them again. The Software Updates Client Agent properties are site wide client settings.

Note
Before software updates can be deployed, the software updates environment must be prepared and the components required by software updates must be configured. For more information, see the Administrator Checklists for Software Updates.

Use the following procedure to enable the Software Updates Client Agent and configure the client agent properties.

To configure the Software Updates Client Agent

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. Right-click Software Updates Client Agent, and then click Properties.

  3. On the General tab, configure the following settings:

    • Enable Software Updates on Clients: Verify that this setting is selected to enable the Software Updates Client Agent, which is enabled and installed on client computers by default. If the client agent is disabled, the client agent components are put into a dormant state but not removed on clients. Reenabling the Software Updates Client Agent will initiate a policy to request that the components on clients be enabled. The Software Updates Client Agent is configured on a site-by-site basis and only affects clients assigned to that site. Disabling the Software Updates Client Agent at a site prevents software update compliance assessment and prevents software updates from being deployed.
    • Scan schedule: Specifies how often a scan for software updates compliance is initiated on client computers. By default, a simple schedule is configured to run the scan for compliance every 7 days and the site database is updated with any changes since the last scan.
      Note
      When a custom schedule is selected, the actual start time on client computers is the start time plus a random amount of time up to 2 hours. This prevents client computers from initiating the scan and connecting to Windows Server Update Services (WSUS) on the active software update point server at the same time.

  4. Click the Update Installation tab, and configure the following settings:

    • Enforce all mandatory deployments: specifies whether to enforce all mandatory software update deployments that have deadlines within a specified period of time. When a deadline is reached for a mandatory software update deployment, installation is initiated on clients for the updates defined in the deployment. This setting determines whether to also initiate the installation for software updates defined in other mandatory deployments that have a configured deadline within the specified period of time. The acceptable values allowed are 1 to 23 hours or 1 to 365 days.
    • Hide all deployments from end users: Specifies that display notifications and notification area icons for the software updates in all deployments will not display on client computers. This setting is not enabled by default. When this setting is enabled, the software updates only in mandatory deployments are available for installation and the silent installation will initiate by the configured deadline. Hidden deployments will become visible on client computers when this setting is not enabled.

  5. Click the Deployment Re-Evaluation tab to configure the schedule that specifies how often the Software Updates Client Agent reevaluates software updates for installation status. If the updates are still required, they are reinstalled if they are no longer found on client computers. By default, a simple schedule is configured to run deployment reevaluation every 7 days.

    Note
    When a custom schedule is selected, the actual start time on client computers is the start time plus a random amount of time up to 2 hours. This prevents client computers from initiating the scan and connecting to Windows Server Update Services (WSUS) on the active software update point server at the same time.

  6. Click OK to exit the properties dialog box.

See Also

Concepts

About the Software Updates Client Agent

Other Resources

Software Updates Client Agent Properties
Configuring Software Updates


How to Install Windows Server Update Services 3.0

Before a software update point can successfully be installed and configured on a site system server in Configuration Manager 2007, Windows Server Update Services (WSUS) 3.0 must be installed on the server.

Important
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

Note
When the active software update point for a site is installed on a remote site system server, the WSUS 3.0 Administration Console must be installed on the site server. For more information, see How to Install the Windows Server Update Services 3.0 Administration Console.

Use the following procedure to plan for the WSUS 3.0 structure and to install WSUS 3.0 on a server that will be configured as a software update point.

To install WSUS 3.0 using the Setup wizard

  1. Review Determine the Software Update Point Infrastructure to determine how many WSUS 3.0 servers need to be installed at the site and where in your environment they should be installed.

  2. Download the WSUS installer file (WSUS3Setupx<platform>.exe) from the Windows Server Update Services Home Web page (http://go.microsoft.com/fwlink/?LinkId=92650) and save it to a location accessible from the server that will install WSUS.

  3. Double-click the WSUS installation file, WSUS3Setupx<platform>.exe.

  4. Click Next, select Full server installation including Administration Console, and then click Next.

  5. Click I accept the terms of the License agreement, and then click Next.

  6. Select Store updates locally, specify the path, and then click Next.

  7. Specify the software used to manage the WSUS 3.0 database. You can have WSUS install Windows Internal Database (Microsoft SQL Server 2005 Embedded Edition), or you can configure WSUS to use SQL Server 2005 on a local or remote computer. By default, Install Microsoft SQL Server 2005 Embedded Edition (Windows) on this computer is selected. WSUS will create the Windows Internal Database or test the connection to the existing Microsoft SQL 2005 server and instance. Click Next.

  8. Specify whether to use the existing Internet Information Services (IIS) Default Web site or to create a custom WSUS 3.0 Web site. When using the WSUS server for a software update point, it is recommended that Create a Windows Server Update Services 3.0 Web site is selected. By default, the custom WSUS Web site uses HTTP port 8530 and HTTPS (SSL) port 8531. Click Next.

  9. Review the specified settings, and then click Next. When the wizard completes, click Finish.

    Important
    The WSUS 3.0 configuration wizard automatically starts after the Setup wizard completes. Because Configuration Manager 2007 manages the WSUS settings, you should exit the configuration wizard after it opens.

See Also

Tasks

How to Install the Windows Server Update Services 3.0 Administration Console

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
Administrator Workflows for Software Updates
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings
Prerequisites for Software Updates


How to Install the Windows Server Update Services 3.0 Administration Console

The Microsoft Windows Server Update Services (WSUS) 3.0 administrator console is required on the Configuration Manager 2007 site server to allow the site server and remote Configuration Manager consoles to configure and synchronize software update points. The WSUS 3.0 Administration console can be installed using the wizard or installed silently from a command line.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

Use one of the following procedures to install the WSUS 3.0 administrator console on the Configuration Manager site server.

To install the WSUS 3.0 Administration console using the Setup wizard

  1. Download the WSUS installer file (WSUSSetup.exe) from the Windows Server Update Services Home Web page (http://go.microsoft.com/fwlink/?LinkId=88321).

  2. Double-click the WSUS installation file, WSUSSetup.exe.

  3. Click Next, select Administration Console Only, and then click Next.

  4. Click I accept the terms of the License agreement, and then click Next.

  5. If the Required Components to use administration UI page displays, click Next. The Microsoft Report Viewer 2005 Redistributable is required to open the WSUS 3.0 Administration console UI, which is not required when using Configuration Manager 2007.

  6. Click Finish when the wizard completes.

  7. Click the Start button, click All Programs, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0 to verify that the console installed successfully. To verify connectivity connect to the WSUS server that will be configured as the active software update point. Close the console after verifying that has been installed.

To install the WSUS 3.0 Administration console silently

  1. Download the WSUS installer file (WSUSSetup.exe) from the Windows Server Update Services Home Web page (http://go.microsoft.com/fwlink/?LinkId=88321).

  2. Install the WSUS 3.0 Administration console on the site server by running the following command line in the folder where the WSUS installer file was downloaded:

    WSUSSetup.exe /q CONSOLE_INSTALL=1

    The WSUS 3.0 Administration console installs silently on the site server.

  3. Click the Start button, click All Programs, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0 to verify that the console installed successfully. To verify connectivity connect to the WSUS server that will be configured as the active software update point. Close the console after verifying that has been installed.

See Also

Tasks

How to Install Windows Server Update Services 3.0

Concepts

About the Software Update Point
Administrator Workflows for Software Updates
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings
Prerequisites for Software Updates

Other Resources

Administrator Checklists for Software Updates


How to Add the Web Server Certificate to the Custom WSUS Web Site

Topic Last Updated—August 2008

When the Configuration Manager 2007 site server is in native mode or when the active software update point is configured to use Secure Sockets Layer (SSL), and when a custom Web site is used to host the Microsoft Windows Server Update Services (WSUS) 3.0 services, you must configure the WSUS Administration Web site to use a Web server signing certificate.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

After it is configured, the certificate is added to the Trusted Root Certification Authorities store on the local computer. This procedure steps through the process of using the same certificate that is used by the Configuration Manager site systems for authentication and encryption when the site is in native mode, but you can use a different Web server signing certificate as long as the certificate is added to the WSUS Administration Web site and that the certificate resides in the Trusted Root Certification Authorities store on client computers. The Web server certificate can be installed on the Web site by using a script or the Internet Information Services (IIS) Manager console.

Important
The WSUS Administration Web site must be assigned a signing certificate where the Subject Name or Subject Alternate Name contains the Internet fully qualified domain name (FQDN).

Use one of the following procedures to add the Web server signing certificate to the WSUS Web site using IIS.

To add the signing certificate to the WSUS Web site in IIS 6.0

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Expand Web Sites, right-click the WSUS Administration Web site, and then click Properties.

  3. Click the Directory Security tab, and then click Server Certificate.

  4. On the Welcome to the Web Server Certificate Wizard page, click Next.

  5. On the Server Certificate page, click Assign an existing certificate, and then click Next.

  6. On the Available Certificates page, select the Web server certificate that was requested when configuring the site for native mode. You can identify the certificate by the Intended Purpose field that has a value of Server Authentication and the Friendly Name that was configured when requesting the certificate. Click Next.

    Note
    The site server will use either the default Web site or a Configuration Manager custom Web site (SMSWeb), depending on how the site was configured. To find the certificate used by the other site systems, view the certificate by going to the Web site properties, and then click View Certificate on the Directory Security tab. Use this certificate when selecting certificates for the WSUS Web page.

  7. On the SSL Port page, configure the port number for SSL (HTTP). When using the WSUS custom Web site, the default SSL port number is 8531. For the step-by-step procedures on how to find the port number, see How to Determine the Port Settings Used by WSUS. Click Next.

  8. On the Certificate Summary page, click Next.

  9. On the Completing the Web Server Certificate Wizard page, click Finish.

  10. Click OK to close the properties for the Web site.

  11. Close IIS Manager.

To add the signing certificate to the WSUS Web site in IIS 7.0

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Expand Sites, right-click the WSUS Web site, and then click Edit Bindings.

  3. In the Site Binding dialog box, select the https binding, and click Edit to open the Edit Site Binding dialog box.

  4. Select the appropriate Web server certificate in the SSL certificate box, and then click OK.

  5. Click Close to exit the Site Bindings dialog box, and then click OK to close Internet Information Services (IIS) Manager.

See Also

Tasks

How to Determine the Port Settings Used by WSUS
How to Install Windows Server Update Services 3.0

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Benefits of Using Native Mode
Certificate Requirements for Native Mode
Deploying the Web Server Certificate to Network Load Balanced Site Systems
Deploying the Web Server Certificates to Site System Servers
Planning for the Software Update Point Settings


How to Configure the WSUS Web Site to Use SSL

Topic Last Updated—August 2008

When a Configuration Manager 2007 site server is in native mode, or when the active software update point is configured to use Secure Sockets Layer (SSL), there are five virtual roots that must be configured to use a secured channel on the active software update point server and active Internet-based software update point server, if configured. The virtual roots are located under the Web site used by the Windows Server Update Services (WSUS) server, and they are modified by using the Internet Information Services (IIS) Manager. After the virtual roots have been configured, you must run the WSUSUtil tool to let the health monitoring component of WSUS know that it should use SSL.

Use one of the following procedures to configure SSL on the WSUS server.

To configure SSL on the WSUS server by using IIS 6.0

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Expand Web Sites, and then expand the Web site for the WSUS server. It is recommended that the WSUS Administration custom Web site be used, but the default Web site might have been chosen when WSUS was being installed.

  3. Perform the following steps on the APIRemoting30, ClientWebService, DSSAuthWebService, ServerSyncWebService, and SimpleAuthWebService virtual directories that reside under the WSUS Web site:

    1. Right-click the Web site or virtual directory, and then click Properties.
    2. Click the Directory Security tab, and then click Edit in the Secure Communications section.
    3. Select Require secure channel (SSL), and then click OK.
    4. Click OK to close the properties for the virtual root.

  4. Close Internet Information Services (IIS).

  5. Run the following command from <WSUS Installation Folder>\Tools: WSUSUtil.exe configuressl <subject name in the signing certificate>.

To configure SSL on the WSUS server by using IIS 7.0

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Expand Sites, and then expand the Web site for the WSUS server. It is recommended that the WSUS Administration custom Web site be used, but the default Web site might have been chosen when WSUS was being installed.

  3. Perform the following steps on the APIRemoting30, ClientWebService, DSSAuthWebService, ServerSyncWebService, and SimpleAuthWebService virtual directories that reside under the WSUS Web site:

    1. In Features View, double-click SSL Settings.
    2. On the SSL Settings page, select Require SSL.
    3. In the Actions pane, click Apply

  4. Close Internet Information Services (IIS) Manager.

  5. Run the following command from <WSUS Installation Folder>\Tools: WSUSUtil.exe configuressl <subject name in the signing certificate>.

See Also

Tasks

How to Install Windows Server Update Services 3.0

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Benefits of Using Native Mode
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings


How to Determine the Port Settings Used by WSUS

Topic Last Updated—August 2008

When creating and configuring an active software update point or active Internet-based software update point in Configuration Manager 2007, the port settings used by the Microsoft Windows Server Update Services (WSUS) 3.0 server must be specified.

Use one of the following procedures to determine the port settings used by WSUS.

To determine the port settings in IIS 6.0

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Expand Web Sites, right-click the Web site for the WSUS server, and then click Properties. It is recommended that the WSUS custom Web site be used, but the default Web site might have been chosen when WSUS was being installed.

  3. Click the Web Site tab. The HTTP port setting is displayed in TCP port, and the HTTPS port setting is displayed in SSL port.

To determine the port settings used in IIS 7.0

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Expand Sites, right-click the Web site for the WSUS server, and then click Edit Bindings. It is recommended that the WSUS custom Web site be used, but the default Web site might have been chosen when WSUS was being installed. The port is displayed for each binding.

See Also

Tasks

How to Configure a Firewall for Software Updates
How to Install Windows Server Update Services 3.0

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Planning for the Software Update Point Settings


How to Configure a Firewall for Software Updates

When there is a firewall between the Configuration Manager 2007 active software update point and the Internet, an active software update point and its upstream server, or an active Internet-based software update point and the active software update point for the site, the firewall might need to be configured to accept the HTTP and HTTPS ports used for the WSUS Web site. On the firewall between the active software update point and the Internet, you can also restrict access to limited domains.

Note
The steps for configuring the firewall are meant for a corporate firewall positioned between WSUS and the Internet, or between an active software update point or an active Internet-based software update point and the upstream server. Because WSUS initiates all its network traffic, there is no need to configure Windows Firewall on the WSUS server.

Use the following procedure to configure the firewall for software updates.

To configure the firewall for software updates

  1. Configure the firewall to allow communication for the HTTP and HTTPS ports used by the WSUS server. By default, a WSUS server that is configured for the default Web site uses port 80 for HTTP and port 443 for HTTPS. By default, the WSUS server uses port 8530 for HTTP and port 8531 for HTTPS if it is using the WSUS custom Web site. For more information, see How to Determine the Port Settings Used by WSUS.

  2. If your organization does not allow the ports and protocols used by the WSUS Web site to be open to all addresses, you can restrict access to the following domains so that WSUS and Automatic Updates can communicate with Microsoft Update:

    • http://windowsupdate.microsoft.com
    • http://*.windowsupdate.microsoft.com
    • https://*.windowsupdate.microsoft.com
    • http://*.update.microsoft.com
    • https://*.update.microsoft.com
    • http://*.windowsupdate.com
    • http://download.windowsupdate.com
    • http://download.microsoft.com
    • http://*.download.windowsupdate.com
    • http://test.stats.update.microsoft.com
    • http://ntservicepack.microsoft.com

  3. If there is an active Internet-based software update point or if there are child sites with an active software update point, the following addresses also need to be added to any firewall that is between the servers:

    Child site active software update point

    • http://<FQDN for active software update point on child site>
    • https://<FQDN for active software update point on child site>
    • http://<FQDN for active software update point on parent site>
    • https://<FQDN for active software update point on parent site>

    Active Internet-based software update point

    • http://<FQDN for active software update point for site>
    • https://<FQDN for active software update point for site>
    • http://<FQDN for active Internet-based software update point>
    • https://<FQDN for active Internet-based software update point>

See Also

Tasks

How to Determine the Port Settings Used by WSUS
How to Install Windows Server Update Services 3.0

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Configuring Software Updates


How to Add the Software Update Point Site Role to a Site System

The software update point in Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a site system server that has Microsoft Windows Server Update Services (WSUS) 3.0 installed. For more information about installing WSUS 3.0, see How to Install Windows Server Update Services 3.0.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

There can be multiple site system servers with the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in native mode, an additional active Internet-based software update point can be assigned to a remote site system server that allows communication from only Internet-based client computers. Additionally, if the active software update point is configured as a Network Load Balancing (NLB) cluster, a site system server with the software update point site role should be created for each server in the NLB cluster. For information that will help you to determine the software update point configuration in your environment, see Planning for the Software Update Point Installation.

Use the following procedure to create a non-active software update point site role on a site system server.

Note
For more information about creating and configuring an active software update point, see How to Create and Configure an Active Software Update Point.

To create a software update point site system role

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Determine whether to create a new site system server or add the software update point site system role to an existing site system server, and then follow the associated step:

    • To create a new site system server and add the software update point site role: Right-click Site Systems, click New, and then click Server.
    • To add the software update point site role to an existing site system server: Right-click the site system server name, and then click New Roles.

  3. Configure the general site system settings for the site system server. By default, the computer account for the site server will connect to the site system computer to install the software update point components. When the computer account for the site server has access to the site system server and the site is in mixed mode, the settings on this page are optional. For more information, see New Site System Server Wizard: General Page. When the computer account does not have access to the site system server or when the site is in native mode, the following settings should be configured:

    • Specify a fully qualified domain name (FQDN) for this site system on the intranet: This setting must be configured for the active software update point site system when the site server is in native mode or when it is in mixed mode and uses Secure Sockets Layer (SSL). By default, this setting must be configured.
    • Specify an Internet-based fully qualified domain name for this site system: This setting must be configured for the active software update point if it accepts Internet-based client connectivity or for the active Internet-based software update point site system.
    • Use another account for installing this site system: This setting must be configured when the computer account for the site server does not have access to the remote site system.
    • Allow only site server initiated data transfers from this site system: This setting must be specified when the remote site system does not have access to the inboxes on the site server. This allows a site system from a different domain or forest to store the files that need to be transferred to the site server. The site server will periodically connect to the remote site system and retrieve the files. The Internet-based software update point might require this setting to be enabled.

    Click Next.

  4. Select Software update point, and then click Next.

  5. Specify whether the site server will use a proxy server when connecting to the software update point, and then click Next.

  6. Specify whether this site system should be configured as the active software update point. For this procedure, do not select Use this server as the active software update point; instead, click Next and then click Close to exit the wizard. For information about how to create an active software update point, see How to Create and Configure an Active Software Update Point.

  7. Open SUPSetup.log in <ConfigMgrInstallationPath>\Logs to monitor the installation progress for the software update point. When the installation completes, Installation was successful is written to the log file.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Install Windows Server Update Services 3.0

Reference

New Site System Server Wizard: General Page

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


How to Create and Configure an Active Software Update Point

The software update point in Microsoft System Center Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a site system server that has Microsoft Windows Server Update Services (WSUS) 3.0 installed. For more information about installing WSUS 3.0, see How to Install Windows Server Update Services 3.0.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

There can be multiple site system servers with the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in native mode, an additional active Internet-based software update point can be assigned to a remote site system server that allows communication from only Internet-based client computers. Additionally, if the active software update point is configured as a Network Load Balancing (NLB) cluster, a site system server with the software update point site role should be created for each server in the NLB. For information that will help you to determine the software update point configuration in your environment, see Determine the Software Update Point Infrastructure.

Use the following procedure to create an active software update point site role on a site system server and configure the software update point properties.

Note
For more information about creating and configuring an active Internet-based software update point, see How to Create and Configure an Active Internet-Based Software Update Point.

To configure a software update point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Determine whether to create a new site system server or add the software update point site system role to an existing site system server, and then follow the associated step:

    • To create a new site system server and add the software update point site role: Right-click Site Systems, click New, and then click Server.
    • To add the software update point site role to an existing site system server: Right-click the site system server name, and then click New Roles.

  3. Configure the general site system settings for the site system server. By default, the computer account for the site server will connect to the site system computer to install the software update point components. When the computer account for the site server has access to the site system server and the site is in mixed mode, the settings on this page are optional. For more information, see New Site System Server Wizard: General Page. When the computer account does not have access to the site system server or when the site is in native mode, the following settings should be configured:

    • Specify a fully qualified domain name (FQDN) for this site system on the intranet: This setting must be configured for the active software update point site system when the site server is in native mode or when it is in mixed mode and uses Secure Sockets Layer (SSL). By default, this setting must be configured.
    • Specify an Internet-based fully qualified domain name for this site system: This setting must be configured for the active software update point if it accepts Internet-based client connectivity or for the active Internet-based software update point site system.
    • Use another account for installing this site system: This setting must be configured when the computer account for the site server does not have access to the remote site system.
    • Allow only site server initiated data transfers from this site system: This setting must be specified when the remote site system does not have access to the inboxes on the site server. This allows a site system from a different domain or forest to store the files that need to be transferred to the site server. The site server will periodically connect to the remote site system and retrieve the files. The Internet-based software update point might require this setting to be enabled.

    Click Next.

  4. Select Software update point, and then click Next.

  5. Specify whether the site server will use a proxy server when connecting to the software update point, and then click Next.

  6. Select Use this server as the active software update point, and then specify the port settings configured for the WSUS Web site on this site system.

    Important
    The site server will fail to communicate with the WSUS server if the port settings are not correct. For information about how to find this information, see How to Determine the Port Settings Used by WSUS.

  7. Specify the synchronization source for the active software update point using one of the following settings:

    • Synchronize from Microsoft Update: The software update point that is highest in the Configuration Manager 2007 hierarchy (most often the central site) must be configured to use this setting.
    • Synchronize from an upstream update server: The active software update points on all child sites and all Internet-based software update points should use this setting. The wizard selects this setting by default if this active software update point meets the criteria.
    • Do not synchronize from Microsoft Update or an upstream update server: Use this setting when this active software update point cannot connect to the upstream update server. Most often, this setting will be used by an active Internet-based software update point that has no access to the active software update point. The active software update point on the central site cannot use this setting. For more information about synchronizing software updates when this setting is selected, see How to Synchronize Updates Using Export and Import.

  8. Keep the default setting Do not create WSUS reporting events, and then click Next.

  9. Specify whether to synchronize software updates on a schedule by selecting Enable synchronization on a schedule. When this setting is not selected, synchronization can be initiated manually by running the Run Synchronization action in the Configuration Manager. Click Next.

    Note
    Scheduled synchronizations perform full synchronization, but using the Run Synchronization action performs only delta synchronization.

  10. Specify the update classifications for which the software updates will be synchronized, and then click Next.

  11. Specify the products for which the software updates will be synchronized, and then click Next.

  12. Specify the languages for which the software updates will be synchronized, click Next, click Next, and then click Close.

  13. Open SUPSetup.log in <InstallationPath>\Logs to monitor the installation progress for the software update point. When the installation completes, Installation was successful is written to the log file.

  14. Open WCM.log in <InstallationPath>\Logs to verify that the connection to the WSUS server was successful. When the connection to the WSUS server has been established and the WSUS components have been verified, There are no unhealthy WSUS Server components on WSUS Server servername and Successfully checked database connection on WSUS server servername are written to the log file.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Configure Software Updates Synchronization
How to Create and Configure an Active Internet-Based Software Update Point
How to Create and Configure an Active Software Update Point on a Secondary Site
How to Configure the Active Software Update Point Component to Use an NLB Cluster
How to Determine the Port Settings Used by WSUS
How to Install Windows Server Update Services 3.0
How to Synchronize Updates Using Export and Import

Reference

New Site System Server Share Wizard: General Page

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


How to Create and Configure an Active Software Update Point on a Secondary Site

Topic last updated—November 2007

The software update point in Microsoft System Center Configuration Manager 2007 is a required component of software updates on primary sites, an optional component for software updates on secondary sites, and is installed as a site system role in the Configuration Manager console. When the secondary site is not configured with a software update point site system, the clients assigned to a secondary site will automatically be configured to use the software update point at the parent site. When there is limited network bandwidth to the software update point at the parent site or when Windows Server Update Services (WSUS) is approaching the maximum number of client computers, it is recommended that a software update point be installed at the secondary site. For information that will help you to determine the software update point configuration in your environment, see Determine the Software Update Point Infrastructure.

The site system server must have WSUS 3.0 installed prior to adding the software update point site system role. For more information about installing WSUS 3.0, see How to Install Windows Server Update Services 3.0. WSUS running on the software update point for the secondary site is configured to be a replica of the active software update point for the parent site.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

Use the following procedures to create a software update point site role on the secondary site and then to configure the active software update point.

To create the software update point on a secondary site

  1. If not already installed, install WSUS 3.0 on the site system server selected for the software update point site role at the secondary site. For more information, see How to Install Windows Server Update Services 3.0.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / <secondary site code> - <secondary site name> / Site Settings / Site Systems.

  3. Determine whether to create a new site system server or add the software update point site system role to an existing site system server, and then follow the associated step:

    • To create a new site system server and add the software update point site role: Right-click Site Systems, click New, and then click Server.
    • To add the software update point site role to an existing site system server: Right-click the site system server name, and then click New Roles.

  4. Configure the general site system settings for the site system server. By default, the computer account for the site server will connect to the site system computer to install the software update point components. For more information, see New Site System Server Wizard: General Page. When the computer account does not have access to the site system server or when the site is in native mode, the following settings should be configured:

    • Specify a fully qualified domain name (FQDN) for this site system on the intranet: This setting must be configured for the active software update point site system when the site server is in native mode or when it is in mixed mode and uses Secure Sockets Layer (SSL). By default, this setting is enabled and must be configured.
    • Specify an Internet-based fully qualified domain name for this site system: This setting must be configured for the active software update point if it accepts Internet-based client connectivity or for the active Internet-based software update point site system.
    • Use another account for installing this site system: This setting must be configured when the computer account for the site server does not have access to the remote site system.
    • Allow only site server initiated data transfers from this site system: This setting must be specified when the remote site system does not have access to the inboxes on the site server. This allows a site system from a different domain or forest to store the files that need to be transferred to the site server. The site server will periodically connect to the remote site system and retrieve the files. The Internet-based software update point might require this setting to be enabled.

    Click Next.

  5. Select Software update point, and then click Next.

  6. Specify whether the site server will use a proxy server when connecting to the software update point, and then click Next.

  7. Click Next, and then click Close.

To configure the active software update point for the secondary site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / <secondary site code> - <secondary site name> / Site Settings / Component Configuration.

  2. Right-click Software Update Point Component, and then click Properties.

  3. Click the General tab, and then specify the port settings configured for the WSUS Web site on this site system.

    Important
    The site server will fail to communicate with the WSUS server if the port settings are not correct. For information about how to find this information, see How to Determine the Port Settings Used by WSUS.

  4. Click the Sync Settings tab to specify whether to create event messages for WSUS reporting. These reporting events are not used by Configuration Manager and can be disabled if WSUS reporting is not used.

  5. Click OK to exit the dialog box.

  6. Open SUPSetup.log in <ConfigMgrInstallationPath>\Logs to monitor the installation progress for the software update point. When the installation completes, Installation was successful is written to the log file.

See Also

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


How to Create and Configure an Active Internet-Based Software Update Point

The software update point in Configuration Manager 2007 is a required component of software updates and is installed as a site system role in the Configuration Manager console. The software update point site system role must be created on a site system server that has Microsoft Windows Server Update Services (WSUS) 3.0 installed. For more information about installing WSUS 3.0, see How to Install Windows Server Update Services 3.0.

Note
Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

There can be multiple site system servers with the software update point site system role, but only one site system server can be configured as the active software update point. When the site is in native mode, an additional active Internet-based software update point can be assigned to a remote site system server that allows communication from only Internet-based client computers. Additionally, if the active software update point is configured as a Network Load Balancing (NLB) cluster, a site system server with the software update point site role should be created for each server in the NLB cluster. For information that will help you to determine the software update point configuration in your environment, see Planning for the Software Update Point Settings.

Use the following procedure to create an active Internet-based software update point site role on a site system server and configure the software update point properties.

Note
The active software update point must be created and configured before creating an active Internet-based software update point. For more information, see How to Create and Configure an Active Software Update Point.

To create and configure the active Internet-based software update point

  1. Create a software update point site system role on the site system that will be assigned the active Internet-based software update point. When creating the site system role, do not select Use this server as the active software update point. For the step-by-step procedure, see How to Add the Software Update Point Site Role to a Site System.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  3. Right-click Software Update Point Component, and then click Properties.

  4. Click the General tab, and then select Allow intranet-only client connections. This prevents communication from Internet-based client computers on the active software update point and allows you to configure an active Internet-based software update point.

  5. Click the Internet-based tab, select Active remote Internet-based software update point, and then configure the following properties:

    • Port number: Specify the HTTP port setting for the WSUS server that is installed on the server specified in Active server name.
      Important
      The site server will fail to communicate with the WSUS server if the port settings are not correct. For information about how to find this information, see How to Determine the Port Settings Used by WSUS.

    • SSL port number: Specify the HTTPS (SSL) port setting for the WSUS server that is installed on the server specified in Active server name.
    • Active server name: Specify from the drop-down list the site system server that will be assigned the active Internet-based software update point site role.
    • Software Update Point Connection Account: Specify the account that will be used by the site server to connect to the site system server to configure WSUS components and initiate synchronization. If this account is left blank, the computer account for the site system will be used.
    • Do not synchronize from the software update point located on the intranet: Select this setting if the active Internet-based software update point will be unable to connect to the active software update point. The export and import functionality of the WSUSUtil tool will need to be used to synchronize software updates metadata when this setting is selected. For more information, see How to Synchronize Updates Using Export and Import.

  6. Click OK to close the Software Update Point Component Properties dialog box.

  7. Open SUPSetup.log in <InstallationPath>\Logs to monitor the installation progress for the software update point. When the installation completes, Installation was successful is written to the log file.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Configure Software Updates Synchronization
How to Configure the Active Software Update Point Component to Use an NLB Cluster
How to Determine the Port Settings Used by WSUS
How to Install Windows Server Update Services 3.0
How to Synchronize Updates Using Export and Import

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates
Administrator Checklist: Planning and Preparing Software Updates
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Configuring Internet-Based Client Management
Software Update Point Component Properties


How to Configure the Active Software Update Point Component to Use an NLB Cluster

Topic last updated -- November 2007

Using network load balanced software update point site systems allows for scalability of support for Configuration Manager sites with over 25,000 assigned clients that will connect to Windows Server Update Services (WSUS) on the active software update point site system server. Configuring the active software update point site system in a network load balancing cluster can also be beneficial for Configuration Manager sites with less than 25,000 assigned clients to ensure site system high availability.

Note
The maximum number of WSUS servers that can be configured as part of a network load balancing cluster is four.

The following five procedures are required to configure the active software update point component for a Configuration Manager site as a network load balancing cluster:

  • Prepare the network environment for network load balanced software update point site systems.
  • Install WSUS 3.0 (on each server that will host the software update point site system role)
  • Install the software update point site system role (on each server that will be part of the software update point network load balancing cluster)
  • Configure the Windows Server network load balancing cluster for installed software update site systems
  • Configure the active software update point component for the Configuration Manager site as the software update point network load balancing cluster.

Prepare the network environment for network load balanced software update point site systems.

To prepare the network environment for network load balanced software update point site systems

  1. Create or identify a domain user account to be used as the Software Update Point Connection account. For more information about the Software Update Point Connection account, see About the Software Update Point Connection Account.

  2. Add the computer accounts of each site system that will be configured as part of the software update point network load balancing cluster to the local administrators group of each server that will be part of the network load balancing cluster.

    Note
    The computer accounts for the cluster nodes must be able to write to the WSUS database. If the local administrators group is removed from the SysAdmin role on the SQL server, the computer accounts will not be able to write to the WSUS database, and the software update point will fail to install until the computer accounts are added to the SysAdmin role in some way.

  3. Create DFS share or a standard network shared folder that is available to all of the WSUS servers that will be part of the software update point network load balancing cluster to be used as the WSUS resource content share. Each of the remote WSUS servers should be given change permissions on the root of the shared folder (all standard NTFS permissions except for full control). If the share is created on one of the site systems that will be part of the network load balancing cluster, the site system computer's Network Access account must have change permissions on the root of the shared folder. The user account used to run WSUS Setup should also have these permissions to the share created. For more information about setting up a DFS share for WSUS remote servers, see http://go.microsoft.com/fwlink/?LinkId=91278.

  4. A SQL Server 2005 database server should be identified to host the WSUS database. The WSUS database can be installed on the same SQL Server 2005 database server instance that hosts the site database or a different SQL Server 2005 database server. For information about configuring SQL Server 2005 to host the WSUS database, see Appendix B: Configure Remote SQL topic in the Windows Server Update Services documentation at http://go.microsoft.com/fwlink/?LinkId=91278.

  5. The WSUS 3.0 Administration console must be installed on the primary site server site system to allow the site server and remote Configuration Manager consoles to configure and synchronize software update points. For more information about installing the WSUS 3.0 administration console, see How to Install the Windows Server Update Services 3.0 Administration Console.

  6. If the Configuration Manager 2007 site is configured to operate in native mode, or SSL authentication will be configured for the WSUS servers in a Configuration Manager 2007 site configured to operate in mixed mode, Web server signing certificates must be configured on each of the software update point site systems that will be configured as part of the network load balancing cluster. For more information about configuring Web server signing certificates for network load balanced software update points, see Deploying the Web Server Certificate to Network Load Balanced Site Systems.

Install WSUS 3.0 (on each server that will host the software update point site system role)

Note
The following procedure must be performed on each server that will be part of the software update point network load balancing cluster.

To Install WSUS 3.0 to Support the Configuration Manager Software Update Point Site System Role

  1. On a server that will be part of the software update point network load balancing cluster, create the following folder: <Program Files directory>\Update Services.

  2. Install WSUS 3.0 on each server that will be a member of the SUP NLB cluster.

    Note
    Configuration Manager 2007 Service Pack 1 (SP1) requires WSUS 3.0 SP1.

    1. Double-click the WSUS setup executable (WSUS3Setupx64.exe or WSUS3Setupx86.exe).
    2. On the Welcome page, click Next.
    3. On the Installation Mode Selection page, select the Full server installation including Administration Console check box, and then click Next.
    4. Read the terms of the license agreement carefully. Click I accept the terms of the License agreement, and then click Next.
    5. On the Select Update Source page, select the Store updates locally check box and enter the path <Program Files directory>\Update Services.
    6. On the Database Options page, do one of the following.
      If you are running WSUS Setup on the server hosting the WSUS SQL Server database, select Use an existing database server on this computer select the instance name to be used from the drop-down list.
      If you are running WSUS Setup on a computer will not host the WSUS SQL Server database, select Use an existing database server on a remote computer and enter the FQDN of the SQL Server that will host the WSUS database followed by the instance name (if not using the default instance).
      Note
      If another WSUS Server that will be part of the network load balancing cluster has been configured to use the same SQL Server database server, Select Use existing database when prompted.

    7. On the Web Site Selection page, specify whether to use the existing Internet Information Services (IIS) Default Web site or to create a custom WSUS 3.0 Web site. When using the WSUS server for a software update point, it is recommended to use a custom WSUS Web site by selecting the Create a Windows Server Update Services 3.0 Web site to use a custom WSUS Web site option. Click Next.
      Note
      By default, the custom WSUS Web site uses HTTP port 8530 and HTTPS (SSL) port 8531. If the Windows Firewall is enabled on the server being configured, ensure that WSUS exceptions are created and enabled in Windows Firewall after installing WSUS. For more information about configuring Windows Firewall for software updates, see How to Configure a Firewall for Software Updates.

    8. On the Ready to Install Windows Server Update Services page, review your choices, and then click Next to begin the WSUS 3.0 installation.
    9. On the Completing the Windows Server Update Services 3.0 Setup Wizard page of the WSUS 3.0 installation wizard, click Finish.
      Important
      After clicking Finish, the Windows Server Update Services Configuration Wizard starts. Do not use the wizard to configure the WSUS installation and click Cancel to close the wizard. The WSUS server configuration is managed from within the Configuration Manager console.

  3. Add the Software Update Point Connection Account to the local WSUS Administrators group on the server.

  4. Configure Internet Information Services (IIS) to enable content share access.

    1. Open the Internet Information Services (IIS) Manager console by clicking Start, point at All Programs, point at Administrative Tools, and click Internet Information Services (IIS) Manager.
    2. Expand <server name>, expand Web Sites, and then expand the Web Site node for the WSUS Web site (either Default Web Site or WSUS Administration).
    3. Right-click Content node and click Properties.
    4. On the Virtual Directory tab, select the A share located on another computer option for the resource content and fill in the UNC share name of the share created in step 3 of the To prepare the network environment for network load balanced software update point site systems procedure in this topic.
    5. Click Connect As, and enter the user name and password of the Software Update Point Connection account created in step 1 of the To prepare the network environment for network load balanced software update point site systems procedure in this topic. Click OK to close the Content node properties.

  5. Configure SSL authentication in Internet Information Services (IIS).

    Important
    This step is only required if the Configuration Manager 2007 is configured to operate in native mode. If the Configuration Manager 2007 site is configured to operate in mixed mode, or SSL authentication will not be configured for WSUS on the site systems in a Configuration Manager 2007 site configured to operate in mixed mode, go to step 6.

    1. Open Internet Information Services (IIS) Manager.
    2. Expand Web Sites, and then expand the WSUS administration Web site (either Default Web Site or WSUS Administration).
    3. Perform steps d through g on each of the following virtual directories of the WSUS administration Web site:APIRemoting30, ClientWebService, DSSAuthWebService, ServerSyncWebService, and SimpleAuthWebService.
    4. Right-click the virtual directory and then click Properties.
    5. Click the Directory Security tab, and then click Edit in the Secure Communications section.
    6. Select Require secure channel (SSL), and then click OK.
    7. Click OK to close the properties for the virtual directory.
    8. Close Internet Information Services (IIS) Manager.
    9. Run the following command from <WSUS Installation Folder>\Tools: WSUSUtil.exe configuressl <FQDN name in Web server signing certificate>.

  6. Move the local content directory to the WSUS resource content share created in step 3 of the To prepare the network environment for network load balanced software update point site systems procedure in this topic.

    Important
    This step must be followed for each of the front-end WSUS servers that are not on the same machine as the WSUS resource content share created in step 3 of the To prepare the network environment for network load balanced software update point site systems procedure in this topic.

    1. Open a command window and navigate to the WSUS tools directory on the WSUS server: cd Program Files\Update Services\Tools
    2. On the first WSUS server to be configured, at the command prompt, type the following command:
      wsusutil movecontent <WSUSContentsharename> <logfilename>
      Where <WSUSContentsharename> is the name of the WSUS content resource location share to which the content should be moved, and logfilename is the name of the log file that will be used to record the content move procedure.
    3. On the successive WSUS servers to be configured, at the command prompt type the following command:
      wsusutil movecontent <WSUSContentsharename> <logfilename> /skipcopy
      Where <WSUSContentsharename> is the name of the WSUS content resource location share to which the content should be moved, and logfilename is the name of the log file that will be used to record the content move procedure.
      Note
      To verify that the content move was successful, review the log file created during the procedure and use registry editor to review the HKLM\Software\Microsoft\Update Services\Server\Setup|ContentDir registry key to ensure that the value has been changed to the WSUS content resource location share name.

Install the software update point site system role (on each server that will be part of the software update point network load balancing cluster)

To install the software update point site system role on servers that will be part of the network load balancing cluster

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Determine whether to create a new site system server or add the software update point site system role to an existing site system server, and then follow the associated step:

    • To create a new site system server and add the software update point site role: Right-click Site Systems, click New, and then click Server.
    • To add the software update point site role to an existing site system server: Right-click the site system server name, and then click New Roles.

  3. Configure the general site system settings for the site system server. The following settings should be configured:

    • Specify a fully qualified domain name (FQDN) for this site system on the intranet: This setting must be configured for the active software update point site system when the site server is in native mode.
    • Specify an Internet-based fully qualified domain name for this site system: This setting must be configured for the active software update point if it accepts Internet-based client connectivity or for the active Internet-based software update point site system.
    • Use another account for installing this site system: This setting must be configured when the computer account for the site server does not have access to the remote site system.
    • Allow only site server initiated data transfers from this site system: This setting must be specified when the remote site system does not have access to the inboxes on the site server. This allows a site system from a different domain or forest to store the files that need to be transferred to the site server. The site server will periodically connect to the remote site system and retrieve the files. The Internet-based software update point might require this setting to be enabled.

    Click Next.

  4. Select Software update point, and then click Next.

  5. Specify whether the site server will use a proxy server when connecting to the software update point, and then click Next.

  6. Specify whether this site system should be configured as the active software update point. For this procedure, do not select Use this server as the active software update point; instead, click Next, and then click Close to exit the wizard.

Configure the Windows Server network load balancing cluster for installed software update point site systems

To configure the Windows Server network load balancing cluster for installed software update point site systems

  1. To configure the Windows Server network load balancing cluster for installed software update point site systems, follow the instructions in the How to Configure Network Load Balancing for Configuration Manager Site Systems procedure.

  2. After verifying that the network load balancing cluster is operating successfully, the software update point component can be configured to use the network load balancing cluster as the active software update point for the site using the Configuration Manager console.

Configure the active software update point component for the Configuration Manager site as the software update point network load balancing cluster.

To configure an NLB as the active software update point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration and then double-click Software Update Point Component.

  2. In the Software Update Point Component Properties dialog box, on the General tab, click Use Network Load Balancing cluster for active software update point.

  3. Click Settings

  4. In the Network Load Balance Settings dialog box, click the IP Address Type arrow and then click FQDN. In the Virtual IP or FQDN (private) box, enter the FQDN of the SUP NLB cluster.

    Note
    If the Configuration Manager 2007 site is configured to operate in native mode and a public FQDN is entered, you must use the FQDN created in step 6 of the To prepare the network environment for network load balanced software update point site systems procedure in this topic.

    Click OK.

  5. In the Software Update Point Component Properties dialog box, click Set and enter the name and password for the Software Update Point Connection account created in step 1 of the To prepare the network environment for network load balanced software update point site systems procedure in this topic.

    Note
    The Enable SSL for this WSUS Server is enabled by default and cannot be modified if the site is in native mode.

  6. Click OK.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Create and Configure an Active Internet-Based Software Update Point
How to Create and Configure an Active Software Update Point

Concepts

About the Software Update Point
About the Software Update Point Connection Account
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


How to Configure Software Updates Synchronization

Software updates in Microsoft System Center Configuration Manager 2007 must be synchronized before the update information is available in the Configuration Manager console. Synchronization is initiated at the highest level site in the hierarchy that has an active software update point and is initiated on a configured schedule or by manually initiating the Run Synchronization action.

Note
Scheduled synchronizations perform full synchronization, but using the Run Synchronization action performs only delta synchronization.

When synchronization with Microsoft Update is complete at the highest site in the hierarchy, synchronization requests are sent to child sites and they initiate synchronization with their configured upstream WSUS servers as soon as the request is processed.

Note
Configuration Manager will synchronize all of the update metadata on the WSUS server. If the WSUS server was previously configured with a set of update classifications, products, or languages different from what the software update point is configured for, updates outside of the configured settings might be synchronized.

The software updates metadata that is synchronized from Microsoft Update is retrieved based on the update classifications, products, and languages configured for the active software update point highest in the hierarchy, most likely the central site. Child sites synchronize with the parent site to get the software updates metadata.

Use the following procedures to configure the properties that determine which software updates are synchronized and to initiate or schedule synchronization on the site server.

To configure the update properties for synchronization on the software update point

  1. In the Configuration Manager console for the highest site with software updates enabled, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. Right-click Software Update Point, and then click Properties.

  3. Click the Software Update Point Component Properties: Products Tab to configure the products for which software updates are synchronized.

  4. Click the Software Update Point Component Properties: Classifications Tab to configure the classifications for which software updates are synchronized.

  5. Click the Software Update Point Component Properties: Languages Tab to configure the languages for which software updates are synchronized.

To manually initiate software update synchronization

  1. In the Configuration Manager console for the highest site with software updates enabled, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Right-click Update Repository, and then click Run Synchronization. Software updates synchronization is initiated as soon as possible. When synchronization is complete, a request is sent to child sites to initiate synchronization.

To configure the software update synchronization schedule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Component Configuration.

  2. Right-click Software Update Point, and then click Properties.

  3. Click the Synchronization Schedule tab, click Enable synchronization on a schedule, and configure the schedule.

  4. Click OK to save the synchronization schedule. Unless the Start value is modified in custom schedule, synchronization is initiated as soon as possible and then again based on the configured recurrence pattern. When synchronization is complete, a request is sent to child sites to initiate synchronization.

See Also

Tasks

How to Create and Configure an Active Software Update Point

Concepts

About Software Updates Synchronization
About the Software Update Point
About the Software Updates Process
Administrator Workflows for Software Updates
Planning for Software Updates Server Settings

Other Resources

Administrator Checklists for Software Updates
Software Update Point Component Properties


How to Configure the Proxy Settings for the Software Update Point

Topic last updated—November 2007

When there is a proxy server between the WSUS server and the upstream update source in Configuration Manager 2007, the proxy settings must be configured for the active software update point. Use the following procedure to configure the proxy setting for the software update point.

To configure the proxy settings for the software update point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <SiteSystemName>.

  2. Right-click ConfigMgr software update point, and then click Properties.

  3. Configure whether a proxy server is used when synchronizing, and if so, provide the proxy server name, port number, and whether credentials are used to connect to the proxy server.

See Also

Reference

ConfigMgr Software Update Point Properties

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates

Other Resources

Configuring Software Updates


How to Install System Center Updates Publisher

System Center Updates Publisher is available on the Configuration Manager 2007 installation CD. Use the following procedure to install Updates Publisher.

To install Updates Publisher

  1. Review the "Getting Started with Updates Publisher" section of the System Center Updates Publisher help file, SC_UpdatesPublilsher.chm, located on the Configuration Manager 2007 DVD at <DVD Drive>\SCUP.

  2. Follow the "How to Install Updates Publisher" procedure in the System Center Updates Publisher help file for step-by-step installation instructions, or to initiate the Updates Publisher Setup without reviewing the help topic, run Setup.exe from <DVD Drive>\SCUP on the Configuration Manager 2007 DVD.

See Also

Concepts

About System Center Updates Publisher


How to Check the Windows Update Agent Version on Clients

Topic last updated—November 2007

Windows Update Agent (WUA) 3.0 is required on Configuration Manager 2007 client computers so that they can connect to the Windows Server Update Services (WSUS) 3.0 server and retrieve the list of software updates that need to be scanned for compliance. By default, the WUA version is collected as part of hardware inventory and can be displayed by running a SQL query, by running a software updates scan report, or by opening Resource Explorer for a client computer.

Important
The WUA version is not recorded until a client computer scans for software updates compliance at least one time and then hardware inventory is collected for the client computer.

Use one of the following procedures to verify the WUA version.

To display the WUA version on client computers using a SQL query

  • Create a query statement that retrieves client computers and the Windows Update Agent version, such as the following sample query statement:

    Copy Code
    SELECT v_R_System.Netbios_Name0, v_GS_WINDOWSUPDATEAGENTVERSIO.Version0
FROM v_GS_WINDOWSUPDATEAGENTVERSIO
INNER JOIN v_R_System ON v_GS_WINDOWSUPDATEAGENTVERSIO.ResourceID = v_R_System.ResourceID
WHERE v_GS_WINDOWSUPDATEAGENTVERSIO.Version0 <> 'ISNULL'
ORDER BY v_GS_WINDOWSUPDATEAGENTVERSIO.Version0

    You can use a similar query when creating a Configuration Manager custom report. The sample query retrieves all computers that have a value for the Windows Update Agent version.

To verify the WUA version using a software updates report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click Scan 1 - Last scan states by collection or Scan 2 - Last scan states by site, and then click Run.

  3. Enter the required parameters, and then click Display.

  4. Click the drill-down link in the left column for one of the scan states. The WUA version is displayed in the Windows Update Agent Version column for all client computers for the specific scan state.

To verify the WUA version using Resource Explorer

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Click the collection that contains the client computer.

  3. Right-click the client computer, click Start, and then click Resource Explorer.

  4. Expand Hardware, and then click Windows Update Agent Version.

See Also

Concepts

Administrator Checklist: Configuring Software Updates
Prerequisites for Software Updates

Other Resources

Configuring Software Updates


How to Install the Windows Update Agent on Client Computers

Topic last updated—November 2007

The Windows Update Agent version 3.0 must be installed on Configuration Manager 2007 client computers before a scan for software updates compliance can successfully complete. When the site server is initially installed, the latest version of the Windows Update Agent is downloaded, and when the client computers are installed, the agent is upgraded automatically to version 3.0, if required. If the upgrade fails during the client installation, the installation is not attempted again and the Windows Update Agent must be upgraded using another method.

When Automatic Updates is enabled on client computers and when Windows Server Update Services (WSUS) 3.0 running on the software update point site system server is configured to support self-update, the Windows Update Agent will automatically download and install updates. When self-update is not an option, you can download and install the Windows Update Agent version 3.0 installation file on client computers. The following procedures provide the steps to download the installation file, create a query for computers that do not have at least Windows Update Agent version 3.0, create a collection based on the query, and create a software distribution that targets the new collection.

To download the Windows Update Agent version 3.0

  • Download the Windows Update Agent version 3.0 installation file for the appropriate client computer architecture at one of the following locations:

    • x86-based versions of Windows: Download WindowsUpdateAgent30-x86.exe (http://go.microsoft.com/fwlink/?LinkID=100334).
    • x64-based versions of Windows: Download WindowsUpdateAgent30-x64.exe (http://go.microsoft.com/fwlink/?LinkID=100335).
    • Itanium-based versions of Windows: Download WindowsUpdateAgent30-ia64.exe (http://go.microsoft.com/fwlink/?LinkID=100336).

To create a collection that retrieves computers that have an older version of the Windows Update Agent version 3.0

  1. Navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click Collections, and then click New Collection.

  3. Specify the Name and Comment, and then click Next.

  4. Click the Query Rule icon to open the Query Rule Properties dialog box.

  5. Specify a name for the query, and then click Edit Query Statement.

  6. Click Show Query Language, and then replace the existing statement with a query such as the following sample query statement:

    Copy Code
    SELECT SMS_R_System.NetbiosName, SMS_G_System_WINDOWSUPDATEAGENTVERSION.Version
FROM SMS_R_System
INNER JOIN SMS_G_System_WINDOWSUPDATEAGENTVERSION on SMS_G_System_WINDOWSUPDATEAGENTVERSION.ResourceID = SMS_R_System.ResourceId
WHERE SMS_G_System_WINDOWSUPDATEAGENTVERSION.Version < "7.0.6000.374" order by SMS_G_System_WINDOWSUPDATEAGENTVERSION.Version

    The sample query will return all computers with a version of the Windows Update Agent that is less than 7.0.6000.374, which is version 3.0. The query will return only the computers that have a value for the Windows Update Agent version, which requires the computer to scan for software updates at least once and then take hardware inventory.

    Modify the sample query statement to meet your needs. Click Show Query Design to display the classes, criteria, and joins in the design dialog box.

  7. Click OK, and then specify whether the collection should be collection limited.

  8. Click OK, specify whether the collection should be updated on a schedule, and then click Next.

  9. Click Next, specify the security rights for the collection, click Next, and then click Close when the wizard completes.

  10. Click the collection under the Collections node to return the computers that do not have the Windows Update Agent version 3.0.

To distribute Windows Update Agent version 3.0 to clients

  1. Create a software distribution package for the downloaded Windows Update Agent version 3.0 installation files. For more information, see How to Create a Package.

  2. Create the program for the software distribution package. For the command line, specify WindowsUpdateAgent30-<platform>.exe /quiet /norestart /wuforce. For more information, see How to Create a Program.

  3. Create an advertisement that targets the client computers that do not have Windows Update Agent version 3.0 or later. Specify the collection that was created in the preceding procedure. For more information, see How to Create an Advertisement.

    Important
    It is highly recommended that you advertise the Windows Update Agent version 3.0 to a small set of test client computers before distributing it to all clients in the collection.

See Also

Tasks

How to Check the Windows Update Agent Version on Clients
How to Create an Advertisement
How to Create a Package
How to Create a Program


How to Configure the Languages for Software Updates

The languages for software updates in Configuration Manager 2007 are configured in the Software Update Point Component Properties dialog box and stored in the site control file. When software updates are synchronized from either the software update point or from any offline catalogs, the language settings are retrieved from the site control file. The summary information (metadata) languages are configured in the properties for only the active software update point at the central site. The active software update point and Internet-based software update point, if configured, synchronize the software updates metadata from the upstream synchronization source for the languages configured for the active software update point at the central site. The update file settings are configured in the properties for the active software update point at each site.

Note
In Systems Management Server (SMS) 2003, the download.ini file stored the configuration settings for the languages that were used. The download.ini file is no longer used when synchronizing software updates.

To configure the languages for software updates

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. Right-click Software Update Point, and then click Properties.

  3. Click the Languages tab, and then configure the languages that will be synchronized for both Configuration Manager and SMS 2003 client computers.

See Also

Tasks

How to Create and Configure an Active Software Update Point

Reference

Software Update Point Component Properties: Languages Tab

Concepts

About the Software Update Point
About Software Update Files
About Software Updates Metadata
Planning for the Software Update Point Settings


How to Install and Configure the Inventory Tool for Microsoft Updates

When there are SMS 2003 clients in the Configuration Manager 2007 hierarchy, the Configuration Manager version of the Inventory Tool for Microsoft Updates must be installed on the highest site in the hierarchy where software updates will be deployed, most likely the central site. Without the Configuration Manager version of the inventory tool, the option to deploy software updates to SMS 2003 clients is not available from the Configuration Manager console.

During the SMS 2003 site upgrade to Configuration Manager 2007, Setup detects whether a previous version of the Inventory Tool for Microsoft Updates is installed on the site and verifies that another installation of the tool is not installed on a site higher in the hierarchy. If both are true, Setup initiates an upgrade for the inventory tool on the site server. After a site has been installed or upgraded, the inventory tool downloads the Microsoft Updates catalog from the download location, synchronizes the software updates in the catalog, and stores the software update information in the site database. When the Inventory Tool for Microsoft Updates upgrade fails or for a new installation of the inventory tool, Setup can be manually initiated from the Configuration Manager 2007 CD

Before distributing the Inventory Tool for Microsoft Updates to all clients that meet the minimum requirements, it is highly recommended that the distribution first be tested on the test client that is specified during installation. The following procedures provide the steps to manually install the Inventory Tool for Microsoft Updates, verify that the inventory scan tool and synchronization components are installed, and verify that the test client scanned for software updates and sent the data to the site server.

Install the Inventory Tool for Microsoft Updates

The following procedure provides the steps to install the Inventory Tool for Microsoft Update, monitor the synchronization process for the Microsoft Updates catalog, and verify that the installation completed successfully.

Important
When the Inventory Tool for Microsoft Updates is upgraded as part of the site upgrade, skip to the next section to verify that the Inventory Tool for Microsoft objects has been created. For more information, see Planning the SMS 2003 Software Updates Upgrade.

To install the Inventory Tool for Microsoft Updates

  1. Navigate to the Inventory Tool for Microsoft Updates source file, SMSITMU.MSI, located on the Configuration Manager 2007 CD in \<cd root>\SMSSETUP\SUMSCANTOOLS\I386.

    Important
    The Inventory Tool for Microsoft Updates should be installed on the site server highest in the hierarchy. Do not install the inventory scan tool on more than one site in the hierarchy. Doing so might result in inaccurate scanning results.

  2. Run the inventory scan tool executable from the central site server. The Welcome screen appears. Click Next.

  3. Select I accept the license agreement, and click Next. The inventory tool installation cannot be completed if the license agreement is not accepted.

  4. Use the default destination folder or specify a new location for the inventory tool program files, and click Next.

  5. Specify a Configuration Manager Client computer as the synchronization host, which will obtain the updated catalog files on a recurring schedule.

    Note
    The updated catalog information is downloaded to the synchronization host and then inserted into the Configuration Manager site server database. Therefore, it is recommended that the synchronization host have a fast (LAN) connection to the site server database and, if possible, to the updated catalog files.

  6. Specify whether to download the catalog from the Internet or from a folder on the local network.

    • If the site server has Internet access, select The synchronization host will automatically download the catalog from the Web to have the synchronization host connect to Microsoft Updates and download the catalog.
    • If the central site does not have Internet access, select I will download the catalog and the synchronization host will copy it from a folder to have the synchronization host retrieve the catalog from the specified location. The catalog will need to be downloaded from a computer with Internet access and stored in the specified location.
      Note
      The URL location of the most recent catalog is listed on this page.

    Click Next.

  7. The Distribution Settings for Inventory Tools page allows you to specify the name of the objects that are created by the installation program. These objects include packages, programs, collections, and advertisements that are needed to distribute the inventory tool to the SMS 2003 client computers. Either provide a new name for the objects or keep the default name that is provided.

    Caution
    Renaming these objects after they are created might cause some parts of the software update inventory process to fail.

  8. In the Distribution Options section of the Distribution Settings for Inventory Tools page, do the following:

    • Specify whether the inventory tool package should be sent to all the distribution points in the site hierarchy. This selection is enabled by default. If this option is not selected, the package is not assigned to any distribution points and it must be assigned to distribution points later by using standard package management in the Configuration Manager console.
    • Specify whether to advertise the inventory tool to the default collection, Microsoft Updates Tool (pre-production), that is created by the installation. Initially, the specified test computer is the only member of this collection. This selection is enabled by default.
    • Specify the name of the computer to use for testing the inventory tool distribution. By default, the synchronization host computer is specified, but any client can be selected.

    Click Next.

  9. The Distribution Settings for Windows Update Agent page allows you to specify whether to create the objects to distribute the Windows Update Agent to client computers. This selection is enabled by default, and the Windows Update Agent will be installed as a dependent component of the Inventory Tool for Microsoft Updates.

    Important
    The Inventory Tool for Microsoft Updates requires the Windows Update Agent to function. It is strongly recommended that the defaults are selected on this page.

    If the objects are created to distribute the Windows Update Agent to client computers, either provide a new name for them or keep the default name provided.

  10. In the Distribution Options section of the Distribution Settings for Windows Update Agent page, do the following:

    • Specify whether the Windows Update Agent package should be sent to all the distribution points in the site. This selection is enabled by default. If this option is not selected, the package is not assigned to any distribution points and it must be assigned to distribution points later by using standard package management in the Configuration Manager console.
    • Specify whether to create a package and program for the Windows Update Agent. This creates a package and program independent of the Inventory Tool for Microsoft Updates package. Because the agent will be installed on clients as a dependency of the inventory tool, it is unlikely that this package would need to be explicitly deployed to clients unless the agent becomes missing or is downgraded. In that case, the Windows Update Agent can be distributed using this package and program.

    Click Next to open the Installation page, and then click Next to proceed with the installation.

  11. The Setup Complete page provides information about the installation and where additional information is available. Click Finish to close the Inventory Tool for Microsoft Updates installation and start the synchronization process for the tool.

Verify the Inventory Tool for Microsoft Updates Objects

The advertisements, package, programs, and collections for the Inventory Tool for Microsoft Updates are created as part of the installation process. Use the following procedure to verify that these objects have been created successfully.

Note
If the objects do not appear, you can try to rerun SMSITMU.MSI to repair the installation. If the repair is not successful, you will have to uninstall and reinstall SMSITMU.MSI. However, uninstalling SMSITMU.MSI removes all existing deployments and all collections created by the Inventory Tool for Microsoft Updates.

To verify that Inventory Tool for Microsoft Updates objects are created

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Verify that the Microsoft Updates Tool and Microsoft Updates Tool Sync advertisements were created.

  3. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  4. Verify that the Microsoft Corporation Microsoft Updates Tool 2.0 ALL was created.

  5. In the console tree, expand the package and click Programs. Verify that the following programs have been created:

    • Microsoft Updates Tool
    • Microsoft Updates Tool (expedited)
    • Microsoft Updates Tool IA64
    • Microsoft Updates Tool IA64 (expedited)
    • Microsoft Updates Tool Sync
    • Microsoft Updates Tool x64
    • Microsoft Updates Tool x64 (expedited)

  6. In the Configuration Manager console, navigate to Configuration Manager / Site Database / Computer Management / Collections.

  7. Verify that the following collections have been created:

    • Microsoft Updates Tool
    • Microsoft Updates Tool (pre-production)
    • Microsoft Updates Tool IA64
    • Microsoft Updates Tool Sync
    • Microsoft Updates Tool x64

Verify the Synchronization Components

The synchronization host uses the Microsoft Updates Tool Sync advertisement to retrieve the latest software updates catalog and update the site server database. Use the following procedure to verify that the advertisement has completed successfully.

To verify that the synchronization component advertisement completed

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / System Status / Advertisement Status / Microsoft Updates Tool Sync.

  2. One primary site should be listed in the results pane. Right-click the site name, highlight Show Messages, and click All to open the Status Message Viewer for the site.

  3. Review the status messages for the advertisement to determine its success. When finished, exit the viewer.

  4. Navigate to <InstallationPath>\Microsoft Updates Inventory Tool\PkgSource using Windows Explorer to check that the synchronization files are in the package source directory on the site server. Verify that the Wsusscn2.cab file is present and that it has a recent time stamp.

    Note
    The folder listed in this step assumes that the default folder was selected during the Inventory Tool for Microsoft Updates installation and that you are browsing to it from the local system.

  5. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  6. Identify the package ID for the Microsoft Updates Sync advertisement by looking at the last column.

  7. Verify that the synchronization files are in the package folder on the distribution point by navigating to <distribution point server name>\SMSPKG<driveletter>$\<packageID>, where package ID is the one identified in the previous step. Verify that the inventory scan tool files are in this folder. Close Windows Explorer.

Monitor the Synchronization Process

After the Inventory Tool for Microsoft Updates installation has completed, the synchronization process starts. Use the following procedure to monitor the synchronization process.

To monitor the synchronization process

  • To monitor the synchronization process, view the wsyncmgr.log file. When the synchronization process completes successfully, status message 6710 - SMS Legacy Update Synchronization done is created and recorded in the log file and is available by looking at the status messages for SMS_WSUS_SYNC_MANAGER under the Component Status node for the site.

    Note
    The synchronization process might take in excess of one hour to complete. When the software updates display in the Configuration Manager console and the Deployable to SMS 2003 column for the update has a value of Yes, you can deploy the software update to SMS 2003 clients.

Verify the Test Client Sent Software Updates Scan Results

During the initial installation of the Inventory Tool for Microsoft Updates, the test client computer that was configured during the installation receives the inventory scan tool advertisement, scans for required software updates, and sends the information back to the site server. Use the following procedure to verify that the test client completed this process.

To verify that the test client sent software updates scan results

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click Compliance for software updates on a specific computer, and then click Run.

  3. Specify the name for the test client computer, and then click Display.

  4. The report should show the results of the software updates scan on the client.

Distribute the Inventory Tool for Microsoft Updates to Clients

The Inventory Tool for Microsoft Updates can be installed more broadly by removing the collection-limiting query from the Microsoft Updates Tool collection. The Inventory Tool for Microsoft Update advertisement should target only SMS 2003 client computers.

Important
When the Inventory Tool for Microsoft Updates is upgraded, the advertisement that was previously used to install the tool on clients continues to be used. It is highly recommended that this advertisement be modified to target a collection of computers with only the SMS 2003 client.

Configuration Manager client computers should scan for software update compliance by using the software updates feature in Configuration Manager 2007. These client computers will use the Windows Update Agent to connect directly to the Windows Server Update Services server, and then send state messages with software update compliance. For more information, see About the Software Updates Process. Use the following procedure to remove the collection-limiting query and make the inventory scan tool available to all clients that meet the minimum requirements.

To remove collection-limiting query from the Microsoft Updates Tool collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the Microsoft Updates Tool collection, and then click Properties.

  3. Click the Membership Rules tab, right-click the Collection Query rule, and then click Properties.

  4. In the Collection limiting section, select Not collection limited, click OK, and then click OK. The clients targeted for Inventory Tool for Microsoft Updates installation receive the inventory scan tool advertisement, scan for applicable software updates, and send the information back to the site server.

See Also

Tasks

How to Deploy Software Updates to SMS 2003 Clients
How to Synchronize the Microsoft Update Catalog for SMS 2003 Clients
Troubleshooting Inventory Tool for Microsoft Updates Issues

Concepts

About the Inventory Tool for Microsoft Updates
About the Software Updates Process
Planning the SMS 2003 Software Updates Upgrade


How to Configure NAP Evaluation for Software Updates

Network Access Protection (NAP) policies in Configuration Manager 2007 define which software updates NAP-capable clients must have by a specified date in order to be compliant. Before you can define a Configuration Manager NAP policy, you must first enable the Network Access Protection client agent and the software updates must be downloaded. Configuration Manager 2007 NAP Policies cannot be created on secondary sites or on a child site if the parent site is enabled for NAP. These sites will inherit the Configuration Manager NAP Policies from the primary or parent site, and these policies cannot be added to, deleted, or modified except on the site on which they were created.

The evaluation of NAP policies can be enabled for software updates while creating the software update deployment using the Deploy Software Updates Wizard or within the software update properties for updates that have been downloaded. NAP evaluation can also be enabled on deployed software updates by creating a new NAP policy.

Use one of the following procedures to enable NAP evaluation for software updates.

To enable NAP evaluation using the Deploy Software Updates Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. Specify the software updates to configure for NAP evaluation, and then click Deploy Software Updates to open the Deploy Software Updates Wizard.

    Software updates can be displayed within the Update Repository, deployment name, and deployment package name console tree nodes. For more information about where to find software updates, see How to Find Software Updates in Configuration Manager.

  3. Follow the wizard pages to the Set Effective Date page, and select Enable NAP evaluation. Specify whether the Configuration Manager NAP policy should become effective as soon as possible or at a specific date and time. Complete the wizard, and click Close.

    Note
    If the Set Effective Date page is not present, NAP has not been configured for the site.

  4. When the Deploy Software Updates Wizard completes, the deployment displays in the Deployment Management node. If a deployment template definition was saved, it displays in the Deployment Templates node. If a deployment package was created, it displays in the Deployment Packages node. The Refresh action might be needed on each node for the objects to display.

To enable NAP evaluation for updates in software updates properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. Specify the software updates to configure for NAP evaluation, and then click Properties to open the properties for the software updates.

    Software updates can be displayed within the Update Repository, deployment name, and deployment package name console tree nodes. For more information about where to find software updates, see How to Find Software Updates in Configuration Manager.

  3. Click the NAP Evaluation tab, and select Enable NAP evaluation. Specify whether the Configuration Manager NAP policy should become effective as soon as possible or at a specific date and time.

    Note
    If the NAP Evaluation tab is not present, at least one of the software updates selected has not yet been deployed or NAP has not been configured for the site. All software updates must be downloaded prior to enabling NAP evaluation.

To enable NAP evaluation for updates using the New Policies Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Network Access Protection /.Policies.

  2. Right-click Policies, and then click New Policies to open the New Policies Wizard.

  3. Select the software updates you want to include in the Configuration Manager NAP policy, and then click Next. Only software updates that have been deployed are displayed.

  4. Specify whether the Configuration Manager NAP policy should become effective as soon as possible or at a specific date and time.

  5. Click Finish, and then click Close.

See Also

Tasks

How to Download Software Updates
How to Deploy Software Updates

Reference

NAP Policy Properties: General Tab

Other Resources

Administrator Checklist: Configure Network Access Protection for Configuration Manager
Deploy Software Updates Wizard
Overview of Network Access Protection
Software Update Name Properties


How to Verify the Fully Qualified Domain Name Settings Used By the Active Software Update Point

Topic last updated—November 2007

The fully qualified domain name (FQDN) is used by WSUS Synchronization Manager, a component for software updates in Configuration Manager 2007, when connecting to Windows Server Update Services (WSUS) running on the active software update point to initiate software updates synchronization. When the FQDN is not valid, the connection will fail. Use the following procedure to verify the FQDN on the site system where the active software update point is installed.

To verify the FQDN settings for the software update point site system

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Right-click the site system where the active software update point is installed, and then click New Role.

  3. Verify that the Specify a fully qualified domain name (FQDN) for this site system on the intranet option is selected and that the Intranet FQDN value is correct. When the site is in native mode, verify that the Internet FQDN value is correct.

    If the FQDN settings are correct, click Cancel to exit the wizard, and skip the last step of this procedure.

  4. Click Next, click Next again without selecting any new site roles, click Next once more, and then click Close.

See Also

Reference

ConfigMgr Software Update Point Properties

Concepts

About the Software Update Point
Administrator Checklist: Configuring Software Updates

Other Resources

Configuring Software Updates


How to Configure Proxy Settings Used When Downloading Software Update Files

Topic last updated—November 2007

By default, software update files are downloaded from the Internet using the credentials of the logged-on user and the proxy settings configured for the user in Internet Explorer. The UpdDwnldCfg.exe utility is available on the Configuration Manager 2007 DVD and on every site server. It can be used to modify the server and account credentials used to access the Internet through the following components:

  • A firewall.
  • A proxy server.
  • A computer that is running Microsoft Internet Security and Acceleration (ISA) server.

When running the UpdDwnldCfg.exe utility to modify the server and account credentials, the following switches can be used:

  • /s: Specifies the name of the firewall, proxy server, or ISA server computer, and the port number that is used when downloading software update files from the Internet.
  • /u: Specifies the user account that is used to connect through the firewall, proxy server, or ISA server.
  • /clean: Removes the server and account settings previously configured by running upddwnldcfg.exe.

Use the following procedures to modify the server and account settings used when software update files are downloaded from the Internet and to remove the settings previously configured by using the UpdDwnldCfg.exe utility.

To modify the server and account settings used when downloading software update files

  • On the site server, run <ConfigMgrInstallationFolder>\bin\<platform>\<language>\UpdDwnldCfg /s:<servername>:<port> /u:<username>. For example, for x86 and English (US), run <ConfigMgrInstallationFolder>\bin\i386\00000409\UpdDwnldCfg /s:MyProxy:80 /u:MyAccount.

To remove the server and account settings previously configured by running upddwnldcfg.exe

  • On the site server, run <ConfigMgrInstallationFolder>\bin\<platform>\<language>\UpdDwnldCfg /clean.

See Also

Other Resources

Configuring Software Updates


How to Enable CRL Checking for Software Updates

By default, the certificate revocation list (CRL) is not checked when verifying the signature on Microsoft System Center Configuration Manager 2007 software updates. Checking the CRL each time a certificate is used offers more security against using a certificate that has been revoked, but it introduces a connection delay and incurs additional processing on the computer performing the CRL check.

If used, CRL checking must be enabled on the Configuration Manager 2007 consoles that process the software updates. If your site also supports software updates to Systems Management Server (SMS) 2003 clients, you would also enable CRL checking on the synchronization host computer.

To enable CRL checking

  • On the computer performing the CRL check, from the product DVD, run \SMSSETUP\BIN\<platform>\<language>\UpdDwnldCfg.exe /checkrevocation. For example, for x86 and English (US) you would run \SMSSETUP\BIN\I386\00000409\UpdDwnldCfg.exe /checkrevocation

See Also

Other Resources

Configuring Software Updates
Tasks for Configuration Manager Security


Tasks for Software Updates

Many tasks need to be performed to successfully manage software updates in Configuration Manager 2007. This section provides information about managing software updates synchronization, software updates metadata, software update files, software update deployments, and removing software updates components.

Click the related link for detailed information about the associated software updates task.

In This Section

How to Manage Software Updates Synchronization

Specifies the tasks related to managing synchronization.

How to Manage Software Updates Metadata

Specifies the tasks related to managing software updates metadata, including the use of update lists, using search folders, and so on.

How to Manage Software Update Files

Specifies the tasks related to managing software update files, such as downloading software updates to a deployment package.

How to Manage Software Update Deployments

Specifies the tasks related to managing software update deployments.

How to Remove Software Updates Components

Specifies the tasks related to removing the software updates components.

See Also

Concepts

Administrator Workflows for Software Updates

Other Resources

Administrator Checklists for Software Updates
Configuring Software Updates
Overview of Software Updates
Planning for Software Updates


How to Manage Software Updates Synchronization

Software updates synchronization in Configuration Manager 2007 is the process of retrieving the software updates metadata that meet the configured criteria from the upstream Windows Server Update Services (WSUS) 3.0 server or Microsoft Update. Click the related link for detailed information about the associated deployment package task.

In This Section

How to Synchronize Software Updates

Specifies how to synchronize software updates.

How to Synchronize Updates Using Export and Import

Specifies how to use the WSUSUtil tool to synchronize software updates.

How to Synchronize the Microsoft Update Catalog for SMS 2003 Clients

Specifies how to synchronize the Microsoft Update catalog for SMS 2003 clients.

See Also

Concepts

About Software Updates Synchronization
Planning for the Software Update Point Settings

Other Resources

Planning for Software Updates


How to Synchronize Software Updates

Software updates in Configuration Manager 2007 must be synchronized with the Windows Server Update Services (WSUS) or Microsoft Update before the update information is available in the Configuration Manager console. Synchronization can be scheduled in the properties for the active software update point highest in the Configuration Manager hierarchy or by manually initiating the Run Synchronization action. Synchronization on child sites is either requested by the configured parent site after it completes synchronization or initiated when a previous synchronization failed. Manual synchronization is not available on child sites.

When synchronization is initiated on a configured schedule, all changes to the software updates metadata since the last scheduled synchronization are inserted into the site database. This includes new software updates metadata or metadata that has been modified or removed. When synchronization is initiated manually, only new software updates metadata since the last synchronization is inserted into the site database. The manual synchronization completes faster than the scheduled synchronization.

The synchronization process might take in excess of one hour to complete depending on whether synchronization has run before, and what languages, products, and classifications have been configured. You can monitor the synchronization progress by looking at the log file for the WSUS synchronization manager, wsyncmgr.log, located by default at %ProgramFiles%\Microsoft Configuration Manager\Logs. When synchronization completes, the WSUS synchronization manager component, SMS_WSUS_SYNC_MANAGER, creates status message 6702.

Use one of the following procedures to synchronize software updates on the site server.

Note
Scheduled synchronizations perform full synchronization, but using the Run Synchronization action performs only delta synchronization.

To configure the software update synchronization schedule

  1. In the Configuration Manager console at the highest site in the hierarchy with an active software update point, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Component Configuration.

  2. Right-click Software Update Point, and then click Properties.

  3. Click the Synchronization Schedule tab, click Enable synchronization on a schedule, and configure the schedule.

  4. Click OK to save the synchronization schedule. Unless the Start value is modified in the custom schedule, synchronization is initiated as soon as possible and then again based on the configured recurrence pattern. When synchronization is complete, a request is sent to child sites to initiate synchronization.

To manually initiate software update synchronization

  1. In the Configuration Manager console at the highest site in the hierarchy with an active software update point, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Right-click Update Repository, and then click Run Synchronization. Software updates synchronization is initiated as soon as possible. When synchronization is complete, a request is sent to child sites to initiate synchronization.

Note
You should initiate the synchronization from a Configuration Manager console on a computer that is not running the SMS Provider. If you run the software update synchronization and then close the Configuration Manager console when the console is running on the same computer as the SMS Provider, the console might stop responding until the synchronization is complete.

See Also

Tasks

How to Create and Configure an Active Software Update Point

Concepts

About Software Updates Synchronization
About the Software Update Point
About the Software Updates Process
Administrator Workflows for Software Updates
Planning for Software Updates Server Settings

Other Resources

Administrator Checklists for Software Updates
Software Update Point Component Properties


How to Synchronize Updates Using Export and Import

When a software update point is not configured to synchronize with its upstream update server in Configuration Manager 2007, the export and import function of the WSUSutil tool can be used to synchronize software updates metadata. The WSUSutil tool should be used to synchronize software updates on a schedule that is similar to the synchronization schedule configured on the central site. You will also want to verify that synchronization has completed on the upstream update source before using the tool to ensure that the most recent software updates metadata is synchronized. To verify that synchronization has completed successfully on the server configured as the upstream update source, check the site server for status message ID 6702 for the SMS_WSUS_SYNC_MANAGER component or look for the log entry in wsyncmgr.log on the site server that references status message ID 6702.

Note
The parent site server is the upstream update source for an active software update point and the current site server is the upstream update source for an active Internet-based software update point.

The user running the tool must be a member of the local Administrators group on the Windows Server Update Services (WSUS) server to export or import the metadata, and the tool must be run locally on the WSUS server.

Important
Never import exported data from a source that you do not trust. Importing content from a source you do not trust might compromise the security of your WSUS server.

The files in the WSUSContent folder (located in <WSUSInstallationDrive>\WSUS\WSUSContent by default) must also be copied from the upstream update server to the software update point so that locally stored updates and the license terms for software updates are available to the import server. Use the following procedures to export and import software updates from the export WSUS server to the import WSUS server.

To copy local files from the export server to the import server

  1. On the export server, navigate to the folder where software updates and the license terms for software updates are stored. By default, WSUS stores the files at <WSUSInstallationDrive>\WSUS\WSUSContent\, where WSUSInstallationDrive is the drive on which WSUS is installed.

  2. Copy all files and folders from this drive to the WSUSContent folder on the import server.

To export metadata from the database of the export server

  1. At the command prompt on the export WSUS server, navigate to the folder that contains WSUSutil.exe. By default, the tool is located at %ProgramFiles%\Update Services\Tools.

  2. Type the following:

    wsusutil.exe export packagename logfile

    For example:

    wsusutil.exe export export.cab export.log

    The format can be summarized as follows: WSUSutil.exe is followed by the export option, the name of export .cab file created during the export operation, and the name of a log file. WSUSutil.exe exports the metadata from the export server and creates a log file of the operation.

    Note
    The package (.cab file) and log file name must be unique in the current folder.

  3. Move the export package to the folder that contains WSUSutil.exe on the import WSUS server.

    Note
    Moving the package to this folder provides an easy import experience. You can move the package to any location accessible to the import server, and then specify the location when running WSUSutil.exe.

To import metadata to the database of the import server

  1. At the command prompt on the import WSUS server, navigate to the folder that contains WSUSutil.exe. By default, the tool is located at %ProgramFiles%\Update Services\Tools.

  2. Type the following:

    wsusutil.exe import packagename logfile

    For example:

    wsusutil.exe import export.cab import.log

    The format can be summarized as follows: WSUSutil.exe is followed by the import command, the name of package file (.cab) created during the export operation (and path to the package file if it is in a different folder), and the name of a log file. WSUSutil.exe imports the metadata from the export server and creates a log file of the operation.

See Also

Tasks

How to Synchronize Software Updates

Concepts

About Software Updates Synchronization
Planning for the Software Update Point Settings


How to Synchronize the Microsoft Update Catalog for SMS 2003 Clients

Synchronization for the Microsoft Updates catalog used for Systems Management Server (SMS) 2003 clients in the Configuration Manager 2007 hierarchy is performed by running an advertisement that initiates the synchronization process.

Important
Before running synchronization for the Microsoft Update catalog, you must upgrade or install the Configuration Manager 2007 Inventory Tool for Microsoft Updates on the site server. When upgrading the site server from SMS 2003 to Configuration Manager 2007, Setup automatically initiates the Inventory Tool for Microsoft Updates upgrade if it detects a previous version of the tool.

Use the following procedure to initiate a synchronization of a software update catalog.

To synchronize the Microsoft Updates catalog

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click Microsoft Updates Tool Sync, and then click Re-run Advertisement. The synchronization host downloads the most recent software updates catalog and copies it to all distribution points where it will be available to SMS 2003 clients. If no changes have been made to the catalog, the synchronization host will not overwrite the existing catalog.

    Note
    By default, clients will update the software update catalog and perform the inventory scan every 7 days. For more information about how to initiate this process manually, see How to Download the Latest Software Updates Catalog on SMS 2003 Clients.

See Also

Concepts

About Software Updates Synchronization
Planning the SMS 2003 Software Updates Upgrade


How to Manage Software Updates Metadata

The software updates metadata in Configuration Manager 2007 provides the information about the software update, such as name, description, products that the update supports, update classification, article ID, download URL, applicability rules, and so on. This section provides links to the tasks that help to manage the metadata, such as finding software updates in the Configuration Manager console, managing update lists that contain a set of software updates, and so on.

Click the related link for detailed information about the associated metadata task.

In This Section

How to Find Software Updates in Configuration Manager

Specifies where in the Configuration Manager console software update metadata can be found.

How to Configure Search Folders for Software Updates

Specifies how to create and configure a search folder for software updates.

How to Create an Update List

Specifies how to create an update list.

How to Modify the Properties for an Update List

Specifies how to modify the properties for an update list.

How to Add Software Updates to an Update List

Specifies how to add software updates to an update list.

How to Remove Software Updates from an Update List

Specifies how to remove software updates from an update list.

How to Use an Update List to Deploy Software Updates

Specifies how to use an update list to deploy software updates.

How to Download the Latest Software Updates Catalog on SMS 2003 Clients

Specifies how to download the Microsoft Update catalog for SMS 2003 clients.

See Also

Concepts

About Update Lists in Software Updates
Planning for a Software Update Deployment


How to Find Software Updates in Configuration Manager

After software updates have been synchronized in Configuration Manager 2007, they are displayed in the Configuration Manager console in several locations. The following procedures provide information about each location where the software updates are displayed in the console.

To display software updates on the Software Updates home page

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. The software updates that meet the Vendor, Update Classification, and Month and year criteria are displayed.

To display software updates under the Update Repository console tree node

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Use the following subtree nodes to display software updates:

    • Navigate to Update Repository / Search Folders / <search folder name> to display the software updates that meet the search criteria. For more information, see How to Configure Search Folders for Software Updates.
    • Navigate to Update Repository / <classification name> / All Updates to display all updates for the specified classification.
    • Navigate to Update Repository / <classification name> / <vendor name> / All Updates to display all updates for a specific classification and vendor.
    • Navigate to Update Repository / <classification name> / <vendor name> / <product name> to display all updates for a specific classification, vendor, and product.

To display software updates in an update list

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Lists / <update list name>.

  2. The software updates in the updates list are displayed.

To display software updates in a deployment

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management / <deployment name> / Software Updates.

  2. The software updates in the deployment are displayed.

To display software updates in deployment packages

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages / <deployment package name> / Software Updates.

  2. The software updates hosted by the deployment package are displayed.

See Also

Tasks

How to Configure Search Folders for Software Updates

Reference

Deployment Management Home Page
Update Repository Home Page

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About Update Lists in Software Updates
Deployment Packages Home Page
How to Manage Software Updates Metadata
Software Updates Home Page


How to Configure Search Folders for Software Updates

Search folders in Configuration Manager 2007 provide an easy way to retrieve a set of software updates that meet the defined search criteria. Search folders created at a parent site are replicated down the hierarchy. The properties for replicated search folders cannot be modified at child sites, but unlike other objects in Configuration Manager, search folder objects at child sites do not display with a lock symbol. Use the following procedure to create a search folder for software updates.

To create a search folder for software updates

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository / Search Folders.

  2. Right-click Search Folders, and then click New Search Folder.

  3. Specify one or more of the following object properties to search:

    • Article ID: Specifies the article ID associated with the software update.
    • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
    • Bundle Update: Specifies whether the software update is bundled with other updates.
    • Custom Severity: Specifies the user-defined severity value for software updates. The custom severity values can be Low, Moderate, Important, Critical, or null.
    • Date Released: Specifies the date that the software update was released.
    • Date Revised: Specifies the date that the software update was last modified.
    • Deployable: Specifies whether the software update can be deployed to client computers.
    • Deployable to SMS 2003: Specifies whether the software update can be deployed to SMS 2003 clients.
    • Deployed: Specifies whether the software update is part of a deployment.
    • Description: Specifies the description for the software update.
    • Downloaded: Specifies whether the software update has been downloaded.
    • Effective Date: Specifies whether the software update is included in the NAP policy, which becomes effective on NAP-capable clients on the specified date and time.
    • Exclusive Handling Required: Specifies whether the software update must be installed independent from other updates.
    • Expired: Specifies whether the software update has expired. Expired software updates are not available for deployment.
    • Information URL: Specifies the URL location for more information about the software update. This setting will rarely be used as search criteria.
    • Installed: Specifies the number of systems that have installed the software update and no longer require it. This setting will rarely be used as search criteria.
    • Not Required: Specifies the number of systems that do not require the software update. This setting will rarely be used as search criteria.
    • Product: Specifies the product associated with the software update.
    • Required: Specifies the number of systems that require the software update. This setting will rarely be used as search criteria.
    • Severity: Specifies the predefined Vendor severity rating for the software update. The severity values can be Low, Moderate, Important, or Critical.
    • Superseded: Specifies whether the software update is superseded by another update.
    • Title: Specifies the title for the software update.
    • Total: Specifies the total number of clients that are in the All Systems collection. This setting will rarely be used as search criteria.
    • Unique Update ID: Specifies the unique ID for the software update.
    • Unknown: Specifies the number of systems in which the software update state is unknown. This setting will rarely be used as search criteria.
    • Update Classification: Specifies the classification for the software update.
    • Vendor: Specifies the vendor that created the software update.

  4. Specify the search criteria for the object property by clicking the underlined property in the Step 2: Edit the property's search criteria window.

  5. Click Search all folders under this feature.

  6. Specify the name of the search folder, and then click OK.

See Also

Tasks

How to Find Software Updates in Configuration Manager
How to Synchronize Software Updates

Concepts

About Software Updates Metadata
How to Manage Software Updates Metadata


How to Create an Update List

The Update List Wizard allows you to add software updates to a new or existing update list. The update list is used to initiate deployments for a set of updates without having to manually select the updates in the set each time a new deployment is created. You must have Create rights on the Configuration items class to create an update list.

Note
Adding software updates to an existing update list does not add the updates to deployments previously created using the update list.

The following procedure provides the steps necessary to add software updates to an update list.

Procedure

To add software updates to an update list

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Specify the software updates to be added to the update list. For more information, see How to Find Software Updates in Configuration Manager.

  3. Right-click the highlighted software updates, and then click Update List to open the Update List Wizard.

  4. Follow the steps in the wizard to add software updates to the update list.

  5. When the Update List Wizard completes, the update list displays in the Update Lists console tree node. The Refresh action might be needed on the node for new update lists to display.

    Note
    To modify the properties for an update list, right-click the update list in the Update Lists node and then click Properties.

See Also

Tasks

How to Configure Search Folders for Software Updates
How to Deploy Software Updates Using an Update List
How to Find Software Updates in Configuration Manager
How to Modify the Properties for an Update List

Concepts

About Software Updates Metadata
About the Update List Wizard
About Update Lists in Software Updates
How to Manage Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

Update List Name Properties
Update List Wizard


How to Modify the Properties for an Update List

To modify an update list after creating it in the Update List Wizard, you must go to the update list's properties. The update list name, description, and security can be modified. To add or remove software updates from an update list, see the corresponding task at the end of this section. Use the following procedure to modify the properties for an update list.

To modify an update list properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Lists.

  2. In the Update Lists pane, right-click the desired update list and then click Properties.

  3. The following properties can be modified:

    • Name: Specifies the name for the update list. The name must be unique and should help to describe the software updates contained in the update list.
    • Description: Specifies the description for the update list. The description should provide an overview of what software updates are contained in the update list and information that helps to identify it among others in the Update Lists node of the Configuration Manager console.
    • Security rights: Specifies the class and instance rights for the update list.

See Also

Tasks

How to Add Software Updates to an Update List
How to Remove Software Updates from an Update List

Reference

Properties - Security Tab

Concepts

About the Update List Wizard
About Update Lists in Software Updates

Other Resources

Update List Name Properties


How to Add Software Updates to an Update List

The Update List Wizard allows you to add software updates to a new or existing update list. The update list is used to initiate deployments for a set of updates without having to manually select the updates in the set each time a new deployment is created. You must have Modify rights on the Configuration items class to add software updates to an update list.

Note
Adding software updates to an existing update list does not add the updates to deployments previously created with the update list.

The following procedure provides the steps necessary to add software updates to an update list.

To add software updates to an update list

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Specify the software updates to be deployed. For more information, see How to Find Software Updates in Configuration Manager.

    Note
    To select multiple software updates, press and hold CTRL and click each update.

  3. Right-click the highlighted software updates, and then click Update List to open the Update List Wizard or drag the updates to an update list in the Configuration Manager console tree.

  4. Follow the steps in the wizard to add the software updates to the update list.

  5. When the Update List Wizard completes, the software updates added to the update list display in the results pane when the update list is highlighted. The Refresh action might be needed on the node for new update lists to display.

See Also

Tasks

How to Configure Search Folders for Software Updates
How to Create an Update List
How to Modify the Properties for an Update List

Concepts

About Update Lists in Software Updates
About the Update List Wizard
How to Manage Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

How to Manage Software Update Deployments
Update List Name Properties
Update List Wizard


How to Remove Software Updates from an Update List

Use the following procedure to remove software updates from an update list after creating it in the Update List Wizard.

Note
Removing software updates from an update list does not remove the updates from deployments previously created using an update list.

To remove software updates from an update list

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Lists / <update list name>.

  2. Select the software updates to remove from the update list. To select multiple software updates, press and hold CTRL and click each update.

  3. Right-click one of the highlighted software updates, and then click Delete.

See Also

Concepts

About the Update List Wizard
About Update Lists in Software Updates
How to Manage Software Updates Metadata

Other Resources

Update List Wizard
Update List Name Properties


How to Use an Update List to Deploy Software Updates

Update lists in Configuration Manager 2007 are used to initiate deployments for a set of updates without having to manually select the updates in the set each time a new deployment is created. The following procedure provides the steps necessary to deploy software updates using an update list.

To deploy software updates using an update list

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Lists.

  2. Start the Deploy Software Updates Wizard with the specified update list using one of the following methods:

    1. Right-click the desired update list, and then click Deploy Software Updates.
    2. Drag-and-drop the desired update list to a deployment template. The deployment is configured with the settings from the template, and the wizard requests information only about the collection (if not specified in the template), deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (if NAP is enabled).
    3. Drag-and-drop the desired update list to a deployment. The configured settings for the deployment are maintained, and the wizard requests information only about the deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (if NAP is enabled).

  3. Follow the steps in the wizard to create or modify the deployment.

  4. When the Deploy Software Updates Wizard completes, the deployment displays in the Deployment Management node. If a deployment template definition was saved, it displays in the Deployment Templates node. If a deployment package was created, it displays in the Deployment Packages node. The Refresh action might be needed on each node for the objects to display.

    Note
    To modify the properties for a deployment, right-click the deployment in the Deployment Management console tree node, and then click Properties.

See Also

Tasks

How to Create an Update List
How to Modify a Software Update Deployment

Concepts

About the Update List Wizard
About Deployment Templates in Software Updates
About Software Update Deployments
How to Manage Software Updates Metadata

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments
Update List Wizard


How to Download the Latest Software Updates Catalog on SMS 2003 Clients

Systems Management Server (SMS) 2003 clients that scan for software updates in the Microsoft Updates catalog will download the latest Microsoft Updates catalog and scan for software updates every 7 days by default. The following procedure provides the steps necessary to manually download the software updates catalog on clients and initiate the inventory scan.

To download the latest Software Updates catalog

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click Microsoft Updates Tool, and then click Re-run Advertisement. The client computers in the target collection receive the advertisement, check for an updated version of the Microsoft Updates catalog, and initiate an inventory scan for the software updates.

See Also

Concepts

How to Manage Software Updates Metadata


How to Manage Software Update Files

The software update file is the actual file that the client computer downloads, such as an executable (.exe) or Windows Installer file (.msi) file, and then installs to update a component or application. This section provides links to the tasks that help to manage the update files, such as creating deployment packages, manually downloading the software update files, refreshing the source files in deployment packages, and so on.

Click the related link for detailed information about the associated deployment package task.

In This Section

How to Create a Deployment Package

Specifies how to create a deployment package.

How to Download Software Updates

Specifies the different methods for downloading software updates to a deployment package.

How to Add Software Updates to a Deployment Package

Specifies how to add software updates to an existing deployment package.

How to Manage Distribution Points in Deployment Packages

Specifies how to manage the distribution points configured for a deployment package.

How to Refresh Source Files in Deployment Packages

Specifies how to refresh the source files on distribution points for software updates.

How to Delete Deployment Packages

Specifies how to delete a deployment package.

How to Manually Download Software Updates

Specifies how to manually download the update files before adding them to a deployment package.

See Also

Concepts

About Software Update Deployment Packages
About Software Update Files


How to Create a Deployment Package

There are several methods for creating a deployment package in Configuration Manager 2007. The Download Update Wizard allows you to download selected software updates to a deployment package prior to deploying the updates to client computers. When creating an update list, the Update List Wizard provides the option to download the software updates as part of the process for adding them to the update list. And finally, the Deploy Software Updates Wizard will download software updates as part of the deployment process.

Note
If the software updates have been previously downloaded to a deployment package, the Deploy Software Updates Wizard uses the existing package and skips all package related pages.

Software updates can be added to new or existing deployment packages, and the updates can be downloaded from the Internet or from a shared folder on the network that is accessible to the site server. For overview information about deployment packages, see About Software Update Deployment Packages. The following procedure provides the steps necessary to create a new deployment package using the Download Update Wizard.

To create a new deployment package

  1. In the Configuration Manager console, select the software updates to download to the deployment package. For more information, see How to Find Software Updates in Configuration Manager.

  2. Right-click the highlighted software updates, and then click Download Software Updates to open the Download Updates Wizard. For more information about completing the settings in the wizard, see Download Updates Wizard.

  3. When the wizard completes, the deployment package displays in System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages. The Refresh action might be needed for the package and software updates to display.

See Also

Tasks

How to Add Software Updates to a Deployment
How to Create an Update List
How to Deploy Software Updates
How to Manually Download Software Updates

Concepts

About Software Update Deployment Packages
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties
Download Updates Wizard


How to Download Software Updates

There are several methods for downloading software updates in Configuration Manager 2007. The Download Updates Wizard allows you to download selected software updates to a deployment package prior to deploying the updates to client computers. When creating an update list, the Update List Wizard provides the option to download the software updates as part of the process for adding them to the update list. And finally, the Deploy Software Updates Wizard will download software updates as part of the deployment process.

Note
If the software updates have been previously downloaded to a deployment package, the Deploy Software Updates Wizard uses the existing package and skips all package related pages.

Software updates are downloaded from the Internet or from a shared folder on the network that is accessible to the site server and can be added to new or existing deployment packages. For overview information about deployment packages, see About Software Update Deployment Packages. For information about software update files, see About Software Update Files.

Note
When using the Download Updates Wizard or the Update List Wizard to download software updates, refresh the software updates list view in the Configuration Manager console after downloading software updates and prior to deploying them to prevent the Download Software Updates Wizard from prompting for download settings.

The following procedure provides the steps necessary to download software updates to a deployment package using the Download Updates Wizard.

To download software updates to a deployment package

  1. In the Configuration Manager console, select the software updates to download to the deployment package. For more information, see How to Find Software Updates in Configuration Manager.

  2. Right-click the highlighted software updates, and then click Download Software Updates to open the Download Updates Wizard. For more information about completing the settings in the wizard, see Download Updates Wizard.

  3. When the wizard completes, the software updates display in Deployment Packages \ <deployment package name> \ Software Updates. The Refresh action might be needed for the package and software updates to display.

See Also

Tasks

How to Add Software Updates to a Deployment
How to Create an Update List
How to Deploy Software Updates
How to Manually Download Software Updates

Concepts

About Software Update Deployment Packages
About Software Update Files
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
How to Manage Software Update Files

Other Resources

Deployment Package Name Properties
Download Updates Wizard
Planning for Software Updates


How to Add Software Updates to a Deployment Package

Software updates can be added to a deployment package from the Download Updates Wizard and Update List Wizard, which allows administrators to provision distribution points with software update source files prior to deploying them, or from the Deploy Software Updates Wizard, which creates the deployment package as part of the deployment.

Note
If the software updates have been previously downloaded to a deployment package, the Deploy Software Updates Wizard uses the existing package and skips all package related pages.

Software updates can be added to new or existing deployment packages, and the updates can be downloaded from the Internet or from a shared folder on the network that is accessible to the site server. The following procedure provides the steps necessary to add software updates to a deployment package.

Note
To modify the properties for a deployment package, right-click the package in the Deployment Packages node, and then click Properties.

To add software updates to a deployment package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. Specify the software updates to be added to the deployment package. For more information, see How to Find Software Updates in Configuration Manager.

    Note
    To select multiple software updates, press and hold CTRL and click each update.

  3. Right-click the highlighted software updates, or the update list, and then click Deploy Software Updates to open the Deploy Software Updates Wizard, Download Software Updates to open the Download Updates Wizard, or Add to Update List to open the Update List Wizard.

    Note
    To download software updates to a package in the Update List Wizard, the Download the files associated with the selected software updates setting must be selected.

  4. Follow the wizard to the Deployment Package page, choose Select a deployment package or Create a new deployment package, and then configure the following properties:

    1. Name: Specifies a name for the package.
    2. Description: Specifies a description for the package.
    3. Deployment package source: Specifies the location where the downloaded software update source files are stored. When the deployment is generated, the source files are compressed and copied to the distribution points that are associated with the deployment package. The source location must be entered as a network path (for example, \\server\sharename\path), or the Browse button can be used to find the network location.
      Important
      The shared folder for the deployment package source files must be manually created before proceeding to the next page.

      Important
      The SMS Provider computer account and the user who will actually download the software updates to the download location both require write access to the download location. Restrict access to the download location to reduce the risk of attackers tampering with the software updates source files in the download location.

    4. Enable binary differential replication: Specifies whether clients that use BITS will continue downloading the files at the bit within the file or the file itself if they are disconnected during file transfer. By default, this setting is disabled and client computers that use BITS will continue downloading the files at the file level.
      Note
      Client computers are also optimized to download only the required files from a package shared folder on the distribution point and not all of the files within the package shared folder when the client computer installs software updates.

    Click Next.

  5. Click Browse to open the Add Distribution Points dialog box, and select the distribution points for the deployment package. Click Next.

  6. Click Next to use the default data access settings.

  7. Click Next to use the default distribution settings.

  8. Select Download software updates from the Internet to download the software updates from the Internet location specified in the properties for each update or Download software updates from the local network to retrieve the software updates from a local directory or shared folder. Click Next.

  9. Follow the wizard through the remaining pages, and then click Close to exit the wizard.

  10. When the wizard completes, the software updates display in Deployment Packages \ <deployment package name> \ Software Updates. The Refresh action might be needed for the package and software updates to display.

See Also

Tasks

How to Add Software Updates to a Deployment
How to Configure Search Folders for Software Updates
How to Create an Update List
How to Deploy Software Updates
How to Find Software Updates in Configuration Manager
How to Manually Download Software Updates

Concepts

About Software Update Deployment Packages
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


How to Manage Distribution Points in Deployment Packages

Software updates in Configuration Manager 2007 can be downloaded to a deployment package from the Download Updates Wizard and the Update List Wizard, which allow administrators to provision distribution points with software update source files prior to deploying them, or from the Deploy Software Updates Wizard, which downloads the software updates as part of the deployment.

The source files for software updates that have been downloaded are stored at the network shared folder that was specified when creating the deployment package and also as compressed packages on child sites. The update source files are then copied to the distribution points defined in the package.

The Manage Distribution Points Wizard can be used to add the deployment package to new distribution points, refresh the package on selected distribution points, update all distribution points with a new package source version, or remove the package from selected distribution points. Use the following procedure to open the Manage Distribution Points Wizard to manage the distribution points defined in a deployment package.

To manage the distribution points defined in a deployment package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages / <deployment package name> / Distribution Points.

  2. Right-click Distribution Points, and then click Manage Distribution Points to open the Manage Distribution Points Wizard.

See Also

Concepts

About Software Update Deployment Packages
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
How to Manage Software Update Files

Other Resources

Manage Distribution Points Wizard


How to Refresh Source Files in Deployment Packages

Software updates can be downloaded to a deployment package from the Download Updates Wizard and Update List Wizard, which allows administrators to provision distribution points with software update source files prior to deploying them, or from the Deploy Software Updates Wizard, which downloads the software updates as part of the deployment.

The source files for downloaded software updates are stored in the source shared folder, the network shared folder specified when creating the deployment package. The files are then copied to the distribution points associated with the package. If newer software update versions become available, the Content Refresh action can be used to download the updates from the download location and replace the updates in the source folder.

The Content Refresh action only replaces the update source files and does not update the distribution points associated with the deployment package. For more information about updating distribution points with source file content, see How to Manage Distribution Points in Deployment Packages. Use the following procedure to refresh the software update source files on site servers.

To refresh software update source files on site servers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages / <deployment package name> / Software Updates.

  2. Select the software updates that need a content refresh, right-click the selected updates, and click Content Refresh to open the Download Updates Wizard.

  3. Select the download location for the software updates, click Next, click Next, and then click Close when the wizard finishes downloading the updates.

See Also

Concepts

About Software Update Deployment Packages
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
Download Updates Wizard: Download Location Page
How to Manage Software Update Files


How to Delete a Software Update from a Deployment Package

Software updates can be removed from a deployment package from the Configuration Manager 2007 console. Before removing software updates from a deployment package, you should verify that the update is not part of an active software update deployment or that the update has been downloaded to a different deployment package. When the last deployment package that contains a software update is deleted, client computers will no longer be able to retrieve the update until the software update is downloaded again to a deployment package.

Use the following procedure to delete a software update from a deployment package.

To remove a software update from a deployment package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages / <deployment name> / Software Updates.

  2. Right-click the software update, and then click Delete.

  3. Click OK to delete the software update.

See Also

Concepts

About Software Update Deployment Packages
Deployment Packages Home Page
How to Manage Software Update Files


How to Delete Deployment Packages

Software update deployment packages in Configuration Manager 2007 can be deleted from the Deployment Packages console tree node. After the deployment package is deleted, the deployment package object is removed from the site server and all child sites, and the package shared folder and associated files are removed on the distribution points configured for the package. The deployment package source files are not deleted.

Deleting a deployment package that is used in an active deployment might result in clients being unable to install software updates in the package. A warning appears in the Package Deletion Confirmation dialog box if any deployments use one or more of the deployment packages selected for deletion. The software updates in a deployment that uses a deleted package will not be available to clients for installation unless the updates are in another package that is accessible to the client.

Note
The user must have Delete instance rights for the Deployment Package object to successfully delete a deployment package. For more information about setting deployment package security, see Properties - Security Tab.

The following procedure provides the steps necessary to delete a deployment package.

To delete a deployment package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages.

  2. In the results pane, right-click one or more deployment packages, and then click Delete. If a warning appears in the Package Deletion Confirmation dialog box stating that existing deployments use one or more of the packages selected for deletion, the software updates in the deployment must be in another package or clients will fail to install them.

  3. Click Yes in the dialog box to delete the deployment package.

See Also

Concepts

About Software Update Deployment Packages
About the Download Updates Wizard
How to Manage Software Update Files


How to Manually Download Software Updates

When the Configuration Manager 2007 site server does not have Internet access, software updates must be manually downloaded and copied to a network shared folder accessible to the site server before the updates can be added to a deployment package and deployed to clients. After the software update is available on a network shared folder, the update is added to a deployment package in the Download Updates Wizard, Deploy Software Updates Wizard, or Update List Wizard.

The following procedure provides the steps necessary to download a software update to a network shared folder.

To download a software update to a network shared folder

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Specify the software update to be downloaded. For more information, see How to Find Software Updates in Configuration Manager.

  3. Click the Content Information tab to display the Internet path to the source file for each supported language for the software update.

    Note
    To copy the row of text that contains the source file location, click the row, press CTRL-C on the row to copy it to the clipboard, paste the text to the Web browser, and then remove all text other than the source path.

  4. Enter the source file path in a Web browser on a computer that has Internet access, and download the file to a location on the network that is accessible to the site server.

  5. From the site server, use the Download Updates Wizard to package the software update. Follow the wizard to the Download Location page, select Download software updates from a location on the local network, and then enter the network shared folder or local folder that contains the software update source file. Click Browse to open the Browse to Folder dialog box.

    Note
    Alternatively, the Deploy Software Updates Wizard can be used to download the update and then deploy it, or the Update List Wizard can be used to download the update and then add it to an update list.

See Also

Tasks

How to Deploy Software Updates
How to Download Software Updates

Concepts

About Software Update Deployment Packages
How to Manage Software Update Files

Other Resources

Deploy Software Updates Wizard
Download Updates Wizard
Update List Wizard


How to Manage Software Update Deployments

Software update deployments in Configuration Manager 2007 are used to deploy software updates to Configuration Manager Client computers and distribute compatible software updates to Systems Management Server (SMS) 2003 clients. This section provides links to the tasks used to manage software update deployments.

Click the related link for detailed information about the associated deployment management task.

In This Section

How to Create a Deployment Template

Specifies how to create a deployment template.

How to Modify a Deployment Template

Specifies how to modify the properties contained in a deployment template.

How to Delete a Deployment Template

Specifies how to delete an existing deployment template.

How to Deploy Software Updates

Specifies how to create or modify a software update deployment.

How to Deploy Software Updates Using an Update List

Specifies how to initiate a software update deployment using an update list.

How to Add Software Updates to a Deployment

Specifies how to add software updates to a software update deployment.

How to Deploy Software Updates to SMS 2003 Clients

Specifies how to deploy software updates to SMS 2003 clients in the hierarchy.

How to Hide Deployments on Client Computers

Specifies how to hide all deployments when they are received and when they install on client computers.

How to Modify a Software Update Deployment

Specifies how to modify a software update deployment.

How to Disable a Software Update Deployment

Specifies how to effectively disable a software update deployment.

How to Delete a Software Update Deployment

Specifies how to delete a software update deployment.

How to Monitor Software Update Deployments

Specifies how to monitor software update deployments.

See Also

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Tasks for Software Updates


How to Create a Deployment Template

Deployment templates in Configuration Manager 2007 store many of the deployment properties that might not change from deployment to deployment. Use the following procedure to create a new deployment template using the Deployment Template Wizard.

To create a new deployment template in the Deployment Template Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Templates.

  2. Right-click Deployment Templates, and then click New Deployment Template to open the Deployment Template Wizard.

  3. Follow the steps in the wizard to create a new deployment template.

  4. When the Deployment Template Wizard completes, the deployment template displays under Deployment Templates. The Refresh action might be needed on the console tree node for the new deployment template to display.

    Note
    To modify the properties for a deployment template, right-click the template in the Deployment Templates node and then click Properties.

See Also

Concepts

About Deployment Templates in Software Updates
About the Deployment Template Wizard
Deployment Templates Home Page
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments
Deployment Template Wizard


How to Modify a Deployment Template

Software update deployment templates in Configuration Manager 2007 store many of the deployment properties that might not change from deployment to deployment. Templates auto-populate these settings when used to initiate a deployment. Use the following procedure to modify an existing deployment template.

To modify a deployment template

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Templates.

  2. In the Deployment Templates pane, right-click the desired deployment template and then click Properties.

  3. In the Deployment Templates Properties dialog box, the following information can be modified:

    • Name and description: Specifies the name and description of the deployment template.
    • Collection: Specifies the collection that is targeted for the software update deployment. Templates can be created without a collection so that one deployment template can be used during a phased deployment where collections change over time.
    • Display/Time Settings: Specifies whether display notification are displayed on client computers, whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.
    • Restart Settings: Specifies the system restart behavior when a software update installs on a client and requires a restart to complete, and specifies whether system restarts are allowed outside of configured maintenance windows.
    • SMS 2003 Settings: Provides the option to deploy software updates to Systems Management Server (SMS) 2003 clients.
      Note
      Only software updates with a value of Yes in the Deployable to SMS 2003 setting can be deployed to SMS 2003 clients.

    • Event Generation: Specifies whether to disable Microsoft Operations Manager alerts during software update installation and whether an Operation Manager alert is created when a software update installations fails.
    • Download Settings: Specifies the behavior for software update installation when clients are within a "slow or unreliable" network boundary and when clients are within the boundaries of a protected distribution point that does not contain the software update.
    • Security: Specifies the class and instance security for the deployment template object.

See Also

Tasks

How to Hide Deployments on Client Computers

Concepts

About Deployment Templates in Software Updates
About the Deployment Template Wizard
Deployment Templates Home Page

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments
Deployment Template Wizard


How to Delete a Deployment Template

Software update deployment templates in Configuration Manager 2007 store many of the deployment properties that might not change from deployment to deployment. Templates auto populate these settings when used to initiate a deployment. When a deployment template is no longer needed, it can be deleted without causing any impact on the deployments that have previously been created by using the template. Use the following procedure to delete an existing deployment template.

To delete a deployment template

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Templates.

  2. In the Deployment Templates pane, right-click the desired deployment template, and then click Delete.

  3. Click Yes in the Confirm Object Delete dialog box.

See Also

Concepts

About Deployment Templates in Software Updates
About the Deployment Template Wizard

Other Resources

How to Manage Software Update Deployments


How to Deploy Software Updates

The Deploy Software Updates Wizard in Configuration Manager 2007 allows you to create or modify a software update deployment, which deploys software updates to clients in the target collection. The software updates can be selected from several different locations and the wizard can be initiated in different ways. When a software update deployment is created or modified, clients will receive the deployment policy on their next machine policy cycle and the updates will be available for installation anytime after the configured start time. The following procedure provides the steps necessary to deploy software updates.

Procedure

To deploy software updates using the Deploy Software Updates Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. Specify the software updates to be deployed. For more information, see How to Find Software Updates in Configuration Manager.

    Note
    To select multiple software updates, press and hold CTRL and click each update to deploy.

  3. Start the Deploy Software Updates Wizard using one of the following methods:

    1. Right-click the highlighted software updates, or the update list, and then click Deploy Software Updates.
    2. Drag-and-drop the highlighted software updates, or the update list, to a deployment template. The deployment is configured with the settings from the template, and the wizard requests information only about the collection (if not specified in the template), deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (if NAP is enabled).
    3. Drag-and-drop the highlighted software updates, or the update list, to a deployment. The configured settings for the deployment are maintained, and the wizard requests information only about the deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (if NAP is enabled).

  4. Follow the steps in the wizard to create or modify the deployment.

  5. When the Deploy Software Updates Wizard completes, the deployment displays in the Deployment Management node. If a deployment template definition was saved, it displays in the Deployment Templates node. If a deployment package was created, it displays in the Deployment Packages node. The Refresh action might be needed on each node for the objects to display.

    Note
    To modify the properties for a deployment, right-click the deployment in the Deployment Management console tree node, and then click Properties.

See Also

Tasks

How to Configure Search Folders for Software Updates
How to Create a Deployment Template
How to Find Software Updates in Configuration Manager

Reference

Deployment Management Home Page

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
About Deployment Templates in Software Updates
How to Manage Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


How to Deploy Software Updates Using an Update List

Update lists in Configuration Manager 2007 are used to initiate deployments for a set of updates without having to manually select the updates in the set each time a new deployment is created. The following procedure provides the steps necessary to deploy software updates using an update list.

To deploy software updates using an update list

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Lists.

  2. Start the Deploy Software Updates Wizard with the specified update list using one of the following methods:

    1. Right-click the desired update list, and then click Deploy Software Updates.
    2. Drag-and-drop the desired update list to a deployment template. The deployment is configured with the settings from the template, and the wizard requests information only about the collection (if not specified in the template), deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (if NAP is enabled).
    3. Drag-and-drop the desired update list to a deployment. The configured settings for the deployment are maintained, and the wizard requests information only about the deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (if NAP is enabled).

  3. Follow the steps in the wizard to create or modify the deployment.

  4. When the Deploy Software Updates Wizard completes, the deployment displays in the Deployment Management node. If a deployment template definition was saved, it displays in the Deployment Templates node. If a deployment package was created, it displays in the Deployment Packages node. The Refresh action might be needed on each node for the objects to display.

Note
To modify the properties for a deployment, right-click the deployment in the Deployment Management console tree node, and then click Properties.

See Also

Tasks

How to Create an Update List

Concepts

About the Update List Wizard
About Deployment Templates in Software Updates
About Update Lists in Software Updates
How to Manage Software Updates Metadata

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments
Update List Wizard


How to Add Software Updates to a Deployment

Software update deployments in Configuration Manager 2007 can be added in the properties for the specific deployment or by dragging the selected software updates to a deployment.

Note
Only downloaded updates appear in the Add Software Update dialog box. To add software updates that have not been previously downloaded, either drag-and-drop the updates from the Configuration Manager console to a deployment or exit the deployment properties, follow the steps in How to Download Software Updates, and then open the Add Software Update dialog box again.

When new software updates are added to a deployment, the deployment properties are updated on the site server and clients will receive the updated deployment on their next machine policy cycle and the updates will be available for installation anytime after the configured start time. The following procedures provide the steps necessary to add software updates to a deployment.

To add software updates from the deployment properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management.

  2. In the results pane, right-click the desired deployment, and click Properties.

  3. Click the Software Updates tab. Click Add to open the Add Software Update dialog box.

  4. Browse for and select the software updates to add to the deployment, and then click OK.

To add software updates using the Deploy Software Updates Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. Specify the software updates to be deployed. For more information, see How to Find Software Updates in Configuration Manager.

    Note
    To select multiple software updates, press and hold CTRL and click each update to deploy.

  3. Start the Deploy Software Updates Wizard by dragging-and-dropping the highlighted software updates, or the update list, to a deployment. The configured settings for the deployment are maintained, and the wizard requests information only about the deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (if NAP is configured).

  4. Follow the steps in the wizard to add the software updates to the deployment.

See Also

Tasks

How to Download Software Updates
How to Find Software Updates in Configuration Manager

Reference

Add Software Update Dialog Box

Concepts

About the Deploy Software Updates Wizard
About the Software Updates Process
About Software Update Deployments
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


How to Remove Software Updates from a Deployment

Topic last updated—November 2007

Software updates can be removed from deployments in Configuration Manager 2007 from the properties for the specific deployment. After a software update is removed from a deployment, the assignment policy is updated and clients will receive the updated policy on their next policy cycle. The following procedure provides the steps necessary to remove a software update from a deployment.

To remove a software update from a deployment

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management.

  2. In the results pane, right-click the desired deployment and click Properties.

  3. Click the Software Updates tab. The software updates that are currently in the deployment are displayed.

  4. Highlight the software update that you would like to remove, and then click Remove.

See Also

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Name Properties
Deploy Software Updates Wizard
How to Manage Software Update Deployments


How to Deploy Software Updates to SMS 2003 Clients

The Deploy Software Updates Wizard in Configuration Manager 2007 allows you to create a software update deployment, which deploys software updates to clients in the target collection. Software updates can be deployed to Systems Management Server (SMS) 2003 clients in the hierarchy as long as the updates are compatible with the clients. Each software update contains the Deployable to SMS 2003 property, and when the Configuration Manager Inventory Tool for Microsoft Updates has synchronized, the setting is set to Yes for synchronized updates. Only the software updates that have a value of Yes for this property can be deployed to SMS 2003 clients. When software updates are selected for deployment and at least one update is not deployable to SMS 2003 clients, the option to deploy software updates to SMS 2003 clients is not available.

The software updates that can be deployed to SMS 2003 clients can be selected from several different locations in the Configuration Manager console and the wizard can be initiated in different ways. You can also create a new advertisement from the SMS 2003 Programs console tree node under the package that contains the software update. For more information about deploying software updates to SMS 2003 clients, see the "Planning for SMS 2003 Deployments" section in Planning for a Software Update Deployment

When a software update deployment is created or modified that targets SMS 2003 clients, clients will receive the policy on their next machine policy cycle and the updates will be available for installation after the configured start time.

The following procedure provides the steps necessary to deploy software updates to SMS 2003 clients.

Procedure

To deploy software updates to SMS 2003 clients

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates.

  2. Specify the software updates to be deployed to SMS 2003 clients. For more information about finding software updates, see How to Find Software Updates in Configuration Manager.

    Note
    To select multiple software updates, press and hold CTRL and click each update to deploy.

  3. Start the Deploy Software Updates Wizard using one of the following methods:

    1. Right-click the highlighted software updates, or the update list, and then click Deploy Software Updates.
    2. Drag-and-drop the highlighted software updates, or the update list, to a deployment template that has Deploy to SMS 2003 clients enabled. The deployment is configured with the settings from the template, and the wizard requests information only about the collection (if not specified in the template), deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (not applicable to SMS 2003 clients).
    3. Drag-and-drop the highlighted software updates, or the update list, to a deployment. The configured settings for the deployment are maintained, and the wizard requests information only about the deployment package (if the update is not in an existing package), download location (if the update is not in an existing package), deployment schedule, and NAP effective date (not applicable to SMS 2003 clients).

  4. Follow the steps in the wizard to create or modify the deployment. If a deployment template was not used to initiate the deployment, enable Deploy software updates to SMS 2003 clients and configure the SMS 2003 specific settings on the SMS 2003 Settings page.

    Important
    When this setting is disabled in an active deployment that includes SMS 2003 clients, this setting cannot be enabled again. The corresponding program and advertisement created for SMS 2003 clients are disabled. Before permanently disabling this deployment for SMS 2003 clients, make sure this is the intended action.

  5. When the Deploy Software Updates Wizard completes, the deployment displays in the Deployment Management node. The advertisement used to deploy updates to SMS 2003 clients is displayed in SMS2003 Advertisements. If a deployment template definition was saved, it displays in the Deployment Templates node. If a deployment package was created, it displays in the Deployment Packages node. The Refresh action might be needed on each node for the objects to display.

    Note
    To modify the properties for a deployment, right-click the deployment in the Deployment Management console tree node, and then click Properties.

See Also

Tasks

How to Deploy Software Updates
How to Find Software Updates in Configuration Manager

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


How to Hide Deployments on Client Computers

Software updates can be installed silently on client computers in Configuration Manager 2007 by selecting the Hide all deployments from end users setting in the Software Updates Client Agent properties. This setting specifies that display notifications and notification area icons for the software updates in all deployments will not display on client computers. When this setting is enabled, the Available Software Updates dialog box is not available and only the software updates in mandatory deployments will install silently on the configured deadline. Software updates in optional deployments will be hidden and not available to users. Hidden deployments will become visible on client computers when this setting is not enabled.

Use the following procedure to hide software updates on client computers.

To hide deployments on computers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. Right-click Software Updates Client Agent, and then click Properties.

    Click the Update Installation tab, and select Hide all deployments from end users.

  3. Click OK to exit the properties dialog box.

See Also

Concepts

About the Software Updates Client Agent
Planning for a Software Update Deployment
Planning for Software Updates Server Settings

Other Resources

How to Manage Software Update Deployments
Software Updates Client Agent Properties


How to Modify a Software Update Deployment

Software update deployments in Configuration Manager 2007 can be modified in the properties for the specific deployment. After the deployment properties are modified on the site server, clients will receive the updated deployment on their next machine policy cycle. The following procedure provides the steps necessary to modify the deployment properties.

To modify deployment properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management.

  2. In the results pane, right-click the desired deployment, and click Properties.

  3. In the <deployment name> Properties dialog box, the following properties can be modified:

    • Name and Description: Specifies the name and description of the deployment.
    • Collection: Specifies the collection that is targeted for the software update deployment.
    • Software Updates: Specifies the software updates that are currently in the deployment. To add software updates, click Add to open the Add Software Update dialog box and browse for downloaded updates, select the updates to add to the deployment, and then click OK. To remove updates from the deployment, highlight the update, and then click Remove. There is no limit to the number of software updates that can be in a deployment.
      Note
      To add software updates to existing deployments, they must first be downloaded to a package using the Download Updates Wizard or be in a previously created deployment. Software updates that have not been downloaded will not appear in the Add Software Update dialog box.

    • Display/Time: Specifies whether users are notified of pending software updates and see the update installation progress, whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.
    • Restart Settings: Specifies the system restart behavior when a software update installs on a client and requires a restart to complete, and specifies whether system restarts are allowed outside of configured maintenance windows.
    • Event Generation: Specifies whether to disable Microsoft Operations Manager alerts during software update installation and whether an Operation Manager alert is created when a software update installations fails.
    • SMS 2003 Settings: Provides the option to deploy software updates to Systems Management Server (SMS) 2003 clients. This setting is available when the deployment was created with only software updates deployable to SMS 2003 clients.
    • Schedule: Specifies when a software update deployment becomes active, when the software update installation will be enforced on clients, whether Wake On LAN will be enabled for the deployment, and whether to ignore maintenance windows and install at the deadline.
    • Download Settings: Specifies the behavior for software update installation when clients are within a "slow or unreliable" network boundary and when clients are within the boundaries of a protected distribution point that does not contain the software update.
    • Security: Specifies the class and instance security for the deployment object.

See Also

Concepts

About the Deploy Software Updates Wizard
About Software Update Deployments
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


How to Disable a Software Update Deployment

Software update deployments in Configuration Manager 2007 can be disabled by configuring the deployment for a collection without any client computers or by configuring the deployment to be made available to clients on with a start time that won't realistically be reached. The first method is preferred because it does not create new policy instances, but just evaluates the deployment and determines that it is no longer in the target collection. When the start time is configured for sometime in the future, the deployment object is updated on the site server and all child sites, client policies are updated, and, after the next client machine policy cycle, the software updates in the deployment no longer display as available or install at configured deadlines. The following procedure provides the steps necessary to disable a deployment.

To disable a software update deployment

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management.

  2. In the results pane, right-click one or more deployments, and then click Properties.

  3. To modify the collection, click the Collection tab, and then configure the deployment with a collection that has no target clients.

  4. To modify the start time, click the Schedule tab, and then configure the available Date and time setting to a future date. For example, configure the date for the year 2020. If the deadline is configured, either remove the deadline or configure it for a date later than the available date.

  5. Click OK to update the deployment.

See Also

Tasks

How to Delete a Deployment Template

Concepts

About the Deploy Software Updates Wizard
About Software Update Deployments
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
How to Manage Software Update Deployments


How to Delete a Software Update Deployment

Software update deployments in Configuration Manager 2007 can be deleted from the Deployment Management console tree node. After the deployment has been deleted, the deployment object is removed from the site server and all child sites, client policies are updated, and, after the next client machine policy cycle, the software updates in the deployment no longer display as available or install at configured deadlines. Deleting a deployment does not affect the software updates that have already been installed on clients, packages used in the deployment, Network Access Protection policies that were created as part of the deployment, or templates used or created in the deployment.

The following procedure provides the steps necessary to delete a deployment.

To delete a software update deployment

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management.

  2. In the results pane, right-click one or more deployments, and then click Delete.

  3. Click Yes to confirm the deletion.

See Also

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
About Software Update Deployments

Other Resources

Deploy Software Updates Wizard
How to Manage Software Update Deployments


How to Monitor Software Update Deployments

Software update deployments in Configuration Manager 2007 can be best monitored by using the built-in software updates reports. These reports are in the Software Updates - C. Deployment States category in the Reports console tree node. There are two main phases for a deployment: the evaluation phase, when client computers determine whether the software updates in the deployment are required, and the enforcement phase, when client computers report the compliance state for the deployment.

To monitor client evaluation for software update deployments, three main reports should be used. The States 2 - Evaluation states for a deployment report summarizes the evaluation state of client computers for a specified deployment. This report provides information about whether the client computer was able to successfully evaluate the deployment. Then, the States 4 - Computers in a specific state for a deployment <secondary> report can be drilled into to get more information about the client computer within a specified state. Finally, the States 7 - Error status messages for a computer can be drilled into to get all error messages for the deployment on the specific computer.

To monitor client enforcement for software update deployments, three main reports should be used. The States 1 - Enforcement states for a deployment report summarizes the enforcement state of client computers for a specified deployment. This report provides information about the state for installing the updates in the deployment; for example, downloading the update, installing the update, successfully installed the update, and so on. Then, the States 4 - Computers in a specific state for a deployment <secondary> report can be drilled into to get more information about the client computer within a specified state. Finally, the States 7 - Error status messages for a computer can be drilled into to get all error messages for the deployment on the specific computer.

Note
To verify the status of software update deployed to SMS 2003 clients, use the reports in the Software Updates - E. Distribution Status for SMS 2003 Clients category.

Use the following procedure to monitor software update deployments using reports.

To monitor deployment evaluation

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click States 2 - Evaluation states for a deployment, and then click Run.

  3. In the Deployment ID box, click Values to view a list of possible deployments to choose, and then click the deployment. To limit the list, in the Deployment ID text box enter part of the deployment name followed by the percent wildcard, and then click Values.

  4. Click Display to view the report. The evaluation states for the deployment are listed with the number of client computers in each state.

  5. Click the Report Link icon in the first column on any row to open the States 4 - Computers in a specific state for a deployment <secondary> report to display the computer information, the last time a state message was received from the client computer, the evaluation state for the deployment, and the error status if one exists.

  6. If there are errors, click the Report Link icon in the row that contains the error to open the States 7 - Error status messages for a computer report.

  7. After reviewing the report, click Close, and then click Close.

To monitor deployment enforcement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click States 1 - Enforcement states for a deployment, and then click Run.

  3. In the Deployment ID box, click Values to view a list of possible deployments to choose, and then click the deployment. To limit the list, in the Deployment ID text box enter part of the deployment name followed by the percent wildcard, and then click Values.

  4. Click Display to view the report. The enforcement states for the deployment are listed with the number of client computers in each state.

  5. Click the Report Link icon in the first column on any row to open the States 4 - Computers in a specific state for a deployment <secondary> report to display the computer information, the last time a state message was received from the client computer, the enforcement state for the deployment, and the error status if one exists.

  6. If there are errors, click the Report Link icon in the row that contains the error to open the States 7 - Error status messages for a computer report.

  7. After reviewing the report, click Close, and then click Close.

See Also

Tasks

How to Deploy Software Updates

Concepts

About Software Update Deployments
Monitoring Software Updates
Planning for a Software Update Deployment
About Software Updates Reports


How to Remove Software Updates Components

There are several software updates components in Configuration Manager 2007. The software update point is not enabled by default, but once installed and configured it can be disabled, which results in the loss of software update compliance assessment data and the prevention of new software update deployments being created on the site server. The Software Updates Client Agent is enabled by default and can be disabled, which results in new software update compliance assessment data not being retrieved and the prevention of clients from receiving software update deployments. The Inventory Tool for Microsoft Updates can be removed when there is no longer the need to deploy software updates to Systems Management Server (SMS) 2003 clients that are in the site hierarchy.

Click the related link for detailed information about the associated task.

In This Section

How to Remove the Software Updates Client Agent

Specifies how to disable the Software Updates Client Agent.

How to Remove the Software Update Point

Specifies how to remove the software update point.

How to Remove the Inventory Tool for Microsoft Updates

Specifies how to remove the Inventory Tool for Microsoft Updates, and associated components, on the site server.

See Also

Concepts

About the Inventory Tool for Microsoft Updates
About the Software Update Point
About the Software Updates Client Agent


How to Remove the Software Updates Client Agent

The Software Updates Client Agent in Configuration Manager 2007 is installed on Configuration Manager Client computers by default. When the client agent is disabled, the client agent components are put into a dormant state, but not completely removed on clients. Reenabling the Software Updates Client Agent initiates a policy requesting that the components on clients be reactivated. The Software Updates Client Agent is configured on a site-by-site basis and affects only clients assigned to that site. Disabling the Software Updates Client Agent at a site prevents software update compliance assessment scans from occurring on any clients assigned to the site. Use the following procedure to disable the Software Updates Client Agent.

To disable the Software Updates Client Agent

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> <site name> / Site Settings / Client Agents.

  2. Right-click Software Updates Client Agent, and then click Properties.

  3. Clear Enable Software Updates on clients, and click OK.

Client Agent Components Left on Uninstalled Clients

When the Software Updates Client Agent is removed from a client, there might be one log file and the temporary inventory tool cache might remain on clients. These components do not affect the client computer or future reinstallation of the Configuration Manager Client. Use the following procedure to remove the files from the client computer.

To remove Software Updates Client Agent components

  1. Browse to %systemroot%\System32\ccm\logs. For Configuration Manager Client computers that are also management points, browse to <drive letter>:\Program Files\SMS_CCM\logs.

  2. Remove Patchinstall.lo_, which is present only when a Systems Management Server 2003 client is upgraded to Configuration Manager 2007 and then later removed.

  3. Browse to the temporary inventory tool cache. This folder is in %systemroot%\System32\VPCache by default.

  4. Remove VPCache and all of its contents, which are present only if the client computer previously had an inventory scan tool installed, such as the Inventory Tool for Microsoft Updates.

    Note
    The temporary inventory tool cache path is stored on clients in the registry at HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\VPCache. The VPCache registry key can also be deleted. In some circumstances, there could be more than one cache location.

See Also

Concepts

About the Software Updates Client Agent

Other Resources

Software Updates Client Agent Properties
How to Remove Software Updates Components


How to Remove the Software Update Point

An active software update point is required in Configuration Manager 2007 to synchronize software updates metadata with Windows Server Update Services (WSUS), scan Configuration Manager client computers for software updates compliance, and deploy software updates to Configuration Manager client computers. Each site can have one or more software update point site systems created, but there is only one active software update point that accepts both intranet-based and Internet-based communication from client computers, or there are 2 active software update points; one that accepts intranet-based communication from client computers and one that accepts Internet-based communication from client computers.

When an active software update point is removed, software updates might be prevented from working throughout the Configuration Manager hierarchy depending on where in the hierarchy the software update point is located. Use the following procedure to remove a software update point site system role.

Procedure

To remove the software update point site system role

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / \\<server name>.

  2. Right-click ConfigMgr Software Update Point, and then click Delete.

  3. Click Yes to confirm the software update point deletion. Removing the software update point might prevent software updates from working properly throughout the Configuration Manager 2007 hierarchy.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Create and Configure an Active Software Update Point

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings


How to Remove the Inventory Tool for Microsoft Updates

The Inventory Tool for Microsoft Updates in Configuration Manager 2007 provides the ability to deploy software updates to Systems Management Server (SMS) 2003 client computers. When all SMS 2003 client computers have been upgraded to Configuration Manager 2007, or software update deployment to SMS 2003 client computers is no longer required, the inventory tool should be removed to prevent unnecessary network traffic, duplicated metadata synchronization, and so on.

Add or Remove Programs is used from Control Panel to uninstall the Configuration Manager 2007 Inventory Tool for Microsoft Updates from the primary site server. This will uninstall the inventory tool from the server and remove the packages, programs, and advertisements created during the installation for the inventory tool.

Important
After the Inventory Tool for Microsoft Updates is removed from the hierarchy, the software updates metadata specific to the tool will be set to an expired state. When there are active deployments that deploy software updates to SMS 2003 clients, the software updates in the deployment will display as expired, but cannot be removed. The deployment will continue to work for the valid software updates, but the deployment will be displayed with a gray icon indicating that there are expired updates in the deployment.

To prevent this issue, clear the Deploy software updates to SMS 2003 clients setting in the properties for all active deployments before removing the Inventory Tool for Microsoft Updates.

Use the following procedure to remove the Inventory Tool for Microsoft Updates.

Procedure

To remove the Inventory Tool for Microsoft Updates

  1. Recommended. Clear the Deploy software updates to SMS 2003 clients setting in the properties for all active deployments.

  2. Open the Control Panel on the site server where the Inventory Tool for Microsoft Updates is installed.

  3. Double-click Add or Remove Programs, click Configuration Manager Inventory Tool for Microsoft Updates in the list, and then click Remove.

  4. Recommended. Remove expired software updates from active deployments. Deployments that contain one or more expired software updates and expired software updates will display with a gray icon. For more information about removing a software update from a deployment, see How to Remove Software Updates from a Deployment.

See Also

Tasks

How to Remove Software Updates from a Deployment

Concepts

About the Inventory Tool for Microsoft Updates
Planning the SMS 2003 Software Updates Upgrade

Other Resources

How to Remove Software Updates Components


Software Updates Security Best Practices and Privacy Information

Applying the most recent security updates is a security best practice. Microsoft System Center Configuration Manager 2007 can make it easier to apply software updates to computers in your organization. However, there are some best practices to help prevent attackers from hijacking the software update infrastructure.

Security Best Practices

Do not change the default permissions on software update packages By default, software update packages are set to allow administrators full control and users read access. Changing these permissions could allow an attacker to add, remove, or delete software updates.

Control access to the download location for software updates The SMS Provider computer account and the user who will actually download the software updates to the download location both require write access to the download location. Restrict access to the download location to reduce the risk of attackers tampering with the software updates source files in the download location.

Use UTC for evaluating deployment times If you use local time instead of UTC, users could potentially delay installation of software updates by changing the time zone on their computers.

Follow best practices for securing WSUS For information about securing WSUS, including adding Active Directory authentication and SSL, see http://go.microsoft.com/fwlink/?LinkId=93170.

Important
If your site is in native mode, in addition to performing the typical steps for configuring SSL on the WSUS server, you must enable SSL on some additional virtual roots to support Configuration Manager 2007 native mode. For more information, see Planning for the Software Update Point Installation.

Enable CRL checking By default, the certificate revocation list (CRL) is not checked when verifying the signature on software updates. Checking the CRL each time a certificate is used offers more security against using a certificate that has been revoked, but it introduces a connection delay and incurs additional processing on the computer performing the CRL check. For the procedure, see How to Enable CRL Checking for Software Updates.

If the software update point is configured in a perimeter network, configure the site server to retrieve the data from the site system By default, site systems push their data back to the site server. A site system can be configured to require the site server to pull the data instead, which allows great control of the ports and permissions required for the data transfer. The setting Allow only site server initiated data transfers from this site system applies to the entire site system and all site system roles configured on it.

If you must deploy software updates to SMS 2003 clients, run the Inventory Tool for Microsoft Updates on a primary site server that is highest in the hierarchy While it is not required to install the Inventory Tool for Microsoft Updates on the central server, you should always install it on the highest site that clients report to. If the scan tool is installed on a primary site lower in the hierarchy, the sites higher in the hierarchy are not able to report on the software updates.

Configure WSUS to use a custom web site When installing WSUS on the software update point, you have the option to use the existing IIS Default Web site or to create a custom WSUS 3.0 Web site. You should create a custom Web site for WSUS so that Internet Information Services (IIS) hosts the WSUS 3.0 services in a dedicated virtual Web site instead of sharing the same Web site used by the other Configuration Manager 2007 site systems or other applications. For more information, see Planning for the Software Update Point Installation.

Enable BITS 2.5 for the site and the distribution points When software updates install on clients, the source files are first downloaded to the cache on the client computer and then installed. If BITS is enabled on the distribution point, disconnection from the network while software updates are downloading does not cause the deployment to fail because BITS resumes the download, starting where it was interrupted, the next time the client has network access. If BITS is not enabled on the distribution point and a network problem occurs while downloading software update files, the software update installation fails, which could leave the client vulnerable to attack.

Privacy Information

Software updates scans your client computers to determine which software updates you require, and then sends that information back to the site database. During the software updates process, Configuration Manager 2007 might transmit information between clients and servers that identify the computer and logon accounts.

Configuration Manager 2007 maintains state information about the software distribution process. State information is not encrypted during transmission or storage. State information is stored in the site database and deleted by the database maintenance tasks. No state information is sent back to Microsoft.

The use of Configuration Manager 2007 software updates to install software updates on client computers might be subject to software license terms for those updates, which is separate from the Software License Terms for Configuration Manager 2007. You should always review and agree to the Software Licensing Terms prior to installing the software updates using Configuration Manager 2007.

Configuration Manager 2007 does not implement software updates by default and requires several configuration steps before information is collected. Before configuring software updates, consider your privacy requirements.

See Also

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features
Software Updates in Configuration Manager


Troubleshooting Software Updates

This section provides information to help troubleshoot the software updates feature in Microsoft System Center Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=89592.

For information about error codes that appear in reports, see Custom Error Codes for Configuration Manager 2007.

In This Section

Monitoring Software Updates

Specifies information about monitoring software updates.

Log Files for Software Updates

Specifies information about the software updates log files.

Troubleshooting Software Updates Issues

Specifies information about the common issues for software updates and provides the steps to help resolve the issue.

Verification Checklists for Software Updates

Provides checklists that have checkpoints for a process that verifies the success of each step.

See Also

Other Resources

Software Updates in Configuration Manager


Monitoring Software Updates

At various points in the software updates process, you can use Microsoft System Center Configuration Manager 2007 reports to view the compliance levels for specific vulnerabilities and software updates, monitor the state of software update deployments, and check the health of the software update components. For example, if a new critical update is released for a particular vulnerability in Windows Server 2003, you can run a report that shows all the computers running Windows Server 2003 in your enterprise that are missing the critical update. When you authorize and deploy that software update, you can periodically run another report that shows compliance levels as reflected in state messages.

The following table lists the features that are available for monitoring software update processes.

Feature Description

Software updates status messages

The software updates components send status messages that contain information about the component installation, component processes, and component health. You can use the Configuration Manager 2007 status system to view the status messages for software updates components to help with monitoring and troubleshooting.

Software updates reporting

Software updates state messages provide information about the compliance of software updates and the evaluation and enforcement state of software update deployments. The software updates reports are used to display the state messages. There are more than 25 predefined software updates reports organized in several categories that can be used to report on specific information about software updates and deployments. For information about software updates reports, see About Software Updates Reports.

In addition to using the preconfigured reports, you can also create custom software updates reports, tailored to the needs of your enterprise. For more information, see Reporting in Configuration Manager.

See Also

Tasks

How to Monitor Software Update Deployments

Concepts

Planning for a Software Update Deployment
Reporting in Configuration Manager
About Software Updates Reports

Other Resources

Troubleshooting Software Updates


Log Files for Software Updates

The log files in Microsoft System Center Configuration Manager 2007 provide detailed information about the associated components and can be helpful when verifying functionality or when you troubleshoot issues. The log files can be found on the site server, the Windows Server Update Services (WSUS) server, and in two locations on the client computers.

Site Server Log Files

The Configuration Manager 2007 site server log files are found, by default, in <InstallationPath>\Logs. The following table provides the log file names and descriptions.

File Name Description

ciamgr.log

Provides information about the addition, deletion, and modification of software update configuration items.

distmgr.log

Provides information about the replication of software update deployment packages.

objreplmgr.log

Provides information about the replication of software updates notification files from a parent to child sites.

PatchDownloader.log

Provides information about the process for downloading software updates from the update source specified in the software updates metadata to the download destination on the site server.

Note
On 64-bit operating systems and on 32-bit operating systems without Configuration Manager 2007 installed, PatchDownloader.log is created in the server logs directory. On 32-bit operating systems, if the Configuration Manager 2007 client is installed, and on the synchronization host computer for the Inventory Tool for Microsoft Updates, PatchDownloader.log is created in the client logs directory.

replmgr.log

Provides information about the process for replicating files between sites.

smsdbmon.log

Provides information about when software update configuration items are inserted, updated, or deleted from the site server database and creates notification files for software updates components.

SUPSetup

Provides information about the software update point installation. When the software update point installation completes, Installation was successful is written to this log file.

WCM.log

Provides information about the software update point configuration and connecting to the WSUS server for subscribed update categories, classifications, and languages.

WSUSCtrl.log

Provides information about the configuration, database connectivity, and health of the WSUS server for the site.

wsyncmgr.log

Provides information about the software updates synchronization process.

WSUS Server Log Files

The log files for WSUS running on the software update point are found, by default, in %ProgramFiles%\Update Services\LogFiles. The following table provides the log file names and descriptions.

File Name | Description
Change.log | Provides information about the WSUS server database information that has changed.
SoftwareDistribution.log | Provides information about the software updates that are synchronized from the configured update source to the WSUS server database.

Client Computer Log Files

The Configuration Manager 2007 client computer log files are found, by default, in %windir%\CCM\Logs. For client computers that are also management points, the log files are found in %ProgramFiles%\SMS_CCM\Logs. The following table provides the log file names and descriptions.

File Name Description

CAS.log

Provides information about the process of downloading software updates to the local cache and cache management.

CIAgent.log

Provides information about processing configuration items, including software updates.

LocationServices.log

Provides information about the location of the WSUS server when a scan is initiated on the client.

PatchDownloader.log

Provides information about the process for downloading software updates from the update source to the download destination on the site server.

Note
On 64-bit operating systems and on 32-bit operating systems without Configuration Manager 2007 installed, PatchDownloader.log is created in the server logs directory. On 32-bit operating systems, if the Configuration Manager 2007 client is installed, and on the synchronization host computer for the Inventory Tool for Microsoft Updates, PatchDownloader.log is created in the client logs directory.

PolicyAgent.log

Provides information about the process for downloading, compiling, and deleting policies on client computers.

PolicyEvaluator

Provides information about the process for evaluating policies on client computers, including policies from software updates.

RebootCoordinator.log

Provides information about the process for coordinating system restarts on client computers after software update installations.

ScanAgent.log

Provides information about the scan requests for software updates, what tool is requested for the scan, the WSUS location, and so on.

ScanWrapper

Provides information about the prerequisite checks and the scan process initialization for the Inventory Tool for Microsoft Updates on Systems Management Server (SMS) 2003 clients.

SdmAgent.log

Provides information about the process for verifying and decompressing packages that contain configuration item information for software updates.

ServiceWindowManager.log

Provides information about the process for evaluating configured maintenance windows.

smscliUI.log

Provides information about the Configuration Manager Control Panel user interactions, such as initiating an Software Updates Scan Cycle from the Configuration Manager Properties dialog box, opening the Program Download Monitor, and so on.

SmsWusHandler

Provides information about the scan process for the Inventory Tool for Microsoft Updates on SMS 2003 client computers.

StateMessage.log

Provides information about when software updates state messages are created and sent to the management point.

UpdatesDeployment.log

Provides information about the deployment on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.

UpdatesHandler.log

Provides information about software update compliance scanning, and the download and installation of software updates on the client.

UpdatesStore.log

Provides information about the compliance status for the software updates that were assessed during the compliance scan cycle.

WUAHandler.log

Provides information about when the Windows Update Agent on the client searches for software updates.

WUSSyncXML.log

Provides information about the Inventory Tool for Microsoft Updates synchronization process.

This log is only on the client computer configured as the synchronization host for the Inventory Tool for Microsoft Updates.

Windows Update Agent Log File

The Windows Update Agent log file is found on the Configuration Manager Client computer, by default, in %windir%. The following table provides the log file name and description.

File Name | Description
WindowsUpdate.log | Provides information about when the Windows Update Agent connects to the WSUS server and retrieves the software updates for compliance assessment and whether there are updates to the agent components.

See Also

Other Resources

Troubleshooting Software Updates


Troubleshooting Software Updates Issues

Topic last updated—November 2007

This section provides information to help troubleshoot software updates issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=89592.

In This Section

Troubleshooting General Software Updates Issues

Troubleshooting Software Update Point Configuration Issues

Troubleshooting Software Updates Synchronization Failures

Troubleshooting Software Update Deployment Issues

Troubleshooting Software Updates Client Issues

Troubleshooting Group Policy Configuration for Software Updates

See Also

Concepts

Custom Error Codes for Configuration Manager 2007

Other Resources

Troubleshooting Software Updates


Troubleshooting General Software Updates Issues

Topic last updated—August 2007

Software Updates Fail on Child Sites but Succeed on Parent Sites

Delays in replication or failures in replication of content to child sites could cause software updates to fail.

Possible Solution

Check the deployments and packages at the child site to verify that they have been replicated correctly.

SMS 2003 Reports Might Not Work in Configuration Manager

Changes in the views used for software updates reporting might cause reports created in Systems Management Server (SMS) 2003 to fail or return inaccurate data.

Possible Solution

Re-create the reports in Configuration Manager 2007.

Reports Show Error 0x80040668

If you see error code 0x80040668 in the report Troubleshooting 2 - Deployment Errors, updates for the deployment have usually been successfully installed despite receiving the error. The description for this error is "Software update still detected as actionable after apply."

Possible Solution

This is usually a temporary condition. Wait for the next software update deployment evaluation cycle, and verify that the error has not reappeared.

Upgraded Administrators Do Not Have Access to All Objects

After upgrading, the user who ran the upgrade has access to all the objects in the Configuration Manager 2007 console but existing administrators have access only to objects that existed prior to upgrade.

Possible Solution

Only the user who runs Setup has access to the new objects after an upgrade. Administrators who had full rights to all SMS 2003 software updates objects will have full rights to the same objects in Configuration Manager 2007, but they will not have any rights to new object types such as deployment templates and update lists. Manually grant administrators access to the new objects they will manage.

Reports Show Error 0x8024400E "SOAP message could not be processed"

If you see reports in the category Software Updates - E. Troubleshooting with the following error, it might be a temporary issue or it could indicate a problem with the configuration of the software update point.

WU_E_PT_SOAP_SERVER SOAP_E_SERVER 0x8024400E - The SOAP message could not be processed due to a server error; resend later

Possible Solution

Check the configuration of the software update point.

Reports Missing State Message Data

State messages for deployments are replicated up the hierarchy to the site where the deployment was created. State messages for software updates are replicated to the site that synchronized with Microsoft Update, typically the central site. Reports run from a site higher in the hierarchy will not display information for the state messages that were replicated to a lower-level site.

Possible Solution

Synchronization to Microsoft Update should be configured at the central site for compliance information to be available in reports at the central site. Deployments should be created at the site where reports will be run for the deployment evaluation and enforcement state.

As Soon as Possible NAP Evaluation Setting Not Working

When Enable NAP evaluation is selected in the properties for a software update and Date and time is configured, switching to As soon as possible might not change the date and time to the current time when you exit the dialog box.

Possible Solution

Instead of using the As soon as possible setting, configure the Date and time setting to the current date and time. This issue does not occur when changing the effective date and time to As soon as possible in the properties for the Network Access Protection policy, located in Policies under the Network Access Protection node.

Installing Software Updates Outside of Configuration Manager Might Impact Compliance Reports

When software updates that are required are installed outside of Configuration Manager—for example, by manually installing the software update or by using Automatic Updates—the Software Updates Client Agent will continue to show the software update as pending. During the next scan for software updates compliance on the client computer, the software update will no longer show as pending and compliance reports will no longer show the software update as required on the client computer.

Possible Solution

To prevent this issue, client computers should not install required software updates using a method other than the Software Updates Client Agent.

Expired Software Updates Cannot Be Removed from an Active Deployment

After the Inventory Tool for Microsoft Updates is removed from the hierarchy, the software updates metadata specific to the tool will be set to an expired state. When there are active deployments that deploy software updates to SMS 2003 clients, the software updates in the deployment will display as expired but cannot be removed. The deployment will continue to work for the valid software updates, but the deployment will be displayed with a gray icon indicating that there are expired updates in the deployment.

Possible Solution

To prevent this issue, clear the Deploy software updates to SMS 2003 clients setting in the properties for all active deployments before removing the Inventory Tool for Microsoft Updates.

See Also

Other Resources

Troubleshooting Software Updates


Troubleshooting Software Update Point Configuration Issues

Topic last updated—November 2007

This section provides information about troubleshooting software update point issues in Configuration Manager 2007.

WSUS Configured as a Replica Server on an Active Software Update Point

After creating an active software update point, the configuration failed on WSUS server entry is written to the WSM.log file or the WSUS not configured entry is written to wsyncmgr.log on the site server in <ConfigMgrInstallationPath>\Logs. In Component Status, status message ID 6703 is displayed for the SMS_WSUS_SYNC_Manager component when synchronization fails.

Possible Solution

Windows Server Update Services (WSUS) running on the active software update point for child primary sites must not be configured as a replica server. Open the WSUS administration console, click Options, and then click Update Source and Proxy Server. On the Update Source tab, verify that the This server is a replica of the upstream server setting is not enabled. If it is enabled, clear the setting and then click OK. WSUS Configuration Manager should be able to configure the WSUS server, and WSUS Synchronization Manager should be able to initiate WSUS synchronization after this setting has been cleared.

Error 0x80131401 When Configuring WSUS Running on the Software Update Point

After the active software update point is installed, WSUS Control Manager connects to WSUS running on the software update point to configure the WSUS settings. There is a known issue where the WsusPool in Internet Information Services (IIS) stops responding and must be restarted. When the WsusPool is in this state, WSUS Control Manager will write an error message similar to Server was unable to process request and the error code 0x80131401 is written to WSUSCtrl.log on the software update point. The following are sample entries when this condition exists:

Found WSUS Admin dll of assembly version Microsoft.UpdateServices.Administration, Version=3.0.6000.273, Major Version = 0x30000, Minor Version = 0x17700111

Found WSUS Admin dll of assembly version Microsoft.UpdateServices.Administration, Version=2.0.0.0, Major Version = 0x20000, Minor Version = 0x0

The installed WSUS build has the valid and supported WSUS Administration DLL assembly version (3.1.6000.1)

System.Web.Services.Protocols.SoapException: System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.IO.FileLoadException: Loading this assembly would produce a different grant set from other instances. (Exception from HRESULT: 0x80131401)~ STATMSG: ID=7000 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_CONTROL_MANAGER" SYS=NOVAPHYB4N05 SITE=U44 PID=4456 TID=4344 GMTDATE=Fri Aug 10 00:34:58.312 2007 ISTR0="NOVAPHYB4N05" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Failed to set WSUS Local Configuration. Will retry configuration in 1 minutes

System.Web.Services.Protocols.SoapException: System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.IO.FileLoadException: Loading this assembly would produce a different grant set from other instances. (Exception from HRESULT: 0x80131401)~

STATMSG: ID=7003 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_CONTROL_MANAGER" SYS=NOVAPHYB4N05 SITE=U44 PID=4456 TID=4344 GMTDATE=Fri Aug 10 00:34:58.421 2007 ISTR0="NOVAPHYB4N05" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Failures reported during periodic health check by the WSUS Server NOVAPHYB4N05. Will retry check in 1 minutes

Waiting for changes for 1 minutes

Possible Solution

Restart the WsusPool application pool in IIS. In the Internet Information Services (IIS) Manager, navigate to the Application Pools node, right-click WsusPool, click Stop, right-click WsusPool, and then click Start.

See Also

Other Resources

Troubleshooting Software Updates Issues


Troubleshooting Software Updates Synchronization Failures

Topic last updated—November 2007

This topic provides general troubleshooting information for Configuration Manager 2007 software updates synchronization and specific synchronization issues and provides detailed information about issues and possible solutions.

General Troubleshooting Tips

Typically, synchronization errors occur when one of the following is not configured correctly:

  • When the active software update point is installed on a remote site system server, the Windows Server Update Services (WSUS) Administration console must be installed on the site server.
  • The port settings configured for the active software update point must be the same as the port settings configured for the WSUS Web site in Internet Information Services (IIS).
  • When there is a proxy server between the active software update point and the upstream update server or Microsoft Update, the proxy server and the software update point proxy server account must be configured, if credentials are required.
  • The computer and Administrator accounts must be able to access virtual directories under the WSUS Web site in IIS from the site server.
  • The active software update point at the central site should be configured to synchronize with Microsoft Update. This setting is automatically configured when you first create the software update point on the central site, but if the setting is modified in the WSUS Administration console, WSUS Configuration Manager does not reset this setting as it does for other WSUS settings.

Check for Errors

When synchronization fails, status message ID 6703 is created by WSUS Synchronization Manager (the SMS_WSUS_SYNC_MANAGER component in Component Status) and log file entries are recorded on the site server.

Status Message ID 6703

Status message ID 6703 contains different error messages depending on the problem that occurs. Look for the synchronization error message in one of the detailed troubleshooting topics for possible solutions to the issue.

Wsyncmgr.log

The wsyncmgr.log file is located on the site server in the <ConfigMgrInstallationPath>\Logs folder. When there are synchronization errors, WSUS Synchronization Manager writes entries to the log file with the specific errors. Look for the error message in one of the detailed troubleshooting topics for possible solutions to the issue.

WCM.log

Log file entries are not written to WCM.log as part of the synchronization process, but the entries can provide some clues to help troubleshoot issues with synchronization. WSUS Configuration Manager connects to WSUS running on the active software update point once every hour, by default, and if there is a problem with ports or connectivity, errors are logged in this log file that might provide more detail than wsyncmgr.log.

WSUS Server Not Configured Error

WSUS Synchronization Manager fails to connect to the WSUS server to initiate synchronization with the message WSUS server not configured. The status message described in the following table is created.

Message ID | Description
6703 | SMS WSUS Synchronization failed. Message: WSUS server not configured. Source: CWSyncMgr::DoSync. The operating system reported error 2147500037: Unspecified error

WSUS Synchronization Manager writes log entries to wsyncmgr.log in <ConfigMgrInstallationFolder>\Logs similar to the following:

Performing sync on regular schedule

STATMSG: ID=6701 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=5364 TID=5220 GMTDATE=<Date & Time> ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Sync failed: WSUS server not configured. Source: CWSyncMgr::DoSync

STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=5364 TID=5220 GMTDATE=<Date & Time> ISTR0="CWSyncMgr::DoSync" ISTR1="WSUS server not configured" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Sync failed. Will retry in 60 minutes

Sync time: 0d00h05m01s

Possible Solutions

Following are possible solutions for the WSUS server not configured error:

  • Check the port settings configured for the active software update point, and make sure they are the same as the port settings configured for the Web site used by WSUS running on the active software update point. For more information, see How to Determine the Port Settings Used by WSUS.
  • Check to make sure the fully qualified domain name (FQDN) for the active software update point site system server is correct. For more information, see How to Verify the Fully Qualified Domain Name Settings Used By the Active Software Update Point.
  • When the Configuration Manager site is in native mode, the WSUS Web site and virtual directories must be configured for Secure Sockets Layer (SSL) because the active software update point is automatically configured to use SSL, but WSUS is not automatically configured. When a Configuration Manager site is in mixed mode, you have the option to configure the active software update point to use SSL. In both cases, you must manually configure the WSUS Web site and virtual directories. For more information, see How to Configure the WSUS Web Site to Use SSL.
  • Check to make sure that WSUS running on the active software update point for the child primary site is not configured to be a replica. The following procedure provides the steps to check whether WSUS is configured to be a replica.

    To check the update source settings in WSUS

    1. Open the WSUS console on the active software update point for the site.

    2. Click Options in the console tree pane.

    3. Click Update Source and Proxy Server in the display pane.

    4. Verify that This server is a replica of the upstream server is not selected unless you are in the WSUS console on the active software update point for a secondary site. Child primary sites should never be configured as a replica of the upstream server.

  • Check that Update Services is running on the WSUS server.

The Remote Name Could Not Be Resolved Error

Update Services on the WSUS server fails to connect to the configured upstream update source with the message The remote name could not be resolved. The status message described in the following table is created.

Message ID | Description
6703 | SMS WSUS Synchronization failed. Message: UssCommunicationError: WebException: The remote name could not be resolved: 'www.update.microsoft.com' at System.Net.HttpWebRequest.GetRequestStream(). Source: Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction.SyncWSUS. The operating system reported error 2147500037: Unspecified error

WSUS Synchronization Manager writes log entries to wsyncmgr.log in <ConfigMgrInstallationFolder>\Logs similar to the following:

Performing sync on local request

STATMSG: ID=6701 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=3584 TID=756 GMTDATE=Mon Aug 06 17:54:25.519 2007 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

STATMSG: ID=6704 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=3584 TID=756 GMTDATE=Mon Aug 06 17:54:26.660 2007 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Synchronizing WSUS server <ComputerName>

Synchronizing WSUS server <FQDN> ...

sync: Starting WSUS synchronization

Sync failed: UssCommunicationError: WebException: The remote name could not be resolved: 'www.update.microsoft.com'~~at System.Net.HttpWebRequest.GetRequestStream(). Source: Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction.SyncWSUS

STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=3584 TID=756 GMTDATE=Mon Aug 06 17:54:32.699 2007 ISTR0="Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction.SyncWSUS" ISTR1="UssCommunicationError: WebException: The remote name could not be resolved: 'www.update.microsoft.com'~~at System.Net.HttpWebRequest.GetRequestStream()" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Sync failed. Will retry in 60 minutes

Update Services writes similar log entries to <WSUSInstallationFolder>\LogFiles\SoftwareDistribution.log.

Possible Solution

Check the proxy settings configured for the active software update point, and make sure they are configured correctly. When there is a proxy server between the WSUS server and the upstream update source, the proxy settings must be configured. When credentials are required, you must specify the correct account information for the proxy. For information about how to configure the proxy settings in Configuration Manager, see How to Configure the Proxy Settings for the Software Update Point.

When the proxy settings are configured correctly in the ConfigMgr software update point properties, you can open the WSUS console to check the proxy settings to make sure they match the settings in Configuration Manager. When the proxy settings are configured correctly, you can review the synchronization status in the WSUS console, which might provide more information about why WSUS synchronization failed.

This issue can also be caused by any number of network issues that prevent the URL address for the upstream update source from being resolved. If configuring the proxy settings does not resolve the issue, troubleshoot this issue like any other name-resolution issue on your network.

The Request Failed with HTTP Status 401: Unauthorized Error

When WSUS Synchronization Manager initiates WSUS synchronization, access to the ApiRemoting30 virtual directory in IIS is required. When access is denied to this virtual directory with the message The request failed with HTTP status 401: Unauthorized, the status message described in the following table is created.

Message ID | Description
6703 | SMS WSUS Synchronization failed. Message: The request failed with HTTP status 401: Unauthorized. Source: Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer. The operating system reported error 2147500037: Unspecified error

WSUS Synchronization Manager writes log entries to wsyncmgr.log in <ConfigMgrInstallationFolder>\Logs similar to the following:

Performing sync on local request

STATMSG: ID=6701 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=2300 TID=3720 GMTDATE=<Date & Time> ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

STATMSG: ID=6704 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=2300 TID=3720 GMTDATE=<Date & Time> ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Synchronizing WSUS server <ComputerName>

Sync failed: The request failed with HTTP status 401: Unauthorized. Source: Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer

STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=2300 TID=3720 GMTDATE=<Date & Time> ISTR0="Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer" ISTR1="The request failed with HTTP status 401: Unauthorized" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Sync failed. Will retry in 60 minutes

Sync time: 0d00h00m03s

Next scheduled sync is a retry sync at <Date & Time>

Waiting 60 minutes for requests…

Possible Solution

Check the permissions on the ApiRemoting30 virtual directory under the WSUS Web site in IIS. The computer and Administrator accounts must have appropriate rights to this virtual directory. The following procedure provides the steps to check the permissions on the ApiRemoting30 virtual directory.

To check the permissions on the ApiRemoting30 virtual directory

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Navigate to Internet Information Services \ <computername> \ Web Sites \ <WSUS Web site> \ ApiRemoting30.

  3. Right-click ApiRemoting30, and then click Permissions.

Unable to Connect to Remote Server Error

WSUS Synchronization Manager fails to connect to the WSUS server to initiate synchronization with the message Unable to connect to remote server. The status message described in the following table is created.

Message ID | Description
6703 | SMS WSUS Synchronization failed. Message: Unable to connect to the remote server. Source: Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer. The operating system reported error 53: The network path was not found.

WSUS Synchronization Manager writes log entries to wsyncmgr.log in <ConfigMgrInstallationFolder>\Logs similar to the following:

Performing sync on local request

STATMSG: ID=6701 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=2300 TID=3720 GMTDATE=<Date & Time> ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

STATMSG: ID=6704 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=2300 TID=3720 GMTDATE=<Date & Time> ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Synchronizing WSUS server <ComputerName>

Sync failed: Unable to connect to the remote server. Source: Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer

STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=2300 TID=3720 GMTDATE=<Date & Time> ISTR0="Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer" ISTR1="Unable to connect to the remote server" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Sync failed. Will retry in 60 minutes

Sync time: 0d00h00m03s

Waiting 59 minutes for requests...

Possible Solutions

Following are possible solutions for the Unable to connect to remote server error:

  • Check to make sure the IIS Admin Service and World Wide Web Publishing Service services are running.
  • Check the connection to the active software update point where WSUS is running.

The Request Failed with DssAuthenticationError: WebException Error

When access is denied to the DSSAuthWebService virtual directory with the message DssAuthenticationError: WebException: The request failed with HTTP status 401: Unauthorized, the message described in the following table is created.

Message ID | Description
6703 | SMS WSUS Synchronization failed. Message: DssAuthenticationError: WebException: The request failed with HTTP status 401: Unauthorized. at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall). Source: Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction.SyncWSUS.

WSUS Synchronization Manager writes log entries to wsyncmgr.log in <ConfigMgrInstallationFolder>\Logs similar to the following:

Found parent sync notification file TEQ.SYN.

Performing sync on parent request

STATMSG: ID=6701 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=5044 TID=7228 GMTDATE=<Date & Time> ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

STATMSG: ID=6704 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=5044 TID=7228 GMTDATE=<Date & Time> ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Synchronizing WSUS server <ComputerName>

Synchronizing WSUS server <FQDN> ...

sync: Starting WSUS synchronization

Sync failed: DssAuthenticationError: WebException: The request failed with HTTP status 401: Unauthorized.~~at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall). Source: Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction.SyncWSUS

STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=<ComputerName> SITE=<SiteCode> PID=5044 TID=7228 GMTDATE=<Date & Time> ISTR0="Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction.SyncWSUS" ISTR1="DssAuthenticationError: WebException: The request failed with HTTP status 401: Unauthorized.~~at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Sync failed. Will retry in 60 minutes

Sync time: 0d00h00m28s

Next scheduled sync is a retry sync at <Date & Time>

Waiting 60 minutes for requests…

Possible Solution

Check the IIS permissions on the DssAuthWebService virtual directory for the WSUS Web site in IIS. The virtual directory must be enabled for anonymous access. By default, the IUSR_<ComputerName> account is used for anonymous access. Check that this account has appropriate rights—for example, whether this account is a member of the Guests group where access has been denied. The following procedure provides the steps to configure the directory permissions for the virtual directory.

To configure anonymous access on the DssAuthWebService virtual directory

  1. On the WSUS server, open Internet Information Services (IIS) Manager.

  2. Expand Web Sites, and then expand the Web site for the WSUS server. It is recommended that the WSUS custom Web site be used, but the default Web site might have been chosen when installing WSUS.

  3. Right-click DssAuthWebService, and then click Properties.

  4. Click the Directory Security tab, and then click Edit in the Authentication and access control section.

  5. Verify that Enable anonymous access is selected and that the IUSR_<ComputerName> account is specified.

Unexpected Software Updates Are Synchronized

When WSUS Synchronization Manager synchronizes with the WSUS server, all software updates metadata in the WSUS database is returned and inserted, or updated, in the Configuration Manager database. If the WSUS server was previously synchronized using different software updates filters (classifications, categories, or languages) than what is currently configured for the active software update point at the central site, software updates metadata outside of the configured filters might be synchronized.

This can occur when an existing WSUS server is used for the active software update point or when the configured languages, products, or classifications are modified directly on the WSUS server and then synchronization is initiated from the WSUS console.

Possible Solution

Every 60 minutes WSUS Configuration Manager will modify the settings on the WSUS server to reflect the configuration for the active software update point. This will prevent additional software updates metadata from being synchronized.

Run Synchronization Action Is Not Available in Console

When you navigate to the Updates Repository node in the Configuration Manager console, the Run Synchronization action is not displayed or not enabled.

Possible Solution

The following requirements must be met before the Run Synchronization action is available:

  • The action is available only from the central site. Synchronization cannot be manually started on child sites and can be initiated only when a synchronization request is received from the parent site.
  • There must be an active software update point installed on the central site.
  • The active software update point must be configured to synchronize with Microsoft Update.

Software Updates Are Not Synchronized in Configured Languages

Software updates are synchronized, but the summary details information is not being synchronized for all of the languages that are selected in the Software Update Point Component Properties. When the active software update point on the central site is synchronized, the selected summary details languages determine what software update metadata is retrieved. If the summary details languages are modified after the synchronization has run at least one time on the central site, the metadata is retrieved in the modified summary details languages for only new software updates or updates that have changed since the last synchronization. The software updates that have already been synchronized will not retrieve metadata for different languages unless there is a change to the update on Microsoft Update or if a custom update is republished to WSUS running on the active software update point for the central site.

Possible Solution

A full synchronization cannot be performed for software updates that have already been synchronized. It is very important that you select all of the summary details languages that will be needed in your Configuration Manager hierarchy before running synchronization on the central site.

Wsyncmgr.log Shows Error 12 and Invalid Schema

If you see the following entries in the wsyncmgr.log, there is a problem with SQL Server:

sp_SetupSDMPackage returns an error

DCM digest has invalid schema

Possible Solution

Restart the SQL Server service.

Synchronization Times Out Because WSUS Synchronization Is in Progress

When Configuration Manager 2007 attempts to synchronize with WSUS, and WSUS running on the active software update point is in the process of synchronizing, Configuration Manager 2007 waits for it to complete in most cases and then initiates synchronization. In some cases, the synchronization process times out while waiting for WSUS to complete synchronization.

Synchronization should never be initiated from the WSUS console. Instead, run the Run Synchronization action in the Configuration Manager console, or let synchronization initiate on the configured synchronization schedule.

Possible Solution

In the WSUS console, click the Synchronizations node and check the status of WSUS synchronization. You can cancel the synchronization in the WSUS console so that Configuration Manager 2007 can start the synchronization process, or you can wait until the WSUS synchronization has completed.

Software Updates Metadata Not Displayed in Configuration Manager Console

When Configuration Manager 2007 initiates synchronization for the first time, the synchronization process can take a long time to complete. During this time the software updates metadata are not displayed in the Configuration Manager console.

Possible Solution

In the WSUS console, click the Synchronizations node and check the status of WSUS synchronization. If synchronization is in progress, wait for it to complete and then monitor the wsyncmgr.log until Configuration Manager 2007 synchronization completes.

Synchronization Fails for an Unknown Reason

If you check wsyncmgr.log but are unable to determine a specific cause for the failure, a number of issues could be involved.

Possible Solutions

Following are possible solutions for synchronization failure:

  • The software update point is not installed. Install a software update point in each Configuration Manager 2007 site. For more information, see Administrator Checklist: Planning and Preparing Software Updates and Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site or Administrator Checklist: Configuring the Software Update Point in a Native Mode Site.
  • The proxy settings on the software update are incorrect. Configure the correct server name, port, and credentials, if required. For more information, see ConfigMgr Software Update Point Properties.
  • The computer running SQL Server does not have enough memory or is not optimally configured. Have the SQL Server administrator monitor the SQL Server performance and tune if necessary. For more information, refer to the SQL Server documentation.

See Also

Other Resources

Troubleshooting Software Updates Issues


Troubleshooting Software Update Deployment Issues

Topic last updated—November 2007

This topic provides information about troubleshooting software update deployment issues in Configuration Manager 2007.

Software Updates Are Downloaded in Deploy Software Updates Wizard When They Have Already Been Downloaded

When creating a software update deployment that will target Systems Management Server (SMS) 2003 clients and at least one software update has not yet been downloaded, all the software updates not in the package configured for the deployment will be downloaded even when they were previously downloaded to another package. When all software updates have been downloaded prior to creating the deployment, when the downloaded updates were previously downloaded to the package selected in the deployment, or when the Deploy software updates to SMS 2003 clients setting is not selected in the deployment, the wizard downloads only the software updates that have not been previously downloaded.

Possible Solution

To prevent this behavior, download the software updates that have not yet been downloaded prior to creating the deployment by using the Download Updates Wizard or the Update List Wizard.

The Deploy Software Updates Wizard Prompts for Download Settings for Software Updates That Are Already Downloaded.

When software updates are downloaded to a deployment package by using the Download Updates Wizard or the Update List Wizard and then the same software updates are selected for deployment before refreshing the software updates list view in the Configuration Manager console, the Deploy Software Updates Wizard will prompt for the download settings, making it appear as if the software updates will be downloaded to the package again.

Possible Solution

The software updates will not be downloaded again to the deployment package. The Deploy Software Updates Wizard will verify that the files are in the package and skip the download process. To prevent this behavior, refresh the software updates list view in the Configuration Manager console after downloading software updates and prior to deploying them.

Downloading Large Software Update Files Might Fail

If you run the Configuration Manager 2007 console on Microsoft Windows Server 2003 or Windows XP computers, downloading large software updates might fail due to a known issue with operating systems earlier than Windows Vista. For example, when you use the Download Updates Wizard, Deploy Software Updates Wizard, or Updates List Wizard to download a large service pack, you might see the error "invalid certificate signature" in the confirmation page of the wizard.

Possible Solution

One of the following workarounds might resolve this issue:

  • Close the wizard, restart the Configuration Manager 2007 console, and attempt to download the large software update again.
  • Run the Configuration Manager 2007 console on a computer running Windows Vista.

Failed to Deploy Migrated Software Updates

During the upgrade process, Configuration Manager 2007 Setup appends (LEGACY) to the title for each software update. This helps you identify software updates that were migrated among the new software updates metadata that is synchronized after the upgrade. Software updates with (LEGACY) in the title should not be deployed to clients and are migrated only for software update distributions that were also migrated and for reporting purposes.

Possible Solution

You can run a script to hide these software updates in the Configuration Manager console so that only deployable software updates are displayed. A sample script is available from the Microsoft Script Center Script Repository (http://go.microsoft.com/fwlink/?LinkId=102377).

Note
Migrated software updates that are in a software update deployment that was also migrated will not be hidden until the migrated deployment is deleted or the updates are removed from the deployment.

Failed to Deploy Metadata-Only Software Updates

Note
The information in this section applies only to Configuration Manager 2007 SP1.

Metadata-only software updates are available in the Configuration Manager console for reporting and cannot be deployed or downloaded.

Possible Solution

The metadata-only software update must be associated with an update file and republished to Windows Server Update Services (WSUS) running on the active software update point before it can be deployed.

See Also

Concepts

About Software Update Deployments
Administrator Checklist: Assessing and Deploying Software Updates
Planning for a Software Update Deployment

Other Resources

Troubleshooting Software Updates


Troubleshooting Software Updates Client Issues

Topic last updated—November 2007

This topic provides information about troubleshooting software update client issues in Configuration Manager 2007.

Display Notification Displays with Installation Deadline for Optional Software Updates

When optional software updates are deployed to and available on a Configuration Manager 2007 client computer and the Install required updates on a schedule setting is enabled on the client computer, a display notification might appear every three hours that incorrectly indicates that the software update will automatically install at a specific time. Because the software update is optional, the notification is incorrect and the software update will not be automatically installed on the client computer. This issue does not occur on client computers that do not have the Install required updates on a schedule setting enabled.

Possible Solution

Specify the Suppress display notifications on clients setting on the Display/Time Settings page of the Deploy Software Updates Wizard when deploying optional software updates to client computers that have the Install required updates on a schedule setting enabled.

Client Scan Fails with Error 0x80040693

In the Microsoft System Center Configuration Manager 2007 console, view any reports in the category Software Updates - E. Troubleshooting. If a Configuration Manager 2007 client reports the error code 0x80040693, it means the client is running the wrong version of Windows Update Agent (WUA). Configuration Manager 2007 clients require version 7.0.6000.374 or higher. For more information, see How to Check the Windows Update Agent Version on Clients.

Possible Solution

If client computers are configured for Automatic Update, they should automatically update their Windows Update Agent from their Automatic Update source. If clients are not configured for Automatic Update, you can locate the WUA redistributable file wuredist.cab on MSDN and deploy it using Configuration Manager 2007 software distribution.

Scan for Software Updates Compliance Fails - Incorrect Windows Update Agent Version

Windows Update Agent (WUA) 3.0 or later must be installed on client computers for the client computer to successfully scan for software updates compliance. You can verify the Windows Update Agent version on client computers in either of the following ways.

  • Hardware inventory: After a client computer has scanned for software updates compliance at least one time, the Windows Update Agent version is reported as part of hardware inventory. This allows you to check the Windows Update Agent version by running Resource Explorer for a specific client computer, or you can create a query that retrieves client computers and the Windows Update Agent version, such as the following:
    Copy Code
    SELECT v_R_System.Netbios_Name0, v_GS_WINDOWSUPDATEAGENTVERSIO.Version0
FROM v_GS_WINDOWSUPDATEAGENTVERSIO
INNER JOIN v_R_System ON v_GS_WINDOWSUPDATEAGENTVERSIO.ResourceID = v_R_System.ResourceID
WHERE v_GS_WINDOWSUPDATEAGENTVERSIO.Version0 <> 'ISNULL'
ORDER BY v_GS_WINDOWSUPDATEAGENTVERSIO.Version0
    You can use a similar query when creating a Configuration Manager custom report. The preceding sample query retrieves all computers that have a value for the Windows Update Agent version.
  • Software updates reports: The Windows Update Agent is reported as part of the 1 - Last scan states by collection and Scan 2 - Last scan states by site reports.

Possible Solution:

Upgrade client computers to WUA 3.0. There are several ways to upgrade the WUA on client computers.

  • Self update through Automatic Updates: Enable Automatic Updates on the client computers, and configure Windows Server Update Services running on the software update point site system to support self-update. For more information, see the section about updating WSUS client software in the WSUS Technical Library (http://go.microsoft.com/fwlink/?LinkId=100333).
    Manually install Windows Update Agent 3.0: You can download the Windows Update Agent 3.0 installation file and upgrade client computers. This can be done at each client, or you can create a query-based collection that retrieves the client computers that do not meet the required Windows Update Agent version and then distribute the Windows Update Agent 3.0 installation file by advertising the file to the collection. For more information about installing Windows Update Agent 3.0, see How to Install the Windows Update Agent on Client Computers.

Software Update Installation Fails with Error 0x80091007

Before a Configuration Manager 2007 client can install software updates, it verifies the hash on the content containing the software update. If the hash does not match, the client fails to install the software update and logs error 0x80091007 to the updatesdeployment.log on the client. The error is also sent to the management point and is visible in the reports under the category Software Updates - E. Troubleshooting.

This issue is often caused by having the wrong version of the package on the distribution point. Frequently this issue occurs when content has not been replicated to a child site or when the package version has changed but the client has not received new policy yet.

Possible Solution

In the Configuration Manager 2007 console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages / <package name> / Package Status / Package Status / <site code>, and look at the source version for the package. Verify that all distribution points are using the same source version, including any distribution points at the child site. You can also look at distmgr.log for any errors that reference the package ID.

Software Update Installation Fails with Error = 0x80004002

A client computer fails to install a software update with the 0x80004002 error message reported in the client log files, such as the following sample log entries:

  • UpdatesHandler.log
    WSUS update (689c410a-44d7-45c7-ae51-9806fcb177f5) installation result = 0x80004002, Reboot State = NoReboot
    Update execution failed.
  • WUAHandler.log
    Failed to get final installation result of updates. Error = 0x80004002.
    Update 1 (<unique update ID>) finished installing (0x80004002).
    Update 2 (<unique update ID>) finished installing (0x80004002).
    Installation of updates completed.
  • WindowsUpdate.log
    WARNING: WU client failed installing updates with error 0x80004002

The UpdatesHandler.log and WUAHandler.log files are located in <ConfigMgrInstallationPath>\Logs, and the WindowsUpdate.log is located in %windir%.

Possible Solution

The WUA installation on the client might be missing files or be corrupt. Reinstall WUA 3.0 on the client computer. For more information about installing WUA 3.0, see How to Install the Windows Update Agent on Client Computers.

See Also

Tasks

How to Install the Windows Update Agent on Client Computers


Troubleshooting Group Policy Configuration for Software Updates

Topic last updated -- August 2007

When a Configuration Manager 2007 client is configured to use the software updates client agent, it is automatically configured with a local Group Policy setting that specifies the Configuration Manager active software update point. The Group Policy setting used is the intranet Microsoft update service location, specified as a Windows Update computer administrative template.

Because this configuration uses a local Group Policy setting, it is suitable for workgroup clients and for clients that belong to a different Active Directory forest from the site server.

However, a local Group Policy setting will always be overwritten by an Active Directory Group Policy setting, and this can result in the Configuration Manager 2007 client failing to obtain software updates using Configuration Manager. This section provides troubleshooting information to help you resolve issues related to Group Policy that prevents software updates from working in Configuration Manager 2007.

Computers Fail to Obtain Software Updates after Software Update Point Based Client Installation is Configured

If Configuration Manager 2007 clients fail to obtain software updates from Configuration Manager and they have an Active Directory Group Policy setting configured for software update point based client installation, a likely reason is that the Active Directory Group Policy object is incorrectly configured.

The software updates feature automatically configures a local Group Policy setting for the Configuration Manager 2007 client so that it is configured with the software update point source location and port number. Both the server name and port number is required for the software updates client to find the software update point.

If an Active Directory Group Policy setting is applied to computers for software update point client installation, this overrides the local Group Policy setting. Unless the value of the setting is exactly the same (server name and port), this causes the Configuration Manager 2007 software updates feature to fail on the client.

The following entries appear in the software updates log file WUAHandler.log:

[Group policy settings were overwritten by a higher authority (Domain Controller) to: Server http://server and Policy ENABLED]LOG

Solution

The software update point for client installation and software updates must be the same server, and specified in the Active Directory Group Policy setting with the correct name format and with the port information (for example, http://server1.contoso.com:80 if the site system server is not configured to use a fully qualified domain name and is using the default Web site).

For more information, see How to Install Configuration Manager Clients Using Software Update Point Based Installation.

Computers Continue to Use an Existing WSUS Server

If Configuration Manager 2007 clients continue to download software updates from an existing WSUS server rather than install them using Configuration Manager, examine the resultant set of policies for the clients using a tool such as the Resultant Set of Policy (RSoP) or the Microsoft Group Policy Management Console (GPMC).

If these clients have an Active Directory Group Policy object assigned to them that specifies a WSUS server that is not their active software update point (using the correct name format and port), it will override the local Group Policy setting configured by the Configuration Manager software updates feature.

The Group Policy setting used is Specify intranet Microsoft update service location and it is located in Computer Configuration / Administrative Templates / Windows Components / Windows Update.

When an Active Directory Group Policy setting overrides the local Group Policy setting, the following entries appear in the software updates log file WUAHandler.log:

[Group policy settings were overwritten by a higher authority (Domain Controller) to: Server http://server and Policy ENABLED]LOG

Solution

Reconfigure Active Directory Group Policy such that Configuration Manager clients are not assigned an Active Directory Group Policy object that specifies a WSUS server other than their active software update point. For example, reconfigure the Active Directory Group Policy setting to Not Configured, or move computers to an organizational unit (OU) that does not have this Group Policy setting applied.

See Also

Other Resources

Troubleshooting Software Updates Issues


Troubleshooting Inventory Tool for Microsoft Updates Issues

Topic Last Updated—August 2008

This section provides information about troubleshooting issues with the Inventory Tool for Microsoft Updates in Configuration Manager 2007.

Software Updates Fail to Deploy Because the Microsoft Update Catalog Fails to Synchronize

During the June 10, 2008 release of the Microsoft Update catalog, additional metadata that is associated with Microsoft Office 2003 Service Pack 1 was added to the Wsusscn2.cab file. The catalog synchronization process (UpdateWUSCatalog.exe) was not designed to handle the specific changes, and as a result, synchronization for the Inventory Tool for Microsoft Updates fails and the latest updates are not available to Systems Management Server (SMS) 2003 clients.

Possible Solution

To resolve this issue, you must install an update to the UpdateWUSCatalog.exe file that accommodates the new metadata. The update must be installed on the Configuration Manager site server, and then catalog synchronization must be manually run before Systems Management Server (SMS) 2003 clients using the Inventory Tool for Microsoft Updates will successfully scan for software updates. The update is available and described in Knowledge Base article 954474 (http://go.microsoft.com/fwlink/?LinkId=123771).

Inventory Tool for Microsoft Updates Setup Fails to Install During Silent Mode Site Server Installation

During the SMS 2003 site upgrade to Configuration Manager 2007, Setup detects whether a previous version of the Inventory Tool for Microsoft Updates is installed on the site and verifies that another installation of the tool is not installed on a site higher in the hierarchy. If both conditions are true, Setup initiates an upgrade for the inventory tool on the site server. During the installation, you can specify whether to download the latest Microsoft Update catalog from the Internet or from a local location.

When a site server is upgraded in silent mode (using the /UPGRADE, /HIDDEN, and /NOUSERINPUT command-line options), the Inventory Tool for Microsoft Updates Setup also runs in silent mode. During the inventory tool upgrade, Setup will automatically download the latest Microsoft Update catalog from the Internet. If the site server cannot access the Internet, the Inventory Tool for Microsoft Updates upgrade fails.

Possible Solution

When the site server has been installed in silent mode and the Inventory Tool for Microsoft Updates upgrade fails, run Setup again manually. When the site server cannot access the Internet, copy the latest Microsoft Update catalog to a location accessible from the site server and then, during the installation, specify the local path to the Microsoft Update catalog. You can download the latest Microsoft Update Catalog from the Microsoft Update Web site (http://go.microsoft.com/fwlink/?LinkID=74689). For more information about the Inventory Tool for Microsoft Updates installation, see How to Install and Configure the Inventory Tool for Microsoft Updates.

Expired Software Updates Cannot Be Removed from a Deployment

After the Inventory Tool for Microsoft Updates is removed from the hierarchy, the software updates metadata specific to the tool will be set to an expired state. When there are active deployments that deploy software updates to SMS 2003 clients, the software updates in the deployment will appear as expired, but they cannot be removed. The deployment will continue to work for the valid software updates, but the deployment will be displayed with a gray icon indicating that there are expired updates in the deployment.

Possible Solution

To prevent this issue, clear the Deploy software updates to SMS 2003 clients setting in the properties for all active deployments before removing the Inventory Tool for Microsoft Updates.

See Also

Other Resources

Troubleshooting Software Updates Issues


Verification Checklists for Software Updates

The verification checklists for software updates in Configuration Manager 2007 provide the information necessary to verify that the process has completed successfully. Click the related link for detailed information about the associated verification checklist.

In This Section

Verification Checklist: Software Updates Synchronization

Provides the information necessary to verify that the synchronization process completed successfully.

See Also

Other Resources

Troubleshooting Software Updates


Verification Checklist: Software Updates Synchronization

There are several phases in the software updates synchronization process, and throughout the process status messages, event ID's, and log files can be used to verify the different parts of the process. The following table provides the information necessary to verify that the synchronization process completed successfully.

Note
Several components are involved in the synchronization process, but in this version of the document, the WSUS Synchronization Manager (WSM) on the site server and Update Services on the Windows Server Update Services (WSUS) server are the only components included.

Verification Step Verification Item Verification Component

Synchronization started on site server.

Status Message 6701
  • Component Status - SMS_WSUS_SYNC_MANAGER
  • Wsyncmgr.log

WSM initiates WSUS server synchronization phase.

Status Message 6704
  • Component Status - SMS_WSUS_SYNC_MANAGER
  • Wsyncmgr.log

WSM verifies the connection to the WSUS server.

Connecting to WSUS server http://<server name>

Synchronizing WSUS server <server name> …
  • Wsyncmgr.log

Synchronization started on WSUS server.

Event ID 382
  • Application Log
  • SoftwareDistribution.log

Content synchronization started on WSUS server.

Event ID 361
  • Application Log
  • SoftwareDistribution.log

Content synchronization succeeded on WSUS server.

Event ID 363
  • Application Log
  • SoftwareDistribution.log

Synchronization completed successfully on WSUS server.

Event ID 384
  • Application Log
  • SoftwareDistribution.log

Synchronization started on site server.

Status Message 6705
  • Component Status - SMS_WSUS_SYNC_MANAGER
  • Wsyncmgr.log

WSM verifies the connection to the WSUS server.

Connecting to WSUS server http://<server name>
  • Wsyncmgr.log

WSM processes the update categories.

sync: SMS_Sync_Categories (phase 6 of 12), processed X out of X items
  • Wsyncmgr.log

WSM processes the software update metadata.

sync: SMS_Sync_Updates (phase 7 of 12), processed X out of X items
  • Wsyncmgr.log

WSM completed the synchronization process.

Status Message 6702
  • Component Status - SMS_WSUS_SYNC_MANAGER

Component Location

The following table lists each verification component in the synchronization process and the location for the component.

Component | Component Location
Application.log | Open the Event Viewer on the site server, and click Application.
Component Status - SMS_WSUS_SYNC_MANAGER | In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Site Status / <site code> - <site name> / Component Status. Right-click SMS_WSUS_SYNC_MANAGER, highlight Show Messages, and then click All.
SoftwareDistribution.log | Browse to %ProgramFiles%\Update Services\LogFiles, by default.
Wsyncmgr.log | Browse to <InstallationPath for Configuration Manager>:\Logs.

See Also

Tasks

How to Configure Software Updates Synchronization
How to Synchronize Software Updates

Concepts

About Software Updates Synchronization
Monitoring Software Updates
Planning for the Software Update Point Settings

Other Resources

Troubleshooting Software Updates


Technical Reference for Software Updates

Topic last updated—November 2007

This section provides technical reference information for software updates in Configuration Manager 2007.

In This Section

Icon Glossary for Software Updates

Provides a list of the icons used in software updates and a brief description for each.

Flowcharts for Software Updates

Provides detailed process flowcharts for software updates.

Software Updates State Messages

Provides information about the software updates state messages created by client computers.

See Also

Other Resources

Troubleshooting Software Updates


Icon Glossary for Software Updates

Topic last updated—March 2008

Software updates in Configuration Manager 2007 displays different icons for objects (software updates, update lists, deployment templates, deployments, and deployment packages) and the state of the object. This provides an easy way to determine the state of an object by the icon displayed in the Configuration Manager console. The following table groups the icons by software updates object and provides the icons, the icon names, and icon descriptions.

Software Update Icons

There are four different colors for the icons used for software updates. The icons can also contain a lock indicating that the software updates metadata was synchronized at a site server higher in the Configuration Manager hierarchy, usually the central site. The properties for locked software updates cannot be modified.

Icon | Icon Name | Description
Normal Update Software Icon | Software update icon | Specifies a normal software update.
Software Update Icon | Expired software update icon | Specifies that the software update is expired. Expired software updates cannot be deployed.
Invalid Software Update Icon | Invalid software update icon | Specifies that the software update is not valid. This usually occurs when the update file is missing for the software update. To resolve this issue, download the software update to a deployment package.
Supersede Software Update Icon | Superseded software update icon | Specifies a software update that has been superseded by another update.
Software Updates Metadata Only Icon | Metadata-only software update icon | Specifies that the software update consists of metadata only and not an associated update file. Metadata-only software updates are available in the Configuration Manager console for reporting and cannot be deployed or downloaded.

Update List Icons

Icon | Icon Name | Description
Normal Update List Icon | Update list icon | Specifies a normal update list that was created at the current site.
Software Update List Locked Icon | Locked update list icon | Specifies that the update list is locked. This occurs when an update list is created at a site higher in the Configuration Manager hierarchy and propagated down. Update lists can be modified only from the site from where it was created.

Deployment Template Icon

Icon | Icon Name | Description
Software Distribution Normal Template Icon | Deployment template icon | Specifies a normal deployment template.

Deployment Icons

Icon | Icon Name | Description
Software Normal Deployment Icon | Deployment icon | Specifies a normal deployment.
Software Deployment Locked Icon | Locked deployment icon | Specifies that the deployment is locked. This occurs when a deployment is created at a site higher in the Configuration Manager hierarchy and propagated down. A deployment can be modified only from the site from where it was created.
Deployment Contains Expired Updated Icon | Deployment contains expired update icon | Specifies that at least one software update in the deployment is expired.
Deployment Icon | Deployment contains superseded update icon | Specifies that at least one software update in the deployment has been superseded by another update.

Deployment Package Icons

Icon | Icon Name | Description
Software Normal Deployment Package Icon | Deployment package icon | Specifies a normal deployment package that was created at the current site.
Software Deployment Locked Icon | Locked deployment package icon | Specifies that the deployment package is locked. This occurs when a deployment package is created at a site higher in the Configuration Manager hierarchy and propagated down. A deployment package can be modified only from the site from where it was created.

See Also

Other Resources

Technical Reference for Software Updates


Flowcharts for Software Updates

Topic last updated—November 2007

Click any link in the following section for flowcharts that show the various processes involved when using software updates in Configuration Manager 2007.

In This Section

Software Updates Synchronization Process Flowchart

Provides the detailed steps for synchronizing software updates at the central site.

Software Update Deployment Process Flowchart

Provides the detailed steps for creating a software update deployment.

Deployment Package Process Flowchart

Provides the detailed steps for creating or updating a deployment package in software updates.

See Also

Other Resources

Technical Reference for Software Updates
Troubleshooting Software Updates


Software Updates Synchronization Process Flowchart

Topic last updated—November 2007

This flowchart provides the detailed steps for the software updates synchronization process on a central site in Configuration Manager 2007.

Software Updates Synchronization Flowchart

See Also

Tasks

How to Synchronize Software Updates

Concepts

About Software Updates Synchronization
Deployment Package Process Flowchart
Flowcharts for Software Updates
Software Update Deployment Process Flowchart

Other Resources

Technical Reference for Software Updates


Software Update Deployment Process Flowchart

Topic last updated—November 2007

This flowchart provides the detailed steps for creating a software update deployment in Configuration Manager 2007.

Software Updates Deployment Flowchart

See Also

Tasks

How to Deploy Software Updates

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deploy Software Updates Wizard
Deployment Package Process Flowchart
Flowcharts for Software Updates


Deployment Package Process Flowchart

Topic last updated—November 2007

Deployment packages in Configuration Manager 2007 can be created when creating a deployment in the Deploy Software Updates Wizard or when downloading software updates in the Download Updates Wizard or Update List Wizard. When software updates are downloaded to a deployment package, the package process is initiated twice. The first time through this process, the deployment package is created or updated. At the same time, the software update files are downloaded to the package source and the updates that have already been downloaded are copied to the distribution points. Then the process ends. The remaining update files are downloaded to the package source, and when the download process completes for all updates, a package refresh is initiated.

The second time through the deployment package process, the package is updated and the rest of the update files are copied to distribution points.

For information about how the deployment package process integrates with the software update deployment process, see Software Update Deployment Process Flowchart.

This flowchart provides the detailed steps for when a software updates deployment package is created or updated in Configuration Manager 2007.

Software Updates Deployment Package Flowchart

See Also

Tasks

How to Create a Deployment Package

Concepts

About Software Update Deployment Packages
Flowcharts for Software Updates
How to Manage Software Update Files
Software Update Deployment Process Flowchart


Software Updates State Messages

Topic last updated—November 2007

Software updates in Configuration Manager 2007 provide state messages that can be used to report on the state of deployments, software updates, and the scan for software updates compliance.

Specifically, software updates state messages are created and sent by Configuration Manager 2007 client computers for the following:

  • States for deployments
  • States for software updates
  • Scan states for an update source

States for Deployments

Client computers create state messages when evaluating software update deployments, for the compliance of deployment (whether or not the client requires one or more software updates in the deployment), and for the enforcement of a mandatory deployment.

Unlike other software updates state messages that are replicated up the hierarchy to the central site, state messages for deployments are replicated up the hierarchy to the site where the deployment was created. Software update deployment enforcement, evaluation, and compliance information will be missing from reports when they are run from a site higher in the hierarchy than where the deployment was created.

Evaluation States for a Deployment

When a new deployment is created and the client computer evaluates the assignment policy for the deployment and during the deployment reevaluation cycle, one of the following state messages is created:

  • Evaluation state unknown
  • Evaluation activated
  • Evaluation succeeded
  • Evaluation failed

Enforcement States for a Mandatory Deployment

When the deadline is reached for a mandatory deployment, client computers create state messages for the following:

  • Enforcement state unknown
  • Installing update(s)
  • Waiting for restart
  • Waiting for another installation to complete
  • Successfully installed update(s)
  • Pending system restart
  • Failed to install update(s)
  • Downloading update(s)
  • Downloaded update(s)
  • Failed to download update(s)
  • Waiting for maintenance window before installing

By segregating update enforcement state messages and deployment enforcement state messages, administrators can create detailed, precise, near-real-time reports for management that were previously difficult, if not impossible, to create.

Compliance States for a Deployment

Client computers report the compliance for a software update deployment by using the following state messages:

  • Compliance state unknown
  • Compliant
  • Non-compliant
  • Conflict detected

States for Software Updates

Client computers create state messages for the compliance of software updates and the enforcement of software updates in a mandatory deployment.

Compliance States for a Software Update

When client computers scan for software updates compliance, a state message with one of the following compliance states is created for each software update:

  • Detection state unknown
  • Update is not required
  • Update is required
  • Update is installed

Enforcement States for a Software Update

When the deadline is reached for a mandatory deployment, client computers create a state message for each software update in the deployment. The following software update enforcement states provide information about the software update installation:

  • Enforcement state unknown
  • Enforcement started
  • Enforcement waiting for content
  • Waiting for another installation to complete
  • Waiting for maintenance window before installing
  • Restart required before installing
  • General failure
  • Pending installation
  • Installing update
  • Pending system restart
  • Successfully installed update
  • Failed to install update
  • Downloading update
  • Downloaded update
  • Failed to download update

Scan States for an Update Source

When a scan is run on a client computer, a state message is created for each update source—for example, Microsoft Update or the Inventory Tool for Microsoft Updates. One of the following scan states is created:

  • Scan state unknown
  • Scan is waiting for content
  • Scan is running
  • Scan completed
  • Scan is pending retry
  • Scan failed
  • Scan completed with errors
  • SMS 2003 client

See Also

Concepts

About Software Updates Compliance
State Messages in Configuration Manager 2007

Other Resources

Technical Reference for Software Updates
Troubleshooting Software Updates Issues


Ports Used in Software Updates

Topic last updated—November 2007

Software updates in Configuration Manager 2007 require different ports to be available for communication between clients, site systems, and sites, and for the software updates process to function properly. The following diagram provides a software updates scenario where there is a central site and one child primary site. This scenario assumes the following:

  • Both sites use the default Web site, and therefore communication between the site server and site systems is configured for HTTP port 80 and HTTPS port 443 by default.
  • On both active software update points, Windows Server Update Services (WSUS) uses the custom WSUS Web site, and therefore communication between the site server and WSUS running on the active software update point, as well as from client computers to WSUS running on the active software update point, is configured for HTTP port 8530 and HTTPS port 8531 by default.
  • HTTPS port 443 is used in this scenario only when the site is configured for native mode.
  • HTTPS port 8531 is used in this scenario only when the site is configured for native mode or when WSUS running on the active software update point has been configured for Secure Sockets Layer (SSL).
Software Updates Ports

See Also

Concepts

Ports Used by Configuration Manager


Operating System Deployment in Configuration Manager

Operating System Deployment allows you to create operating system images and deploy those images to target computers. Operating System Deployment also provides task sequences which help facilitate the deployment of operating system images, and other Configuration Manager 2007 software packages.

The following topics are included in this section:

  • Overview of Operating System Deployment
  • Prerequisites for Operating System Deployment
  • Planning for Operating System Deployment
  • Configuring Operating System Deployment
  • Tasks for Operating System Deployment
  • Troubleshooting Operating System Deployment
  • Operating System Deployment Security Best Practices and Privacy Information
  • Technical Reference for Operating System Deployment


Overview of Operating System Deployment

Operating system deployment provides the Microsoft System Center Configuration Manager 2007 administrator with a tool for creating images that can be deployed to computers managed by Configuration Manager 2007, and to unmanaged computers using bootable media such as CD set or DVD. The image, in a Windows Imaging Format (WIM) format file, contains the desired version of a Microsoft Windows operating system and can also include any line-of-business applications that need to be installed on the computer. Operating system deployment provides the following functionality:

  • Operating system image capture
  • User state migration using the User State Migration Tool
  • Operating system image deployment
  • Task sequences

In this Section

Click any of the following links for more information:

Administrator Workflows for Operating System Deployment

Operating System Deployment Terminology

Supported Operating Systems and Hard Disk Configurations for Operating System Deployment

Upgrading from Systems Management Server 2003 Operating System Deployment

About the Operating System Deployment Reference Computer

About Native Mode Certificates and Operating System Deployment

About Capturing and Deploying an Operating System Image

About Creating the Operating System Deployment Packages

About the Driver Catalog

About Task Sequences

About Task Sequence Variables

Operating System Deployment Checklists

About Feature Reports for Operating System Deployment

About Multicast for Operating System Deployment

About Configurations for Multicast for Operating System Deployment

About Unknown Computer Support for Operating System Deployment

See Also

Other Resources

Operating System Deployment in Configuration Manager


Administrator Workflows for Operating System Deployment

This section provides workflows that walk you through the basic tasks needed to create and deploy an operating system image to a computer. The following workflows are included in this section:

  • Administrator Workflow: Top Level Administrator Processes for Operating System Deployment
  • Administrator Workflow: Create and Distribute Image for Operating System Deployment
  • Administrator Workflow: Create and Configure Task Sequence for Operating System Deployment
  • Administrator Workflow: Image Deployments Using Media for Operating System Deployment

See Also

Other Resources

Operating System Deployment in Configuration Manager


Administrator Workflow: Top Level Administrator Processes for Operating System Deployment

There are four main actions that an administrator can take when using the Operating System Deployment feature of Configuration Manager 2007. The following flowchart maps these actions in the order in which they generally take place.

Top Level Administrative Workflow

See Also

Concepts

Administrator Workflows for Operating System Deployment


Administrator Workflow: Create and Distribute Image for Operating System Deployment

This workflow represents the steps and actions needed to capture and restore computer state for a new computer installation.

Create and Distribute Image Workflow

See Also

Concepts

Administrator Workflow: Top Level Administrator Processes for Operating System Deployment
Administrator Workflow: Create and Configure Task Sequence for Operating System Deployment


Administrator Workflow: Create and Configure Task Sequence for Operating System Deployment

The following workflow builds from the Operating System Deployment Top Level Workflow and identifies the basic steps and actions to take to create and distribute an operating system image using a task sequence.

Data Flow of creating and distributing an OS image

See Also

Concepts

Administrator Workflows for Operating System Deployment


Administrator Workflow: Image Deployments Using Media for Operating System Deployment

The following flowchart displays the actions associated with a Configuration Manager 2007 media initiated operating system deployment in the order in which they generally take place.

Flowchart of media initiated OSD

See Also

Concepts

Administrator Workflows for Operating System Deployment


Operating System Deployment Terminology

Topic last updated—January 2008

The following terms are used when describing concepts and actions related to Microsoft System Center Configuration Manager 2007 operating system deployment.

Destination Computer

The destination computer is the computer that will receive the user state data and settings that are migrated from a source computer. The destination computer must have a computer association with the source computer for side-by-side migration scenarios.

Image

The image is a collection of files and folders that duplicates the original file and folder structure of an existing computer, including the file and folder structure of the operating system, or that is a file-based replica of a hard disk. An image often contains other files added by the Configuration Manager 2007 administrator. Operating System Deployment supports Windows Image format (WIM).

Reference computer

A reference computer is a fully-configured computer from which you generate the WIM file that will be used to distribute operating system images to target computers.

Source Computer

The source computer is an existing computer that is managed by Configuration Manager 2007. The source computer contains the user state data and settings that will be migrated to a new destination computer. The source computer must have a computer association with the destination computer for side-by-side migration scenarios.

Sysprep

Sysprep is a Windows system preparation tool that facilitates image creation on reference computers running Windows operating systems, and the preparation of an image for deployment to multiple target computers. Sysprep generalizes the reference computer by removing all computer-specific information such as security identifiers, network addresses, and the computer name. When the generalized image is cloned to other computers, the other computers establish their own identity and don't duplicate the identity of the reference computer.

Target computer

The target computer is the computer on which you install a Microsoft® Windows operating system image using Configuration Manager 2007 Operating System Deployment.

Task sequence

A task sequence is a series of one or more task steps that can be advertised to Configuration Manager 2007 clients to run user-specified actions. Task sequences are used with Operating System Deployment to build source computers, capture an operating system image, migrate user and computer settings, and deploy an image to a collection of target computers. Task sequences can also be used to run other Configuration Manager 2007 actions, such as deploying Configuration Manager 2007 software packages or running custom command lines.

Task sequence group

A task sequence group is a component of a task sequence and represents a collection of one or more task sequence steps.

Task sequence step

A task sequence step is a component of a task sequence and represents a user-specified action that is run on a computer that the task sequence is advertised to. Task sequence steps always run entirely on the target computer, and never on a Configuration Manager 2007 site system.

Unknown System

An unknown system is an Operating System Deployment feature in Configuration Manager 2007 R2. An unknown system is a computer or device that does not have a management agent installed and that is not “known” by an existing management infrastructure or system.

Unprovisioned System

An unprovisioned system is an Operating System Deployment feature in Configuration Manager 2007 R2. An unprovisioned system is a computer or device that has been discovered by an existing management infrastructure or system but is not yet installed with a management agent.

User State Migration Tool (USMT)

The User State Migration Tool (USMT) is a Windows utility used by administrators to collect a user's documents and settings, called the user state data, before an operating system deployment is performed, and then restores the user state data after the installation.

USMT migrates user files and settings during large deployments of Microsoft Windows 2000, Microsoft Windows XP or Windows Vista operating systems. USMT captures desktop, network, and application settings as well as a user's files, and then migrates them to a new Windows installation in order to improve and simplify the migration process.

USMT 3.0 supports the capture of user settings (known as scan state) from computers running the Windows 2000 operating system or later, and the restore of user settings (known as load state) on computers running the Windows XP or Windows Vista operating systems.

USMT 2.61 supports the capture of user settings (known as scan state) from computers running the Windows 9x operating system or later, and the restore of user settings (known as load state) on computers running the Windows 2000 or later operating systems.

For more information about USMT see the Windows XP Professional Deployment Web page, see (http://go.microsoft.com/fwlink/?LinkID=88299). You can download USMT from the Microsoft Download Center, see (http://go.microsoft.com/fwlink/?LinkID=88300).

Windows Image Format file (WIM)

A WIM file represents the file format for an image captured using Operating System Deployment and is a compressed collection of files and folders.

Windows Preinstallation Environment (Windows PE)

Windows PE 2.0 is a Windows operating system with limited services, built on the Windows Vista operating system platform. Windows PE is the boot image used by Operating System Deployment, and is used only in the preinstallation and deployment of Windows operating systems. Configuration Manager 2007 does not support earlier versions of Windows PE.

You can find detailed documentation about Windows PE, see (http://go.microsoft.com/fwlink/?LinkId=93917).

See Also

Concepts

Overview of Operating System Deployment

Other Resources

Planning for Operating System Deployment


Supported Operating Systems and Hard Disk Configurations for Operating System Deployment

Topic last updated—March 2008

This topic lists the operating systems and disk configurations that support the capture, creation, and deployment of operating system images by using Configuration Manager 2007.

Supported Operating Systems

  • Windows 2000 Professional operating system, with Service Pack 4
  • Windows 2000 Server operating system, Service Pack 4
  • Windows 2000 Advanced Server operating system, Service Pack 4
  • Windows 2000 Datacenter operating system, Service Pack 4
  • Windows XP Professional operating system, Service Pack 2
  • Windows Embedded for Point of Service (requires support of sysprep for creating and deploying images)
  • Windows Server 2003 operating system, Web Edition, Service Pack 1
  • Windows Server 2003 operating system, Standard Edition, Service Pack 1
  • Windows Server 2003 operating system, Enterprise Edition, Service Pack 1
  • Windows Server 2003 Datacenter operating system, Service Pack 1
  • Windows Vista Business operating system
  • Windows Vista Enterprise operating system
  • Windows Server 2008 Standard operating system
  • Windows Server 2008 Enterprise operating system
  • Windows Server 2008 Datacenter operating system

Supported Disk Configurations

The hard disk configuration combinations on the reference and target computers that are supported for use with Configuration Manager 2007 operating system deployment are shown in the following table.

Reference Hard Disk Configuration | Target Hard Disk Configuration
Basic Disk | Basic Disk
Simple volume on a dynamic disk | Simple Volume on a dynamic disk

Configuration Manager 2007 supports capturing an operating system image only from computers configured with simple volumes. There is no support for the following hard disk configurations:

  • Spanned volumes
  • Striped volumes (RAID 0)
  • Mirrored volumes (RAID 1)
  • Parity volumes (RAID 5)

A hard disk configuration on the reference and target computers that is also not supported for use with Configuration Manager 2007 operating system deployment is shown in the following table.

Reference Hard Disk Configuration | Target Hard Disk Configuration
Basic Disk | Dynamic Disk

See Also

Concepts

Overview of Operating System Deployment


Upgrading from Systems Management Server 2003 Operating System Deployment

The image files and packages that you created with the Operating Deployment Feature Pack are not supported by operating system deployment in Microsoft System Center Configuration Manager 2007. You must create new images for use with Configuration Manager 2007.

See Also

Concepts

Overview of Operating System Deployment


About the Operating System Deployment Reference Computer

Topic Last Updated—August 2008

The reference computer is used by Configuration Manager 2007 operating system deployment to capture the operating system image that you want to deploy to a collection of one or more target computers.

You can configure the reference computer manually, or you can completely automate the configuration of the reference computer and the capturing of the image. The extent to which you configure the reference computer manually is up to you. You can completely automate the configuration of the reference computer using task sequences, you can manually configure certain aspects of the reference computer and then automate the rest using task sequences, or you can manually configure the reference computer without using task sequences. After you have captured an image from a reference computer, the reference computer should not be used again to capture an operating system image from because of registry entries that are created during the initial configuration. It is recommended that you create a new reference computer from which to capture the operating system image. If you plan to use the same reference computer to create future operating system images, you should uninstall the Configuration Manager 2007 client and then reinstall the Configuration Manager 2007 client.

The following table outlines advantages and disadvantage for an automated and manual configuration of the reference computer:

Reference computer Advantages Disadvantages

Automated configuration

The configuration can be completely unattended eliminating the need for an administrator or user to be present.

You can reuse the task sequence to repeat configuration of additional reference computers with a high level of confidence.

You can modify the task sequence to accommodate differences in reference computers without having to recreate the entire task sequence.

The initial action of building a task sequence can take some time to create and test.

If the reference computer requirements change significantly, it can take some time to re-build and re-test the task sequence.

Manual configuration

You do not need to create a task sequence or take the time to test and troubleshoot the task sequence.

You can install directly from CDs without having to put all the software packages (including Windows itself) into a Configuration Manager 2007 package.

The accuracy of the reference computer configuration depends on the administrator or user that is doing the configuration.

You’ll still need a method to verify and test that the reference computer is properly configured.

There is no way to “reuse” the configuration method.

Requires a person to be actively involved throughout the process.

Steps for Configuring a Reference Computer

The following table lists the basic steps to consider when configuring a reference computer for Operating System Deployment.

Configure the reference computer with the: Description

Appropriate operating system.

The reference computer must be installed with the operating system that you intend to deploy as an image to a collection of one or more target computers. For all operating system images except Windows Vista, the associated HAL type must match the target computer's HAL type. For example, you cannot capture a virtual operating system image and apply that image to a target computer.

Appropriate service pack.

It is recommended that the operating system running on the reference computer should have the most current service pack applied.

Appropriate software updates.

It is recommended that the operating system running on the reference computer should have the most current software updates applied, especially security updates.

Appropriate applications.

You can install all software applications that you would like to include in the image you are deploying to a collection of one or more target computers. You can also install software applications manually or as a custom task sequence step rather than as part of the image when you deploy the captured image. The advantages and disadvantages of each method of installation are described in the section Advantages and Disadvantages of Installing Software Applications and Tools as Part of an Operating Image Deployment.

Important
Configuration Manager 2007 software packages that use the Run another program first option to install a dependent program as part of the package are not supported by Operating System Deployment.

Configuration Manager 2007 uses Sysprep to collect information about the applications you installed. However, not all applications are compatible with Sysprep. You must install those applications as a separate task sequence step after the image is deployed, or manually.

Reference computer must be a member of a workgroup

The reference computer must be configured as a member of a workgroup.

Appropriate version of Sysprep or another migration tool.

When you are preparing a Windows XP, Windows 2000 Professional, Windows 2000 Server, and Windows Server 2003 operating system image, the reference computer must have the version of Sysprep appropriate for that operating system installed, particularly if you are deploying the image to more than one target computer. Configure a C:\Sysprep folder in the reference computer by copying sysprep.exe and setupcl.exe to that folder. You can manually Sysprep the reference computer by running the command:

sysprep -mini -quiet - reseal -reboot

When you are deploying a Windows Vista or a Windows Server 2008 operating system image, the Sysprep location is created by default. The default location is %windir%\System32\sysprep

You can also automate Sysprep using a task sequence step or if you are using capture media. For more information about creating capture media see: How to Capture an Image from a Reference Computer Using Capture Media

Important
The Prepare Windows for Capture task sequence step attempts to reset the local administrator password on the reference computer to blank before running Sysprep. If the Local Security policy Password must meet complexity requirements is enabled, then this task sequence step fails to reset the administrator password. In this scenario, disable this policy before running the task sequence.

Appropriate tools and scripts you require to mitigate installation scenarios.

You can install the application compatibility tools and scripts necessary to troubleshoot known installation scenarios on target computers as part of the image that you are deploying to a collection of one or more target computers. You can also install these tools and scripts manually or as a custom task sequence rather than as part of the image. The advantages and disadvantages of each method of installation are described in the section Advantages and Disadvantages of Installing Software Applications and Tools as Part of an Operating Image Deployment.

Appropriate desktop customization (wall paper, branding, default user profile).

The reference computer can be configured with the appropriate desktop customization properties that you want to include as part of the image you are deploying to a collection of one or more target computers. Desktop properties include specified wall paper, organizational branding, and a standard default user profile.

See Also

Concepts

Planning for the Operating System Image


About Native Mode Certificates and Operating System Deployment

When you use Configuration Manager 2007 to deploy operating systems in native mode, you will need to include a public key infrastructure (PKI) certificate if task sequences used as part of the operating system deployment process communicate with the native mode site's management point. Without this certificate, authentication to the management point will fail, and operating system deployments will not succeed.

Additionally, for this certificate to be trusted by the management point, the site must also be configured with a root certification authority for the certificate. For more information about configuring the site with the root certification authority, see How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients.

The certificate that you use with operating system deployments requires client authentication capability, and it does not get installed on the client as part of the operating system deployment. Its use is only temporary for the task sequences to complete. For the client to be managed in the native mode site after the operating system deployment, you must independently provision the client with its native mode client certificate. For more information about how to provision the client with its native mode client certificate, see Deploying the Client Computer Certificates to Clients and the Management Point.

For more information about all the certificates used with Configuration Manager 2007 native mode, see Certificate Requirements for Native Mode.

Specify the operating system deployment certificate as part of your boot media, if you are using media initiated operating system deployments, and configure the PXE service point to use this certificate if you are using PXE initiated operating system deployments. Specify the certificate by importing a Public Key Certificate Standard (PKCS #12) file, and providing the password that was chosen when the file was created. PKCS #12 files have a .PFX extension.

If you need guidance on how to prepare the PKCS #12 certificate file, see How to Export Certificates For Use With Operating System Deployment.

Protecting the Operating System Deployment Certificate from Unauthorized Use

To help protect unauthorized access to the Configuration Manager site using this certificate, assign a password with media initiated operating system deployments. You can also configure an expiration date that will be assigned to the media, and when this date expires, the media will no longer be valid.

If the PKI deployment is using a certificate revocation list (CRL), the certificate can also be revoked by a certification authority administrator, and this can be another method of protection if the certificate is known to be compromised. Certificate revocation checking is enabled by default on the management point.

When the site is in either native mode or mixed mode, you can also block client certificates that have been imported for operating system deployment, if you suspect the certificates have been compromised. For more information, see Determine If You Need to Block Configuration Manager Clients and How to Block Configuration Manager Clients.

See Also

Concepts

Configuration Manager Site Modes
Benefits of Using Native Mode
Certificate Requirements for Native Mode

Other Resources

How to Manage Native Mode Certificates and Operating System Deployment


About Capturing and Deploying an Operating System Image

There are three basic actions you need to take when you want to use Configuration Manager 2007 to deploy an operating system image to a collection of one or more target computers as outlined in the Administrator Workflow: Top Level Administrator Processes for Operating System Deployment:

  • Build and capture an image and distribute it to distribution points
  • Create and configure the appropriate deployment task sequence
  • Advertise the task sequence

Create the image and distribute it to distribution points

Operating system images are .WIM format files and represent a compressed collection of reference files and folders needed to successfully install and configure an operating system on a computer. The operating system image is built and captured from a reference computer which you configure with all required operating system files, support files, software updates, tools, and other software applications. The Administrator Workflow: Create and Distribute Image for Operating System Deploymentprovides a flowchart that identifies each step in this process. You can find additional information about reference computers in the operating system deployment task topic About the Operating System Deployment Reference Computer.

You can build the reference computer manually, or use a task sequence to automate some or all of the build steps.

You can find additional information about building and configuring a reference computer in the topic How to Build a Reference Computer, and information about capturing an image in the OSD Task topic How to Capture an Image from a Reference Computer Using Capture Media and How to Create a Task Sequence to Build and Capture an Operating System Image

Create and configure the appropriate deployment task sequence

After you have created the reference computer and captured an operating system image from that computer, you can use a task sequence to configure how to deploy that image to a target computer. The New Task Sequence Wizard walks you through the process of creating a deployment task sequence. Refer to the topic How to Create a Task Sequence to Install an Existing Operating System Image Package for more information.

Advertise the task sequences

After you have created the necessary deployment task sequences, you can identify the appropriate collections of target computers that you will advertise the task sequences to. Then run the Task Sequence - New Advertisement Wizard.

Important
Operating System Deployment does not distinguish Configuration Manager 2007 site system servers, in particular branch distribution points, from other target computers in the collection. If you are advertising the task sequence to a collection that contains a Configuration Manager 2007 site system server, the site system server will run the task sequence like any other computer in the collection. It is recommended that you remove the site system server role from the site system server before deploying an operating system image to it, and then assign the site system server role back to the site system server.

See Also

Concepts

Overview of Operating System Deployment


About Creating the Operating System Deployment Packages

There are several Configuration Manager 2007 packages that you need to create to support the building of a reference computer and the deployment of an operating system image to a target computer.

Building a reference computer:

  • Operating system installation package
  • Configuration Manager 2007 client installation package
  • Sysprep package
  • Driver packages
  • Other Packages

Deploying an image to a target computer:

  • Configuration Manager 2007 client installation package
  • USMT packages
  • Other Packages
  • Operating system image package

Building a reference computer

These packages support the building of a reference computer.

Operating System Installation Package

The Operating System Installation Package must contain all the files necessary to install the desired Windows operating system on a reference computer. For example, this package might contain all of the reference files found on theWindows XP Professional installation CD (not just the files in the i386 folder) because the installation must be run unattended. You create this package as you would any other Configuration Manager 2007 package. This package does not require a program. The task sequence will reference the source files as needed.

Sysprep Package

Sysprep is a Windows system preparation tool that facilitates image creation, and the preparation of an image for deployment to multiple destination computers. If the operating system version you are running is Windows Vista, Sysprep is already available on the computer and you do not need to specify a package. If the operating system version you are running is Windows XP or earlier, you must specify a package that contains the version of Sysprep and all its support files (no subfolders) appropriate for that operating system version. This package does not require a program. Operating System Deployment uses the Sysprep files contained in the package.

For more information about using Sysprep, see the Sysprep documentation for the version of Sysprep that supports the version of the operating system running on the Reference computer.

Driver Package

If the reference computer requires device drivers that are not included with the operating system, you must create the packages that contain the necessary Windows drivers to support hardware on the reference computer. Typically, a manufacturer supplies an INF file and other supporting files for a device driver, and sometimes an installation script as well. You should refer to the documentation supplied by the manufacturer of the device driver to ensure that you create a package that includes all supporting files.

Operating System Deployment supports two kinds of device drivers:

  • Auto Apply Drivers - Auto Apply Drivers to specify the categories that should be made available during Windows setup
  • Apply Driver Package - to specify a package that has all the drivers that should be deployed.

One way to organization driver packages is to create a single package for each computer make and model that has each device driver stored in its own folder.

For example:

\GX240_Drivers

\NetworkInterfaceDrivers

\Intel1000

\Broadcom

\VideoDrivers

\ATI

\AudioDrivers

\SBPro

Important
The path string that the task sequence appends cannot be longer than 4KB in length for computers running the Windows XP and Windows 2003 operating systems, and 2KB for computers running the Windows 2000 operating system. You can find the path in the OEMPNPDRIVERS PATH variable in the Sysprep.inf file.

Deploying an image to a target computer

These packages support the operating system image deployed to a target computer.

Configuration Manager 2007 Client Installation Package

Since every operating system deployment installs the Configuration Manager 2007 client, you need to create a Configuration Manager 2007 package to install the Configuration Manager 2007 client. You can use the package definition file included with Configuration Manager 2007 for the Configuration Manager 2007 client Upgrade. This package should have as its source location: \\<smssiteserver>\<sms_sitecode>\Client. Assign the package to the appropriate distribution point(s).

Note
It is required that the program be configured to run unattended when no user is logged on, and from a network share.

USMT Package

If you are migrating user state from one desktop to another, then you should use USMT as your migration tool.

USMT 3.0 supports the capture of user settings (known as scan state) from computers running the Windows 2000 operating system or later, and the restore of user settings (known as load state) on computers running the Windows XP or Windows Vista operating systems.

USMT 2.61 supports the capture of user settings (known as scan state) from computers running the Windows 9x operating system or later, and the restore of user settings (known as load state) on computers running the Windows 2000 or later operating systems.

You can download USMT from the Microsoft Download Center at http://go.microsoft.com/fwlink/?LinkId=88300.

Use Configuration Manager 2007 to create a package that contains the appropriate version of USMT to run on the computer. Include the contents of the USMT BIN folder (c:\USMT\bin). A package program is not required. Distribute the package to the appropriate distribution point(s). When the task sequence step is run, the task sequence will look for and use the appropriate version of USMT in the package you specify. Include the configuration files (.INF) as part of the USMT package. Refer to the documentation for USMT for configuration information.

Other Packages

These packages can support both the reference computer and the target computer depending on your need. You can install all software applications that you would like to include in the image you are deploying to a collection of one or more destination computers using a task sequence. You must create a Configuration Manager 2007 package that can successfully install the application on the taregt computer, and reference that package using the Install Software task sequence step.

The program you select must meet the following criteria:

  • It must run under the local system account and not the user account.
  • It should not interact with the desktop. The program must run silently or in an unattended mode.
  • It must not initiate a reboot on its own. The program must request a reboot using a 3010 return code. This ensures that the task sequence step will properly handle the reboot.
Important
Configuration Manager 2007 software programs that use the Run another program first option to install a dependent program as part of the package are not supported by operating system deployment. If Run another program first is enabled for a program, and the other program has already been run on the target computer, the task sequence step will complete successfully. However, if the other program has not already been run on the target computer, the task sequence step will fail.

Task sequences sometimes reference packages that contain required files and programs to be used or run on a target computer, for example, the Package option for the Run Command Line task sequence step. When you specify files or programs on the Command line field for this task sequence step that are not already present on the target computer, the Package option specifies the Configuration Manager 2007 package that contains the appropriate files. However, this package does not require a program. When the task sequence step is run, the task sequence will look for and use the appropriate files in the package you specify.

You do not need to create a separate package for each file used in this way. In fact, it is recommended that you create one package that contains all the files you might need to use when running a task sequence on a target computer, and then referencing this package when a specific file is required in a task step. The task sequence step will simply look for the appropriate file in whatever package you specify.

See Also

Concepts

Overview of Operating System Deployment


About the Driver Catalog

The driver catalog helps manage the cost and complexity of deploying an operating system in an environment that contains different types of computers and devices. The driver catalog consists of two nodes in the Configuration Manager 2007 administrator console: Drivers and Driver Packages. Storing device drivers in the driver catalog and not with each individual operating system image greatly reduces the number of operating system images that are required. When you deploy an operating system image, each operating system image can install enabled device drivers that have been imported and are available on a distribution point.

You can also store multiple versions of Windows device drivers in the driver catalog. Maintaining multiple versions of device drivers provides an easy way to upgrade existing device drivers when hardware device requirements change on your network.

Driver Catalog Terminology

Windows device driver

A Windows device driver consists of an INF file and one or more additional files required to support a device. Configuration Manager 2007 will read and obtain the hardware and platform information from the INF file.

Driver Package

A Driver Package is a Configuration Manager 2007 package that contains the content for one or more device drivers. When you add a new device driver the content is added to the driver package share. The driver package can then be copied to a distribution point so that computers can install them.

Importing a New Windows Device Driver

Windows device drivers must be imported into the Configuration Manager 2007 site so that they are available for operating system deployments. You should import only device drivers that you plan to deploy as part of your operating system deployments in your Configuration Manager 2007 environment. For more information about importing new Windows device drivers into the driver catalog for use with operating system deployments, see How to Import Windows Device Drivers into the Driver Catalog

Device Driver Categories

You can assign device drivers that have been imported into the driver catalog to a category. Device driver categories are helpful with linking similarly used device drivers together in a logical fashion. For example, you can assign all network adapter device drivers to a specific category. When you initiate an operating system deployment you can you can configure Windows setup to search in only the specified categories when locating device drivers.

Creating Device Driver Packages

Device driver packages group similar device drivers together to help streamline operating system deployments; for example you may decide to create a driver package for each type computer manufacturer on your network.

Driver packages contain the content associated with one or more device drivers. Device drivers should be added to a driver package and copied to an available distribution point so Configuration Manager 2007 client computers can install them. Driver packages also provide you the flexibility to distribute device driver content to only the distribution points that will require them.

When you create a driver package, the source location of the package should point to an empty network share and the Configuration Manager 2007 system account must have read/write permissions to the driver package source location. When you add device drivers to a driver package, Configuration Manager 2007 will copy the device driver to the driver package source location. Only device drivers that have been imported and are enabled in the driver catalog can be added to a new or existing driver package. For more information about creating a driver package use the following link: How to Create a Driver Package

You must copy the driver package to at least one distribution point for computers to be able to access them, and all device drivers in a specific package are copied together. If you want to copy a subset of device drivers from an existing driver package, you must create a new driver package and copy it to a distribution point. If you change the source location of an existing driver package, you will need to manually copy the device drivers to the new location. If the device drivers are not moved to the new location they will be removed as part of the next distribution point update.

Adding Device Drivers to Boot Images

You can add Windows device drivers that have been imported into the driver catalog to a Configuration Manager 2007 boot image. You should only add mass storage and network adapter device drivers to boot images because other types of drivers are not generally required and will increase the size of the boot image. Only device drivers that are intended for use with Windows Vista should be added to a boot image because the required version of Windows PE is Windows Vista-based. For more information about adding device drivers to a boot image see: How to Add Windows Device Drivers to a Boot Image

Driver Catalog Task Sequence Steps

There are two task sequence steps that you can use with your operating system deployments to install device drivers that have been imported into the driver catalog. When you use these task sequence steps you can also specify how device drivers will be installed on a target computer.

The following list briefly describes the two device driver task sequence steps:

  • Auto apply drivers - allows you to automatically match and install device drivers as part of an operating system deployment. You can configure the task sequence step to install only the best matched driver for each hardware device detected, or specify that the task sequence step will install all compatible drivers for each hardware device detected and allow Windows setup to choose the best driver. For more information about using the Auto Apply Drivers task sequence step see: Auto Apply Drivers.
  • Apply Driver Package - allows you to make all device drivers in a specific driver package available for use by Windows setup. Windows setup will search in the specified driver packages for required device drivers. For more information about using the Apply Driver Package task sequence step see: Apply Driver Package

Driver Catalog Reports

  • You can use several device driver reports to determine general device driver information. The reports category Driver Management contains reports that can help you inventory available device drivers and evaluate device driver applicability and availability. For more information about the reports that are available with operating system deployment and the driver catalog see: Available Operating System Deployment Reports

See Also

Concepts

Overview of Operating System Deployment

Other Resources

How to Manage the Driver Catalog


About Task Sequences

Topic Last Updated—August 2008

Task sequences provide the mechanism for performing multiple steps or tasks on a client computer at the command-line level without requiring user intervention. Task sequences do not represent a full scripting language.

After a task sequence is created, it can be accessed in the Configuration Manager 2007 console by selecting the Task Sequences node. The task sequence node and its task sequences are replicated to child sites in the Configuration Manager hierarchy. If the task sequence cannot locate a referenced image or package on a distribution point, the task sequence will contain broken references and will fail when it is run. You can also create subfolders to manage or group task sequences. These subfolders are also replicated to child sites.

Terminology for Task Sequences

The following list of terms describes task sequences and the components of task sequences:

Action

The command part of a single step within a task sequence. There are two types of task sequence actions: Custom Actions and Built-in Actions.

Custom action

A command-line string supplied by the administrator that will run a command on the Configuration Manager 2007 client computer.

Built-in action

A Configuration Manager 2007 action that will perform a specific action on the Configuration Manager 2007 client computer.

Condition

A parameter within a task sequence step or task sequence group that determines whether the Configuration Manager 2007 client should process the action.

Step

The basic component of a task sequence or task sequence group. Each step can contain an action and an optional check for the conditions assigned to a task.

It is not required that you group task sequence steps; however, using groups improves the readability of the task sequence and provides better error handling.

Group

A logical arrangement of multiple steps within a task sequence. A task sequence group consists of a name and an optional check for the conditions assigned to a task.

Note
Each task sequence group can contain additional nested task sequence groups.

Task sequence

One or more steps or groups that are linked sequentially to perform an operation or task.

Creating a New Task Sequence

You can create a new task sequence by using the Task Sequence Wizard. For more information about creating custom task sequences, use the following link How to Manage Task Sequences. The wizard contains built-in task sequences and custom task sequences that can perform many different tasks. You can create task sequences that will perform tasks from capturing and installing operating system image packages to changing a registry setting.

Moreover, you can create task sequences that will allow you to install an existing image package, build and capture a reference operating system image, or create a custom task sequence that will perform a customized task using variables. Custom task sequences can be used to perform specialized operating system deployments or to perform other custom actions or steps.

Custom and built-in task sequences can also be used to run multiple task sequence steps on a target computer that will perform a series of steps to achieve an installation. Task sequence names do not need to be unique.

After you have completed the Task Sequence Wizard, the new task sequence object is created and is visible in the results pane of the Configuration Manager console.

Using Task Sequences Outside Operating System Deployment

Although task sequences are essential for operating system deployment, they can also play a vital role in other Configuration Manager 2007 tasks. The power of task sequences lies in their flexibility and administrators can use these to configure client settings, distribute software, update drivers, edit user states, and perform other tasks independent of operating system deployment.

Task Sequences and the Network Access Account

In Configuration Manager 2007, task sequences run only in the context of the local system account. The Network Access account is used to access required packages located on Configuration Manager 2007 distribution points. You must configure the Network Access account correctly or the task sequence will fail because it will not be able to access the required Configuration Manager 2007 packages to complete the associated task. In Configuration Manager 2007 R2, the task sequence can be modified to run as a different account. For more information about the Network Access account, see About the Network Access Account.

Note
The Network Access account is never used as the security context for running programs, installing updates, or running task sequences; however, the Network Access account is used to access the associated resources on the network.

When you use a boot image to initiate an operating system deployment, Configuration Manager 2007 uses the Windows PE environment, which is not a full operating system. The Windows PE environment uses an automatically generated, random name that is not a member of any domain. Without configuring the Network Access account properly the computer may not have the necessary permissions to access required Configuration Manager 2007 packages to complete the task sequence.

For more information about configuring the Network Access account, use the following link: How to Configure the Network Access Account.

Access Control

You can provide access control to specific task sequences. You can set user rights on individual task sequences in the same fashion as other Configuration Manager 2007 objects using the Security tab. For more information about assigning user rights, see How to Assign Rights for Objects to Users and Groups.

To create a new task sequence or folder, you must have Create or Administer permission to the Task Sequences folder. You must also have at least Read permission to objects, such as the packages the task sequence will reference. To advertise a task sequence, only Read permission is required to the task sequence.

Advertising a Task Sequence

You can advertise a task sequence to any Configuration Manager 2007 collection. By default, task sequence advertisements are made available to sub collections.

Each target computer will receive the task sequence by way of the advertisement and will run the task sequence according to the settings specified in the advertisement. Task sequences do not contain associated files or programs. Any files referenced by a custom task sequence must already be present on the target computer or reside on an accessible distribution point. An advertised task sequence will be run on client computers even if the program or package has already been installed.

The Configuration Manager 2007 client will use normal Configuration Manager 2007 client polling methods to locate the task sequence advertisement. For more information about Configuration Manager 2007 client polling methods, use the following link: How to Initiate Policy Retrieval for a Configuration Manager Client

You cannot advertise a task sequence that references a nonexistent program.

For more information about advertising a task sequence, see How to Advertise Task Sequences.

Editing a Task Sequence

You can use the Task Sequence Editor to update or change the run-time actions associated with an existing task sequence. You can also change the order of the task sequence steps by using the task sequence editor to change the priority assigned to each task sequence step. You can also specify how the task sequence will handle errors for failed task sequence steps by specifying that the task sequence should continue if there is an error. You can also add conditions to the task sequence by using If statements on the Options tab.

If the task sequence has any unassociated references to a package or a program as a result of the edit, you will need to fix the reference, delete the unreferenced program from the task sequence, or temporarily disable the failed task sequence step until the broken reference has been fixed or removed.

Task Sequence Steps and Actions

Steps are the basic components of a task sequence. They contain the commands that run on a target computer that perform tasks such as installing an operating system, creating a registry entry, or installing a Configuration Manager 2007 software package.

Task sequence steps are processed sequentially and the conditions assigned to each task sequence step are evaluated. If the step is applicable to a Configuration Manager Client the action is initiated. The next task sequence step will not proceed until the previous action has completed. A task sequence is considered complete when all steps have been completed or when a failed step causes the task sequence to end prematurely.

Important
By default, a task sequence will fail after one step or action fails. To continue after a task sequence step failure, edit the task sequence, click the Options tab, and then select Continue on error.

Task Sequence Groups

Groups are multiple steps within a task sequence. A task sequence group consists of a name and an optional check for the conditions assigned to a task.

Creating groups will enable you to combine multiple steps within a task sequence. Groups can be nested within each other, and a group can contain a mixture of steps and subgroups. Groups are useful for combining multiple steps that share a common condition. You can also configure the group failure behavior as you do with individual steps.

To allow the task sequence to continue to the next step if one of the steps fails, use the Options tab to set the task sequence to Continue on error. The following table and example show how the Continue on error option works.

In this example, there are two groups of task sequences containing three task sequence steps each.

Task Sequence Group/Step | Continue on error setting
Task Sequence Group 1 | Continue on error selected
Task Sequence Step 1 | Continue on error selected
Task Sequence Step 2 |
Task Sequence Step 3 |
Task Sequence Group 2 |
Task Sequence Step 4 |
Task Sequence Step 5 |
Task Sequence Step 6 |
  • If task sequence step 1 fails, the task sequence will continue with task sequence step 2.
  • If task sequence step 2 fails, than the task sequence will not run task sequence step 3 but will continue to run task sequence steps 4 and 5 which are in a different task sequence group.
  • If task sequence step 4 fails, no more steps will be run, and the task sequence will fail because the Continue on error setting has not been configured for task sequence group 2.

You must assign a name to task sequence groups, although the group name does not need to be unique. You can also provide an optional description for the task sequence group.

Running Task Sequences

In Configuration Manager 2007 SP1 and earlier, task sequences always run by using the local system account, so there is no option of running a task sequence for each individual user that logs in. In Configuration Manager 2007 R2, the task sequence command-line step can be modified to run as a different account. The task sequence will check for referenced packages prior to running. If a referenced package is not validated or available on a distribution point, the task sequence will return an error for the associated task sequence step. If an advertised task sequence has been configured to download and run, all dependent programs are downloaded to the Configuration Manager 2007 client cache. The necessary packages and programs are obtained from distribution points, and if the Configuration Manager 2007 client cache size is too small or the program cannot be found, the task sequence will fail and a status message will be generated. You can also specify if the content should be downloaded as needed by selecting Download content from distribution point and run locally, or you can use the Run program from distribution point option to specify that the installations should run across the network.

If a dependent package or program cannot be located by the task sequence, an immediate error will be returned if the advertisement is optional. However, if the advertisement is mandatory the Configuration Manager 2007 client will wait for the necessary package or program to be replicated to the appropriate distribution point.

Important
If a task sequence step requires the client computer to restart, there must be an available formatted disk partition at the time of the computer restart; otherwise, the task sequence will fail regardless of any error handling setting.

When a task sequence dependent object, such as a software distribution package, is updated to a newer version, any task sequence that references the package is automatically updated and will reference the newest version.

Note
All task sequences are checked for possible dependencies and availability on a distribution point prior to initiating. When an object that an existing task sequence depends on is deleted, an error is issued. For more information about how to identify missing task sequence objects use the following link: Log Files for Operating System Deployment

When a task sequence completes successfully or fails, an entry is placed in the Configuration Manager 2007 client history. There is no method to cancel or halt a task sequence once it has initiated on a computer.

Importing and Exporting Task Sequences

A task sequence created in one Configuration Manager 2007 site can be exported and then imported to another Configuration Manager 2007 site or hierarchy. If you use task sequences from a site other than the one in which it was originally created, make sure that any referenced images or packages are available in the new site, or the task sequence that is dependent on that package will fail. To export task sequences right-click the task sequence, and then click Export. You will be prompted to provide a name for the task sequence and the location to save the exported task sequence. When you export a task sequence, it does not include the referenced images or packages. If an imported task sequence cannot locate the referenced packages on a distribution point, the task sequence will contain broken references and will fail when it is run. Do not attempt to edit a task sequence after it has been exported. The task sequence must be imported into a Configuration Manager 2007 site before it can be edited. Restrict access to the exported file to help prevent tampering.

Important
Because of changes to the task sequence schema to allow a task sequence to be run as a specified account, Configuration Manager 2007 R2 task sequences that use the Run As feature cannot be imported by a Configuration Manager 2007 site server. Configuration Manager 2007 R2 task sequences that use the Run As feature and that run on Configuration Manager 2007 will fail.

To import a task sequence, click Import in the Actions pane, and then browse to the location of the task sequence file.

Creating Media for Task Sequences

You can write task sequences and the related files and dependencies to a DVD or CD set or a USB flash drive. Removable media will allow you to run the task sequence on computers that do not have a network connection to your Configuration Manager 2007 site. Task sequence media can be used only in the same site where the media was created. For more information about creating media use the following link: How to Deploy an Operating System Image Using Media

You can create three types of removable media:

  • Stand-alone. Stand-alone media contains the task sequence and all associated objects necessary for the task sequence to run. Stand-alone media task sequences can run when the Configuration Manager Client has limited or no connectivity to the network. Stand-alone media can be run in two ways: first, if the target computer is not booted, the Windows PE image associated with the task sequence is used from the stand-alone media and the task sequence begins. Second, the stand-alone media can be manually started if a user is logged on to the network and initiates the installation.
    Important
    Stand-alone media task sequence steps must be able to fully run autonomously from the network; otherwise, the task sequence step will fail. For example, a task sequence step that requires a distribution point to obtain a package will fail; however if the necessary package is contained on the stand-alone media the task sequence step will succeed.

  • Boot. Boot media contains the necessary files to start a target computer so that it can connect to the Configuration Manager 2007 infrastructure and the target computer can determine which task sequences to run based on the target computer's collection membership. The task sequence and dependent objects are not contained on the media; instead, they are obtained over the network from the Configuration Manager 2007 client. This method is useful with new computer or bare metal deployments, or when no Configuration Manager 2007 client is present on the computer.
  • Capture. Capture media is used to capture an operating system image that has been configured and created outside of the Configuration Manager 2007 infrastructure. Capture media can contain custom programs that can run prior to a task sequence. The custom program can interact with the desktop, prompt the user for input values, or create variables that will be used by the task sequence.

You should specify a password that is assigned to the media and must be entered by a user to access the files contained on the media. If you specify a password to be assigned to the media, a user must be present to enter the password at the target computer.

When you run a task sequence using media, the specified computer chip architecture contained on the media will not be recognized and the task sequence will attempt to run even if the architecture specified does not match what is actually installed on the target computer.

Important
If the chip architecture contained on the media does not match the chip architecture installed on the target computer the installation will fail.

Using Media in Configuration Manager 2007 Native Mode Environments

When you use media created by Configuration Manager 2007 to deploy operating systems in native mode, you will need to include a public key infrastructure (PKI) certificate on the media if task sequences require communication with the native mode site's management point. Without this certificate, authentication to the management point will fail, and operating system deployments will not succeed. For more information about using certificates in native mode for operating system deployment media use the following link: How to Manage Native Mode Certificates and Operating System Deployment

Additionally, for the certificate contained on the media to be trusted by the management point, the site must also be configured with a root certification authority for the certificate. For more information about configuring the site with the root certification authority, see How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients.

See Also

Concepts

Overview of Operating System Deployment

Other Resources

How to Manage Native Mode Certificates and Operating System Deployment
How to Manage Task Sequences


About Task Sequence Variables

The Configuration Manager 2007 task sequence environment variables are a set of name and value pairs that supply configuration and operating system deployment settings for computer, operating system, and user state configuration tasks on a Configuration Manager 2007 client computer. Task sequence variables provide a mechanism to configure and customize the steps in a task sequence.

When you create a task sequence in the Configuration Manager 2007 administrator console, it is stored as a sequence of steps. You can edit the task sequence steps and their associated settings in a task sequence using the Task Sequence Editor. When you run the task sequence, many of the task sequence settings are stored as environment variables. You can access or change the values of built-in task sequence variables, and you can create new task sequence variables to customize the way a task sequence runs on a target computer.

You can use task sequence variables in the task sequence environment to perform the following actions:

  • Configure settings for a task sequence action
  • Supply command-line arguments for a task sequence step
  • Evaluate a condition that determines whether a task sequence step or group should run
  • Provide values for custom scripts used in a task sequence

For example, you might have a task sequence that includes a Join Domain or Workgroup task sequence step. The task sequence might be advertised to different collections, where the collection membership is determined by domain membership. In that case, you can specify a Per-Collection task sequence variable for each collection’s domain name and then use that task sequence variable to supply the appropriate domain name in the task sequence.

Creating Task Sequence Variables

You can add new task sequence variables to customize and control steps in a task sequence. For example, you can create a task sequence variable to override a setting for a built-in task sequence step. You can also create a custom task sequence variable to use with conditions, command lines, or custom steps in the task sequence. When you create a task sequence variable, the task sequence variable and the associated value is preserved within the task sequence environment, even when the sequence restarts the target computer. The variable and its value can be used within the task sequence across different environments. For example, it can be used in a full Windows operating system and in the Windows Pre-Installation environment.

The following table describes the methods for creating a task sequence environment variable, along with usage implications for each method.

Creation Method Usage Overview

Setting fields in task sequence steps using the Task Sequence Editor

Specifies set default values for the task sequence step. The variable and value are accessible only when the step runs in the task sequence. They are not part of the overall sequence environment, and they are not accessible by other task sequence steps in the task sequence.

For a list of built-in variables and their associated actions, see Operating System Deployment Task Sequence Variables.

Adding a set task sequence variable step in a task sequence

Specifies the task sequence variable and value in the task sequence environment when the task sequence step is run as part of a task sequence. All subsequent task sequence steps can access the environment variable and its value.

Defining a Per-Collection variable

Specifies a task sequence and values for a collection of computers. All task sequences targeted to the collection can access the task sequence variable and its value.

Defining a Per-Computer variable

Specifies task sequence variables and values for a particular computer. All task sequences targeted to the computer can access the task sequence variable and its value.

Adding a task sequence variable on the Variables page of the Task Sequence Media Wizard

Specifies task sequence variables and values for the task sequence that is run from the media that can access the task sequence variable and its value.

To override the default value for a built-in task sequence variable, you must define a task sequence variable with the same name as the built-in task sequence variable. For a list of built-in task sequence variables with the associated actions and usage, see Operating System Deployment Task Sequence Variables.

You can delete a task sequence variable from the task sequence environment by using the same methods as creating a task sequence variable. To delete a variable from the task sequence environment, you set the task sequence variable value to an empty string.

You can combine methods to set an environment task sequence variable to different values for the same sequence. In an advanced scenario, you might set the default values for steps in a sequence using the Task Sequence Editor and then set a custom variable value using each of the creation methods. The following list describes the rules that determine which value is used when a task sequence variable is created using more than one method:

  1. Set Task Sequence Variable overrides all other creation methods.
  2. Per-computer variables take precedence over per-collection variables. If you specify the same task sequence variable name for a per-computer variable and a per-collection variable, the per-computer variable value will be used when the target computer runs advertised task sequence.
  3. Task sequences can be run from stand-alone media. Use the media variables in place of per-collection or per-computer variables. If the task sequence is running from stand-alone media, per-computer and per-collection variables do not apply and will not be used. Instead, task sequence variables defined on the Variables page of the Task Sequence Media wizard are used to set values specific to a task sequence running from media.
  4. If a task sequence variable value is not set in the overall sequence environment, built-in actions use the default value for the step, as set in the Task Sequence Editor.

In addition to overriding values for built-in task sequence step settings, you can also create a new environment variable for use in a task sequence step, script, command line, or condition. When you specify a name for a new task sequence variable, there are several guidelines that you must follow.

The following section describes these guidelines and provides examples of valid and invalid task sequence variable names:

  • The task sequence variable name you specify can contain letters, numbers, the underscore character (_), and a hyphen (-).
  • Task sequence variable names have a minimum length of 1 character and a maximum length of 256 characters.
  • User defined variables must begin with a letter (A-Z).
  • User-defined variable names cannot begin with the underscore character. Only read-only task sequence variables are preceded by the underscore character.
    Note
    Read-only task sequence variables can be read by task sequence steps in a task sequence but not set. For example, you can use a read-only task sequence variable as part of the command line for a Run Command Line task sequence action, but you cannot set a read-only variable using the Set Task Sequence Variable action.

  • Task sequence variable names are not case sensitive. For example, OSDVAR and osdvar represent the same task sequence variable.
  • Task sequence variable names cannot begin or end with a space or contain embedded spaces. Spaces that are left at the beginning or the end of a task sequence variable name are not read.
  • The following table displays examples of valid and non valid user-specified task sequence variables.

Examples of Valid User-Specified Variable Names Examples of Non valid User-Specified Variable Names

MyVariable

1Variable

Note
User-specified task sequence variables cannot begin with a number.

My_Variable

MyV@riable

Note
User-specified task sequence variables cannot contain the @ character.

My_Variable_2

_MyVariable

Note
User-specified task sequence variables cannot begin with an underscore.

The following are general limitations when creating task sequence variable:

  • Task sequence variable values cannot exceed 4000 characters.
  • You cannot create or override a read-only task sequence variable. Read-only variables are designated by names starting with an underscore character (_). You can access the value of read-only task sequence variables in your task sequence; however, you cannot change their associated values.
  • There is no limit to how many task sequence variables can be created; however, the total size of the task sequence environment cannot exceed 10 MB.

Accessing Task Sequence Environment Variables

After specifying the task sequence variable and its value using one of the methods from the previous section, you can use the environment variable value in your task sequences. You can access default values for built-in task sequence variables, specify a new value for a built-in variable, or use a custom task sequence variable in a command line or script.

The following table outlines task sequence operations that can be performed by accessing the task sequence environment variables.

Task Sequence Operation Usage Overview

Configure action settings

You can specify that a task sequence step setting is provided by a variable value when the sequence runs.

To supply a task sequence step setting through a task sequence environment variable, use the Task Sequence Editor to edit the step and specify the variable name as the field value. The variable name must be enclosed in percent signs (%) to indicate it is an environment variable.

Supply command-line arguments

You can specify part or all of a custom command line by using an environment variable value.

To supply a command-line setting by using an environment variable, use the variable name as part of the Command Line field of the Run Command Line task sequence step. The variable name must be enclosed in percent signs (%).

Example:

The following command line uses a built-in environment variable to write the computer name to C:\File.txt.

Cmd /C %_SMSTSMachineName% > C:\File.txt

Evaluate a step condition

You can use built-in or custom task sequence environment variables as part of a task sequence step or group condition. The environment variable value will be evaluated prior to running the task sequence step or group on a Configuration Manager 2007 computer.

To add a condition that evaluates a variable value, select a step or group in the sequence and use the Add Condition drop down on the Options tab. Select the task sequence variable condition, and specify the variable and the value to evaluate.

Provide information for a custom script

Task Sequence variables can be read and written using the Microsoft.SMS.TSEnvironment COM object while the task sequence is running.

The following example illustrates a Visual Basic script file that queries the _SMSTSLogPath task sequence variable to get the current log location. The script also sets a custom variable.

dim osd: set env = CreateObject("Microsoft.SMS.TSEnvironment")

dim logPath

' You can query the environment to get an existing variable.

logPath = env("_SMSTSLogPath")

' You can also set a variable in the OSD environment.

env("MyCustomVariable") = "varname"

For more information about using task sequence variables in scripts, refer to the SDK documentation.

Computer and Collection Variables

Task sequences can be configured to run on multiple computers or collections simultaneously. You can specify unique per-computer or per-collection information, such as specifying a unique operating system product key or joining all of the members of a collection to a specified domain.

You can assign task sequence variables to a single computer or a collection. When the task sequence starts to run on the target computer or collection, the values specified will be applied to the target computer or collection.

You can specify task sequence variables for a single computer or a collection. When the task sequence starts to run on the target computer or collection, the variables specified will be added to the environment and the values will be available to all task sequence steps in the task sequence.

Important
If the same variable name is used for both a per-collection and per-computer variable, the computer variable value takes precedence over the collection variable. Task sequence variables that are assigned to collections take precedence over task sequence variables over built-in task sequence variables.

For more information about creating task sequence variables for a single computer or collection, please see the following topics:

  • How to Create Per-Computer Task Sequence Variables. Select this topic for more information about specifying a task sequence variable to a single computer.
  • How to Create Per-Collection Task Sequence Variables. Select this topic for more information about specifying a task sequence variable to a collection.

Task Sequence Media Variables

Task sequence variables can be specified for task sequences that are stored and run from media, such as CD/DVD sets or USB drives. You add the task sequence variables and specify their values when you create the media containing the task sequence; the variables and their values are stored on the media with the task sequence.

Important
When you run a task sequence from media, all custom task sequence variable information must be contained on the media; per-collection and per-computer variables cannot used with task sequences running from media.

You can specify task sequence variables on the Variables page of the Task Sequence Media Wizard. For more information about using the Task Sequence Media, see Task Sequence Media Wizard.

Task Sequence Variables List

For a list of built-in task sequence variables, see Task Sequence Variables

See Also

Tasks

How to Create Per-Collection Task Sequence Variables
How to Create Per-Computer Task Sequence Variables

Concepts

Operating System Deployment Task Sequence Variables


Operating System Deployment Checklists

This topic provides links to checklists that provide recommended steps to help you complete essential operating system deployment tasks in Configuration Manager 2007.

In This Section

Administrator Checklist: Configure the Reference Computer for Operating System Deployment

Provides a checklist for a recommended method to configure the operating system deployment reference computer.

Administrator Checklist: Create the Capture Task Sequence

Provides a checklist for a recommended method to create the operating system deployment capture task sequence.

Administrator Checklist: Prepare the Configuration Manager Environment for Bare Metal Operating System Deployment

Provides a checklist for recommended methods for preparing the Configuration Manager 2007 site for bare metal operating system deployments.

Administrator Checklist: Prepare the Configuration Manager Environment for Operating System Deployment

Provides the basic steps to consider when preparing the Configuration Manager 2007 environment for using operating system deployment.

See Also

Concepts

Administrator Workflows for Operating System Deployment


Administrator Checklist: Configure the Reference Computer for Operating System Deployment

The following checklist includes the basic steps to consider when configuring a reference computer for operating system deployment. You can create a capture CD to capture the operating system image after the reference computer has been configured. For more information about capturing an operating system image see: About Capturing and Deploying an Operating System Image

Step | Reference
Configure the reference computer with the operating system, service packs, security updates, applications, settings, tools and desktop customization | About the Operating System Deployment Reference Computer
Create media to capture the reference computer operating system image. | How to Capture an Image from a Reference Computer Using Capture Media

See Also

Concepts

About Creating the Operating System Deployment Packages

Other Resources

Operating System Deployment Checklists


Administrator Checklist: Create the Capture Task Sequence

The following checklist includes the basic steps to consider when creating a task sequence to build a reference computer and capture an operating system image from that reference computer.

Steps | Reference
Identify a Configuration Manager 2007 client that will be the reference computer. | About the Operating System Deployment Reference Computer
Run the New Task Sequence Wizard. | New Task Sequence Wizard - Build and Capture a Reference Operating System image
Customize the task sequence that you created. | Operating System Deployment: Task Sequence Editor

Run the New Task Sequence Wizard

When you run the New Task Sequence Wizard, select the option Build a Reference Operating System Image. This table lists the information you need to provide when running the wizard.

Steps Reference

Create all the support packages that you need to successfully build the reference computer including:

  • Windows operating system installation
  • Configuration Manager 2007 client installation
  • Sysprep
  • Driver packages
  • Software applications and support tools

About Creating the Operating System Deployment Packages

Identify the Configuration Manager 2007 package that contains the operating system to install on the reference computer.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Identify the Configuration Manager 2007 package that contains the Configuration Manager 2007 client to install on the reference computer.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Specify workgroup or domain information including the account credentials that has permission to join the workgroup or domain.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Specify appropriate Windows license information.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Specify whether you'll need to install all software updates targeted to the reference computer by Configuration Manager 2007, mandatory software updates targeted to the reference computer by Configuration Manager 2007, or no software updates.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Specify any other Configuration Manager 2007 packages that contain software applications or other tools or scripts that you want to install on the reference computer.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Specify the Configuration Manager 2007 package containing the appropriate version of Sysprep or another migration tool.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Specify a local or network location for the image to be stored.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Customize the New Task Sequence

The New Task Sequence Wizard is used to create a default task sequence that you can then customize further by running the Task Sequence Editor. This table lists the items that you can customize for the reference computer.

Add a task sequence that does the following: | Description
Installs a Configuration Manager 2007 package that contains the appropriate service pack. | Install Software
Installs a Configuration Manager 2007 package that contains the appropriate software updates. | Install Software Updates
Installs a Configuration Manager 2007 package that contains the appropriate applications. | Install Software
Installs a Configuration Manager 2007 package that contains the appropriate mass storage drivers (disk, NIC) | Apply Driver Package
Installs a Configuration Manager 2007 package that contains the appropriate tools and scripts you require to mitigate installation scenarios. | Install Software
Installs a Configuration Manager 2007 package that contains the appropriate desktop customization (wall paper, branding, default user profile). | Install Software Run Command Line

See Also

Tasks

How to Capture an Image from a Reference Computer Using Capture Media

Concepts

How to Create a Task Sequence to Build and Capture an Operating System Image
Planning for the Operating System Image

Other Resources

Operating System Deployment Checklists


Administrator Checklist: Prepare the Configuration Manager Environment for Bare Metal Operating System Deployment

The following checklist includes the tasks you perform to prepare the Configuration Manager 2007 environment for bare-metal operating system deployments.

Steps Reference

Configure the Configuration Manager 2007 PXE service point.

You must add the PXE service point site role to a server in your Configuration Manager 2007 site.

For more information about establishing a PXE service point site role, see How to Configure the PXE Service Point.

Enable the boot images to allow the command shell for troubleshooting.

You must enable command support for troubleshooting.

Right-click the boot image and select Properties. Select the Windows PE tab, and select Enable Command Support (testing only).

Make the required boot images available on the PXE service point.

You must make the required boot images available on the PXE service point so that they are available to initiate the bare metal operating system deployment.

For more information about adding boot images to a PXE service point, see How to Add Boot Images to the PXE Service Point.

Configure the Network Access Account.

In the Configuration Manager 2007 administrator console, navigate to System Center Configuration Manager / Site Database / Site Management / Site Name / Site Settings / Client Agents.

Right-click Client Agents and select Properties. Click Set, and specify the account that will be used to access Configuration Manager 2007 site resources. The account you specify must have access to the share specified on the PXE service point and any files or directories required by the task sequence.

Important
The Network Access account should not be an administrator on any resource in your Configuration Manager 2007 site. For more information, see About the Network Access Account.

Create the Operating System Deployment Task Sequence.

You must create a task sequence to complete the operating system deployment task. For more information about using task sequences, see How to Manage Task Sequences.

See Also

Tasks

How to Perform a Network Capture of a Server Operating System Image That Is Configured with Sysprep and PXE

Other Resources

Operating System Deployment Checklists


Administrator Checklist: Prepare the Configuration Manager Environment for Operating System Deployment

The following checklist includes the tasks you perform to prepare the Configuration Manager 2007 environment for operating system deployment.

Task Reference

Enable DHCP

Refer to your Windows Server documentation for information about configuring DHCP. In particular, you will need to:

  • Create a scope of available addresses
  • Enable the DNS scope option
  • Activate the scope and authorize the server

Enable the Client Network Access account in Active Directory for the Configuration Manager 2007 site

How to Configure the Network Access Account

Create the appropriate packages to use with your operating system deployment task sequences.

About Creating the Operating System Deployment Packages

Distribute the boot image you want to deploy to the appropriate distribution points.

You can also modify the boot.wim file to gather log information by way of the command-line shell.

How to Manage Operating System Boot Images

Configure a state migration point

How to Manage the User State

How to Configure the State Migration Point

Add drivers to an operating system image

How to Install Drivers on a Configuration Manager 2007 Client Using a Task Sequence

Configure the PXE Service Point

How to Configure the PXE Service Point

See Also

Other Resources

Planning for Operating System Deployment


About Feature Reports for Operating System Deployment

Reports have been created for Operating System Deployment in Configuration Manager 2007. These reports provide information about operating system deployment and task sequence status.

The available operating system reports can be used to provide high level information about overall operating system deployment progress, information on the status of specific operating system deployments and task sequences, and miscellaneous reports that provide general information about operating system deployments.

In This Section

Available Operating System Deployment Reports

See Also

Other Resources

Operating System Deployment in Configuration Manager


Available Operating System Deployment Reports

There are five operating system deployment report categories, each with available reports that retrieve data used to accomplish a variety of objectives. This section lists each of the operating system deployment reports by category and provides a brief description for each.

State Migration

  • State migration information for a specified state migration point::
    This report returns information about the number of Configuration Manager 2007 clients that save the user state to the specified state migration point, and the available disk space.
  • State migration points for a specific site:
    This report returns information about available state migration points for a specific Configuration Manager 2007 site as well as the number of Configuration Manager 2007 clients that save their user state there and the available disk space.

Task Sequence - Progress

  • Progress of OS Deployment task sequences:
    This report returns information about overall progress for all operating system deployment task sequences.
  • Chart - Progress of all task sequences:
    This report returns a chart depicting the overall progress of all task sequences in a graphical format.
  • Progress of all task sequences:
    This report returns the progress information for all task sequences.
  • Chart - Weekly progress of a task sequence:
    This report returns a chart depicting the overall progress of a task sequence since the task sequence was first advertised.

Task Sequence - Advertisements

  • Progress of a running task sequence:
    This report returns the progress of a specific task sequence that is currently running in the various task sequence phases/groups.
  • Progress of a running task sequence advertisement:
    This report returns the progress of a specific task sequence advertisement that is currently running in the various task sequence phases/groups.
  • Count of failures in each phase/group of a specific task sequence:
    This report returns the number of failures in each phase/group of a specific task sequence.
  • All task sequence advertisements:
    This report provides detailed information about all task sequence advertisements initiated from the Configuration Manager 2007 site.
  • All system resources that failed in a specific group/phase of a specific task sequence advertisement:
    This report returns a list of all computers that failed within a specific group/phase of the specified task sequence advertisement.
  • Count of failures in each phase/group of a specific task sequence advertisement:
    This report returns a list of the number of failures in each phase/group of a specific task sequence advertisement.
  • All system resources currently in a specific group/phase of a specific task sequence advertisement:
    This report returns a list of computers that are currently running in a specific group/phase of the specified task sequence advertisement.
  • Summary report for a task sequence advertisement:
    This report returns the summary information for a specific task sequence.
  • Deployment status for all task sequence advertisements:
    This report returns the progress of all task sequence advertisements.
  • Progress of all advertisements for a specific task sequence:
    This report returns the progress of all advertisements for a specific task sequence.

Task Sequence - Advertisement Status

  • Count of all system resources that have task sequence advertisements assigned but not yet run:
    This report returns information about each computer that has accepted information about an assigned task sequence but has not yet run the task sequence.
  • Task run time history for a specific computer and a specific task sequence advertisement:
    This report returns information about the run time status for each task sequence step. If no record is returned, the task sequence has not started yet.
  • All system resources for a specific task sequence advertisement in a specific state:
    This report returns a list of computers that are targeted by the specified task sequence advertisement and are currently in the specified state.
  • List of computers that took longer than a specified length of time to run a task sequence advertisement:
    This report returns a list of computers that took longer than the specified length of time to run a task sequence advertisement. The length of time is displayed in hours as a parameter for this report.
  • Run time for each step of a specific task sequence advertisement on a specific computer:
    This report returns the time required to complete each task sequence step contained in a specific task sequence advertisement on a specific computer.
  • Run time for a specific OS deployment task sequence advertisement on a specific target computer:
    This report returns the total time necessary to successfully complete an operating system deployment task sequence on a target computer.
  • Run time status of a specific task sequence advertisement for a specific computer:
    This report returns the run time status summary of a specific task sequence advertisement on a specific computer.
  • Status summary of a specific task sequence advertisement:
    This report shows the status summary of all resources that have been targeted by a specific task sequence.

Operating System

  • Count operating systems and service packs:
    This report returns the number of computers sorted by operating system version and service pack level.
  • Windows server computers:
    This report returns a list of computers and the associated versions of the Windows Server operating system.
  • Computers with a specific operating system and service pack:
    This report returns a list that displays computers with a specific operating system and service pack.
  • Count of operating systems:
    This report retunes the number of computers inventoried by operating system deployment.
  • History - operating system history for a specific computer:
    This report returns the inventory history for the operating system on a single computer.
  • Computers with a specific operating system:
    This report returns a list of computers with a specific operating system installed
  • Services - Services information for a specific computer:
    This report returns summary information about the services running on a single computer.
  • Services - Computers running Remote Access Server:
    This report returns a list of computers running remote access server.
  • Services - Computers running a specific service:
    This report returns a list of computers running a specified service.

See Also

Concepts

Reporting in Configuration Manager


About Multicast for Operating System Deployment

Topic Last Updated—August 2008

Multicast is an operating system deployment feature in Microsoft System Center Configuration Manager 2007 R2 that conserves network bandwidth by simultaneously sending data to multiple clients rather than sending a copy of the data to each client over a separate connection. Multicast allows multiple computers to download an operating system image package as it is multicast by the distribution point rather than each client being sent the package separately. This can conserve network bandwidth in environments where multiple clients are likely to be downloading the same operating system image at the same time. Clients can join a multicast session already in progress. When the multicast is complete, the client will then download missing portions of the package.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Multicast Prerequisites

Multicast for operating system deployment requires Microsoft System Center Configuration Manager 2007 SP1 and Microsoft System Center Configuration Manager 2007 R2 be installed and the Windows Deployment Services (WDS) extension be installed on Windows Server 2008 site system servers. For a full list of prerequisites for multicast, see Prerequisites for Multicast for Operating System Deployment.

Enabling and Configuring Multicast

To deploy operating system images by using multicast, the multicast feature must be enabled on the specific Configuration Manager 2007 distribution point. Branch distribution points cannot use multicast. For information about how to enable multicast, see How to Enable Multicast for Operating System Deployment.

After enabling multicast, configure multicast for the network environment. For more information about configuring for multicast, see About Configurations for Multicast for Operating System Deployment.

Scheduling Multicast

Administrators can further conserve bandwidth by specifying scheduling conditions to group multiple clients together. This consolidates client requests and optimizes the benefits of multicast but might require clients to wait until certain conditions are met to begin downloading the operating system image. The scheduling conditions can be configured to require a certain number of clients or a certain number of minutes before the multicast session begins. For more information about scheduling conditions for multicast sessions, see ConfigMgr Distribution Point Properties: Multicast Tab.

See Also

Reference

ConfigMgr Distribution Point Properties: Multicast Tab

Concepts

About Configurations for Multicast for Operating System Deployment
Prerequisites for Multicast for Operating System Deployment


About Configurations for Multicast for Operating System Deployment

Topic last updated—March 2008

Multicast is an operating system deployment feature in Microsoft System Center Configuration Manager 2007 R2 that conserves network bandwidth by simultaneously sending data to multiple clients rather than sending a copy of the data to each client over a separate connection. Multicast allows multiple computers to download an operating system image package as it is sent by the distribution point rather than each client being sent the package independently. This can conserve network bandwidth in environments where multiple clients are likely to be downloading the same operating system image at the same time.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Multicast Network Configurations

Multicast requires configuration of the multicast IP addresses, ports, and network configurations for multicast communication. In addition, the distribution point that has multicast enabled must have Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients) enabled.

Multicast Account

The multicast account specifies the Windows user account to be used when making Configuration Manager 2007 database connections for the multicast configuration. The default setting uses the computer account for the distribution point. A different user account can be specified.

Note
Best practice is to use the minimum necessary permissions for performing a specific task.

IP Addresses and UDP Ports

The multicast service point must be configured to specify the multicast IP addresses and user datagram protocol (UDP) port range used by multicast sessions. These IP addresses and ports must be accessible by computers requesting operating system images so the routers in between must be configured to allow multicast traffic. The IP addresses must be within the range of multicast IP addresses between 224.0.0.0 and 224.0.0.255. The settings for multicast might require configuration of firewalls and routers to ensure that multicast traffic is not blocked.

By default, the IP address will be obtained from a DHCP server that is enabled to distribute multicast addresses. Depending on the network environment, the administrator can instead specify a range of IP addresses.

Multicast Schedule

By default, multicast is performed using an unscheduled multicast called autocast. Autocast allows clients to begin downloading immediately. If an autocast is already in progress, the client joins the multicast and downloads the package and then downloads any portion of the package it missed because it joined late. If no session is in progress when a client requests an image, the multicast session begins immediately.

Alternatively, the administrator can configure multicast to distribute images when specific scheduling conditions are met. A scheduled multicast requires clients to wait until the Session start delay in minutes has passed or until the Minimum number of clients is reached before the multicast session begins. After a multicast session begins, new clients must wait for the next session.

Deploying operating system packages via autocast might require more bandwidth, but it does not require that clients wait to begin the download.

Network Profile

Specifies the profile of the network used for multicast. Each profile contains settings to optimize performance for the specified speed, such as the maximum transport window size, the transport cache size, and the block size.

Network Considerations for Multicast

Enabling multicast allows Configuration Manager 2007 clients to share a multicast of an operating system image sent by a distribution point. During an operating system deployment task sequence, the client requests an operating system image from a distribution point.

The distribution point assignment for a multicast deployment is made like a normal assignment, including the determination as to whether the distribution point is local or remote based on whether it is within a fast network boundary. The client is then assigned to a distribution point based on a list that favors local multicast-enabled distribution points, if available. If a client cannot receive a local multicast distribution other non-multicast local distribution points and remote distribution points are tried. Operating system images are never distributed from a remote distribution point using multicast. Branch distribution points cannot use multicast for operating system deployment. For more information about how package source files are located, see Configuration Manager and Content Location (Package Source Files).

Best practice recommends that the same distribution point is not used both for multicast and for unicast distributions in network environments that are likely to have high volumes of operating system deployment. For this reason, operating system deployment driver packages and non-multicast operating system images should be located on distribution points other than the multicast-enabled distribution point.

See Also

Reference

ConfigMgr Distribution Point Properties: Multicast Tab

Concepts

Configuration Manager and Content Location (Package Source Files)


About Unknown Computer Support for Operating System Deployment

Topic last updated—March 2008

Unknown computer support is an operating system deployment feature in Configuration Manager 2007 R2 that allows unmanaged systems to be recognized and receive an operating system deployment.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Unknown computer support allows computers without a Configuration Manager 2007 client to be provisioned with an operating system by Configuration Manager 2007 operating system deployment. The unknown computer can then receive an advertised task sequence to install an operating system image by using Configuration Manager 2007 operating system deployment or other task sequences.

Important
If you enable unknown computer support, any unknown computers that use PXE-initiated operating system deployments will attempt to run mandatory task sequences. Mandatory task sequences that include operations such as Apply Operating System Image or Format and Partition disk will destroy all data on those unknown systems.

Unknown Computer Installation Process

When the unknown computer broadcasts a PXE boot request or boots from boot media, the computer will be assigned to a PXE-enabled server by the DHCP server. A Configuration Manager 2007 server with an unknown computer support–enabled PXE site role will record the MAC address of the unknown computer. For the purpose of operating system deployment, the computer is now recognized as unprovisioned rather than unknown. The unprovisioned computer can receive task sequences and install an operating system image that includes the Configuration Manager 2007 client. During operating system installation, the task sequence can retrieve collection variables but not machine variables from unknown computers.

When installed with the Configuration Manager 2007 client, the computer will appear in the appropriate Configuration Manager 2007 collections. If the computer fails to install the operating system image with the Configuration Manager 2007 client, the computer will appear in the Unprovisioned Computers folder in System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment.

See Also

Other Resources

How to Deploy an Operating System to Unknown Computers


Prerequisites for Operating System Deployment

Topic last updated—November 2007

This topic describes the external and internal prerequisites or dependencies that are required for Configuration Manager 2007 operating system deployment.

Dependencies External to Configuration Manager 2007

The following table provides information about operating system deployment dependencies that are external to Configuration Manager 2007.

Dependency More Information

User State Migration Tool (USMT)

If you plan to capture and restore the user state as part of your operating system deployment, you will need to download the USMT. For more information about the USMT, see http://go.microsoft.com/fwlink/?LinkId=88299.

You can download the USMT from the Microsoft Download Center at http://go.microsoft.com/fwlink/?LinkId=88300.

For help with state migration, you can find additional scripts from the Microsoft Business Desktop Deployment Web site at http://go.microsoft.com/fwlink/?LinkId=88302.

Windows PE

Windows PE 2.0 is a Windows operating system with limited services, built on the Windows Vista operating system platform. Windows PE is the boot image used with operating system deployment and is used only during the pre-installation and deployment of Windows operating systems. Configuration Manager 2007 does not support earlier versions of Windows PE.

You can find detailed documentation about Windows PE at http://go.microsoft.com/fwlink/?LinkId=88303.

Windows Automated Installation Kit (WAIK)

Operating system deployment for Configuration Manager 2007 SP1 and Configuration Manager 2007 R2 require WAIK version 1.1 from Vista SP1 or Windows Server 2008.

Configuration Manager 2007 Dependencies

The following table provides information about Configuration Manager 2007 operating system deployment prerequisites.

Dependency More Information

Supported operating systems and hard disk configurations

For more information about the operating system versions and hard disk configurations supported by Configuration Manager 2007 operating system deployment, see Supported Operating Systems and Hard Disk Configurations for Operating System Deployment.

Deploying an operating system image

Depending on the method you plan to use to deploy operating system images, there are several dependencies that must be considered. For more information about these dependencies, see Determine Your Operating System Deployment Method.

Driver Catalog

Deploying a device driver requires that the device driver has been imported, enabled, and is available on a distribution point accessible to the Configuration Manager 2007 client. For more information about the driver catalog, see How to Manage the Driver Catalog.

Configuration Manager 2007 Site Systems

There are new Configuration Manager 2007 site system roles for use with operating system deployment. For more information about the new site system roles, see the following topics:

  • How to Configure the PXE Service Point
  • How to Configure the State Migration Point

Certificates for native mode

If the site is configured for native mode, you might need the following public key infrastructure (PKI) certificates for an operating system deployment:

  • Web server certificate and client certificate for the state migration point.
  • Client certificates that are imported for the PXE service point and boot media image.
  • Root certification authority certificates that are configured as a site property.

For more information about the PKI certificate requirements, see the section "Operating System Deployment Feature" in Certificate Requirements for Native Mode.

For more information about how native mode certificates are used with operating system deployment, see About Native Mode Certificates and Operating System Deployment.

See Also

Concepts

Prerequisites for Multicast for Operating System Deployment

Other Resources

Operating System Deployment in Configuration Manager


Planning for Operating System Deployment

This section provides the basic planning tasks needed to create and deploy an operating system image to a computer. The following planning information is included in this section:

  • Planning ConfigMgr Site Systems for Operating System Deployment
  • Determine Your Operating System Deployment Method
  • Planning for the Operating System Image
  • Planning for the Boot Image
  • Planning for Deploying the Operating System Image
  • Planning for PXE Initiated Operating System Deployments
  • Planning for Operating System Deployment in a NAP-Enabled Environment
  • Planning for Operating System Deployment in a Native Mode Site

See Also

Other Resources

Operating System Deployment in Configuration Manager


Planning ConfigMgr Site Systems for Operating System Deployment

The same planning steps that you would consider when setting up Configuration Manager 2007 site systems apply when configuring them for Operating System Deployment. For example, if you are planning to have more than one site system role on a server, you need to consider the aggregate affect of all the site system roles on the server's resources - network performance, memory, disk storage, and processor utilization. Operating System Deployment primarily affects resources for the state migration point and the distribution point.

Consider the following specific items when configuring the state migration point and distribution point for Operating System Deployment.

State Migration Point

The state migration point is used by Operating System Deployment when migrating user state and settings from one computer to another as part of the operating system image deployment. The state migration point requires Internet Information Services (IIS) to be installed.

As you plan for the state migration point, consider the following:

User State Size

The size of the user state directly affects disk storage on the state migration point and network performance during the migration. Consider the size of the user state and the number of computers that you are migrating. Consider also what settings you need to migrate from the computer. For example, if My Documents is already backed up to a server, then perhaps you don’t need to migrate it as part of the image deployment. This can keep the overall size of the user state smaller and decrease the effect it would otherwise have on network performance and disk storage on the state migration point.

User State Migration

Operating System Deployment relies on the User State Migration Tool (USMT) to migrate user state and settings.

USMT 3.0 supports the capture of user settings (known as scan state) from computers running the Windows 9x operating system or later, and the restore of user settings (known as load state) on computers running the Windows 2000 , service pack 4,Windows XP, Windows 2003, or Windows Vista operating systems.

Note
Configuration Manager 2007 supports computers running the Windows 2000, service pack 4 operating system or later. For more information about the supported operating systems for operating system deployment see: Supported Operating Systems and Hard Disk Configurations for Operating System Deployment

For more information about USMT see the Windows XP Professional Deployment Web page at http://go.microsoft.com/fwlink/?LinkId=88299. You can download USMT from the Microsoft Download Center at http://go.microsoft.com/fwlink/?LinkId=88300.

You can also find additional scripts to assist you with state migration from the Microsoft Business Desktop Deployment Web site http://go.microsoft.com/fwlink/?LinkId=88302.

Retention Policy

When you configure the state migration point, you can specify how long to keep user state data that was stored on it. The length of time that you keep the data on the state migration point depends on two considerations: the effect that the stored data has on disk storage, and whether you need to keep the data for a time against the possibility of needing to migrate it again.

There are two phases to state migration: capture and restore.

During capture, the user state data is collected and saved to the state migration point. During restore, the data is located on the state migration point, written to the destination computer, and then released by the task sequence step Release State Store. When the data is released, the retention timer starts. If you chose to delete migrated data immediately when you configured the state migration point, the user state data is deleted as soon as it is released. If you configured the state migration point to keep the data for a certain period of time, the data will be deleted when that period of time elapses after the state data is released. The longer you set the retention period, the more disk space you are likely to need.

Selecting drives

When you configure the state migration point, you need to specify the drive on the server that should be used to store user state migration data. You select a drive from a fixed list of drives. However, the list of available drives shows all drive letters available, some of which may represent non-writable drives, such as the CD drive, or a non-network share drive. Some drive letters might not be mapped to any drives on the computer. It is important that you understand before configuring the state migration point which drives you should use for storing user state migration data.

Distribution Point

You must plan for the appropriate number and placement of distribution points. This kind of planning is basically the same as you would do for any other deployment of Configuration Manager 2007 packages. However, there are some considerations specific to Operating System Deployment.

Consider the number of computers that can be deployed at one time from a given distribution point. The processing speed and disk I/O of the distribution point must be considered along with the available bandwidth on the network, and the effect that the size of the image package will be on those resources.

For example, on a 100Mb Ethernet network, if no other server resource factors are considered, the maximum number of computers that can process a 2GB image package in one hour would be 23.

Copy Code
1 Megabit transfers 8 Megabytes of data
100 Megabits/sec = 12.5 Megabytes/sec = 750 Megabytes/min = 45 Gigabytes/hour= 23 images @ 2GB per image.

In reality, the number might be far less. So if you need to be able to deploy a specific number of computers within a specific time frame, you will need to distribute the image package to an appropriate number of distribution points, and use Configuration Manager 2007 features such as protected distribution points and branch distribution points to ensure that the appropriate destination computers receive the image.

Important
Operating System Deployment does not distinguish Configuration Manager 2007 site servers, in particular branch distribution points, from other destination computers in the collection. If you are advertising the task sequence to a collection that contains a Configuration Manager 2007 site server, the site server will run the task sequence like any other computer in the collection. It is recommended that you remove the site system role from the site server before deploying an operating system image to it, and then assign the site system role back to the site server. In addition, if you need to deploy an image to a distribution point or branch distribution point, be aware that the server needs to receive its image package from a different distribution point. It cannot receive the package from itself.

PXE Service Point

The PXE service point site role is used to initiate the operating system deployment process. The PXE service point must be configured to respond to PXE boot requests made by Configuration Manager 2007 clients on the network and then interact with Configuration Manager 2007 infrastructure to determine the appropriate deployment actions to take.

Fore more information about deploying operating systems using PXE, use the following link: Planning for PXE Initiated Operating System Deployments

See Also

Other Resources

Planning for Operating System Deployment


Determine Your Operating System Deployment Method

There are different methods you can use to deploy an operating system image using Configuration Manager 2007. The following tables describe some of the prerequisites and installation considerations depending on the method of operating system deployment you implement for your Configuration Manager 2007 site.

PXE Initiated Operating System Deployments

Dependencies Advantages Disadvantages Reference
  • PXE service point site role.
  • Windows Deployment Services installation.
  • Firewall port configuration.
  • This method works well when no user is present at the target computer or in datacenter environments.
  • Optional PXE advertisements require user intervention.
  • DHCP considerations when co-located with PXE service point site role.

Planning for PXE Initiated Operating System Deployments

Bootable Media Initiated Operating System Deployments

Dependencies Advantages Disadvantages Reference
  • Appropriate image architecture must be available on an accessible distribution point.
  • Works well for bare metal operating system deployment scenarios.
  • Media can be password protected for security purposes.
  • You must use bootable media in the same Configuration Manager 2007 site where the media was created.

How to Deploy an Operating System Image Using Media

Stand-alone Media Initiated Operating System Deployments

Dependencies Advantages Disadvantages Reference
  • Media set of USB flash drive, CD, or DVD which will contain the necessary installation files.
  • Use this method for computers that are connected to the Configuration Manager 2007 site using a low bandwidth connection.
  • No connection to the Configuration Manager 2007 site is required.
  • Media should be password protected for security purposes.
  • All necessary installation files must be contained on the media.
  • All required device drivers must be contained on the media.
  • No method to set an expiration date on the media.

How to Deploy an Operating System Image Using Media

Side by Side Operating System Deployments

Dependencies Advantages Disadvantages Reference
  • State migration point site role.
  • You must create a computer association between the source and destination computer.
  • Using the state migration point site role, the user state can be saved and restored to the new computer.
  • State migration point must have sufficient hard disk space available to store user state.

How to Perform a Side-by-Side Operating System Deployment

How to Create a Computer Association for a Side-by-Side Migration

How to Manage the User State

Configuration Manager 2007 Initiated Operating System Deployments

Dependencies Advantages Disadvantages Reference
  • Target computer must be a Configuration Manager 2007 client.
  • You can deploy an operating system image without creating additional media.
  • Requires connection to Configuration Manager 2007 site.
  • Target computers must be Configuration Manager 2007 clients.

How to Deploy Operating System Images to a Computer

How to Capture an Image from a Reference Computer Using Capture Media

See Also

Other Resources

Planning for Operating System Deployment


Planning for the Operating System Image

When you create the operating system image to deploy to target computers, the image contains the operating system and related files. Other applications and tools can be installed as a separate task sequence step, or manually, after the operating system is installed, or the supporting applications and tools can be pre-installed as part of the image. Here are some considerations for configuring the operating system image.

Packages that Support an Image Deployment

There are several Configuration Manager 2007 packages that you need to create to support the deployment of an operating system image:

  • Configuration Manager 2007 client installation package
  • USMT packages
  • Other Packages
Important
Configuration Manager 2007 software packages that use the Run another program first option to install a dependent program as part of the package are not supported by Operating System Deployment

You should create and test these packages before you create a task sequence to deploy the operating system image.

Configuration Manager 2007 Client Installation Package

To use a task sequence to install the Configuration Manager 2007 client on a destination computer, create a Configuration Manager 2007 package using the “Setup Windows and ConfigMgr” task sequence step. The package source location is %ProgramFiles%\Microsoft Configuration Manager\Client. Packages defined using the “Setup Windows and ConfigMgr” task do not require an associated program. All parameters needed for operating system deployment will be supplied by the task sequence when it is run. For more information about the available Configuration Manager 2007 client installation properties, use the following link: About Configuration Manager Client Installation Properties

Note
It is recommended that the program be configured to run when no user is logged on, and from a network share.

USMT Package

If you are migrating user state from one desktop to another, then you must use USMT 3.0 as your migration tool for Configuration Manager 2007. You can download USMT from the Microsoft Download Center at http://go.microsoft.com/fwlink/?LinkId=88300. Use Configuration Manager 2007 to create a package to install and run USMT on the target computer. A package program is not required. Be sure to include the configuration files (.INF) as part of the USMT package. Refer to the documentation for USMT for configuration information.

Other Packages

There are several other packages that you can create to support the operating system image deployment as well as the building of a reference computer. For more information about these packages, see the topic About Creating the Operating System Deployment Packages under the section See Also.

Server-Specific Deployments

Any hardware configuration that needs to be done as part of the image deployment to a server computer must be considered and included as part of the deployment task sequence.

For example, for a new server installation you might need to flash the computer BIOS, or configure the RAID controller.

It is recommended that you include packages that contain the appropriate tools to configure the server computer hardware as part of the deployment task sequence, or include it in the Windows PE image. For example, you could create a package that runs the vendor's flash bios tool and include that as a Run Command Line task sequence step that references the package in the deployment task sequence.

Advantages and Disadvantages of Installing Applications and Tools using a Task Sequence

Applications and tools can be preinstalled as part of the image being deployed, or they can be installed separately (either manually, or as a custom task in a deployment task sequence) after the operating system has been deployed. This table outlines the advantages and disadvantages for each.

Installation method | Advantage | Disadvantage
Install as part of operating system image | Potentially faster deployment to target computers No need to host the application for deployment separately | Need to create a new image when updates are required Need to create an image for each distinct set of installation or setup properties Potentially larger overall image sizes Not all applications can be part of an image. The applications must be able to be generalized by Sysprep to be part of the image.
Install separately from the image | Fewer images to maintain Fewer update images to create | Potentially longer deployment and installation times, using separate Configuration Manager 2007 packages.

See Also

Concepts

About Creating the Operating System Deployment Packages
Planning ConfigMgr Site Systems for Operating System Deployment
About Configuration Manager Client Installation Properties

Other Resources

Planning for Operating System Deployment


Planning for the Boot Image

Boot images are similar to operating system images except that they contain the appropriate version of Windows PE rather than a full operating system. They are stored with the .WIM file name extension. These WIM files are not captured from reference computers, but are supplied and customized by the Configuration Manager administrator, or obtained from an external source.

Configuration Manager 2007 includes 2 boot images - one to support x86 platforms and one to support x64 platforms. It is recommended that you use these images unless you have specific drivers that you need to include.

Boot images are distributed to distribution points like operating system images. When deployed as a package to a Configuration Manager 2007 client, the image is copied to and booted from the hard drive of the destination computer. When deployed using bootable media, the destination computer boots from the media and loads Windows PE.

It is important that the image contain the appropriate network adapter (NIC) drivers and mass storage drivers necessary to successfully run on the destination computer.

Important
Boot images should always be stored in a physically secure location.

Updating the boot image

You can update boot images by adding new network adapter or mass storage device drivers to it or by editing the properties associated with the boot image. Device drivers that you add to an existing boot image must be imported and enabled in the driver catalog before they cane be added to a boot image. When you update a boot image, the boot image does not change any of the associated packages that the boot image references. After you make changes to a boot image, you must update the distribution points that contain a version of the boot image so that the most current version of the boot image is available.

For more information about updating a boot image, use the following link: How to Update Boot Images

To update the boot image on distribution points

  1. In the Configuration Manager console, expand Operating System Deployment and expand Boot Images.

  2. Right-click the image you need to update and click Update Distribution Points.

See Also

Other Resources

Planning for Operating System Deployment


Planning for Deploying the Operating System Image

There are several things to consider when planning for the deployment of an operating system image:

  • Image Size
  • Configuration Manager 2007 Client Cache Size
  • State Migration Point and Distribution Point
  • USMT package
  • Advertisement Download Options
  • Stand-alone Installation.

Image Size

The size of an operating system image can be quite large, often 2GB or more. The size of the image will affect the performance and bandwidth utilization of the network. It is recommended that you test network performance to better gauge the affect that the image deployment might have and the time it will take to complete. Configuration Manager 2007 activities that affect network performance include distributing the image to a distribution point, distributing the image from one site to another, and downloading the image to the Configuration Manager 2007 client.

One way to mitigate excessive use of network bandwidth between Configuration Manager 2007 sites is to use Courier Sender to send image data from a parent Configuration Manager 2007 site to a child Configuration Manager 2007 site. Courier Sender uses physical media instead of sending data over the network. When you have large image packages that would require excessive time or bandwidth to send them over the network, this sender can be useful. You can use Courier Sender at the source Configuration Manager 2007 site to create a parcel (a collection of files transferred from one site to another using Courier Sender), write the parcel to a tape, CD, or other physical medium, and then ship the tape or CD to the destination site by mail or a courier service. At the destination site, you can then use Courier Sender to receive the parcel and import the package data into the site. Other information files associated with the image package are still sent using the existing network connection between the Configuration Manager 2007 sites.

It is also recommended that you plan for an appropriate amount of disk storage space on all targeted distribution points and branch distribution points. Keep in mind that a branch distribution point is often a client desktop computer, and that the size of the image can affect the computer's performance for the desktop user.

Consider the Client Cache Size

Configuration Manager 2007 clients automatically use Background Intelligent Transfer Service (BITS) if it is available. When you advertise a deployment task sequence, you can set an option on the advertisement so that Configuration Manager 2007 clients will download the full image to a local cache before starting to run it. If the distribution point is not local but has BITS enabled, BITS is used to download the image.

In general, when a package, or in this scenario an image, must be downloaded but the cache cannot accommodate the package, Configuration Manager 2007 checks the other packages in cache to determine whether deleting any or all of the oldest packages will free enough space to place the new package into the cache. If deleting any or all of the oldest packages does not free enough space, the new package is not placed into the cache.

This might be the case if there is a package that is currently locked. If deleting any or all of the oldest packages does free enough space in the cache, Configuration Manager 2007 does so, and places the new package into the cache.

The default cache size on Configuration Manager 2007 clients might not be large enough for most operating system image deployments. If you are planning to download the full image to a local cache before starting to run it, you must adjust the Configuration Manager 2007 client cache size on the destination computers to accommodate the size of the image you are deploying.

Users with administrative credentials on the computers they are using can manage the download cache. Users can change the size or location of the cache, or delete all current contents. These options are in the Temporary Program Download Folder section of the Advanced tab of the Configuration Manager item in Control Panel. The download cache can also be managed with scripts.

Configure State Migration Point and Distribution Point

If you are planning to migrate existing user and computer state settings as part of your image deployment, then you need to configure a state migration point to store the settings. You also need to consider the appropriate number and placement of distribution points that will host the image for Configuration Manager 2007 clients. For more information about planning for the state migration point and distribution points, see Planning ConfigMgr Site Systems for Operating System Deployment.

Advertisement Download Options

There are basically two ways to run the image deployment on an Configuration Manager 2007 client computer. You can run the image by downloading it first to the Configuration Manager 2007 client cache from a distribution point and then installing it, or you can install the image from the distribution point. By default, when you create the advertisement for the deployment task sequence, the image is downloaded first to the Configuration Manager 2007 client cache and then installed. For more information about setting these options, refer to the Configuration Manager 2007 Operating System Deployment help topic Task Sequence - New Advertisement Wizard - Advanced Client.

If you choose to download the image to the Configuration Manager 2007 client cache before running it, and the deployment task sequence contains a step to re-partition the hard drive, the re-partition step will fail because re-partitioning the hard drive erases the contents of the Configuration Manager 2007 client cache. If the deployment task sequence must re-partition the hard drive, you must run the image installation from the distribution point using the Run program from distribution point option when the task sequence is advertised.

Stand-alone Installation

You can create stand-alone media to deploy the operating system manually to a destination computer. Configuration Manager 2007 Operating System Deployment supports the use of CD or DVD media. Again, the size of the image might affect your choice of stand-alone media. To create stand-alone media, run the Create Task Sequence Media Wizard from the Operating System Deployment node in the Configuration Manager 2007 Administrator's Console. For more information about running the Create Task Sequence Media Wizard, refer to the Configuration Manager 2007 Operating System Deployment help topic Task Sequence Media Wizard.

To deploy an operating system to a new computer that is not currently managed by Configuration Manager 2007, the new computer must be added to the Configuration Manager 2007 database prior to initiating the operating system deployment process. This is true whether or not the computer has an existing operating system. For more information about importing new computer information into Configuration Manager 2007, see How to Add a New Computer to the Configuration Manager Database.

See Also

Other Resources

Planning for Operating System Deployment


Planning for PXE Initiated Operating System Deployments

When you use PXE to initiate an operating system image deployment to a target computer there are several configuration decisions that must be considered depending on your network environment.

The sections below outline the various configuration and installation options that should be considered if you plan to use PXE to initiate operating system image deployments.

PXE Service Point

The PXE service point is a Microsoft System Center Configuration Manager 2007 site role that responds to PXE requests from computers that have been imported into Configuration Manager 2007. The PXE service point must be configured to respond to PXE boot requests by Configuration Manager 2007 clients so that Configuration Manager 2007 clients can interact with the Configuration Manager 2007 infrastructure to determine the appropriate installation actions to take.

PXE Service Point Configuration More Information

Windows Deployment Services (WDS)

The PXE service point site role must be installed on a server with WDS installed. For more information about WDS use the following link: http://go.microsoft.com/fwlink/?LinkId=81031

  • Windows Server® 2008 - The WDS services are bundled with the software.
  • Windows Server 2003 - For Windows Server 2003, Service Pack 1 you must first install the Remote Installation Services (RIS) and then install the Windows Vista SP1 or Windows Server 2008 version of Windows Automated Installation Kit (Windows AIK). RIS must be installed however no additional RIS configuration is required.
  • For Windows 2003 servers running Service Pack 2 and higher, the Windows AIK installation is not necessary. The WDS role can be added by using Add or Remove Programs. Use the following link for more information about the Windows AIK: http://go.microsoft.com/fwlink/?LinkId=81030

WDS Configuration Considerations

The WDS installation requires that the administrator is a member of the Local Administrators group on the server where Windows Deployment Services is installed. To boot to the WDS client, the user must be a member of the Domain users group. In addition, your computing environment must meet the following technical requirements:

  • Active Directory. A WDS server must be either a member of an Active Directory domain or a domain controller for an Active Directory domain. All Windows domain and forest configurations support WDS.

Network PXE Requests

By default, the Configuration Manager 2007 PXE service point is configured to respond immediately to network PXE requests. You can configure a delay when setting up the PXE service point if there are multiple PXE servers on your network so that the Configuration Manager 2007 PXE service point will wait the specified amount of time before responding to network PXE requests.

Available NTFS partition

The PXE service point running WDS requires an available NTFS hard disk partition to store boot images. The stored boot images will be used with the PXE initiated operating system deployments.

Windows Deployment Services (WDS) and DHCP

You should consider the following configuration options if you plan to co-host the PXE service point on a server running DHCP.

PXE Service Point Configuration Item More Information

DHCP considerations

You must have a functioning DHCP server with an active scope. WDS will utilize PXE which requires a DHCP server.

Whether you plan to co-host WDS and DHCP on the same server or use two different servers you must configure WDS to listen on a specific port. DHCP and WDS both require port number 67. If you have co-hosted WDS and DHCP you can move DHCP or the PXE site role to a separate server or use the procedure below to configure the WDS server to listen on a different port.

Modify the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDSServer\Providers\WDSPXE

Set the registry value to:

UseDHCPPorts = 0

For the new configuration to take effect run the following command on the co-located DHCP and WDS server:

WDSUTIL /Set-Server /UseDHCPPorts:No /DHCPOption60:Yes

DNS Considerations

A DNS server is required to run WDS.

Firewall and server port settings

The following UDP ports must be open on the WDS server and on the firewall:

Port 67 (DHCP)

Port 69 (TFTP)

Port 4011 (PXE)

Installing WDS

Task More Information

WDS components

The WDS installation installs the following components:

  • The Trivial File Transfer Protocol (TFTP) service
  • The Windows Deployment Services service
  • The Windows Deployment Services Management snap-in and tools

WDS Installation Procedures

If you plan to install WDS on a server running Windows Server 2003, Service Pack 1:

  1. Install RIS.
  2. Download and install the Windows AIK.
  3. Perform one of the following tasks:
    1. Locate and double-click the Windows Deployment Services installation file (windows-deployment-services-update-amd64.exe or windows-deployment-services-update-x86.exe), and complete the wizard.
    2. From a command prompt type the following for amd64 installations: Windows-Deployment-Services-update-amd64.exe /quiet /forcerestart, for x86 installations: Windows-Deployment-Services-update-x86.exe /quiet /forcerestart
    3. When the installation is complete restart the server to ensure the most current files are available.
  4. If you plan to install WDS on a server running Windows Server 2003, Service Pack 2, WDS is already installed:
Note
WDS is included with this version of Windows Server.

  • Install RIS and then install WDS. Restart the server so the correct file versions are available.

PXE Advertisements

The following section describes general PXE advertisement configuration planning considerations.

Advertisement Type More Information

Mandatory advertisement

Computers that receive a mandatory advertisement that is enabled for PXE will boot using PXE without any user intervention. The user will not be given an option to bypass the PXE boot.

Note
If a user cancels the PXE boot process before the PXE service point responds, the computer will not receive the advertisement.

Optional advertisement

For computers that receive an optional advertisement that is enabled for PXE, a user must be present at the computer to press F12 to continue the PXE boot process or the computer will boot into the current operating system or using the next available boot device.

Clear last PXE Advertisement

If for any reason you want to re-advertise a mandatory advertisement enabled for a PXE device or assigned to a collection you can select this option by right clicking an existing Configuration Manager 2007 collection or a device with an existing PXE advertisement and selecting Clear last PXE Advertisement.

Important
Selecting this option will reset the status for the last mandatory PXE advertisements for the collection or device. The most recent mandatory advertisements will be rerun on any computers or devices the advertisement has been assigned to.

Note
The Windows Deployment Service (WDS) on Windows Server 2003 SP1 and below requires the Windows Automated Installation Kit (Windows AIK) be installed. Windows AIK requires 1GB of disk space and 1.4GB of disk space during installation. For more information about Windows AIK, see http://go.microsoft.com/fwlink/?LinkId=81030.

See Also

Other Resources

How to Initiate Operating System Image Deployments Using PXE
Planning for Operating System Deployment


Planning for Operating System Deployment in a NAP-Enabled Environment

Topic last updated—November 2007

When deploying an operating system and Configuration Manager 2007 client into an environment that is using Network Access Protection (NAP), you must take additional configuration steps. Failing to configure an operating system deployment correctly for Network Access Protection can result in newly deployed computers having restricted network access with failed remediation.

Clients running Windows Vista and Windows Server 2008 natively support Network Access Protection, whereas computers running Windows XP do not natively support Network Access Protection and require the installation of an additional Network Access Protection client. For more information about the Network Access Protection Client for Windows XP, see the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

Network Access Protection supports a number of enforcement mechanisms, such as IPsec, 802.1X, VPN, and DHCP. Each enforcement mechanism requires its respective Network Access Protection enforcement client to be enabled and the Windows Network Access Protection Service started and configured for automatic startup. For more information about deploying and configuring Network Access Protection in Configuration Manager, see Network Access Protection in Configuration Manager.

Use the steps in the following sections to ensure that the enforcement mechanism and the Windows Network Access Protection Service is enabled and will interact correctly with the Configuration Manager client when deploying an operating system into a NAP-enabled environment.

The Reference Computer Is Configured for Network Access Protection

The following scenario would be appropriate if all your operating system deployments are in a NAP-enabled environment, using the same NAP-enforcement mechanism:

  1. Configure the reference computer with the operating system, service packs, security updates, applications, settings, tools and desktop customization.
  2. If the operating system is Windows XP, install the Network Access Protection Client for Windows XP.
  3. Enable the appropriate Network Access Protection enforcement clients.
  4. Configure the Windows Network Access Protection service to start automatically, and start the service.
  5. Capture the image.
  6. Create a task sequence that references this image.
  7. Advertise the task sequence to computers.

With this configuration, the Network Access Protection enforcement client and Windows Network Access Protection Service starts automatically in the newly deployed computer because they are part of the image. Also, they will already be running when the Configuration Manager client installs, ensuring that the Configuration Manager client can bind to the Windows Network Access Protection Service.

The Reference Computer Is Not Configured for Network Access Protection

The following scenario would be appropriate if only some of your computers are installed into a NAP-enabled environment or if you needed to add the configuration for Network Access Protection to an existing captured image:

  1. Configure the reference computer with the operating system, service packs, security updates, applications, settings, tools and desktop customization.
  2. Capture the image.
  3. Create a task sequence that references this image.
  4. If the operating system is Windows XP, add a custom task sequence step that will run in the newly deployed operating system to install the Network Access Protection Client for Windows XP.
  5. Add a custom task sequence step that will run in the newly deployed operating system to enable the appropriate Network Access Protection enforcement clients.
    Note
    Use the command-line utility, netsh nap client set enforcement <enforcement ID> enable. For more information, see the Windows Network Access Protection documentation. For ongoing configuration, ensure that Group Policy configures the enforcement clients.

  6. Add a custom task sequence step that will run in the newly deployed operating system to configure the Windows Network Access Protection Service to start automatically, and start the service.
    Note
    For ongoing configuration, ensure that Group Policy configures this service.

  7. Add a custom task sequence step to restart the computer.
    Note
    This restart is necessary to ensure that the enforcement clients and the Windows Network Access Protection Service are already running when the Configuration Manager client starts, ensuring that the Configuration Manager client can correctly bind to the Windows Network Access Protection Service.

  8. Advertise the task sequence to computers.

See Also

Concepts

Planning for Deploying the Operating System Image

Other Resources

Network Access Protection in Configuration Manager
Planning for Operating System Deployment


Planning for Operating System Deployment in a Native Mode Site

Topic last updated—November 2007

If the Configuration Manager 2007 site is operating in native mode or will be migrated from mixed mode to native mode, you must plan for the correct public key infrastructure (PKI) certificates. For more information about native mode, see Configuration Manager Site Modes.

To identify which PKI certificates are required when you are using operating system deployment in a native mode site, see the section "Operating System Deployment Feature" in Certificate Requirements for Native Mode.

For information about deploying the PKI certificates required for native mode, see Administrator Checklist: Deploying the PKI Requirements for Native Mode.

See Also

Concepts

Administrator Checklist: Migrating a Site to Native Mode
Prerequisites for Native Mode

Other Resources

How to Manage Native Mode Certificates and Operating System Deployment


Configuring Operating System Deployment

To configure a site for operating system deployment, you may need to perform certain tasks depending on the method of deployment you choose.

Click any link in the following section for information about configuring your Configuration Manager 2007 site for operating system deployment.

In This Section

How to Add Images

Contains the steps for adding new operating system images and operating system install packages.

How to Manage the User State

Contains the steps to setup a state migration point and capture and restore the user state.

How to Manage the Driver Catalog

Contains the steps to import device drivers and create driver packages for use with operating system deployment and device driver management.

How to Manage Task Sequences

Contains the steps to create, use, advertise, and copy task sequences.

How to Manage Task Sequence Variables

Contains the steps to assign task sequence variables to a computer or a collection.

How to Manage Operating System Boot Images

Contains the steps to add and update operating system boot images.

How to Manage Native Mode Certificates and Operating System Deployment

Contains information on setting up and importing client certificates.

See Also

Other Resources

Operating System Deployment in Configuration Manager


How to Add Images

Use the following tasks to help you add operating system images and operating system install packages. Operating system install packages and operating system images can be used to deploy images to target computers.

Use the following procedures to add an operating system install package or operating system image.

In This Section

How to Add Operating System Images

How to Add Operating System Install Packages

See Also

Other Resources

Configuring Operating System Deployment


How to Add Operating System Images

You can add an operating system image to use with your operating system deployments. The operating system WIM files you import can be used as part of an operating system deployment task sequence.

Use the following procedure to add an operating system image.

Procedure

To add an operating system image

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Operating System Images.

  2. To add an operating system image, right-click the Operating System Images node, and then click Add Operating System Image to open the Add Operating System Image Wizard.

  3. On the Data Source page, type the network path in (UNC) format to the operating system image WIM file. To browse for a WIM file, click Browse button, and then locate the operating system image you want to add.

  4. On the General page, specify the Name, Version, and an optional Comment. This information is useful when you have multiple operating system images.

  5. Click Next to view the summary of the operating system that is being created.

  6. Click Next to complete the wizard. The new operating system image is created and displays in the Results pane when you select the Operating System Images node.

See Also

Other Resources

How to Add Images


How to Add Operating System Install Packages

You can add an operating system install packages for use with your setup initiated operating system deployments. The operating system install packages can be copied to distribution points so that they are available for Configuration Manager 2007 computers to install them.

Use the following procedure to add an operating system install package:

Procedure

To add an operating system install package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Operating System Install Packages.

  2. To launch the Add Operating System Install Package Wizard, right -click the Operating System Install Packages node and select Add Operating Install Package from the context menu.

  3. On the Data Source page, specify the network path to the operating system package in UNC format. Select the operating system you want to add.

  4. On the General page, provide a Name, Version, and Comment for the operating install package. This identifying information is useful when you have multiple operating system install packages available.

  5. Click Next to view the Summary of the operating system installation package that is being created.

  6. Click Next to complete the wizard. The new operating system install package is created and is visible in the Results pane when you select the Operating System Install Packages node.

See Also

Other Resources

How to Add Images


How to Manage the User State

The state migration point (SMP) is a Configuration Manager 2007 site role that provides a location to store user state information before an operating system deployment or migration.

Use the following tasks to manage the user state:

In This Section

How to Configure the State Migration Point

How to Capture and Restore the User State

How to Save the User State Locally for In-place Operating System Deployments

Administrator Workflow: Capture User State

Administrator Workflow: Restore User State Workflow

See Also

Other Resources

Configuring Operating System Deployment


How to Configure the State Migration Point

The state migration point is a Configuration Manager 2007 site role that provides a location to store user state information before an operating system deployment. You can store the user state on the state migration point while the operating system deployment proceeds and then restore the user state to the new computer from the state migration point. Each state migration point site server can only be a member of one Configuration Manager 2007 site.

Note
It can take up to one hour for the state migration point to be available for user state storage. To expedite the availability of the state migration point after you create the new site role you can adjust any state migration point property setting to trigger a site control file update.

Use this procedure to enable and configure the state migration point.

How to Configure the State Migration Point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Select New from the Action menu or Actions pane, or right-click Site System Roles and select New Roles from the context menu.

  3. Select Server to run the New Site System Server wizard.

  4. Alternatively, to add the State Migration Point role to an existing site system:

    1. Select the desired site server in the Site System Roles pane.
    2. Select Action from the menu, or right-click the site system entry, and then select New role from the menu to run the New Site Roles Wizard.
    3. Continue with Step 5.

  5. On the General page of the wizard, enter the Name of the server that will be the state migration point. Optionally provide the fully qualified host name for the server. Specify which account credentials to use to install the site system.

  6. On the System Role Selection page, click the check box next to State migration point.

  7. On the State Migration Point page, specify the drives on the server that should be used to store migration data. Click the New button to:

    1. Specify the Storage drive letter to use for storing migration data on the site system.
    2. Enter the maximum number of clients whose data will be stored on the site system in the Maximum clients field.
    3. Enter the Minimum Free Space that is required on the selected drive, and the unit of measurement (i.e. MB).
    4. Or, select an existing drive from the Drives list and click the Edit button to modify that entry, or the Delete button to remove it.
    Important
    All drives that are available on the server are listed, including non-writable drives such as the CD. Be sure to select a writable drive from the list.

  8. On the State Migration Point page, specify how the state migration should manage migration data that is marked for deletion. Select the option Immediately to remove that data as soon as possible after it is marked for deletion. Select the option Delete after and enter the number of days to wait before deleting that data. To configure the state migration point to reject new request select the Enable restore-only mode.

    Important
    When the state migration point site role is deleted or retired all associated user storage paths are also deleted.

See Also

Concepts

Planning ConfigMgr Site Systems for Operating System Deployment


How to Capture and Restore the User State

You can capture and restore the user state information by using a custom task sequence. This method is helpful with side-by-side migration and hardware upgrade deployment scenarios so that you can retain the user settings associated with the reference computer. The User State Migration Tool (USMT) version 3.0 is required to complete the necessary capture and restore steps.

Important
You must create a computer association before you can capture the user state from a reference computer. For more information about creating a computer association, use the following link: How to Create a Computer Association for a Side-by-Side Migration

Use the following procedures to capture and restore the user state.

To capture the user state

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To start the New Task Sequence Wizard, right-click the Task Sequence node, and then click New - Task Sequence.

  3. To create a new custom task sequence, on the Create a New Task Sequence page, select Create a new custom task sequence.

  4. On the Task Sequence Information page, you can assign a name, version, and an optional description to the custom task sequence.

    Note
    You can associate this custom task sequence with a boot image by clicking Browse to open the Select a Boot Image dialog box, and then selecting the desired image.

  5. To request access and reserve disk space on the state migration point add the Request State Store step and select Capture state from this computer.

  6. To add the capture step to the task sequence, edit the task sequence by right-clicking the new custom task sequence in the results pane and selecting Edit from the context menu.

  7. To add the capture step, click Add, and click User State, and then click Capture User State. You can do any of the following:

    1. To specify the package that contains the USMT you will use with this task sequence step, click Browse to open the Select a Package dialog box, and then specify the USMT package. When you select a package, the selected package's ID and version information displays.
    2. To capture all the user profiles with the standard options, select Capture all user profiles with standard options.
    3. To customize the user profile capture, select Customize user profile capture, click Files to open the Configuration Files dialog box, specify the name of the configuration file you want to use, and then click Add.
    4. To delete an existing configuration file associated with this task sequence step, select the file in the Files pane, and then click Remove.

  8. To create a location to store the captured user state, add the Request State Store step by clicking Add, and then clicking User State/Request State Store. This will create a UNC connection to state migration point.

To restore the user state

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To open the New Task Sequence Wizard, right-click the Task Sequence node, and then click New - Task Sequence.

  3. To create a new custom task sequence, on the Create a New Task Sequence page, select Create a new custom task sequence.

  4. On the Task Sequence Information page, specify a name, version, and an optional description to be assigned to the custom task sequence.

    Note
    You can associate this custom task sequence with a boot image by clicking Browse to open the Select a Boot Image dialog box and selecting the desired image.

  5. To add the restore step to the task sequence, edit the task sequence by right-clicking the task in the results pane, and then clicking Edit.

  6. To establish a connection to the state migration point add the Request State Store task sequence step and select Restore state from another computer.

  7. In the Task Sequence Editor, click Add - User State, and then click Restore User State.

    Important
    If you are using this task sequence step for a task unrelated to an operating system deployment scenario, you should add the Restart Computer task sequence step immediately following this task sequence step.

    1. To specify the package that contains the USMT you will use with this task sequence step, click Browse to open the Select a Package dialog box, and then specify the USMT package. When you select a package, the selected package's ID and version information displays.
    2. To restore all of the captured user profiles with the standard options, select Restore all captured user profiles with standard options.
    3. To customize the user profile restore, select Customize user profile restore, click Files to open the Configuration Files dialog box, specify the name of the configuration file you want to use, and then click Add.
    4. To delete an existing configuration file associated with this task sequence step, select the file in the Files pane, and then click Remove.

  8. To restore the local computer user profiles, select Restore local computer profiles. Specify a new password that should be assigned to the local accounts. Existing passwords for local accounts cannot be migrated, so the new password specified will be assigned to the local computer accounts.

  9. To allow the restore task sequence step to proceed if some of the selected client files cannot be restored, select the Continue if some files cannot be restored check box.

  10. To enable logging for this task sequence step, select the Enable verbose logging check box.

  11. To release the user state, add the Release State Store step by clicking Add, and then clicking User State/Release State Store.

    Important
    The task sequence action that runs prior to the Release State Store task sequence step must be successful before you can run the Release State Store task sequence step.

See Also

Tasks

How to Configure the State Migration Point
How to Create a Computer Association for a Side-by-Side Migration


How to Save the User State Locally for In-place Operating System Deployments

When you perform in-place operating system deployments you can create a task sequence to deploy the operating system image to an existing Configuration Manager 2007 client computer and save the user state on the target computer without using a state migration point. After the successful deployment of the new operating system the user state files will be restored to the new operating system and will be deleted form the path specified. The user state is saved using the read-only _OSDStateStorePath task sequence variable. For more information about task sequence variables, use the following link: About Task Sequence Variables

Use the following procedure to create an operating deployment task sequence that will save the user state locally to the target computer:

Procedures

To create an operating system deployment task sequence that will save the user state locally

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To start the New Task Sequence Wizard, right-click the Task Sequences node, and then click New/Task Sequence.

  3. On the Create a New Task Sequence page, select Install an existing image package and click Next.

  4. On the Task Sequence Information page, specify descriptive name for the task sequence and add an optional comment. To specify the boot image that will be associated with the task sequence click the Browse button to launch the Select a Boot Image dialog box and select the boot image. Click Next.

    Important
    The boot image you specify must match the chip architecture installed on the target computer or the task sequence will fail.

  5. On the Install the Windows Operating System page, specify the operating system image package that will be used to install the operating system image by clicking the Browse button to launch the Select an Operating System Image dialog box, if there are multiple images in the image package, use the drop-down to specify the Image that should be associated with the image package. Clear the Partition and format the target computer before installing the operating system check-box option.

    Important
    You must not select the option to format and partition the target computer hard disk. If this selection has not been unchecked the option to save the user state will not be available on the State Migration page of this wizard.

  6. Additionally, on the Install the Windows Operating System page, specify the Windows Product key and Server license mode. If you specify Per server as the license mode, configure the Maximum server connections that will be permitted. You must also specify if the local administrator account should be disabled, or if you want to use the same administrator account for all target computers by selecting the appropriate option. Click Next.

  7. On the Configure the Network page, specify if the target computer will join a Workgroup or a Windows Domain.

    1. If you are adding the target computer to a Workgroup, you must type the name of the workgroup in the space provided.
    2. If you are adding the target computer to a Windows domain, click the Set button to launch the Windows User Account dialog box and specify the user account and password that should be used to add the computer to the Windows domain. You must also specify the name of the Windows Domain and Windows Domain OU that the target computer will be added to by clicking the Browse button. Click Next.

  8. On the Install ConfigMgr page, click the Browse button to launch the Select a Package dialog box and select the Configuration Manager 2007 package that will be used to install the Configuration Manager 2007 client. Specify the Configuration Manager 2007 client installation properties that will be used in the Installation properties window. Click Next.

  9. On the Configure State Migration page, select the Save user settings locally option and click the Browse button to select the USMT package that will be used to capture the user state. Additionally, specify the configuration user settings that will be captured by selecting the Capture network settings and capture Microsoft Windows settings check boxes. Click Next.

  10. On the Include Updates in Image page specify how the target computer will install assigned software updates by selecting the appropriate option.

  11. On the Install Software Packages page click the New button to launch the Program Select Dialog box. Click the Browse button to launch the Select a Package dialog box. Select the Configuration Manager 2007 packages you want to include and click OK. Use the drop down to select the associated programs that should be used.

  12. To complete the creation of the new task sequence, on the Summary page, click Next.

  13. To confirm that the new task sequence was created using the properties specified, review the confirmation on the Confirmation page.

  14. Click Close to close the New Task sequence Wizard.

  15. After you have created the task sequence, you must edit the task sequence. Select the Set Local State Location task sequence step. In the Value window specify the directory that the state store will be saved by typing in the network location between the percent symbols. For example: %C:\MyLocalStateStore%. For more information about editing an existing task sequence, use the following link: How to Edit an Existing Task Sequence

See Also

Other Resources

How to Manage the User State


Administrator Workflow: Capture User State

The following flowchart displays the actions associated with a Configuration Manager 2007 user state capture in the order in which they generally take place.

Flowchart: Dispalys actions of user state capture

See Also

Concepts

Administrator Workflow: Restore User State Workflow

Other Resources

How to Manage the User State


Administrator Workflow: Restore User State Workflow

The following flowchart displays the actions associated with restoring the user state to a Configuration Manager 2007 computer in the order in which they generally take place.

Flowchart of Restore User State

See Also

Concepts

Administrator Workflow: Capture User State

Other Resources

How to Manage the User State


How to Manage the Driver Catalog

The driver catalog helps manage the cost and complexity of deploying an operating system in an environment that contains different types of computers and devices. By storing device drivers in the driver catalog and not with each individual operating system image, the number of operating system images needed is greatly reduced.

Use the following tasks to help you manage the driver catalog:

In This Section

How to Import Windows Device Drivers into the Driver Catalog

How to Create a Driver Package

How to Add Device Drivers to an Existing Driver Package

How to Install Drivers on a Configuration Manager 2007 Client Using a Task Sequence

See Also

Concepts

About the Driver Catalog

Other Resources

Configuring Operating System Deployment


How to Import Windows Device Drivers into the Driver Catalog

You can import device drivers for use in your Configuration Manager 2007 site. Imported device drivers can be added to boot image packages or driver packages and can be installed as part of an Operating System Deployment task sequence using the Auto Apply Driver and Apply Driver Package task sequence steps. Configuration Manager 2007 reads the provider, class, version, signature, supported hardware, and supported platform information associated with the device as part of the import process. By default, the driver is named after the first hardware device it supports, however the device driver can be renamed later. The supported platforms list is determined based on the device driver’s definition. However, the accuracy of this can vary so you should manually verify if the device driver is supported after it has been imported.

The SMS Provider must have read permission to the network share where the device driver will be located or the import will fail.

Use the following procedure to import Windows device drivers into the driver catalog.

Procedure

To import Windows device drivers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Drivers.

  2. To start the Import New Driver Wizard, do any of the following:

    • Click Action on the file menu in MMC snap-ins, and then click Import.
    • In the Actions pane, click Import.
    • Right-click the Drivers node, and then click Import.

  3. On the Locate Driver page, specify whether you want to import a specific device driver or all device drivers contained in a specific directory.

    • To import a specific driver, select Import a specific driver and specify the source file directory in UNC format and the Windows device driver.INF or mass storage txtsetup.oem file to be imported.
    • To import all of the device drivers in a specific directory, select Import all drivers in the following network path (UNC) to its .inf or txtsetup.oem file and specify the network path to the device driver directory.
    Note
    To import a subset of device drivers from a large directory, you can create a new subdirectory and copy the desired drivers into the newly created directory. Use the method above to import the contents of that subdirectory. Each device driver should be imported into its own subdirectory.

  4. On the Driver Details page, specify a descriptive name and optional description for the driver.INF file or files that will be imported. To allow computers to use the device drivers, the Enable these drivers and allow computers to install them check box must be checked. This check box is selected by default.

    Important
    If a device driver is causing a problem or you want to suspend deployment of a device driver, you can disable the device driver by clearing the Enable these drivers and allow computers to install them check box. For computers to use and install a driver, this option must be enabled.

  5. To assign the device drivers to a category for filtering purposes, such as "Beta" or "Production," click the Categories button. The category assignment is also used to configure the device drivers that will be considered by the Auto Apply Driver task sequence step.

  6. On the Platforms Applicability page, confirm the platforms where these drivers will be installed.

    • To make the driver available to all platforms, select This driver can be run on any platform.
    • To specify a particular client platform for the device driver to be installed, select This driver can run only on the specified platforms, and then select the applicable platforms.

  7. On the Add Driver to Packages page, assign the device driver to an existing package, or create a new package by clicking the New Package button to open the New Driver Package dialog box.

  8. Specify the Name, and Description that should be associated with the new driver package and provide the source directory in UNC format, and then select Update distribution points when finished to update the distribution points immediately.

    Important
    Drivers must be part of a package and deployed to distribution points before computers can install them. If you do not update distribution points immediately, you must update the distribution points later using the Update Distribution Point wizard.

  9. On the Add Driver to Boot Images page, specify the boot image or images you would like to add the driver to.

    Note
    Only mass storage and network device drivers should be added to the boot images for operating system deployment scenarios.

  10. Select Update distribution points when finished to update the distribution points immediately with the updated boot images.

  11. On the Summary page, review the action details, and then click Next to complete the wizard.

See Also

Concepts

About the Driver Catalog

Other Resources

How to Manage the Driver Catalog


How to Create a Driver Package

A driver package contains the content associated with one or more device drivers. Device drivers must to be added to a driver package and copied to a distribution point before Configuration Manager 2007 clients can install them.

Note
Driver packages that are made available to Microsoft Windows 2000-based and Windows XP-based Configuration Manager 2007 clients should not contain more than 150 device drivers in a single driver package.

Use the following procedure to create a new driver package.

To create a new driver package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Driver Packages.

  2. To start the New Driver Package Wizard, right-click the Driver Packages node, and then click New - Driver Package.

  3. On the Name line, specify a descriptive name for the new driver package. The name you specify should help you determine what device drivers are contained or what the purpose is for the driver package. In the Description window, enter an optional description for the driver package. The description should provide information about the contents or the purpose of the driver package.

  4. Specify the driver package source by entering the path to the driver package source directory in Universal Naming Convention (UNC) format. Alternatively, you can specify the source by clicking Browse to open the Browse For Folder dialog box, and browsing to the correct path. If you need to create a new empty folder for the source directory which will contain the device driver content, click Make New Folder. Each driver package must have a unique source path.

    Important
    The Configuration Manager 2007 system account must have read/write permissions to the specified driver package source location.

  5. To close the New Driver Package Wizard, click OK. The new driver package will be visible in the results pane.

    Note
    You can view the associated general, data source, distribution point, data access, and security information for the driver package by right-clicking the driver package, and then clicking Properties.

See Also

Concepts

About the Driver Catalog

Other Resources

How to Manage the Driver Catalog


How to Add Device Drivers to an Existing Driver Package

You can add Windows device drivers that have been imported into the driver catalog to an existing driver package.

Use the following procedure to add Windows device drivers to an existing driver package.

Procedure

To add a device driver to an existing driver package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Drivers.

  2. In the Drivers pane, right-click the device driver you want to add to a driver package, and then click Add or Remove to Packages to open the Add or Remove Drivers to Packages dialog box.

  3. Select the driver package or packages you want to add the device driver to by selecting the check box associated with the driver package. You can create a new package by clicking New Package to open the New Driver Package Wizard.

  4. To update the distribution points associated with the selected driver packages with the new driver information, select the Update distribution points when finished check box.

  5. To close the Add or Remove Drivers to Packages dialog box, click OK.

See Also

Other Resources

How to Manage the Driver Catalog


How to Disable and Enable a Device Driver in the Driver Catalog

You can enable and disable Windows device drivers that have been imported into the driver catalog. You can temporarily disable a device driver so that Configuration Manager 2007 client computers and the task sequence environment will not be able to install a specific device driver as part of an operating system deployment.

Use the following procedures to disable and enable a Windows device driver.

Procedures

To disable a device driver

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Drivers.

  2. To disable the device driver, locate the device driver in the Drivers pane, right-click the device driver, and then click Disable.

  3. In the Update Driver Status dialog box, confirm the device driver that will be disabled, and then click Yes to disable the device driver and close the dialog box.

 To enable a device driver

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Drivers.

  2. To enable the device driver, locate the device driver in the Drivers pane, right-click the device driver, and then click Enable.

  3. In the Update Driver Status dialog box, confirm the device driver that will be enabled, and then click Yes to enable the device driver and close the dialog box.

See Also

Other Resources

How to Manage the Driver Catalog


How to Delete a Device Driver from the Driver Catalog

You can delete a device driver that has been imported into the driver catalog.

Note
Device drivers must be deleted one device driver at a time. There is no method to multi-select a group of device drivers for deletion.

Use the following procedure to delete a Windows device driver:

Procedures

To disable a device driver

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Drivers.

  2. To delete the device driver, locate the device driver in the Drivers pane and right-click the device driver and select Delete. Alternatively, select Delete in the Drivers Actions pane.

  3. In the Delete Driver dialog box confirm the device driver that will be deleted. Click Show Reference to display the driver packages that are associated with the selected device driver. To view the boot images associated with the selected device driver click the Boot Images tab.

  4. Click OK to complete the device driver deletion and close the Delete Driver dialog box.

See Also

Other Resources

How to Manage the Driver Catalog


How to Install Drivers on a Configuration Manager 2007 Client Using a Task Sequence

You can add new device drivers to an existing operating system image using the task sequence editor. To allow Configuration Manager 2007 to search in the driver catalog for the new device drivers you should add the Auto Apply Drivers task sequence step to an existing task sequence. The auto apply driver task sequence step will search in the Configuration Manager 2007 existing driver categories for the most appropriate device driver to install with the operating system deployment. Configuration Manager 2007 will look in all available categories for the device driver. To limit the device driver search to specific categories, select Limit driver matching to only consider drivers in selected categories.

To add an existing driver package to an operating system you should add the Apply Driver Package task sequence step. This task sequence step will add all device drivers in a specified directory to the existing task sequence for use with the operating system deployment.

Use the procedure below to add device drivers to an existing operating system image using one of the Driver task sequence steps mentioned earlier

How to Add Drivers to an Operating System Image

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To open the task sequence in the task sequence editor, locate the task sequence in the list that contains the operating system image you want to add the device driver to. Right-click the task sequence and select Edit from the context menu. Alternatively, you can select the task sequence and click Edit in the Actions pane or select the Action menu and choose Edit.

  3. To add the desired device driver task sequence step, select the task sequence group that you want to add the driver task sequence step to, or click the Add menu and select Drivers.

  4. To allow Configuration Manager 2007 to search for the appropriate device drivers, add the Auto Apply Drivers task sequence step. Configuration Manager 2007 will search available driver categories for the appropriate device drivers. To allow Configuration Manager 2007 to add a driver package, add the Apply Driver Package task sequence step. This option will allow Configuration Manager 2007 to install only device drivers from a specific category.

  5. Specify the appropriate information on the Properties and Options tabs.

  6. Click OK to save the task sequence.

See Also

Concepts

About Task Sequences

Other Resources

How to Manage the Driver Catalog


How to Manage Task Sequences

Task sequences provide the mechanism for performing multiple steps or tasks on a computer without requiring user intervention.

Use the following tasks to help you manage the Configuration Manager 2007 task sequence environment:

In This Section

How to Perform a Network Capture of a Server Operating System Image That Is Configured with Sysprep and PXE

How to Create a Task Sequence to Install an Existing Operating System Image Package

How to Create a Task Sequence to Build and Capture an Operating System Image

How to Create a Custom Task Sequence

How to Edit an Existing Task Sequence

How to Advertise Task Sequences

How to Copy a Task Sequence from one Configuration Manager 2007 Site to Another

How to Install Software Packages as Part of a Task Sequence

See Also

Other Resources

Configuring Operating System Deployment


How to Perform a Network Capture of a Server Operating System Image That Is Configured with Sysprep and PXE

Use the following procedure to capture a Configuration Manager 2007 server operating system image configured with Sysprep and PXE.

Note
You should temporarily remove the hard disk from the reference computer boot device list in the BIOS so that it will always perform a PXE boot.

To capture a server operating system image configured with Sysprep and PXE

  1. Prepare the reference computer. For more information about preparing the reference computer, see Administrator Checklist: Configure the Reference Computer for Operating System Deployment.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Computer Associations. To import the reference server into the Configuration Manager 2007 database, right-click the Computer Association node and select Import Computer Information.

  3. On the Select Source page, select Import Single Computer and click Next.

  4. On the Single Computer page, you must specify the Computer Name and the MAC address of the computer you want to import.

  5. On the Data Preview page, confirm the computer you are about to import and click Next.

  6. On the Choose Target Collection page, select Add new computers to the All Systems collection.

  7. To specify the location of the operating system you want to capture, right-click the reference server you just imported in the All Systems collection and select Properties. To add the path of the operating system, select the Variables tab and add the OSDTargetSystemRoot task sequence variable—for example, OSDTargetSystemRoot=C:\windows.
    For more information about task sequence variables, see About Task Sequence Variables.

  8. To save the captured image, create a share on the same Configuration Manager 2007 server you are using to initiate the operating system image capture.

  9. To create the task sequence that will be used to capture the operating system image, in the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences. Right-click Task Sequences and select New, Task Sequence. Select Create a new custom task sequence and click Next.

  10. Specify a Name and optional Comment to be associated with the task sequence. To select the boot image, click Browse and select the boot image. To complete the New Task Sequence Wizard, click Next.

  11. To edit the new custom task sequence, right-click the task sequence and select Edit.

  12. To add the capture task sequence step, edit the task sequence and add the Capture Operating System Image task sequence step. Specify the optional description, and configure the location specified in step 8, which is where the captured image will be saved, by clicking Browse and specifying the location in Universal Naming Convention (UNC) format. For more information about editing an existing task sequence, see How to Edit an Existing Task Sequence.

    Important
    The network access account associated with this task sequence step must have read and write access to the share specified in step 8 and any files that are located on the Configuration Manager 2007 server required to complete the task sequence.

  13. To advertise the task sequence to the reference computer, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements. Right-click Advertisements and click Advertise Task Sequence.

  14. On the General page, enter a Name and optional Comment that will be associated with this advertisement. To include members of any subcollections and to make this advertisement available to PXE, select the Make this task sequence available to boot media and PXE check box.

  15. On the Schedule page, to add the mandatory advertisement, click New and select Assign immediately after this event. Select the Ignore maintenance windows when running program and Allow system restart outside of maintenance windows check boxes.

  16. On the Distribution Points page, specify how Configuration Manager 2007 clients will obtain assigned content and interact with the distribution point. Click Next. On the Interaction page, specify how Configuration Manager 2007 clients will be notified of the advertisement. Click Next and complete the wizard.

  17. Turn on the target computer, and ensure the computer starts using PXE. To ensure the advertisement is being run, monitor the boot progress and verify that the assigned task sequence is being run.

    Note
    If the target computer boots using the hard disk, you might need to reconfigure the BIOS so that it boots using PXE.

  18. The operating system image capture will complete, and the WIM file captured from the reference computer will be saved to the location specified in step 4 of this procedure.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database

Other Resources

How to Deploy an Operating System


How to Create a Task Sequence to Install an Existing Operating System Image Package

You can create a task sequence to deploy an existing operating system image to a target computer by using the New Task Sequence Wizard. After you have created the task sequence, you can edit the task sequence by selecting the Task Sequences node, right-clicking the task sequence you want to change, and then clicking Edit to open the Task Sequence Editor.

Use the following procedure to create a new task sequence to install an existing operating system image.

Procedures

To create the operating system deployment new task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To start the New Task Sequence Wizard, right-click the Task Sequences node, and then click New/Task Sequence.

  3. On the Create a New Task Sequence page, select Install an existing image package, and then click Next.

  4. On the Task Sequence Information page, specify a descriptive name for the task sequence, and then add an optional comment. To specify the boot image that will be associated with the task sequence, click Browse to open the Select a Boot Image dialog box, select the boot image, and then click Next.

    Important
    The boot image you specify must match the chip architecture installed on the target computer or the task sequence will fail.

  5. On the Install the Windows Operating System page, specify the operating system image package that will be used to install the operating system image by clicking Browse button to open the Select an Operating System Image dialog box, and then selecting the operating system package. If there are multiple images in the image package, use the drop-down to specify the Image that should be associated with the image package. To partition and format the target computer's hard disk prior to installing the operating system image, select the Partition and format the target computer before installing the operating system check box.

    Important
    Do not select the option to format and partition the target computer hard disk if you have saved the user state locally or the saved user state will be erased. For more information about saving the user state locally on the target computer for in-place operating system deployment scenarios, see How to Save the User State Locally for In-place Operating System Deployments

  6. Additionally, on the Install the Windows Operating System page, specify the Windows Product key and Server license mode. If you specify Per server as the license mode, configure the Maximum server connections that will be permitted. You must also specify if the local administrator account should be disabled, or if you want to use the same administrator account for all target computers by selecting the appropriate option. Click Next.

  7. On the Configure the Network page, specify if the target computer will join a Workgroup or a Windows Domain.

    1. If you are adding the target computer to a Workgroup, you must type the name of the workgroup in the space provided.
    2. If you are adding the target computer to a Windows domain, click the Set button to open the Windows User Account dialog box and specify the user account and password that should be used to add the computer to the Windows domain. You must also specify the name of the Windows Domain and Windows Domain OU that the target computer will be added to by clicking the Browse button. Click Next.

  8. On the Install ConfigMgr page, click the Browse button to launch the Select a Package dialog box and select the Configuration Manager 2007 package that will be used to install the Configuration Manager 2007 client. Specify the Configuration Manager 2007 client installation properties that will be used in the Installation properties window. Click Next.

  9. Configure how you will save the user state information on the Configure State Migration page. Click the Browse button to select the USMT package that will be used to capture the user settings. Specify the configuration settings that will be captured by selecting the Capture network settings and capture Microsoft Windows settings check boxes. Click Next.

  10. On the Include Updates in Image page specify how the target computer will install assigned software updates by selecting the appropriate option.

  11. On the Install Software Packages page, click New to open the Program Select dialog box. Click Browse to open the Select a Package dialog box. Select the Configuration Manager 2007 packages you want to include, and then click OK. Use the drop down to select the associated programs that should be used.

  12. To complete the creation of the new task sequence, on the Summary page, click Next.

  13. To confirm that the new task sequence was created using the properties specified, review the confirmation on the Confirmation page.

  14. Click Close to close the New Task Sequence Wizard.

See Also

Tasks

How to Deploy Operating System Images to a Computer

Other Resources

How to Manage Task Sequences


How to Create a Task Sequence to Build and Capture an Operating System Image

You can create task sequence to build and capture operating system image for use with operating system deployment using the New Task Sequence Wizard. After you have created the task sequence, you can edit the task sequence by selecting the Task Sequences node and right-clicking on the task sequence you want to change and selecting Edit to launch the Task Sequence Editor.

Use the following procedure to create a new task sequence to build and capture operating system image:

Procedures

To create a new build and capture task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To start the New Task Sequence Wizard, right-click the Task Sequences node, and then click New/Task Sequence.

  3. On the Create a New Task Sequence page, select Build and capture a reference operating system image and click Next.

  4. On the Task Sequence Information page, specify descriptive name for the task sequence and add an optional comment. Specify the boot image that will be associated with the task sequence by clicking the Browse button to launch the Select a Boot Image dialog box and select the boot image. Click Next.

    Important
    The boot image you specify must match the chip architecture installed on the target computer and the chip architecture specified in the operating system install package or the task sequence will fail.

  5. On the Install Windows Operating System page, specify the operating system install package that will be used to install the operating system by clicking the Browse button to launch the Select an Operating System Install Package dialog box and selecting the operating system install package. If there are multiple Editions associated with the operating system install package, use the drop-down to specify the edition that should be included with this task sequence.

  6. Additionally, on the Install the Windows Operating System page, specify the Windows Product key and Server license mode (if necessary). If you specify Per server as the license mode, configure the Maximum server connections that will be permitted. By default the local administrator account will be disabled, if you want to Always use the same administrator account for the computers that will run this task sequence, select the always use the same administrator password option and provide the password that will be used. Click Next

  7. On the Configure the Network page, specify if the target computer will join a Workgroup or a Windows Domain.

    1. If you are adding the target computer to a Workgroup, you must type the name of the workgroup in the space provided.
    2. If you are adding the target computer to a Windows domain, click the Set button to launch the Windows User Account dialog box and specify the user account and password that should be used to add the computer to the Windows domain. The account you specify must have domain join permissions in the Windows domain you want to add the computer. You must also specify the name of the Windows Domain and Windows Domain OU that the target computer will be added to by clicking the Browse button. Click Next.

  8. On the Install ConfigMgr page, click the Browse button to launch the Select a Package dialog box and select the Configuration Manager 2007 package that will be used to install the Configuration Manager 2007 client. Specify the Configuration Manager 2007 client installation properties that will be used in the Installation properties window. Click Next.

  9. On the Include Updates in Image page specify how the target computer will install assigned software updates by selecting the appropriate option.

  10. On the Install Software Packages page click the New button to launch the Program Select Dialog box. Click the Browse button to launch the Select a Package dialog box. Select the Configuration Manager 2007 packages you want to include and click OK. Use the drop down to select the associated programs that should be used.

  11. On the System Preparation page specify the Configuration Manager 2007 package that contains the Sysprep tool. The sysprep tool specified must support the operating system install package version selected in step 5.

  12. On the Image Properties page specify identifying information that will be associated with task sequence you are creating.

  13. On the Capture Image page, specify where the captured operating system image will be saved on the network. You can click the Browse button to search for a location or type in the path using UNC format. Click the Set button to launch the Windows User Account dialog box and specify the network account that will be used to access the specified operating system image output location.

  14. To complete the creation of the new task sequence, on the Summary page, click Next.

  15. To confirm that the new task sequence was created using the properties specified, review the confirmation on the Confirmation page.

  16. Click Close to close the New Task sequence Wizard.

See Also

Other Resources

How to Manage Task Sequences


How to Create a Custom Task Sequence

A task sequence consists of a combined series of steps to complete an action. Task sequences can operate across a computer restart, and task sequence steps can be put into groups for more control over run-time behavior. You can create a custom task sequence that will automate and perform tasks on a computer without user intervention. Custom task sequence steps can be added to groups so that multiple task sequence steps will run on a computer. Using task sequence steps in groups will allow you to organize and configure error control for each individual task sequence step and group.

Use the following procedure to create a custom task sequence.

To create a custom task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To start the New Task Sequence Wizard, right-click the Task Sequences node, and then click New/Task Sequence.

  3. On the Create a New Task Sequence page, select Create a new custom task sequence, and then click Next.

  4. On the Task Sequence Information page, specify descriptive information about the custom task sequence, type the Task sequence name, Version, and a Description in the spaces provided.

  5. To specify the boot image that will be associated with this custom task sequence, click Browse to open the Select a Boot Image dialog box, and then specify the boot image you want to use.

  6. To complete the creation of the new custom task sequence, on the Summary page, click Next.

  7. To confirm that the new task sequence was created using the properties specified, review the confirmation on the Confirmation page.

  8. To edit or add or remove steps to the custom task sequence, right-click the task sequence, and then click Edit.

See Also

Concepts

About Task Sequences

Other Resources

How to Manage Task Sequences


How to Edit an Existing Task Sequence

You can update, or change an existing Configuration Manager 2007 task sequence.

Use the following procedure to edit an existing task sequence.

Procedures

To edit an existing task sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To start the Task Sequence Editor, select the task sequence you want to update, right-click the task sequence, and then click Edit.

  3. To add a new task sequence step or a new task sequence group, click Add and select New Group or the task sequence step you want to add.

  4. To remove a task sequence step, select the task sequence step you want to remove, click Remove, and then click Yes.

  5. You can also click the Options tab to update the options associated with the task sequence step.

  6. Click OK to close the Task Sequence Editor.

See Also

Other Resources

How to Manage Task Sequences


How to Advertise Task Sequences

You can advertise task sequences to collections by using the New Advertisement wizard.

Before you run the New Advertisement Wizard, you will need to know what target collections and desired run-time behavior you want for the advertisement you are creating. Read access to the task sequence is required to advertise the task sequence, and the task sequence must exist prior to creating the advertisement.

When you have created a successful advertisement, it will be located under the Software Distribution/Advertisements node.

Use the following procedure to create a new advertisement of task sequences.

To advertise task sequences to collections

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

    Alternatively, you can navigate to the Task Sequences node: System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences. Right-click the task sequence you want to advertise, and then click Advertise.

  2. To start the New Advertisement Wizard, right-click the collection that will receive the advertisement, and then click Advertise Task Sequence.

  3. On the General page, specify a Name and an optional descriptive Comment for the new advertisement.

    Note
    Task sequence advertisement names do not need to be unique, you can assign the same name to more than one task sequence advertisement.

  4. Specify the task sequence to be advertised by selecting an existing task sequence from the drop-down list, and then confirm the collection that will receive the advertisement. To change the target collection for the advertisement, click the Browse, and specify a different collection.

  5. To make the advertisement available to subcollections of the selected collection, select the Include members of subcollections check box. To make the advertisement available to boot media and PXE clients, select the Make this task sequence available to boot media and PXE check box.

    Note
    The Make this task sequence available to boot media and PXE check box is not available if the advertised task sequence will perform a task sequence other than an operating system deployment.

  6. On the Schedule tab, specify when this task sequence will be available to the target collection.

    You can also assign an expiration date to the advertisement by selecting the Advertisement will expire check box, and specifying an expiration date. If you want the specified time to be interpreted as Coordinated Universal Time (UTC) time format, select the UTC check box; otherwise, the local time on each target computer will be used.

  7. To create mandatory advertisements which must be run on the target computer, click the New icon to open the Assignment Schedule dialog box. To specify when and how frequently this advertisement is available, click Schedule to open the Custom Schedule dialog box, and specify the schedule and recurrence behavior.

  8. You can specify the desired Wake On LAN (WOL) and maintenance window behavior by selecting the corresponding check boxes, and then use the drop-down list to assign the priority and rerun behavior.

  9. On the Distribution Points page, specify how clients will retrieve content from packages referenced by the task sequence. Do one of the following:

    • To allow the Configuration Manager 2007 clients to download all required content as needed by the running task sequence, select Download content locally when needed by running task sequence. This task sequence action specifies that required content is downloaded to the computer when needed by a task sequence action. This option is useful when you plan on partitioning your hard disk as part of the operating system deployment or you make extensive use of conditions.
    • To configure the Configuration Manager 2007 client to download all content to the client cache before initiating the task sequence, select Download all contents locally before starting the task sequence. This option is particularly useful when deploying an operating system to multiple computers at the same time. The required content will be downloaded using BITS where available, which is bandwidth aware and lessens the impact on your network. It also helps improve the reliability of operating system deployments because the task sequence will not start until all content is downloaded and verified. However, this option cannot be used if the advertisement is enabled for PXE and boot media or the task sequence contains a Partition Disk task sequence action that repartitions the drive containing the Configuration Manager 2007 client cache.
    • To configure the Configuration Manager 2007 client to access content directly from a distribution point, select Access content from a distribution point when needed by a running task sequence. This option can be less reliable and less secure because the content is not downloaded and verified before being used by the running task sequence.

    By default Configuration Manager 2007 clients will access content from a local distribution point, you can specify that the Configuration Manager 2007 client should use a remote distribution point if a local distribution point is not available by selecting the When no local distribution point is available, use a remote distribution point check box. To specify that the Configuration Manager 2007 client should use an unprotected distribution point if a protected one is not available select the When no protected distribution point is available, use an unprotected distribution point check box.

  10. On the Interaction page, specify how clients will be notified and interact with the advertised task sequence.

  11. On the Security page, specify the users that have access to this object and click Next.

  12. Review the summary on the Summary page and click Next.

  13. On the Confirmation page click Close to close the wizard.

See Also

Concepts

About Task Sequences
About Advertisements

Other Resources

How to Manage Task Sequences


How to Copy a Task Sequence from one Configuration Manager 2007 Site to Another

Task sequences are automatically propagated from Configuration Manager 2007 parent sites to Configuration Manager 2007 child sites. However, they are not propagated from child sites to parent sites, or from a Configuration Manager 2007 site in one hierarchy to an Configuration Manager 2007 site in another hierarchy.

A task sequence can be exported as an XML file from one Configuration Manager 2007 site, and imported to another Configuration Manager 2007 site. Only the task sequence itself is exported. No reference packages are exported. Consequently, you must review each imported task sequence using the Task Sequence Editor for any references to packages and ensure that the task sequence references packages that exist in the site you have imported the task sequence to. User passwords and software product keys are also not exported and you will need to create the necessary task sequence steps at the site where the task sequence was imported.

Note
If you plan to import more than one task sequence you must close and re-open the Task Sequence Editor after each successful task sequence import.

Use this procedure to copy a task sequence from a Configuration Manager 2007 child site to a Configuration Manager 2007 parent site, or from a Configuration Manager 2007 site in one hierarchy to and Configuration Manager 2007 site in another hierarchy.

How to Copy a Task Sequence from one ConfigMgr Site to Another

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. In the Task Sequences pane, select the task sequence that you want to copy.

  3. In the Action menu, or from the Actions pane, select Export.

  4. In the Save As dialog box, select the location that the task sequence XML file should be saved and enter a file name for the task sequence file. You must save the task sequence as an .XML file.

  5. If necessary, place the task sequence XML file on a network share that can be accessed by the other Configuration Manager 2007 site.

  6. Using the Configuration Manager 2007 Administrator Console at the other Configuration Manager 2007 site, navigate to Task Sequences.

  7. In the Action menu, or from the Actions pane, select Import.

  8. Browse to the location of the task sequence XML file that you exported, select it, and click Open. Note the path to where the task sequence was imported to and click OK to confirm the import.

  9. The task sequence should now be visible in the list of task sequences. You can also click Refresh the Actions pane to reload list of available task sequence.

    Note
    When you import a task sequence into another Configuration Manager 2007 site, it is important to remember that Configuration Manager 2007 only imports the task sequence. It does not import any boot image packages, operating system image packages, or software packages, user passwords, or product keys that are referenced by the task sequence. Consequently, the imported task sequence contains null references to those types of packages.

  10. Select the imported task sequence and edit the task sequence at the new site.

    • Fix any broken package and program references that are needed by the task sequence. All associated programs must be accessible by the task sequence at the new site.
    • Reconfigure any task sequence steps that require a user account or password with appropriate credentials so the task sequence can run at the new Configuration Manager 2007 site.
    • If any task sequence steps require a unique product key, reconfigure the task sequence with the product key information that should be used at the new site.
    • If a boot image is required to run the task sequence you need to associate the task sequence with a boot image that is available at the new site. To associate a new boot image for the task sequence, by right-clicking the task sequence and choosing Properties. Select the Advanced tab and assign the new boot image.

  11. Review the task sequence for any broken or null package references. You can do any of the following:

    • Configure the broken reference to specify an appropriate package at the new Configuration Manager 2007 site.
    • Remove the task sequence step that contains the broken reference.
    • Disable the task sequence step that contains the broken reference.
    • Create a conditional statement for that task sequence step that skips the reference.
    Note
    If you run a task sequence that has a task sequence step with a broken reference, by default the task sequence will generate an error for that task sequence step and continue to run.

  12. Verify that all associated user accounts needed by the task sequence steps have the necessary permissions at the new site. For example; the task sequence may have a step that must have permissions to create a computer account, or connect to a network folder at the new site.

See Also

Other Resources

How to Manage Task Sequences


How to Install Software Packages as Part of a Task Sequence

You can use a task sequence to install software as part of any operating system image deployment, or to install software on an existing Microsoft System Center Configuration Manager 2007 client.

Using steps in a task sequence, Configuration Manager 2007 can install one or more Configuration Manager 2007 software packages on a target computer after the new operating system is installed, but before the user is first allowed to login. The installation of each software package in the task sequence completes in order before the next software package is installed. Desktop users cannot login to the computer until all software packages have been installed. Programs associated with each Configuration Manager 2007 package must run under the computer's system account and be configured to install automatically and silently without user interaction.

When you use a task sequence to install an application Configuration Manager 2007 checks the following two conditions:

  1. Whether or not a user must be logged in for the installation to proceed.
  2. Whether or not user any user input is required.

Use this procedure to add a software package to an existing task sequence that deploys an operating system image to a computer.

How to Install Software Packages as Part of a Task Sequence

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. Select the task sequence that is being used to deploy the operating system image from the Task Sequences pane to which the software package should be added.

  3. In the Action menu, or from the Actions pane, select Edit to run the Task Sequence Editor.

  4. Highlight the task sequence step in the tree view pane where you want to install the software package and click Add. You can add this new task step to the Install Software group if it exists.

  5. Under General, select Install Software. The new task step is added after the task step you highlighted.

  6. To install a single package select Install a single application and click the Browse button to specify the package id and associated program.

  7. To install multiple packages, select Install multiple applications and enter the package ID on the Base variable name line. This action specifies the base variable name for a series of task sequence variables that each contain a <packageID, program name> pair separated by a colon. The series of variable names is formed by appending a numeric suffix between 001 and 999 to the administrator-defined base name. The associated packages will be installed in the order specified in the list and each package installation will be completed before the installation for the next package begins.

  8. Click OK to save the task sequence.

See Also

Reference

Operating System Deployment: Task Sequence Editor
Install Software

Other Resources

How to Manage Task Sequences


How to Manage Task Sequence Variables

The Configuration Manager 2007 task sequence environment is a set of name and value pairs that perform configuration and operating system deployment tasks on a Configuration Manager 2007 client computer. Task sequence variables provide a mechanism to store and run administrator defined computer and user state configuration tasks.

Use the following tasks to help you manage Configuration Manager 2007 task sequence variables:

In This Section

How to Create Per-Computer Task Sequence Variables

How to Create Per-Collection Task Sequence Variables

See Also

Concepts

Task Sequence Variables

Other Resources

Configuring Operating System Deployment


How to Create Per-Computer Task Sequence Variables

You can define custom per-computer variables for each computer in the Configuration Manager 2007 database. The maximum number of variables that can be assigned to a specific computer may not exceed 1,000. Per-computer variables do not propagate throughout the hierarchy and per-computer task sequence variables can be hidden so that they are not visible in logs or in the Configuration Manager console. The mask attribute cannot be cleared and must be deleted. When a computer is deleted from the Configuration Manager 2007 database, all associated task sequence variables are also deleted.

Per-computer task sequence variables have a higher precedence than per-collection task sequence variables so task sequence variables that are assigned to a specific computer will have a higher priority than variables assigned to the collection or collections where the Configuration Manager 2007 client is located.

For example: If collection A has a variable assigned to it and computer A which is a member of collection A has a conflicting variable assigned to it, the variable assigned to computer A will receive higher priority than that of the variable assigned to collection A.

Use the following procedure to create per-computer task sequence variables.

To create per-computer task sequence variables

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. To assign a per-computer variable to a computer, locate and expand the collection the computer belongs to, right-click the computer, click Properties, and then click the Variables tab.

  3. To specify custom variables and their associated values, click the New icon to open the <New> Variable dialog box.

  4. In the <New> Variable dialog box, specify a name for the variable. Additionally, specify whether this variable will be visible in the Configuration Manager 2007 console.

  5. On the Value line, specify the Value that should be assigned to the variable, confirm the value specified by typing the value again on the Confirm Value line, and then click OK.

    If you have specified that the value should be hidden from the Configuration Manager 2007 console the confirm value line will not be available.

  6. In the Variables window, you can review the per-computer variables assigned to this computer.

See Also

Tasks

How to Create Per-Collection Task Sequence Variables

Concepts

About Task Sequence Variables


How to Create Per-Collection Task Sequence Variables

You can define per-collection task sequence variables for a specific collection in the Configuration Manager 2007 database. Per-collection task sequence variables can be hidden by selecting the Do not display in the Configuration Manager 2007 console option. When the hidden attribute value is cleared, the associated value of the variable is also cleared. Hidden variables cannot be cleared and must be deleted. When you delete a collection from the Configuration Manager 2007 database, all associated task sequence variables are also deleted.

Note
Per-computer task sequence variables have a higher precedence than per-collection task sequence variables so task sequence variables that are assigned to a specific computer will have a higher priority than variables assigned to the collection or collections where the Configuration Manager 2007 client is located..

Use the following procedure to create per-collection variables.

To create per-collection task sequence variables

  1. In the Configuration Manager console, System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. To assign a variable to a collection, right-click the collection, and then click Modify Collection Settings.

  3. To define the per-collection variable and the associated value, open the <New> Variable dialog box, click the Collection Variable tab, and then click the New icon.

  4. In the New Variable dialog box, specify a name for the variable, and then specify whether the value associated with the variable will be visible in the Configuration Manager 2007 administrator console.

  5. On the Value line, specify the Value of the variable, and if the value is masked, enter the value again to confirm the variable on the Confirm Value line, and then click OK. If you have specified that the value should not be displayed in the Configuration Manager 2007 console, the confirm value line will not be available.

  6. You can specify a Precedence by selecting a numeric value from the drop-down list, where 1 is the lowest precedence, and 9 to specify the highest precedence. The Precedence level will be used when a computer is a member of multiple collections with differing precedence levels assigned.

See Also

Tasks

How to Create Per-Computer Task Sequence Variables

Concepts

About Task Sequence Variables


How to Manage Operating System Boot Images

Operating system images are .wim format files and represent a compressed collection of reference files and folders needed to successfully install and configure an operating system image on a computer.

Use the following tasks to help you manage the Configuration Manager 2007 operating system images:

In This Section

How to Add Windows Device Drivers to a Boot Image

How to Update Boot Images

How to Add a Boot Image to Configuration Manager

See Also

Other Resources

Configuring Operating System Deployment


How to Add Windows Device Drivers to a Boot Image

Windows device drivers that have been imported into the driver catalog can be added to one or more boot images. Only mass storage device drivers and network adapter device drivers should be added to boot images because other types of drivers are not needed and will increase the size of the boot image. You should only add valid device drivers that are intended for use with Windows Vista because the version of Windows PE is Windows Vista-based.

Note
Adding device drivers to a boot image can increase the memory requirements of the boot image. Only add device drivers to boot images that are absolutely necessary. If the memory requirements of the boot image exceed the memory of the target computer the deployment will fail.

It is recommended that you only add network and mass storage device drivers to a boot image so that the size of the boot image does not get too large. However, there may be situations where you want to selectively install additional device drivers to a boot image. The Auto Apply Driver task sequence step will scan for device devices present on the computer and install the compatible device drivers. To address devices like multi-function or child devices that do not have a device driver installed yet it may be necessary to add additional device drivers to the boot image so that these devices can be detected.

Use the following procedure to add Windows device drivers to one or more boot images.

To add Windows device drivers to a boot image

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Drivers.

  2. To add a driver to a boot image, select the driver you want to add, right-click the selection, and then click Add or Remove Drivers to Boot Images. Alternatively, you can drag the selected driver to the desired boot image or images under the Boot Images node. You can also add drivers on the Windows PE tab on the Boot Image properties dialog box.

    Note
    To add multiple drivers to a boot image, select all the drivers you want to add, right-click the selection of drivers, and then select Add or Remove Drivers to Boot Images from the context menu.

  3. In the Add or Remove Drivers to Boot Images dialog box, specify which boot image or images to add the specified driver or drivers to in the Add or Remove Drivers to Boot Images dialog box. To select all available boot images, click Select All.

  4. To update distribution points immediately, select Update distribution points when finished. To update distribution points at a later time, right-click the Distribution Point node under the boot image to be updated, and then click Update Distribution Points. Boot images with the added drivers will not be available to computers until they have been updated on distribution points.

    Note
    To view existing drivers already associated with a boot image, right-click the boot image, click Properties, and then click the Windows PE tab.

See Also

Tasks

How to Import Windows Device Drivers into the Driver Catalog

Other Resources

How to Manage the Driver Catalog


How to Update Boot Images

You can update a boot image by adding device drivers to it or editing its properties. Device drivers that you add to an existing boot image must be imported and enabled in the driver catalog. Updating the boot image does not change the associated package that the boot image references.

Important
Any changes made to the Images tab of the boot image properties dialog will also update the source image. Changes made on the other boot image tabs will not change the source image.

Use the following procedure to update an existing boot image.

To update a boot image

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Boot Images.

  2. To view the properties of the boot image you want to update, right-click the boot image, and then click Properties. Alternatively, in the Actions pane, you can click Properties.

  3. To change the name, version, or to add a comment, click the General tab and type in the new information.

  4. To update the property values on the source image, click the Image tab.

  5. On the Image tab, select the image property you want to update and type in the new information in the Value column. If you used an external tool to update the image properties, click Reload to reload the image properties from the source image.

    Important
    You will lose image property changes if you click Reload, because that will reload the image properties from the source image.

  6. To add a network device driver or mass storage device driver to a Windows PE image, click the Windows PE tab, and then click the New icon to open the Select a Driver dialog box.

    Note
    Modifications to boot image properties made on the Windows PE tab, such as adding drivers or enabling command support, are not automatically updated during scheduled distribution point updates. To update the boot image on distribution points, either click Yes in the Distribution Point Update Required dialog box to update distribution points immediately or manually update the distribution points by right-clicking the boot image and clicking Update Distribution Points.

  7. Select the device driver from the Drivers window, and then click OK.

  8. Click the Data Source tab to schedule the distribution point updates. The updated images must be replicated to the distribution point for computers to install them. You can also change the source directory by selecting the image you want to use.

    Note
    You can update distribution points with only the new information by selecting Enable binary differential updates. Enabling binary differential updates will replicate only the changed file information to the distribution point.

See Also

Tasks

How to Add Windows Device Drivers to a Boot Image

Other Resources

How to Manage Operating System Boot Images


How to Add a Boot Image to Configuration Manager

An operating system deployment boot image is a Windows PE image and is used during an operating system deployment. By default, Configuration Manager 2007 creates an x86 and x64 boot image for use with operating system deployments. The boot images are displayed in the results pane when you select the Boot Images node in the Configuration Manager 2007 administrator console.

You can also import you own custom boot images. You may want custom boot images for any of the following scenarios:

  • You want to run scripts or custom actions in Windows PE that require optional Windows PE components that are not enabled in the default Configuration Manager 2007 boot images.
  • You would like to include custom tools and scripts in the Windows PE image.
  • You would like to initiate operating system deployments using boot media, stand-alone media and PXE initiated deployments.
  • If you are deploying operating systems in a complex environment you may require multiple boot images containing different sets of device drivers. Adding device drivers to a boot image increases the size of the boot image so individual boot images should not contain all available device drivers.

To successfully import a custom boot image, the boot image must already be finalized or the SMS Provider will reject it. Configuration Manager 2007 setup puts two finalized boot images in the following directory: <SMS installation>\OSD\boot\<arch>. You can import these boot images into the boot image catalog. Use the following procedure to create a new source boot image that can be imported:

Note
Note these steps must be run on a computer running the SMS provider.

  1. Copy a boot image from the directory where the Windows Automated Installation Kit (WAIK) is installed.
  2. Mount this new copied boot image to a temporary directory. For example; %systemroot%\temp\bootimages imagex.exe /mountrw c:\winpe\winpe.wim 1 %systemroot%\temp\bootimages.
  3. Import and install the security .dll optional component. To prepare an X86 boot image you must perform the following steps:
    1. peimg.exe /import=\\<site server>\SMS_<site code>\OSD\bin\i386\Windows6.0-KB939663-x86.cab %systemroot%\temp\bootimages\windows
    2. peimg.exe /install=Package_1_for_KB939663 %systemroot%\temp\bootimages\windows
    3. To prepare an X64 image you must perform the following steps:
    4. peimg.exe /import=\\<site server>\SMS_<site code>\OSD\bin\x64\Windows6.0-KB939663-x86.cab %systemroot%\temp\bootimages\windows
    5. %systemroot%\temp\bootimages\windows
    6. peimg.exe /install=Package_1_for_KB939663 %systemroot%\temp\bootimages\windows
  4. Install the three optional components that are required to perform Configuration Manager 2007 operating system deployments:
    1. peimg.exe /install=WinPE-Scripting-Package %systemroot%\temp\bootimages\windows
    2. peimg.exe /install=WinPE-WMI-Package %systemroot%\temp\bootimages\windows
    3. peimg.exe /install=WinPE-XML-Package %systemroot%\temp\bootimages\windows
  5. Install the optional components that should be included with the boot image.
  6. Copy the additional required files that are needed to mount the directory.
  7. Finalize the boot image using the following command: peimg.exe /prep %systemroot%\temp\bootimages\windows /f
  8. Dismount the boot image using the following command: imagex.exe /unmount /commit %systemroot%\temp\bootimages\windows
  9. Export the custom boot image. This step is necessary to reduce the image footprint: imagex.exe /export c:\winpe\winpe.wim 1 c:\winpe\boot.wim
Note
Imagex.exe and peimg.exe are located in the WAIK installation directory.

You can import the newly created boot image into the Configuration Manager 2007 catalog.

Use the following procedure to add a new boot image.

To add a boot image

  1. In the Configuration Manager console, navigate System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Boot Images.

  2. To start the Add Boot Image Wizard, right-click the Boot Images node, and then click Add Boot Image.

  3. On the Data Source page, specify the path to the boot image WIM file. You can click Browse to browse for a specific boot image. If the selected WIM file contains multiple images, use the Boot Image drop-down list to select the desired image.

    Note
    The specified path must be a valid network path in the UNC format. For example: \\servername\<sharename>\path.

  4. On the General page, provide a Name and Version to be associated with the boot image, optionally add an optional descriptive Comment for the boot image, and then click Next.

  5. Review the Summary, and then click Next to add the new boot image.

See Also

Tasks

How to Update Boot Images


How to Manage Native Mode Certificates and Operating System Deployment

When the Configuration Manager 2007 site is operating in native mode, operating system deployment Configuration Manager 2007 clients require public key infrastructure (PKI) certificates that enable them to communicate with the Configuration Manager 2007 site and complete deployment. These certificates include a client authentication certificate and a trusted root certification authority certificate.

For more information about how native mode certificates are used with operating system deployments, see About Native Mode Certificates and Operating System Deployment.

Use the following tasks to help you manage the PKI certificates associated with operating system deployments in native mode environments.

In This Section

How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients

How to Export Certificates For Use With Operating System Deployment

See Also

Concepts

Administrator Checklist: Deploying the PKI Requirements for Native Mode
Configuration Manager Site Modes
Benefits of Using Native Mode
Certificate Requirements for Native Mode

Other Resources

Configuring Operating System Deployment


How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

When the Configuration Manager 2007 site is operating in native mode, operating system deployment clients require root certification authority certificates for the certification authorities used with Configuration Management.

If all the computers in the Configuration Manager 2007 primary site (and any secondary sites) use certificates from the same certification authority, you need to specify a single root certification authority certificate. However, if more than one certification authority is used, you must specify a root certification authority certificate for each certification authority that is used by clients, and the following site systems:

  • Management points
  • Distribution points
  • Software update points
  • State migration points

Before you can specify the root certification authority certificates in Configuration Manager, you must first prepare the root certification authority certificates by exporting them to a file.

Follow these procedures to prepare the root certification authority certificates by exporting them to a file.

To prepare root certification authority certificates by exporting them to a file - from computers running Windows Vista

  1. On a computer that has the root certification authority certificates installed, log on as a local administrator and click Start, type MMC into the search box and press Enter. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

  2. In the empty console, click File and then click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, select certificates and click Add.

  4. On the Certificates snap-in page, select Computer Account and then click Next.

  5. In the Select Computer dialog box, ensure the option Local computer: (the computer this console is running on) is selected and then click Finish.

  6. In the Add Standalone Snap-in dialog box, click OK to close the Add or Remove Snap-ins dialog box.

  7. In the console, expand Certificates (Local Computer) and then expand Trusted Root Certification Authorities.

  8. Double-click Certificates to expand the certificate store. Locate the first trusted root certificate you need for operating system deployment clients.

  9. Right-click the certificate you require, select All Tasks, and then click Export to launch the Certificates Export Wizard.

  10. In the Certificate Export Wizard, click Next.

  11. On the Export File Format page, ensure DER encoded binary X.509 (.CER) is selected and then click Next.

  12. On the File to Export page, specify a path and file name for the exported certificate and then click Next.

  13. On the Completing the Certificate Export Wizard page, click Finish.

  14. To confirm the successful certificate export, click OK in the Certificate Export Wizard dialog box.

  15. If operating system clients are not using the same root certification authority, repeat steps 10 through 15 until you have exported each root certification authority certificate you require to individual files.

    Note
    Configuration Manager 2007 does not support importing multiple root certification authority certificates in the same file, and it supports only the DER encoded binary X.509 (.CER) format.

  16. Store the file securely where you can access it from the Configuration Manager site properties, Site Mode tab.

To prepare root certification authority certificates by exporting them to a file- from computers running Windows XP Professional, or Windows Server 2003

  1. On a computer that has the root certification authority certificates installed, click Start, click Run, type MMC in the Run dialog box, and then click OK.

  2. In the empty console, click File and then click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, click Add.

  4. In the Add Standalone Snap-in dialog box, select Certificates and then click Next.

  5. In the Select Computer dialog box, ensure the option Local computer: (the computer this console is running on) is selected and then click Finish.

  6. In the Add Standalone Snap-in dialog box, click Close.

  7. In the Add/Remove Snap-in dialog box, click OK.

  8. In the console, expand Certificates (Local Computer) and then expand Trusted Root Certification Authorities.

  9. Click Certificates, and then in the details pane, locate the first trusted root certificate you need for operating system deployment clients.

  10. Right-click the certificate you require, click All Tasks, and then click Export.

  11. In the Certificate Export Wizard, click Next.

  12. On the Export File Format page, ensure DER encoded binary X.509 (.CER) is selected and then click Next.

  13. In the File to Export page, specify a path and file name for the exported certificate and then click Next.

  14. On the Completing the Certificate Export Wizard page, click Finish.

  15. To close the wizard, click OK in the Certificate Export Wizard dialog box.

  16. If operating system clients are not using the same root certification authority, repeat steps 10 through 15 until you have exported each root certification authority certificate you require to individual files.

    Note
    Configuration Manager 2007 does not support importing multiple root certification authority certificates in the same file, and it supports only the DER encoded binary X.509 (.CER) format.

  17. Store the file securely where you can access it from the Configuration Manager site properties, Site Mode tab.

See Also

Tasks

How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients

Concepts

Configuration Manager Site Modes


How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients

When the Configuration Manager 2007 site is operating in native mode, operating system deployment clients require root certification authority certificates for the certification authorities used with Configuration Management.

Follow this procedure to specify the root certification authority certificates for operating system deployment clients assigned to the primary site and to its secondary sites.

Note
This procedure requires that you have exported the root certification authority certificates. For more information, see How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients.

To specify the root certification authority certificates for operating system deployment clients

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site code> and then click Properties.

  3. On the Site Mode tab in the site properties dialog box, ensure Native is selected for the Site mode option.

  4. In the Operating system deployment settings section, click Specify Root CA Certificates.

  5. To add a root certification authority certificate to the Configuration Manager site, in the Set Root CA Certificates dialog box, click the new icon.

  6. In the Open dialog box, select a file with a .cer extension that contains the exported certificate and then click Open.

    Note
    Configuration Manager 2007 does not support exported certificate formats other than the format DER encoded binary X.509 (.CER).

  7. Repeat steps 5 and 6 if you have additional root certification authority certificates to add.

  8. To remove a root certification authority certificate from the Configuration Manager site, in the Set Root CA Certificates dialog box, select the certificate to remove and then click the delete icon.

  9. Repeat step 8 if you have additional root certification authority certificates to remove.

  10. In the Set Root CA Certificates dialog box, click OK.

  11. In the Site Mode tab, click OK to close the site properties dialog box.

See Also

Tasks

How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

Concepts

Configuration Manager Site Modes


How to Export Certificates For Use With Operating System Deployment

When the Configuration Manager 2007 site is operating in native mode, operating system deployments that require communication with the management point must be configured to use a public key infrastructure (PKI) certificate. For more information about the certificate requirements for operating system deployment, see About Native Mode Certificates and Operating System Deployment.

To configure the operating system deployments with the required certificate, import a Public Key Certificate Standard (PKCS #12) file. The creation of this file is external to Configuration Manager 2007; however, you can use the following procedures to create this file.

Before following these procedures, the certificate must already be deployed to a computer. The certificate requirements are as follows:

  • Intended use must include client authentication
  • The private key must be allowed to be exported

If you need information about how to deploy computer certificates, follow the guidance in the following topic: Deploying the Client Computer Certificates to Clients and the Management Point. This same topic can be used for more information about how to deploy computers with their own client computer certificate that will be needed for Configuration Manager native mode communication after the operating system deployment is complete.

Important
The computer certificate required for operating system deployments is not the same computer certificate that will be required for Configuration Manager 2007 clients in a native mode site.

Considerations for creating and deploying the certificate for operating system deployments:

  • If you are using a Microsoft PKI solution, and using an Enterprise Edition of Windows Server 2003 Certificate Services with templates for auto enrollment, you can use either the computer template or the workstation template. However, you must modify the template (duplicate it, and modify the copy) so that the option Allow Private key to be exported is enabled on the Request Handling tab of the certificate template.
  • Unlike most computer certificates, this certificate is not restricted to or owned by a specific computer, but is shared temporarily by all computers that are targeted with operating system deployments in the native mode site. Because of this behavior, consider creating the certificate with a unique attribute for identification (such as custom Subject Name or Subject Alternative Name), and use it only for operating system deployments. Should the certificate ever become compromised, it can then be easily identified and revoked without affecting other computers.
  • Consider having a longer than usual validity period to reduce the administrative overheads of reconfiguring operating system deployments in line with the certificate expiry date.

When the certificate is deployed to a computer, you can then use the following procedures to export the certificate so that you can use it with operating system deployments. If you are using a PXE service point, import the exported certificate as part of the database configuration properties. If you are creating boot media, import the exported certificate on the Security page of the Task Sequence Media wizard.

To export a certificate for use with operating system deployment - from computers running Windows Vista:

  1. On the Windows Vista computer that has the certificate installed, log in as a local administrator, click Start, type mmc into the Search box, and then press Enter.

  2. In the empty console, click File and then click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, select Certificates and click Add.

  4. On the Certificates snap-in page, select Computer account and then click Next.

  5. On the Select Computer dialog box, ensure the option Local computer: (the computer this console is running on) is selected and then click Finish.

  6. To close the Add Standalone Snap-in dialog box, click OK.

  7. In the console, double-click Certificates (Local Computer).

  8. In the console, expand Personal.

  9. Locate the certificate that you need for use with operating system deployment deployments.

  10. Right-click the certificate you require, click All Tasks, and then click Export to launch the Certificate Export Wizard.

  11. On the Certificate Export Wizard Welcome page, click Next.

  12. On the Export Private Key page, select Yes, export the private key, and then click Next.

    Note
    If this option is not available, the certificate has been created without the option to export the private key. In this scenario, you cannot export the certificate in the required format.

  13. On the Password page, specify a strong password to protect the exported certificate with its private key, and then click Next.

  14. On the Export File Format page, ensure that the following option is selected: Personal Information Exchange - PKCS #12 (.PFX).

    Note
    Optionally, select Delete the private key if the export is successful which will ensure that the certificate cannot be used on the computer after you have exported it. This will help to ensure that the certificate is used only for operating system deployments. Alternatively, you can manually delete the certificate on the computer after the export procedure is complete.

  15. On the File to Export page, specify the name of the file that you want to export, and then click Next.

  16. To close the wizard, click Finish in the Certificate Export Wizard dialog box.

  17. Store the file securely and ensure that you can access it from the Configuration Manager console.

To export a certificate for use with operating system deployment - from computers running Windows XP Professional, or Windows Server 2003:

  1. On the Windows XP Professional or Windows Server 2003 computer that has the certificate installed, click Start, click Run, type MMC in the Run dialog box, and then click OK.

  2. In the empty console, click File and then click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, click Add.

  4. Select Certificates from Available snap-ins, and then click Add.

  5. In the Certificates snap-in dialog box, click Computer account, and then click Next.

  6. In the Select Computer dialog box, ensure that the option Local computer: (the computer this console is running on) is selected, and then click Finish.

  7. In the Add or Remove Snap-ins dialog box, click OK.

  8. In the console, expand Certificates (Local Computer).

  9. Expand Personal, and then click Certificates.

  10. In the results pane, locate the certificate that you need for operating system deployment deployments.

  11. Right-click the certificate you require, click All Tasks, and then click Export.

  12. In the Certificate Export Wizard, click Next.

  13. On the Export Private Key page, select Yes, export the private key, and then click Next.

    Note
    If this option is not available, the certificate has been created without the option to export the private key. In this scenario, you cannot export the certificate in the required format.

  14. On the Password page, specify a strong password to protect the exported certificate with its private key, and then click Next.

  15. On the Export File Format page, ensure that the following option is selected: Personal Information Exchange - PKCS #12 (.PFX).

    Note
    Optionally, select Delete the private key if the export is successful which will ensure that the certificate cannot be used on the computer after you have exported it. This will help to ensure that the certificate is used only for operating system deployments. Alternatively, you can manually delete the certificate on the computer after the export procedure is complete.

  16. On the File to Export page, specify the name of the file you want to export and click Next.

  17. To close the wizard, click OK in the Certificate Export Wizard dialog box.

  18. Store the file securely and ensure that you can access it from the Configuration Manager console.

See Also

Tasks

How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

Concepts

Configuration Manager Site Modes
About Native Mode Certificates and Operating System Deployment
Deploying the Client Computer Certificates to Clients and the Management Point


Tasks for Operating System Deployment

The links in this section provide the necessary information to complete each associated operating system deployment task.

In This Section

How to Deploy an Operating System

How to Deploy an Operating System Image Using Media

How to Initiate Operating System Image Deployments Using PXE

How to Deploy an Operating System Image via Multicast

How to Deploy an Operating System to Unknown Computers

See Also

Other Resources

Operating System Deployment in Configuration Manager


How to Deploy an Operating System

Use the following tasks to help you configure and perform operating system image deployments:

In This Section

How to Build a Reference Computer

How to Add a New Computer to the Configuration Manager Database

How to Create a Computer Association for a Side-by-Side Migration

How to Deploy Operating System Images to a Computer

How to Perform a Side-by-Side Operating System Deployment

See Also

Other Resources

Operating System Deployment in Configuration Manager


How to Build a Reference Computer

Use this procedure to build a reference computer to use to capture an operating system image. You can configure the reference computer manually, or you can build the reference computer and create the capture image using a task sequence. For either method refer to the Administrator Checklist: Configure the Reference Computer for Operating System Deployment for additional guidance in configuring the reference computer. When building the reference computer using a task sequence, refer to the Administrator Checklist: Create the Capture Task Sequence for additional guidance.

How to Build a Reference Computer Manually

  1. Identify the computer that will be used as the reference computer.

  2. Configure the reference computer with the appropriate operating system and other software needed to create the operating system image.

    Note
    You should minimally install the appropriate operating system and service pack, support drivers, any required software updates, and the appropriate version of Sysprep.

  3. Configure the reference computer to be a member of a workgroup.

  4. Reset the local administrator password on the reference computer to be blank.

  5. Copy the appropriate Sysprep files (sysprep.exe and setupcl.exe) to the C:\Sysprep folder on the reference computer.

  6. Run Sysprep using the command: sysprep -mini -quiet -reseal -reboot

How to Build a Reference Computer Using a Task Sequence

  1. Identify the computer that will be used as the reference computer.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  3. In the Action menu, or from the Actions pane, select New, then Task Sequence to run the New Task Sequence Wizard.

  4. On the Create a New Task Sequence wizard page, select Build and Capture a reference operating system image.

  5. After you successfully complete the wizard, select the new task sequence from the Task Sequences pane.

  6. In the Action menu, or from the Actions pane, select Edit to run the Task Sequence Editor and customize the task sequence steps that are included with the task sequence and to add any additional task sequence steps that are required.

  7. If the reference computer is a Configuration Manager 2007 client, in the Action menu, or from the Actions pane, select Advertise to run the New Advertisement Wizard. If this is a new computer you can import the computer using the Import Computer Information wizard which will add the computer to the Configuration Manager 2007 database.

    Important
    If the task sequence has a disk partitioning task sequence step, do not select a Download Program option for the advertisement.

  8. If the reference computer is not a Configuration Manager 2007 client, you can run the Task Sequence Media Wizard to create bootable media to use to install the image on the reference computer.

  9. If the reference computer is a Configuration Manager 2007 client, Advertise the task sequence to the reference computer:

    1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.
    2. Select the task sequence to advertise from the Task Sequences pane.
    3. On the Action menu, or from the Actions pane, select Advertise to run the New Advertisement Wizard.

  10. Alternatively, you can create bootable media such as CD or DVD and use that to manually run the task sequence on the reference computer.

See Also

Tasks

How to Create Task Sequence Bootable Media

Reference

New Task Sequence Wizard
Operating System Deployment: Task Sequence Editor
Task Sequence - New Advertisement Wizard

Concepts

About the Operating System Deployment Reference Computer


How to Add a New Computer to the Configuration Manager Database

Topic Last Updated—August 2008

To deploy an operating system to a new computer without stand-alone media that is not currently managed by Configuration Manager 2007, the new computer must be added to the Configuration Manager 2007 database prior to initiating the operating system deployment process. Although Configuration Manager 2007 can automatically discover computers on your network that have a Windows operating system installed, if the computer has no operating system installed you will need to import the new computer information by using the Import Computer Information Wizard. This wizard supports importing information about a single computer, or importing information about one or more computers from an external .csv file.

Important
If the computer to be imported already exists in the Configuration Manager 2007 database, the new computer information will overwrite the existing computer information.

Use the following procedures to import multiple computers by using a file or import a single computer.

Configuration Manager 2007 R2 includes unknown computer support for Operating System Deployment. If unknown computer support is enabled, new computers without an operating system installed can be discovered via the PXE boot process.

To import new computer information from a file

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Computer Associations.

  2. To start the Import Computer Information Wizard, on the Action menu, click Import Computer Information, or right-click the Computer Associations node, and then click Import Computer Information. Alternatively, you can start the wizard in the Actions pane by clicking Import Computer Information.

  3. To specify the source file that contains the computer information to be imported, select Import computer information using a file, and then click Next.

    Note
    The import file you specify must be created before running this wizard. The specified file must be created in the comma separated values (CSV) format. Use the following format when entering the computer information with each property value in a separate column: NEWCOMP1,55555555-5555-5555-5555-555555555555,05:06:07:08:09:0A. Raw byte format is not supported. No conversion of raw byte format data will be performed. If the computer information is not entered using this format, the computer import will fail.

  4. On the Choose Mapping page, specify the file you have created that containing the new computer information to be imported. You can enter the path and file name on the Import File line, or click Browse to locate the import file. If the file contains column headings, check the This file has column headings check box, which will cause the first line of the file to be ignored. To change the Source Column property information associated with a value, select the column number and use the Assign as list to reassign the value.

    Note
    Each Configuration Manager 2007 property can be used only once. The Name field must be assigned to one column. You must also specify a Computer Name, SMBIOS GUID, or MAC Address. Although both values may be used, each property must be assigned to only one column. You can optionally specify the source computer, but it should also be assigned to one column. Multiple MAC addresses should be separated by a colon.

    The Ignore and Variable options can be assigned to multiple columns. Ignore is the default option. If you assign a column as a Variable, you must also enter the variable that should be used.

  5. On the Data Preview page, preview the data and the associated values.

    Important
    The specified file to be imported must contain valid data in order to proceed to the next page of the wizard.

  6. On the Choose Target Collection page, specify which collections the imported computers should be assigned to. By default, the computers are assigned to the All Systems collection. To add the imported computers to a specific collection, click Browse. The imported computers will be statically added to the specified collection. If you do not want to add the computers to any additional collections, select Do not add computers to a collection.

    Important
    For a computer to receive an operating system deployment, it must be a member of a collection.

  7. On the Summary page, confirm if the computer import was successful. If the import was not successful, this page will display a list of errors that occurred during the import process. Only computers that failed to import into Configuration Manager 2007 are listed on the summary page.

To import computer information for a single computer

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Computer Associations

  2. To start the Import Computer Information Wizard, on the Action menu, click Import Computer Information, or right-click the Computer Associations node, and then click Import Computer Information. Alternatively, you can start the wizard in the Actions pane by clicking Import Computer Information.

  3. To import the computer information from a single computer, select Import single computer, and then click Next.

  4. On the Single Computer page you must specify the Computer Name and either the SMBIOS GUID or MAC Address of the computer you are importing. Optionally, click Search to open the Search Computer dialog box. You can create a computer association by entering or specifying the name of a reference computer from which the user state and settings will be migrated to the new computer.

  5. On the Data Preview page, review the data that will be mapped to each Configuration Manager 2007 property, and then click Next.

  6. On the Choose Target Collection page, specify which collections the imported computer should be assigned to. By default, the computers are assigned to the All Systems collection. To add the imported computers to a specific collection, click Browse. The imported computer will be statically added to the specified collection. If you do not want to add the computer to any additional collections, select Do not add computer to a collection.

    Important
    For a computer to receive an operating system deployment, it must be a member of a collection.

  7. On the Summary page, confirm that the import was successful. If the import was not successful, this page will display a list of errors that occurred during the import.

See Also

Other Resources

Discovery in Configuration Manager


How to Create a Computer Association for a Side-by-Side Migration

A computer association creates a relationship between a source and destination computer for the side-by-side migration of user state data. The source computer is an existing computer that is managed by Configuration Manager 2007, and contains the user state data and settings that will be migrated to a specified destination computer. You can also create a computer association when importing new computers into the Configuration Manager 2007 database by using the Import Computer Information Wizard.

Important
Creating a computer association between computers located in a Configuration Manager 2007 parent site with computers located in a child site is not supported.

Use the following procedures for creating a new computer association.

To create a new computer association

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Computer Associations.

  2. To create a new computer association, you can do either of the following:

    • Right-click the Computer Associations node, click New, and then click Computer Association.
    • In the Actions pane, click New, and then click Computer Association,
    • On the Configuration Manager File menu, click Action, click New, and then click Computer Association.

  3. On the Computer Association tab, specify the name of the source computer that contains the user state data to be migrated to the new computer on the Source Computer line. Alternatively, you can click Search to open the Search Computer dialog box to locate the source computer.

  4. To specify the name of the destination computer that will receive the migrated user state data, type the computer name on the Destination computer line or click Search to open the Search Computer dialog box.

  5. To specify the user accounts that should be migrated from the source computer to the destination computer, click New to open the Add User Account dialog box, and then click the User Accounts tab.

  6. Enter the user account that should be migrated to the destination computer in the space provided or click Browse to open the Select User dialog box. If no user accounts are specified, all user accounts on the source computer will be migrated.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database


How to Deploy Operating System Images to a Computer

Use this procedure to deploy an operating system image to a target computer. When you deploy an operating system the target computer should have the same architecture as the boot image that is contained in the operating system image. To complete the operating system deployment successfully you must also create a sysprep directory on the reference computer hard drive.

Note
For boot/full media and PXE initiated installations, if there is no formatted partition available the task sequence engine will create and format a temporary partition to use as the local data path.

How to Deploy an Operating System Image to a Computer

  1. In the Configuration Manager console, navigate System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. In the Action menu, or from the Actions pane, select New, then Task Sequence to run the New Task Sequence Wizard.

  3. On the Create a New Task Sequence wizard page, select Install an existing image package.

  4. After you successfully complete the wizard, select the new task sequence from the Task Sequences pane.

  5. In the Action menu, or from the Actions pane, select Edit to run the Task Sequence Editor and customize the task steps that are included with the task sequence and to add any additional task steps that are required.

  6. Ensure that a collection exists that contains the target computer.

  7. Advertise the task sequence to the collection that contains the target computer:

    1. In the Configuration Manager console, navigate System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences
    2. Select the task sequence to advertise from the Task Sequences pane.
    3. On the Action menu, or from the Actions pane, select Advertise to run the New Advertisement Wizard.

  8. Monitor the progress of the deployment task sequence using the Advertisement Status window on the Operating System Deployment node main screen. This window does not refresh automatically, so be sure to refresh the screen periodically to see the most current information about advertised task sequences.

See Also

Tasks

How to Deploy an Operating System Image to an Offline Computer
How to Deploy an Operating System Image to a New Computer Using Boot Media

Reference

New Task Sequence Wizard
Operating System Deployment: Task Sequence Editor


How to Perform a Side-by-Side Operating System Deployment

You can use Configuration Manager 2007 to perform a side-by-side computer migration. Side-by-side computer migrations are useful in computer upgrade scenarios when you want to move the user state and files from a source computer to a new, destination computer. Before you can perform a side-by-side migration you must import the destination computer into the Configuration Manager 2007 database and create a computer association between the source and destination computers.

Use the following procedure to perform a side-by-side computer migration.

Performing a side-by-side computer migration

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Computer Associations.

  2. Import the new destination computer into Configuration Manager 2007 database and then create a computer association between the source computer and the destination computer.

  3. To capture the user state from the source computer, create a Custom Task Sequence to capture the user state by using the Capture User State task sequence step. This task sequence step should be used in conjunction with the Request State Store task sequence step.

  4. To install the new operating system on the destination computer, use the task sequence editor, and then create the necessary installation task sequence steps to install the new operating system.

  5. To copy the user state from the state migration point to the destination computer, create a custom task sequence, and then add the Request State Store and Release State Store task sequence steps.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database
How to Create a Computer Association for a Side-by-Side Migration
How to Capture and Restore the User State

Other Resources

How to Deploy an Operating System


How to Deploy an Operating System Image Using Media

You can write task sequences and their related files and dependencies to a DVD or CD set or a USB drive. Using media will allow you to run the operating system deployment task sequence steps on computers that do not have a network connection or have a low bandwidth connection to your Configuration Manager 2007 site. You must specify a boot image that should be associated with the media you create, or the task sequence will fail.

If the media you create is going to be used in a different site than the Configuration Manager 2007 site it was created in, you must create a custom task sequence and add the Run Command Line task sequence step. You can add a command line to the Run command line task sequence step that will assign the new Configuration Manager 2007 client to the desired site.

Important
Boot media that is created in a parent site can only be used in child sites with no protected distribution points configured.

For more information about creating a custom task sequence, see How to Create a Custom Task Sequence

Use the following tasks to help you manage Configuration Manager 2007 task sequence operating system deployment media:

In This Section

How to Create Task Sequence Bootable Media

Contains the steps necessary to create bootable media that can be used to run a task sequence on a new computer.

How to Create Stand-alone Media

Contains the steps necessary to create stand-alone media from which to run your operating system image deployment. The stand-alone media will contain all necessary data to run the specified operating system deployment task sequences without requiring a connection to a Configuration Manager 2007 site.

How to Capture an Image from a Reference Computer Using Capture Media

Contains the steps necessary to capture an operating system image from a reference computer using capture media.

How to Deploy an Operating System Image to a New Computer Using Boot Media

Contains the steps necessary to deploy an operating system image to a new bare metal computer or a computer that is new to your Configuration Manager 2007 site.

How to Deploy an Operating System Image to an Offline Computer

Contains the steps necessary to deploy an operating system image to a computer that is not connected to the network or to a computer that is connected by a low bandwidth connection.

See Also

Other Resources

Tasks for Operating System Deployment


How to Create Task Sequence Bootable Media

Use this procedure to create bootable media that can be used to run a task sequence on a new computer. The media types you can create are CD, DVD or USB media. Task sequence bootable media can only be used in the site where the media was created. This will ensure that packages referenced by the task sequence are available to the task sequence.

Use the following procedure to create task sequence bootable media:

How to Create Task Sequence Bootable Media

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To launch the Task Sequence Media wizard, select the Actions menu and then select Create Task Sequence Media. Alternatively, you can click Create Task Sequence Media in the Actions pane.

  3. On the Select Media Type page, select Bootable Media and click Next.

  4. On the Media Type page specify the type of media you want to use with the cooperating system deployment. You can specify CD, DVD, or a USB flash drive as the type of media.

  5. Specify the name of the media file that you are creating on the Media file line. The media file is where Configuration Manager 2007 will save the files to. If multiple pieces of media are required Configuration Manager 2007 will add a sequence number to each piece of required media. If you are using USB media, specify the Drive letter that should be used to save the files using the drop down.

    Note
    If you are initiating a task sequence using USB media you must leave the USB media attached until you have successfully started the full operating system.

  6. On the Security page, you can specify a password to protect the media or require that the media request a self signed certificate. You can import an existing certificate by selecting Import Certificate and clicking the Browse button to locate the certificate you want to use. You should always assign a password or request a certificate to protect the bootable media and your Configuration Manager 2007 site.

  7. Specify the boot image that will run from the boot media on the Boot Image page. The media you specify will be used to boot the new computer, therefore the boot image specified must be of the appropriate architecture (x86, x64) and include the appropriate device drivers for the target computer. To view distribution points from child sites, select the Show distribution points from child sites check box.

  8. On the Confirmation page you can view the summary and click Finish to complete the wizard.

See Also

Tasks

Operating System Media Pre-Execution Hook

Other Resources

How to Deploy an Operating System Image Using Media


How to Create Stand-alone Media

You can create stand-alone media from which to run your operating system image deployment. The stand-alone media will contain all necessary data to run the specified operating system deployment task sequences without requiring a connection to a Configuration Manager 2007 site. Stand-alone media will operate whether or not a Configuration Manager 2007 client is installed on the target computer and it will operate without communicating with a Configuration Manager 2007 server infrastructure, such as a management point or distribution point.

Stand-alone media is suitable for use in environments where it is not practical to copy an operating system image or other large packages over the network or in environments with no network connectivity or low bandwidth network connectivity. You can create a CD set, a DVD set, or USB media to deploy the operating system image. When the media is created for CDs or DVDs, the output is a set of .iso files that need to be burned to the media by using a non-Microsoft program to create the CD or DVD set. Media that is created for a USB drive is written directly to the USB drive, therefore the USB drive must be connected when the media is created.

The following actions are not supported for use with stand-alone media:

  • Automatic application of device drivers from the driver catalog.
  • Installing software updates.
  • Installing software prior to an operating system deployment.

When you advertise a task sequence initiated from stand-alone media you must configure the correct version of the boot image and version of the HAL or the deployment will fail. You must have backup and restore rights on the local computer and the Configuration Manager 2007 user right before you can create a task sequence to create the media.

Use the following procedure to create stand-alone media.

To create stand-alone media

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To start the Task Sequence Media Wizard, click Actions on the menu, and then click Create Task Sequence Media. Alternatively, in the Actions pane, click Create Task Sequence Media.

  3. On the Select Media Type page, select Stand-alone Media, and then click Next.

  4. On the Media Type page, specify the type of media you want to use with the operating system deployment. You can specify CD, DVD, or a USB flash drive as the type of media. If you select CD/DVD set as the type of media you want to create, you then specify the capacity of the media. If the media size specified is too small to store the entire image, you must store the image using multiple CDs or DVDs. A sequence number will be added to the name of each piece of media created.

  5. On the Media file line, specify the name of the media file that you are creating. The media file is where Configuration Manager 2007 will save the files to. If multiple pieces of media are required, Configuration Manager 2007 will add a sequence number to each piece of required media. If you are using USB media, specify the Drive letter that should be used to save the files.

  6. On the Security page, you can assign a password to protect the task sequence steps and variables contained on your media. If you specify a password, the password will be required to use the media.

    Important
    Only the task sequence steps and variable information is encrypted. The package content is not encrypted; therefore, you should not include sensitive information in task sequence scripts. Sensitive information should be stored and implemented using variables.

  7. On the Stand-alone CD/DVD page, specify the task sequences you want to run from this media by clicking Browse and then selecting the desired task sequences. All associated task sequences and packages must be specified and saved onto the stand-alone media.

    Note
    All task sequences specified must be able to operate without communicating with the Configuration Manager 2007 infrastructure. The wizard does not validate the task sequences and any task sequences that require Configuration Manager 2007 communication will fail when run from stand-alone media.

  8. On the Distribution Points page, specify the distribution points that contain associated packages. You can display distribution points from child sites by selecting the Show distribution points from child sites check box. You can use the Add and Remove buttons to move packages so that they are available to Configuration Manager 2007 client computers.

  9. On the Variables page, specify the task sequence variables that should be added to the stand-alone media. For more information about using task sequence variables use the following link: About Task Sequence Variables.

See Also

Tasks

Operating System Media Pre-Execution Hook

Other Resources

How to Deploy an Operating System Image Using Media


How to Capture an Image from a Reference Computer Using Capture Media

Use this procedure to capture an operating system image from a reference computer using capture media. You can build a reference computer manually and then create media to capture the operating system image.

Important
You should not try to capture an image of a Configuration Manager 2007 site system.

How to Capture an Image from a Reference Computer Manually

  1. Build the reference computer.

    1. The computer must be a member of a workgroup.
    2. The local Administrator password must be blank.
    3. Do not require password complexity in the local system policy.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  3. On the Action menu, or from the Actions pane, select Create Task Sequence Media wizard. Select the Capture Media option and click Next.

  4. On the Media Type page specify the type of media you want to use for the capture media. You can specify a USB flash drive, CD, or DVD as the media type. If you specify a USB flash drive make sure it is connected to the computer so that the necessary files can be written directly to the device.

  5. On the Media file line, enter the save path and file name of the media that will be used to perform the installation. The ISO file that is created will be written to the media type location specified.

  6. Select the boot image that should be associated with the media. Click the Browse button to launch the Select a Boot Image dialog box. The available boot images are listed. Select the computer architecture you want and click OK. To specify the distribution point that contains the specified boot image, use the drop down.

    Note
    The media you create will run on any available computer architecture regardless of what is specified on the installation media.

  7. Create a bootable CD that contains the .ISO file you created by using an appropriate software application.

  8. Boot the computer into the full operating system and insert the capture CD.

    Note
    For all supported operating systems except Windows Vista and Windows Server® 2008, the sysprep folder ( %SystemDrive%\Sysprep ) must be present on the computer before you launch the capture CD.

  9. Run the Image Capture Wizard and identify the location for the captured image to be stored.

  10. Add the captured image to Configuration Manager 2007 as an image package:

    1. Navigate to: System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Operating System Images.
    2. On the Action menu, or from the Actions pane, select Add Operating System Image to launch the Add Operating System Image wizard. Complete the wizard to add the operating system image.


How to Deploy an Operating System Image to a New Computer Using Boot Media

You can use Configuration Manager 2007 to deploy an operating system image to a new bare metal computer or a computer that is new to your Configuration Manager 2007 site by using three basic steps:

  1. Import the new computer information into the Configuration Manager 2007 database.
  2. Use the Task Sequence Media Wizard to create bootable media that will initiate the operating system deployment.
  3. Create a task sequence step that will start the deployment initiated by the media.

Use the following procedure to deploy an operating system to a new computer.

To deploy an operating system to a new computer

  1. In the Configuration Manager console, navigate to System Center Configuration Manager/ Site Database / Computer Management / Operating System Deployment / Computer Associations.

  2. To add the computer to the Configuration Manager 2007 database, right-click the Computer Associations node, and then click Import Computer Information to start the Import Computer Information Wizard. You can import one computer of a set of computers by using the wizard.

  3. To create a bootable media set to initiate the operating system deployment, start the Create Task Sequence Media Wizard, and then on the Select Media Type page, select Bootable Media.

  4. Create the necessary task sequence steps that will perform the operating system deployment.

  5. Advertise the task sequence to the collection where the new computer was imported.

  6. To use the bootable media to initiate the deployment, log in to the computer operating system, insert the media into the target computer, and then start the deployment process.

To edit the task sequence to deploy an operating system using a USB drive

  1. In the Configuration Manager console, navigate to System Center Configuration Manager/ Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. In the results pane right-click the task sequence for the operating system deployment using bootable media.

  3. In the task sequence steps pane, select Restart Computer and then click the Options tab.

  4. Click Remove All, click Add Condition, and then select If statement. The If Statement Properties dialog box opens.

  5. Select Any condition, and then click OK.

  6. In the conditions pane, click Any.

  7. Click Add Condition, and then click Task Sequence Variable. The Task Sequence Variable dialog box opens.

  8. Add a condition where Variable is "_SMSTSLaunchMode" (without quotes), Condition is "equals" (without quotes), and Value is "UFD" (without quotes). Click OK to add the task sequence variable.

  9. Click Add Condition, and then click Task Sequence Variable. The Task Sequence Variable dialog box opens.

  10. Add a condition where Variable is "_SMSTSInWinPE" (without quotes), Condition is "equals" (without quotes), and Value is "false" (without quotes). Click OK to add the task sequence variable and then click OK to close the Task Sequence Editor. The task sequence has been edited to support USB boot media for operating system deployment.

See Also

Tasks

How to Advertise Task Sequences
How to Add a New Computer to the Configuration Manager Database
How to Create Task Sequence Bootable Media


How to Deploy an Operating System Image to an Offline Computer

You may need to deploy an operating system to a computer that is not connected to the network or to a computer that is connected by a low bandwidth connection. You can use Configuration Manager 2007 to create offline installation media that perform the installation.

Note
The target computer should not have an existing Configuration Manager 2007 client installed on it.

Use the following procedure to deploy an operating system to an offline computer.

To deploy an operating system to an offline computer

  1. In the Configuration Manager console, navigate to System Center Configuration Manager/ Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. To create a stand-alone media set, start the Task Sequence Media Wizard.

  3. In the Task Sequence Wizard, on the Select Media Type page, select Stand-alone media.

    If you selected CD/DVD set on the Media Type page, the files created are a set of .ISO files that need to be burned onto the media set. You can then use another product to burn the installation files onto the CD or DVD set.

    If you selected a USB flash drive on the Media Type page, the files will be created and saved directly to the USB flash drive.

    Important
    If you have specified a USB flash drive as the media type the USB flash drive must be connected to the server running the Configuration Manager 2007 administrator console when the image is created because the media files you create will be written directly to the USB flash drive. If there is a task sequence step that will cause the computer to restart, you must also configure the target computer's BIOS to boot from the hard disk or the computer will boot using the attached media.

  4. To start the operating system deployment, insert the media into the target computer, and then initiate the installation from the media you created. If there is no existing operating system on the target computer, you should insert or attach the installation media to the computer and restart the computer by using the installation media.

Note
Make sure the media you use to complete the installation is bootable.

See Also

Tasks

How to Create Stand-alone Media


How to Initiate Operating System Image Deployments Using PXE

You can use the PXE protocol to initiate operating system deployments to Configuration Manager 2007 computers and servers.

Use the following tasks to help you perform PXE initiated operating system deployments:

In This Section

How to Add Boot Images to the PXE Service Point

How to Configure the PXE Service Point

How to Deploy an Operating System Image using PXE

Administrator Workflow: PXE Deployment

See Also

Other Resources

Tasks for Operating System Deployment


How to Add Boot Images to the PXE Service Point

When establishing a PXE service point, a default shared folder, called SMSPXEIMAGES$, is created to store boot images. Before using PXE to initiate operating system deployments, you must make the required boot images available on the PXE service point.

Use the following procedure to add boot images to the PXE service point.

To add boot images to the PXE service point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Boot Images.

  2. Run the Manage Distribution Points Wizard by right-clicking the boot image you want to add to the PXE service point, and then select Manage Distribution Points.

  3. On the Welcome page, click Next.

  4. On the Select Destination Distribution Point page, specify the task you want to perform, and then click Next.

  5. On the Package page, select the PXE service point you want to copy the image to, and then click Next.

    Note
    The PXE service point displays in the list with the associated SMSPXEIMAGES$ shared folder displayed in the path.

  6. On the Completion page, verify the boot image you are copying to the PXE service point, and then click Next.

  7. On the Summary page, click Next.

  8. To close the wizard, click Close.

See Also

Other Resources

How to Initiate Operating System Image Deployments Using PXE


How to Configure the PXE Service Point

You can use the PXE protocol to initiate operating system deployments to Configuration Manager 2007 client computers. Configuration Manager 2007 uses the PXE service point site role to initiate the operating system deployment process. The PXE service point must be configured to respond to PXE boot requests made by Configuration Manager 2007 clients on the network and then interact with Configuration Manager 2007 infrastructure to determine the appropriate deployment actions to take.

You must assign the PXE service point site role to a server running Windows Server 2003.

Important
If you are using Windows Server 2003 you must install the Remote Installation Services (RIS) and the Windows Automated Installation Kit (Windows AIK). If you are using Windows Server 2003, Service Pack 2 you must install the Windows Deployment Services using Add or Remove Programs. Configuration Manager 2007 SP1 and Configuration Manager 2007 R2 require the Vista SP1 version of Windows AIK.

The PXE protocol is not secure. Both the PXE server and the PXE client should be located on a physically secure network, such as in a datacenter to prevent unauthorized access to your site.

Use the following procedure to create the PXE service point site role.

To create the PXE service point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. To start the New Site Role Wizard, click Action on the Configuration Manager console, and then click New Roles. Alternatively, in the Actions pane, or right-click Site System Roles, and then click New Roles.

    Note
    You can deploy and configure multiple PXE service point servers depending on your network topology.

  3. On the General page of the wizard, optionally provide the fully qualified host name (FQDN) for the server, and then specify which account credentials should be used to install the site system role.

  4. On the System Role Selection page, select PXE Service Point.

  5. On the PXE-General page, specify whether the PXE service point is enabled to respond to incoming PXE requests.

    Note
    This option will temporarily disable this PXE server and should be selected only if there are conflicting PXE servers on the network.

  6. You can specify a password for computers that boot to PXE.

    Important
    For unattended deployments, do not specify a password. If a password is specified, a user must be present at the client computer to enter the password or the deployment will fail.

  7. Specify whether this server will respond to PXE service requests on all network interface adapters or a specific network interface adapter in the Interfaces section by entering the MAC address for all applicable interfaces.

    If multiple PXE service points are used, enter the number of seconds the PXE service point should wait before responding to PXE requests in the Delay box. Use this option only when there are multiple PXE servers on the same subnet.

  8. On the PXE-Database page, specify the account the PXE service point should use to connect with the Configuration Manager 2007 database. The account specified must have the necessary permissions on the client computers running Microsoft SQL Server and Configuration Manager 2007 client permissions. For more information, see About the PXE Service Point Database Connection Account. You will also need to specify whether the PXE service point will create a self-signed certificate or whether a certificate should be imported by the user. If you import a certificate it must be issued by a certification authority (CA) trusted by the site.

See Also

Concepts

How to Deploy an Operating System Image using PXE


How to Deploy an Operating System Image using PXE

You can use the pre-boot execution environment (PXE) to initiate operating system deployments to computers and servers that are known by the Configuration Manager 2007 environment.

PXE is used to initiate the operating system installation. The PXE service point site system will respond to PXE requests from computers on the network and then work with the Configuration Manager 2007 environment to determine the next appropriate action to take. For new operating system deployments the first step is usually to download a version of Windows PE to the target computer.

Important
By default, when you create the PXE service point an associated distribution point is also created with a network share called SMSPXEIMAGES$. This network share contains the boot images and must be accessible by the target computers. You should only add boot images that will be used as part of your PXE initiated deployment to this share. You must also add the boot images to the PXE service point before you add them to a standard distribution point so the logged in administrator will have access to the associated files.

You will need at least one boot image for each type of processor architecture present in your Configuration Manager 2007 environment on the distribution point. For example, if you have computers with x64 processors in your environment you will need at least one x64 boot image assigned to the PXE distribution point even if you only plan to deploy x86 operating systems. This is because PXE stub needs some of the native files contained in the boot image to identify the computer before the task sequence can be started.

Any boot image that is referenced by an operating system deployment task sequence must reside on a PXE distribution point and a standard distribution point accessible by the target computer. For example; if you advertise a task sequence that contains an x86 boot image and the target computer has an x64 chip architecture you must have an x86 and x64 boot image available on the PXE distribution point. Because the task sequence contains an x86 boot image, in order for the x64 target computer to initiate the task sequence you must copy an x86 boot image to an accessible standard distribution point. The x86 boot image will be used to initiate the task sequence and the target computer will then download the correct boot image version from the location on the PXE distribution point.

To use PXE to initiate operating system deployments you must have a PXE service point site role installed and configured properly. For more information about setting up the PXE service point site role, click the following link: How to Configure the PXE Service Point

Use the following procedure to deploy an operating system using PXE:

Procedures

To Deploy an Operating System using PXE

  1. Import the target computer information and assign the computer to a Configuration Manager 2007 collection. For more information about importing new computers into Configuration Manager 2007 see: How to Add a New Computer to the Configuration Manager Database

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  3. Establish the Configuration Manager 2007 PXE service point site role. For more information about creating the PXE service point site role see: How to Configure the PXE Service Point.

  4. Create and advertise the PXE operating system deployment task sequence to the target collection or device. You can assign a mandatory or optional advertisement. If you specify an optional advertisement there must be a user present to PXE boot the computer. You can only assign one mandatory advertisement to a target computer and you must specify the time when the mandatory advertisement should be run.

  5. To initiate the operating system image installation, you must configure the target computer BIOS to PXE boot. PXE boot the target computer. For mandatory PXE advertisements the computer will automatically boot using PXE. For optional advertisements there must be a user present to PXE boot the computer.

    • If you have specified that no password is required to establish the connection to the PXE service point, PXE boot the computer to initiate the operating system deployment.
    • For additional security, you can assign a password to establish a connection to the PXE service point. If you have specified that a password is required to establish a connection to the PXE service point, PXE boot the computer to initiate the operating system deployment and enter the password. For the operating system deployment to continue the password must be entered at the Configuration Manager 2007 client computer or the task sequence will not run.
    Important
    If you are using the English version of Windows PE and communicating with a Configuration Manager 2007 site server running a double byte character set you should assign a password containing only simple characters or not require a password for PXE initiated deployments.

  6. Configuration Manager 2007 will connect to the assigned management point and retrieve the assigned policy and complete the operating system deployment.

See Also

Tasks

How to Configure the PXE Service Point

Concepts

Planning for PXE Initiated Operating System Deployments
Administrator Workflow: PXE Deployment

Other Resources

Planning for Operating System Deployment


Administrator Workflow: PXE Deployment

The following flowchart displays the actions associated with a PXE initiated operating system deployment in the order in which they generally take place.

PXE Deployment Workflow

See Also

Other Resources

How to Initiate Operating System Image Deployments Using PXE


How to Deploy an Operating System Image via Multicast

Multicasting is an operating system deployment feature in Configuration Manager 2007 R2 that conserves network bandwidth by simultaneously sending data to multiple clients rather than copying and sending the data to each client over a separate connection.

In This Section

Prerequisites for Multicast for Operating System Deployment

How to Enable Multicast for Operating System Deployment

Administrator Checklist for Multicast for Operating System Deployment

See Also

Other Resources

Tasks for Operating System Deployment


Prerequisites for Multicast for Operating System Deployment

Topic last updated—January 2008

The following sections describe the external and internal prerequisites or dependencies that are required for the multicast feature of Configuration Manager 2007 operating system deployment.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Dependencies External to Configuration Manager 2007

The following table lists external dependencis for the muliticast feature.

Dependency | More Information
Windows Server 2008 | Windows Server 2008 must be running on the distribution point enabled for multicast.
Windows Deployment Services (WDS) | The Windows Deployment Services for Windows 2008 must be installed before multicast is enabled on the distribution point server.
Internet Information Services (IIS) with extensions | Internet Information Services must be installed before multicast is enabled on the distribution point server. ISAPI extensions and IIS 6 management compatibility must be installed.
Network firewall configuration | Network firewalls must be enabled so that UDP ports used by multicast for operating system deployment are accessible by Configuration Manager 2007 clients. For information about configuring these ports, see ConfigMgr Distribution Point Properties: Multicast Tab.
Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients) | Operating system deployment package transfer using IIS requires that Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients) be enable. For information about configuring this property, see ConfigMgr Distribution Point Properties: General Tab.

Configuration Manager 2007 Dependencies

The following table lists the dependencies for the Configuration Manager 2007 operating system deployment multicast feature.

Dependency | More Information
Configuration Manager 2007 SP1 and Configuration Manager 2007 R2 | The site server must have both Configuration Manager 2007 SP1 and Configuration Manager 2007 R2 installed.
Configuration Manager 2007 operating system deployment | The Configuration Manager site must be configured to support operating system deployment. For more information, see Prerequisites for Operating System Deployment and Configuring Operating System Deployment.

See Also

Tasks

How to Enable Multicast for Operating System Deployment

Concepts

Prerequisites for Operating System Deployment

Other Resources

Tasks for Operating System Deployment


How to Enable Multicast for Operating System Deployment

Topic last updated—January 2008

Multicast is an operating system deployment feature in Microsoft System Center Configuration Manager 2007 R2 that conserves network bandwidth by simultaneously sending data to multiple clients rather than sending a copy of the data to each client over a separate connection. Other packages can be distributed using multicast to target computers running in WinPE when used inside a command line action. Before enabling multicast, see Prerequisites for Multicast for Operating System Deployment. To use multicast to distribute operating systems, you must perform the following procedures:

  1. Enable multicast on the distribution point.
  2. Configure the operating system image package to use multicast.
Note
The information in this topic applies only to Configuration Manager 2007 R2.

To enable multicast for a distribution point

  1. In the Configuration Manager 2007 console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site System /, and then click the site name of the server.

  2. In the results pane, right-click ConfigMgr distribution point, and then select Properties. The ConfigMgr Distribution Point Properties dialog box opens.

  3. Click the Multicast tab, and select the Enable as a multicast distribution point check box.

  4. Configure the multicast settings appropriate for your Configuration Manager 2007 environment. Multicast settings include the following:

    • Multicast Internet protocol (IP) address range
    • User datagram protocol (UDP) port range for multicast
    • Multicast schedule cast option (optional)
    • Network profile

  5. Click OK.

To allow an operating system image package to use multicast

  1. In the Configuration Manager 2007 console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Operating System Images.

  2. In the results pane, right-click the package to be distributed using multicast, and then select Properties. The Operating System Properties dialog box opens.

  3. Click the Distribution Settings tab, and select the Allow this package to be transferred using multicast check box.

  4. Configure the multicast settings appropriate for the package. Multicast settings include the following:

    • Encrypt packages when transferred via multicast. Use this option if the package contains sensitive information. If not encrypted, the contents of the package will be visible in clear text on the network and could be read by other computers connected to the network.
    • Transfer this package only via multicast. This option ensures that the package will be distributed using multicast, thereby conserving network bandwidth. If multicast is unavailable, the package will not be distributed.

  5. Click OK.

See Also

Reference

ConfigMgr Distribution Point Properties: Multicast Tab

Concepts

Prerequisites for Multicast for Operating System Deployment


Administrator Checklist for Multicast for Operating System Deployment

Topic last updated—March 2008

The following checklist for Configuration Manager 2007 R2 multicast for operating system deployment provides the steps necessary to enable and configure the multicast settings.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Step | More Information
Review the network considerations and requirements for multicast for operating system deployment. | Administrator Checklist for Multicast for Operating System Deployment
Ensure that the site server that will support multicast for operating system deployment meets all prerequisites. | Prerequisites for Multicast for Operating System Deployment
Enable multicast on the site server that will provide multicast support for operating system deployment. | How to Enable Multicast for Operating System Deployment
Configure the multicast settings appropriately for the network environment. | About Configurations for Multicast for Operating System Deployment

See Also

Concepts

About Multicast for Operating System Deployment


How to Deploy an Operating System to Unknown Computers

Topic last updated—March 2008

Unknown computer support is an operating system deployment feature in Configuration Manager 2007 R2 that allows unmanaged systems to be discovered and receive an operating system deployment.

Important
If you enable unknown computer support, any unknown computers that use PXE-initiated operating system deployments will attempt to run mandatory task sequences. Mandatory task sequences that include operations such as Apply Operating System Image or Format and Partition disk will destroy all data on those unknown systems.

Before enabling unknown computer support for operating system deployment, ensure the site system meets all prerequisites for unknown computer support. To learn more about the prerequisites for unknown computer support, see How to Enable Unknown Computer Support for Operating System Deployment.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

How to Enable Unknown Computer Support for Operating System Deployment

How To Deploy Operating Systems Using Unknown Computer Support

How to Create an Exclusion List for Unknown Computer Support


How to Enable Unknown Computer Support for Operating System Deployment

Topic last updated—March 2008

Unknown computer support is an operating system deployment feature in Configuration Manager 2007 R2 that allows unmanaged systems to be discovered and receive operating system deployment.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Before enabling unknown computer support for operating system deployment, ensure the site system meets all prerequisites for unknown computer support.The following table provides information and links about Configuration Manager 2007 prerequisites for the operating system deployment unknown computer support feature.

Important
If you enable unknown computer support, any unknown computers that use PXE-initiated operating system deployments will attempt to run mandatory task sequences. Mandatory task sequences that include operations such as Apply Operating System Image or Format and Partition disk will destroy all data on those unknown systems.

Dependency | More Information
Configuration Manager 2007 SP1 and Configuration Manager 2007 R2 | The site server must have both Configuration Manager 2007 SP1 and Configuration Manager 2007 R2 installed.
Configuration Manager 2007 operating system deployment | The Configuration Manager site must be configured to support operating system deployment. For more information, see Prerequisites for Operating System Deployment and Configuring Operating System Deployment.

Use the following procedures to enable unknown computer support either for a PXE service point or for bootable media.

To enable unknown computer support for a PXE service point

  1. In the Configuration Manager 2007 console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site System /, and then click the site name of the server. If the site server has not been enabled as a PXE service point, see How to Configure the PXE Service Point.

  2. In the results pane, right-click ConfigMgr PXE Service Point, and then select Properties to open the ConfigMgr PXE Service Point Properties dialog box.

  3. Click the General tab, select the Enable unknown system support check box, and then click OK.

To enable unknown computer support for bootable media

  1. In the Configuration Manager 2007 console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences.

  2. Right-click Task Sequences, and then select Create Task Sequence Media to open the Task Sequence Media Wizard.

  3. On the Select Media Type page, select Bootable media, and then click Next.

  4. On the Media Type page, select the media type and file parameters, and then click Next.

  5. Select the Enable unknown computer support check box, and complete the rest of the security settings for the bootable media. Click Next.

  6. Specify the boot image and distribution point for the boot image, and then click Next.

  7. Finish the Task Sequence Media Wizard. The bootable media can now be used to deploy operating systems to unknown computers.

See Also

Reference

ConfigMgr PXE Service Point Properties: General Tab
Task Sequence Media Wizard - Bootable Media Security Page

Other Resources

How to Deploy an Operating System
Tasks for Operating System Deployment


How To Deploy Operating Systems Using Unknown Computer Support

Topic last updated—March 2008

Unknown computer support is an operating system deployment feature in Configuration Manager 2007 R2 that allows unmanaged systems to be discovered and receive an operating system deployment.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To prevent computers from accidentally being reimaged, the administrator can create an exclusion list. The exclusion list provides a list of MAC addresses to which PXE server should never send task sequences to install an operating system. PXE requests from computers whose MAC addresses appear on the exclusion list will be ignored by the PXE server. For more information about how to create an exclusion list, see How to Create an Exclusion List for Unknown Computer Support.

Important
Making an advertisement for operating system deployment mandatory might result in computers being unintentionally reinstalled and result in loss of data. If the environment uses mandatory advertisements for operating system deployment to unknown computers then you should ensure computers on your network are not set to PXE boot by default unless they should be reinstalled.

Operating system deployment to an unknown computer can be initiated using either PXE boot or boot media. Use the following procedures to enable unknown computer support either for a PXE service point or for bootable media.

Important
If you enable unknown computer support, any unknown computers that use PXE-initiated operating system deployments will attempt to run mandatory task sequences. Mandatory task sequences that include operations such as Apply Operating System Image or Format and Partition disk will destroy all data on those unknown systems.

To deploy operating systems using unknown computer support

  1. Ensure unknown computer support is enabled. For more information about enabling unknown computer support, see How to Enable Unknown Computer Support for Operating System Deployment.

  2. Prepare the PXE service point or boot media for the target computer.

    1. To begin operating system deployment using a preboot execution environment (PXE), add a PXE boot image to the PXE service point. For more information about how to create boot images for PXE operating system deployment, see How to Add Boot Images to the PXE Service Point.
    2. To begin operating system deployment via boot media, create bootable media for operating system deployment. For more information about creating bootable media, see How to Create Task Sequence Bootable Media.

  3. Prepare operating system images for the target computers. For more information about creating operating system images and operating system image packages, see How to Add Images.

  4. Create a task sequence to install an operating system using either PXE boot or boot media. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment, right click Task Sequences, select New, and then click Task Sequence. Complete the New Task Sequence Wizard.

  5. Advertise the task sequence to boot media and PXE . In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment / Task Sequences, in the results pane right-click the task sequence, and then select Advertise. On the General page of the New Advertisement Wizard, ensure that the Make the task sequence available to boot media and PXE check box is selected, and then complete the New Advertisement Wizard as appropriate for your environment.

  6. To install an operating system on an unknown computer using boot media, create a boot media. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment, right-click Task Sequences, and then click Create Task Sequence Media to start the Task Sequence Media Wizard. Select Bootable Media in the Task Sequence Media Wizard and then complete the wizard. The Enable unknown computer support option is selected by default and should remain enabled.

See Also

Tasks

How to Enable Unknown Computer Support for Operating System Deployment

Concepts

About Unknown Computer Support for Operating System Deployment


How to Create an Exclusion List for Unknown Computer Support

Topic last updated—March 2008

Unknown computer support is an operating system deployment feature in Configuration Manager 2007 R2 that allows unmanaged systems to be discovered and receive operating system deployment. The exclusion list provides a list of computer MAC addresses to which the PXE server should not send task sequences to install an operating system. PXE requests from computers whose MAC addresses appear on the exclusion list will be ignored by the PXE server.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

How to create an exclusion list for unknown computer support

  1. Create a new text file on the PXE site server. Name the file appropriately—for example, exceptions.txt.

  2. Using a standard text-editing program such as Notepad, edit the new text file to add the MAC addresses of computers to be ignored by the PXE server. The MAC address elements should be separated by colons and each MAC address should be on a separate line. For example, 01:23:45:67:89:ab. Save and close the exception list file.

  3. Edit the registry of the PXE site server to create a MACIgnoreListFile registry key HKLM\Software\Microsoft\SMS\PXE with the string value of the full path of the text file location on the PXE site server.

See Also

Concepts

About Unknown Computer Support for Operating System Deployment


Troubleshooting Operating System Deployment

The following links provide information to help troubleshoot the operating system deployment feature in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

In This Section

Log Files for Operating System Deployment

Specifies information about the operating system deployment log files.

Monitoring Operating System Deployments

Specifies information about monitoring operating system deployments.

Operating System Deployment Issues

Specifies information about the common issues for operating system deployment and provides the steps to help resolve the issues.

See Also

Concepts

Troubleshooting Operating System Deployment Using Custom Error Codes

Other Resources

Technical Reference for Operating System Deployment


Log Files for Operating System Deployment

Topic last updated—March 2007

The log files in Microsoft System Center Configuration Manager 2007 provide detailed information about the associated components and can be helpful when verifying functionality or when troubleshooting issues.

Operating System Deployment Log Files

The following table provides information about the log files and their default locations that are created when using Configuration Manager 2007 operating system deployment.

Log File Name Description

CCMSetup.log

Provides information about client-based operating system actions.

Log file location:

%windir%\system32\ccmsetup

CreateTSMedia.log

Provides information about task sequence media when it is created. This log is generated on the computer running the Configuration Manager 2007 administrator console.

Log file location:

<ConfigMgrInstallationPath>\%temp%

DriverCatalog.log

Provides information about device drivers that have been imported into the driver catalog.

Log file location:

<ConfigMgrInstallationPath>\logs

MP_ClientIDManager.log

Provides information about the Configuration Manager 2007 management point when it responds to Configuration Manager 2007 client ID requests from boot media or PXE. This log is generated on the Configuration Manager 2007 management point.

Log file location:

<ConfigMgrInstallationPath>\SMS_CCM\Logs

MP_DriverManager.log

Provides information about the Configuration Manager 2007 management point when it responds to a request from the Auto Apply Driver task sequence action. This log is generated on the Configuration Manager 2007 management point.

Log file location:

<ConfigMgrInstallationPath>\SMS_CCM\Logs\

MP_Location.log

Provides information about the Configuration Manager 2007 management point when it responds to request state store or release state store requests from the state migration point. This log is generated on the Configuration Manager 2007 management point.

Log file location:

<ConfigMgrInstallationPath>\SMS_CCM\Logs

Pxecontrol.log

Provides information about the PXE Control Manager.

Log file location:

<ConfigMgrInstallationPath>\sms\logs\

PXEMsi.log

Provides information about the PXE service point and is generated when the PXE service point site server has been created.

Log file location:

<ConfigMgrInstallationPath>\sms\logs

PXESetup.log

Provides information about the PXE service point and is generated when the PXE service point site server has been created.

Log file location:

<ConfigMgrInstallationPath>\sms\logs

Setupact.log, Setupapi.log, Setuperr.log

Provides information about Windows Sysprep and setup logs.

Log file location:

%windir%

SmpIsapi.log

Provides information about the state migration point Configuration Manager 2007 client request responses.

Log file location:

<InstallationPath>\SMS_CCM\Logs

Smpmgr.log

Provides information about the results of state migration point health checks and configuration changes.

Log file location:

<ConfigMgrInstallationPath>\sms\logs\

SmpMSI.log

Provides information about the state migration point and is generated when the state migration point site server has been created.

Log file location:

<ConfigMgrInstallationPath>\sms\logs

Smsprov.log

Provides information about the SMS Provider.

Log file location:

<ConfigMgrInstallationPath>\logs

Smspxe.log

Provides information about the Configuration Manager 2007 PXE service point.

Log file location:

<ConfigMgrInstallationPath>\sms_ccm\logs

SMSSMPSetup.log

Provides information about the state migration point and is generated when the state migration point site server has been created.

Log file location:

<ConfigMgrInstallationPath>\sms\logs

Smsts.log

General location for all operating system deployment and task sequence log events.

Log file location:

  • If task sequence completes when running in the full operating system with an Configuration Manager 2007 client installed on the computer: <CCM Install Dir>\logs
  • If task sequence completes when running in the full operating system with no Configuration Manager 2007 client installed on the computer: %temp%\SMSTSLOG
  • If task sequence completes when running in WindowsPE: <largest fixed partition>\SMSTSLOG
Note
<CCM Install Dir> is %windir%\system32\ccm\logs for most Configuration Manager 2007 clients and <Configuration Manager 2007 installation drive>\SMS_CCM for the Configuration Manager 2007 site server

TaskSequenceProvider.log

Provides information about task sequences when they are imported, exported, or edited.

Log file location:

<ConfigMgrInstallationPath>\logs

USMT Log loadstate.log

Provides information about the USMT regarding the restoring of user state data.

Log file location:

%windir%\system32\ccm\logs

USMT Log scanstate.log

Provides information about the User State Migration Tool (USMT) regarding the capture of user state data.

Log file location:

%windir%\system32\ccm\logs

Multicast for Operating System Deployment Log Files

The following table provides information about the log files and their default locations that are created when using multicast for Configuration Manager 2007 operating system deployment.

Note
The information in this section applies only to Configuration Manager 2007 R2.

Log File Name | Description
McsMgr.log | Provides information about multicast availability and changes to multicast configuration. Log file location: <ConfigMgrInstallationPath>\sms\logs
McsSetup.log | Provides information about the multicast service point role setup and is generated when the multicast service point site server has been created. It confirms that the environment has been successfully set up and run the .msi file. Log file location: <ConfigMgrInstallationPath>\sms\logs
McsMSI.log | Provides information about the .msi setup for the multicast service point and is generated when the multicast service point site server has been created. Log file location: <ConfigMgrInstallationPath>\sms\logs
McsExec.log | Provides information about multicast packages, namespace management, session creation, and health checking for multicast. Log file location: <ConfigMgrInstallationPath>\sms_ccm\logs
McsISAPI.log | Provides information about the multicast service point Configuration Manager 2007 client request responses. Log file location: <ConfigMgrInstallationPath>\SMS_CCM\Logs
McsPrv.log | Provides information about the interaction between multicast components and the Windows Deployment Service (WDS) components—for example, the creation, reading and distribution of namespaces. Log file location: <ConfigMgrInstallationPath>\SMS_CCM\Logs
McsPerf.log | Provides information about the multicast performance counter updates. Log file location: <ConfigMgrInstallationPath>\SMS_CCM\Logs

See Also

Concepts

Troubleshooting Operating System Deployment


Monitoring Operating System Deployments

Topic last updated -- November 2007

At various points in the operating system deployment process, you can use Microsoft System Center Configuration Manager 2007 reports to view the progress for operating system deployments or to monitor the state of operating system deployments.

The following table lists the features that are available for monitoring operating system deployments.

Feature Description

Operating system deployment custom error codes

You can use operating system custom error codes to troubleshoot operating system deployment failures. The following link provides more information about operating system deploymnet custom error codes: Troubleshooting Operating System Deployment Using Custom Error Codes

Operating System Deployment Reports

Configuration Manager 2007 provides several reports that provide information about operating system deployments to all target computers in a specified collection. Each report lets you drill down to see detailed status of individual computers. For more information about operating system deployment reports use the following link: About Feature Reports for Operating System Deployment

For example, you can see what step of the deployment task sequence failed to run. The following procedure provides the steps necessary to find reports related to task sequences:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.
  2. In the Reports pane, enter task sequence in the Look for field.
  3. Select Category from the Search in drop down list.
  4. Click Find Now.
  5. Select the report you want to run, and choose the Action Run.

See Also

Concepts

Troubleshooting Operating System Deployment


Operating System Deployment Issues

Topic last updated -- November 2007

This section provides information to help troubleshoot operating system deployment issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

In This Section

Troubleshooting General Operating System Deployment Issues

Troubleshooting Media Initiated Operating System Deployments

Troubleshooting Network Access Protection and Operating System Deployment

Troubleshooting Operating System Deployment Boot Image Issues

Troubleshooting PXE Initiated Operating System Deployment Issues

Troubleshooting Task Sequence Initiated Operating System Deployment Issues

See Also

Concepts

Troubleshooting Operating System Deployment


Troubleshooting General Operating System Deployment Issues

Topic Last Updated—August 2008

This section provides information to help troubleshoot general operating system deployment issues in Configuration Manager 2007. This content might have been updated since the publishing of this version. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

You Cannot Install Windows XP or Windows Server 2003 Successfully After You Use Windows Vista or Windows PE 2.0 to Create Partitions on a Hard Disk

You use Windows Vista or the Windows Preinstallation Environment (Windows PE) 2.0 to create partitions on a hard disk. After you do this, you try to install Microsoft Windows Server 2003 or Windows XP and it fails.

Solution

This issue occurs because Windows Vista and Windows PE 2.0 create disk partitions differently than Windows XP and Windows Server 2003. This occurs only on computers that use certain BIOS firmware. For more information about the required workaround see the following:

Windows XP—http://go.microsoft.com/fwlink/?LinkId=94633

Windows Server 2003—http://go.microsoft.com/fwlink/?LinkId=94635

Computers Are Not Running Software Distribution Advertisements

Software distribution advertisements are failing on Configuration Manager 2007 clients running all versions of the following operating systems:

  • Windows 2000
  • Windows XP
  • Windows 2000 Server
  • Windows 2003 Server

When you deploy an image from one of these operating systems, Configuration Manager 2007 software distribution advertisements might be one hour behind due to revised Daylight Savings Time laws in many countries.

Solution

You can install an update to your computer that will automatically adjust the computer clock to the correct date in 2007 due to revised Daylight Savings Time laws. For more information about how to install the required update, see http://go.microsoft.com/fwlink/?LinkId=94809.

A Failure Occurs When Deploying Operating Systems to Computers with no NTFS Boot Partition

When you deploy an operating system image with no NTFS boot partition, the operating system deployment fails and returns an error.

Solution

You must convert the hard disk to NTFS format before staging a boot image. You can use the Run Command Line task sequence step to perform the hard disk conversion. Enter the following command for the Command Line of the Run Command Line task sequence step:

%windir%\system32\convert.exe c: /fs:ntfs /x

This command assumes that the boot partition is on hard drive "C".

The following potential results are returned from this action:

  • 0: Indicates the hard disk was successfully converted to NTFS.
  • 4: Indicates that the hard disk was already formatted as NTFS and no action was taken.

Clients Lose Historical Data or It Is Unmanaged and Missing from the All Systems Collection

Configuration Manager 2007 ensures that each Configuration Manager 2007 client is uniquely identified. If a duplicate hardware ID is identified, by default Configuration Manager 2007 automatically creates a new client record for the duplicate record. This setting lets you easily upgrade or deploy clients that might have duplicate hardware IDs, without requiring manual intervention. However, with this setting, a computer that has been re-imaged or restored from backup will have a new record created, which results in all previous information about that client being no longer available for reporting purposes.

An alternative configuration is to require the administrator to manually reconcile all conflicting records when they are detected. This setting results in affected clients being unmanaged and no longer displaying in collections but displaying in the Conflicting Records node. These clients will remain unmanaged until the administrator resolves the conflict.

For more information, see the section "Managing Client Identity" in What's New in Client Deployment for Configuration Manager.

Solution

When a new record is created, you cannot get back previous data for the client, but you can reconfigure Configuration Manager so that it does not automatically create new records in future.

If clients are unmanaged and missing from collections, check the Conflicting Records node so that you can manually reconcile the records by merging them, by creating a new record, or by blocking the new record.

For more information about how to configure the site-wide setting and how to manually resolve conflicting records, see How to Manage Conflicting Records for Configuration Manager Clients.

The SMSPXE.log Becomes Full When Deploying or Updating a Package Using Binary Delta Replication

When you deploy a package using binary delta replication, the SMSPXE.log can fill up in less than one minute.

Solution

When the SMSPXE.log is full, a new log file is created and the date and time are appended to the title. The new log file is created in the following directory:

Configuration Manager 2007 Site Server: %windir%\sms\logs

Other Computer: %windir%\system32\ccm\logs

Generic Error Message Returned When Deploying Windows Vista Operating System Image

When you perform a scripted operating system installation of Windows Vista, you receive a generic error message.

Solution

This issue might be caused if you specify a nonvalid PID with the operating system deployment. All setup logs are also copied into the task sequence logs directory where you can locate additional information.

For more information about the operating system deployment logs, see Log Files for Operating System Deployment.

Operating System Deployment Task Sequence Could Not Export Certificates from Certificate Store

You manually import one or more non-exportable certificates to the Configuration Manager 2007 certificate store and the task sequence fails to run because it could not export certificates from the Configuration Manager 2007 certificate store.

Solution

Do not manually import certificates into the Configuration Manager 2007 store.

Operating System Images Captured Before Daylight Savings Time Update Might Fail

Beginning in 2007, daylight saving time (DST) has been extended in the United States. DST started on March 11, 2007, which is three weeks earlier than usual, and it ended on November 4, 2007, which is one week later than usual. This resulted in a new DST period that is four weeks longer than in previous years. Operating system images captured before the daylight savings time update was applied might fail when performing the install software action step after the new operating system is installed.

Solution

In order to ensure that the task sequence does not fail, the operating system to be installed should have the DST update installed or the activation and expiration time of the task sequence should be outside the revised DST dates. For more information about the daylight savings time (DST) update, see http://go.microsoft.com/fwlink/?LinkId=108434.

New Users Are Not Added Using New Computer Association Wizard

In Configuration Manager 2007 SP1 and R2, using the Create New Computer Association Wizard to add new users to the computer fails to add the new users. The wizard states that the tasks have been successfully completed, but the new users are not added.

Solution

To add users to a new computer association, complete the New Computer Association Wizard without adding users. Right-click the new association, select Specify User Accounts, and then add the new user accounts. The users will be added.

Editing Task Sequences with Later Versions of the Administrator Console Is Not Supported

Editing Configuration Manager 2007 task sequences with a Configuration Manager 2007 SP1 or Configuration Manager 2007 R2 console is not supported. An error will appear when you are attempting to edit task sequences that were created on earlier versions of Configuration Manager 2007.

Solution

Do not use Configuration Manager 2007 SP1 or later versions to edit task sequences that were created on earlier versions of Configuration Manager 2007.

See Also

Concepts

Troubleshooting Operating System Deployment

Other Resources

Operating System Deployment Issues


Troubleshooting Media Initiated Operating System Deployments

Topic last updated -- November 2007

This section provides information to help troubleshoot media initiated operating system deployment issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

Missing Operating System Error When Booting Using USB Media

When you start a target computer using USB media and you receive a "Missing Operating System" error.

Solution

Some computer BIOS versions do not recognize all USB media as bootable. Use different USB media to start the computer.

Hash Value Errors when Creating Task Sequences

If you are not an administrator on the computer where you are running the Configuration Manager 2007 console, you will get the error "The hash value is not correct" when trying to create task sequence media.

Solution

Use an account that is an administrator on the Configuration Manager 2007 console computer when creating task sequence media. Users of the Configuration Manager 2007 console do not require administrative rights to the Configuration Manager 2007 console computer. However, if the user does not have local administrator rights, the user must first run MMC and then add the Configuration Manager 2007 snap-in to create a new console session. The user can then save the console session and run the new session without administrator rights on the local computer.

The exception is when you try to create task sequence media. If you are not an administrator on the computer where you are running the Configuration Manager 2007 console, you will get the error "The hash value is not correct" when trying to create task sequence media.

See Also

Concepts

Troubleshooting Operating System Deployment

Other Resources

Operating System Deployment Issues


Troubleshooting Network Access Protection and Operating System Deployment

Topic last updated -- November 2007

This section provides information to help troubleshoot network access protection (NAP) and operating system deployment issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

An Operating System Deployment Installs the Configuration Manager Client before Configuring Network Access Protection in Windows

When you deploy an operating system in a Network Access Protection environment using the operating system deployment feature in Configuration Manager, and you use custom task sequence steps to enable the enforcement clients and start the Network Access Protection in Windows, failing to add a restart step to the task sequence can result in the computer being non-compliant and being unable to successfully remediate.

Solution

Manually restart the computer.

To correct the operating system deployment configuration, see Planning for Operating System Deployment in a NAP-Enabled Environment

See Also

Concepts

Troubleshooting Operating System Deployment

Other Resources

Operating System Deployment Issues


Troubleshooting Operating System Deployment Boot Image Issues

Topic last updated -- November 2007

This section provides information to help troubleshoot operating system deployment boot image issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

Configuration Manager 2007 Clients are not Communicating with my Site when running Windows PE

When Configuration Manager 2007 clients are running Windows PE they are unable to communicate with the Configuration Manager 2007 site.

Solution

The following list displays several reasons why the Windows PE image might not be able to obtain the necessary network connectivity to communicate with the Configuration Manager 2007 site:

  • Network adapter device drivers - The Windows PE image may not have access to the appropriate network adapter device drivers.
  • IPSec - The network may be running in IPSec require mode. If IPSec is running the Windows PE image will not be able to communicate with a management point, state migration point or distribution point.
  • Network Access - The network access account may not have sufficient access to the required network resources.

See Also

Concepts

Troubleshooting Operating System Deployment

Other Resources

Operating System Deployment Issues


Troubleshooting PXE Initiated Operating System Deployment Issues

Topic Last Updated—August 2008

This topic provides information to help troubleshoot PXE-initiated operating system deployment issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

Deploying Operating System WIM Files to a PXE Service Point Can Cause an Access Denied Error When You Try to Deploy Boot Images to the PXE Service Point

If you put an operating system image on the PXE service point before adding a boot image to the PXE service point, you will receive an access denied error. The error occurs because the permissions from the WIM file are applied to the PXE temp folder used for extracting binaries, and the logged in user does not have permissions to delete those folders. Therefore, the PXE service point fails to extract binaries because it cannot delete or access the temp folders for extracting purposes.

Solution

The workaround is to use the PXE service point for boot images only because the PXE service point is configured to allow only TFTP and WDS services to access it; this means that a regular Configuration Manager 2007 client cannot access packages. If you get this error, you need to locate the folder (it is hidden), take ownership of it, and delete it. The folder will be at %temp%/PXEBootfiles.

PXE Service Point Remote Installation Directories Are Not Removed During PXE Service Point Uninstallation

When the PXE service point is uninstalled, the PXE remote installation directory and PXEImages$ directory are not removed. If the PXE service point is then reinstalled with the remote installation directory in a new location, the PXE service point installation will fail.

Solution

To install the PXE remote installation share in a new location after uninstalling the PXE service point, you should first remove the remote installation directory and the SMSPXEImages Share.

Remote PXE Service Points Must Be Updated After Upgrading to Configuration Manager 2007 SP1

When you are upgrading a Configuration Manager 2007 site to Configuration Manager 2007 SP1with one or more PXE service points that are not on the same computer as the site server, the Wimgapi.dll file that is used by the PXE service point is not replaced with the latest version. Because the updated wimgapi.dll version is required for PXE support by Configuration Manager 2007 SP1, PXE deployments that are using the remote service point will fail.

Solution

To update the Wimgapi.dll version on the remote PXE service point, perform the following steps:

  1. On the remote PXE service point site system, stop the service named Windows Deployment Services (WDS) Server.
  2. Run the new version of the Wimpgapi.msi file. This file was distributed when the site system was upgraded during the Configuration Manager 2007 upgrade process. The Wimgapi.msi file is located at \sms \ wim \ wimgapi.msi by default. Reinstalling the wimgapi file might require you to reboot your site server.
  3. Restart the “Windows Deployment Services (WDS) Server” service if necessary.

See Also

Concepts

Troubleshooting Operating System Deployment

Other Resources

Operating System Deployment Issues


Troubleshooting Task Sequence Initiated Operating System Deployment Issues

Topic last updated -- August 2007

This section provides information to help troubleshoot task sequence initiated operating system deployment issues in Configuration Manager 2007. This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=93781.

Running 64-bit Custom Task Sequence Programs Using the Task Sequence Environment Will Fail

A 64-bit custom task sequence program using the task sequence environment variable deployed to a Configuration Manager 2007 client on a 64-bit operating system will fail. This failure occurs when the task sequence program attempts to load the 64-bit task sequence environment COM object because the client is 32-bit even on 64-bit operating systems.

Solution

Use a 32-bit custom program to access the task sequence environment. This 32-bit custom program can read the environment variables and write them out to task sequence files. These files can then be read by 64-bit programs.

Task sequence fails and there are no policy assignments when assigned management point is running replicated Microsoft SQL Server

When you run replicated Microsoft SQL server on a Configuration Manager 2007 management point, task sequences are failing and no policy assignments are available.

Solution

When you import a computer entry or create a computer entry using the SDK, wait until the next Microsoft SQL replication time has elapsed before trying to run the task sequence.

See Also

Concepts

Troubleshooting Operating System Deployment

Other Resources

Operating System Deployment Issues


Troubleshooting Unknown Computer Support for Operating System Deployment

Topic Last Updated—August 2008

Unknown computer support is an operating system deployment feature in Configuration Manager 2007 R2 that allows unmanaged systems to be discovered and receive operating system deployment. This section provides information to help troubleshoot unknown computer support issues in Configuration Manager 2007 operating system deployment.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Operating System Deployment to Unknown Computer Fails to Complete

When an unknown computer requests an operating system image by using unknown computer support but then fails to completely install the image, the computer is left in an unprovisioned state. The PXE service point will have a record of the MAC address of the computer, but because it has not successfully installed the Configuration Manager 2007 client, it cannot be discovered as a client computer. Computers in this state appear in the Unprovisioned Computers folder in the Configuration Manager 2007 console.

Solution

To view unprovisioned computers, in the Configuration Manager 2007 console, navigate to System Center Configuration Manager / Site Database / Computer Management / Operating System Deployment and then click Unprovisioned Systems. A list of unprovisioned computers appears in the results pane.

Unknown Machines Registered with a Generic Task Sequence Not Recognized by Active Directory

If a generic task sequence with one "Image Apply" task targets unknown computers and the task is then run from boot media or PXE without any task sequence variable to specify the machine name, Configuration Manager 2007 will use 'Unknown' for the name of each machine. This can result in multiple machines with the name 'Unknown.' Active Directory will have issues with identically named machines.

Solution

Name each unknown machine explicitly using environment variables in the task sequence.

Log Files for Unknown Computer Support

When an unknown computer attempts to install an operating system by using PXE boot or boot media, a log file is created on the unknown computer. On Windows XP, this is located by default in C:\Documents and Settings \ Local Settings \ Temp. On Windows Vista, this is located by default in C:\Windows \ Temp. To find all log files for unknown computer support on the client machine, search for smsts*.log.

See Also

Concepts

About Unknown Computer Support for Operating System Deployment


Troubleshooting Operating System Image Deployment Using USB Devices

Topic last updated – March 2008

When trying to deploy Windows via Configuration Manager 2007 operating system deployment with boot media located on a USB drive, you receive an error message.

Operating System Deployment Fails Using a Boot Image on a USB Device

When trying to deploy Windows via Configuration Manager 2007 boot media located on a USB drive, you receive the following error message:

"Windows could not start because of a computer disk hardware configuration problem. Could not read the selected boot disk. Check boot path and disk hardware. Please check the Windows documentation about hardware disk configuration and your reference manuals for additional information."

This is caused when the BOOT.INI file that is used by Windows to determine the correct boot device is written incorrectly and shows the USB device as the boot device. When the computer is rebooted and the USB device is removed, Windows cannot find the boot device and stops with the error message above. This is because when the BOOT.INI order is determined, Windows detects the USB device and shows it first in the boot order. Since the USB drive cannot be removed until the machine has rebooted into the new operating system, the USB drive cannot be removed prior to the BOOT.INI file creation to ensure the correct order.

Solution

This issue can be resolved by causing the Windows preinstallation environment (WinPE) boot process to be done from the hard drive prior to completing the operating system configuration and attempting to reboot to the final operating system. This is done by including a task sequence step to reboot the machine into WinPE. This step will write WinPE from the USB drive to the hard drive and then set that location as the boot location. When the machine reboots, it boots to the hard drive from that point forward. The following steps demonstrate how to enable this step.

When you create a task sequence using the New Task Sequence Wizard, it inserts a step named Restart in Windows PE as the first step in the sequence. This step ensures that the task sequence is being started in WinPE. If the target machine is already running Windows and is managed by Configuration Manager 2007, this task will begin running on the machine, load WinPE on the hard drive, and reboot the machine to WinPE. If the target machine is being booted to a USB drive, the boot operating system is already WinPE, and the condition assigned to the step (“_SMSTSInWinPE equals ‘false’ “) causes this step to be skipped and the task sequence continues to be run from the USB device. Adding an additional condition to the step will allow the system to load WinPE from the USB device to the hard drive and reboot to the hard drive.

How to Create the Task Sequence Step Without Using the Task Sequence Wizard

To create the task sequence step without using the Task Sequence Wizard

  1. If you did not create the task sequence via the wizard or you have deleted the Restart in Windows PE step, you can create one by doing the following:

    1. Within your desired task sequence, select the first step in the task sequence and then click Add > General > Restart Computer. This adds the new step after the selected step. Click the Move Up toolbar button to move this step to the top of the list.

    2. Click the Options tab, and then click Add Condition > Task Sequence Variable.

  2. In the Task Sequence Variable dialog, enter _SMSTSInWinPE in the Variable box.

  3. Select equals from the Condition drop down box.

  4. Enter false in the Value box.

  5. Click OK to display the new condition.

  6. Click Apply or OK to save the new step.

To Add the Additional Condition to the Task Sequence Step

To Add the Additional Condition to the Task Sequence Step

  1. Select the Restart in Windows PE step (or the name of the step created in the preceding procedure).

  2. Click the Options tab, and then click Add Condition > Task Sequence Variable.

  3. In the Task Sequence Variable dialog, enter _SMSTSLaunchMode in the Variable box.

  4. Select equals from the Condition drop down box.

  5. Enter UFD in the Value box.

  6. Click OK.


Troubleshooting Operating System Deployment Using Custom Error Codes

The following table lists Operating System Deployment custom error codes, possible problems and possible solutions.

Operating System Deployment Custom Error Codes

Error Code | Possible Problem | Possible Solution
0x80040001 | Could not get the client GUID | Check whether the machine has been imported to the site database. Refer to clientidmgr.log in MP location for details.
0x80040101 | Network access account is not set | Check the admin UI to make sure Network Access Account is set
0x80040102 | No content location returned for the given package | Check the server side to make sure the package is distributed to at least one distribution point. Also check whether advertisement allows the task sequence to fall back to remote distribution point when there is no local distribution point
0x80040103 | Could not access package content in the distribution point | Make sure Network Access Account is set correctly. Check the underline network connectivity.
0x80040104 | Could not find reference program policy | Make sure the reference program policy is downloaded locally. Check policy agent log for details.
0x80040105 | Could not find CCM_ClientAgentConfig raw policy | Make sure policy is downloaded locally. Check policy agent log for details.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | An invalid image capture path has been specified. | Enter a valid path.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | An invalid image file name extension has been specified. | Enter a valid file name extension (.WIM)
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | An invalid image file name has been specified. | Enter a valid file name.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | Image capture path is too long | Enter a valid path
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | An invalid image file name has been specified. | Enter a valid file name
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | Timeout waiting for PNP to finish initialization. | Check windows logs
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Task sequence failed in Windows PE | Check the smsts.log file for more information.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | An invalid network adapter index has been specified | The given network adapter was not found. Please verify that the correct drivers are installed.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | Sysprep is not installed | Install correct version of sysprep
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Sysprep is invalid | Install correct version of sysprep
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | Invalid System Partition | Check OSD documentation for supported file system types.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | Machine is joined to a domain | Un-join the domain and rerun
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | Machine is domain controller | Domain controllers cannot be used as reference machines
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | A default management point has not been assigned for this site. | Set a default management point
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Certificates for the default management point are not available. | Try again
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | Package {0} is not available on the specified distribution points. | Assign package to a distribution point
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | Invalid password for media certificate | Provide a valid password
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | The media certificate does not have an associated private key | Create a media certificate with a private key
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,6) | The certification authority certificate has not been set for this site. | Set authority

See Also

Concepts

Troubleshooting Operating System Deployment
Custom Error Codes for Configuration Manager 2007


Operating System Deployment Security Best Practices and Privacy Information

Topic last updated—March 2008

Operating system deployment can be a convenient way to deploy your environment with the most secure operating systems and configurations. However, if an attacker can get control of your Microsoft System Center Configuration Manager 2007 site infrastructure, he could run the task sequence of his choice, including formatting the hard drives of all client computers. Task sequences can be configured to contain sensitive information, such as accounts with permissions to join the domain and volume licensing keys, presenting the risk of information disclosure.

Another important tenet of operating system deployment security is protecting the client authentication certificate used for bootable task sequence media and for PXE boot deployment. Capturing a client authentication certificate gives the attacker the private key to impersonate a valid client on the network.

Best Practices

Implement access controls to protect bootable media When you create bootable media, you should always assign a password to help secure the media. However, even with a password, only files containing sensitive information are protected. You should also control physical access to the media to prevent an attacker from using cryptographic attacks to obtain the client authentication certificate.

If the client certificate is compromised, block the certificate To deploy a client using bootable media and PXE service points, you must have a client authentication certificate with a private key. If that certificate is compromised, you should block the certificate under the Site Settings / Certificates / Boot Media node or PXE node.

Secure the communication channel between the site server and the PXE service point When the PXE service point is being configured with the client authentication certificate by the site server, the certificate is vulnerable to capture on the network. Use Internet Protocol security (IPsec) or some other form of encryption between the site server and the PXE service point.

Use PXE service points only on secure network segments When a client sends out a PXE boot request, there is no way to guarantee that the request is being serviced by a valid PXE service point. A rogue PXE service point could provide a tainted image to clients. An attacker could launch a man-in-the-middle attack against the TFTP protocol used by PXE and send malicious code with the operating system files, or she could create a rogue client to make TFTP requests directly to the PXE service point. An attacker could use a malicious client to launch a denial of service attack against the PXE service point. Use defense in depth to protect the network segments where clients will access PXE service points.

Important
Although it is supported to configure the PXE service point in a perimeter network, it is not recommended.

Configure the PXE service point to respond to PXE requests only on specified network interfaces Allowing the PXE service point to respond on all network interfaces could allow the PXE service point to respond to an unsecured network.

Require a password to PXE boot Client identities have to be entered into the database so that completely unknown computers are not allowed to PXE boot. Requiring a password adds an extra level of security to the PXE boot process, which is inherently insecure.

Manually delete state migration point folders when they are decommissioned When you remove a state migration point folder in the Configuration Manager 2007 console on the state migration point properties, the physical folder is not deleted. You must manually remove the network share and delete the folder.

Do not configure the deletion policy to delete user state immediately If you set the deletion policy on the state migration point to remove data marked for deletion immediately, and if an attacker manages to retrieve the users state before the valid computer does, the user state data would be deleted immediately. Set the Delete after interval to be long enough to verify the successful restore of user state data.

Control physical access to computers using USB flash drives for task sequences In an unattended installation using BitLocker to write to USB flash drives, a task sequence with the Disable BitLocker action stores the BitLocker key protectors in cleartext to allow access to the volume from Microsoft Windows PE and to disable boot integrity checking by the TPM. After this action has run, an attacker with physical access to the computer could gain access to the encrypted volume. Also, if the task sequence is using a USB flash drive, the attacker could just steal the USB drive.

Implement access controls to protect the reference computer imaging process Ensure that the reference computer used to capture operating system images is in a secure environment with appropriate access controls so that unexpected or malicious software cannot be installed and inadvertently included in the captured image. When capturing the image, ensure that the destination network file share location is secure so that the image cannot be tampered with after it is captured.

Always install the most recent security updates on the reference computer Starting with an up-to-date reference computer helps lessen the window of vulnerability for new computers coming online.

If you must deploy operating systems to an unknown computer, implement access controls to prevent unauthorized computers from connecting to the network Although provisioning unknown computers can be a convenient way to bring up multiple computers on demand, it can also allow an attacker to efficiently become a trusted client on your network. Restrict physical access to the network, and monitor clients to detect unauthorized computers. Also, computers responding to PXE-initiated operating system deployment might have all data destroyed during the operating system deployment, which could result in a loss of availability of systems that are inadvertently reformatted.

Always configure task sequence advertisements to download content Configuring to Download content locally when needed by running task sequence is more secure because Configuration Manager 2007 verifies the package hash after the task sequence is downloaded and discards the task sequences if the hash does not match the hash in the policy. If you configure the task sequences advertisement to Access content from a distribution point when needed by a running task sequence, no verification takes place and attackers can tamper with the content. If you must run the program from the distribution point, use NTFS least permissions on the packages on the distribution points and use Internet Protocol security (IPsec) to secure the channel between the client and the distribution point and between the distribution point and the site server.

Enable encryption for multicast packages For every operating system deployment package, you have the option to enable encryption when transferring the package using multicast. Enabling encryption helps prevent rogue computers from joining the multicast session and helps prevent attackers from tampering with the transmission.

Monitor for unauthorized multicast-enabled distribution points If attackers can gain access to your network, they can configure rogue multicast servers to spoof operating system deployment.

Privacy Information

In addition to deploying operating systems to computers with no operating system, Configuration Manager 2007 can be used to migrate users’ files and settings from one computer to another. The administrator configures which information to transfer, including personal data files, configuration settings, and browser cookies.

The information is stored on a state migration point and is encrypted during transmission and storage. The information is allowed to be retrieved by the new computer associated with the state information. If the new computer loses the key to retrieve the information, a Configuration Manager administrator with the View Recovery Information right on computer association instance objects can access the information and associate it with a new computer. After the new computer restores the state information, it deletes the data after one day by default. You can configure when the state migration point removes data marked for deletion. The state migration information is not stored in the site database and is not sent to Microsoft.

If you use boot media to deploy operating system images, you should always use the default option to password protect the boot media. The password encrypts any variables stored in the task sequence, but any information not stored in a variable might be vulnerable to disclosure.

Operating system deployment can use task sequences to perform many different tasks during the deployment process, including software distribution and software updates. When you configure task sequences, you should also be aware of the privacy implications of software distribution and software updates.

Configuration Manager 2007 does not implement operating system deployment by default and requires several configuration steps before you collect state information or create task sequences or boot images. Before configuring operating system deployment, consider your privacy requirements.

See Also

Other Resources

Operating System Deployment in Configuration Manager
Security Best Practices and Privacy Information for Configuration Manager Features


Technical Reference for Operating System Deployment

Click any link in the following section for technical references for Configuration Manager 2007 operating system deployment.

In This Section

Task Sequence Variables

Provides a list of task sequence variables for use with operating system deployment.

Sample Operating System Deployment Task Sequence Scenarios

Provides sample task sequence scenario. These samples can help you decide how to setup new and custom task sequences in your environment.

Operating System Media Pre-Execution Hook

Provides information on how to configure boot media, stand-alone media, and PXE to run a script or executable that can interact with the user in Windows PE before the task sequence is selected


Task Sequence Variables

Use the following reference document to help you use task sequence variables with Configuration Manager 2007 operating system deployment scenarios:

In This Section

Operating System Deployment Task Sequence Variables

Contains information about built-in Configuration Manager 2007 task sequence variables and how you can use them to control and customize a task sequence

See Also

Other Resources

Operating System Deployment in Configuration Manager


Operating System Deployment Task Sequence Variables

The following sections describe task sequence action variables (action variables) and task sequence built-in variables (built-in variables). The following lists display Configuration Manager 2007 task sequence variables and how you can use them to control and customize a task sequence. Task sequence variables supply configuration settings for computer, operating system and user state configuration tasks that are performed on a Configuration Manager 2007 computer. Task sequence variables provide a mechanism to configure and customize individual task sequence steps within a task sequence. Use the following link for more information about task sequence variables: About Task Sequence Variables

When a computer runs a task sequence, the task sequence environment is initialized using general configuration settings. As individual task sequence steps are run within the task sequence, settings specific to the current task sequence action are added to the task sequence environment. After each task sequence step is completed, any settings specific to the task sequence step are removed from the task sequence environment.

Using action variables you can change the associated default values of a task sequence to customize how the task sequence step will be run on a target computer.

Note
Task sequence variables with names that begin with an underscore (_) character are read-only. You can access the values associated with read-only task sequence variables, however you cannot change the associated values.

Task Sequence Action Variables

Task sequence action variables (action variables) specify configuration properties for a particular task sequence step. By default, the default task sequence step settings are initialized and available only when the associated task sequence step is run. In other words, the task sequence variable setting is added to the task sequence environment before the task sequence step is run, and the value is removed after the task sequence has run.

For example; using the task sequence editor you can specify a start-in directory for a command line action by specifying the Start In property value in the Run Command Line task sequence step. The default value specified is stored in the task sequence environment as the WorkingDirectory variable, which is specific to the Run Command Line task sequence action. The WorkingDirectory environment variable is initialized before running the Run Command Line task sequence action. During the Run Command Line step, the specified directory value can be accessed through the environment variable named WorkingDirectory. After the task sequence step completes, the variable is removed from the task sequence environment. If the sequence contains another Run Command Line task sequence step, the new WorkingDirectory variable is initialized and set to the starting value for that task sequence.

While the default value for a task sequence action setting is present while the task sequence step is run, any new value you set can be used by multiple steps in the sequence. If you use one of the task sequence variable creation methods to override a built-in variable value, the new value remains in the environment and overrides the default value for other steps in the task sequence. In the previous example, if a Set Task Sequence Variable step is added as the first step of the task sequence, and sets the WorkingDirectory environment variable to the value C:\, both Run Command Line steps in the task sequence will use the new starting directory value.

The following tables describe the Configuration Manager 2007 action variables which are grouped by their associated task sequence action:

Run Command Line Task Sequence Action

Action Variable Name Description

SMSTSDisableWow64Redirection

Set this variable to "true" to disable Wow64 file redirection and 64bit registry redirection when the task sequence is evaluating file, folder and registry condition in a 64bit operating system.

WorkingDirectory

Specifies the starting directory for a command-line action.

Note
The specified directory name must not exceed 255 characters.

Examples:

  • "C:\"
  • "%SystemRoot%"

Restart Computer Task Sequence Action

Action Variable Name Description

SMSRebootMessage

Specifies that an administrator configurable message to users before rebooting the computer will be displayed. If you don't specify a message, default message text is used.

Note
The message specified must not exceed 512 characters.

Example:

  • "This computer will be restarted; please save your work."

SMSRebootTimeout

Specifies the number of seconds that the warning is displayed to the user before the computer will restart. Specify zero seconds to indicate that no reboot message should be displayed.

Examples:

"0" (default)

"5"

"10"

Install Software Updates Task Sequence Action

Action Variable Name | Description
SMSInstallUpdateTarget | Installs assigned software updates. You can specify all updates, or mandatory updates. Valid values: "All" "Mandatory"

Apply Operating System Task Sequence Action

Action Variable Name Description

OSDConfigFileName

Specifies the file name of the operating system deployment answer file associated with the operating system deployment package

OSDImageIndex

Specifies the image index value of the WIM file that should be applied to the target computer.

OSDInstallEditionIndex

Specifies the version of Windows Vista operating system that will be installed. If no version is specified Windows setup will determine which version to install using the referenced product key.

Note
You should only use a value of zero ( 0 ) if the following conditions are true:

  • You are installing a pre-Windows Vista operating system or,
  • You are installing Windows Vista and,
  • No product key is specified and,
  • The operating system you are installing is a volume license edition.

Valid values:

"0" (default)

Apply Data Image Task Sequence Action

Action Variable Name | Description
OSDDataImageIndex | Specifies the image index value of the WIM file that should be applied to the target computer.
OSDWipeDestinationPartition | Specifies if the files located on the target partition should be deleted. Valid values: "true" (default) "false"

Setup Windows and ConfigMgr Task Sequence Action

Action Variable Name | Description
SMSClientInstallProperties | Specifies the client installation properties that should be used when installing the Configuration Manager 2007 client.

Capture Operating System Image Task Sequence Action

Action Variable Name Description

OSDCaptureAccount

Specifies a Windows account name that has permissions to the network share where the captured image will be stored.

OSDCaptureAccountPassword

Specifies the password for the Windows account used to store the captured image on a network share.

OSDCaptureDestination

Specifies the location where a captured operating system image will be saved.

Note
The directory specified must be between 1 and 255 characters.

OSDImageCreator

An optional name of the user that created the image, stored in the WIM file.

Note
The specified user name must be between 1 - 255 characters.

OSDImageDescription

An optional user-defined description of the captured operating system image that is stored in the WIM file.

Note
The specified description must be between 1 - 255 characters.

OSDImageVersion

An optional user-defined version number to assign to the captured operating system image. This value can be any combination of letters and numbers and is stored in the WIM file.

Note
The specified version must be between 1 - 32 characters.

OSDTargetSystemRoot

Stores the path to the currently running operating system for the Prepare ConfigMgr Client for Capture task sequence action. The task sequence action uses this task sequence variable to find the path to the operating system so that it can be verified as a supported operating system for capture by Configuration Manager 2007.

Capture Network Settings Task Sequence Action

Action Variable Name | Description
OSDMigrateAdapatorSettings | Specifies if the network adapter settings (TCP/IP, DNS, and WINS) configuration information should be captured. Examples: "true" (default) "false"
OSDMigrateNetworkMembership | Specifies if the workgroup or domain membership information should be migrated as part of the operating system deployment. Examples: "true" (default) "false"

Apply Network Settings Task Sequence Action

Action Variable Name Description

OSDAdapterCount

Specifies the number of network adapters installed on the target computer.

OSDDNSDomain

Specifies the primary DNS server that will be used by the target computer.

Note
This value is set by the Apply Network Settings action, but it remains in the environment and is available to all subsequent task sequence actions.

OSDDomainName

Specifies the name of the Windows domain that the target computer should join.

Note
The specified length must be between 1 - 32 characters.

OSDDomainOUName

Specifies the RFC 1779 format name of the organizational unit (OU) which the target computer should join. If specified, the value must contain the full path.

Example:

LDAP://OU=MyOu,DC=MyDom,DC=MyCompany,DC=com

OSDEnableTCPIPFiltering

Specifies if TCP/IP filtering should be enabled.

Note
This value is set by the Apply Network Settings action, but it remains in the environment and is available to all subsequent task sequence actions.

Valid values:

"true"

"false" (default)

OSDJoinAccount

Specifies the network account that should be used to add the target computer to a Windows domain.

OSDJoinPassword

Specifies the network password that should be used to add the target computer to a Windows domain.

OSDNetworkJoinType

Specifies the type of network the target computer should join as part of the operating system deployment.

"0" indicates that the target computer should join a Windows domain. "1" specifies that the computer should join a workgroup.

Valid values:

"0"

"1"

OSDSuffixSearchOrder

Specifies the DNS search order for the target computer.

Note
This value is set by the Apply Network Settings action, but it remains in the environment and is available to all subsequent task sequence actions.

OSDWorkgroupName

Specifies the name of the workgroup that the target computer should join.

You must specify either this value, or the OSDDomainName value.

Note
The specified length must be between 1 - 32 characters.

Example:

"Accounting"

Prepare Windows for Capture Task Sequence Action

Action Variable Name | Description
OSDBuildStorageDriverList | Builds a mass storage device driver list. Valid values: "true" "false" (default)
OSDKeepActivation | Specifies whether the product activation flag should be reset. Valid values: "true" "false" (default)

Capture User State Task Sequence Action

Action Variable Name Description

_SMSTSUserStatePath

Creates a location and allows you to save the user state locally. You must also set the OSDStateStorePath task sequence variable to _SMSTSUserStatePath.

OSDMigrateAdditionalCaptureOptions

Specifies additional user state migration tool (USMT) command line options that will be used to capture additional USMT options not exposed by the Configuration Manager 2007 user interface. This task sequence variable is only available for use with the Capture User State task sequence step.

Note
The USMT options specified with this task sequence variable are not validated for accuracy prior to running the task sequence.

OSDMigrateConfigFiles

Specifies the configuration files used to capture user profiles. This value is set for customized user profile migration.

OSDMigrateContinueOnLockedFiles

Allows the user state capture to proceed if some files cannot be captured.

Valid values:

"true" (default)

"false"

OSDMigrateEnableVerboseLogging

Enables verbose logging for the user state migration tool (USMT).

Valid values:

"true"

"false" (default)

OSDMigrateMode

Allows you to customize the files that are captured by the USMT.

Valid values:

"Simple"

"Advanced"

OSDMigrateSkipEncryptedFiles

Specifies if encrypted files should be captured.

Valid values:

"true"

"false" (default)

_OSDMigrateUsmtPackageID

Specifies the package ID of the Configuration Manager 2007 package that will contain the USMT files. This variable is required.

Restore User State Task Sequence Action

Action Variable Name Description

OSDMigrateContinueOnRestore

Specifies that the user state restoration should continue even if some files cannot be restored.

Valid values:

"true" (default)

"false"

OSDMigrateEnableVerboseLogging

Enables verbose logging for the USMT tool.

Note
This value is required by the action; it must be set to "true" or "false"

Valid values:

"true"

"false" (default)

OSDMigrateLocalAccountPassword

Specifies if the local user account password should be reset for restored local user profiles.

OSDMigrateLocalAccounts

Specifies if the local computer account should be restored.

Valid values:

"true"

"false" (default)

_OSDMigrateUsmtRestorePackageID

Specifies the package ID of the Configuration Manager 2007 package that contains USMT files that will be restored. This variable is required.

Request State Store Task Sequence Action

Action Variable Name Description

OSDStateFallbackToNAA

Specifies if the task sequence step should use the Network Access Account as a fallback when the computer account fails to connect to the state migration point.

Valid values:

"true"

"false" (default)

OSDStateSMPRetryCount

Specifies the number of times that the task sequence step should try to find a state migration point before failing.

Note
The specified count must be between 0 - 600.

OSDStateSMPRetryTime

Specifies number of seconds that the task sequence step should wait between retry attempts.

Note
The specified number of seconds must be between 0 - 30.

Format and Partition Disk Task Sequence Step

Action Variable Name Description

OSDDiskIndex

Specifies the physical disk number to be partitioned.

Note
This value is required by the task sequence action.

OSDDiskpartBiosCompatibilityMode

Specifies whether or not to disable cache alignment optimizations when partitioning the hard disk for compatibility with certain types of BIOS.

Valid values:

"true"

"false" (default)

OSDGPTBootDisk

Specifies whether or not to create an EFI partition on a GPT hard disk so that it can be used as the startup disk on EFI-based computers.

Note
This value is required by the action; it must be set to "True" or "False"

Valid values:

"true"

"false" (default)

OSDPartitions

Specifies an array of partition settings; see the SDK topic for accessing array variables in the task sequence environment.

Note
This value is required by the task sequence action.

This task sequence variable is an array variable. Each element in the array represents the settings for single partition on the hard disk. The settings defined for each partition can be accessed by combining the array variable name with the zero-based disk partition number and the property name.

For example, the following variable names can be used to define the properties for the first partition that will be created by this task sequence action on the hard disk:

Note
If multiple partitions will be defined with this task sequence action the properties for the second partition can be defined by using their index in the variable name; for example; OSDPartitions1Type, OSDPartitions1FileSystem, OSDPartitions1Bootable, OSDPartitions1QuickFormat, OSDPartitions1VolumeName and so on.

  • OSDPartitions0Type - Specifies the type of partition and is a required property. Valid values are "Primary", "Extended", "Logical", and "Hidden".
  • OSDPartitions0FileSystem - Specifies the type of file system to use when formatting the partition. This is an optional property, if no file system is specified the partition will not be formatted. Valid values are "FAT32" and "NTFS".
  • OSDPartitions0Bootable - Specifies if the partition is bootable and is a required property. If this value is set to "TRUE" for MBR disks then this will be made the active partition.
  • OSDPartitions0QuickFormat - Specifies the type of format that should be used and is a required property. If this value is set to "TRUE", a quick format will be performed otherwise a full format will be performed.
  • OSDPartitions0VolumeName - Specifies the name that should be assigned to the volume when it is formatted. This is an optional property.
  • OSDPartitions0Size - Specifies the size of the partition. Units are specified by the OSDPartitions0SizeUnits variable. This is an optional property. If this property is not specified the partition is created using all remaining free space.
  • OSDPartitions0SizeUnits - Specifies the units that will be used when interpreting the OSDPartitions0Size task sequence variable. This is an optional property. Valid values are "MB" (default), "GB", and "Percent".
  • OSDPartitions0VolumeLetterVariable - Partitions will always use the next available drive letter in Windows PE when they are created. Use this optional property to specify the name of another task sequence variable which will be used to save the new drive letter for future reference.

OSDPartitionStyle

Specifies the partition style to use when partitioning the disk. "MBR" indicates the master boot record partition style, and "GPT" indicates the GUID Partition Table style.

Note
This value is required by the task sequence action; it must be set to "GPT" or "MBR"

Valid Values:

"GPT"

"MBR"

Convert Disk to Dynamic Task Sequence Action

Action Variable Name Description

OSDConvertDiskIndex

Specifies the physical disk number to be converted.

Note
This value is required by the task sequence action.

Connect to Network Folder Task Sequence Action

Action Variable Name Description

SMSConnectNetworkFolderAccount

Specifies the administrator account that should be used to connect to the network share.

Note
This value is required by the task sequence action.

SMSConnectNetworkFolderDriveLetter

Specifies the network drive letter to connect to. This value is optional; if it is not specified, then the network connection is not mapped to a drive letter.

Note
If this value is specified the value must be in the range from D: to Z:

Examples:

"D:"

"E:"

SMSConnectNetworkFolderPassword

Specifies the network password that should be used to connect to the network share.

Note
This value is required by the task sequence action.

SMSConnectNetworkFolderPath

Specifies the network path for the connection.

Note
This value is required by the task sequence action.

Example:

"\\servername\sharename"

Join Domain or Workgroup Task Sequence Action

Action Variable Name Description

OSDJoinAccount

Specified the account that should be used by the target computer to join the Windows domain.

OSDJoinDomainName

Specifies the name of a Windows domain the target computer will join.

Note
The specified Windows domain name must be between 1 - 255 characters

OSDJoinDomainOUName

Specifies the RFC 1779 format name of the organizational unit (OU) which the target computer should join. If specified, the value must contain the full path.

Example:

LDAP://OU=MyOu,DC=MyDom,DC=MyCompany,DC=com

Note
The specified Windows domain OU name must be between 0 - 32,767 characters. This value should not be set if the variable OSDJoinType is set to "1" (join workgroup).

OSDJoinPassword

Stores the network password that should be used by the target computer to join the Windows domain.

Note
This value is required if the variable OSDJoinType is set to "0" (join domain)

OSDJoinSkipReboot

Specifies whether the target computer should be restarted after joining the domain or workgroup.

Valid values:

"true"

"false"

OSDJoinType

Specifies if the target computer should join a Windows domain or a workgroup. "0" will configure the target computer to join a specified Windows domain. "1" will configure the target computer to join a specified workgroup.

Valid values:

"0"

"1"

OSDJoinWorkgroupName

Specifies the name of a workgroup the target computer will join.

Note
The specified workgroup name must be between 1 to 32 characters.

Example:

"Accounting"

Capture Windows Settings Task Sequence Action

Action Variable Name Description

OSDMigrateComputerName

Specifies if the computer name should be migrated.

Note
This value is required by the action; it must be set to "true" or "false".

Valid values:

"true" (default)

"false"

OSDMigrateRegistrationInfo

Specifies if the computer user and organizational information should be migrated.

Note
This value is required by the task sequence action; it must be set to "true" or "false".

Valid values:

"true" (default)

"false"

OSDMigrateTimeZone

Specifies if the computer time zone settings should be migrated.

Note
This value is required by the task sequence action; it must be set to "true" or "false".

Valid values:

"true" (default)

"false"

Apply Windows Settings Task Sequence Action

Action Variable Name Description

OSDComputerName

Specifies the default name of the target computer. This can be overwritten when the task sequence runs by the Capture Windows Settings task sequence action if the Migrate computer name option is selected.

Example:

"%_SMSTSMachineName%" (default)

OSDProductKey

Specifies the Windows product key.

Note
The specified value must be between 1 - 255 characters.

OSDRegisteredUserName

Specifies the default registered user name in the new operating system. This can be overwritten when the task sequence runs by the Capture Windows Settings task sequence action if the Migrate registered user and organization name option is enabled.

Note
This value is required by the task sequence; the specified value must be between 1 - 255 characters.

OSDRegisteredOrgName

Specifies the default registered organization name in the new operating system. This can be overwritten when the task sequence runs by the Capture Windows Settings task sequence action if the Migrate registered user and organization names option is enabled.

Note
This value is required by the task sequence; the specified value must be between 1 - 255 characters.

OSDTimeZone

Specifies the default time zone setting that should be used in the new operating system. This can be overwritten when the task sequence runs the Capture Windows Settings action if the Migrate time zone option is enabled.

Note
This value is required by the task sequence.

OSDServerLicenseMode

Specifies the Windows Server license mode that should be used.

Valid values:

"PerSeat"

"PerServer"

OSDServerLicenseConnectionLimit

Specifies the maximum number of connections allowed.

Note
The specified must be in the range between 5 - 9999 characters.

OSDRandomAdminPassword

Specifies a randomly generated password for the administrator account in the new operating system. If set to “true”, the local administrator account will be disabled on the target computer. If set to “false”, the local administrator account will be enabled on the target computer, and the local administrator account password will be assigned the value of the variable OSDLocalAdminPassword.

Valid values:

"true" (default)

"false"

OSDLocalAdminPassword

Specifies the local administrator password. This value is ignored if the Randomly generate the local administrator password and disable the account on all supported platforms option is enabled.

Note
The specified value must be between 1 and 255 characters.

Auto Apply Drivers Task Sequence Action

Action Variable Name Description

OSDAutoApplyDriverCategoryList

Specifies the driver catalog category unique ID's the task sequence action will search in for required device drivers. This value is optional and it is not set by default. The available category ID's can be obtained by enumerating the list of SMS_CategoryInstance objects on the site.

OSDAllowUnsignedDriver

Specifies whether Windows should be configured to allow unsigned device drivers to be installed. This task sequence variable is not used when deploying the Windows Vista operating system.

Note
This value is required by the action; it must be set to "true" or "false".

Valid values:

"true"

"false" (default)

OSDAutoApplyDriverBestMatch

Specifies what the task sequence action should do if there are multiple device drivers in the driver catalog that are compatible with a hardware device. If set to "true”, only the best device driver will be installed. If “false”, all compatible device drivers will be installed, and the operating system will choose the best driver to use.

Note
This value is required by the action; it must be set to "true" or "false".

Valid values:

"true" (default)

"false"

Apply Driver Package Task Sequence Action

Action Variable Name Description

OSDApplyDriverBootCriticalContentUniqueID

Specifies the content ID of the mass storage device driver in the driver package to install. If this is not specified, no mass storage driver is installed.

OSDApplyDriverBootCriticalINFFile

Specifies the INF file of the mass storage driver to be installed

Note
This task sequence variable is required if the OSDApplyDriverBootCriticalContentUniqueID is set.

OSDApplyDriverBootCriticalHardwareComponent

Specifies if a mass storage device driver is being installed, this must be “scsi”.

Note
This task sequence variable is required if the OSDApplyDriverBootCriticalContentUniqueID is set.

OSDApplyDriverBootCriticalID

Specifies the boot critical ID of the mass storage device driver to be installed. This is listed in the "scsi" section of the device driver’s txtsetup.oem file.

Note
This task sequence variable is required if the OSDApplyDriverBootCriticalContentUniqueID is set.

OSDAllowUnsignedDriver

Specifies whether Windows should be configured to allow unsigned device drivers to be installed. This task sequence variable is not used when deploying the Windows Vista operating system.

Note
This value is required by the action; it must be set to "true" or "false".

Valid values:

"true"

"false" (default)

Enable BitLocker Task Sequence Action

Action Variable Name | Description
OSDBitLockerRecoveryPassword | Specifies instead of generating a random recovery password, the Enable BitLocker task sequence action will use the specified value as the recovery password. The value must be a valid numerical BitLocker recovery password.
OSDBitLockerStartupKey | Specifies instead of generating a random startup key for the key management option “Startup Key on USB only”, the Enable BitLocker task sequence action will use the value as the startup key. The value must be a valid, Base64-encoded BitLocker startup key.

Task Sequence Built-in Variables

Task sequence built-in variables (built-in variables) are produced by the underlying task sequence engine and their associated values are generally read-only. Built in variables provide information about the environment where the associated task sequence is running. The values associated with a built-in variable are available in the task sequence environment throughout the entire task sequence. Typically, built-in variables are initialized before any task sequence steps are run in the task sequence. For example, the built-in variable _SMSTSLogPath is used to set the path that Configuration Manager 2007 components use to write log files while the task sequence runs; any task sequence step can access this environment variable.

The following list describes the Configuration Manager 2007 built-in variables available for use within a Configuration Manager 2007 task sequence:

Built-in Variable Name Description

_SMSTSAdvertID

Stores the current running task sequence advertisement ID. It uses the same format as a Configuration Manager 2007 software distribution advertisement ID. If the task sequence is running from a stand-alone media, this variable is un-defined.

Example:

"ABC20001"

_SMSTSBootImageID

Stores the Configuration Manager 2007 boot image package ID if there is a boot image package associated with the current running task sequence. The variable will not be set if there is no Configuration Manager 2007 boot image package associated.

Example:

"ABC00001"

_SMSTSClientGUID

Stores the value of Configuration Manager 2007 client GUID. This variable is not set if the task sequence is running through a stand-alone media.

Example:

"0a1a9a4b-fc56-44f6-b7cd-c3f8ee37c04c"

_SMSTSCurrentActionName

Specifies the name of currently running task sequence step. This variable will be set before the task sequence manager runs each individual step.

Example:

"run command line"

_SMSTSDownloadOnDemand

Set to "true" if the current task sequence is running in download on demand mode which means the task sequence manager downloads content locally only when it needs to access the content.

_SMSTSInWinPE

This variable is set to "true" when the current task sequence step is running in the Windows PE environment and set to "false" if not. You can test this task sequence variable to determine the current operating system environment.

_SMSTSLastActionRetCode

Stores the return code returned by the last action that was run.

Example:

"0"

_SMSTSLastActionSucceeded

The variable is set to "true" if the last action is succeeded and to "false" if the last action failed. If the last action is skipped because the step is disabled or the associated condition is evaluated to false, this variable is not reset which means it still holds the value for the previous action of the last action.

_SMSTSLaunchMode

Specifies the task sequence launch method. The task sequence can have the following values:

  • "SMS" - specifies that the task sequence is launched using the Configuration Manager 2007 client.
  • "UFD" - specifies that the task sequence is launched using USB media.
  • "CD" - specifies that the task sequence is launched using CD/DVD sets.
  • "PXE" - specifies that the task sequence is launched from PXE

_SMSTSLogPath

Stores the full path to the log directory. This is specified by the TSM and can be used to determine where actions should be logged. This value cannot be set when no hard drive is available.

_SMSTSMachineName

Stores and specifies the computer name. Stores the name of the computer that the task sequence will use to log all status messages. To change the computer name in the new operating system use the OSDComputerName variable.

Example:

"ABC"

_SMSTSMediaType

Specifies the type of media that will be used to initiate the installation. Examples of types of media are Boot Media, Full Media, and PXE.

_SMSTSMP

Stores the name or IP address of a Configuration Manager 2007 management point.

_SMSTSMPPort

Stores the management point port number of a Configuration Manager 2007 management point.

Example:

"80"

_SMSTSOrgName

Stores the branding title name which will be displayed in task sequence progress UI dialog.

Example:

"XYZ Organization"

_SMSTSPackageID

Stores the current running task sequence ID. This ID uses the same format as a Configuration Manager 2007 software package ID.

Example:

"HJT00001"

_SMSTSPackageName

Stores the current running task sequence name specified by the Configuration Manager 2007 administrator when the task sequence is created.

Example:

"Deploy xpsp2 task sequence"

_SMSTSRunFromDP

Set to "true" if the current task sequence is running in run from distribution point mode, which means the task sequence manager will obtain required packages from distribution point shares.

_SMSTSSiteCode

Stores the site code of the Configuration Manager 2007 site.

Example:

"ABC"

_SMSTSType

Specifies the type of the current running task sequence. It can have following values:

"1" - indicates the generic task sequence.

"2" - indicates the operating system deployment task sequence.

_SMSTSUseCRL

Specifies if the task sequence uses the certificate revocation list when using SSL to communicate with the management point.

_SMSTSUserStarted

Specifies whether a task sequence is started by a user. This variable will only be set if the task sequence is started from the Configuration Manager 2007 client. For example, if _SMSTSLaunchMode is set to "SMS". The variable can have following values:

  • "true" - specifies that the task sequence is manually started by a user from client RAP.
  • "false" - specifies that the task sequence is initiated automatically by the Configuration Manager 2007 scheduler.

_SMSTSUseSSL

Specifies if the task sequence uses SSL to communicate with the Configuration Manager 2007 management point. If your site is running in native mode set the value to "true".

SMSTSErrorDialogTimeout

Specifies that a dialog indicating an error occurred. The dialog will be dismissed automatically in 15 minutes by default. Users can set this task sequence variable to control the timeout value in seconds.

SMSTSRebootDelay

Specifies how many seconds to wait before the computer will reboot. The task sequence manager will display a notification dialog before reboot if this variable is not set to 0.

Examples:

"0"

"30"

SMSTSRebootMessage

Specifies the message to display in the shutdown dialog box when a reboot is requested. If this variable is not set, then a default message will be shown.

Examples:

This computer is being rebooted by the task sequence manager.

SMSTSRebootRequested

Indicates that a reboot is requested after completing the current task sequence step. If a reboot is needed, simply set this variable to "true" and the task sequence manager will restart the machine after this task sequence step. The task sequence does not support an individual task sequence step to reboot the computer. The task sequence step must set this task sequence variable if it requires a reboot to complete the task sequence step. After the computer is rebooted, the task sequence will continue running from the next task sequence step.

SMSTSRetryRequested

Requests a retry after the completion of the current task sequence step. If this task sequence variable is set, the SMSTSRebootRequested must also be set to "true". After the computer is rebooted, the task sequence manager will rerun the same task sequence step.

See Also

Concepts

About Task Sequence Variables


Sample Operating System Deployment Task Sequence Scenarios

Use the following reference documents as a guide as you create various Configuration Manager 2007 operating system deployment task sequence scenarios.

Click any link in the following section for more information about the available scenarios that provide a recommended path for creating operating system deployment task sequences.

In This Section

Sample Stand-alone Media Operating System Deployment Task Sequence

Provides a sample task sequence to deploy an operating system image using stand-alone media.

Sample Existing Operating System Image Deployment Task Sequence

Provides a sample task sequence to deploy an operating system image using an existing operating system image.

Sample Build and Capture Operating System Image Task Sequence

Provides a sample task sequence that will build and capture an operating system image for deployment.

See Also

Other Resources

Technical Reference for Operating System Deployment


Sample Stand-alone Media Operating System Deployment Task Sequence

Use the table as a guide as you create a task sequence to deploy an operating system using stand-alone media. The table will help you decide the general sequence for your task sequence steps and how to organize and structure those task sequence steps into logical groups.

Note
You should always use the Task Sequence Media Wizard to create stand-alone media from which to run your operating system deployment.

The task sequence you create may vary from this sample and can contain more or less task sequence steps and groups.

Sample stand-alone media task sequence

Task Sequence Group/Step Reference

Capture File and Settings - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

Capture Windows Settings

Use this task sequence step to identify the Microsoft Windows settings that should be captured from the computer that will receive the task sequence. You can capture the computer name, user and organizational information and the time zone settings.

Capture Network Settings

Use this task sequence step to capture network settings from the computer that will receive the task sequence associated with this task step. You can capture the computer's domain or workgroup membership and the network adapter setting information.

Capture User Files and Settings - (New Task Sequence Sub-Group)

You can create a task sequence group within a task sequence group using the task sequence editor. A task sequence sub-group helps keep similar task sequence steps together for better organization and error control.

Set Local State Location

You can use this task sequence step specify a local location using the protected path task sequence variable. The user state will be stored on a protected directory on the hard drive.

Capture User State

You can use this task sequence step to capture the user files and settings you want to migrate to the new operating system.

Install Operating System - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

Reboot to Windows PE or hard disk

Use this task sequence step to specify restart options for the target computer that will receive this task sequence. This step will display a message to the user that the computer will be restarted so that the installation can continue.

This step uses the read-only _SMSTSInWinPE task sequence variable. If the associated value equals false the task sequence step will continue.

Apply Operating System

Use this task sequence step to install a specified operating system image onto target computer. This step applies all volume images contained in the WIM file to the corresponding sequential disk volume on the target computer after first deleting all files on that volume (with the exception of Configuration Manager 2007-specific control files). You can specify a sysprep answer file and also configure which disk partition should be used for the installation.

Apply Windows Settings

Use this task sequence step to configure the Windows settings configuration information for the target computer. The windows settings you can apply are user and organizational information, product or license key information, time zone, and the local administrator password.

Apply Network Settings

Use this task sequence step to specify the network or workgroup configuration information for the target computer. You can also specify if the computer should use a DHCP server or you can statically assign the IP address information.

Apply Driver Package

The Apply Driver Package task sequence step allows you to make all device drivers in a driver package available for use by Windows setup. All necessary device drivers must be contained on the stand-alone media.

Setup Operating System - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

Setup Windows and ConfigMgr

Use this task sequence step to install the Configuration Manager 2007 client software. Configuration Manager 2007 installs and registers the Configuration Manager 2007 client GUID. You can assign the necessary installation parameters in the Installation properties window.

Restore User Files and Settings - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

Restore User State

Use this task sequence step to initiate the User State Migration Tool (USMT) to restore user state and settings to a target computer.

See Also

Tasks

How to Create Stand-alone Media

Other Resources

Sample Operating System Deployment Task Sequence Scenarios


Sample Existing Operating System Image Deployment Task Sequence

Use the table as a guide as you create a task sequence to deploy an operating system using an existing operating system image. The table will help you decide the general sequence for your task sequence steps and how to organize and structure those task sequence steps into logical groups.

Important
You should always use the New Task Sequence Wizard to create this task sequence. For more information about deploying an operating system to a new computer use the following link: How to Deploy Operating System Images to a Computer

The task sequence you create may vary from this sample and can contain more or less task sequence steps and groups.

Sample existing operating system image task sequence

When you use the New Task Sequence Wizard to create this new task sequence some of the task sequence step names are different than what than what they would be if you manually added these task sequence steps to an existing task sequence. The following table displays the naming differences:

New Task Sequence Wizard Task Sequence Step name | Equivalent Task Sequence Editor Step Name
Request User State Storage | Request State Store
Capture User Files and Settings | Capture User State
Release User State Storage | Release State Store
Restart in Windows PE | Reboot to Windows PE or hard disk
Partition Disk 0 | Format and Partition Disk
Restore User Files and Settings | Restore User State

Sample existing operating system image task sequence:

Task Sequence Group/Step Reference

Capture File and Settings - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

This group contains actions that capture files and settings from the reference computer operating system.

Capture Windows Settings

Use this task sequence step to identify the Microsoft Windows settings that should be captured from the computer that will receive the task sequence. You can capture the computer name, user and organizational information and the time zone settings.

Capture Network Settings

Use this task sequence step to capture network settings from the computer that will receive the task sequence associated with this task step. You can capture the computer's domain or workgroup membership and the network adapter setting information.

Capture User Files and Settings - (New Task Sequence Sub-Group)

You can create a task sequence group within a task sequence group using the task sequence editor. A task sequence sub-group helps keep similar task sequence steps together for better organization and error control.

This group contains the actions to capture user files and settings.

Request User State Storage

Use this task sequence step to request access to a state migration point when capturing state from a computer. You can configure this task sequence step to capture or restore the user state information.

Capture User Files and Settings

Use this task sequence step to use the User State Migration Tool (USMT) to capture user state and settings from the computer that will receive the task sequence associated with this task step. You can use the standard options or configure the options you want to capture.

Release User State Storage

This task sequence step notifies the state migration point that the capture or restore action has been completed.

Install Operating System - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

This group contains actions that will run in the Windows PE environment to install and configure the image.

Restart in Windows PE

Use this task sequence step to specify restart options for the target computer that will receive this task sequence. This step will display a message to the user that the computer will be restarted so that the installation can continue.

This step uses the read-only _SMSTSInWinPE task sequence variable. If the associated value equals false the task sequence step will continue.

Partition Disk 0

This task sequence step specifies the actions necessary to format the hard drive on the target computer. The default disk number is 0.

This step uses the read-only _SMSTSClientCache task sequence variable. This step will run if the Configuration Manager 2007 client cache does not exist.

Apply Operating System

Use this task sequence step to install a specified operating system image onto target computer. This step applies all volume images contained in the WIM file to the corresponding sequential disk volume on the target computer after first deleting all files on that volume (with the exception of Configuration Manager 2007-specific control files). You can specify a sysprep answer file and also configure which disk partition should be used for the installation.

Apply Windows Settings

Use this task sequence step to configure the Windows settings configuration information for the target computer. The windows settings you can apply are user and organizational information, product or license key information, time zone, and the local administrator password.

Apply Network Settings

Use this task sequence step to specify the network or workgroup configuration information for the target computer. You can also specify if the computer should use a DHCP server or you can statically assign the IP address information.

Apply Device Drivers

This task sequence step allows you to match and install drivers as part of an operating system deployment. You can allow Windows Setup to search all existing driver categories by selecting Consider drivers from all categories or limit which driver categories Windows Setup should search by selecting Limit driver matching to only consider drivers in selected categories.

This step uses the read-only _SMSTSMediaType task sequence variable. If the associated value does not equal FullMedia this task sequence step will run.

Apply Driver Package

The Apply Driver Package task sequence step allows you to make all device drivers in a driver package available for use by Windows setup.

Setup Operating System - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

This group of task sequence steps will setup the operating system.

Setup Windows and ConfigMgr

Use this task sequence step to install the Configuration Manager 2007 client software. Configuration Manager 2007 installs and registers the Configuration Manager 2007 client GUID. You can assign the necessary installation parameters in the Installation properties window.

Install Updates

Use this task sequence step to specify how software updates should be installed on a target computer. The target computer is not evaluated for applicable software updates until this task sequence step runs. At that point, the target computer is evaluated for software updates as any other Configuration Manager 2007-managed client.

This step uses the read-only _SMSTSMediaType task sequence variable. If the associated value does not equal FullMedia this task sequence step will run.

Restore User Files and Settings - (New Task Sequence Sub-Group)

You can create a task sequence group within a task sequence group using the task sequence editor. A task sequence sub-group helps keep similar task sequence steps together for better organization and error control.

This group contains the steps necessary to restore the user files and settings.

Request User State Storage

Use this task sequence step to request access to a state migration point when restoring the user state to a computer.

Restore User Files and Settings

Use this task sequence step to initiate the User State Migration Tool (USMT) to restore user state and settings to a target computer.

Release User State Storage

This task sequence step notifies the state migration point that the capture or restore action has been completed and disconnects the target computer from the state migration point.

See Also

Other Resources

Sample Operating System Deployment Task Sequence Scenarios


Sample Build and Capture Operating System Image Task Sequence

Use the table as a guide as you create a task sequence to build and capture an operating system image. The table will help you decide the general sequence for your task sequence steps and how to organize and structure those task sequence steps into logical groups.

Important
You should always use the New Task Sequence Wizard to create this type of task sequence.

The task sequence you create may vary from this sample and can contain more or less task sequence steps and groups.

Sample build and capture operating system image task sequence

When you use the New Task Sequence Wizard to create this new task sequence some of the task sequence step names are different than what they would be if you manually added these task sequence steps to an existing task sequence. The following table displays the naming differences:

New Task Sequence Wizard Task Sequence Step name | Equivalent Task Sequence Editor Step Name
Restart in Windows PE | Reboot to Windows PE or hard disk
Partition Disk 0 | Format and Partition Disk
Apply Device Drivers | Auto Apply Drivers
Install Updates | Install Software Updates
Join Workgroup | Join Domain or Workgroup
Prepare ConfigMgr Client | Prepare ConfigMgr Client for Capture
Prepare Operating System | Prepare Windows for Capture
Capture the Reference Machine | Capture Operating System Image

Sample Build and Capture Task sequence:

Task Sequence Group/Step Reference

Build the Reference Computer - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

This group contains the actions necessary to build a reference computer.

Restart in Windows PE

Use this task sequence step to specify restart options for the target computer that will receive this task sequence. This step will display a message to the user that the computer will be restarted so that the installation can continue.

This step uses the read-only _SMSTSInWinPE task sequence variable. If the associated value equals false the task sequence step will continue.

Partition Disk 0

This task sequence step specifies the actions necessary to format the hard drive on the target computer. The default disk number is 0.

This step uses the read-only _SMSTSClientCache task sequence variable. This step will run if the Configuration Manager 2007 client cache does not exist.

Apply Operating System

Use this task sequence step to install a specified operating system image on a target computer. This step applies all volume images contained in the WIM file to the corresponding sequential disk volume on the target computer after first deleting all files on that volume (with the exception of Configuration Manager 2007-specific control files).

Apply Windows Settings

Use this task sequence step to configure the Windows settings configuration information for the target computer.

Apply Network Settings

Use this task sequence step to specify the network or workgroup configuration information for the target computer.

Apply Device Drivers

This task sequence step allows you to match and install drivers as part of an operating system deployment. You can allow Windows Setup to search all existing driver categories by selecting Consider drivers from all categories or limit which driver categories Windows Setup should search by selecting Limit driver matching to only consider drivers in selected categories.

This step uses the read-only _SMSTSMediaType task sequence variable. If the associated value does not equal FullMedia this task sequence step will run.

Setup Windows and ConfigMgr

Use this task sequence step to install the Configuration Manager 2007 client software. Configuration Manager 2007 installs and registers the Configuration Manager 2007 client GUID. You can assign the necessary installation parameters in the Installation properties window.

Install Updates

Use this task sequence step to specify how software updates should be installed on a target computer. The target computer is not evaluated for applicable software updates until this task sequence step runs. At that point, the target computer is evaluated for software updates as any other Configuration Manager 2007-managed client.

This step uses the read-only _SMSTSMediaType task sequence variable. If the associated value does not equal FullMedia this task sequence step will run.

Capture the Reference Computer - (New Task Sequence Group)

You can create a task sequence group using the task sequence editor. A task sequence group helps keep similar task sequence steps together for better organization and error control.

This group contains the necessary steps to prepare and capture a reference computer.

Join Workgroup

Use this task sequence step to specify information needed to have the target computer join a workgroup.

Prepare ConfigMgr Client for Capture

This task sequence step takes the Configuration Manager 2007 client on the reference computer and prepares it for capture as part of the imaging process

Prepare Operating System

Use this task sequence step to specify the Sysprep options to use when capturing Windows settings from the reference computer. This task sequence step runs Sysprep and then reboots the computer into the Windows PE boot image specified for the task sequence.

Capture Operating System Image

Use this task sequence step to enter a specific existing network share and .WIM file to use when saving the image. This location is used as the package source location when adding an operating system image package using the Add Operating System Image Package Wizard. It is also referenced on the Operating System Images - Data Source Tab of the properties of the Operating System Package you add.

See Also

Other Resources

Sample Operating System Deployment Task Sequence Scenarios


Operating System Media Pre-Execution Hook

The following section describes how to configure boot media, stand-alone media, and PXE to run a script or executable that can interact with the user in Windows PE before the task sequence is selected. This can be used to prompt for information and save it in the task sequence environment before the task sequence is started. For example, you can use this to prompt for user credentials to join the domain.

When the target computer boots, the command-line will be run before policy is downloaded.

Note
This script will run successfully on computers with x86 chip architectures, however if the target computer has an x64 chip architecture this script will fail. The paths are set the same for both types of chip architectures; however the x86 version of cscript.exe will search using the current path and root directory for the script and the x64 version will not. The x64 version of cscript.exe will only search in the current directory.

To configure media to run a script or program that can interact with the user

  1. Create a TSConfig.INI file that contains the command-line to run. For example:

    Copy Code
    [CustomHook]
CommandLine=”WScript.exe X:\MyScript.vbs”

  2. Create a Windows PE image that contains the TSConfig.ini and any files required in the root folder.

  3. Use the procedure How to Add a Boot Image to Configuration Manager to import the boot image into the Configuration Manager 2007 site.

  4. Create boot media or stand-alone media using the boot image you imported in step 3.

See Also

Tasks

How to Create Task Sequence Bootable Media

Other Resources

Technical Reference for Operating System Deployment


Asset Intelligence in Configuration Manager

Topic last updated—January 2008

The Asset Intelligence Configuration Manager 2007 feature allows administrators to inventory and manage software in use throughout the Configuration Manager 2007 hierarchy. Asset Intelligence enhances the inventory capabilities of Configuration Manager 2007 and Configuration Manager 2007 SP1 to help manage software in use and software license management in the enterprise. Many additional Asset Intelligence specific inventory classes improve the breadth of information gathered about hardware and software assets.

This section provides detailed information about the concepts, planning, configuring, managing, security, and troubleshooting of Asset Intelligence.

In This Section

Overview of Asset Intelligence

Prerequisites for Asset Intelligence

Configuring Asset Intelligence

Tasks for Asset Intelligence

Troubleshooting Asset Intelligence

Technical Reference for Asset Intelligence

See Also

Other Resources

Configuration Manager 2007 Features


Overview of Asset Intelligence

Topic last updated—January 2008

Asset Intelligence in Configuration Manager 2007 allows administrators to inventory and manage software license usage throughout their enterprise by using the Asset Intelligence catalog, which is a locally stored catalog of software and license information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Asset Intelligence enhances the inventory capabilities of Microsoft System Center Configuration Manager 2007 by extending hardware inventory and adding license management functionality. Many hardware inventory WMI classes improve the breadth of information gathered about hardware and software titles in use.

Over 50 reports present this information in easy-to-use format. Many of these reports link to more specific reports, providing the ability to query for general information and drill through to more detailed information.

In Configuration Manager 2007 SP1, further functionality to the Asset Intelligence feature was added to allow custom editing of the Asset Intelligence catalog. In addition, Microsoft Software Assurance (SA) customers can connect to System Center Online to dynamically update the Asset Intelligence catalog with the most current information available. Microsoft SA customers can also reconcile enterprise software license usage with purchased Microsoft Volume Licensing Service (MVLS) software licenses in use by importing MVLS license information into the Configuration Manager site database.

In This Section

About the Asset Intelligence Catalog

About the Asset Intelligence Synchronization Point

About the Asset Intelligence Home Page

About Asset Intelligence Reports

About Asset Intelligence Validation States

See Also

Concepts

Asset Intelligence in Configuration Manager


About the Asset Intelligence Catalog

Topic last updated—March 2008

The Configuration Manager 2007 Asset Intelligence catalog is a set of database tables stored in the site database that contain categorization and identification information for over 300,000 software titles and versions, divided into nearly 100 families and almost 2,000 specific categories. These database tables are also used to manage hardware requirements for specific software titles and cataloged CPU properties information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Asset Intelligence catalog has been extended to enable software license information for software titles in use (both Microsoft and non-Microsoft software) to be manually imported, a large collection of known CPU properties, and the hardware requirements for software titles stored in the Asset Intelligence catalog. In addition, the ability to perform local editing of the Asset Intelligence catalog as well as the ability to upload software title information to System Center Online for categorization has been added.

Asset Intelligence catalog updates containing newly released software and hardware definitions will be available for download periodically to perform bulk catalog updates, or the catalog can be dynamically updated by Microsoft Software Assurance (SA) customers using the Asset Intelligence synchronization point site system role.

Software Categories

Using the Software Categories node located under the Customize Catalog Asset Intelligence Configuration Manager console node, administrators can view available software category information stored in the Asset Intelligence catalog.

Asset Intelligence software categories are used to broadly categorize inventoried software titles and are also used as high-level groupings of more specific software families. For example, a software category could be energy companies, and a software family within that software category could be oil and gas or hydroelectric.

Many software categories are predefined in the Asset Intelligence catalog, and additional user-defined categories can be created to further define inventoried software. The validation state for all predefined software categories is always validated, while custom software category information added to the Asset Intelligence catalog is user-defined.

Note
Predefined software category information is read-only and cannot be modified. User-defined software categories can be added, modified, or deleted by administrators. For more information about managing software categories, see How to Manage Software Categories.

Software Families

Using the Software Families node located under the Customize Catalog Asset Intelligence Configuration Manager console node, administrators can view available software family information stored in the Asset Intelligence catalog.

Asset Intelligence software families are used to further define inventoried software titles within software categories. The validation state for all predefined software families is always validated, while custom software family information added to the Asset Intelligence catalog is user-defined.

Note
Predefined software family information is read-only and cannot be modified. User-defined software families can be added, modified, or deleted by administrators. For more information about managing software families, see How to Manage Software Families.

Custom Labels

Using the Custom Labels node located under the Customize Catalog Asset Intelligence Configuration Manager console node, administrators can view all custom labels that have been defined by an administrator.

Custom labels can be used to further categorize inventoried software titles stored in the Asset Intelligence catalog. Administrators can use custom labels to create user-defined groups of software titles that share a common attribute. For example, a custom label could be created called shareware, that custom label could be associated with inventoried shareware titles, and a report could be run to display all software titles that have the custom label shareware associated with them.

Custom labels have no validation state because they are always created locally.

Note
For more information about managing custom labels, see How to Manage Custom Labels.

Inventoried Software Titles

Using the Inventoried Software Titles node located under the Asset Intelligence Configuration Manager console node, administrators can view inventoried software title information collected from Configuration Manager 2007 clients by the hardware inventory client agent that is stored in the Asset Intelligence catalog.

Inventoried software titles can also have up to three custom labels associated with them to enable further user-defined categorization.

The following information is displayed for each inventoried software title:

  • The name of the inventoried software title.
  • The name of the vendor that developed the inventoried software title.
  • The product version of the inventoried software title.
  • The currently assigned software category for the inventoried software title.
  • The currently assigned software family for the inventoried software title.
Note
Because inventoried software title information is obtained through Configuration Manager 2007 client hardware inventory reports, all information except for software category and software family information is read only and cannot be modified.

Processor Properties

Using the Processor Properties node located under the Asset Intelligence Configuration Manager console node, administrators can view processor property information about CPU types stored in the Asset Intelligence catalog.

Note
The processor properties displayed are retrieved from the Asset Intelligence catalog and are not based on inventoried CPU information from Configuration Manager 2007 clients.

The following information is displayed for each CPU listed:

  • The name of the CPU.
  • The date of manufacture for the CPU.
  • The manufacturer of the CPU.
  • The brand ID of the CPU.
  • The processing speed of the CPU (in MHz).
  • Whether or not the CPU is designed for mobile devices.
  • The amount of cache memory available for the CPU.
Note
Processor property information is read only and cannot be modified. Additional CPU information will become available via download from System Center Online during future catalog updates.

Hardware Requirements

Using the Hardware Requirements node located under the Asset Intelligence Configuration Manager console node, administrators can manage software title hardware requirement information stored in the Asset Intelligence catalog. In addition to the default hardware requirements listed, administrators can add new software title hardware requirement information to meet custom requirements.

When the Hardware Requirements node is selected, the hardware requirements for software titles stored in the Asset Intelligence catalog are displayed. Hardware requirements can be used to verify that computers meet the hardware requirements for software titles before they are targeted for software deployments.

Note
The hardware requirements displayed are retrieved from the Asset Intelligence catalog and are not based on inventoried software title information from Configuration Manager 2007 clients.

The following information is displayed for each hardware requirement listed:

  • The software title name that the hardware requirement is associated with.
  • The validation state for the hardware requirement.
    Note
    The validation state for hardware requirements obtained through System Center Online is always validated. The validation state for all custom hardware requirements is always user-defined.

  • The minimum processor speed, in MHz, that the software title requires.
  • The minimum RAM, in KB, that the software title requires.
  • The minimum free disk space, in KB, that the software title requires.
  • The minimum hard disk size, in KB, that the software title requires.

Custom hardware requirements for software titles not stored in the Asset Intelligence catalog can be added, modified, or deleted. However, existing, noncustom hardware requirement information stored in the Asset Intelligence catalog is read only and cannot be deleted.

See Also

Concepts

How to Customize the Asset Intelligence Catalog
Overview of Asset Intelligence


About the Asset Intelligence Synchronization Point

Topic last updated—March 2008

The Asset Intelligence synchronization point is a site system role used to connect to System Center Online over TCP port 443 to manage dynamic Asset Intelligence catalog information updates.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This site role can be installed only on Configuration Manager 2007 SP1 central sites, and all Asset Intelligence catalog customization must be configured using a Configuration Manager console connected to the central site. While all updates must be configured at the central site, Asset Intelligence catalog information is replicated to all child primary sites using normal Configuration Manager 2007 site-to-site communication processes.

Important
Because a System Center Online authentication certificate (.pfx) is required to install this site system role, the Asset Intelligence synchronization point site system can be used only by Microsoft Software Assurance (SA) license customers who have registered with System Center Online and have received the required certificate. For more information about obtaining the System Center Online authentication certificate, see How to Connect to System Center Online.

Using this site role, SA license customers can request on-demand catalog synchronization with System Center Online or schedule automatic catalog synchronization. The Asset Intelligence synchronization point can also be used to upload uncategorized software titles to System Center Online for identification.

See Also

Tasks

How to Install an Asset Intelligence Synchronization Point

Concepts

Overview of Asset Intelligence


About the Asset Intelligence Home Page

Topic Last Updated—August 2008

The Asset Intelligence Configuration Manager 2007 console tree node is the home page for the Asset Intelligence feature in Configuration Manager 2007 SP1. To access the Asset Intelligence home page, in the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Asset Intelligence home page displays a summary dashboard of Asset Intelligence catalog information.

Note
The Asset Intelligence home page does not automatically update while it is being viewed. To refresh the Asset Intelligence home page information while viewing it, click F5.

The Asset Intelligence home page is divided into the following sections:

  • Asset Intelligence summary
  • Asset Intelligence catalog summary
  • Asset Intelligence catalog synchronization status summary
  • Links and resources

Asset Intelligence Summary

The Asset Intelligence summary section of the Asset Intelligence home page contains the following elements.

Asset Intelligence feature state

Specifies whether or not the Asset Intelligence feature has been enabled.

System Center Online service connection status

Specifies the connection status to System Center Online.

Note
An Asset Intelligence Synchronization point site system role is required to connect to System Center Online. For information about installing an Asset Intelligence Synchronization point, see How to Install an Asset Intelligence Synchronization Point.

Asset Intelligence catalog last updated

Specifies the time and date of the last Asset Intelligence catalog update.

Asset Intelligence Catalog Summary

The Asset Intelligence Catalog summary section of the Asset Intelligence home page contains the following elements.

Asset Intelligence catalog summary information tables

Displays Asset Intelligence catalog summary information in table format. The following information is displayed in number format:

  • Inventoried software titles
  • Software categories
  • Software families
In addition, the numbers of each are displayed according to one of the following identification states:

  • Identified by Microsoft
  • Identified by administrator
  • Pending online identification
Asset Intelligence catalog summary information chart

Displays Asset Intelligence catalog summary information in bar chart format. The following information is displayed in percentage format:

  • Inventoried software titles
  • Software categories
  • Software families
The information is displayed using opaque colors according to one of the following identification states:

  • Identified by Microsoft (green)
  • Identified by administrator (blue)
  • Pending online identification (yellow)
  • Unidentified and not pending online identification (red)

Asset Intelligence Catalog Synchronization Status Summary

Note
The Asset Intelligence catalog synchronization status section of the Asset Intelligence home page is only displayed if an Asset Intelligence synchronization point site system role has been installed. For more information about installing an Asset Intelligence synchronization point see How to Install an Asset Intelligence Synchronization Point.

The Asset Intelligence catalog synchronization summary section of the Asset Intelligence home page contains the following elements.

Last download time

Displays the date and time of the last Asset Intelligence catalog synchronization with System Center Online.

Changes to Categories/Families

Displays the number of new software categories added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Changes to Software Titles

Displays the number of new software titles added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Changes to CPU

Displays the number of new processor properties added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Changes to Hardware Requirements

Displays the number of new software title hardware requirements added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Links and Resources

The Links and Resources section of the Asset Intelligence home page contains the following elements.

Navigation

Provides links to Configuration Manager 2007 SP1 console items where Asset Intelligence components can be configured.

Web Reports

Provides links to common Asset Intelligence reports.

Resources

Provides links to external resource information.

See Also

Concepts

Overview of Asset Intelligence


About Asset Intelligence Reports

The Asset Intelligence reports are located under the general Configuration Manager console reporting node. However, for easy discoverability, shortcuts to the available Asset Intelligence reports are displayed in the Asset Intelligence Reports Configuration Manager console node.

Note
The accuracy of installed software title quantities and license information displayed in Asset Intelligence reports might vary from the actual number of software titles installed or licenses in use in the environment because of the complex dependencies and limitations involved in inventorying software license information for software titles installed in enterprise environments. Asset Intelligence reports should not be used as the sole source for determining purchased software license compliance. For more information about the dependencies and limitations involved in Asset Intelligence reporting, see About Asset Intelligence Reporting Limitations.

In This Section

Hardware Reports

License Management Reports

Software Reports

See Also

Concepts

Overview of Asset Intelligence


Hardware Reports

Hardware Asset Intelligence reports provide information about hardware assets within your organization, including age and upgrade readiness. Using hardware inventory information, such as processor age and speed, memory, peripheral devices, and more, Asset Intelligence hardware reports are able to present information about USB devices, hardware in need of upgrade, and even computers that are not ready for a specific software upgrade.

Drill-through Hierarchy

The following diagram shows the hierarchy and drill-through order of the Hardware Asset Intelligence reports.

Hardware Reports diagram

Reports

The following table lists reports in the Hardware Asset Intelligence Reports category and provides a brief description of their purpose. Also noted is the report that can be drilled through to from the report. For more information, see About Report Links.

Note
Several reports drill through to the Computer Details report. For more information about the Computer Details report, see About the Computer Details Page

Note
Some user data in these reports is gathered from the System Security Event Log. For better report accuracy, it is recommended that this log be cleared when reassigning a computer to a new user.

Report Description

Hardware 01A - Summary of Computers in a Specific Collection

This report provides a summary view of all of the computers in a collection.

Drill through to Computer Details.

Hardware 02A - Estimated Computer Age by Ranges within a Collection

This report lists a number of yearly quarters and a count of the computers whose birth dates fall within that quarter. It is useful for migration planning.

Drill through to Hardware 02B - Computers within an age range within a collection report.

Hardware 02B - Computers within an age range within a collection

This report lists all computers that have a CPU that was manufactured within a specified date range.

Available from Hardware 02A - Estimated Computer Age by Ranges within a Collection report.

Drill through to Computer Details.

Hardware 03A - Primary computer users

This report lists all users who are a primary console user of at least one computer and the number of computers for which they are a primary console user. Help desk can use this report to determine the primary contact for a computer. Highlights users that are primary console users for multiple computers.

Drill through to Hardware 03B - Computers for a Specific Primary Console User report.

Hardware 03B - Computers for a Specific Primary Console User

This report gives a summary of all computers for which a specified user is the primary console user.

Available from the following reports:

  • Hardware 03A - Primary computer users
  • Hardware 05A - Console Users on a Specific Computer

Drill through to Computer Details.

Hardware 04A - Shared (multi-user) Computers

This report lists computers within a specified collection that do not have a single user with a login time greater than 66 percent. Can be used to help detect computers that are used as kiosks and terminal servers.

Drill through to Computer Details.

Hardware 05A - Console Users on a Specific Computer

This report lists every console user who has logged on to a specific computer.

Drill through to Hardware 03B - Computers for a Specific Primary Console User.

Hardware 06A - Computers for Which Console Users Could not be Determined

This report lists computers for which the primary console user cannot be determined, typically because security logging is not enabled or the logs have been purged.

Drill through to Computer Details.

Hardware 07A - USB Devices by Manufacturer

This report lists USB devices being used on computers of a collection, organized by manufacturer. Can help identify mass storage units and other USB devices that can be limited or blocked using Vista.

Drill through to Hardware 07B - USB Devices by Manufacturer and Description report.

Hardware 07B - USB Devices by Manufacturer and Description

This report provides descriptions of USB devices made by a specified manufacturer.

Available from Hardware 07A - USB Devices by Manufacturer report.

Drill through to Hardware 07C - Computers with a Specific USB Device report.

Hardware 07C - Computers with a Specific USB Device

This report lists all computers that have been connected to a specified USB device.

Available from Hardware 07B - USB Devices by Manufacturer and Description report.

Drill through to Hardware 07D - USB Devices on a Specific Computer report.

Hardware 07D - USB Devices on a Specific Computer

This report lists all USB devices connected to a specific computer.

Available from Hardware 07C - Computers with a Specific USB Device report.

Drill through to Computer Details.

Hardware 08A - Hardware that is Not Ready for a Software Upgrade

This report states the minimum requirements for installation of a specified software product and lists all computers that do not meet the minimum disk, memory, processor, or operating system requirements for that product.

Note
CPU Requirement, Memory Requirement, Free Disk Requirement, and Total Disk Requirement columns indicate whether this criterion has failed the requirements check.

Drill through to Computer Details.

Hardware 09A - Search for computers

This report provides a summary of computers matching keyword filters on computer name, SMS site, domain, top console user, operating system, manufacturer, or model.

Drill through to Computer Details.

Hardware 10A - Computers that have Changed within a Specified Collection

This report identifies all computers with changes to specified inventory objects within a specified collection and time period.

The following list identifies the inventory classes that provide change information for this report.

  • BIOS
  • CD-ROM
  • Disk
  • Partition
  • Motherboard
  • Network Adapter
  • Operating System
  • Parallel Port
  • Pointing Device
  • Keyboard
  • Processor
  • SCSI Controller
  • Services
  • Tape Drive
  • Desktop Monitor
  • IDE Controller
  • Sound Devices
  • USB Controller
  • Video Controller
  • System Enclosure
  • Installed Software
  • Installed Software MS
  • Auto-Start Software
  • Browser Helper Object

A change in any one of these classes will cause the affected computer to be listed in this report.

Drill through to Hardware 10B - Changes on a Specified Computer within a Time Range report.

Hardware 10B - Changes on a Specified Computer within a Time Range

This report provides a summary of changes to specified inventory objects for a specified computer and time period.

See report Hardware 10A - Computers that have Changed within a Specified Collection for a list of contributing classes.

Available from Hardware 10A - Computers that have Changed with a Specified Collection report.

Drill through to Hardware 10C - Changes in a specified class on a specified computer report.

Hardware 10C - Changes in a specified class on a specified computer

This report lists the details of all changes in specified inventory objects for a specified computer and time period.

See report Hardware 10A - Computers that have Changed within a Specified Collection for a list of contributing classes.

Available from Hardware 10B - Changes on a Specified Computer within a Time Range report.

See Also

Concepts

About Report Links
About the Computer Details Page


License Management Reports

License Management Reports provide information about licensing including number of licenses in use, sales channel, and time until expiration.

Asset Intelligence license management reports provide data about licenses in use. The License Ledger report lists installed Microsoft applications in a format congruent with a Microsoft License Statement. This provides a convenient method of matching purchased licenses with used licenses. Asset Intelligence CAL reports track the number of users and devices that access servers running Microsoft Windows Server or Microsoft Exchange Server software. These reports support better evaluation of CAL usage and needs, providing a means to avoid unintentional software piracy, or over-purchasing of licenses. Other License Management reports provide information about computers acting as Key Management Servers for Windows Vista activation and other Windows Vista activation statistics.

Note
The accuracy of installed software title quantities and license information displayed in Asset Intelligence reports might vary from the actual number of software titles installed or licenses in use in the environment because of the complex dependencies and limitations involved in inventorying software license information for software titles installed in enterprise environments. Asset Intelligence reports should not be used as the sole source for determining purchased software license compliance. For more information about the dependencies and limitations involved in Asset Intelligence reporting, see About Asset Intelligence Reporting Limitations.

Drill-through Hierarchy

The following diagram shows the hierarchy and drill-through order of the License Management reports.

License Management Reports Diagram

Reports

The following table lists reports in the License Management category and provides a brief description of their purpose. Also noted is the report that can be drilled through to from the report. For more information, see About Report Links.

Note
Several reports drill through to the Computer Details report. For more information about the Computer Details report, see About the Computer Details Page

Important
Several of these reports present information about the function of Key Management Service (KMS), a method of administering volume licensing. If a KMS server has not been implemented, some reports may return no data. For more information about KMS, search for KMS on Microsoft TechNet (http://go.microsoft.com/fwlink/?linkid=3225).

Report Description

License 01A - Microsoft License Ledger for Microsoft License Statements

This report lists Microsoft products that are licensed in volume. The format of the report is similar to a Microsoft License Statement. This can be used to compare licenses used against licenses purchased.

Drill through to License 01B - Microsoft License Ledger Item by Sales Channel report.

License 01B - Microsoft License Ledger Item by Sales Channel

This report lists how many installed instances of a specified software title are from specific sales channels.

Typical sales channels include OEM, Volume, and Retail.

Available from License 01A - Microsoft License Ledger for Microsoft License Statements report.

Drill through to License 01C - Computers with a specific Microsoft License Ledger Item and Sales Channel report.

License 01C - Computers with a specific Microsoft License Ledger Item and Sales Channel

This report identifies which computers have a specific item from the Microsoft License Ledger.

Available from License 01B - Microsoft License Ledger Item by Sales Channel report.

Drill through to License 01D - Microsoft License Ledger Products on a Specific Computer report.

License 01D - Microsoft License Ledger Products on a Specific Computer

This report identifies all Microsoft License Ledger items installed on a specific computer.

Available from License 01C - Computers with a specific Microsoft License Ledger Item and Sales Channel report.

Drill through to Computer Details.

License 02A - Count of Licenses Nearing Expiration by Time Ranges

This report lists computers running Windows Vista grouped by specific time ranges in which they will refresh their license activation from the KMS.

Note
No action is required. However, unavailability of a KMS will impact the activation refresh of these devices.

Drill through to License 02B - Computers with Licenses Nearing Expiration report.

License 02B - Computers with Licenses Nearing Expiration

This report identifies computers with licenses that will need to be refreshed by the KMS within a specified time range.

Available from License 02A - Count of Licenses Nearing Expiration by Time Ranges report.

Drill through to License 02C - License Information on a Specific Computer report.

License 02C - License Information on a Specific Computer

This report provides Windows Vista volume licensing information for a specified computer.

Available from the following reports:

  • License 02B - Computers with Licenses Nearing Expiration
  • License 03B - Computers with a Specific License Status
  • License 04B - Computers with a Specific Product Managed by Software Licensing Service

Drill through to Computer Details.

License 03A - Count of Licenses by License Status

This report lists the number of computers that are currently in specific license states. These states are:

  • Unlicensed
  • Licensed
  • Out Of Box Grace
  • Out of Box Tolerance/Expired Grace Period
  • Non-genuine grace

Drill through to License 03B - Computers with a Specific License Status report.

License 03B - Computers with a Specific License Status

This report lists computers that are in a specified license state.

Available from License 03A - Count of Licenses by License Status report.

Drill through to License 02C - License Information on a Specific Computer report.

License 04A - Count of Products Managed by Software Licensing Service

This report lists all the products that Software Licensing Service manages and counts how many computers have each product installed.

Drill through to License 04B - Computers with a Specific Product Managed by Software Licensing Service report.

License 04B - Computers with a Specific Product Managed by Software Licensing Service

This report lists all computers that have a specified product.

Available from License 04A - Count of Products Managed by Software Licensing Service report.

Drill through to License 02C - License Information on a Specific Computer report.

License 05A - Computers Providing Key Management Service

This report lists Windows Vista computers that act as Key Management Servers.

Note
If there are no KMS servers in your collection, then this report will provide no data.

Drill through to Computer Details.

License 06A - Processor Counts for Per-Processor Licensed Products

This report provides the total number of processors on computers using Microsoft products that support per-processor licensing.

License 07A - Client Access License (CAL) Usage - Summary

This report summarizes the usage of user and device CALs by product.

Note
All versions of a product will appear on the same line.

Drill through to License 08B - Client Access License (CAL) utilization details - product specific report.

License 08A - Client Access License (CAL) Usage - Product Specific

This report summarizes the usage of user and device CALs for a Specific Product.

Note
Each version of a product will have its own line.

Drill through to License 08B - Client Access License (CAL) utilization details - product specific report.

License 08B - Client Access License (CAL) Utilization Details - Product Specific

This report provides a list of servers and the number of user and device CALs used on each server.

Available from the following reports:

  • License 07A - Client Access License (CAL) Usage - Summary
  • License 08A - Client Access License (CAL) usage - product specific

License 09A - List of Users Utilizing Windows Server Client Access Licenses (CAL)

This report provides a list of CAL users and allows navigation to detailed user-specific CAL information.

Drill through to License 09B - Client Access License (CAL) utilization details for a specific user report.

License 09B - Client Access License (CAL) Utilization Details for a Specific User

This report provides a list of servers accessed by a specific user.

Available from License 09A - List of users utilizing Windows Server Client Access Licenses (CAL) report.

License 10A - List of Devices Utilizing Windows Server Client Access Licenses (CAL)

This report provides a list of CAL devices and allows navigation to detailed device-specific CAL information.

Drill through to License 10B - Client Access License (CAL) utilization details for a specific device report.

License 10B - Client Access License (CAL) Utilization Details for a Specific Device

This report provides a list of servers accessed by a specific device.

Available from License 10A - List of devices utilizing Windows Server Client Access Licenses (CAL) report.

License 11A - Historical Client Access License (CAL) Utilization

This report provides historical data for CAL usage summaries.

License 12A - Servers from which Client Access License (CAL) usage data cannot be collected

This report provides a count and list of servers from which CAL usage data cannot be collected.

See Also

Concepts

About Report Links
About the Computer Details Page
About Client Access License Reports
About License Ledger Reports


About License Ledger Reports

License ledger reports closely resemble and are intended to be used in conjunction with a Microsoft License Statement. Comparing this report to a Microsoft License Statement allows you to analyze license usage in comparison with purchased licenses.

License 01A - Microsoft License Ledger for Microsoft License Statements

This report lists the Microsoft products installed on computers in a specific collection that are licensed using a volume licensing model. The data is reported in a format similar to a Microsoft License Statement. This report contains the following columns.

Licensed Family Name

Licensed family names are indicative of the general role of the software, such as Microsoft Virtual Server Enterprise, Project Professional, or Windows Server - Standard.

Licensed Product Name

The licensed product name is the specific title of the software, such as Virtual Server - Enterprise 2005 or Windows Server - Standard 2003.

Version Code

The version code associated with the specific version.

Inventoried Quantity

The inventoried quantity represents the number of computers in the inventoried collection on which the specific software is installed.

Note
This quantity does not reflect per-processor counts or multiple instances on a single computer.

License 01B - Microsoft License Ledger Item by Sales Channel

From the License 01A - Microsoft License Ledger for Microsoft License Statements report, you can drill through to the License 01B - Microsoft License Ledger Item by Sales Channel report. This report presents information about a single software item chosen from the License 01A - Microsoft License Ledger for Microsoft License Statements report.

Note
In the Channel column, Full Packaged Product refers to a retail boxed software, Compliance Checked Product refers to an upgrade from a validly licensed version of a product, OEM refers to Original Equipment Manufacturer or software included with a purchased computer, and Volume refers to software purchased with a volume license.

This report contains the following columns.

Product Name

The software title.

Channel

The sales channel associated with the software license. Sales channel codes are described in the following table.

Note
Any values other than those listed in the table are undefined.

Code Sales Channel

0

Full Packaged Product

1

Compliance Checked Product

2

OEM

3

Volume

NULL

Not Available

Inventoried Qty

The inventoried quantity represents the number of computers in the inventoried collection on which the specific software is installed.

Note
This quantity does not reflect per-processor counts or multiple instances on a single computer.

License 01C - Computers with a Specific Microsoft License Ledger Item and Sales Channel

From the License 01B - Microsoft License Ledger Item by Sales Channel report, you can drill through to the License 01C - Computers with a Specific Microsoft License Ledger Item and Sales Channel report. This report presents a list of computers on which are installed the software item from a sales channel chosen from the License 01B - Microsoft License Ledger Item by Sales Channel report. This report contains the following columns.

Computer Name

The name associated with the listed computer.

SMS Site

The SMS site code.

Top Console User

The user, if any, who has used this computer more than 60 percent of the logged time, as computed from the system log using user log-on and log-off events.

Serial Number

The serial number associate with the listed computer.

Asset Number

The asset tag number assigned to the listed computer as listed in the computer's BIOS.

Computer Manufacturer

The name of the manufacturer as listed in the computer's BIOS.

Computer Model

The model of the computer.

Product ID

The ID number associated with this instance of the specified software.

DSL ID

If a Windows Installer or OSD deployment package is tagged with a property named DSL ID, the content of this property will be reported in this column. This provides one means of verification that software was distributed from an approved source.

License 01D - Microsoft License Ledger Products on a Specific Computer

This report identifies all Microsoft license ledger items installed on a specific computer. This report contains the following columns.

Computer Name

The name associated with the listed computer.

Licensed Family Name

Licensed family names are indicative of the general role of the software, such as Microsoft Virtual Server Enterprise, Project Professional, or Windows Server - Standard.

Licensed Product Name

The licensed product name is the specific title of the software, such as Virtual Server - Enterprise 2005 or Windows Server - Standard 2003.

Channel

The sales channel associated with the software license. Sales channel codes are described in the following table.

Note
Any values other than those listed in the table are undefined.

Code Sales Channel

0

Full Packaged Product

1

Compliance Checked Product

2

OEM

3

Volume

NULL

Not Available

See Also

Concepts

License Management Reports


About Client Access License Reports

Client Access License (CAL) reports can be used to verify compliance and analyze current licensing needs. Summary reports provide a count of users or devices over all servers of a given type for the last 90 days and can be compared to the CAL section of a Microsoft License Statement to verify compliance. Detail reports provide information about specific users or devices and can be used to analyze CAL usage to determine whether device CALs or user CALs would be more effective for your needs.

Note
CAL inventory information is collected only from Windows Servers that have the Configuration Manager 2007 client installed. Servers that do not have the Configuration Manager 2007 client installed do not report to the site server.

Inventoried CAL usage for Microsoft Exchange Server is calculated based on authentication to Windows Server on servers that are running Exchange Server. Asset Intelligence CAL reports count all connections to that server as Exchange Server CALs. Therefore, if an Exchange Server is used for other server functions, the reported CAL usage for Exchange Server will be inaccurate.

Important
In large enterprise environments, CAL reports can take several minutes to generate. Due to data volume and database architecture, CAL reports might take several minutes to run.

Summary Reports

Summary reports can be used to verify licensing compliance.

License 06A - Processor Counts for Per-Processor Licensed Products

This report provides the total number of processors on computers using Microsoft products that support per-processor licensing. This report contains the following columns.

Product Name

The software title.

1 Processor Servers

The number of single-processor servers in the specified collection that are running specific Microsoft software that is licensed on a per-processor licensing model.

Each line represents different Microsoft Server software. For example, Microsoft SQL Server 2000 and Microsoft SQL Server 2005 will be represented on different lines.

2 Processor Servers

The number of 2-processor servers in the specified collection that are running specific Microsoft software that is licensed on a per-processor licensing model.

4 Processor Servers

The number of 4-processor servers in the specified collection that are running specific Microsoft software that is licensed on a per-processor licensing model.

8 Processor Servers

The number of 8-processor servers in the specified collection that are running specific Microsoft software that is licensed on a per-processor licensing model.

16 Processor Servers

The number of 16-processor servers in the specified collection that are running specific Microsoft software that is licensed on a per-processor licensing model.

Total Processors

The total number of processors in servers in the specified collection that are running specific Microsoft software that is licensed on a per-processor licensing model.

For example, if there are five 1-processor servers, four 2-processor servers, three 4-processor servers, zero 8-processor servers, and zero 16-processor servers, the total number of processors equals 25.

License 07A - Client Access License Usage - Summary

This report summarizes the usage of user and device CALs by product. This report is not version specific, and all versions of a server product will be summarized on a single line for user CALs and a single line for device CALS. This report contains the following columns.

Product Name

The software title.

Total Servers

The number of servers that provided CAL information for the listed product.

User CALs used in last 90 days

The number of user CALs that have been logged on servers running the listed product over the last 90 days.

User CALs used in last year

The number of user CALs that have been logged on servers running the listed product over the last 365 days.

Device CALs used in last 90 days

The number of device CALs that have been logged on servers running the listed product over the last 90 days.

Device CALs used in last year

The number of device CALs that have been logged on servers running the listed product over the last 365 days.

License 08A - Processor Counts for Per-Processor Licensed Products

This report summarizes the usage of user and device CALs for a specific product. The report is version specific and each version of a server product will be listed on a separate line for user CALs and another separate line for device CALS.

For example, Windows Server 2003, Enterprise Edition is listed on a separate line from Windows Server 2003, Standard Edition. This report contains the following columns.

Product Name

The software title.

Total Servers

The number of servers that provided CAL information for the listed product

User CALs used in last 90 days

The number of user CALs that have been logged on servers running the listed product over the last 90 days.

User CALs used in last year

The number of user CALs that have been logged on servers running the listed product over the last 365 days.

Device CALs used in last 90 days

The number of device CALs that have been logged on servers running the listed product over the last 90 days.

Device CALs used in last year

The number of device CALs that have been logged on servers running the listed product over the last 365 days.

License 11A - Historical Client Access License Utilization

This report provides historical data for CAL usage summaries. The report presents a series of data points showing how many user CALs and device CALs were logged in the 90 days preceding each data point. Data points are created at a specific interval, as set in the Summarize Client Access License Weekly Usage Data task. For more information, see Summarize Client Access License Weekly Usage Data Task Overview. This report contains the following columns.

Date

The date the data point was created.

Product

The software title.

User CALs

The number of user CALs logged on servers running the listed product over the 90 days prior to the date listed for this data point.

Device CALs

The number of device CALs logged on servers running the listed product over the 90 days prior to the date listed for this data point.

License 12A - Servers from Which Client Access License Usage Data Cannot Be Collected

This report provides a count and list of servers from which CAL usage data cannot be collected. The report is divided into summary and detail sections.

The summary section provides a list of reasons that servers cannot provide CAL usage data and the number of servers to which each reason applies. The detail section provides a list of servers that cannot provide CAL usage data and the reason why they cannot. This report contains the following columns.

Number of Servers

The number of servers that cannot report CAL usage data for a specific reason.

Reason Code

This code designates the reason for which the servers cannot report CAL usage data. The following table shows the reason codes and their meanings.

Reason Code Meaning

0

Reason not determined.

1

Server Site code is different from the current site.

2

Server does not have the Configuration Manager 2007 client installed.

3

Asset Intelligence collection cycle has not inventoried this server yet.

Server Name

The name of the server that cannot report CAL usage data.

Site Code

The site that the server belongs to.

Detail Reports

Detail reports are used to analyze usage.

License 08B - Client Access License Utilization Details - Product Specific

This report provides a list of servers and the number of user and device CALs used on each server. Each line of the report is product specific. This report contains the following columns.

Product Name

The software title.

Server Name

The name assigned to the specific server.

User CALs

The number of user CALs logged on the listed server running the listed product over the last 90 days.

Device CALs

The number of device CALs logged on the listed server running the listed product over the last 90 days.

License 09A - List of Users Utilizing Windows Server Client Access Licenses

This report provides a list of users that have accessed servers using Microsoft products that require Client Access Licensing. From this report, you can navigate to detailed user-specific CAL information. This report contains the following columns.

User Name

The user's user name.

Last Access

The date and time of the user's last server access.

License 09B - Client Access License Utilization Details for a Specific User

This report provides a list of servers using Microsoft products that require Client Access Licensing that have been accessed by a specific user. The report is user specific but can reference many servers. This report contains the following columns.

User Name

The specific user's user name.

Server Name

The name assigned to the server.

Last Access

The date and time of the user's last access to the listed server.

License 10A - List of Devices Utilizing Windows Server Client Access Licenses

This report provides a list of devices that have accessed servers using Microsoft products that require Client Access Licensing. From this report, you can navigate to detailed device-specific CAL information. This report contains the following columns.

Device Name

The name assigned to the computer or other device.

Device IP

The IP address of the computer or other device.

Last Access

The date and time of the user's last access to a server using one or more Microsoft products that require Client Access Licensing.

License 10B - Client Access License Utilization Details for a Specific Device

This report provides a list of servers using Microsoft products that require Client Access Licensing that have been accessed by a specific device. This report contains the following columns.

Device Name

The name assigned to the computer or other device.

Device IP

The IP address of the computer or other device.

Note
If the IP address for a device has been changed, it is possible to have more than one IP address listed in this report. However, each line will have the same device name and the IP address associated with the device at the time that it accessed the listed server.

Server Name

The name assigned to the server that the device accessed.

Last Access

The date and time of the user's last access to the listed server.

See Also

Concepts

License Management Reports


Client Access Licensing Overview

Many Microsoft products utilize the Client Access License (CAL) model, including Exchange Server and SQL Server. For a list of Microsoft products for which CALs are required, see the Microsoft CAL Guide at http://go.microsoft.com/fwlink/?LinkId=91230.

Note
At this time, Configuration Manager 2007 tracks CALs only for Windows Server and Exchange Server.

To understand how Microsoft System Center Configuration Manager 2007 can help track and manage CAL usage, it is important to understand that there are several different CAL models and that CALs are product specific. A CAL for Microsoft Exchange Server does not impart the rights to use Microsoft Windows Server, and vice versa.

Important
Purchasing CALs for earlier versions of an application does not grant the right to use later versions of the application. However, purchasing CALs for later versions of applications grants the right to use earlier versions of that application. For example, a CAL purchased for Windows 2000 does not grant the right to use Windows Server 2003. However, a CAL purchased for Windows Server 2003 grants the right to use Windows 2000. This is true with other applications as well, such as Exchange Server and SQL Server.

For more information about user rights associated with CALs, see the Microsoft Volume Licensing Web site at http://go.microsoft.com/fwlink/?LinkId=91231.

Client Access Licenses Models

Three primary CAL models are used for Microsoft Server products: Per User, Per Device, and Per Server. Not all types of CALs are available for all products, and specific products can offer additional types of CALs. For more information about specific CAL licenses, see the Microsoft CAL Guide at http://go.microsoft.com/fwlink/?LinkId=91230.

Per User CAL

With the Per User CAL model, a separate CAL is required for each unique user who accesses a server. If a user uses multiple computers, the user can access the server from each computer using only a single CAL. However, if a different user logs on to one of the computers, that user will need a separate Per User CAL to access the server.

A typical example of the Per User CAL might be for a company that has two Exchange Servers used by 200 employees on 220 computers. This would require two server licenses (to install the product on the servers) and 200 Per User CALs. Because a CAL is assigned to each user, the number of computers accessing the servers is unimportant.

Per Device CAL

With the Per Device CAL model, a separate CAL is required for each unique device that accesses a server. If more than one person uses a specific computer, one CAL will allow all of them to access the server from that computer. However, if one of these users also uses another computer to access the server, the additional computer will need a Per Device CAL as well.

A typical example of the Per Device CAL might be for a company that has two Exchange Servers used by 200 employees on 150 computers. This would require two server licenses (to install the product on the servers) and 150 Per Device CALs. Because a CAL is assigned to each device, the number of users accessing the servers is unimportant.

Per Server CAL

With the Per Server CAL model, a separate CAL is required for each unique device that accesses a server simultaneously. During setup, the server administrator enters the quantity of CALs purchased for the specific server. If this quantity were set to 30, only 30 computers would be allowed to connect to that server simultaneously. However, if that server served a pool of 100 computers, all the computers would have server access as long as no more than 30 were connected at the same time. After a computer disconnected from the server, a CAL would be freed so that another computer could connect to the server. If multiple servers are used to load balance, separate CALs are required for each server. For example, if you were using two exchange servers and purchased 200 Per Server CALs, you would likely assign 100 CALs to each server.

How CAL Counts Are Calculated for Asset Intelligence Reports

When hardware inventory is enabled for client computers, the Configuration Manager 2007 hardware inventory client agent analyzes Security Audit logs on computers running a Windows Server operating system. The list of users and IP addresses that have contacted the server is then included in the hardware inventory report sent by the client. When an Asset Intelligence CAL report is run, the information gathered from clients is consolidated based on the CAL models previously described. Reports accumulate CAL usage separately for each version of Windows. Additionally, the number of users and computers that have connected to Windows servers running Exchange Server are compiled and reported as Exchange CALs.

The following specific assumptions have been made about user and device Exchange CALs, as well as Windows Server device CALs:

  • Exchange CAL calculation assumes that Exchange Server is installed on a single workload computer. If other server products run on the same computer, users or devices connecting only to those other products will be reported as Exchange CALs.
  • Device CAL reports identify computers by IP address. Because of this, the following might be observed when inventorying Device CAL usage:
    • If some clients are behind a router with Network Address Translation, all computers connecting through the single IP address will be counted as one.
    • If a computer uses more than one IP address due to multiple Network Interface Cards, each IP address will be counted as a separate device CAL.
    Note
    User CALs are not based on IP address and are not affected by these IP-related limitations.

Due to the previously listed limitations, CAL reports in general, and especially Device CAL reports, should be used as a baseline for CAL usage analysis rather than an authoritative summary of CAL usage. Additionally, the number of servers from which CAL usage is reported might differ from the number of servers in a collection if the security event logs for all servers are not configured to log success logon events. For more information about prerequisites for collecting CAL information, see Prerequisites for Asset Intelligence.

See Also

Concepts

License Management Reports


Software Reports

Topic last updated—March 2008

Software Asset Intelligence reports provide information about software families, categories, and specific software titles installed on computers within your organization.

In addition to hardware information, information is gathered about installed software, which can be identified and categorized by a software category and family. Asset Intelligence reports present information about browser helper objects, auto-start software, and more. These reports can be used to identify ad-ware, spy-ware, and other malware, and can help identify software redundancy to help streamline software purchasing and support.

Note
The accuracy of installed software title quantities and license information displayed in Asset Intelligence reports might vary from the actual number of software titles installed or licenses in use in the environment because of the complex dependencies and limitations involved in inventorying software license information for software titles installed in enterprise environments. Asset Intelligence reports should not be used as the sole source for determining purchased software license compliance. For more information about the dependencies and limitations involved in Asset Intelligence reporting, see About Asset Intelligence Reporting Limitations.

Drill-through Hierarchy

The following diagram shows the hierarchy and drill-through order of the Software Asset Intelligence reports.

Software Reports Diagram

Reports

The following table lists reports in the Software Asset Intelligence Reports category and provides a brief description of their purpose. Also noted is the report that can be drilled through to from each report. For more information, see About Report Links.

Note
Several reports drill through to the Computer Details report. For more information about the Computer Details report, see About the Computer Details Page

Report Description

Software 01A - Summary of Installed Software in a Specific Collection

This report provides a summary of installed software.

Drill through to Software 02D - Computers with a Specific Software Product report.

Software 02A - Software Families

This report lists high-level software families and provides the starting point for drilling through into the Asset Intelligence catalog categories. Typical families include Communications, Corporate, Personal, Management, and PDA.

Drill through to Software 02B - Software Categories with a Family report.

Software 02B - Software Categories with a Family

This report lists role-specific groupings within a software family. Some examples are HR, Accounting, and Sales within Corporate and Games, DVD Players, and Gambling within Personal.

Available from Software 02A - Software Families report.

Drill through to Software 02C - Software by Category and Family report.

Software 02C - Software by Category and Family

This report lists all installed software that belongs to the specified family and category.

Available from Software 02B - Software Categories with a Family report.

Drill through to Software 02D - Computers with a Specific Software Product report.

Software 02D - Computers with a Specific Software Product

This report lists computers on which the specified software product is installed.

Available from the following reports:

  • Software 01A - Summary of Installed Software in a Specific Collection
  • Software 02C - Software by Category and Family
  • Software 03A - Uncategorized Software
  • Software 06A - Search for Installed Software report.

Drill through to Software 02E - Installed Software on a Specific Computer report.

Software 02E - Installed Software on a Specific Computer

This report lists all software installed on a specified computer. This information can be useful for Help desk operations and security.

Available from the Software 02D - Computers with a Specific Software Product report.

Drill through to Computer Details.

Software 03A - Uncategorized Software

This report lists all software that is categorized as unknown or is not categorized. This may include line-of-business applications, custom packages, or newly released software that has not yet been added to the catalog.

Drill through to Software 02D - Computers with a Specific Software Product report.

Software 04A - Auto-Start Software

This report lists all software that starts with Windows and can highlight malware, spy-ware, ad-ware, and other applications that can cause degradation of performance. This report spans the entire organization or collection.

Drill through to Software 04B - Computers with a Specific Auto-Start Software report.

Software 04B - Computers with a Specific Auto-Start Software

This report lists all computers for which the specified piece of software is configured to start automatically.

Available from Software 04A - Auto-Start Software report.

Drill through to Software 04C - Auto-Start Software on a Specific Computer.

Software 04C - Auto-Start Software on a Specific Computer

This report lists all software that starts with Windows on a specific computer and can highlight malware, spy-ware, ad-ware, and other applications that can cause degradation of performance.

Available from Software 04B - Computers with a Specific Auto-Start Software report.

Drill through to Computer Details.

Software 05A - Browser Helper Objects

This report identifies applications, typically downloaded from the Internet, that embed themselves in your browser. Toolbars and malware are typical examples that pose potential security risks.

Drill through to Software 05B - Computers with a Specific Browser Helper Object report.

Software 05B - Computers with a Specific Browser Helper Object

This report lists computers that have a specified browser helper object. It could be used to identify computers from which to remove a specific piece of malware.

Available from Software 05A - Browser Helper Objects report.

Drill through to Software 05C - Browser Helper Objects on a Specific Computer report.

Software 05C - Browser Helper Objects on a Specific Computer

This report lists all browser helper objects for a specified computer.

Available from Software 05B - Computers with a Specific Browser Helper Object report.

Drill through to Computer Details.

Software 06A - Search for Installed Software

This report identifies instances of software products matching a specific Publisher, Product Name, and Version.

Drill through to Software 02D - Computers with a Specific Software Product report.

Software 07A - Recently Used Executables by Number of Computers

This report lists executables that have been used recently with a count of computers on which they have been used.

Drill through to Software 07B - Computers that Recently Used a Specified Executable report.

Software 07B - Computers that Recently Used a Specified Executable

This report lists the computers on which a specified executable has recently been used.

Available from Software 07A - Recently Used Executables by Number of Computers report.

Drill through to Software 07C - Recently Used Executables on a Specific Computer report.

Software 07C - Recently Used Executables on a Specific Computer

This report lists executables that have been used recently on a specified computer.

Available from Software 07B - Computers that Recently Used a Specified Executable report.

Drill through to Computer Details.

Software 08A - Recently Used Executables by Number of Users

This report lists executables that have been used recently with a count of users that have recently used them.

Drill through to Software 08B - Users that Recently Used a Specified Executable report.

Software 08B - Users that Recently Used a Specified Executable

This report lists the users that have recently used a specified executable.

Available from Software 08A - Recently Used Executables by Number of Users report.

Drill through to Software 08C - Recently Used Executables by a Specified User report.

Software 08C - Recently Used Executables by a Specified User

This report lists executables that have been used recently by a specified user.

Available from Software 08B - Users that Recently Used a Specified Executable report.

Software 09A – Infrequently used software

Note
This Asset Intelligence report is only available in Configuration Manager 2007 SP1 sites.

This report displays software titles that have not been used during a specified period of time.

Drill through to Software 09B – Computers with infrequently used software installed report.

Software 09B – Computers with infrequently used software installed

Note
This Asset Intelligence report is only available in Configuration Manager 2007 SP1 sites.

This report displays computers which have software installed that has not been used in a specified period of time.

Available from Software 09A – Infrequently used software report.

Software 10A – Software titles with specific, multiple custom labels defined

Note
This Asset Intelligence report is only available in Configuration Manager 2007 SP1 sites.

This report displays software titles that have all custom labels specified associated with them.

Drill through to Software 10B – Computers with a specific custom label software title installed report.

Software 10B – Computers with a specific custom label software title installed

Note
This Asset Intelligence report is only available in Configuration Manager 2007 SP1 sites.

This report displays all computers in a collection that have a specified custom labeled software title installed.

Available from Software 10A – Software titles with specific, multiple custom labels defined report.

Software 11A – Software titles with a specific custom label defined

Note
This Asset Intelligence report is only available in Configuration Manager 2007 SP1 sites.

This report displays software titles that have at least one of the selected custom labels associated with them.

Drill through to Software 10B – Computers with a specific custom label software title installed report.

Software 12A – Software titles without a custom label

Note
This Asset Intelligence report is only available in Configuration Manager 2007 SP1 sites.

This report displays all software titles that do not have a custom label defined.

Drill through to Software 02D – Computers with a specific software product report.

See Also

Concepts

About Report Links
About the Computer Details Page


About Asset Intelligence Reporting Limitations

Topic last updated—March 2008

Asset Intelligence reports are capable of providing large amounts of information about installed software titles and purchased software licenses in use. However, they should not be used as the sole source for determining purchased software license compliance.

Example Dependencies

The accuracy of installed software title quantities and license information displayed in Asset Intelligence reports can vary from the actual amounts currently in use because of the complex dependencies involved in inventorying software license information for software titles in use in enterprise environments.

The following are example dependencies involved in inventorying installed software and license usage in the enterprise using Asset Intelligence that might affect the accuracy of Asset Intelligence reports:

Client hardware inventory dependencies

Asset Intelligence installed software reports are based on data collected from SMS or Configuration Manager clients by extending hardware inventory to enable Asset Intelligence reporting. Because of this dependency on hardware inventory reporting, Asset Intelligence reports will reflect data only from SMS or Configuration Manager clients that successfully complete hardware inventory processes with the required Asset Intelligence WMI reporting classes enabled. In addition, because SMS or Configuration Manager clients perform hardware inventory processes on a schedule defined by the administrator, there might be a delay in data reporting that affects the accuracy of Asset Intelligence reports. For example, an inventoried, licensed software title might be uninstalled after the client completes a successful hardware inventory cycle, but the software title will still appear as installed in Asset Intelligence reports until the client’s next scheduled hardware inventory reporting cycle.

Software packaging dependencies

Because Asset Intelligence reports are based on installed software title data collected using standard SMS or Configuration Manager client hardware inventory processes, some software title data might not be properly collected. For example, software installations that do not conform to standard installation processes or software installations that have been modified prior to installation might result in inaccurate Asset Intelligence reporting results.

Server role dependencies

When utilizing CAL reporting, it is important to remember that these reports were designed to provide visibility into the usage of specific products in specific scenarios—for example, a server running a Windows Server operating system supporting a single server role. Licensed software title usage in different scenarios might produce inaccurate results—for example, the case of a server running a Windows Server operating system supporting multiple roles, such as Exchange mail server or SQL Server database server. When deciding to use Asset Intelligence to report license usage and information, keep in mind that it was designed only to provide visibility into license usage. For example, even if your license agreement allows you to use certain software in a lab or classroom environment without charge, Asset Intelligence will be able to detect only installed software in use and report it as such. In such a case, relying solely on Asset Intelligence might result in overpayment.

Location and usage

When deciding to use Asset Intelligence to report license usage and information, keep in mind that it was designed only to provide visibility into license usage. For example, even if your license agreement allows you to use certain software in a lab or classroom environment without charge, Asset Intelligence will be able to detect only installed software in use and report it as such. In such a case, relying solely on Asset Intelligence might result in overpayment.

Legal Limitations

The information displayed in Asset Intelligence reports are subject to many limitations and the information displayed in them does not constitute legal, accounting, or other professional advice. The information provided by Asset Intelligence reports is for informational purposes only and should not be used as the sole source of information for determining software license usage compliance.

The following are example limitations involved in inventorying installed software and license usage in the enterprise using Asset Intelligence that might affect the accuracy of Asset Intelligence reports:

Microsoft license usage quantity limitations

  • The quantity of purchased Microsoft software licenses is based on information supplied by administrators and should be closely reviewed to ensure that the correct number of software licenses is provided.
  • The Microsoft software license quantity reported contains information only for Microsoft software licenses acquired through volume licensing programs and does not reflect information for software licenses acquired through retail, Original Equipment Manufacturer (OEM), or other software license sales channels.
  • Software licenses acquired in the last 45 days might not be included in the Microsoft software license quantities reported because of software reseller reporting requirements and schedules.
  • Software license transfers as a result of company mergers or acquisitions might not be reflected in Microsoft software license quantities.
  • Nonstandard terms and conditions in a Microsoft Volume Licensing (MVLS) agreement might affect the number of software licenses reported and, consequently, might require additional review by a Microsoft representative.
Installed software title quantity limitations

The accuracy of installed software title quantities in Asset Intelligence reports relies on fully functioning SMS or Configuration Manager clients successfully completing hardware inventory reporting cycles and installation on appropriate computers. Additionally, there might be a delay between installation or uninstallation of a licensed software title after a successful hardware inventory reporting cycle that will not be reflected in Asset Intelligence reports run before the client reports its next scheduled hardware inventory.

License reconciliation limitations

The reconciliation of installed software title quantities to the quantity of purchased software licenses is calculated by using a comparison of the license quantity specified by the administrator and the installed software title quantities collected from SMS or Configuration Manager client hardware inventories based on the schedule set by the administrator. This comparison does not represent a final license position conclusion by Microsoft. The actual license position depends on the specific software title license and usage rights granted by the license terms.

See Also

Concepts

Overview of Asset Intelligence


About Asset Intelligence Validation States

Topic last updated—March 2008

Asset Intelligence validation states represent the source and current validation status of Asset Intelligence catalog information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Validation States

Possible Asset Intelligence validation states and administrator actions that can cause them are displayed in the following table.

State Definition Administrator action Comment

Validated

Catalog item has been defined by System Center Online researchers.

None.

Best state.

User Defined

Catalog item has not been defined by System Center Online researchers.

Customized the local catalog information.

This state will be displayed in Asset Intelligence reports.

Pending

Catalog item has not been defined by System Center Online researchers, but the item has been submitted to System Center Online for categorization.

Requested categorization from System Center Online.

Catalog item will remain in this state until System Center Online researchers categorize the item and the Asset Intelligence catalog is synchronized.

Updateable

A user-defined catalog item has been categorized differently by System Center Online during subsequent catalog synchronization.

Customized the local Asset Intelligence catalog to categorize an item as user-defined.

Administrator can use the Software Details Conflict Resolution dialog box to decide whether or not to use the new categorization information or the previous user-defined value.

Note
After a categorization conflict has been resolved, the item will not be validated as conflicting again unless subsequent categorization updates introduce new information about the item.

Uncategorized

Catalog item has not been defined by System Center Online researchers, the item has not been submitted to System Center Online for categorization, and the administrator has not assigned a user-defined categorization value.

None.

Request categorization or customize local catalog information.

This is base state for all unknown software.

See Also

Concepts

Overview of Asset Intelligence
Validation State Transition Examples


Prerequisites for Asset Intelligence

Topic last updated—January 2008

The Asset Intelligence feature in Configuration Manager 2007 has both external dependencies and dependencies within the product that should be considered when implementing Asset Intelligence or attempting to view Asset Intelligence report information.

The prerequisites for Asset Intelligence in Configuration Manager 2007 include the following:

  • Client agent prerequisites
  • Hardware inventory file modification prerequisites
  • Site maintenance task prerequisites
  • Windows event log setting prerequisites

Client Agent Prerequisites

The Asset Intelligence reports depend on client information obtained through client hardware and software inventory reports.

To obtain the information necessary for all Asset Intelligence reports, the following client agents must be enabled:

  • Hardware inventory client agent
  • Software metering client agent

Hardware Inventory Client Agent Dependencies

To collect inventory data required for some Asset Intelligence reports, the hardware inventory client agent must be enabled. In addition, some hardware inventory reporting classes must be enabled in the SMS_DEF.mof file on the primary site server computer.

For information about enabling the Hardware Inventory Client Agent, see How to Configure Hardware Inventory for a Site.

Software Metering Client Agent Dependencies

A number of Asset Intelligence software reports depend on the software metering client agent for data. For information about enabling the software metering client agent, see How to Configure Software Inventory for a Site.

The following Asset Intelligence reports depend on the software metering client agent to provide data:

  • Software 07A - Recently Used Executables by Number of Computers
  • Software 07B - Computers that Recently Used a Specified Executable
  • Software 07C - Recently Used Executables on a Specific Computer
  • Software 08A - Recently Used Executables by Number of Users
  • Software 08B - Users that Recently Used a Specified Executable
  • Software 08C - Recently Used Executables by a Specified User

Hardware Inventory File Modification Prerequisites

Important file modification prerequisites apply to the Configuration.mof file and to the SMS_def.mof file.

For more information about the Configuration.mof file, see About MOF Files Used by Hardware Inventory.

For more information about editing the Configuration.mof file, see How to Extend Hardware Inventory Using the Configuration.mof File.

Configuration.mof File Modification Prerequisites

Client Access License (CAL) data collection must be enabled in the Configuration.mof hardware inventory data class file to provide data for the Asset Intelligence Client Access License reports. To enable CAL data collection, the Configuration.mof file must be edited and associated maintenance tasks must be enabled. In addition, computer security policies must be configured to audit Success logon events. For more information about enabling success event logging, see How to Enable Success Logon Event Logging.

For more information about Asset Intelligence CAL data reports, see About Client Access License Reports .

For more information about the maintenance tasks that must be enabled to support the Asset Intelligence CAL reports, see the "Site Maintenance Task Prerequisites" section in this topic.

To enable data collection for CAL data, the CCM_CALTrackConfig WMI data class must be edited in the Configuration.mof file to configure the following required settings.

Note
The Configuration.mof file is located on the primary site server computer in the <ConfigMgr installation directory> \ Inboxes \ clifiles.src \ hinv directory.

CALCollectionType

The CALCollectionType parameter controls whether CALs are tracked for devices, users, or both. To enable CAL data collection, the CALCollectionType parameter value must be changed from the default value of 0 to a value that specifies the type of data to be collected. The CALCollectionType parameter can be set to one of the values described in the following table.

Parameter Setting | Setting Description
0 | Data collection disabled
1 | User CAL collection only
2 | Device CAL collection only
3 | All CAL collection enabled
Note
If you want to enable CAL data collection on more than one Configuration Manager 2007 or Configuration Manager 2007 SP1 primary site, the Configuration.mof file for each site must be edited.

CALCollectionFrequencyDays

A single server can be accessed regularly by thousands of users and devices. Creating a record in the Configuration Manager site database for each connection could result in high network bandwidth usage. Polling for which users or devices access the server on a weekly basis is adequate for tracking CAL usage. The CALCollectionFrequencyDays parameter value controls the frequency, in days, of CAL data collection. The default value is 7 days, but a value between 0 and 90 days can be specified. Setting this parameter to 0 causes polling to be run based on the CALCollectionFrequencyMinutes parameter.

CALCollectionFrequencyMinutes

When the CALCollectionFrequencyDays parameter setting is set to 0, polling occurs based on the CALCollectionFrequencyMinutes parameter setting. The CALCollectionFrequencyMinutes parameter setting controls the frequency, in minutes, of CAL data collection. A value between 1 and 1,440 minutes can be specified.

Note
Polling for CAL information too frequently in large sites can result in a significant network impact.

CALCollectionTimeWindow

Current Microsoft licensing models allow for CALs to be reassigned every 90 days. The CALCollectionTimeWindow parameter reflects this licensing model. If the model is changed, this parameter can be adjusted to agree with the new licensing model. The default is 90 days, but a value between 1 and 365 days can be specified.

CALSupportedWindowsVersions

To limit polling to servers, this parameter lists the operating system versions that are polled for client access information. This parameter setting should not be modified. Modification of this setting will result in inaccurate CAL counts. The default value is “5.0,5.2,6.0."

SMS_def.mof Modification Prerequisites

The following hardware inventory reporting classes in the SMS_def.mof file can be enabled to support Asset Intelligence reporting requirements:

Note
The SMS_def.mof file is located on the primary site server computer at <ConfigMgr installation directory> \ Inboxes \ clifiles.src \ hinv directory.

  • SMS_SystemConsoleUsage
  • SMS_SystemConsoleUser
  • SMS_InstalledSoftware
  • SMS_AutoStartSoftware
  • SMS_BrowserHelperObject
  • SMS_InstalledExecutable
  • SMS_SoftwareShortcut
  • SoftwareLicensingService
  • SoftwareLicensingProduct

For more information about hardware inventory reporting classes used by Asset Intelligence, see Hardware Inventory Reporting Classes Required for Asset Intelligence Reports.

Site Maintenance Task Prerequisites

Two site maintenance tasks are associated with CAL information stored in the site database:

  • Delete Aged Client Access License Data Properties
  • Summarize Client Access License Weekly Usage Data

For information about enabling and scheduling site maintenance tasks, see How To Schedule a Site Maintenance Task

Delete Aged Client Access License Data

The Delete Aged Client Access License Data maintenance task is not necessary for data collection, but it should be enabled to prevent the accumulation of unnecessary data stored in the site database. The purpose of this task is to periodically delete aged CAL data from the site database that is no longer needed.

For more information, see Delete Aged Client Access License Data Task Overview.

Summarize Client Access License Weekly Usage Data

The Summarize Client Access License Weekly Usage Data task establishes summaries of usage over time and directly supports the Asset Intelligence license management report: License 11A - Historical Client Access License (CAL) Utilization.

The CAL data that is collected from client hardware inventory reports represents a single computer at a single point in time. To have meaningful reports, it is necessary to periodically gather these points together into summaries that are stored and used for the purpose of tracking usage trends over time.

For more information, see Summarize Client Access License Weekly Usage Data Task Overview.

Windows Event Log Setting Prerequisites

Four Asset Intelligence reports display information gathered from the Windows security event logs on client computers. If the security event log settings are not set correctly, these reports will contain no data, even if the appropriate hardware inventory reporting class is enabled.

The following Asset Intelligence reports rely on collected Windows security event log information:

  • Hardware 3A - Primary Computer Users
  • Hardware 3B - Computers for a Specific Primary Console User
  • Hardware 4A - Shared (Multi-user) Computers
  • Hardware 5A - Console Users on a Specific Computer

To enable the hardware inventory client agent to inventory the information required to support these reports, you must first modify the Windows security event log settings on clients to log all Success logon events, as well as enable the SMS_SystemConsoleUser SMS_def.mof reporting class. For more information about modifying security event log settings to log all Success logon events, see How to Enable Success Logon Event Logging.

Note
The SMS_SystemConsoleUser SMS_def.mof reporting class will retain successful logon data for only the previous 90 days of the security event log, regardless of the length of the log. If the security event log has fewer than 90 days of data, the entire log is read.

See Also

Concepts

Asset Intelligence in Configuration Manager
Hardware Inventory Reporting Classes Required for Asset Intelligence Reports


Hardware Inventory Reporting Classes Required for Asset Intelligence Reports

Topic last updated—January 2008

Several hardware inventory reporting classes in the SMS_def.mof file can be enabled to support Asset Intelligence reporting requirements.

To enable data collection for client access license data, in addition to the SMS_def.mof reporting classes described in the following table, the CCM_CALTrackConfig WMI data class must be edited in the Configuration.mof file. For more information about editing the CCM_CALTrackConfig data class in the Configuration.mof file, see Prerequisites for Asset Intelligence.

Note
The Configuration.mof and SMS_def.mof files are located on the primary site server computer at <ConfigMgr installation directory> \ Inboxes \ clifiles.src \ hinv directory.

Hardware inventory reporting class Reporting class description

SMS_InstalledSoftware

This class tracks information about installed software. The following reports are dependent on this class:

  • License 1C - Computers with a specific Microsoft License Ledger Item and Sales Channel
  • Software 1A - Summary of Installed Software in a Specific Collection
  • Software 2A - Software Families
  • Software 2B - Software Categories with a Family
  • Software 2C - Software by Category and Family
  • Software 2D - Computers with a Specific Software Product
  • Software 2E - Installed Software on a Specific Computer
  • Software 3A - Uncategorized Software
  • Software 6A - Search for Installed Software

SMS_InstalledSoftwareMS

This class tracks information specifically about installed Microsoft software. The following reports are dependent on this class:

  • License 1A - Microsoft License Ledger for Microsoft License Statements
  • License 1B - Microsoft License Ledger Item by Sales Channel
  • License 1C - Computers with a specific Microsoft License Ledger Item and Sales Channel
  • License 1D - Microsoft License Ledger products on a specific computer

SMS_SystemConsoleUsage

This class polls the System Security Event Log for information about all console usage. The following reports are dependent on this class:

  • Hardware 1A - Summary of Computers in a Specific Collection
  • Hardware 2B - Computers within an age range with a collection
  • Hardware 3A - Primary computer users
  • Hardware 3B - Computers for a Specific Primary Console User
  • Hardware 4A - Shared (multi-user) Computers
  • Hardware 5A - Console Users on a Specific Computer
  • Hardware 6A - Computers for Which Console Users Could not be Determined
  • Hardware 7C - Computers with a Specific USB Device
  • Hardware 8A - Hardware that is Not Ready for a Software Upgrade
  • Hardware 9A - Search for computers
  • License 1C - Computers with a specific Microsoft License Ledger Item and Sales Channel
  • License 2B - Computers with Licenses Nearing Expiration
  • License 3B - Computers with a Specific License Status
  • License 4B - Computers with a Specific Product Managed by Software Licensing Service
  • Software 2D - Computers with a Specific Software Product
  • Software 4B - Computers with a Specific Auto-Start Software
  • Software 5B - Computers with a Specific Browser Helper Object

SMS_SystemConsoleUser

This class polls the System Security Event Log for information about specific console users. The following reports are dependent on this class:

  • Hardware 3A - Primary computer users
  • Hardware 3B - Computers for a Specific Primary Console User
  • Hardware 4A - Shared (multi-user) Computers
  • Hardware 5A - Console Users on a Specific Computer
Important
This class requires that the security event log on client computers has been configured to record successful log on events.

This class will retain data for only the previous 90 days of the event log, regardless of the length of the log. If the log has fewer than 90 days of data, the entire log is read.

SMS_AutoStartSoftware

This class tracks information about software that starts automatically with the operating system. The following reports are dependent on this class:

  • Software 4A - Auto-Start Software
  • Software 4B - Computers with a Specific Auto-Start Software
  • Software 4C - Auto-Start Software on a Specific Computer

SMS_BrowserHelperObject

This class tracks browser helper objects. While some browser helper objects are beneficial, most software considered "malware" is in the form of browser helper objects. The following reports are dependent on this class:

  • Software 5A - Browser Helper Objects
  • Software 5B - Computers with a Specific Browser Helper Object
  • Software 5C - Browser Helper Objects on a Specific Computer

Win32_USBDevice

This class tracks devices connected to USB ports. The following reports are dependent on this class:

  • Hardware 7A - USB Devices by Manufacturer
  • Hardware 7B - USB Devices by Manufacturer and Description
  • Hardware 7C - Computers with a Specific USB Device
  • Hardware 7D - USB Devices on a Specific Computer

SMS_Processor

This is an existing SMS class to which new properties have been added to provide more complete data about processors. The following reports are dependent on this class:

  • Hardware 1A - Summary of Computers in a Specific Collection
  • Hardware 2A - Estimated Computer Age by Ranges within a Collection
  • Hardware 2B - Computers within an age range with a collection
  • Hardware 8A - Hardware that is Not Ready for a Software Upgrade
  • Hardware 9A - Search for computers

SoftwareLicensingService

This class is specific to Windows Vista. For more information, see the Microsoft TechNet article titled Windows Vista Volume Activation 2.0 Technical Attributes at http://go.microsoft.com/fwlink/?LinkId=87205. The following reports are dependent on this class:

  • License 2C - License Information on a Specific Computer
  • License 5A - Computers Acting as a Key Management Service

SoftwareLicensingProduct

This class is specific to Windows Vista. For more information, see the Microsoft TechNet article titled Windows Vista Volume Activation 2.0 Technical Attributes at http://go.microsoft.com/fwlink/?LinkId=87205. The following reports are dependent on this class:

  • License 2A - Count of Licenses Nearing Expiration by Time Ranges
  • License 2B - Computers with Licenses Nearing Expiration
  • License 2C - License Information on a Specific Computer
  • License 3A - Count of Licenses by License Status
  • License 3B - Computers with a Specific License Status
  • License 4A - Count of Products Managed by Software Licensing
  • License 4B - Computers with a Specific Product Managed by Software Licensing Service

See Also

Concepts

Prerequisites for Asset Intelligence


Configuring Asset Intelligence

Topic last updated—March 2008

The tasks in this section provide information and the steps that are required to configure Asset Intelligence in Configuration Manager 2007 and Configuration Manager 2007 SP1.

For information about Asset Intelligence post-configuration tasks in Configuration Manager 2007 and Configuration Manager 2007 SP1, see Tasks for Asset Intelligence.

In This Section

Asset Intelligence Configuration Checklist

How to Enable Asset Intelligence

How to Enable Success Logon Event Logging

How to Import Software License Information

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Connect to System Center Online

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Install an Asset Intelligence Synchronization Point

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Enable the Asset Intelligence Synchronization Point

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Configure Asset Intelligence Object Security for Asset Managers

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Disable Asset Intelligence

How to Disable the Asset Intelligence Synchronization Point

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Concepts

Asset Intelligence in Configuration Manager


Asset Intelligence Configuration Checklist

Topic last updated—March 2008

The following checklists outline the steps you should take when configuring Asset Intelligence in Configuration Manager 2007 and Configuration Manager 2007 SP1 sites after required Asset Intelligence planning has been completed.

Before using these checklists, ensure that you have reviewed the prerequisites for the Asset Intelligence feature. For more information about the prerequisite requirements for Asset Intelligence, see Prerequisites for Asset Intelligence.

Asset Intelligence Configuration Checklist for Configuration Manager 2007

The following checklist provides the steps required to configure Asset Intelligence in Configuration Manager 2007.

Step Reference

By default, in new installations of Configuration Manager 2007, Asset Intelligence information collection is not enabled. To enable the Asset Intelligence feature, at least one of the required hardware inventory reporting classes that Asset Intelligence reports rely on must be enabled.

When a Systems Management Server 2003 SP3 site with the Asset Intelligence feature already installed and enabled is upgraded to Configuration Manager 2007, Asset Intelligence data collection will remain enabled.

Similarly, when a Configuration Manager 2007 site with the Asset Intelligence feature already installed and enabled is upgraded to Configuration Manager 2007 SP1, Asset Intelligence data collection will remain enabled.

Note
Asset Intelligence reports that depend on the hardware inventory classes enabled during this step will not display data until clients have successfully completed a hardware inventory cycle using the updated inventory reporting policy generated by enabling Asset Intelligence reporting classes.

How to Enable Asset Intelligence

Note
The procedures in this topic detail the steps necessary to enable Asset Intelligence in both Configuration Manager 2007 and Configuration Manager 2007 SP1 installations.

To enable data to be collected for Asset Intelligence console usage and Client Access License (CAL) reports, CAL usage data collection must be enabled in the Configuration.mof hardware inventory settings file and computer security policy logon settings must be configured to enable auditing of success logon events.

Prerequisites for Asset Intelligence

How to Enable Success Logon Event Logging

To disable the Asset Intelligence feature, all hardware inventory reporting classes that Asset Intelligence reports rely on must be disabled.

How to Disable Asset Intelligence

Note
The procedures in this topic detail the steps necessary to disable Asset Intelligence both in Configuration Manager 2007 and in Configuration Manager 2007 SP1 installations.

Asset Intelligence Configuration Checklist for Configuration Manager 2007 SP1

The following checklist provides the steps required to configure Asset Intelligence in Configuration Manager 2007 SP1 in addition to the configuration steps required for Asset Intelligence in Configuration Manager 2007.

Step Reference

To enable software license usage reports in Asset Intelligence, software licenses must be imported into the Asset Intelligence catalog.

Microsoft and non-Microsoft software licenses can be imported into the Asset Intelligence catalog using the Asset Intelligence License Import Wizard.

How to Import Software License Information

Before installing an Asset Intelligence synchronization point site role, a System Center Online authentication certificate must be obtained.

Note
This step is applicable only to Software Assurance (SA) license customers.

How to Connect to System Center Online

To connect to System Center Online for dynamic Asset Intelligence catalog updates, an Asset Intelligence Synchronization point site system role must be installed as a site system for the central site of the hierarchy.

Note
This step is applicable only to SA license customers.

How to Install an Asset Intelligence Synchronization Point

To perform scheduled Asset Intelligence catalog synchronizations with System Center Online, the Asset Intelligence synchronization point must be enabled and a synchronization schedule must be specified.

Note
This step is applicable only to SA license customers.

How to Enable the Asset Intelligence Synchronization Point

To disable scheduled Asset Intelligence catalog synchronization with System Center Online, the Asset Intelligence synchronization point must be disabled.

If the Asset Intelligence synchronization point is not configured to perform scheduled synchronizations with System Center Online, the Asset Intelligence catalog must be manually synchronized with System Center Online.

Note
This step is applicable only to SA license customers.

How to Disable the Asset Intelligence Synchronization Point

How to Manually Request Asset Intelligence Catalog Synchronization

See Also

Concepts

Configuring Asset Intelligence


How to Enable Asset Intelligence

Topic last updated—January 2008

By default, in new installations of Configuration Manager 2007, Asset Intelligence information collection is not enabled. To enable the Asset Intelligence feature, at least one of the required hardware inventory reporting classes that Asset Intelligence reports rely on must be enabled.

Note
In Microsoft System Center Configuration Manager 2007, the Asset Management report category was renamed Asset Intelligence. When upgrading from SMS 2003 SP3 to Configuration Manager 2007, the existing Asset Management reports are deleted and Asset Intelligence reports are created. As a result, any previous modifications made to the standard SMS 2003 SP3 Asset Management reports are lost.

When a Systems Management Server 2003 SP3 site with the Asset Intelligence feature already installed and enabled is upgraded to Configuration Manager 2007, Asset Intelligence data collection will remain enabled. If additional hardware inventory reporting classes must be enabled, the procedures in this topic can be used in Configuration Manager 2007 or Configuration Manager 2007 SP1.

Note
To collect the inventory data required for Asset Intelligence reports, the hardware inventory client agent must be enabled. For information about enabling the hardware inventory client agent, see How to Configure Hardware Inventory for a Site

To enable Asset Intelligence in Configuration Manager 2007 sites, the SMS_def.mof hardware inventory reporting file must be manually edited to enable the required hardware inventory reporting classes that Asset Intelligence reports rely on. For more information about modifying the SMS_def.mof file, see How to Extend Hardware Inventory Using the SMS_def.mof File.

To enable Asset Intelligence in Configuration Manager 2007 SP1 sites, the Asset Intelligence Reporting Class Settings dialog box can be used to enable the required hardware inventory reporting classes that Asset Intelligence reports rely on.

To enable the Asset Intelligence feature in Configuration Manager 2007

  1. On the Configuration Manager 2007 primary site server computer, navigate to the <ConfigMgr installation directory> \ Inboxes \ clifiles.src \ hinv directory.

  2. Using Notepad.exe, open the SMS_def.mof file and make any necessary changes. To enable a hardware inventory reporting class, change the class reporting qualifier from False to True.

    For a list of hardware inventory classes that Asset Intelligence reports depend on, see Hardware Inventory Reporting Classes Required for Asset Intelligence Reports.

  3. Close the SMS_def.mof file and save changes.

    Note
    Asset Intelligence reports that depend on the hardware inventory classes enabled using this procedure will not display data until clients have performed hardware inventory using the new hardware inventory reporting policy based on the contents of the updated SMS_def.mof hardware inventory file.

 To enable the Asset Intelligence feature in Configuration Manager 2007 SP1

  1. In the Configuration Manager 2007 SP1 console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

  2. Right-click Asset Intelligence, and click Edit Asset Intelligence Reporting Class Settings.

    Note
    If the Configuration Manager console action pane is displayed while Asset Intelligence is selected in the console, the Asset Intelligence Reporting Class Settings dialog box can also be started by clicking Edit Asset Intelligence Reporting Class Settings in the action pane.

  3. To enable Asset Intelligence reporting, enable at least one reporting class from the available Asset Intelligence reporting classes displayed and click OK. After clicking OK, the selected hardware inventory reporting classes will be automatically enabled in the SMS_def.mof hardware inventory reporting file stored in the <ConfigMgr installation directory> \ Inboxes \ clifiles.src \ hinv directory on the primary site server computer.

    For a list of hardware inventory classes that Asset Intelligence reports depend on, see Hardware Inventory Reporting Classes Required for Asset Intelligence Reports.

    Note
    Asset Intelligence reports that depend on the hardware inventory classes enabled using this procedure will not display data until clients have performed hardware inventory using the new hardware inventory reporting policy based on the contents of the updated SMS_def.mof hardware inventory file.

See Also

Concepts

Tasks for Asset Intelligence


How to Enable Success Logon Event Logging

Topic last updated—March 2008

To enable data to be collected for Asset Intelligence console usage and CAL reports, Client Access License (CAL) data collection must be enabled in the Configuration.mof hardware inventory settings file and computer security policy logon settings must be configured to enable auditing of success logon events.

You can use the following procedures to enable the security policy settings required for Asset Intelligence console usage and CAL reports. For more information about Configuration.mof modifications required to enable Asset Intelligence CAL reporting, see Prerequisites for Asset Intelligence.

To enable success logon event logging using a local security policy

  1. On a Configuration Manager 2007 client computer, open Control Panel and navigate to Administrative Tools \ Local Security Policy.

  2. Navigate to Security Settings \ Local Policies \ Audit Policy.

  3. In the results pane, double-click Audit account logon events and ensure that Success is selected.

To enable success logon event logging using an Active Directory domain security policy

  1. On a domain controller computer, navigate to Administrative Tools \ Domain Security Policy.

  2. Navigate to Security Settings \ Local Policies \ Audit Policy.

  3. In the results pane, double-click Audit account logon events and ensure that Success is selected.

See Also

Concepts

Tasks for Asset Intelligence


How to Import Software License Information

Topic last updated—March 2008

The License Import Wizard is used to import Microsoft and non-Microsoft licensing information into the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to import software license information into the Asset Intelligence catalog.

Important
When importing non-Microsoft software license information, administrators must create a valid .XML formatted license import file. For more information about creating a license import file, see Importing Software Licenses Into the Asset Intelligence Catalog.

To import software license information into the Asset Intelligence catalog

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

  2. Right-click Asset Intelligence, and click License Import Wizard to start the License Import Wizard.

    Note
    If the Configuration Manager console action pane is displayed, the License Import Wizard can also be started by clicking License Import Wizard in the action pane.

  3. On the Welcome page of the License Import Wizard, click Next.

  4. On the Import page of the License Import Wizard, click Browse to specify the location of a valid XML-formatted licensing information file stored on a standard network shared folder.

    Note
    The shared folder should be properly secured to prevent unauthorized access to the licensing information file and the computer account of the computer the wizard is being run on must have full control permissions to the share containing the license import file.

  5. On the Summary page of the License Import Wizard Wizard, review the information you have specified, to ensure that it is correct before continuing. If changes need to be made, click Previous to return to the Import page.

See Also

Concepts

Tasks for Asset Intelligence


How to Connect to System Center Online

Topic last updated—March 2008

To connect to System Center Online, an Asset Intelligence Synchronization point site system role must be installed. Before installing this site role, an authentication certificate (.pfx) file must be obtained from System Center Online. A System Center Online authentication certificate is required to install the Asset Intelligence synchronization point site system role and can be obtained only by Software Assurance (SA) license customers.

Before beginning the following procedure, ensure that the computer hosting the Configuration Manager console that will be used to connect to System Center Online to obtain the System Center Online authentication certificate has Internet connectivity and that the MVLS login and required SA license information is available.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To connect to System Center Online

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

  2. Right-click Asset Intelligence, and click Connect to System Center Online to open the Microsoft Volume Licensing (MVLS) home page.

  3. On the MVLS home page, log in to the Web site and complete the necessary requirements to obtain a System Center Online authentication certificate.

  4. Save the System Center Online authentication certificate (.pfx) file in a network share location. Security should be configured on the network share location so that it is accessible only by the account that will be used to import the certificate when installing the Asset Intelligence synchronization point site system role from within the Configuration Manager console. For more information about Asset Intelligence security best practices, see Asset Intelligence Security Best Practices and Privacy Information.

See Also

Concepts

Tasks for Asset Intelligence


How to Install an Asset Intelligence Synchronization Point

Topic last updated—January 2008

The Asset Intelligence Synchronization point site system role is used to connect Configuration Manager 2007 SP1 sites to System Center Online to synchronize Asset Intelligence catalog information. The Asset Intelligence synchronization point can only be installed on a site system located in the central site of a Configuration Manager 2007 SP1 hierarchy and requires Internet access to synchronize with System Center Online using TCP port 443.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In addition to downloading new Asset Intelligence catalog information, the Asset Intelligence Synchronization point can upload custom software title information to System Center Online for categorization. All software titles uploaded to System Center Online for categorization will be treated as public information by Microsoft. Therefore, you should ensure that your custom software titles do not contain confidential or proprietary information.

During installation of this site role, a System Center Online authentication certificate, which can be obtained only by Software Assurance (SA) license customers, must be specified. Before beginning this procedure, ensure that a valid System Center Online authentication certificate file (.pfx) is available on a shared network folder accessible to the computer running the New Site Role Wizard and the certificate is present in the network share until the Asset Intelligence synchronization point has synchronized successfully with System Center Online.

Important
The original certificate obtained for connecting to System Center Online should be safeguarded by creating a backup of the original and using the backup copy to connect to System Center Online. The original certificate should be stored in case the certificate used to connect to System Center Online is deleted. This can happen if the certificate expires or otherwise becomes invalid. If a proxy server is required to connect to System Center Online, the connection certificate might also be deleted if the user account password expires for the account configured for proxy server authentication on the Proxy Server tab of the Asset Intelligence synchronization point site system properties.

Use the following procedure to install an Asset Intelligence synchronization point site system role.

To install an Asset Intelligence synchronization point site system role

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Site Settings / Site Systems.

  2. Right-click the site system name to install the Asset Intelligence Synchronization Point site system role, and click New Roles to start the New Site Role Wizard.

    Note
    If the Configuration Manager console action pane is displayed, the New Site Role Wizard can also be started by clicking New Roles in the action pane.

  3. On the General page of the New Site Role Wizard, verify the existing site system settings, and click Next.

  4. On the System Role Selection page of the New Site Role Wizard, select Asset Intelligence Synchronization Point, and click Next.

  5. On the Asset Intelligence Synchronization Point Connection Settings page of the New Site Role Wizard, specify the path to the System Center Online authentication certificate (.pfx) file, and click Next.

    Note
    Because System Center Online accepts network traffic only over TCP port 443, the port settings cannot be configured on this page of the wizard.

  6. On the Asset Intelligence Synchronization Point Schedule page of the New Site Role Wizard, specify whether or not to enable synchronization on a schedule. If you select to enable scheduled Asset Intelligence catalog synchronization with System Center Online, you can also specify a simple or custom synchronization schedule.

  7. On the Summary page of the New Site Role Wizard, review the settings you have specified to ensure they are correct before continuing. To make changes to any settings, click Previous until you return to the appropriate page, make the change, and return to the Summary page.

See Also

Concepts

Tasks for Asset Intelligence


How to Enable the Asset Intelligence Synchronization Point

Topic last updated—January 2008

The Asset Intelligence synchronization point site system role is used to connect Configuration Manager 2007 SP1 sites to System Center Online to synchronize Asset Intelligence catalog information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To perform scheduled Asset Intelligence catalog synchronizations with System Center Online, the Asset Intelligence synchronization point must be enabled and a synchronization schedule must be specified on the Asset Intelligence Synchronization Point Properties Schedule tab.

Use the following procedure to enable the Asset Intelligence synchronization point.

To enable the Asset Intelligence synchronization point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Site Settings / Site Systems.

  2. Right-click the Asset Intelligence Synchronization Point site system computer name, and click Properties.

    Note
    If the Configuration Manager console action pane is displayed, the Asset Intelligence Synchronization Point Properties can be viewed by clicking Properties in the action pane.

  3. On the Asset Intelligence Synchronization Point Properties Schedule tab, select the Enable synchronization on a schedule option to enable the Asset Intelligence Synchronization point. After enabling the Asset Intelligence Synchronization point, you can also specify a simple or custom synchronization schedule for the site system to synchronize the Asset Intelligence Catalog with System Center Online.

    Note
    If the Configuration Manager console action pane is displayed, the Asset Intelligence Synchronization Point Properties Schedule tab can also be viewed by navigating to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence in the Configuration Manager console and clicking Schedule Catalog Synchronization in the action pane.

See Also

Concepts

Tasks for Asset Intelligence


How to Configure Asset Intelligence Object Security for Asset Managers

Topic last updated—March 2008

To configure Asset Intelligence object permissions for asset managers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Security Rights / Users.

  2. Right-click Users, and click Manage ConfigMgr Users to start the ConfigMgr User Wizard.

  3. On the User Name page, select the Add new user option, and enter the domain login information for the asset manager.

  4. On the User Rights page, select Add another right or modify an existing one option.

  5. On the Add Right page, select Asset Intelligence from the class drop-down list and select the View Asset Intelligence rights option.

  6. On the User Rights page, click Next and continue through the wizard.

See Also

Concepts

Configuring Asset Intelligence


How to Disable Asset Intelligence

Topic last updated—January 2008

To disable the Asset Intelligence feature, all hardware inventory reporting classes that Asset Intelligence reports rely on must be disabled.

When a Systems Management Server 2003 SP3 site with the Asset Intelligence feature already installed and enabled is upgraded to Configuration Manager 2007, Asset Intelligence data collection will remain enabled. The procedures in this topic can be used to disable all enabled hardware inventory reporting classes in Configuration Manager 2007 or Configuration Manager 2007 SP1.

To disable Asset Intelligence in Configuration Manager 2007 sites, the SMS_def.mof hardware inventory reporting file must be manually edited to disable all required hardware inventory reporting classes that Asset Intelligence reports rely on. For more information about modifying the SMS_def.mof file, see How to Extend Hardware Inventory Using the SMS_def.mof File.

To disable Asset Intelligence in Configuration Manager 2007 SP1 sites, the Asset Intelligence Reporting Class Settings dialog box can be used to disable all required hardware inventory reporting classes that Asset Intelligence reports rely on.

To disable the Asset Intelligence feature in Configuration Manager 2007 Sites

  1. On the Configuration Manager 2007 primary site server computer, navigate to the <ConfigMgr installation directory> \ Inboxes \ clifiles.src \ hinv directory.

  2. Using Notepad.exe, open the SMS_def.mof file and make any necessary changes. To disable a hardware inventory reporting class, change the class reporting qualifier from True to False.

    For a list of hardware inventory classes that Asset Intelligence reports depend on, see Hardware Inventory Reporting Classes Required for Asset Intelligence Reports.

  3. Close the SMS_def.mof file, and save changes.

    Note
    Clients will continue to report hardware inventory information that Asset Intelligence reports depend on until they have performed hardware inventory using the new hardware inventory reporting policy based on the contents of the updated SMS_def.mof hardware inventory file.

To disable the Asset Intelligence feature in Configuration Manager2007 SP1 Sites

  1. In the Configuration Manager 2007 SP1 console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

  2. Right-click Asset Intelligence, and click Edit Asset Intelligence Reporting Class Settings.

    Note
    If the Configuration Manager console action pane is displayed while Asset Intelligence is selected in the console, the Asset Intelligence Reporting Class Settings dialog box can also be started by clicking Edit Asset Intelligence Reporting Class Settings in the action pane.

  3. To disable Asset Intelligence reporting, clear the check box for all the available Asset Intelligence reporting classes displayed, and click OK. After clicking OK, the selected hardware inventory reporting classes will be automatically disabled in the SMS_def.mof hardware inventory reporting file stored in the <ConfigMgr installation directory> \ Inboxes \ clifiles.src \ hinv directory on the primary site server computer.

    Note
    Clients will continue to report hardware inventory information that Asset Intelligence reports depend on until they have performed hardware inventory using the new hardware inventory reporting policy based on the contents of the updated SMS_def.mof hardware inventory file.

See Also

Concepts

Tasks for Asset Intelligence


How to Disable the Asset Intelligence Synchronization Point

Topic last updated—January 2008

The Asset Intelligence synchronization point site system role is used to connect Configuration Manager 2007 SP1 sites to System Center Online to synchronize Asset Intelligence catalog information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To perform scheduled Asset Intelligence catalog synchronizations with System Center Online, the Asset Intelligence synchronization point must be enabled and a synchronization schedule specified on the Asset Intelligence Synchronization Point Properties Schedule tab.

If the Asset Intelligence synchronization point is installed but not enabled, the Asset Intelligence catalog must be manually synchronized with System Center Online. For information about performing manual synchronization of the Asset Intelligence catalog with System Center Online, see How to Manually Request Asset Intelligence Catalog Synchronization.

The following procedure can be used to disable the Asset Intelligence synchronization point.

To disable the Asset Intelligence synchronization point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Site Settings / Site Systems.

  2. Right-click the Asset Intelligence Synchronization Point site system computer name, and click Properties.

    Note
    If the Configuration Manager console action pane is displayed, the Asset Intelligence Synchronization Point Properties dialog can be viewed by clicking Properties in the action pane.

  3. On the Asset Intelligence Synchronization Point Properties Schedule tab, clear the Enable synchronization on a schedule option to disable the Asset Intelligence Synchronization point.

    Note
    If the Configuration Manager console action pane is displayed, the Asset Intelligence Synchronization Point Properties Schedule tab can also be viewed by navigating to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence in the Configuration Manager console and clicking Schedule Catalog Synchronization in the action pane.

See Also

Concepts

Tasks for Asset Intelligence


Tasks for Asset Intelligence

Topic last updated—March 2008

The tasks in this section provide information and the steps that are required to use Asset Intelligence in Configuration Manager 2007 and Configuration Manager 2007 SP1.

For information about Asset Intelligence configuration tasks in Configuration Manager 2007 and Configuration Manager 2007 SP1, see Configuring Asset Intelligence.

In This Section

How to View Collected Asset Intelligence Information

How to Update the Asset Intelligence Catalog

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Customize the Asset Intelligence Catalog

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Request Software Categorization

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Resolve Software Details Conflicts

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Concepts

Asset Intelligence in Configuration Manager


How to View Collected Asset Intelligence Information

Topic last updated—January 2008

Asset Intelligence reports can be run to view the most detailed information collected by the Asset Intelligence feature. Asset Intelligence reports can be used to view the report types described in the following table.

Type of Asset Intelligence Report | Description
Hardware Reports | Provides information about hardware assets within your organization, including age and upgrade readiness.
License Management Reports | Provides information about licensing, including number of licenses in use, sales channel, and time until expiration.
Software Reports | Provides information about software families, categories, and specific software titles installed on computers within your organization.

For an overview of reports in Configuration Manager 2007, see Reporting Overview.

For a general overview of Asset Intelligence catalog information, access the Asset Intelligence home page by using About the Asset Intelligence Home Page.

Use the following procedures to view collected Asset Intelligence information.

To view collected Asset Intelligence Information using Asset Intelligence Reports

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Asset Intelligence Reports.

  2. Right-click the Asset Intelligence report you want to view, and click Run to view the report.

    Note
    If the Configuration Manager console action pane is displayed, the selected report can also be run by clicking Run in the action pane.

To view collected Asset Intelligence Information using the Asset Intelligence home page in Configuration Manager 2007 SP1 sites

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

  2. View Asset Intelligence catalog information displayed on the Asset Intelligence home page in the results pane of the Configuration Manager console.

See Also

Concepts

About Asset Intelligence Reports
About the Asset Intelligence Home Page
Tasks for Asset Intelligence


How to Update the Asset Intelligence Catalog

Topic last updated—January 2008

This section contains tasks that Configuration Manager 2007 and Configuration Manager 2007 SP1 Asset Intelligence administrators can use to update Asset Intelligence catalog information.

In This Section

How to Manually Update the Asset Intelligence Catalog

How to Schedule Asset Intelligence Catalog Updates

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

How to Manually Request Asset Intelligence Catalog Synchronization

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Concepts

Tasks for Asset Intelligence


How to Manually Update the Asset Intelligence Catalog

Topic last updated—March 2008

The Asset Intelligence catalog can be manually updated by downloading a catalog update Microsoft Installer (.msi) file from the Microsoft download center and installing it on the site database server.

Note
The Asset Intelligence catalog update file has a dependancy on the SQL Server bulk copy program (bcp.exe). The bulk copy program is a stand-alone utility that is installed with Microsoft SQL Server client tools installations. If you receive an error stating that bcp is not recognized as an internal or external command, an operable program, or a batch file, while performing the procedures in this topic, it means that bcp is not installed on the computer used to update the Asset Intelligence catalog and the procedures will not succeed. For more information about the bcp, see "Importing and Exporting Bulk Data by Using the bcp Utility at http://go.microsoft.com/fwlink/?LinkId=111811.

The following procedures can be used both by Configuration Manager 2007 and by Configuration Manager 2007 SP1 Asset Intelligence administrators to update the Asset Intelligence catalog locally at the site database server or from a remote computer.

Note
The user account running the Asset Intelligence catalog update installation must have administrative rights to the SQL Server site database computer and site database to perform these procedures.

To manually update the Asset Intelligence catalog from a remote computer

  1. Verify that the SQL Server client tools are installed on the computer that will be used to update the SQL Server site database server computer.

  2. Download the Asset Intelligence catalog update Microsoft Windows Installer (MSI) file (AICU.MSI) from the Microsoft download center, and save it to the local computer.

  3. Open a command prompt, and navigate to the directory that the Asset Intelligence catalog update file is saved in.

  4. From the command prompt, run the following command:

    AICU.MSI SQLServer=<site database server name> SITEDB=<site database name>

  5. Review the log file created in the <root drive> \ AI \ BCP_OSQL_LOGS directory to ensure that the update was successful.

To manually update the Asset Intelligence catalog at the site database server computer

  1. Verify that the SQL Server client tools are installed on the SQL Server site database server computer.

  2. Download the Asset Intelligence catalog update Microsoft Windows Installer (MSI) file (AICU.MSI) from the Microsoft download center, and save it to the local computer.

  3. Double-click the AICU.MSI file to start the Asset Intelligence and License Management Catalog Update Setup Wizard.

  4. Continue through the wizard to update the Asset Intelligence catalog.

  5. Review the log file created in the <root drive> \ AI \ BCP_OSQL_LOGS directory to ensure that the update was successful.

See Also

Concepts

How to Update the Asset Intelligence Catalog


How to Schedule Asset Intelligence Catalog Updates

Topic last updated—January 2008

Asset Intelligence catalog information updates can be scheduled to occur automatically by using the Asset Intelligence synchronization point Configuration Manager 2007 SP1 site system role.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Asset Intelligence synchronization point Schedule tab is used to enable or disable the Asset Intelligence synchronization point site system role and to configure synchronization schedule settings for the Asset Intelligence synchronization point to connect to System Center Online.

Note
By default, catalog updates are scheduled for weekly download from System Center Online.

Use the following procedure to schedule Asset Intelligence catalog updates.

Note
An Asset Intelligence synchronization point site system role must first be installed before using the procedure in this topic. For information about installing an Asset Intelligence synchronization point, see How to Install an Asset Intelligence Synchronization Point.

To schedule Asset Intelligence catalog updates

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Site Management / <site code - site description> / Site Settings / Site Systems / <site system hosting the Asset Intelligence synchronization point site server role>.

  2. In the results pane, right-click Asset Intelligence synchronization point, and click Properties.

    Note
    If the Configuration Manager console action pane is displayed, the Asset Intelligence synchronization point properties can also be opened by clicking Properties in the action pane.

  3. In the Asset Intelligence synchronization point Schedule tab, ensure that Enable synchronization on a schedule is enabled.

  4. Select either a simple or custom schedule for Asset Intelligence catalog updates, and configure the schedule as needed.

See Also

Reference

Asset Intelligence Synchronization Point Properties: Schedule Tab

Concepts

How to Update the Asset Intelligence Catalog


How to Manually Request Asset Intelligence Catalog Synchronization

Topic last updated—January 2008

In addition to scheduled synchronizations, synchronization of the local Asset Intelligence catalog with System Center Online can be manually requested. Manually synchronizing catalog information allows administrators to retrieve the latest software title categorization information as well as new CPU property and hardware requirements information from System Center Online. When requesting catalog synchronization with System Center Online, information is not uploaded to System Center Online.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Asset Intelligence catalog synchronization can be initiated manually from within the Configuration Manager 2007 SP1 console up to 2 times in a 24-hour period. If a request for synchronization occurs after the second attempt in a 24-hour period, it will be queued and synchronization will be attempted at the next available time.

Note
An Asset Intelligence synchronization point site system role must first be installed before using the procedure in this topic. For information about installing an Asset Intelligence synchronization point, see How to Connect to System Center Online.

Use the following procedure to manually request Asset Intelligence catalog synchronization with System Center Online.

To manually request Asset Intelligence catalog synchronization with System Center Online

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

  2. Right-click Asset Intelligence, and click Synchronize Catalog to request synchronization of the Asset Intelligence catalog with System Center Online.

    Note
    If the Configuration Manager console action pane is displayed, a request for Asset Intelligence catalog synchronization can also be started by clicking Synchronize Catalog in the action pane.

  3. Click OK on the Catalog Synchronization Status dialog box.

See Also

Concepts

How to Update the Asset Intelligence Catalog


How to Customize the Asset Intelligence Catalog

Topic last updated—January 2008

The Configuration Manager 2007 SP1 Asset Intelligence feature allows administrators to customize the local Asset Intelligence catalog. Using the Customize Catalog Configuration Manager console node, administrators can locally edit the information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

When customizing the local Asset Intelligence catalog, administrators can create, rename, and delete custom catalog information. The software categorization information supplied by System Center Online can also be redefined to suit custom software categorization requirements.

Asset Intelligence catalog categorization information received from System Center Online is stored in the site database with read-only rights and cannot be modified or deleted. However, administrators can choose to use custom categorization data instead of the information supplied by System Center Online for existing or custom software title information. When categorization information is changed or added by administrators, the catalog information is considered user-defined. User-defined categorization information is stored in separate database tables than validated catalog information.

Important
Asset Intelligence catalog updates can only be made at the highest site in the hierarchy that Asset Intelligence has been enabled. Editing or creating new objects for replicated Asset Intelligence catalog information at child sites is not supported.

In This Section

How to Manage Software Categories

How to Manage Software Families

How to Manage Custom Labels

How to Manage Hardware Requirements

See Also

Concepts

Configuring Asset Intelligence


How to Manage Software Categories

Topic last updated—January 2008

Administrators can manage software category information stored in the Asset Intelligence catalog using the Software Categories node located under the Customize Catalog Configuration Manager console node.,

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Software titles stored in the Configuration Manager 2007 SP1 Asset Intelligence catalog are grouped using software categories and software families. Software categories are used as high-level groupings of more specific software families. For example, a software category could be energy companies, and a software family within that software category could be oil and gas or hydroelectric.

In This Section

How to Create Custom Software Categories

How to Modify Custom Software Categories

How to Delete Custom Software Categories

See Also

Concepts

How to Customize the Asset Intelligence Catalog


How to Create Custom Software Categories

Topic last updated—January 2008

Using the Software Categories node located under the Customize Catalog Configuration Manager console node, administrators can create custom software categories used to group software title information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to create custom Asset Intelligence catalog software categories.

To create a custom software category

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Software Categories.

  2. Right-click Software Categories, and click New Category to start the New Software Category Wizard.

    Note
    If the Configuration Manager console action pane is displayed, the New Software Category Wizard can also be started by clicking New Category in the action pane.

  3. On the General page of the New Software Category Wizard, specify a name for the new software category and, optionally, a description.

    Note
    The validation state for all new custom software categories is always user-defined.

  4. On the Summary page of the New Software Category Wizard, review the new software category information you have specified to ensure it is correct before continuing. If changes need to be made, click Previous to return to the General page.

See Also

Concepts

How to Manage Software Categories


How to Modify Custom Software Categories

Topic last updated—January 2008

Using the Software Categories node located under the Customize Catalog Configuration Manager console node, administrators can modify custom software categories used to group software title information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to modify custom Asset Intelligence catalog software categories.

To modify a custom software category

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Software Categories.

  2. Right-click the custom software category name, and click Properties.

    Note
    If the Configuration Manager console action pane is displayed, the custom software category can also be modified by clicking the custom software category name and then clicking Properties in the action pane.

  3. Modify the software category name or description as necessary, and click OK.

    Note
    The validation state for all new custom software categories is always user-defined.

See Also

Concepts

How to Manage Software Categories


How to Delete Custom Software Categories

Topic last updated—January 2008

Using the Software Categories node located under the Customize Catalog Configuration Manager console node, administrators can delete custom software categories used to group software title information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to delete custom, user-defined Asset Intelligence catalog software categories.

To delete a custom software category

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Software Categories.

  2. Right-click the custom software category name, and click Delete.

    Note
    If the Configuration Manager console action pane is displayed, the custom software category can also be deleted by clicking the custom software category name and then clicking Delete in the action pane.

  3. Click Yes in the Confirm Object Delete dialog box to delete the custom software category.

See Also

Concepts

How to Manage Software Categories


How to Manage Software Families

Topic last updated—January 2008

Using the Software Families node located under the Customize Catalog Configuration Manager console node, administrators can manage software family information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Software titles stored in the Configuration Manager 2007 SP1 Asset Intelligence catalog are grouped using software categories and software families. Software categories are used as high-level groupings of more specific software families. For example, a software category could be energy companies, and a software family within that software category could be oil and gas or hydroelectric.

In This Section

How to Create Custom Software Families

How to Modify Custom Software Families

How to Delete Custom Software Families

See Also

Concepts

How to Customize the Asset Intelligence Catalog


How to Create Custom Software Families

Topic last updated—January 2008

Using the Software Families node located under the Customize Catalog Configuration Manager console node, administrators can create custom software families used to group software title information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to create custom Asset Intelligence catalog software families.

To create a custom software family

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Software Families.

  2. Right-click Software Families, and click New Family to start the New Software Family Wizard.

    Note
    If the Configuration Manager console action pane is displayed, the New Software Category Wizard can also be started by clicking New Family in the action pane.

  3. On the General page of the New Software Family Wizard, specify a name for the new software family, and optionally, a description.

    Note
    The validation state for all new custom software families is always user-defined.

  4. On the Summary page of the New Software Family Wizard, review the new software family information you have specified to ensure that it is correct before continuing. If changes need to be made, click Previous to return to the General page.

See Also

Concepts

How to Manage Software Families


How to Modify Custom Software Families

Topic last updated—January 2008

Using the Software Families node located under the Customize Catalog Configuration Manager console node, administrators can modify custom software families used to group software title information stored in the Asset Intelligence Knowledge Base.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to modify custom Asset Intelligence Catalog software families.

To modify a custom software family

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Software Families.

  2. Right-click the custom software family name, and click Properties.

    Note
    If the Configuration Manager console action pane is displayed, the custom software family can also be modified by clicking the custom software family name and then clicking Properties in the action pane.

  3. Modify the software family name or description as necessary, and click OK.

    Note
    The validation state for all new custom software families is always user-defined.

See Also

Concepts

How to Manage Software Families


How to Delete Custom Software Families

Topic last updated—January 2008

Using the Software Families node located under the Customize Catalog Configuration Manager console node, administrators can delete custom software families used to group software title information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to delete custom, user-defined Asset Intelligence catalog software families.

To delete a custom software family

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Software Families.

  2. Right-click the custom software family name, and click Delete.

    Note
    If the Configuration Manager console action pane is displayed, the custom software family can also be deleted by clicking the custom software family name and then clicking Delete in the action pane.

  3. To delete the custom software family, click Yes in the Confirm Object Delete dialog box.

See Also

Concepts

How to Manage Software Families


How to Manage Custom Labels

Topic last updated—January 2008

The Configuration Manager 2007 SP1 Asset Intelligence feature allows administrators to customize the local Asset Intelligence catalog. Using the Custom Labels node located under the Customize Catalog Configuration Manager console node, administrators can manage custom label information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Asset Intelligence custom labels allow you to create custom filters that can be used to group software titles and view them using Asset Intelligence reports based on custom label criteria that you define. For example, you can create a custom label called shareware, associate it with a number of applications, and then run a report that will show you all titles with the custom label of shareware.

In This Section

How to Create Custom Labels

How to Modify Custom Labels

How to Delete Custom Labels

See Also

Concepts

How to Customize the Asset Intelligence Catalog


How to Create Custom Labels

Topic last updated—January 2008

Using the Custom Labels node located under the Customize Catalog Configuration Manager console node, administrators can create custom labels used to group software titles that share a common attribute. For example, a group of titles can be labeled as site-licensed software or shareware in addition to software category and software family grouping information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to create Asset Intelligence catalog custom labels.

Note
Up to 100 custom labels can be created, but each software title can have only one to three custom labels associated with it and stored in the Asset Intelligence catalog.

To create a custom software category

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Custom Labels.

  2. Right-click Custom Labels, and click New Label to start the New Custom Label Wizard.

    Note
    If the Configuration Manager console action pane is displayed, the New Software Category Wizard can also be started by clicking New Category in the action pane.

  3. On the General page of the New Custom Label Wizard, specify a name for the new custom label and, optionally, a description.

    Note
    There is no validation state for custom labels because all custom labels are always user-defined.

  4. On the Summary page of the New Custom Label Wizard, review the new custom label information you have specified to ensure that it is correct before continuing. If changes need to be made, click Previous to return to the General page.

See Also

Concepts

How to Manage Custom Labels


How to Modify Custom Labels

Topic last updated—January 2008

Using the Custom Labels node located under the Customize Catalog Configuration Manager console node, administrators can modify custom labels used to group software titles that share a common attribute. For example, a group of titles can be labeled as site-licensed software or shareware, in addition to software category and software family grouping information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to modify Asset Intelligence catalog custom labels.

To modify a custom label

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Custom Labels.

  2. Right-click the custom label name, and click Properties.

    Note
    If the Configuration Manager console action pane is displayed, the custom software category can also be modified by clicking the custom label name and then clicking Properties in the action pane.

  3. Modify the custom label name or description as necessary, and click OK.

See Also

Concepts

How to Manage Custom Labels


How to Delete Custom Labels

Topic last updated—January 2008

Using the Custom Labels node located under the Customize Catalog Configuration Manager console node, administrators can delete custom labels used to group software titles that share a common attribute.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to create Asset Intelligence catalog custom labels.

To delete a custom label

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Custom Labels.

  2. Right-click the custom label name, and click Delete.

    Note
    If the Configuration Manager console action pane is displayed, the custom label can also be deleted by clicking the custom label name and then clicking Delete in the action pane.

  3. Click Yes in the Confirm Object Delete dialog box to delete the custom label.

See Also

Concepts

How to Manage Custom Labels


How to Manage Hardware Requirements

Topic last updated—January 2008

The Configuration Manager 2007 SP1 Asset Intelligence feature allows administrators to customize the local Asset Intelligence catalog. Using the Hardware Requirements node located under the Customize Catalog Configuration Manager console node, administrators can manage software title hardware requirements information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

How to Create Custom Hardware Requirements

How to Modify Custom Hardware Requirements

How to Delete Custom Hardware Requirements

See Also

Concepts

How to Customize the Asset Intelligence Catalog


How to Create Custom Hardware Requirements

Topic last updated—January 2008

Using the Hardware Requirements node of the Configuration Manager console, administrators can create custom hardware requirements for software title information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Creating custom hardware requirements can be done for software titles without previous hardware requirements information stored in the Asset Intelligence catalog, or to customize the requirements of an application that has hardware requirements already defined.

Important
Existing, non-custom hardware requirements information stored in the Asset Intelligence catalog is read only and cannot be modified. To customize the hardware requirements for an application that has hardware requirements already defined by System Center Online, you must create custom hardware requirements for the software title.

Use the following procedure to create custom Asset Intelligence catalog hardware requirements.

To create a custom hardware requirement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Hardware Requirements.

  2. Right-click Hardware Requirements, and click New Hardware Requirements to start the New Hardware Requirement Wizard.

    Note
    If the Configuration Manager console action pane is displayed, the New Software Category Wizard can also be started by clicking New Hardware Requirements in the action pane.

  3. On the General page of the New Hardware Requirements Wizard, specify the following:

    1. The software title name that the new hardware requirements will be associated with.
      Note
      The validation state for all custom hardware requirements is always user-defined.

    2. The minimum processor speed, in MHz, that the software title requires.
    3. The minimum RAM, in KB, that the software title requires.
    4. The minimum free disk space, in KB, that the software title requires.
    5. The minimum hard disk size, in KB, that the software title requires.

  4. On the Summary page of the New Hardware Requirements Wizard, review the new hardware requirements information you have specified to ensure it is correct before continuing. If changes need to be made, click Previous to return to the General page.

See Also

Concepts

How to Manage Hardware Requirements


How to Modify Custom Hardware Requirements

Topic last updated—January 2008

Using the Hardware Requirements node of the Configuration Manager console, administrators can modify custom hardware requirements for software title information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to modify custom Asset Intelligence catalog hardware requirements.

Important
Existing, non-custom hardware requirements information stored in the Asset Intelligence catalog is read only and cannot be modified.

To modify a custom hardware requirement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Knowledge Base / Hardware Requirements.

  2. Right-click the software title name with the custom hardware requirement that will be modified, and click Properties.

    Note
    If the Configuration Manager console action pane is displayed, the custom hardware requirement can also be modified by clicking the software title name with the custom hardware requirement that will be modified and then clicking Properties in the action pane.

  3. Modify the custom hardware requirements information as necessary, and click OK.

See Also

Concepts

How to Manage Hardware Requirements


How to Delete Custom Hardware Requirements

Topic last updated—January 2008

Using the Hardware Requirements node of the Configuration Manager console, administrators can delete custom hardware requirements for software title information stored in the Asset Intelligence catalog.

Important
Existing, non-custom hardware requirements information stored in the Asset Intelligence catalog is read only and cannot be deleted.

Use the following procedure to delete custom Asset Intelligence catalog hardware requirements.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To delete a custom hardware requirement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog / Hardware Requirements.

  2. Right-click the software title name with the custom hardware requirement that will be deleted, and click Delete.

    Note
    If the Configuration Manager console action pane is displayed, the custom hardware requirement can also be deleted by clicking the software title name with the custom hardware requirement to be deleted and then clicking Delete in the action pane.

  3. Click Yes in the Confirm Object Delete dialog box to delete the custom hardware requirement.

See Also

Concepts

How to Manage Hardware Requirements


How to Request Software Categorization

Topic last updated—January 2008

Uncategorized software title information can be submitted to System Center Online for research and categorization. After an uncategorized software title is submitted, researchers identify, categorize, and then make the software title categorization information available to all customers using the online service.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

When software title information is submitted to System Center Online for categorization, the following conditions apply:

  • Only basic software title information is transmitted to System Center Online, and software title information to be categorized can be reviewed before submission.
  • Software license information is never transmitted.
  • Any software title that is uploaded becomes publicly available as part of the System Center Online catalog and can be downloaded by other customers.
  • The source of the software title is not stored in the System Center Online catalog. However, application titles containing confidential or proprietary information should not be submitted for categorization by System Center Online.

For more information about Asset Intelligence privacy information, see Asset Intelligence Security Best Practices and Privacy Information.

Use the following procedure to request Asset Intelligence catalog software title categorization from System Center Online.

Note
An Asset Intelligence catalog synchronization point site system role must be installed and configured to connect to System Center Online using TCP port 443 before beginning this procedure.

To request software categorization from System Center Online

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Inventoried Software Titles / Uncategorized Software.

  2. Select a software title to be categorized, or multi-select multiple titles to be submitted to System Center Online for categorization.

    Note
    Only uncategorized inventoried software titles can be submitted to System Center Online for categorization. If an inventoried software title has been categorized by an administrator, resulting in a user-defined state, you must right-click the inventoried software title and click Revert to revert the software title back to the uncategorized state before it can be submitted to System Center Online for categorization.

  3. Right-click the selected inventoried software titles, and click Request Catalog Update.

  4. Review the System Center Online categorization submission privacy message, and select an available option.

    Note
    You must read and agree to the System Center Online categorization submission privacy message to allow the selected software titles to be submitted for categorization.

  5. Refresh the Uncategorized Software Configuration Manager console node, and ensure that the software titles selected for submission to System Center Online are no longer displayed.

  6. Verify that the state of the inventoried software title submitted to System Center Online for categorization has changed from Uncategorized to Pending when displayed in the Inventoried Software Titles Configuration Manager console node.

See Also

Concepts

Configuring Asset Intelligence


How to Resolve Software Details Conflicts

Topic last updated—January 2008

The Asset Intelligence Software Details Conflict Resolution dialog box is used to select a conflict resolution action after newly updated software categorization details have been received from System Center Online that conflict with existing software details information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

You can use the following procedure to resolve Asset Intelligence catalog software title details conflicts.

To resolve a software details conflict

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence / Customize Catalog.

  2. Select the Inventoried Software Titles node.

  3. Review the State column in the results pane for software titles in the Updatable state.

  4. Right-click software titles in the Updatable state, and click Resolve Conflict to open the Software Details Conflict Resolution dialog box.

  5. Select a conflict resolution option, and click OK.

See Also

Reference

Software Details Conflict Resolution Dialog

Concepts

Configuring Asset Intelligence


Asset Intelligence Security Best Practices and Privacy Information

Topic last updated—March 2008

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Security Best Practices

Implement access controls to help protect the registration certificate The registration certificate is acquired during the System Center Online provisioning and helps ensure that only Microsoft Software Assurance (SA) customers can deploy the Asset Intelligence Synchronization Point and communicate with System Center Online. After you obtain the registration certificate from the Microsoft Volume Licensing site, you will need to place the certificate in a shared folder so that it can be accessed when creating the Asset Intelligence synchronization point.

Implement access controls to help protect the licensing file The License Import Wizard is used to import Microsoft and non-Microsoft licensing information into the Asset Intelligence catalog. An attacker tampering with the licensing file could cause a company to incorrectly assess its licensing situation. When importing a licensing file, verify that it came from a trusted source and has not been tampered with.

Privacy Information

Asset Intelligence extends the inventory capabilities of Microsoft System Center Configuration Manager 2007 to provide a higher level of asset visibility in the enterprise. If you perform a new installation of Configuration Manager 2007 or Configuration Manager 2007 SP1, Asset Intelligence information collection is not enabled, by default. When a Systems Management Server 2003 SP3 site with the Asset Intelligence feature already installed and enabled is upgraded to Configuration Manager 2007 or Configuration Manager 2007 SP1, Asset Intelligence data collection will remain enabled. You can modify the type of information collected. For more information, see "How to Enable Asset Intelligence" in the Configuration Manager Documentation Library.

Asset Intelligence information is stored in the site database in the same manner as inventory information. In native mode, the data is always encrypted during transfer to the management point, and in mixed mode, you have the option of encrypting inventory data transfer between the client and the management point. Inventory data is not stored in encrypted form in the database. Information is retained in the database until deleted by the site maintenance tasks Delete Aged Inventory History every 90 days. You can configure the deletion interval.

In Configuration Manager 2007, Asset Intelligence information is not sent back to Microsoft. In Configuration Manager 2007 SP1, if you are a Microsoft customer with a Software Assurance contract (SA), you can choose to send System Center Online requests for categorization, which means that you can tag one or more software titles which are uncategorized and send them to System Center Online for research and categorization. After a software title is uploaded, Microsoft researchers identify, categorize, and then make that knowledge available to all customers utilizing the on-line service. You should be aware of the following privacy implications of submitting information to System Center Online:

  • Upload applies only to generic software title information (name, publisher, and so on) that you choose to send to System Center Online. Inventory information is not sent with an upload.
  • Upload never happens automatically, and the system was not designed for this task to be automated—you must manually select and approve the upload of each software title.
  • A dialog box will show you exactly what data is going to be uploaded, prior to the actual upload process.
  • License information is not sent to Microsoft. The license information is stored in a separate area of the database, and there is no way to send it to Microsoft.
  • Any software title that is uploaded becomes public, in the sense that the knowledge of that given application and its categorization become part of the System Center Online catalog, and will then be downloaded to other consumers of the catalog.
  • The source of the software title is not recorded in the catalog and is not made available to other customers. However, you still need to verify that you do not load any application titles that contain any private information.
  • Uploaded data cannot be recalled.

Before configuring Asset Intelligence data collection and deciding whether or not to submit information to System Center Online, consider your privacy requirements.


Troubleshooting Asset Intelligence

Topic last updated—March 2008

This section provides information to help you troubleshoot the Asset Intelligence feature in Configuration Manager 2007 and Configuration Manager 2007 SP1.

In This Section

Known Issues for Asset Intelligence

Log Files for Asset Intelligence

See Also

Concepts

Asset Intelligence in Configuration Manager


Troubleshooting Asset Intelligence Issues

Topic last updated—March 2008

The topics in this section provide troubleshooting information Configuration Manager 2007 and Configuration Manager 2007 SP1 Asset Intelligence feature issues.

In This Section

Known Issues for Asset Intelligence

Troubleshooting Asset Intelligence Reporting

Troubleshooting the Asset Intelligence Synchronization Point and Catalog

See Also

Concepts

Asset Intelligence in Configuration Manager


Known Issues for Asset Intelligence

Topic last updated—March 2008

Asset Intelligence cannot report the license channel correctly on applications that use ProductID to identify versions

When viewing Asset Intelligence reports License 01A, 01B, 01C, or 01D, the license channel information might not report correctly for some older applications, depending on how the application stores product ID information in the registry. For example, an enterprise that uses select Volume License Key editions might appear to have retail versions. This problem typically affects older products that use the ProductID instead of the DigitalProductID registry value.

Solution

There is no way to incorporate the correct information into the Configuration Manager 2007 Asset Intelligence reports. If you want to verify the versions, however, you can look at the Product ID in the registry of clients you suspect are reporting incorrect sales channel information. The ProductID registry entry for a software product is located in the system registry hive under the Registration subkey for the product. The ProductID registry entry for an operating system is located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion.

When you locate the value ProductID, in the data note the group of numbers after the first dash and match it to the following table of common channel IDs. For example, if the ProductID is 73931-640-2474146-57484, locate 640 in the following table.

ID | Description
OEM | OEM
000 | TRIAL
111 | SELECT (Network installation) [Volume License Key]
197 | MSDN
198 | MSDN
270 | SELECT [Volume License Key]
335 | MSDN
336 | MSDN
337 | MSDN
338 | MSDN
365 - 367 | MSDN
425 | MSDN
436 | TRIAL
460 | TRIAL
471 - 499 | Home Use Program (HUP)
550 | OEM
630 - 636 | OEM
640 - 650 | OPEN [Volume License Key]
652 | SELECT [Volume License Key]
660 | SELECT [Volume License Key]
700 - 705 | Visual Studio .NET
700 - 712 | Office XP or Open License
721 - 744 | Home Use Program
725 | Academic
726 - 736 | Academic

Processor count appears to be incorrect on Windows Server 2003

When one of the following conditions is true for a Windows Server 2003-based computer, Windows incorrectly reports the number of physical processors:

  • The computer uses one or more hyperthreading-enabled preocessors.
  • The computer uses one or more multicore processors.

Solution

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain an available hotfix. For more information about this known issue, see Microsoft Knowledge Base article 932370, "The number of physical hyperthreading-enabled processors or the number of physical multicore processors is incorrectly reported in Windows Server 2003," at http://go.microsoft.com/fwlink/?LinkId=111805.

License Reports do not Contain Exchange Server 2007 Information

The licensing model used by Microsoft Exchange Server 2007 is currently not supported by Asset Intelligence reporting. Microsoft Exchange 2007 stores license relevant data in Active Directory Domain Services and is not inventoried by Configuration Manager clients. Because of this, Microsoft Exchange 2007 licensing data does not appear in license reports.

Solution

None.

See Also

Concepts

Troubleshooting Asset Intelligence


Troubleshooting Asset Intelligence Reporting

Topic last updated—March 2008

This section provides troubleshooting information to help you resolve issues encountered when viewing Asset Intelligence reports.

Some Asset Intelligence reports do not contain data

If the Asset Intelligence hardware inventory reporting classes are not enabled, reports based on those classes will not contain data.

Solution

Review the hardware inventory reporting classes that Asset Intelligence reports rely on, and determine which hardware inventory reporting classes to enable. For more information about hardware inventory reporting classes used by Asset Intelligence, see Hardware Inventory Reporting Classes Required for Asset Intelligence Reports. For more information about how to enable hardware inventory reporting classes for Asset Intelligence in Configuration Manager 2007 and Configuration Manager 2007 SP1, see How to Enable Asset Intelligence.

Important
Enabling Asset Intelligence reporting classes will increase computer resource usage during Configuration Manager client hardware inventory. To prevent unnecessary client computer resource usage, you should verify that only the reporting classes required to support the Asset Intelligence reports needed are selected.

Asset Intelligence Client Access License (CAL) reports do not contain data

When viewing Asset Intelligence CAL license reports, some information might be missing. In addition to enabling the required Configuration Manager 2007 Configuration.mof hardware configuration inventory file, the security event log settings of client computers must also be configured to log success logon events. For more information about Asset Intelligence CAL reports, see About Client Access License Reports .

Note
Asset Intelligence CAL reports display only CAL information for Configuration Manager 2007 client computers running Windows Server or Exchange Server and will display security event log data up to 90 days old.

Solution

To ensure Configuration Manager 2007 client CAL information required for Asset Intelligence reporting is collected, you must enable the required Configuration.mof hardware inventory configuration file and configure client security logs to log success logon events.

For information about the required Configuration.mof hardware inventory configuration file modifications needed, see Prerequisites for Asset Intelligence.

For information about modifying Configuration Manager 2007 client security event logs to log success logon events, see How to Enable Success Logon Event Logging.

See Also

Concepts

Troubleshooting Asset Intelligence Issues


Troubleshooting the Asset Intelligence Synchronization Point and Catalog

Topic last updated—March 2008

This section provides troubleshooting information to help you resolve issues encountered with the Asset Intelligence synchronization point site system role or the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Certificate missing for Asset Intelligence synchronization point installation

A System Center Online authentication certificate is required to install the Asset Intelligence synchronization point site system role and can be obtained only by Software Assurance (SA) license customers.

Solution

The authentication certificate can be obtained at the Microsoft Volume Licensing (MVLS) home page. For information about obtaining the System Center Online authentication certificate required to install the Asset Intelligence synchronization point, see How to Connect to System Center Online.

The Asset Intelligence synchronization point cannot connect to System Center Online

If the Asset Intelligence catalog is not updating as expected, the Asset Intelligence synchronization point site system role might not be connecting to System Center Online.

Solution

Verify that the Asset Intelligence synchronization point has Internet connectivity and that TCP port 443 is configured to allow communication though any configured firewalls.

For more information about the Asset Intelligence synchronization point site system role, see About the Asset Intelligence Synchronization Point.

See Also

Concepts

Troubleshooting Asset Intelligence Issues


Log Files for Asset Intelligence

Topic last updated—March 2008

The log files associated with Asset Intelligence in Configuration Manager 2007 and Configuration Manager 2007 SP1 provide detailed information about the associated components and can be helpful when verifying functionality or when you need to troubleshoot issues.

The following table provides the log file names and descriptions that can be used to monitor or troubleshoot Asset Intelligence processes.

Note
The Asset Intelligence log files can be found, by default, in the <ConfigMgrInstallPath>\Logs directory.

File Name Description

aikbmgr.log

Provides information about the Asset Intelligence catalog manager service.

aiupdatesvc.log

Provides information about the Asset Intelligence catalog synchronization service and can be useful to determine the following:

  • When the service starts.
  • Where the Asset Intelligence synchronization point is located.
  • The time of the next scheduled catalog synchronization.

aiussetup.log

Provides information about the installation of the Asset Intelligence catalog synchronization point site system role.

aiusmsi.log

Provides information about the installation of the Asset Intelligence catalog synchronization point site system role.

See Also

Concepts

Troubleshooting Asset Intelligence


Technical Reference for Asset Intelligence

Topic Last Updated—August 2008

This section provides technical reference information about the Configuration Manager 2007 Asset Intelligence feature.

In This Section

Example Scenarios for Asset Intelligence

Validation State Transition Examples

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Importing Software Licenses Into the Asset Intelligence Catalog

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Example Asset Intelligence Non-Microsoft License Import File

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Concepts

Asset Intelligence in Configuration Manager


Example Scenarios for Asset Intelligence

Topic last updated—March 2008

This section provides example scenarios of how Asset Intelligence in Configuration Manager 2007 and Configuration Manager 2007 SP1 can be implemented.

In This Section

Enabling Asset Intelligence

Enabling Client Access License (CAL) Data Collection For Asset Intelligence

Using Reports To View Asset Intelligence Catalog Information

Importing Software License Information into the Asset Intelligence Catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Customizing Asset Intelligence Catalog Information

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Installing and Configuring the Asset Intelligence Synchronization Point

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Concepts

Technical Reference for Asset Intelligence


Enabling Asset Intelligence

Topic last updated—March 2008

By default, in new installations of Configuration Manager 2007, Asset Intelligence information collection is not enabled. To enable the Asset Intelligence feature, at least one of the required hardware inventory reporting classes that Asset Intelligence reports rely on must be enabled.

Note
When a Systems Management Server 2003 SP3 site with the Asset Intelligence feature already installed and enabled is upgraded to Configuration Manager 2007, Asset Intelligence data collection will remain enabled. Similarly, if a Configuration Manager 2007 site with the Asset Intelligence feature already enabled is upgraded to Configuration Manager 2007 SP1, Asset Intelligence data collection will remain enabled.

The example scenarios in this topic describe the processes involved when enabling Asset Intelligence for both Configuration Manager 2007 and Configuration Manager 2007 SP1 sites.

Example Scenario for Enabling Asset Intelligence in Configuration Manager 2007

In this example, Ed Banti, the Configuration Manager 2007 administrator for Blue Yonder Airlines, has decided to enable the Asset Intelligence feature to take advantage of the available extended inventory and reporting capabilities. After reviewing the Asset Intelligence configuration checklist, Ed used the following steps to enable Asset Intelligence in Configuration Manager 2007.

For more information about the Asset Intelligence configuration checklist, see Asset Intelligence Configuration Checklist.

Process Reference

Before enabling Asset Intelligence, Ed determines the Asset Intelligence reports that are required to fulfill his advanced inventory reporting requirements.

After determining the reports he is most interested in, Ed reviews the hardware inventory reporting classes those reports relied on for information. By doing so, Ed plans to enable only the hardware inventory reporting classes necessary to avoid causing excessive resource usage for Configuration Manager 2007 clients in the site when performing hardware inventories.

About Asset Intelligence Reports

Hardware Inventory Reporting Classes Required for Asset Intelligence Reports

After determining the hardware inventory reporting classes to enable, Ed opens the SMS_def.mof hardware inventory configuration file stored on the primary site server for his site in the <ConfigMgrInstallDir>\inboxes\clifiles.src\hinv directory and makes the necessary changes.

Ed knows that it will take some time for the new inventory policy to be compiled by clients and that he will need to wait until all clients have performed a hardware inventory cycle based on the new policy before viewing Asset Intelligence reports based on the new information.

How to Enable Asset Intelligence

How to Extend Hardware Inventory Using the SMS_def.mof File

When Ed is confident that all Configuration Manager clients have performed hardware inventory using the new inventory reporting policy created by editing the SMS_def.mof file, he reviews the applicable Asset Intelligence reports to view the newly inventoried information.

How to View Collected Asset Intelligence Information

Example Scenario for Enabling Asset Intelligence in Configuration Manager 2007 SP1

In this example, Ed Banti, the Configuration Manager 2007 administrator for Blue Yonder Airlines, has upgraded his Configuration Manager 2007 site to Configuration Manager 2007 SP1 and has decided to enable additional Asset Intelligence reporting functionality. The asset manager for Blue Yonder Airlines, April Meyer, has asked Ed to provide her with Client Access License (CAL) and additional software license usage in the environment. Because of this requirement, Ed will need to work with the Active Directory administrator for Blue Yonder Airlines, Marcus Loh, to configure the required Group Policy object (GPO) settings to collect the security event log information required for Asset Intelligence CAL reports.

Process Reference

Ed first reviews the new Asset Intelligence reports available in Configuration Manager SP1 to determine whether any new hardware inventory reporting classes should be enabled or if any of the currently enabled reporting classes should be disabled to conserve client computer hardware resources during hardware inventory processes.

About Asset Intelligence Reports

Hardware Inventory Reporting Classes Required for Asset Intelligence Reports

After determining the hardware inventory reporting class changes required, Ed uses the Asset Intelligence Reporting Class Settings dialog to reconfigure the hardware inventory reporting class settings.

To begin inventorying CAL license usage data, Ed researches the Configuration.mof hardware inventory configuration file changes required, opens the Configuration.mof file stored on the primary site server for his site in the <ConfigMgrInstallDir>\inboxes\clifiles.src\hinv directory, and makes the necessary changes.

Ed knows that it will take some time for the new inventory policy to be compiled by clients and that he will need to wait until all clients have performed a hardware inventory cycle based on the new policy before viewing Asset Intelligence reports based on the new information.

How to Enable Asset Intelligence

Asset Intelligence Reporting Class Settings Dialog

Prerequisites for Asset Intelligence

How to Extend Hardware Inventory Using the Configuration.mof File

Enabling Client Access License (CAL) Data Collection For Asset Intelligence

Ed then works with Marcus to coordinate the required Group Policy Object changes required to configure Configuration Manager clients to begin logging all Success logon events in the computer security event logs.

How to Enable Success Logon Event Logging

Because Blue Yonder Airlines does not have a Software Assurance Microsoft Volume Licensing agreement, Ed asks April to provide him with an .xml formatted licensing information file to import into the site database.

How to Import Software License Information

Importing Software Licenses Into the Asset Intelligence Catalog

When Ed is confident that all Configuration Manager clients have performed hardware inventory after all previous changes have been made, he reviews the applicable Asset Intelligence reports to view the newly inventoried information.

How to View Collected Asset Intelligence Information

See Also

Concepts

Example Scenarios for Asset Intelligence


Enabling Client Access License (CAL) Data Collection For Asset Intelligence

Topic last updated—March 2008

Before Asset Intelligence Client Access License (CAL) reports can be used to track CAL usage for Configuration Manager 2007 clients, the following must be configured:

  • The security policy of Configuration Manager 2007 clients must be configured to log all Success logon events.
  • CAL WMI data class information must be configured in the Configuration.mof hardware inventory configuration file.
    Note
    Configuration Manager 2007 CAL license maintenance tasks should also be enabled.

  • Configuration Manager 2007 clients must perform a successful hardware inventory reporting cycle based on the new Configuration.mof modifications.

Example Scenario for Enabling CAL Data Collection for Asset Intelligence

In this example, Ed Banti, the Configuration Manager 2007 administrator for Blue Yonder Airlines, works with Marcus Loh, the Active Directory administrator for Blue Yonder airlines, to ensure that all Configuration Manager 2007 clients are configured to record success logon events in the Windows security event log by modifying the domain security policy for the domain the client computers reside in. Afterwards, Ed makes the necessary modifications to the Configuration.mof hardware inventory configuration file.

Process Reference

Ed meets with Marcus to discuss the domain security policy settings required for all Configuration Manager 2007 clients to begin logging Success logon events, and Marcus implements the requested changes.

How to Enable Success Logon Event Logging

Ed reviews the prerequisite documentation for Asset Intelligence to determine what Configuration.mof modifications are necessary to implement CAL data tracking.

Prerequisites for Asset Intelligence

By reviewing the prerequisites documentation for Asset Intelligence, Ed knows that he must open the Configuration.mof file stored on the primary site server for his site, find the CCM_CALTrackConfig WMI data class, and modify the following settings in accordance with his reporting requirements:

  • CALCollectionType
  • CALCollectionFrequencyDays
  • CALCollectionFrequencyMinutes
  • CALCollectionTimeWindow
  • CALSupportedWindowsVersions

How to Extend Hardware Inventory Using the Configuration.mof File

To ensure only necessary CAL tracking data is stored in the site database, Ed enables and configures the Delete Aged Client Access License Data and Summarize Client Access License Weekly Usage Data site maintenance tasks.

Delete Aged Client Access License Data Task Overview

Summarize Client Access License Weekly Usage Data Task Overview

After all configuration has been completed and Configuration Manager clients have performed a successful hardware inventory reporting cycle, Ed reviews the CAL license reports to view the newly collected information.

About Client Access License Reports .

See Also

Concepts

Example Scenarios for Asset Intelligence


Using Reports To View Asset Intelligence Catalog Information

Topic last updated—March 2008

Asset Intelligence reports can be run to view the most detailed information collected by the Asset Intelligence feature. Asset Intelligence reports can be used to view hardware, software, and license management information.

Example Scenario for Using Reports to View Asset Intelligence Catalog Information

In this example, Ed Banti, the Configuration Manager 2007 administrator for Blue Yonder Airlines, views collected Asset Intelligence information by using reports. Ed also configures the necessary Configuration Manager 2007 reporting security permissions to allow April Meyers, the asset manager for Blue Yonder Airlines, to view necessary licensing information reports by using a remote installation of the Configuration Manager 2007 console, without giving her the ability to manage site information.

Process | Reference
Ed reviews the available Asset Intelligence reports to determine the reports to view. | About Asset Intelligence Reports
Using the Configuration Manager console, Ed selects an Asset Intelligence report and views it. | How to View Collected Asset Intelligence Information
Ed configures the required security settings to allow April to have read-only access to collected Asset Intelligence information. | How to Configure Asset Intelligence Object Security for Asset Managers

See Also

Concepts

Example Scenarios for Asset Intelligence


Importing Software License Information into the Asset Intelligence Catalog.

Topic last updated—March 2008

Using the Configuration Manager 2007 SP1 License Import Wizard, administrators can import both Microsoft and non-Microsoft licensing information into the Asset Intelligence catalog. After importing licensing information, Asset Intelligence license management reports provide data about the number of purchased licenses for given software titles and information about how many of those licenses are in use.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Example Scenario for Importing Microsoft MVLS Licensing Information into the Asset Intelligence Catalog

In this example, Torsten Arndt, the Configuration Manager 2007 SP1 administrator for Humongous Insurance, will import Microsoft Volume Licensing (MVLS) licensing information into the Asset Intelligence catalog. To do this, Torsten will work closely with Stefan Delmarco, the asset manager for Humongous Insurance, who is registered with MVLS and manages the organization's MVLS licenses.

Process | Reference
In preparation for using the Configuration Manager 2007 SP1 License Import Wizard to import purchased MVLS software licenses purchased by Humongous Insurance into the Asset Intelligence catalog, Torsten requests that Stefan store the MVLS licensing information file (in .xml format) in a secured network share location accessible only to Stefan and himself. | Asset Intelligence Security Best Practices and Privacy Information How to Import Software License Information
After importing MVLS license information into the Asset Intelligence catalog, Torsten and Stefan can use the Asset Intelligence license ledger reports to analyze license usage in comparison to purchased licenses. | About License Ledger Reports How to Configure Asset Intelligence Object Security for Asset Managers

Example Scenario for Importing Non-Microsoft Licensing Information into the Asset Intelligence Catalog

In this example, Torsten Arndt, the Configuration Manager 2007 SP1 administrator for Humongous Insurance, will import non-Microsoft licensing information into the Asset Intelligence catalog. To do this, Torsten will work closely with Kim Ralls, the software packaging administrator for Humongous Insurance who is responsible for installation and management of all line-of-business applications, and Stefan Delmarco, the asset manager for Humongous Insurance.

Process | Reference
To import non-Microsoft software licenses into the Asset Intelligence catalog, the licensing information must be properly formatted, with all required fields present, in an XML-formatted license import file. To make this process easier, Kim uses Microsoft Office Excel to create the licensing file and saves it in XML format. | Importing Software Licenses Into the Asset Intelligence Catalog
In preparation for using the Configuration Manager 2007 SP1 License Import Wizard to import non-Microsoft software licenses purchased by Humongous Insurance into the Asset Intelligence catalog, Torsten requests that Kim store the custom software licensing information file (in XML format) in a secured network share location accessible only to Kim and himself. | Asset Intelligence Security Best Practices and Privacy Information How to Import Software License Information
After importing the non-Microsoft license information into the Asset Intelligence catalog, Torsten and Stefan can use the Asset Intelligence license management reports to analyze license usage in comparison to purchased licenses. | License Management Reports How to Configure Asset Intelligence Object Security for Asset Managers

See Also

Concepts

Example Scenarios for Asset Intelligence


Customizing Asset Intelligence Catalog Information

Topic last updated—March 2008

The Configuration Manager 2007 SP1 Asset Intelligence feature allows administrators to customize the local Asset Intelligence catalog. Using the Customize Catalog Configuration Manager console node, administrators can locally edit the information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

When customizing the local Asset Intelligence catalog, administrators can create, rename, and delete custom catalog information. The software categorization information supplied by System Center Online can also be redefined to suit custom software categorization requirements.

Example Scenario for Customizing the Asset Intelligence Catalog

In this example, Torsten Arndt, the Configuration Manager 2007 SP1 administrator for Humongous Insurance, will customize Asset Intelligence catalog information, create custom labels, and define custom software categories and software families for inventoried software titles. To do this, Torsten will work closely with Stefan Delmarco, the asset manager for Humongous Insurance, who manages the software in use for the organization.

Process Reference

Torsten begins the process by viewing the inventoried software title information for uncategorized software titles. After reviewing the list of uncategorized software with Stefan, a list of user-defined software categories, software families, and custom labels are decided on.

About the Asset Intelligence Catalog

Torsten then uses the Configuration Manager console to add the planned user-defined, custom categorization information to help manage and categorize the software in use by Humongous Insurance.

By configuring the custom category and family information for uncategorized software titles and assigning custom label information as needed, Torsten is able to completely categorize all inventoried software titles.

How to Customize the Asset Intelligence Catalog

After implementing user-defined categorization information into the Asset Intelligence catalog, Torsten and Stefan use Asset Intelligence reports to view inventoried software titles by using custom categorization details.

Software Reports

How to Configure Asset Intelligence Object Security for Asset Managers

See Also

Concepts

Example Scenarios for Asset Intelligence


Installing and Configuring the Asset Intelligence Synchronization Point

Topic last updated—March 2008

The Configuration Manager 2007 SP1 Asset Intelligence feature allows administrators to customize the local Asset Intelligence catalog. Using the Customize Catalog Configuration Manager console node, administrators can locally edit the information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Example Scenario for Installing and Configuring the Asset Intelligence Synchronization Point

In this example, Stuart Railson, the Configuration Manager 2007 SP1 administrator for Tailspin Toys, will install and configure the Asset Intelligence synchronization point to enable dynamic Asset Intelligence catalog updates. To do this, Stuart will review the security requirements with Carol Philips, Tailspin Toys' security manager, Patrick Hines, Tailspin Toys' firewall administrator, and Lisa Miller, who is registered with the Microsoft Volume License Service and manages Microsoft Software Assurance licensed software in use for Tailspin Toys. Stuart will then configure the necessary security settings to allow Larry Zhang, the asset manager for Tailspin Toys, to view Asset Intelligence catalog data.

Process | Reference
Before beginning the installation process, Stuart carefully reviews the Asset Intelligence configuration checklist and verifies that the site system selected to install the Asset Intelligence synchronization point meets supported configuration requirements for Configuration Manager 2007 SP1 site systems. | Asset Intelligence Configuration Checklist Configuration Manager 2007 SP1 Supported Configurations
Stuart then reviews the security implications of uploading software title information to System Center Online with Carol and the required Internet connectivity requirements with Patrick. | About the Asset Intelligence Synchronization Point Asset Intelligence Security Best Practices and Privacy Information
Before installation of the Asset Intelligence synchronization point can proceed, Stuart reviews the System Center Online authentication certificate requirements with Lisa. After provisioning the System Center Online authentication certificate, Lisa copies the certificate file (.pfx) to a secured network share location accessible to Stuart while using the New Site Role Wizard to install the Asset Intelligence synchronization point. | How to Connect to System Center Online Asset Intelligence Security Best Practices and Privacy Information How to Add New Site System Roles
After installing the Asset Intelligence synchronization point and synchronizing the local Asset Intelligence catalog with System Center Online, Stuart configures the security permissions necessary for Larry to view software asset information. | How to Install an Asset Intelligence Synchronization Point How to Configure Asset Intelligence Object Security for Asset Managers

See Also

Concepts

Example Scenarios for Asset Intelligence


Validation State Transition Examples

Topic last updated—March 2008

Asset Intelligence validation states are not static and can change depending on administrative actions taken that affect the data stored in the Asset Intelligence catalog. This topic describes some possible validation state transition examples.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

State Transition Examples

  • Uncategorized catalog item is categorized by the administrator.
  • Categorized catalog item is recategorized by the administrator.
  • User-defined catalog item is recategorized by System Center Online.
  • Uncategorized catalog item is submitted to System Center Online for Categorization.
  • User-defined catalog item is submitted to System Center Online for categorization.

Uncategorized Item Is Categorized by the Administrator

State transition | State transition description
Uncategorized | An inventoried software title that has not been previously categorized by System Center Online or the administrator is entered into the Asset Intelligence catalog.
Uncategorized to User Defined | The uncategorized item is categorized by the administrator.

Categorized Item Is Recategorized by the Administrator

State transition State transition description

Validated

Catalog item has been defined by System Center Online researchers and is present in the Asset Intelligence catalog.

Validated to User Defined

The validated catalog item is recategorized by the administrator.

Note
Because categorization information obtained from System Center Online is stored in the database and cannot be deleted, the administrator can choose to revert back to the System Center Online categorization later.

User Defined Item Is Recategorized by System Center Online

State transition State transition description

Uncategorized

An inventoried software title that has not been previously categorized by System Center Online or the administrator is entered into the Asset Intelligence catalog.

User Defined

The uncategorized item is categorized by the administrator.

User Defined to Updateable

A user-defined catalog item has been categorized differently by System Center Online during subsequent manual bulk update of the Asset Intelligence catalog.

Administrator can use the Software Details Conflict Resolution dialog box to decide whether or not to use the new categorization information or the previous user-defined value.

Updateable to Validated

Administrator uses the Software Details Conflict Resolution dialog box to use the new categorization information received from System Center Online during the previous catalog update.

or

Updateable to User Defined

Administrator uses the Software Details Conflict Resolution dialog box to use the previous user-defined value.

Note
Because categorization information obtained from System Center Online is stored in the database and cannot be deleted, the administrator can choose to revert back to the System Center Online categorization later.

Uncategorized Item Is Submitted to System Center Online for Categorization

Note
This example applies only to Asset Intelligence in Configuration Manager 2007 SP1 with an Asset Intelligence synchronization point installed and enabled.

State transition | State transition description
Uncategorized | An inventoried software title is entered into the Asset Intelligence database that has not been previously categorized by System Center Online or the administrator.
Uncategorized to Pending | The uncategorized item is submitted to System Center Online for categorization by the administrator.
Pending to Validated | The item is categorized by System Center Online and is imported into the Asset Intelligence catalog by the administrator using a bulk catalog update or Asset Intelligence catalog synchronization using the Asset Intelligence synchronization point site system role.

User Defined Item Is Submitted to System Center Online for Categorization

Note
This example applies only to Asset Intelligence in Configuration Manager 2007 SP1 with an Asset Intelligence synchronization point installed and enabled.

State transition State transition description

Uncategorized

An inventoried software title is entered into the Asset Intelligence database that has not been previously categorized by System Center Online or the administrator.

User Defined

The uncategorized item is categorized by the administrator.

User Defined to Pending

The user-defined item is submitted to System Center Online for categorization by the administrator.

Pending to Updateable

A user-defined catalog item has been categorized differently by System Center Online during subsequent catalog synchronization.

Administrator can use the Software Details Conflict Resolution dialog box to decide whether or not to use the new categorization information or the previous user-defined value.

Updateable to Validated

Administrator uses the Software Details Conflict Resolution dialog box to use the new categorization information received from System Center Online during the previous catalog update.

or

Updateable to User Defined

Administrator uses the Software Details Conflict Resolution dialog box to use the previous user-defined value.

Note
Because categorization information obtained from System Center Online is stored in the database and cannot be deleted, the administrator can choose to revert back to the System Center Online categorization later.

See Also

Tasks

How to Request Software Categorization
How to Resolve Software Details Conflicts

Concepts

About Asset Intelligence Validation States
Technical Reference for Asset Intelligence


Importing Software Licenses Into the Asset Intelligence Catalog

Topic Last Updated—August 2008

The following sections describe the procedures necessary to import both Microsoft and non-Microsoft software licensing information into the Configuration Manager 2007 SP1 site database using the Asset Intelligence License Import Wizard.

When importing software licenses from license information files into the site database, the site server computer account requires full control NTFS permissions to the file share that will be used to import software license information.

Important
When software license information is imported into the site database, existing software license information is overwritten. Ensure that the software license information file used with the Asset Intelligence License Import Wizard contains a complete listing of all necessary software license information.

For more information about using the Asset Intelligence License Import Wizard, see How to Import Software License Information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Importing Microsoft Volume Licensing (MVLS) Software License Information

Microsoft software license information can be imported into the Asset Intelligence catalog directly from a Microsoft licensing spreadsheet. Before importing software license information, the MVLS spreadsheet must be converted to an .xml file. The following procedure describes how to convert an MVLS licensing spreadsheet file to .xml format using Microsoft Office Excel.

Important
Either Microsoft Office Excel 2003 or Microsoft Office Excel 2007 can be used to complete this procedure. However, if you attempt to convert an MVLS spreadsheet created in Microsoft Office Excel 2003 (.xls) with Microsoft Office Excel 2007 (.xlsx), this procedure will fail. Before beginning this procedure, ensure that the MVLS statement file type is the same as the version of Microsoft Office Excel that will be used.

To Convert a Microsoft Volume Licensing Statement to .xml Format

  1. Open the MVLS spreadsheet with Microsoft Office Excel and ensure that the License Summary tab is selected.

  2. From the Microsoft Office Excel file menu, save the file in .xml format. When using Microsoft Office Excel 2003, the file created should be saved as an XML Spreadsheet formatted file. When using Microsoft Excel 2007, the file created should be saved as an XML Spreadsheet 2003 formatted file.

  3. Copy the .xml file to the file share that will be used to import software license information into the Asset Intelligence catalog using the Asset Intelligence License Import Wizard.

  4. From within the Configuration Manager console, use the Asset Intelligence License Import Wizard to import the newly created .xml license information file.

  5. Run the Asset Intelligence License 14A – Microsoft Volume Licensing Reconciliation Report to verify that the licensing information has been successfully imported into the Asset Intelligence catalog.

Importing non-Microsoft Volume Licensing (MVLS) Software License Information

Non-Microsoft software license information can also be imported into the Asset Intelligence catalog using a manually created license import file in .csv file format. When creating a non-Microsoft license import file, the information in the following table can be used to describe software licenses to be imported into the Asset Intelligence catalog. Name, Publisher, Version, Language, Effective Quantity, PO Number, Reseller Name, Date of purchase, Support purchased (1 or 0), Support Expiration Date, and Comments.

Column Name | Data Type | Required | Example
Name | Up to 255 characters | Yes | Software title
Publisher | Up to 255 characters | Yes | Software publisher
Version | Up to 255 characters | Yes | Software title version
Language | Up to 255 characters | Yes | Software title language
EffectiveQuantity | Integer value | Yes | Number of licenses purchased
PONumber | Up to 255 characters | No | Purchase order information
ResellerName | Up to 255 characters | No | Reseller information
DateOfPurchase | Date value in the following format: Month/Day/Year. | No | Date of license purchase.
SupportPurchased | Bit value | No | 0 or 1 Enter 0 for Yes or 1 for No.
SupportExpirationDate | Date value in the following format: Month/Day/Year. | No | End date of purchased support.
Comments | Up to 255 characters | No | Optional comments
Note
While only the Name, Publisher, Version, and EffectiveQuantity fields are required to contain data, all fields must be entered on the first row of the license import file. All date fields should be displayed in the following format: Month/Day/Year as in this example: 8/4/2008.

The following procedure describes the process that can be used to create a non-Microsoft software license import file using Microsoft Office Excel.

To Create a non-Microsoft License Import File Using Microsoft Office Excel

  1. Open Microsoft Office Excel and create a new spreadsheet.

  2. On the first row of the new spreadsheet, enter all software license data field names.

  3. On the second and subsequent rows of the new spreadsheet, enter software license information as required. Ensure that at least all of the required software license data fields are entered on subsequent rows for each software license to be imported. The software title name entered in the spreadsheet must be the same as the software title that is displayed in Resource Explorer for a client computer after hardware inventory has run.

  4. From the Microsoft Office Excel file menu, save the file in .csv format.

  5. Copy the .csv file to the file share that will be used to import software license information into the Asset Intelligence catalog using the Asset Intelligence License Import Wizard.

  6. From within the Configuration Manager console, use the Asset Intelligence License Import Wizard to import the newly created .csv license information file.

  7. Run the Asset Intelligence License 15A – Third Party Software Reconciliation Report to verify that the licensing information has been successfully imported into the Asset Intelligence catalog.

See Also

Tasks

How to Import Software License Information

Concepts

Technical Reference for Asset Intelligence
Example Asset Intelligence Non-Microsoft License Import File


Example Asset Intelligence Non-Microsoft License Import File

Topic Last Updated—August 2008

The example information in this topic can be used to create a sample non-Microsoft software license file used to import software licenses into the Asset Intelligence catalog using the Asset Intelligence License Import Wizard.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Example non-Microsoft License Import File Created in Microsoft Office Excel

The following table can be copied and pasted into a new Microsoft Office Excel spreadsheet and saved with a .csv file extension to be used as an example non-Microsoft license import file for testing purposes. When creating the license import file, all header fields are required while only Name, Publisher, Version, and EffectiveQuantity data values are required in the spreadsheet. For more information about the fields used in a non-Microsoft license import file, see Importing Software Licenses Into the Asset Intelligence Catalog.

Name | Publisher | Version | Language | EffectiveQuantity | PONumber | ResellerName | DateOfPurchase | SupportPurchased | SupportExpirationDate | Comments
Software Title 1 | Software Publisher | 1.01 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 2 | Software publisher | 1.02 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 3 | Software publisher | 1.03 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 4 | Software publisher | 1.04 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 5 | Software publisher | 1.05 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 6 | Software publisher | 1.06 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 7 | Software publisher | 1.07 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 8 | Software publisher | 1.08 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 9 | Software publisher | 1.09 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment
Software title 10 | Software publisher | 1.10 | English | 1 | Purchase number | Reseller name | License purchase date | 0 | 8/4/2008 | Comment

See Also

Tasks

How to Import Software License Information

Concepts

Technical Reference for Asset Intelligence


Software Metering in Configuration Manager

The Configuration Manager 2007 software metering feature allows you to monitor and collect software usage data from Configuration Manager 2007 clients. Click the associated link in the following section for detailed information about planning, configuring, managing, monitoring, and troubleshooting software metering.

In This Section

Overview of Software Metering

Provides an overview of the software metering feature.

Prerequisites for Software Metering

Provides information about the prerequisites necessary to use software metering.

Tasks for Software Metering

Provides a set of tasks to perform desired software metering objectives.

Software Metering Privacy Information

Provides security and privacy information and best practices for software metering.

Troubleshooting Software Metering

Provides troubleshooting information for software metering.

Technical Reference for Software Metering

Provides technical reference information for software metering.

See Also

Concepts

What's New in Software Metering for Configuration Manager


Overview of Software Metering

Software metering in Configuration Manager 2007 allows you to monitor and collect software usage data on Configuration Manager 2007 clients.

The collection of this usage data is based on software metering rules that can be configured by the administrator in the Configuration Manager console, or by the automatic generation of rules based on usage data collected by Configuration Manager 2007 inventory. These rules are evaluated by the software metering client agent on Configuration Manager 2007 client computers, which collects metering data and reports this back to the site database. The software metering client agent continues to collect usage data when there is no connection to the Configuration Manager 2007 site and will report this back when the connection is re-established. Software metering data held on the site database is summarized on a specified schedule and propagated up through the site hierarchy to any parent site. The central Configuration Manager 2007 site database will therefore contain usage data from all client computers within the site hierarchy.

Note
If you plan to use software metering to collect information about virtual application packages you must restart the target computers after you install the Microsoft Application Virtualization Client software. For more information about virtual application packages see: About Virtual Application Packages. By default, software metering rules are active only on the Configuration Manager 2007 site where they were created. When you create a rule, you can specify that it should be copied to all child sites of the Configuration Manager 2007 site where it was created.

After you collect usage data from Configuration Manager 2007 clients, you can use different features to view the data, including collections, queries, and reporting. This data, combined with data from software inventory, can assist your organization in determining the following:

  • How many copies of a particular software program have been deployed to the computers in your organization. Among those computers, you can determine how many users actually run the program.
  • How many licenses of a particular software program you need to purchase when you renew your license agreement with the software vendor.
  • Whether any users are still running a particular software program. If the program is not being used, you might consider retiring the program.
  • Which times of the day a software program is most frequently used.

See Also

Concepts

Prerequisites for Software Metering

Other Resources

Tasks for Software Metering
Troubleshooting Software Metering
Technical Reference for Software Metering


Prerequisites for Software Metering

Software metering in Configuration Manager 2007 has only dependencies within the product.

Configuration Manager 2007 Dependencies

Dependency | More Information
The site must be running Configuration Manager 2007 and be enabled for software metering. | To use software metering, you must enable the software metering client agent. This is not enabled by default.

See Also

Tasks

How to Enable or Disable the Software Metering Client Agent

Other Resources

Software Metering Client Agent Properties


Tasks for Software Metering

To use Configuration Manager 2007 software metering, you must complete a number of configuration and management tasks.

The content in this section contains more information about these tasks.

In This Section

How to Enable or Disable the Software Metering Client Agent

How to Add a Software Metering Rule

How to Delete a Software Metering Rule

How to Configure Automatic Software Metering Rule Generation

How to Enable or Disable a Software Metering Rule

See Also

Other Resources

Overview of Software Metering


How to Enable or Disable the Software Metering Client Agent

Enabling the software metering client agent makes it possible for Configuration Manager 2007 clients that are assigned to this site to collect usage data specified by software metering rules. This client agent is not enabled by default.

Disabling the software metering client agent prevents Configuration Manager 2007 clients that are assigned to this site from collecting usage data specified by software metering rules.

This setting to enable or disable the software metering client agent is downloaded to client computers according to the Policy Polling Interval in the Computer Client Agent Properties dialog box (by default, every 60 minutes).

To enable or disable the software metering client agent:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Agents.

  2. Right-click Software Metering Client Agent and then click Properties.

  3. On the General tab, enable or disable the option Enable software metering on clients.

  4. Click OK.

See Also

Other Resources

Overview of Software Metering


How to Add a Software Metering Rule

The New Software Metering Rule Wizard leads you through the process of creating a new software metering rule for your Configuration Manager 2007 site. The following procedure provides the steps necessary to create a new software metering rule.

To add a new software metering rule:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Metering.

  2. Right-click Software Metering, click New, and then click Software Metering Rule.

  3. On the General page of the New Software Metering Rule Wizard, specify the following information:

    • Name: The name of the software metering rule. This should be unique and descriptive.
      Note
      Software metering rules can share the same name if the file name contained in the rules is different.

    • File Name: The name of the executable file you want to meter. You can click Browse to display the Open dialog box, in which you can select the executable file to use.
      Note
      If you type the executable name into the File name field, no checks are carried out to determine whether this file exists or whether it contains the necessary header information. When possible, use the Browse button to specify the executable file to be metered.

      Wildcard characters are not permitted in the file name.

      This field is optional if a value for Original file name is specified.

    • Original File Name: The name of the executable file you want to meter. This name is matched to information in the header of the file, not the filename itself so that it can be useful in cases where the executable file has been renamed but you want to meter it by the original name.
      Note
      Wildcard characters are not permitted in the original file name.

      This field is optional if a value for File Name is specified.

    • Version: The version of the executable file you want to meter. You can use the wildcard character (*) to represent any string of characters or the wildcard character (?) to represent any single character. If you want to meter for all versions of an executable file, use the default value (*).
    • Language: The language of the executable file to meter. The default value is English (United States). If you select an executable file to be metered by using the Browse button, this field is automatically filled if language information is present in the header of the file. To meter all language versions of a file, select - Any - from the drop-down list.
    • Comment: An optional description for the software metering rule.
    • Site Code: The Configuration Manager 2007 site code that the software metering rule will apply to.
    • This rule applies to the specified site and all its child sites: Indicates whether the software metering rule will apply to all lower level Configuration Manager 2007 or Systems Management Server 2003 sites, in addition to the site code specified in Site code.
    • To continue, click Next.

  4. On the Security page of the New Software Metering Rule Wizard, specify an optional class and instance security rights for this software metering rule and then click Finish.

See Also

Other Resources

Overview of Software Metering


How to Delete a Software Metering Rule

When you delete a software metering rule in Configuration Manager 2007, the change in rules will be downloaded to client computers according to the Policy Polling Interval in the Computer Client Agent Properties dialog box (by default, every 60 minutes).

The following procedure provides the steps necessary to delete a software metering rule.

To add a new software metering rule:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Metering.

  2. Right-click a software metering rule, and then click Delete.

  3. In the Confirm Object Delete dialog box, click Yes to confirm you want to delete this software metering rule.

See Also

Other Resources

Overview of Software Metering


How to Configure Automatic Software Metering Rule Generation

Software metering in Configuration Manager 2007 introduces a new feature that allows you to configure software metering to automatically generate disabled software metering rules from recent usage inventory data held in the Configuration Manager 2007 database. This can be configured so that only applications used on a specified percentage of computers will have metering rules created. You can also specify the maximum number of automatically generated software metering rules allowed on the site.

The following procedure provides the steps necessary to configure automatic software metering rule generation.

Note
Software metering rules that are automatically created are by default disabled. Before you can begin to collect usage data from these rules, you must enable them.

To configure automatic software metering rule generation:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Metering.

  2. Right-click the Software Metering node, and then click Properties.

  3. In the General tab of the Software Metering Properties dialog box, specify the following:

    • Enable the option to Auto-create disabled metering rules from recent usage inventory data.
    • Specify the percentage of computers in a Configuration Manager 2007 site that must use a particular executable before a software metering rule for that executable is automatically created. The default value is 10 percent.
    • Specify the number of rules after which no new software metering rules will be automatically created. The default value is 100 rules.

  4. Click OK.

See Also

Tasks

How to Enable or Disable a Software Metering Rule

Other Resources

Overview of Software Metering


How to Enable or Disable a Software Metering Rule

You might want to disable a Configuration Manager 2007 software metering rule while still keeping it for later use.

The following procedure provides the steps necessary to enable or disable a software metering rule.

This setting to enable or disable a software metering rule is downloaded to client computers according to the Policy Polling Interval in the Computer Client Agent Properties dialog box (by default, every 60 minutes).

To enable or disable a software metering rule:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Metering.

  2. Right-click one or more software metering rules and then click Enable or Disable.

See Also

Other Resources

Overview of Software Metering


Software Metering Privacy Information

Software metering monitors the usage of applications on client computers. Software metering is not enabled by default. You must configure which applications to meter. Metering information is stored in the site database. The information is encrypted during transfer to the management point but it is not stored in encrypted form in the site database. Information is retained in the database until deleted by the site maintenance tasks Delete Aged Software Metering Data (every five days) and Delete Aged Software Metering Summary Data (every 270 days). You can configure the deletion interval. Metering information is not sent back to Microsoft. Before configuring software metering, consider your privacy requirements. Some additional metering information is collected through hardware inventory. For more information, see Inventory Security Best Practices and Privacy Information.

See Also

Concepts

Software Metering in Configuration Manager

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features


Troubleshooting Software Metering

Topic last updated—November 2007

The topics in this section provide toubleshooting information for software metering with Configuration Manager 2007.

This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=66999.

In This Section

Troubleshooting Software Metering Issues

Lists possible problems and solutions if you experience issues when using software metering.

Log Files for Software Metering

Lists and describes the log files created on the client and server for Configuration Manager 2007 software metering.

See Also

Concepts

Software Metering in Configuration Manager


Troubleshooting Software Metering Issues

Topic last updated—November 2007

This section provides troubleshooting information to help you resolve issues when using software metering in Configuration Manager 2007.

Usage Data Is Not Being Reported or Is Incomplete for a Software Metering Rule

Configuration Manager 2007 software metering returns no data or incomplete data.

Solution

Common causes of software metering data not being reported or being incomplete include the following:

  • The software metering client agent is not enabled. To enable the software metering client agent, see How to Enable or Disable the Software Metering Client Agent.
  • Client computers have not yet reported metering data because of the data collection schedule specified on the Software Metering Client Agent Properties dialog box Schedule tab. Wait for the client to report data to the site server, or consider reducing the Data collection schedule interval.
  • When you specify the file version for a new software metering rule, it's possible that not all computers in your organization are using this version of the software package. You can use Configuration Manager 2007 software inventory to discover which versions are in use and either set up multiple software metering rules to monitor each version or use wildcards to specify the version in the software metering rule.
  • When you specify language settings for a software metering rule, it's possible that some computers in your organization might be running different language versions of the same software package. Either set up multiple software metering rules to meter each language version of the software or set the language to Any in the software metering rule.
  • When Configuration Manager 2007 software metering automatically generates new software metering rules, they are created in a disabled state. You must enable them before they will generate any data. For more information, see How to Enable or Disable a Software Metering Rule.

See Also

Concepts

Software Metering in Configuration Manager

Other Resources

Troubleshooting Software Metering


Log Files for Software Metering

Topic last updated—November 2007

You can reference a number of log files to help troubleshoot software metering issues in Configuration Manager 2007. These are located on both the client computer and the Configuration Manager 2007 site server.

Configuration Manager Client Computer Log Files

The Configuration Manager 2007 client log files can be found in one of the following locations:

  • On client computers that serve as management points, the client log files are located in the SMS_CCM\Logs folder.
  • On all other computers, the client log files are located in the %Windir%\System32\CCM\Logs folder.

The following table lists and describes the client computer log files.

Log file name Description

Mtrmgr.log

Monitors all software metering processes.

Can help to troubleshoot scenarios where metering cannot monitor a program or add to Windows Management Instrumentation (WMI). Make sure that the software metering rules were downloaded and that the programs are matched by the rules.

SWMTRReportGen.log

Generates a usage data report that is collected by the metering agent. (This data is logged in Mtrmgr.log.)

Can help to troubleshoot scenarios where the client cannot send a software metering report to the management point. Make sure that the client can generate a usage report and send it to the management point.

Configuration Manager Site Server Log Files

The Configuration Manager 2007 site server log file can be found in the folder SMS\Logs on the site server. The following table lists and describes the site server log file.

Log file name | Description
Swmproc.log | This component processes metering files and maintains settings. Can help to troubleshoot scenarios where software metering information does not appear or appears corrupted.

See Also

Concepts

Overview of Configuration Manager Client Deployment


Technical Reference for Software Metering

Click any link in the following section for technical references for software metering in Configuration Manager 2007.

In This Section

About Feature Reports for Software Metering

Provides a list of the reports built into Configuration Manager 2007 that help you analyze the usage data collected by software metering.

About Software Metering Maintenance Tasks

Provides information on the tasks built into Configuration Manager 2007 that help you to optimize and maintain the usage data collected by Configuration Manager 2007 software metering.

Example Scenario for Implementing Software Metering

An example scenario of how software metering can be implemented to address various business requirements.

See Also

Concepts

Software Metering in Configuration Manager


About Feature Reports for Software Metering

The following reports are available for Configuration Manager 2007 client deployment.

These reports have the report category of Software Metering.

  • All software metering rules at this site
  • Computers that have a metered program installed, but have not run the program since a specified date
  • Computers that have run a specific metered software program
  • Concurrent usage for all metered software programs
  • Concurrent usage trend analysis of a specific metered software program
  • Install base for all metered software programs
  • Software metering summarization progress
  • Time of day usage summary for a specific metered software program
  • Total usage for all metered software programs
  • Total usage for all metered software programs on Windows Terminal Servers
  • Total usage trend analysis for a specific metered software program
  • Total usage trend analysis for a specific metered software program on Windows Terminal Servers
  • Users that have run a specific metered software program

See Also

Other Resources

Overview of Software Metering


About Software Metering Maintenance Tasks

Configuration Manager 2007 includes a number of maintenance tasks to help you manage the usage data collected by software metering:

  • Delete Aged Software Metering Data
  • Delete Aged Software Metering Summary Data
  • Summarize Software Metering File Usage Data
  • Summarize Software Metering Monthly Usage Data

These tasks are described in the following sections. By default, all four tasks are enabled in the Configuration Manager 2007 console. To configure these tasks in the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Maintenance / Tasks and then double-click the task you want to configure.

Delete Data Tasks

The following maintenance tasks remove old software metering data and summarized data from the Configuration Manager 2007 site database:

Delete Aged Software Metering Data

Use the Delete Aged Software Metering Data task to delete all summarized software metering data that is older than the number of days specified.

By default, the task is scheduled to run every day and to delete software metering data that is older than five days. You can configure the number of days to be any number from 2 through 255.

Delete Aged Software Metering Summary Data

Use the Delete Aged Software Metering Summary Data task to delete summarized software metering summary data that is older than the number of days specified.

By default, the task is scheduled to run every Sunday and to delete software metering summary data that is older than 270 days.

Summarize Software Metering Tasks

The Summarize Software Metering tasks perform the data summarization to compress the amount of data in the Configuration Manager 2007 site database.

For the two software metering summarization tasks to succeed, software metering data that is at least 12 hours old must exist.

Data summarization runs daily and runs only against usage data that is older than 12 hours. Data summarization is required for all Configuration Manager 2007 software metering reports to display meaningful data. To understand what is contained in the most current set of summary data, you should know when summarization last occurred. A report for this, Software metering summarization progress is included in Configuration Manager 2007.

Summarize Software Metering File Usage Data

The Summarize Software Metering File Usage Data task condenses software metering file usage data from multiple records into one general record. This record provides information about the program name, version, language, and number of distinct users over intervals of 15 minutes and one hour. This process compresses and optimizes the amount of data stored in the Configuration Manager 2007 site database.

By default, the Summarize Software Metering File Usage Data task runs daily. For every hour and every 15-minute interval within the hour, the task calculates the total number of distinct user/computer combinations that are running the matching program. Within the 15-minute intervals, this approximates the number of concurrent users. For example:

  • If the same user is using a software program and is logged on to three different computers simultaneously, this counts as three usages.
  • If three users are logged on to a computer running Terminal Services and all three are running the software program, this counts as three usages.
  • If the same user starts and stops the software program on the same computer three separate times during the hour, this counts as one usage for that user.

When replicated up the Configuration Manager 2007 hierarchy, the software metering summary data from each site remains separated from data from the other sites. When the data reaches a parent site, each record is marked with the site code of the site where the usage data was generated. These records can be added together to estimate concurrent program usage in the network.

Summarize Software Metering Monthly Usage Data

The Summarize Software Metering Monthly Usage Data task condenses detailed software metering usage data from multiple records into one general record. This record provides information about the program name, program version and language, program running times, number of usages, last usage, user name, and computer name. Data summarization helps compress the amount of data in the Configuration Manager 2007 site database. Monthly software usage data is sent to the central site.

The summarization information includes the number of times each matching software program ran on a particular computer and by a particular user during the month. By default, the task is scheduled to run daily and the summarization period is one month. Software monthly usage data is replicated to the parent site.

See Also

Other Resources

Overview of Software Metering


Example Scenario for Implementing Software Metering

The following sections provide an example scenario of how software metering in Configuration Manager 2007 can be implemented to solve the following business requirements:

  • Determine how many copies of a specified software application are in use on the company network.
  • Determine whether there are any unused copies of the specified software application on the network.
  • Determine which users regularly use the specified software application.

This scenario demonstrates how customers can use software metering to monitor applications in the enterprise to see where they are being loaded, how often they are being used, and also who is using them.

Woodgrove Bank has deployed Microsoft Office 2007 as its standard office productivity suite. However, to support a legacy application, the bank needs to maintain a number of copies of Microsoft Office Word 2003 on the system. To reduce support and licensing costs, these copies of Word 2003 need to be removed if the legacy application is no longer being used. The bank also needs to identify which users use the legacy application.

John Woods is Woodgrove Bank's IT systems manager. He learns that Configuration Manager 2007 software metering will allow him to accomplish the stated business objectives. He decides to follow this course of action:

  • John checks that the bank's Configuration Manager 2007 site is enabled for software metering, and he does not change the default data collection schedule of once every seven days.
  • He adds a new software metering rule, named woodgrove.exe, to monitor the bank's legacy application.
  • John waits for seven days, after which the client computers in the bank's Configuration Manager 2007 site begin to report usage data for the woodgrove.exe executable.
  • John uses the Configuration Manager 2007 report Install base for all metered software programs to report which computers have the application woodgrove.exe loaded.
  • He then uses the report Computers that have a metered program installed, but have not run the program since a specified date, specifying the software metering rule and a date six months in the past. This report identifies 30 computers that have not run the program in the past six months.
  • John contacts the owners of each computer to confirm that the legacy application is no longer in use and arranges to remove both the application and the copy of Word 2003 on the computer.
  • John continues to check the metering reports weekly and take remedial action where necessary.

For procedural information about these steps, see the following topics:

  • Prerequisites for Software Metering
  • How to Enable or Disable the Software Metering Client Agent
  • How to Add a Software Metering Rule
  • About Feature Reports for Software Metering

See Also

Other Resources

Overview of Software Metering


Reporting in Configuration Manager

Microsoft System Center Configuration Manager 2007 reporting helps you to gather, organize, and present information about users, hardware and software inventory, software updates, site status, and other Configuration Manager operations in your organization. Reporting provides you with a number of predefined reports that you can use as is or that you can modify to meet your needs, or custom reports and dashboards can be created to meet your needs. Click the associated link the following section for overview information about reporting and detailed information about configuring, managing, and troubleshooting reporting.

In This Section

Reporting Overview

Provides an overview for reporting.

Configuring Reporting

Provides the configuration information for reporting.

Reporting Tasks

Provides a set of tasks to perform reporting objectives.

Reporting Security Best Practices

Provides security and privacy information and best practices for reporting.

Troubleshooting Reporting

Provides troubleshooting information for reporting.

Technical Reference for Reporting

Provides technical reference information for reporting.


Reporting Overview

Configuration Manager 2007 generates a tremendous amount of network, inventory, discovery, and status information, which it maintains in the site database. Depending on the level of each site in the Configuration Manager hierarchy, the site database might also include information that is passed up from child sites. One challenge that administrators might face is retrieving the pertinent data that is necessary to monitor and evaluate the Configuration Manager system and to help administrators and others effectively manage an organization. Configuration Manager can be used to gather, organize, and present information that is collected in the site database.

Reporting provides a number of predefined reports that provide data for the Configuration Manager components and processes. Custom reports can also be created, and predefined reports can be modified to meet business needs. Click any link in the following section for overview information about reporting.

In This Section

Prerequisites for Reporting

Specifies the requirements for using the reporting component in Configuration Manager.

About Reporting Points

Provides information about the reporting point site system.

About Report Viewer

Provides information about Report Viewer, which displays the reporting types by using Internet Explorer.

About Configuration Manager Reports

Provides overview information about Configuration Manager reports, the report structure, and the report settings.

About Configuration Manager Dashboards

Provides overview information about Configuration Manager dashboards and information about using dashboards.

About Supplemental Reports

Provides information about supplemental reports that can be displayed in Report Viewer.

See Also

Concepts

Reporting in Configuration Manager


About Reporting Points

A reporting point is a site server role in Configuration Manager 2007 that hosts the files used by Configuration Manager to display database information in Report Viewer. Reporting points communicate only with the local site database; thus, you implement reporting points only in primary sites, not secondary sites. Large organizations with numerous report users should consider planning for multiple reporting points. With multiple reporting points, you can provide different reporting point access URLs to different sets of users for accessing reports.

Requirements for the Reporting Point

For the reporting point site role to be added to a site system computer, the following components must be available:

  • The site system computer must have Internet Information Services (IIS) installed and enabled.
  • Active Server Pages must be installed and enabled.
    Note
    When you install ASP.NET on a Windows Server 2008 operating system reporting point, you must also manually enable Windows Authentication. For more information, see How to Configure Windows Server 2008 for Site Systems.

  • Microsoft Internet Explorer 5.01 SP2 or later must be installed on any server or client that uses Report Viewer.
  • To use graphs in reports, Office Web Components (Microsoft Office 2000 SP2, Microsoft Office XP, or Microsoft Office 2003) must be installed.
    Note
    Office Web Components is not supported on 64 bit operating systems. If you want to use graphs in reports, use 32 bit operating systems for your reporting points.

Creating Reporting Points

Configuration Manager 2007 does not automatically enable reporting points. You must enable all reporting points as required to provide access to the reports in your site. To balance a heavy demand for reports in a larger site, you can enable more than one reporting point and then point different groups of users to different URLs for each reporting point. The first time Report Viewer is opened from the Configuration Manager console, you must select a default reporting point that is used when starting Report Viewer from the console. The default reporting point is modified from the Report Options dialog box after it is first configured. For more information about how to create a reporting point, see How to Create a Reporting Point.

See Also

Concepts

Prerequisites for Reporting
Reporting Overview


About Report Viewer

Report Viewer in Configuration Manager 2007 displays database information in a Web browser. When the reporting point site server role is created, Report Viewer files are installed on the site system computer and reports can be opened in Report Viewer from the Configuration Manager console or from a Web browser. For more information, see How to Open Report Viewer.

When Report Viewer is opened in a Web browser, the following reporting objects are displayed:

  • Reports: Provides a list of reports organized by category and then sorted alphabetically.
  • Dashboards: Provides a list of dashboards sorted alphabetically.
  • Computer Details: Opens the Computer Details page, which lists all reports that provide information about individual computers and that have been configured to appear on this page.
  • Supplemental Reports: Provides a list of the supplemental reports.

The user must have Read security rights on the reporting objects for them to be displayed in Report Viewer.

Adjusting Timeout Settings

When a report runs, Report Viewer uses Active Server Pages (ASP) files that are stored on a reporting point. The Internet Information Services (IIS) default setting for the ASP script timeout is 90 seconds. This amount of time should be sufficient for running reports in most environments. However, in certain situations some reports might time out before finishing, such as those with a slow network connection, insufficient hardware, or a SQL statement that is inefficient or returns a large set of records.

If you receive error messages indicating that the maximum time to run a script has been exceeded, you might need to increase the ASP script timeout setting. For more information, see How to Configure the ASP Script Timeout Setting.

Important
The ASP script timeout setting must not be less than either of the control timeout settings: Session("DBConnectionTimeout") and Session("DBCommandTimeout").

When data for reports is retrieved from the SQL Server views in the site database, the ASP script calls an ActiveX control, and in the call, the script passes two control timeout settings as parameters:

  • Session("DBConnectionTimeout"): This setting specifies the number of seconds within which the ActiveX control must connect to the Configuration Manager site database server. The default is 30 seconds.
  • Session("DBCommandTimeout"): This setting specifies the number of seconds within which the ActiveX control must receive data back from the Configuration Manager site database server. The default is 300 seconds.

If there are timeouts when running reports, these timeout settings might also need to be increased. The timeout settings are specified in the Global.asa file. This file can be modified in a text editor, such as Notepad, to increase the settings. If there are multiple reporting points, the Global.asa file must be modified on each of the reporting points on which there are timeouts. The Global.asa file is located in <Installation drive>:\Inetpub\wwwroot\<Report folder name>\. For more information, see How to Configure Connection and Command Timeout Settings.

Timeouts can also have an impact on the performance of dashboards. When one or more reports contained in a dashboard experience timeouts, timeout error messages might appear in some cells and other cells might not display data at all. Timeout settings and report refresh intervals should be carefully configured so that reports that are used in dashboards do not time out or refresh before the dashboard can display all reports.

See Also

Tasks

How to Configure Connection and Command Timeout Settings
How to Configure the ASP Script Timeout Setting
How to Open Report Viewer
How to Run a Report

Concepts

About Configuration Manager Dashboards
About Configuration Manager Reports
About Supplemental Reports
About the Computer Details Page
About the Status Message Details Page


About the Computer Details Page

The Computer Details page of Report Viewer in Configuration Manager 2007 displays a set of reports that are configured to display on the page and provide information about a specific computer. Many predefined reports provided with Configuration Manager are configured to appear on this page and display detailed information about a specific computer. Custom reports can also be configured to appear on the Computer Details page by selecting the Display in Computer Details setting on the General tab of the report's properties page. This setting is available only to reports that have one prompt or no prompts configured. Reports that appear on the Computer Details page also appear in the list of reports on the main page of Report Viewer and in the Configuration Manager console.

Many reports on the Computer Details page include a prompt that requests the user to enter a value before running the report. This value is usually a computer name, but it can be a different value, such as a file name or a user name, depending on how the report is configured. When a user selects a report with a prompt on the Computer Details page, the title of the Value text box changes to reflect the Prompt Text value that was specified when the prompt was created, such as Computer Name. The user can then enter a value and run the report. When a value is specified, the user can select other reports on the Computer Details page and run those reports by using the same value. For example, you might enter a computer name and run a report that provides operating system information about that computer. You can then run a report that provides processor information about the same computer.

When a report contains a link to the Computer Details page, that report must contain computer names in one of its columns. The value from the configured column of the source report is automatically inserted into the Value text box on the Computer Details page. For more information about report links, see About Report Links.

See Also

Tasks

How to Add a Report to the Computer Details Page

Concepts

About Report Links


About the Status Message Details Page

The Status Message Details page of the Configuration Manager 2007 Report Viewer displays information about a specific status message. The Status Message Details page is system-generated and cannot be modified or deleted. The Status Message Details page displays the same information as the Status Message Viewer. You can use the Status Message Details page, instead of the Configuration Manager console, to integrate this status information into your reports.

A number of the predefined reports link to the Status Message Details page. You can also link reports that you create to the Status Message Details page. Any report that you link to the Status Message Details page must contain RecordID values in one of its columns. For more information about report links, see About Report Links.

See Also

Concepts

About Report Links


About Configuration Manager Reports

Reporting in Configuration Manager 2007 is integrated into the Configuration Manager console. Reports are secured Configuration Manager objects that you can create and manage in the Configuration Manager console. Many predefined reports are provided with Configuration Manager, and additional reports can be created to fit your needs. The Object Wizard can be used to import reports that are created at another site. You can run reports by using Report Viewer, which is a browser-based application that you can start either from within the Configuration Manager console or by using a URL with Internet Explorer, which allows for access to reports by any user with the appropriate security rights. For more information, see About Report Viewer. Like other Configuration Manager objects, you must have the appropriate credentials to create, modify, delete, view, or run reports.

The Report Viewer files are located on a reporting point, which is a Configuration Manager site system role. The reporting point provides access to reports at the site and communicates directly with the site database; therefore, they can be installed only on a primary site. Multiple reporting points can be created to balance the network load for viewing reports. For more information, see About Reporting Points.

Reports are not propagated up or down the Configuration Manager hierarchy; they run only against the site's database of the site on which they are created. However, because primary sites contain inventory data from child sites, when a report retrieves data from a primary site's database, it might retrieve data that was forwarded from a child site.

Report Types

Configuration Manager 2007 provides many predefined reports. Custom reports can be created if the predefined reports do not retrieve the desired data, and supplemental reports are created outside of Configuration Manager and are available from Report Viewer.

Predefined Reports

Configuration Manager 2007 provides a number of predefined reports that can be used to gather important information from the site database. Administrators can create, manage, and secure reports by using the Configuration Manager console. Administrators and other report users, such as help desk specialists or business decision-makers, can run reports by using Report Viewer, which is a browser-based application that runs with Microsoft Internet Explorer. You can create and administer reports in the secure environment of the Configuration Manager console, and end users can run reports without the need to access a console. A number of predefined reports are designated to appear on the Computer Details page of Report Viewer. If you clear the Display in computer details check box, modify the SQL statement, or modify a report prompt for a predefined report, the report might not work as intended.

Custom Reports

When the predefined reports do not retrieve the desired data, custom reports can be created either by copying and modifying predefined reports or by creating new reports. When modifying the properties of a predefined report, you can no longer use the original report as designed. If you reinstall predefined reports, from an import or as part of a product upgrade, you lose your changes. To keep the original report intact, always make a copy of the predefined report, rename it, and then modify the new report to better meet your needs. To create a new report, you must specify an SQL statement that determines which records are returned when the report is run. For more information, see How to Create a Report.

Supplemental Reports

Reports created outside of Configuration Manager can be copied to a designated folder on a reporting point to extend the reporting capabilities of the site. These reports will primarily be Active Server Pages (ASP) pages. However, it can be any file that can display by using Internet Explorer 5.0 or later. Because supplemental reports are not secured Configuration Manager objects, any user can view them unless you secure them by using Microsoft Internet Information Services (IIS) security. For more information, see About Supplemental Reports.

Report Categories

There are many report categories that help to organize reports. Reports can be configured for only one report category. New categories can be created by specifying a unique category when creating or modifying reports. Report categories are case sensitive. When creating a new report and an existing report category is specified it is recommended that the category be selected from the drop-down list. A new category is created when a name is entered in the Category text box that is not identical to an existing category. For a list of the predefined report categories, see Configuration Manager Report Categories.

Creating and Modifying Reports

Creating a new report or modifying a predefined report requires a working knowledge of SQL. When you create a new report, you must specify a category. You can choose an existing category or create a new category. When you create a new category, it is added to the category list. Within a given category, report names must be unique. However, you can use duplicate report names in different categories. Configuration Manager assigns each new report a report ID number, which uniquely identifies the report. The category determines which tree branch the report appears in on the main page of Report Viewer.

You can configure a report to refresh its results automatically at a specified interval. This functionality is especially useful for reports that you include in a dashboard or otherwise use to monitor information that changes frequently. You can also configure a report to display its data as a chart. This functionality is useful for reports that return counts, such as a report that provides a count of computers by network protocol. You can specify a chart title, a title and report column to use for the category (x) axis data, and a title and report column to use for the value (y) axis data. For the value (y) axis data, you should select a column that contains integer data. If you select a column that contains string data, some of the data might be truncated on the chart. You can also specify a default chart type, such as a bar chart. A report user can choose to display the data with a different chart type after the report runs. If a report returns multiple result sets, Report Viewer displays only the first result set as a chart.

To display report data as a chart by using Report Viewer, you must have a licensed copy of Microsoft Office XP Web Components, Microsoft Office 2000 Web Components, or Microsoft Office 2003 Web Components installed on the reporting point site system. The Office Web Components are automatically installed with all Office XP editions, and Office 2000 and Office 2003 Professional, Premium, Developer, and Standard editions. They are not installed with Office 2000, Office 2003 Small Business, or the stand-alone version of Microsoft Office Excel 2000. You must also have a licensed copy of at least one Microsoft Office application installed on the reporting point site system.

Note
Office Web Components is not supported on 64 bit operating systems. If you want to use graphs in reports, use 32 bit operating systems for your reporting points.

Report SQL Statement

The principal element of a report is a Structured Query Language (SQL) statement that defines which data the report gathers and returns as the result set. A result set is a tabular arrangement of the data in columns and rows. A report can also return multiple result sets. The SQL statement in a report does not run directly against the Configuration Manager site database tables. Instead, the SQL statement runs against a set of Microsoft SQL Server views, which point to records in the Configuration Manager site database tables. Each time that you run a report, the information returned consists of data that is current in the database at the time that you run the report. To create new reports by using the Configuration Manager console, you must have a working knowledge of SQL. However, no knowledge of SQL is required to import new reports.

Report Prompts

A report prompt is a report property that you can configure to request a parameter value from the user before running the report. When you include a prompt, the user is prompted to enter a parameter value prior to running the report. You can include more than one prompt in a report; however, each prompt must have a unique name. For more information, see About Report Prompts.

Running Reports

Reports in Configuration Manager 2007 are opened in Report Viewer, which can be opened from the Configuration Manager console or by using a Web browser and entering the unique URL for the report.

You can also use a report's URL to schedule the report to run automatically at a specified time. This functionality can be helpful for reports that can take a long time to run, such as a report that returns a large amount of data. You can schedule such reports to run at a time when your network is less busy. For more information, see How to Schedule Reports and Dashboards. The amount of time that is required to run a report depends on the amount of data that is returned by the report. With large reports, you might experience timeouts. If this happens, the timeout settings can be adjusted. For more information, see the "Adjusting Timeout Settings" section of About Report Viewer.

If a report does not have prompts, Report Viewer starts directly at the Report Results page for the selected report when it runs. For performance reasons, Report Viewer limits the result set that is returned by a report query to 10,000 rows, which can be modified. For more information, see How to Configure the Maximum Rows Returned by a Report Query.

For reports that are likely to return large amounts of data, such as status message reports or client installation reports, it is recommended that you create prompts or linked reports to limit the amount of data that is returned by any one report. By using prompts, you can limit a report to returning status messages only for a particular time period or to returning information about only clients in a specific site. For more information, see About Report Prompts and About Report Links.

Report Viewer cannot display different languages on a single reporting page. You can create individual reports that contain data in only one language. If double-byte character set (DBCS) information is not displayed correctly, you should configure Internet Explorer encoding to Auto-Select. Right-click anywhere in Report Viewer, point to Encoding, and then click Auto-Select. This overrides other encoding selections. Reports that are opened within the Configuration Manager console use the default encoding setting and cannot be modified from the console.

Using Report Data

When you run a report, there are several ways that you can use the report data in another application or offline. You can use the menu bar commands on the Report Results page to perform the following tasks:

  • Print the report data.
  • Copy the report data to the Clipboard.
  • Display the report data as a chart (for reports configured to do so).
  • Export the report data as a comma-delimited file. (Exporting report data is different from exporting report definitions.)
  • Add the report URL to your list of favorites.
  • Send the URL for the report by using e-mail. (The recipient must have Read permission for the report and be a member of the SMS Reporting Users group to run the report.)

A report can return multiple result sets (for example, when you include more than one SELECT clause or a COMPUTE clause in an SQL statement). If a report is configured to display as a chart and the report returns more than one result set, Report Viewer displays only the first result set as a chart. If you print a report that returns multiple result sets, copy it to the Clipboard, or export it to a comma-delimited file, all result sets are included.

You can sort the data within a result set by clicking a column heading. If the report has multiple result sets, you can sort the data in each result set independently. You can sort only by using one column at a time.

If a report has links to a target, link icons appear to the left of each row of data when you run the report in Report Viewer. When you click a link icon, the target opens in the same window. If a report has links to a target and returns multiple result sets, the same target is used for all result sets. For more information, see About Report Links.

Exporting and Importing Reports

Reports in Configuration Manager 2007 can be exported by using the Export Object Wizard, which creates a Managed Object Format (MOF) file that can then be imported at another site. This can be useful when importing reports that have been downloaded from the Internet or created by someone else in the organization. For more information about exporting and importing reports, see About Exporting and Importing Reports.

Scheduling Reports

Report Viewer generates a unique URL for each report and dashboard that you run. The URL contains the report ID and the variable names that you used to run the report. You can use the URL to schedule a report or dashboard to run (or to run and export the data to a file) at a specified interval by configuring the Scheduled Tasks feature of your operating system to start Internet Explorer with a URL. For more information, see How to Schedule Reports and Dashboards.

Deleting Reports

When a report is deleted in Configuration Manager 2007, the report object is removed from the site database, resulting in the following changes to the report's status:

  • It no longer appears in the report list in the Configuration Manager console or Report Viewer.
  • It no longer appears in dashboards in which it was included.
  • It is no longer available to source reports that use the deleted report as the target for a link. The report link in the source report no longer works when the target report is deleted, and the link should be removed or reconfigured.

For the steps to delete a report, see How to Delete a Report.

See Also

Tasks

How to Configure the Maximum Rows Returned by a Report Query
How to Create a Report
How to Delete a Report
How to Schedule Reports and Dashboards

Concepts

About Exporting and Importing Reports
About Report Links
About Report Prompts
About Report Viewer
About Reporting Points
About Supplemental Reports


About Report Prompts

A prompt in Configuration Manager 2007 is a report property that can be configured when a report is created or modified. Prompts are created to limit or target the data that a report retrieves. A report can contain more than one prompt as long as the prompt names are unique and contain only alphanumeric characters that conform to the SQL rules for identifiers.

When you are running a report, the prompt will request a value for a required parameter and, based on the value, retrieve the report data. For example, the Computer information for a specific computer report retrieves the computer information for a specific computer and prompts the user for a computer name. Report Viewer then passes the specified value to a variable that is defined in the SQL statement for the report. Provided that the SQL statement is properly configured, the report returns computer information data for only the specified computer.

Prompt Properties

A default value for the prompt can be configured so that when the prompt displays it is populated with the default value. The prompt can also be configured to display a list of appropriate values from which the user can choose by using a SQL statement, which is separate from the report's primary SQL statement. For example, if a report prompts the user for a computer name and you want users to be able to select from a list rather than typing in a computer name from memory, a SQL statement can be configured. When the user clicks Values in the Prompt dialog box, a list displays the items returned from the SQL statement that the user can choose from. To allow the use of the percent (%) symbol wildcard to limit the values returned, the @_filterwildcard variable must be used in the SQL statement.

Prompt SQL Statement Example

The following is an example of a SQL statement for a prompt that supports the use of the % wildcard character and returns a list of computer names that are either filtered or unfiltered, depending on the prompt value that is entered:

Copy Code
begin
 if (@__filterwildcard = '')
  SELECT DISTINCT SYS.Netbios_Name0 from v_R_System SYS ORDER By SYS.Netbios_Name0
 else
  SELECT DISTINCT SYS.Netbios_Name0 from v_R_System SYS
  WHERE SYS.Netbios_Name0 like @__filterwildcard
  ORDER By SYS.Netbios_Name0
end

The SQL statement provides two main sections. When the user clicks Values without typing anything into the text box, the if (@__filterwildcard = '') statement is true and all computer names are returned. Otherwise, the computer that matches the prompt value is retrieved, or when a wildcard is specified, the computers that contain the text from the prompt value are retrieved and populate the values list.

Using Wildcards for Prompt Values

Wildcards can be used to reduce the number of values that are displayed when you click Values in the Prompt dialog box. Use the percent (%) symbol to substitute for any number of characters, the underscore (_) symbol to substitute for a single character, and the bracket ([ ]) symbols to search for literals. Although wildcards help reduce the number of values that are displayed when you click Values, you cannot use wildcards to reduce the number of results that are returned when you actually run a report by clicking Display. If you enter a wildcard and then click Display, the report searches for the wildcard as a literal value. For example, if you enter %m% when prompted for a computer name and then click Display, the report searches for computers that have the literal name %m%.

Maximum Rows Returned for Prompt Values

The number of values that might be returned when you click Values can be very large and is limited by default to 1,000. For information about how you can change the default, see How to Configure the Maximum Rows Returned in the Values List.

See Also

Tasks

How to Configure the Maximum Rows Returned in the Values List
How to Create a Report
How to Create or Modify Report Prompts


About Report Links

Report links in Configuration Manager 2007 are used in a source report to provide users with ready access to additional data, such as more detailed information about each of the items in the source report. For example, you might link a report that lists all site codes to another report that lists all recent error messages for a given site code. The source report passes a specific site code to the target report based on which line item in the source report the user chooses to obtain more information for. A report can be configured with only one link, and that link can connect only to a single target resource.

Link Types

Source reports can use any one of the link types described in this section.

Link to Another Report

The Link to another report link type provides a link to a predefined or custom report. Links to supplemental reports are described later in this list. If the target report requires one or more prompts to run, the source report must contain a column with the appropriate values for each prompt. The column number that will provide the value for the prompt must be specified. For example, you might link a report that lists computers that were discovered recently to a report that lists the last messages that were received for a specific computer. When the link is created, you might specify that column 2 in the source report contains computer names, which is a required prompt for the target report. When the source report is run, link icons appear to the left of each row of data. When you click the icon on a row, Report Viewer passes the value in the specified column for that row as the prompt value that is needed to display the target report. For more information about report prompts, see About Report Prompts.

Link to Computer Details

The Link to Computer Details link type provides a link to the Computer Details page, which is a specialized page of Report Viewer. When a source report links to the Computer Details page, that report must contain a computer name value in one of its columns. The column is specified when the link to Computer Details is configured. When the source report runs, link icons appear to the left of each row of data. When you click the icon on a row, the Computer Details page opens and displays computer information about the specific computer. For more information about the Computer Details page of Report Viewer, see About the Computer Details Page.

Link to Status Message Details

The Link to Status Message Details link type provides a link to the Status Message Details page, which is a specialized page of Report Viewer. This page can be accessed only from a report that contains status messages. You can use the Status Message Details page to display information about a specific status message, based on the RecordID property for the message. The source report must contain a column with RecordID values. When you create the link, the column that contains the appropriate RecordID must be specified. When the source report runs, link icons appear to the left of each row of data. When you click an icon on a row, the Status Message Details page opens and displays information about the specific status message. For more information about the Status Message Details page of Report Viewer, see About the Status Message Details Page.

Link to URL

The Link to URL link type provides a link to a supplemental report or to any file that is supported by HTTP. To create the link, you specify the URL of the target, which can be either an absolute or a relative URL. You can also configure a URL link to pass column information from the source report as a parameter to the target report. To do this, you specify column values in the URL, as in the following example:

Copy Code
CustomReport.asp?MachineName=<3>&Network=<5>

In the URL example, <3> is replaced with the value from column 3 and <5> is replaced with the value from column 5 in the source report. You must configure the target page to accept the data that Report Viewer passes to it. Report Viewer performs no syntax checking. The URL that is specified in the report properties can be a maximum of 1,024 characters. When a report user clicks the link and the source report data is inserted into the URL, the target URL can be up to 2,048 characters.

Changing Linked Reports

When report links are configured, dependencies are created between the source report and its target. This is especially true when a link is created that specifies the source report column that contains the data needed by the target (for example, a source report that links to a target report that contains one or more prompts, links to the Computer Details page, or links to the Status Message Details page).

When these types of links are in a source report and columns are deleted or the order of the columns is modified in the source report, the link properties might need to be modified for the link to continue to function. For example, suppose that a source report has the Link to Status Message Details link and uses column 2 for the RecordID. If the SQL statement is modified in the source report so that the RecordID is now in column 3, the wrong information is used for the variable and the link no longer works. To prevent this, any time the order of columns is modified in a source report, the link properties should also be modified to reflect the changes.

Links can also break by adding, deleting, or changing a prompt in a target report. To prevent this, when prompts are modified in a target report, the link properties should also be modified in any reports that have links to the target report to reflect the changes.

Hyperlinks Based on Report Value Data

In addition to report links, which you can configure when creating a report, hyperlinks can also appear in a report when it is run. These hyperlinks appear only when report values with a specific format are displayed in the report. When retrieved data starts with http://, ftp://, file://, or \\, Report Viewer converts the entire text string into a hyperlink. This provides another way to redirect users to additional information.

See Also

Concepts

About Configuration Manager Reports


About Exporting and Importing Reports

Reports in Configuration Manager 2007 can be exported by using the Export Object Wizard, which creates a Managed Object Format (MOF) file that can then be imported at another site. This can be useful when importing reports that have been downloaded from the Internet or created by someone else in the organization. To export a report, you must have Read permission for the Reports security object class or instance. To import a report, you must have Create permission for the Reports security object class or instance.

Exporting Reports

Use the Export Object Wizard to export one or more report objects. When you export report objects, Configuration Manager writes the object definitions to a MOF file. Only the definitions for the report object are exported, not any report data. For example, if you export a report that contains links to the Status Message page, you export only the status message IDs and not the actual data that is contained in the individual status messages.

You can use the Export Object Wizard to export objects from only one object class (reports, collections, or queries) at a time. MOF files that are created by using the Export Object Wizard contain only one object class. For more information, see How to Export a Report.

When you export reports that have links, links to URLs are maintained; however, links to other targets are not maintained. For example, if you export a report that links to another report, that link is not maintained and it must be manually reconfigured after the report object is imported.

The report ID is unique for each report. When you export a report, the report ID is not written to the MOF file. This prevents you from accidentally replacing an existing report by importing a MOF file in which a report ID for an imported report matches that of an existing report. When you import reports, Configuration Manager 2007 assigns each imported report a new report ID.

More than one report can have the same name, as long as each report is in a different report category. When you export reports, the report categories are written to the MOF file; however, the report categories do not appear in the Export Object Wizard. The unique report ID for each report does appear in the Export Object Wizard. To ensure that you are exporting the reports that you want, verify that the report ID of each report in the Export Object Wizard matches the report ID of each report as it appears in the results pane of the Configuration Manager console.

Importing Reports

Use the Import Object Wizard to import the report objects contained in a MOF file. A MOF file is a text file that you can use to import report object instances into your Configuration Manager database. You can also use MOF files to import report object instances into another database. You can also use the Import Object Wizard to import user-created MOF files that contain objects from multiple object classes. The MOF file must be in Unicode format or Import Object Wizard will fail to import the MOF file. All MOF files that are exported by the Export Object Wizard are in Unicode file format.

You must have Create permission for all object classes in a MOF file. Any objects for which you do not have permission are not imported. For example, if you import a MOF file that contains report and collection objects but you have Create permission only for the Reports object class, the collection objects are not imported. When you import and run a report that was created at another Configuration Manager site, the report runs against your site database, not the original site database.

When you are importing reports, the properties of the existing report are overwritten without warning if you import a report with the same name and category as a report already in the database. To avoid this, open the MOF file by using a text editor, such as Notepad, and review the object names against the names of existing objects in the Configuration Manager site database before importing the file.

See Also

Tasks

How to Export a Report
How to Import a Report

Concepts

About Configuration Manager Reports


About Configuration Manager Dashboards

Dashboards in Configuration Manager 2007 provide the ability to display multiple reports in a grid within a single Report Viewer page. Dashboards can be used with the reports included with Configuration Manager and any custom reports you have created, provided the reports do not use prompts. Dashboards are commonly used by administrators for the following tasks:

  • Retrieving information about a variety of topics.
  • Comparing the results for related reports.
  • Grouping the most commonly used reports on a single page.
  • Grouping reports that show related types of information about the hardware or software of managed computers.
  • Grouping reports that provide data for an end-to-end process, such as the scan state, deployment evaluation state, and deployment installation state for software updates.

Using Dashboards

Like reports, dashboards are managed in the Configuration Manager console, but they are viewed using Report Viewer. Configuration Manager dashboards can be viewed from any computer with access to a reporting point. Dashboards are not subject to Configuration Manager object security; however, users must have Read security rights to the reports that are displayed in a dashboard. When dashboards run, the following actions can be taken:

  • Print the dashboard results.
  • Add the dashboard to the list of favorites.
  • Open the individual reports in a separate window.
  • Open a target for an individual report in a separate window.

Each report displayed in a dashboard has a link icon on the left side of the title bar. To display the individual report in a separate window of Report Viewer, click the icon. If a dashboard displays a report that has links, you can also click the link icons in that report to display the target in a separate window of Report Viewer. For more information, see About Report Links. You can configure individual reports to refresh automatically at a regular interval. This feature can be especially helpful for reports that you include in a dashboard.

See Also

Tasks

How to Add Reports to a Dashboard
How to Create a Dashboard
How to Modify Dashboard Properties

Concepts

About Configuration Manager Reports
About Report Links
Reporting Overview

Other Resources

How to Manage Dashboards


About Supplemental Reports

Supplemental reports in Configuration Manager 2007 are reports that are created outside of Configuration Manager and added to the Supplemental folder on a reporting point. If there are multiple reporting points, the supplemental report must be copied to the folder on each of the reporting points from which users need access to the report. Supplemental reports do not appear in the Configuration Manager console; they appear only in Report Viewer. However, the Supplemental Reports item does not appear in the Report Viewer tree until you install at least one supplemental report file on the reporting point.

Supplemental reports can be Active Server Pages (ASP) files or any other file that can be displayed by using Internet Explorer 5.0 or later, such as HTML files, Microsoft Office files, or text files. Supplemental reports can be run directly from Report Viewer or from a link configured in a report, using the URL for the supplemental report as the target. For more information, see About Report Links.

Supplemental reports are not Configuration Manager database objects and therefore are not backed up routinely by the Configuration Manager backup service. These files must be backed up manually. If a reporting point is disabled, Configuration Manager automatically copies any supplemental reports to the root drive on the reporting point site system computer. If the reporting point is re-created on the computer, Configuration Manager automatically moves the supplemental reports from the folder to the designated supplemental reports folder on the reporting point.

See Also

Tasks

How to Find Supplemental Reports on Disabled Reporting Points
How to Install a Supplemental Report

Concepts

About Configuration Manager Reports
About Report Links
About Report Viewer


Prerequisites for Reporting

The reporting point site system computer in Configuration Manager 2007 requires the following components for reports and dashboards to run and display correctly:

  • The site system must have Internet Information Services (IIS) installed and enabled.
  • Active Server Pages must be installed and enabled.
    Note
    When you install ASP.NET on a Windows Server 2008 operating system reporting point, you must also manually enable Windows Authentication. For more information, see How to Configure Windows Server 2008 for Site Systems.

  • Microsoft Internet Explorer 5.01 SP2 or later must be installed on any server or client that uses Report Viewer.
  • To use graphs in reports, Office Web Components (Microsoft Office 2000 SP2, Microsoft Office XP, or Microsoft Office 2003) must be installed.
    Note
    Office Web Components is not supported on 64 bit operating systems. If you want to use graphs in reports, use 32 bit operating systems for your reporting points.

See Also

Concepts

Configuring Reporting
Reporting Configuration Checklist
Reporting Overview


Configuring Reporting

Before Configuration Manager 2007 reporting objects can be displayed in Report Viewer, the reporting point must be installed and configured, and the configuration settings for other reporting components should be considered. This section provides installation and configuration procedures for reporting components.

Click the related link for detailed information about the associated reporting configuration task.

In This Section

Reporting Configuration Checklist

Specifies the configuration checklist for reporting.

How to Configure Report Options for a Site

Specifies how to configure the report options for a site.

How to Modify the Number of Reporting Points in Report Options

Specifies how to modify the number of reporting points that are displayed in the drop-down list in the Report Options dialog box.

How to Create a Reporting Point

Specifies how to create a reporting point.

How to Display the Properties for a Reporting Point

Specifies how to display the properties for a reporting point.

How to Configure the Maximum Rows Returned by a Report Query

Specifies how to configure the maximum rows returned by the SQL query for the report and displayed in Report Viewer.

How to Configure the Maximum Rows Returned in the Values List

Specifies how to configure the maximum values that are returned by the SQL query for a report prompt.

How to Configure the ASP Script Timeout Setting

Specifies how to configure the ASP script timeout setting for the reporting point.

How to Configure Connection and Command Timeout Settings

Specifies how to configure the connection and command timeout settings for Internet Information Services on the reporting point.

See Also

Concepts

Reporting Overview

Other Resources

Reporting Tasks


Reporting Configuration Checklist

The following checklist for Configuration Manager 2007 reporting provides information about the reporting requirements, planning and security, the steps necessary to configure the components required by reporting, managing reports and dashboards, and troubleshooting common issues.

Step | Reference
Review the Configuration Manager 2007 reporting concepts and prerequisites. | Reporting in Configuration Manager Prerequisites for Reporting
Review the security and privacy best practices information about reporting. | Reporting Security Best Practices
Create the reporting point site system role on one or more computers. | How to Create a Reporting Point
Manage the Configuration Manager reports, which includes running a report, creating new reports, modifying SQL statements that are used in a report, and so on. | How to Run a Report How to Create a Report How to Modify Report Properties
Manage the Configuration Manager dashboards, which includes running a dashboard, creating new dashboards, adding reports to dashboards, and modifying the properties for a dashboard. | How to Create a Dashboard How to Run a Dashboard How to Add Reports to a Dashboard How to Modify Dashboard Properties
Troubleshoot reporting issues. | Troubleshooting Reporting

See Also

Other Resources

Technical Reference for Reporting


How to Configure Report Options for a Site

The reporting options for a Configuration Manager 2007 site provide the ability to select the default reporting point used and whether a new browser window opens when running reports and dashboards from the Configuration Manager console.

Note
In R2, you also have the option to select the default server when running Reporting Services reports.

Use the following procedure to configure the report options for a site.

To configure report options for a site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database.

  2. Right-click < Site Database >, and then click Report Options.

  3. Specify from the drop-down list the default report point that will be used when opening reports and dashboards from the Configuration Manager console. If there are no reporting points available in the list, you must exit the dialog box and then create a reporting point. For more information, see How to Create a Reporting Point. By default, the maximum number of reporting points displayed in the drop-down list is five. For more information about modifying the number of reporting points displayed, see How to Modify the Number of Reporting Points in Report Options.

  4. Specify whether reports and dashboards that run from the Configuration Manager console open in a new browser window or if they open within the console.

See Also

Tasks

How to Create a Reporting Point
How to Modify the Number of Reporting Points in Report Options
How to Run a Report


How to Modify the Number of Reporting Points in Report Options

The Report Options dialog box provides a drop-down list of the available reporting points. By default, a maximum of five reporting points appear in the drop-down list. Use the following procedure to modify the number of reporting points that appear in the drop-down list.

To modify the maximum number of reporting points in the drop-down list

  1. Open the Registry Editor on the computer on which the Configuration Manager console is installed.

  2. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\Admin UI. Create the SMS, Admin UI, and Reporting keys if they are not present.

    Create a DWORD value named MenuCount under the Reporting key, and then enter the value for the desired maximum number of reporting points that will appear in the drop-down list.

See Also

Tasks

How to Configure Report Options for a Site

Concepts

About Configuration Manager Reports
Configuring Reporting


How to Create a Reporting Point

A reporting point in Configuration Manager 2007 is a site server role that hosts files used by Configuration Manager to display database information in Report Viewer. Use the following procedure to create a reporting point on a site system computer.

To create a reporting point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Determine whether to create a new site system or modify an existing site system, and then follow the associated step.

    To create a new site system and add the reporting point role:

    • Right-click Site Systems, click New, and then click Server.

    To add the reporting point role to an existing site system:

    • Right-click the site system name, and then click New Roles.

  3. Configure the general site system settings, and then click Next.

  4. Select Reporting point, and then click Next.

  5. Specify the Report folder for the reporting point. Configuration Manager creates a folder with the specified name under \Inetpub\wwwroot. The default folder name is SMSReporting_sitecode.

  6. Specify whether the Configuration Manager console opens the Report Viewer Web page using hypertext transfer protocol (http) or secure hypertext transfer protocol (https), and what port number is used. The default port for http is 80, and the default port for https is 443.

  7. Click Next, and then click Close to exit the wizard.

See Also

Tasks

How to Display the Properties for a Reporting Point

Reference

ConfigMgr Reporting Point Properties: General Tab

Concepts

About Configuration Manager Reports
About Reporting Points
Reporting Configuration Checklist


How to Display the Properties for a Reporting Point

A reporting point in Configuration Manager 2007 is a site server role that hosts files used by Configuration Manager to display database information in Report Viewer. Use the following procedure to display the properties for a reporting point.

To modify the properties for a reporting point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site system name>.

  2. Right-click ConfigMgr reporting point, and then click Properties.

  3. The following properties are displayed:

    • Report folder: Specifies the folder on the site system for the reporting point. Configuration Manager creates a folder with the specified name under \Inetpub\wwwroot. The default folder name is SMSReporting_sitecode.
    • Transfer Protocol: Specifies whether the Configuration Manager console opens the Report Viewer Web page using hypertext transfer protocol (http) or secure hypertext transfer protocol (https), and what port number is used. The default port for http is 80, and the default port for https is 443.

  4. Click OK to exit the dialog box.

See Also

Reference

ConfigMgr Reporting Point Properties: General Tab

Concepts

About Configuration Manager Reports
About Reporting Points
Reporting Configuration Checklist


How to Configure the Maximum Rows Returned by a Report Query

Report Viewer in Configuration Manager 2007 limits the result set returned by a report query to 10,000 rows. The maximum number of rows that are returned when running a report query can be modified by creating a registry key and setting a value on site system computers that have the reporting point role.

Note
Increasing the maximum number of rows for queries that return a large amount of data or queries that are inefficiently written might cause performance issues when the report is run.

Use the following procedure to configure the maximum number of rows returned by a report query.

To change the number of rows returned by a report query

  1. Open the Registry Editor on the reporting point computer.

  2. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\Reporting.

  3. Create a DWORD value named Rowcount, and then set its value to the number of rows that you want returned in the report query. If you want to return all rows, set the value to 0xffffffff, which is the hexadecimal equivalent of –1.

    The configured number of rows is returned by any report query that is run from this reporting point.

    Note
    If you set Rowcount to a number that is not valid (such as 0 or a number less than –1), Report Viewer returns the default maximum of 10,000 rows.

See Also

Concepts

About Report Viewer


How to Configure the Maximum Rows Returned in the Values List

Report Viewer in Configuration Manager 2007 limits the number of rows returned to 1,000 rows when you click Values and the values list displays for a prompt. The maximum number of rows returned by the query for the prompt that populates the values list can be modified by creating a registry key and setting a value on site system computers that have the reporting point role.

Note
Increasing the maximum number of rows for queries that return a large amount of data or queries that are inefficiently written might cause performance issues when the values are displayed.

Use the following procedure to configure the maximum number of rows returned in the values list.

To configure the number of rows returned in a values list

  1. Open the Registry Editor on the reporting point computer.

  2. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\Reporting.

  3. Create a DWORD value named Values Rowcount, and then set its value to the number of rows that you want returned in the report query. If you want to return all rows, set the value to 0xffffffff, which is the hexadecimal equivalent of –1.

    The configured number of rows is returned by any prompt query that is run from this reporting point.

See Also

Tasks

How to Create or Modify Report Prompts

Concepts

About Report Prompts
About Report Viewer


How to Configure the ASP Script Timeout Setting

Topic Last Updated—August 2008

When a report runs in Configuration Manager 2007, Report Viewer uses Active Server Pages (ASP) scripts that are stored on a reporting point computer. The Internet Information Services (IIS) default setting for the ASP script timeout is 90 seconds. This amount of time should be sufficient for running reports in most environments. However, in certain situations some reports might time out before finishing. Use the following procedure to configure the ASP script time-out setting.

To configure the ASP script timeout setting in IIS 6.0

  1. On the reporting point computer, open Internet Information Services (IIS) Manager.

  2. Navigate to Internet Information Services \ <server name> \ Web Sites \ Default Web Site.

  3. Right-click SMSReporting_<site name>, and then click Properties.

  4. Click the Virtual Directory tab, and then click Configuration in the Application settings section.

  5. Click the Options tab, and then configure ASP script timeout.

  6. Click OK to save the changes, and then click OK to exit the dialog box.

To configure the ASP script timeout setting in IIS 7.0

  1. On the reporting point computer, open Internet Information Services (IIS) Manager.

  2. Navigate to <server name> \ Sites \ Default Web Site.

  3. Click SMSReporting_<site name>, and then double-click ASP in Features View.

  4. Expand Limits Properties, configure the Script Time-out setting, press Enter, and then click Apply in the Actions pane.

See Also

Tasks

How to Configure Connection and Command Timeout Settings

Concepts

About Report Viewer


How to Configure Connection and Command Timeout Settings

In Configuration Manager 2007, when data for reports is retrieved from the Microsoft SQL Server views in the site database, the Active Server Pages (ASP) script calls an ActiveX control, and in the call, the script passes two timeout settings as parameters.

If there are timeouts when running reports, these timeout settings might need to be increased. The timeout settings are specified in the Global.asa file. If there are multiple reporting points, the Global.asa file must be modified on each of the reporting points on which there are timeouts.

Use the following procedure to configure the DBConnectionTimeout and DBCommandTimeout timeout settings.

To configure the DBConnectionTimeout and DBCommandTimeout timeout settings

  1. On the reporting point computer, navigate to <Installation drive>:\Inetpub\wwwroot\<Report folder name>.

  2. Open Global.asa in a text editor, such as Notepad.exe.

  3. Configure the following settings:

    • Session("DBConnectionTimeout"): This setting specifies the number of seconds within which the ActiveX control must connect to the Configuration Manager site database server. The default is 30 seconds.
    • Session("DBCommandTimeout"): This setting specifies the number of seconds within which the ActiveX control must receive data back from the Configuration Manager site database server. The default is 300 seconds.

See Also

Tasks

How to Configure the ASP Script Timeout Setting

Concepts

About Report Viewer


Reporting Tasks

There are many tasks associated with managing reporting components in Configuration Manager 2007. This section provides information about managing reports and dashboards, as well as how to open Report Viewer to display reporting types.

Click the related link for detailed information about the associated reporting task.

In This Section

How to Open Report Viewer

Specifies how to open Report Viewer to display the reporting types.

How to Manage Reports

Specifies the procedures that can be used to manage reports.

How to Manage Dashboards

Specifies the procedures that can be used to manage dashboards.

See Also

Concepts

Configuring Reporting
Reporting Overview


How to Open Report Viewer

Report Viewer in Configuration Manager 2007 can be opened from the Configuration Manager console or by using a Web browser. Report Viewer can be opened from any computer that has access to a reporting point and for users that have sufficient reporting security rights. Configuration Manager automatically creates the Reporting Users users group that can be used to manage which users have access to reports and dashboards. For more information, see Reporting Security Best Practices.

Use the following procedures to open Report Viewer from the Configuration Manager console and from a Web browser.

To open Report Viewer from the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the name of the desired report, and then click Run. The report will either open within the Configuration Manager console or a Web browser window will open and display the data. For information about configuring how reports and dashboards display when opened from the Configuration Manager Console, see How to Configure Report Options for a Site.

To open Report Viewer from a Web browser

  1. Open a Web browser, enter the URL for the reporting point, and then press Enter. The default URL for a reporting point is http://servername/SMSReporting_site code.

  2. All available reports, dashboards, and computer details are listed.

See Also

Tasks

How to Configure Report Options for a Site

Concepts

About Configuration Manager Reports
How to Manage Reports


How to Manage Reports

Reports in Configuration Manager 2007 are managed from the Configuration Manager console and viewed by using Report Viewer. Click the related link for detailed information about the associated report task.

In This Section

How to Run a Report

Specifies how to run a report.

How to Create a Report

Specifies how to create a new report.

How to Clone a Report

Specifies how to clone, or make a copy of, a report.

How to Copy Configuration Manager Reports to SQL Reporting Services

Specifies how to copy the existing Configuration Manager reports to the Reporting Services server.

Applies only to Configuration Manager 2007 R2.

How to Modify Report Properties

Specifies how to modify the properties for a report.

How to Create or Modify Report Prompts

Specifies how to create or modify report prompts.

How to Modify the Report SQL Statement

Specifies how to modify the SQL statement in a report.

How to Use Query Designer to Create or Modify Report Queries

Specifies how to use Query Designer to create or modify the SQL statement in a report.

How to View the SQL Statement in a Report

Specifies how to view the SQL statement in a report.

How to Add a Report to the Computer Details Page

Specifies how to configure a report so that it is added to the Computer Details page of Report Viewer.

How to View Computer Details Reports

Specifies how to view the Computer Details page of Report Viewer.

How to Install a Supplemental Report

Specifies how to install a supplemental report that can be viewed in Report Viewer.

How to Schedule Reports and Dashboards

Specifies how to schedule reports and dashboards so that they run at a specified time, and specifies how to configure whether reports export the result set to a text file.

How to Import a Report

Specifies how to import a report using the Import Object Wizard.

How to Export a Report

Specifies how to export reports by using the Export Object Wizard.

How to Delete a Report

Specifies how to delete a report.

See Also

Concepts

Configuring Reporting
Reporting Overview


How to Run a Report

Reports in Configuration Manager 2007 are opened in Report Viewer, which can be opened from the Configuration Manager console or by using a Web browser. Reports can be opened from any computer that has access to a reporting point for the site and for users that have sufficient rights to view the reports. For more information about the security rights needed to view reports, see Reporting Security Best Practices.

Use the following procedures to open a report from the Configuration Manager console and from a Web browser.

Procedure

To run a report from the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the name of the report that you want to run, and then click Run. The report will either open within the Configuration Manager console or be displayed in a Web browser window. For information about configuring how the report displays when opened from the Configuration Manager Console, see How to Configure Report Options for a Site.

To run a report from a Web browser

  1. Open a Web browser, enter the URL for the report, and then press Enter. The default URL for a report is http://reporting point name/SMSReporting_site code/Report.asp?ReportId=ReportID.

  2. Alternatively, you can go to Report Viewer, select the report from the list, and then click Display. The default URL for the reporting point is http://servername/SMSReporting_site code.

See Also

Tasks

How to Configure Report Options for a Site
How to Create a Report

Concepts

Reporting Security Best Practices


How to Create a Report

New reports in Configuration Manager 2007 can be created by specifying the report properties or by cloning an existing report where the properties from the source report are used to create the new report. Use the following procedure to create a new report by specifying the report properties.

Procedure

To create a new report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click Reports, point to New, and then click Report to open the Report Properties dialog box for the new report.

  3. Click the General tab, and then specify the following:

    • Name: Specifies the name of the report. The report name must be unique within the report category. This is a required setting.
    • Category: Specifies the category for the report. Categories are case sensitive and, unless a new category is being created for the report, it is recommended that the category be selected from the Category drop-down list. This is a required setting.
    • Comment: Specifies a description for the report. This is an optional field that helps to describe the purpose of the report. This is an optional setting.
    • SQL statement: Specifies the SQL statement used to retrieve the report data. Click Edit SQL Statement to create the SQL statement that will retrieve the desired data. For more information about creating SQL statements for reports, see SQL Query Statement Reference. This is a required setting.
    • Click Prompts to create a report prompt. For more information about creating report prompts, see How to Create or Modify Report Prompts.

  4. Click the Display tab to configure whether the data in the report is automatically updated and whether to provide a chart for the report.

  5. Click the Links tab, and then specify one of the following:

    • No Link: Specifies that a link is not configured.
    • Link to another report: Specifies that a link to another report is configured. Click Select to specify the target report from the Select Report dialog box. If the target report requires prompts, you must specify the column from the source report that will be used to provide the data for each prompt in the target report. To configure the column, double-click a prompt, type the column number in the Column text box, and then click OK.
    • Link to Computer Details: Specifies that a link to computer details is configured. The source report must contain a column that contains the computer name. In the Computer name column text box, specify the column that contains the computer name, and then click OK.
    • Link to Status Message Details: Specifies that a link to status message details is configured. The source report must contain a column that specifies a status message record ID. In the Record ID column text box, specify the column that contains the status record ID, and then click OK.
    • Link to URL: Specifies that a link to a URL resource is configured. Specify the URL in the URL text box, and then click OK.

  6. Click OK.

See Also

Tasks

How to Clone a Report
How to Create or Modify Report Prompts

Concepts

About Configuration Manager Reports
SQL Query Statement Reference

Other Resources

Report Name Properties


How to Clone a Report

Cloning a report in Configuration Manager 2007 is the easiest way to create a new report. The cloned report uses the SQL statement and other properties from the existing report, which can then be modified to retrieve the desired information. Use the following procedure to clone a predefined Configuration Manager report.

Procedure

To clone a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the report to be cloned, and then click Clone.

  3. Type the name of the new report in the New report name text box, and then click OK. The report name is required and must be unique.

  4. To modify the report properties, right-click the new report and then click Properties. For information about modifying the properties for a report, see How to Modify Report Properties.

See Also

Tasks

How to Create a Report
How to Modify Report Properties


How to Modify Report Properties

Reports in Configuration Manager 2007 retrieve data using a SQL statement. They can request information using a report prompt, link to another report or resource, and so on. The properties for a report are modified in the report properties dialog box. Use the following procedure to modify the properties for a report.

Procedure

To modify the general properties for a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the name of the report that you want to modify, and then click Properties.

  3. Click the General tab, and then modify any of the following general properties:

    • Name: Specifies the name of the report. The report name must be unique within the report category.
    • Category: Specifies the category for the report. Categories are case sensitive and, unless a new category is being created for the report, it is recommended that the category be selected from the Category drop-down list.
    • Display in Computer Details: Specifies whether the report will appear on the Computer Details page of Report Viewer. This setting is available only to reports that have one or no report prompts configured.
    • Comment: Specifies a description for the report. This is an optional field that helps to describe the purpose of the report.
    • SQL statement: Specifies the SQL statement used to retrieve the report data. Click Edit SQL Statement to modify the SQL statement.
    • Click Prompts to create or modify a report prompt. For more information about creating report prompts, see How to Create or Modify Report Prompts.

  4. Click the Display tab, and then modify any of the following display properties:

    • Refresh the report automatically: Specifies whether to automatically refresh the data in the report. When it is enabled, specify the Refresh interval (minutes) setting. The default setting is 5 minutes.
    • Provide a chart for the report: Specifies whether to provide an option to display the results for the report in a chart. When it is enabled, specify the following settings:
      Default chart type: Specifies the default chart type from the drop-down list box. The chart will open with the chart type specified in the drop-down list, but it can be changed to another type when viewing the chart.
      Chart title: Specifies the name for the chart. This is an optional setting.
      Category [X] axis column: Specifies the column number from the report that is used for the data that is presented along the horizontal axis (X axis) of the chart.
      Category [X] axis label: Specifies the label for the horizontal axis (X axis) of the chart.
      Category [Y] axis column: Specifies the column from the report that is used for the data that is presented, along the vertical axis (Y axis) of the chart.
      Category [Y] axis label: Specifies the label for the vertical axis (Y axis) of the chart.
    Note
    To display report data as a chart, you must have a licensed copy of Microsoft Office XP or Office 2000 Web Components installed on the reporting point site system. With Office XP, you also must have at least one Microsoft Office application installed on the reporting point site system.

  5. Click the Links tab, and then specify one of the following links properties:

    • No Link: Specifies that a link is not configured.
    • Link to another report: Specifies that a link to another report is configured. Click Select to specify the target report from the Select Report dialog box. If the target report requires prompts, you must specify the column from the source report that will be used to provide the data for each prompt in the target report. To configure the column, double-click a prompt, type the column number in the Column text box, and then click OK.
    • Link to Computer Details: Specifies that a link to computer details is configured. The source report must contain a column that contains the computer name. In the Computer name column text box, specify the column that contains the computer name and then click OK.
    • Link to Status Message Details: Specifies that a link to status message details is configured. The source report must contain a column that specifies a status message record ID. In the Record ID column text box, specify the column that contains the status record ID and then click OK.
    • Link to URL: Specifies that a link to a URL resource is configured. Specify the URL in the URL text box, and then click OK.

  6. Click OK.

See Also

Concepts

How to Modify the Report SQL Statement


How to Create or Modify Report Prompts

A prompt is a report property that can be configured when a report is created or modified. When running a report with a configured prompt, you must enter a value for the required parameter before the data can be retrieved for the report. Use the following procedures to configure a report prompt and then to integrate it into the SQL statement for the report.

Procedure

To configure a report prompt

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the report of your choice, and then click Properties.

  3. Click Edit SQL Statement, and then click Prompts.

  4. Click the New icon to define a new prompt, or right-click a prompt in the Prompts list and then click Properties to edit an existing prompt.

  5. Configure the following settings for the prompt:

    • Name: Specifies the name for the prompt. This is a required setting.
    • Prompt text: Specifies the prompt text that is displayed when the report runs. This is a required setting.
    • Default value: Specifies the default value that is automatically inserted into the prompt text box when a report runs. This is an optional setting.
    • Allow an empty value: Specifies whether the prompt value is required or if it is optional. By default, this setting is not enabled and the prompt value is required.
    • Provide a SQL statement: Specifies whether a list of possible values will be retrieved for the prompt based on a SQL statement. When it is enabled, click Edit SQL Statement to specify the SQL statement for the prompt. For more information about specifying the SQL statement for a prompt, see Prompt SQL Statement Dialog Box.

  6. Click OK, click OK, and then click OK again to save the prompt.

To integrate the report prompt into the SQL statement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the report of your choice, and then click Properties.

  3. Click Edit SQL Statement to open the Report SQL Statement dialog box.

    To integrate a prompt into the report, you must specify the prompt name as a variable in the SQL statement of the report by using the syntax @promptname. The following SQL statement example integrates a prompt named username into the SQL statement for the report. When the report runs, it requests the user name, and then it will return data from the v_R_System view where the User_Name0 field is equal to the value entered for the prompt.

    SELECT SyS User_Name0 AS 'User Name', SYS.Name0 AS 'Computer Name' FROM v_R_SYSTEM SYS

    WHERE User_Name0 LIKE @prompt2

  4. Click OK, and then click OK again to save the changes to the report.

See Also

Reference

Prompt Properties Dialog Box
Prompt SQL Statement Dialog Box
Prompts Dialog Box

Concepts

How to Modify the Report SQL Statement
SQL Query Statement Reference


How to Modify the Report SQL Statement

Reports in Configuration Manager 2007 can be based on simple SQL statements or very complex ones that prompt the user for information, join several Microsoft SQL Server views, and use filters to limit the results. Use the following procedure to modify the SQL statement that is used in a report.

Procedure

How to modify the SQL statement in a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the report of your choice, and then click Properties.

  3. Click Edit SQL Statement to open the Report SQL Statement dialog box. The SQL statement for the report is listed in the SQL Statement pane.

  4. The SQL statement must be typed into the SQL statement text box. However, you can add a new view or column value to the SQL statement as follows:

    Add a SQL view:

    1. Click the location within the SQL statement to insert the new view.
    2. Select a view from the View list, and then click Insert.

    Add a column value:

    1. Click the location within the SQL statement to insert the new column value.
    2. Select the view from the View list, select the column from the Columns list, and then click Values.
    3. Select the value from the Values list, and then click OK. You can filter the values that are listed by clicking Set, selecting Apply a filter, and specifying a value for the Filter criterion. For more information about setting a filter, see Set Filter Dialog Box.
    Note
    Adding a new view or column value does not insert additional keywords or punctuation, even when they are required to make the SQL statement valid. You can use Query Designer to design the report SQL statement in a graphical user interface. For more information about how to use Query Designer to modify queries, see How to Use Query Designer to Create or Modify Report Queries.

  5. To add a prompt to the SQL statement, click Prompts. For more information about adding prompts to a SQL statement, see How to Create or Modify Report Prompts.

  6. Click OK, and then click OK again.

See Also

Tasks

How to Create or Modify Report Prompts
How to Use Query Designer to Create or Modify Report Queries

Reference

Column Values Dialog Box
Prompt SQL Statement Dialog Box
Prompts Dialog Box
Report SQL Statement Dialog Box
Set Filter Dialog Box

Concepts

About Report Prompts
SQL Query Statement Reference


How to Use Query Designer to Create or Modify Report Queries

For some administrators, creating queries in Microsoft SQL Server Query Designer is easier than creating them in Configuration Manager 2007. Use the following procedures to create and modify Configuration Manager report queries using Query Designer.

To create a new query in Query Designer

  1. Start Microsoft SQL Server Management Studio.

  2. Navigate to Computer Name \ Databases \ Configuration Manager database name \ Views.

  3. Right-click one of the views for the query, and click Open View to display the results pane.

  4. Press CTRL+1 to open the diagram pane, press CTRL+2 to open the criteria pane, and then press CTRL+3 to open the SQL pane.

  5. Right-click in the diagram pane (top center pane), click Add Table to open the Add Table dialog box, and click Views. While holding the CTRL key, select the Configuration Manager views to add to the query; click Add; and then click Close.

  6. Design and test the SQL statement using Query Designer. For more information about using Query Designer, search for Query Designer in the SQL Server 2005 Books Online (http://go.microsoft.com/fwlink/?LinkId=60544)

  7. When the query retrieves the desired data, copy the SQL statement from Query Designer and paste the query into the Report SQL Statement dialog box in the Configuration Manager report.

To modify a Configuration Manager report query in Query Designer

  1. Start Microsoft SQL Server Management Studio.

  2. Navigate to Computer Name \ Databases \ Configuration Manager database name \ Views.

  3. Right-click any views, and click Open View to display the results pane.

  4. Press CTRL+1 to open the diagram pane, press CTRL+2 to open the criteria pane, and then press CTRL+3 to open the SQL pane.

  5. Copy the SQL statement from the Configuration Manager report, and then paste the SQL statement into the SQL pane replacing the existing SQL statement currently in the pane. For more information about how to copy the SQL statement from a Configuration Manager report, see How to View the SQL Statement in a Report.

  6. Design and test the SQL statement using Query Designer. For more information about using Query Designer, search for Query Designer in the SQL Server 2005 Books Online (http://go.microsoft.com/fwlink/?LinkId=60544).

  7. When the query retrieves the desired data, copy the SQL statement from Query Designer and paste the query into the Report SQL Statement dialog box in the Configuration Manager report.

See Also

Tasks

How to View the SQL Statement in a Report

Concepts

About Configuration Manager Reports
Using Query Designer to Create SQL Statements for Reports
SQL Query Statement Reference


How to View the SQL Statement in a Report

Reports in Configuration Manager 2007 can be based on simple SQL queries or very complex ones that prompt the user for information, join several Microsoft SQL Server views, and use filters to limit the results. Use the following procedure to find out what query is used in a Configuration Manager report.

Procedure

To view the query statement in a Configuration Manager report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the report of your choice, and then click Properties.

  3. Click Edit SQL Statement to open the Report SQL Statement dialog box. The SQL statement for the report is listed in the SQL Statement pane.

    Note
    To copy the SQL statement so that it can be modified in Query Designer, highlight the entire SQL statement and press Ctrl+c.

See Also

Tasks

How to Use Query Designer to Create or Modify Report Queries

Concepts

Using Query Designer to Create SQL Statements for Reports


How to Add a Report to the Computer Details Page

The Computer Details page of Report Viewer in Configuration Manager 2007 displays a set of reports that are configured to display on the page and provide information about a specific computer. Any reports that have one or no report prompts can be configured to appear on the Computer Details page. Use the following procedure to configure a report to display on the Computer Details page.

To configure a report to display on the Computer Details page

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the name of the report that you want to modify, and then click Properties.

  3. Click the General tab, and then select Display in Computer Details.

See Also

Tasks

How to Modify Report Properties

Concepts

About the Computer Details Page


How to View Computer Details Reports

The Computer Details page of Report Viewer in Configuration Manager 2007 displays a set of reports that are configured to display on the page and provide information about a specific computer. Use the following procedure to view the reports that have been configured to display on the Computer Details page of Report Viewer.

Procedure

To display computer details reports

  1. Open Report Viewer in Internet Explorer by entering the URL for a reporting point for the site. The default URL for a reporting point is http://servername/SMSReporting_site code.

  2. Click Computer Details to open the Computer Details page of Report Viewer. The reports are organized by report category and then alphabetically. There is no way to change the sort order on this page.

See Also

Concepts

About Report Viewer
About the Computer Details Page
How to Manage Reports


How to Install a Supplemental Report

Supplemental reports in Configuration Manager 2007 are reports that are created outside of Configuration Manager and added to the Supplemental folder on a reporting point. If there are multiple reporting points, the supplemental report must be copied to the folder on each of the reporting points from which users need access to the report. After the supplemental report is copied to the reporting point, you can run the reports directly from Report Viewer or link another report to the supplemental report by using the URL for the supplemental report as a link target. Use the following procedure to install a supplemental report.

To install a supplemental report file

  1. On a reporting point site server computer, navigate to <Installation drive>:\Inetpub\wwwroot\<Report folder name>\Supplemental.

  2. Copy the supplemental report file to the Supplemental folder.

See Also

Tasks

How to Open Report Viewer

Concepts

About Report Links
About Report Viewer
About Supplemental Reports


How to Schedule Reports and Dashboards

Report Viewer in Configuration Manager 2007 generates a unique URL for each report and dashboard that you run. The URL contains the report ID and the variable names that you used to run the report. You can use the URL to schedule a report or dashboard to run (or to run and export the data to a file) at a specified interval by configuring the Scheduled Tasks feature of the operating system to start Internet Explorer with a URL. Use the following procedure to schedule a dashboard or report to run and export the results to a file.

To schedule a dashboard or report with Scheduled Tasks

  1. Start the Scheduled Tasks tool, located in the Accessories\System Tools program group.

  2. Double-click Add Scheduled Task, and then click Next.

  3. or the Create Task Wizard from the Task Scheduler tool, depending on your operating system.

  4. In the Application list, click Internet Explorer, and then click Next.

  5. Enter a name for the task, select a time interval option, and then click Next.

  6. Select the time and day that you want the task to start, and then click Next.

  7. Enter a qualified user name and password, and then click Next.

  8. Select Open advanced properties for this task when I click Finish, and then click Finish.

  9. Choose one of the following commands depending on whether the report only displays or displays and exports the report data to a text file at a specified time:

    To run and display a report at a specified interval:

    In the Run text box, insert one space after the Internet Explorer command line, and then type the URL for the report or dashboard. For example, C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http:\\<server name>\SMSReporting_<site code>\Report.asp?ReportID=<reportID>, where server name is the NetBIOS name of Configuration Manager server on which the reporting point is installed.

    To run, display, and export a report to a comma-delimited text file at a specified interval:

    In the Run text box, insert one space after the Internet Explorer command line, type the URL for the report or dashboard, and then type one of the following parameters immediately after the URL:

    • &ExportTo=<Drive letter>:\<Path>\<Filename.txt>
      Drive letter specifies a hard drive on the reporting point computer, not on the local computer. For example, C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http:\\<server name>\SMSReporting_<site code>\Report.asp?ReportID=<reportID> &ExportTo=<Drive letter>:\<Path>\<Filename.txt>, where server name is the NetBIOS name of Configuration Manager server on which the reporting point is installed and share name is the name of a share that exists on that server.
    • &ExportTo=\\<Export server name>\<share name>
      Export Server name is the name of the computer where the exported text file is created. For example, C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http:\\<server name>\SMSReporting_<site code>\Report.asp?ReportID=<reportID> &ExportTo=\\<Export server name>\<share name>, where server name is the NetBIOS name of Configuration Manager server on which the reporting point is installed and share name is the name of a share that exists on that server.

To schedule a dashboard or report with Task Scheduler

  1. Start Task Scheduler, located in the Accessories\System Tools program group.

  2. Click Create Task, and then specify the general settings for the task.

  3. Click the Trigger tab, click New, and then specify the trigger settings for the task.

  4. Click the Actions tab, click New, specify Start a program for the Action, click Browse and browse to iexplore.exe. By Default, this file is located in %Program Files%\Internet Explorer.

  5. Choose one of the following commands depending on whether the report only displays or displays and exports the report data to a text file at a specified time:

    To run and display a report at a specified interval:

    In the Add arguments text box, type the URL for the report or dashboard. For example, http:\\<server name>\SMSReporting_<site code>\Report.asp?ReportID=<reportID>

    To run, display, and export a report to a comma-delimited text file at a specified interval:

    In the Add arguments text box, type the URL for the report or dashboard, and then type one of the following parameters immediately after the URL:

    • &ExportTo=<Drive letter>:\<Path>\<Filename.txt>
      Drive letter specifies a hard drive on the reporting point computer, not on the local computer. For example, http:\\<server name>\SMSReporting_<site code>\Report.asp?ReportID=<reportID>&ExportTo=<Drive letter>:\<Path>\<Filename.txt>
    • &ExportTo=\\<Export server name>\<share name>
      Export Server name is the name of the computer where the exported text file is created. For example, http:\\<server name>\SMSReporting_<site code>\Report.asp?ReportID=<reportID>&ExportTo=\\<Export server name>\<share name>.

See Also

Tasks

How to Create a Dashboard
How to Create a Report

Concepts

About Configuration Manager Dashboards
About Configuration Manager Reports
Reporting Overview


How to Import a Report

The Import Object Wizard in Configuration Manager 2007 is used to import reports that have been exported by using the Export Object Wizard. The user importing the report must have the Create security right for the Report class. Use the following procedure to import a report.

To import a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click Reports, and then click Import Objects.

  3. Click Next, and then specify the MOF path and file name. Click Browse to browse to the path and file location. Click Next.

    Caution
    If there are existing reports with the same name and configured for the same category, the existing report will be overwritten with the imported report.

  4. Review the reports listed in the Objects pane, and then click Next. You must have Create security rights for the Report class for the reports to be imported.

  5. Click Next and review the comment for the Managed Object Format (MOF) file, click Next to import the report objects, and then click Finish to exit the wizard.

See Also

Tasks

How to Export a Report

Concepts

About Configuration Manager Reports
About Exporting and Importing Reports
How to Manage Reports


How to Export a Report

The Export Object Wizard in Configuration Manager 2007 is used to export the selected reports available at the site. The user exporting the reports must have Read permissions to the Report class or instance for the report. Use the following procedure to export a report.

To export a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click Reports (to select multiple reports to export) or right-click an individual report, and then click Export Objects.

  3. Click Next, select the reports to export, and then click Next.

  4. Specify the MOF path and file name. Click Browse to browse to the path and file location.

    Caution
    When a Managed Object Format (MOF) file of the same name already exists in the specified folder, the existing MOF file is overwritten without warning.

  5. Specify a comment for the MOF file. Comments are displayed when importing the MOF file using the Import Object Wizard.

  6. Click Next to export the selected reports, and then click Finish to exit the wizard.

See Also

Tasks

How to Import a Report

Concepts

About Configuration Manager Reports
About Exporting and Importing Reports


How to Delete a Report

When a report is deleted in Configuration Manager 2007, the report object is removed from the site database, resulting in the following changes to the report's status:

  • It no longer appears in the report list in the Configuration Manager console or Report Viewer.
  • It no longer appears in dashboards in which it was included.
  • It is no longer available to source reports that use the deleted report as the target for a link. The report link in the source report no longer works when the target report is deleted, and the link should be removed or reconfigured.

Use the following procedure to delete a report.

Procedure

To delete a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click the report that you want to delete, and then click Delete.

  3. Click Yes to confirm that the report should be deleted. When other reports or dashboards specify this report as a link target or a dashboard report, they are listed in the Delete Report dialog box; deleting this report causes the report link for the other report to fail and the dashboard to no longer display the expected data.

See Also

Concepts

About Configuration Manager Reports
About Report Links
How to Manage Reports


How to Manage Dashboards

Dashboards in Configuration Manager 2007 provide the ability to display one or more reports on a single page. Click the related link for detailed information about the associated dashboard task.

In This Section

How to Run a Dashboard

Specifies how to run a dashboard.

How to Create a Dashboard

Specifies how to create a new dashboard.

How to Clone a Dashboard

Specifies how to create a dashboard by cloning another dashboard.

How to Modify Dashboard Properties

Specifies how to modify the properties for a dashboard.

How to Add Reports to a Dashboard

Specifies how to add reports to an existing dashboard.

How to Remove Reports from a Dashboard

Specifies how to remove reports from a dashboard.

How to Delete a Dashboard

Specifies how to delete a dashboard.

See Also

Concepts

About Configuration Manager Dashboards
Reporting Overview


How to Run a Dashboard

Dashboards in Configuration Manager 2007 are used to display one or more reports on a single page. Dashboards are opened in the Report Viewer, which can be opened from the Configuration Manager console or by using a Web browser. Dashboards can be opened from any computer that has access to a reporting point for the site and for users that have sufficient rights to view the reports in the dashboard. For more information about the security rights needed to view dashboards, see Reporting Security Best Practices.

Use the following procedures to open a report from the Configuration Manager console and from a Web browser.

Procedure

To run a dashboard from the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Dashboards.

  2. Right-click the name of the dashboard that you want to run, and then click Run. The dashboard will either open within the Configuration Manager console or be displayed in a Web browser window. For information about configuring how the dashboard displays when opened from the Configuration Manager Console, see How to Configure Report Options for a Site.

To run a dashboard from a Web browser

  1. Open a Web browser, enter the URL for the dashboard, and then press Enter. The default URL for a dashboard is a http://reporting point name/SMSReporting_site code/Dashboard.asp?DashboardId=DashboardID.

  2. Alternatively, you can go to Report Viewer, select the dashboard from the list, and then click Display. The default URL for the reporting point is http://servername/SMSReporting_site code.

See Also

Tasks

How to Configure Report Options for a Site
How to Create a Dashboard

Concepts

About Configuration Manager Dashboards
Reporting Security Best Practices


How to Create a Dashboard

Dashboards in Configuration Manager 2007 display multiple reports on a single page. You can create dashboards to monitor information about related hardware or software or to group the reports you use most frequently. New dashboards can be created by specifying the dashboard properties or by cloning an existing dashboard. Use the following procedure to create a new dashboard by specifying the dashboard properties.

Procedure

How to create a new dashboard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Dashboards.

  2. Right-click Dashboards, and then click New Dashboard to open the New Dashboard Wizard.

  3. Specify the following dashboard properties:

    • Name: Specifies the name for the dashboard. This setting is required.
    • Comment: Specifies the description for the dashboard. This setting is optional.
    • Limit cell height: Specifies whether to limit the height of the dashboard display. When this property is selected, type the maximum height, in pixels, in the Height text box. The default value is 250.

    Click Next.

  4. Specify the dimensions for the dashboard, and then click Set. By default, the dashboard is made of two rows and two columns.

  5. Select the row and column for the dashboard report, click the Select Report icon, select the report from the Select Report dialog box, and then click OK.

    Note
    The dialog box will display only the reports that do not contain a report prompt and reports for which the user has Read access.

    Repeat step 5 to add additional reports to the dashboard.

  6. Use the Move Up and Move Down icons to change the dashboard position for a highlighted report.

  7. Click Next, and then click Close.

See Also

Concepts

About Configuration Manager Dashboards

Other Resources

How to Manage Dashboards


How to Clone a Dashboard

Cloning a dashboard in Configuration Manager 2007 is the easiest way to create a new dashboard. The new dashboard copies the properties from the dashboard that is being cloned, and then the properties can be modified to meet your needs. Use the following procedure to clone an existing dashboard.

Procedure

To clone a dashboard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Dashboards.

  2. Right-click the dashboard to be cloned, and then click Clone.

  3. Type the name for the new dashboard in the New dashboard name text box, and then click OK. The dashboard name is required and must be unique.

  4. To modify the dashboard properties, right-click the new dashboard and then click Properties. For information about modifying the properties for a dashboard, see How to Modify Dashboard Properties.

See Also

Tasks

How to Create a Dashboard
How to Modify Dashboard Properties


How to Modify Dashboard Properties

Dashboards in Configuration Manager 2007 display one or more reports on a single page. Use the following procedure to modify the properties for a dashboard.

Procedure

To modify the properties for a dashboard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Dashboards.

  2. Right-click the name of the dashboard that you want to modify, and then click Properties.

  3. On the General tab, the following dashboard properties can be modified:

    • Name: Specifies the name for the dashboard. This setting is required.
    • Comment: Specifies the description for the dashboard. This setting is optional.
    • Limit cell height: Specifies whether to limit the height of the dashboard display. When selected, type the maximum height, in pixels, in the Height text box. The default value is 250.

  4. On the Reports tab, the following dashboard properties can be modified:

    • Dashboard dimensions: Specify the dimensions for the dashboard, and then click Set. By default, the dashboard is made of two rows and two columns.
    • Dashboard reports: Specify the reports for each position in the dashboard. Select the row and column for the dashboard report, click the Select Report icon, select the report from the Select Report dialog box, and then click OK.
      Note
      The dialog box will display only the reports that do not contain a report prompt and for which the user has Read access.

      Use the Move Up and Move Down icons to change the dashboard position for a highlighted report.

  5. Click OK to save the changes and exit the dialog box.

See Also

Tasks

How to Add Reports to a Dashboard

Concepts

About Configuration Manager Dashboards

Other Resources

Dashboard Name Properties


How to Add Reports to a Dashboard

Dashboards in Configuration Manager 2007 display multiple reports on a single page. Use the following procedure to add reports to a dashboard.

Procedure

To add reports to a dashboard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Dashboards.

  2. Right-click the name of the dashboard that you want to modify, and then click Properties.

  3. Click the Reports tab. All reports that are used in the dashboard are listed in the Dashboard reports area, along with the position (row and column) for each report.

  4. To add or remove columns or rows from the dashboard, specify the dimensions and then click Set.

    Note
    When the dimensions for a dashboard are reduced, the reports assigned to the rows or columns are removed from the dashboard temporarily, but they can be restored by increasing the dimensions to the original size. The reports are permanently removed when clicking OK or Apply.

  5. Double-click a dashboard position, select a report from the Select Report list, and then click OK to insert the selected report into the position.

    Note
    The dialog box will display only the reports that do not contain a report prompt and for which the user has Read access.

  6. Use the Move Up and Move Down icons to change the dashboard position for a report.

  7. Click OK to save the dashboard and exit the dialog box.

See Also

Tasks

How to Modify Dashboard Properties

Concepts

About Configuration Manager Dashboards
How to Remove Reports from a Dashboard

Other Resources

Dashboard Name Properties


How to Remove Reports from a Dashboard

Dashboards in Configuration Manager 2007 display multiple reports on a single page. Use the following procedure to remove reports from a dashboard.

Procedure

How to remove reports from a dashboard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Dashboards.

  2. Right-click the name of the dashboard that you want to modify, and then click Properties.

  3. Click the Reports tab. All reports that are used in the dashboard are listed in the Dashboard reports area, along with the position (row and column) for each report.

  4. To remove an individual report while keeping the original number of rows and columns in the dashboard, double-click the report to open the Select Report Properties dialog box, select -Blank- from the Select Report dialog box, and then click OK.

    Note
    Several reports can be removed at the same time by decreasing the number of rows or columns in the dashboard. Decreasing the number of rows will remove entire rows of reports, starting from the bottom of the dashboard. Decreasing the number of columns will remove entire columns of reports, starting from the right-hand side of the dashboard.

  5. Click OK to save the dashboard and exit the dialog box.

See Also

Concepts

About Configuration Manager Dashboards
About Configuration Manager Reports
How to Manage Reports


How to Delete a Dashboard

Dashboards in Configuration Manager 2007 display multiple reports on a single page. Use the following procedure to delete a dashboard.

Note
The reports displayed in a dashboard are not removed from the database when the dashboard is deleted.

Procedure

To delete a dashboard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Dashboards.

  2. Right-click the name of the dashboard that you want to delete, and then click Delete.

  3. Click Yes to confirm the deletion.

See Also

Concepts

About Configuration Manager Dashboards

Other Resources

How to Manage Dashboards


Reporting Security Best Practices

Attackers usually try to gather as much information about a company as possible to find vulnerabilities. An attacker might attempt to gain access to Microsoft System Center Configuration Manager 2007 reports to find information about the network environment. For example, if an attacker can view the report showing software update compliance, she can use specific attacks against computers that are not updated against those attacks.

Attacks against Configuration Manager 2007 reporting are usually lower risk than attacks against the site server, site database server, software distribution, and remote tools.

Restrict queries and reports to authorized viewers Use the principle of least privilege when assigning permission to queries and reports. Reports can be run from the Configuration Manager 2007 console or through a report viewer, such as Internet Explorer. Only queries viewed in the Configuration Manager 2007 console are subject to Configuration Manager 2007 object security. When you run Configuration Manager 2007 queries, you must have Configuration Manager 2007 object security permissions on the objects included in the query. In addition, when you create a query, Values on the Criteria tab of the Query Statement Properties dialog box returns no data if you do not have Read and Read Resource permissions to the Collections class.

A query can be collection limited, so that users can query data only for resources in collections they are authorized to use. Even when the user does not specify collection limiting when creating a query, Configuration Manager 2007 applies collection limiting if the user is not authorized to view all resources. If someone requires access to information, verify that they will not be restricted by collection limiting.

Use the reporting users group to control access to the reporting point By default, all members of the Administrators and Reporting Users groups have access to the reporting point Web site. If users need access to reports on the reporting point, add them to the Reporting Users local groups on each required reporting point. The Reporting Users group does not have any members by default.

The Reporting Users group does not have Configuration Manager 2007 object security rights configured by default. This group needs Read security rights on the Report SMS class or members of the group are not able to access reports, even though they do have access to the reporting Web site.

Manage security for users who connect directly to the SQL Server computer If you use reporting mechanisms other than the Configuration Manager console and Configuration Manager reporting, WMI security and Configuration Manager object security are not in effect. If you choose to use reporting mechanisms that access SQL Server views directly, such as using and ODBC driver or scripting, you must implement security controls to restrict data access to authorized users.

Note
Accessing data directly in the tables is not supported. The only supported way to access the data is by using the views.

Enable HTTPS access for reporting points When you configure the reporting point role on a site system, you should configure the reporting point to launch the report viewer using HTTPS. Intercepting the session state or credentials in unencrypted HTTP traffic is a relatively easy security attack. Stealing the session state could give the attacker full access to the reporting point. This setting does not obtain the certificate or configure IIS to use SSL. Complete these configurations before you configure the reporting point for HTTPS access.

Note
Configuring HTTPS on the reporting point is completely separate from native mode configuration. Even in native mode, reporting points default to using HTTP access.

See Also

Concepts

Reporting in Configuration Manager

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features


Troubleshooting Reporting

This section provides information to help troubleshoot the reporting feature in Configuration Manager 2007.

Note
This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=91691.

In This Section

How to Configure Logging on a Reporting Point

Describes how to configure logging on a site system computer with the reporting point site role.

Log Files for Reporting

Describes the log files and the type of information contained in each log file.

Troubleshooting Reporting Issues

Describes common issues of reporting and how to fix the issues.

How to Find Supplemental Reports on Disabled Reporting Points

Describes how to find supplemental reports on a computer that has had the reporting point site system role removed.

See Also

Concepts

Reporting in Configuration Manager


How to Configure Logging on a Reporting Point

Logging is enabled by default for each Configuration Manager 2007 site system computer with the reporting point site role to help troubleshoot issues related to reporting. Use the following procedure to configure logging on a site system computer with the reporting point site role.

To configure logging on a reporting point

  1. Open the Registry Editor on the site system computer with a reporting point site role.

  2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Tracing\SMS_REPORTING_POINT

  3. The default registry key elements are as follows:

    • Enabled=dword:00000001
    • MaxFileSize=dword: 2621440
    • TraceFilename=%ProgramFiles%\Microsoft Configuration Manager\Logs\smsreporting.log

    It is recommended that the reporting point log file be enabled. To modify the maximum log file size, increase or decrease the MaxFileSize value. To change the location for the reporting point log file, provide a new location for the TraceFilename value.

See Also

Concepts

About Reporting Points
Log Files for Reporting
Troubleshooting Reporting


Log Files for Reporting

Configuration Manager 2007 creates log files for reporting that contain information about the reporting point installation and the reporting actions. The log files are located on the Configuration Manager site server computer, in the %ProgramFiles%\Microsoft Configuration Manager\Logs folder by default. The following table describes the log files and the type of information contained in each log file.

File Name | Description
SMSReportingInstall.LOG | Provides information about the installation of a reporting point.
smsreporting.log | Provides information about using the reporting components, including the connection to the site database, the queries used on the site database to retrieve the items displayed in a report and dashboard, and so on.

See Also

Concepts

About Configuration Manager Reports
Troubleshooting Reporting


Troubleshooting Reporting Issues

This section provides information about reporting issues in Configuration Manager 2007 and possible resolutions.

Note
This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=91691.

Click the related link for information about the associated reporting issue.

In This Section

Reports and Dashboards Not Displaying Correctly in Browser

See Also

Concepts

Troubleshooting Reporting


Reports and Dashboards Not Displaying Correctly in Browser

The report viewer in Configuration Manager 2007 opens the browser, but reports do not appear in the left pane. Also, reports and dashboards open the browser, but none of the report data appears.

Problem

Reporting in Configuration Manager requires that Microsoft Internet Explorer 5.01 SP2 or later is installed on any server or client that uses Report Viewer. To use graphs in reports, Office Web Components (Microsoft Office 2000 SP2, Microsoft Office XP, or Microsoft Office 2003) must be installed.

Note
Office Web Components is not supported on 64 bit operating systems. If you want to use graphs in reports, use 32 bit operating systems for your reporting points and clients.

See Also

Concepts

Troubleshooting Reporting


How to Find Supplemental Reports on Disabled Reporting Points

Supplemental reports are reports that you or others create outside of Configuration Manager 2007 and that you place in a designated folder on a reporting point. If a reporting point site system role is removed, Configuration Manager automatically copies any supplemental reports on that computer to a folder on the root drive. Use the following procedure to find supplemental reports on a computer that has had the reporting point site system role removed.

To find supplemental reports on a computer that has had the reporting point removed

  1. Open the registry editor on the computer where the reporting point was disabled.

  2. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\ SMS\Client\BackupSuppRptDir

    The BackupSuppRptDir value represents the path to the supplemental reports that were backed up when the reporting point was removed from the computer.

See Also

Tasks

How to Install a Supplemental Report

Concepts

About Supplemental Reports
Troubleshooting Reporting


Technical Reference for Reporting

Click any link in the following section for technical reference information for reporting in Configuration Manager 2007.

In This Section

SQL Query Statement Reference

Provides information about using Microsoft SQL query statements.

Using Query Designer to Create SQL Statements for Reports

Provides information about using Query Designer to create SQL query statements for reports.

Configuration Manager Report Categories

Provides the Configuration Manager 2007 report categories and a brief description for each.

Error Codes in Configuration Manager Reports

Provides references to correlate standard Windows error codes displayed in reports to a description.

See Also

Concepts

Reporting in Configuration Manager


SQL Query Statement Reference

Many useful Microsoft SQL Server statements can be used when creating Configuration Manager 2007 reports, and they are briefly described in this section. To follow this discussion, you should have a basic level of SQL query statement knowledge and the ability to write queries such as the following:

SELECT Name, Comment, CollectionID

FROM v_Collection

WHERE Name LIKE 'All Windows%'

ORDER BY Name

For information about how to write basic queries, search for Query Fundamentals in the Microsoft SQL Server 2005 Books Online.

Aggregate Functions

Aggregate functions (such as SUM, AVG, COUNT, COUNT(*), MAX, and MIN) generate summary values in query result sets. An aggregate function (with the exception of COUNT(*)) processes all the selected values in a single column to produce a single result value. Aggregate functions can be applied to all rows in a view, to a subset of the view specified by a WHERE clause, or to one or more groups of rows in the view. When an aggregate function is applied, a single value is generated from each set of rows.

Important
Be aware that NULL values are not included in aggregate results. For example, if you have 100 records and 8 of them have a NULL column value for the property that you are counting, the count will return only 92 results.

An example of using the COUNT(*) aggregate function is displayed in the following query (from the Count clients for each site predefined report) and example result set.

SELECT v_Site.SiteCode, v_Site.SiteName, v_Site.ReportingSiteCode,

Count(SMS_Installed_Sites0) AS 'Count'

FROM v_Site, v_RA_System_SMSInstalledSites InsSite

WHERE v_Site.SiteCode = InsSite.SMS_Installed_Sites0

GROUP BY SiteCode, SiteName, ReportingSiteCode

ORDER BY SiteCode

SiteCode | SiteName | ReportingSiteCode | Count
ABC | ABC Site |  | 928
123 | 123 Site | ABC | 1010

Date and Time Functions

Many built-in reports use the Date and Time functions. The most common functions used are the GETDATE, DATEADD, DATEDIFF, and DATEPART.

GETDATE ()

The GETDATE function produces the current date and time in SQL Server internal format for datetime values. GETDATE takes the NULL parameter ().

The following example results in the current system date and time:

SELECT GETDATE()

(no column name)

2005-05-29 10:10:03.001

DATEADD (datepart, number, date)

The DATEADD function returns a new datetime value based on adding an interval to the specified date.

Datepart is the parameter that specifies on which part of the date to return a new value (for example, year, month, day, hour, minute, and so forth), number is the value used to increment datepart, and date is the starting date.

The following example results in a date that is two days from May 29, 2005:

SELECT DATEADD([day], 2, '2005-05-29 10:10:03.001')

(no column name)

2005-05-31 10:10:03.001

DATEDIFF (datepart , startdate , enddate)

The DATEDIFF function returns the number of date and time boundaries crossed between two specified dates.

Datepart is the parameter that specifies on which part of the date to return a new value (for example, year, month, day, hour, minute, and so forth), startdate is the starting date, enddate is the ending date.

The following example results in the number of minutes between the first and second dates:

SELECT DATEDIFF (minute, '2005-05-29 10:10:03.001',

'2005-06-12 09:28:11.111')

(no column name)

20118

DATEPART (datepart , date)

The DATEPART function returns an integer representing the specified datepart of the specified date.

Datepart is the parameter that specifies on which part of the date to return, and date is the specified date.

The following example results in the month in the specified date:

SELECT DATEPART (month, '2005-05-29 10:10:03.001')

(no column name)

5

Combining Date and Time Functions

It is typical to use a combination of the Date and Time functions in Configuration Manager reports.

The following example results in the current date and time (2005-05-29 10:10:03.001 in this example) minus 100 days:

SELECT DATEADD([day], - 100, GETDATE())

(no column name)

2005-02-18 10:10:03.001

Example Query Using Date and Time Functions

The following query results in the total count of status messages for a one-day period. In this query, the COUNT, GETDATE, and DATEADD functions are used as well as the BETWEEN logical operator and the GROUP BY and ORDER BY clauses.

SELECT SiteCode, MessageID, COUNT(MessageID) AS [count],

GETDATE() AS [End Date]

FROM vStatusMessages

WHERE ([Time] BETWEEN DATEADD([day], -1, GETDATE()) AND GETDATE())

AND (MessageID BETWEEN '0' AND '10000')

GROUP BY SiteCode, MessageID

ORDER BY SiteCode, MessageID

Site Code | MessageID | Count | End Date
ABC | 500 | 190 | 2005-05-29 10:10:03.001
ABC | 501 | 130 | 2005-05-29 10:10:03.001
ABC | 502 | 190 | 2005-05-29 10:10:03.001
ABC | 1105 | 85 | 2005-05-29 10:10:03.001
ABC | 1106 | 5 | 2005-05-29 10:10:03.001
… | … | … | …

JOINS

To create effective reports in Configuration Manager, you need to understand how to join different views to get the expected data. There are three types of joins: inner, outer, and cross. In addition, there are three types of outer joins: left, right, and full. The self join utilizes any of the above joins, but joins records from the same view.

Inner Joins

In an inner join, records from two views are combined and added to a query's results only if the values of the joined fields meet certain specified criteria. If you use an inner join by using the ResourceID to join the v_R_System and v_GS_WORKSTATION_STATUS views, the result would be a list of all systems and their last hardware scan date.

SELECT v_R_System.Netbios_Name0 AS MachineName,

v_GS_WORKSTATION_STATUS.LastHWScan AS [Last HW Scan]

FROM v_R_System INNER JOIN v_GS_WORKSTATION_STATUS

ON v_R_System.ResourceID = v_GS_WORKSTATION_STATUS.ResourceID

Machine Name | Last HW Scan
Client1 | 2005-05-29 10:10:03.001
Client3 | 2005-06-12 09:28:11.110

Outer Joins

An outer join returns all rows from the joined views whether or not there's a matching row between them. The ON clause supplements the data rather than filtering it. The three types of outer joins (left, right, and full) indicate the main data's source. Outer joins can be particularly helpful when you have NULL values in a view.

Left Outer Joins

When you use a left outer join to combine two views, all the rows in the left view are included in the results. In the following query, the v_R_System and v_GS_WORKSTATION_STATUS views are joined using the left outer join. The v_R_System view is the first view listed in the query, making it the left view. The result will include a list of all systems and their last hardware scan date. Unlike the inner join, systems that have not been scanned for hardware will still be listed with a NULL value (as seen in the result set).

SELECT v_R_System.Netbios_Name0 AS MachineName,

v_GS_WORKSTATION_STATUS.LastHWScan AS [Last HW Scan]

FROM v_R_System LEFT OUTER JOIN v_GS_WORKSTATION_STATUS

ON v_R_System.ResourceID = v_GS_WORKSTATION_STATUS.ResourceID

Machine Name | Last HW Scan
Client1 | 2005-05-29 10:10:03.001
Client2 | NULL
Client3 | 2005-06-12 09:28:11.110

Right Outer Joins

A right outer join is conceptually the same as a left outer join except that all the rows from the right view are included in the results.

Full Outer Join

A full outer join retrieves all the rows from both joined views. It returns all the paired rows where the join condition is true, plus the unpaired rows from each view concatenated with NULL rows from the other view. You usually won't want to use this type of outer join.

Cross Join

A cross join returns the product of two views, not the sum. Each row in the left view is matched up with each row in the right view. It's the set of all possible row combinations, without any filtering. However, if you add a WHERE clause, a cross join functions as an inner join—it uses the condition to filter all possible row combinations down to the ones you want.

Self Join

A self join uses any of the above join types, but is a view that is joined to itself. In database diagrams, a self join is called a reflexive relationship.

NOT IN Keyword Phrase

Subqueries with the keyword phrase NOT IN are very useful to find information about a set of data that doesn’t meet certain criteria. In the following example, the query returns the NetBIOS name of all computers that do NOT have Notepad.exe installed. You must first create a query that can detect all computers that have the selected file installed as follows:

SELECT DISTINCT v_R_System.Netbios_Name0

FROM v_R_System INNER JOIN v_GS_SoftwareFile

ON (v_GS_SoftwareFile.ResourceID = v_R_System.ResourceId)

WHERE v_GS_SoftwareFile.FileName = 'Notepad.exe'

After confirming that the first query displays all the computers that have Notepad.exe installed, the following subquery statement will use the NOT IN keyword phrase to find all computer names that do NOT have the Notepad.exe file installed:

SELECT DISTINCT Netbios_Name0

FROM v_R_System

WHERE Netbios_Name0 NOT IN

(SELECT DISTINCT v_R_System.Netbios_Name0

FROM v_R_System INNER JOIN v_GS_SoftwareFile

ON (v_GS_SoftwareFile.ResourceID = v_R_System.ResourceId)

WHERE v_GS_SoftwareFile.FileName = 'Notepad.exe')

ORDER by Netbios_Name0

See Also

Tasks

How to Use Query Designer to Create or Modify Report Queries

Reference

Report SQL Statement Dialog Box

Concepts

How to Modify the Report SQL Statement


Using Query Designer to Create SQL Statements for Reports

When creating Configuration Manager 2007 reports, queries can be created while in the Report SQL Statement dialog box in the Configuration Manager console. The Configuration Manager SQL views and associated columns are both listed, but you still need to know how to write query statements. For some administrators, it is much easier to use Query Designer in Microsoft SQL Server 2005 to create the query for the Configuration Manager report. This tool has a variety of features that help in designing and testing queries.

Using Query Designer to Create Report Queries

Writing queries in the Query Designer component of the Microsoft SQL Server 2005 Management Studio provides a graphical interface for writing queries. You can create a new query or copy a query from an existing Configuration Manager report, paste the query into the SQL pane and easily add views, create joins, select columns to display, add criteria, sort data, and so on. For more information, see How to Use Query Designer to Create or Modify Report Queries. Query Designer provides the following panes:

  • Diagram pane: Provides the ability to join the views on specific columns and select the columns to display as part of the query results.
  • Criteria pane: Provides the ability to create aliases for columns, configure the sort order for the query results, configure filters, and so on.
  • SQL pane: Provides the ability to manipulate the SQL statement.
  • Results pane: Provides the query results when the Execute SQL action is initiated.

Query Designer Considerations

When using Query Designer, you should be aware of the following points so that your queries and reports work as expected.

Report Prompt Query Variables

Many predefined Configuration Manager reports have report prompts. These report prompts require the user to enter a value for a specified view column. The value is stored in a variable, and the variable is then used to filter the query result set. These variables will not work in Query Designer, so you must change the variable to a static value or the query will fail. The following example shows a query from a Configuration Manager report that contains a variable representing a specific collection ID and how this variable is modified so that Query Designer can be used:

Query from a Configuration Manager report:

SELECT Name

FROM v_FullCollectionMembership

WHERE CollectionID = @collid

Change the variable to the desired static value:

SELECT Name

FROM v_FullCollectionMembership

WHERE CollectionID = 'SMS00001'

After the query has been modified in Query Designer and is ready to be used in a Configuration Manager report, the query can be copied into the Report SQL Statement dialog box for the report and modified so that the original report prompt variable replaces the static value entered above.

Report Links

If you change the column order by modifying the query in a predefined report, and the report has a link to another report that requires a column number, the link can pass data from the wrong column to the target report. To prevent this, verify that the correct column numbers are specified in the link.

See Also

Tasks

How to Use Query Designer to Create or Modify Report Queries

Concepts

SQL Query Statement Reference


Configuration Manager Report Categories

There are many predefined report categories in Configuration Manager 2007 that help to organize reports. Configuration Manager provides the predefined report categories that are listed in the following table:

Report Category

Asset Intelligence

Client Framework

Desired Configuration Management - Assignment

Desired Configuration Management - Compliance

Desired Configuration Management - Errors

Device Management

Driver Management

Hardware - <hardware inventory category>

Network

Network Access Protection

Operating System

SMS Site - Client Information

SMS Site - Discovery and Inventory Information

SMS Site - General

SMS Site - Server Information

Software - Companies and Products

Software - Files

Software Distribution - Advertisement Status

Software Distribution - Advertisements

Software Distribution - Collections

Software Distribution - Packages

Software Metering

Software Updates - Deployments

Software Updates - States

Software Updates - Updates

Software Updates Infrastructure

SSL Configuration

Status Messages

Status Messages - Audit

Task Sequence - Advertisement Status

Task Sequence - Advertisements

Task Sequence - Progress

Upgrade Assessment - Windows Server 2008

Upgrade Assessment - Windows Vista

Upgrade Assessment - Windows XP

Users

Wake On LAN

See Also

Concepts

About Configuration Manager Reports

Other Resources

Technical Reference for Reporting


Error Codes in Configuration Manager Reports

Topic last updated -- August 2007

Some Configuration Manager 2007 reports display error codes in reports, rather than a description of the error. Examples include the client deployment, client assignment, and client communication reports. You might also see them in reports relating to software updates.

For information about how to map these error codes to an error description, see http://go.microsoft.com/fwlink/?LinkId=103419.

See Also

Concepts

About Reports for Configuration Manager Clients
About Software Updates Reports
Custom Error Codes for Configuration Manager 2007

Other Resources

Technical Reference for Reporting


SQL Reporting Services in Configuration Manager 2007 R2

Topic Last Updated—August 2008

The Microsoft System Center Configuration Manager 2007 R2 SQL Reporting Services feature provides a set of tools and resources that help you use the advanced reporting capabilities of SQL Reporting services from the Configuration Manager console.

The topics in this section provide detailed information about planning, configuring, and troubleshooting SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

Overview of SQL Reporting Services

Provides an overview of SQL Reporting Services in Configuration Manager 2007 R2.

Prerequisites for SQL Reporting Services

Provides information about prerequisites necessary for using SQL Reporting Services in Configuration Manager 2007 R2.

Planning for SQL Reporting Services

Provides information about planning for using SQL Reporting Services in Configuration Manager 2007 R2.

Best Practices for SQL Reporting Services

Provides best practice information about implementing SQL Reporting Services in Configuration Manager 2007 R2.

Configuring SQL Reporting Services

Provides tasks to configure SQL Reporting Services in Configuration Manager 2007 R2.

Tasks for SQL Reporting Services

Provides a set of tasks to perform SQL Reporting Services objectives in Configuration Manager 2007 R2.

Troubleshooting SQL Reporting Services

Provides information to help you troubleshoot SQL Reporting Services in Configuration Manager 2007 R2.

Technical Reference for SQL Reporting Services

Provides technical reference information for SQL Reporting Services in Configuration Manager 2007 R2.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Reporting in Configuration Manager


Overview of SQL Reporting Services

Topic Last Updated—August 2008

SQL Reporting Services in Configuration Manager 2007 R2 enables administrators to use the advanced reporting features of Microsoft SQL Server Reporting Services from the Configuration Manager console. Advantages of using this solution include the following:

Note
The information in this topic applies only to Configuration Manager 2007 R2.

  • Uses an industry standard reporting system to query the Configuration Manager 2007 database.
  • Enables users who are not familiar with Configuration Manager 2007 reporting to generate ad hoc reports.
  • Enables users to subscribe to reports; for example, a manager could automatically be e-mailed a report each day, detailing the status of a patch rollout.
  • Simplifies the creation of SQL-based reports in Configuration Manager 2007 R2.

Reports can be created in SQL Reporting Services using a number of methods, including the following:

  • By importing existing Configuration Manager 2007 reports into SQL Reporting Services using the Copy Reports to Reporting Services Wizard.
  • By creating new reports using the Create Report Wizard.
  • By using Microsoft Report Builder, supplied with SQL Server.
Note
Using SQL Reporting Services on your site does not replace the existing Configuration Manager 2007 reports.

For more information about installing and configuring SQL Reporting Services, visit the SQL Reporting Services Web site at http://go.microsoft.com/fwlink/?LinkId=111840.

In This Section

Administrator Checklist for SQL Reporting Services

Provides a checklist for a recommended path to installing, configuring, and using SQL Reporting Services in Configuration Manager 2007 R2.

About Using Microsoft Report Builder to Create Reports in SQL Reporting Services

Describes the features of Microsoft Report Builder and provides information on how it can be used to create reports.

About Report Models in SQL Reporting Services

Provides information about how report models are used in SQL Reporting Services to display only relevant information to the administrator building a report.

About Report Folders in SQL Reporting Services

Provides information about using report folders in SQL Reporting Services.

About Security in SQL Reporting Services

Provides information about report security in SQL Reporting Services.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Planning for SQL Reporting Services
Prerequisites for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services
Troubleshooting SQL Reporting Services


Administrator Checklist for SQL Reporting Services

Topic Last Updated—August 2008

Use the steps in the following checklist to install, configure, and use SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Step | Reference
Review the SQL Reporting Services concepts in the Configuration Manager 2007 R2 documentation library. | Overview of SQL Reporting Services
Review the SQL Reporting Services planning information in the Configuration Manager 2007 R2 documentation library. | Planning for SQL Reporting Services
Review the SQL Reporting Services prerequisites in the Configuration Manager 2007 R2 documentation library. | Prerequisites for SQL Reporting Services
Install and configure a SQL Reporting Server in your Configuration Manager 2007 R2 hierarchy. | How to Configure Microsoft SQL Server for SQL Reporting Services Refer to SQL Reporting Services documentation and the SQL reporting services Web site at http://go.microsoft.com/fwlink/?LinkId=111840
Designate and configure a reporting services point in your Configuration Manager 2007 site. | How to Create a Reporting Services Point for SQL Reporting Services How to Configure Properties for the Reporting Services Point How to Select the Default Report Server for SQL Reports
Copy built-in Configuration Manager 2007 reports to SQL Reporting Services. | How to Copy Configuration Manager Reports to SQL Reporting Services
Create SQL Reporting Services reports from the Configuration Manager 2007 console. | How to Create a New Model-Based Report in SQL Reporting Services How to Create a New SQL-Based Report in SQL Reporting Services
Manage SQL Reporting Services reports. | How to Modify an Existing SQL Reporting Services Report How to Delete a SQL Reporting Services Report How to Assign Reports to Report Folders in SQL Reporting Services How to Create Report Folders in SQL Reporting Services How to Delete Report Folders in SQL Reporting Services How to Modify Report Folders in SQL Reporting Services
Configure automatic delivery of SQL Reporting Services reports. | How to Configure Report Subscriptions in SQL Reporting Services How to Modify a Report Subscription in SQL Reporting Services
Troubleshoot problems with SQL Reporting Services. | Troubleshooting SQL Reporting Services

See Also

Other Resources

Configuring SQL Reporting Services
Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services
Troubleshooting SQL Reporting Services


About Using Microsoft Report Builder to Create Reports in SQL Reporting Services

Topic Last Updated—August 2008

Microsoft Report Builder is the primary tool used in SQL Reporting Services in Configuration Manager 2007 R2 to construct reports. Report Builder allows the administrator to construct SQL Reporting Services reports by dragging items from views that have been exposed to the user through report models. When you use Report Builder, it is not necessary to understand where the data you are using is stored, making it possible for administrators with no experience in using SQL to construct reports.

Report Builder is launched automatically when you use the Create Report Wizard to create a model-based report. You can also open Report Builder from your SQL Reporting Services Web site.

This topic is an introduction to the features available in Report Builder. For detailed help and tutorials, refer to the documentation supplied with Report Builder.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Features Available in Report Builder

Feature | Description
Explorer pane | Allows you to easily view and choose from the available views and items.
Drag and drop | Drag available items into the report from the Explorer pane.
Interactive report building | Drag items around in the report design window, and position them wherever you want.
Filters | Apply filters to reports to limit the data based on criteria you specify.
Preview results | Generate an immediate preview of the report.
Adjust rows and columns | Interactively change the size of rows and columns in the report.
Export the report | Export the report in a variety of popular formats.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Export a SQL Reporting Services Report

Concepts

About Report Models in SQL Reporting Services
Administrator Checklist for SQL Reporting Services
Example Scenario for Implementing SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


About Report Models in SQL Reporting Services

Topic Last Updated—August 2008

SQL Reporting Services in Configuration Manager 2007 R2 uses report models to help the administrator select items from the database to include in model-based reports. Report models expose only specified views and items for the user building the report to choose from. To create model-based reports, at least one report model needs to be available.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Report models have the following features:

  • Database fields and tables can be given logical business names, so knowledge of the database structure is not required to produce reports.
  • Items can be grouped logically.
  • Relationships between items can be defined.
  • Model elements can be secured so that users can see only the data that they have permission to see.

Although sample report models are included in Configuration Manager 2007 R2, you can also define report models to meet your own business needs.

To design and build report models, you must install the SQL Server Business Intelligence Development Studio component of Microsoft SQL Server, and then complete five steps outlined in the following table.

Create a report model project | A report model project contains the definition of the data source (a .ds file), the definition of a data source view (a .dsv file), and the report model (an .smdl file).
Define a data source for a report model | After creating a report model project, you need to define one data source from which you will extract business data. This will typically be the Configuration Manager 2007 site database.
Define a data source view for a report model | After defining the data sources that you will use in your report model project, the next step is to define a data source view for the project. A data source view is a logical data model based on one or more data sources. Data source views encapsulate access to the physical objects, such as tables and views, contained in underlying data sources. SQL Reporting Services generates the report model from the data source view. Data source views facilitate the model design process by providing you with a useful representation of the data that you specified. You can rename tables and fields, as well as add aggregate fields and derived tables, in a data source view without changing the underlying data source. For an efficient model, add only those tables to the data source view that you intend to use.
Define a report model | A report model is a layer on top of a database that identifies business entities, fields, and roles. When published, these models enable Report Builder users to develop reports without having to be familiar with database structures or understand and write queries. Models are composed of sets of related report items that are grouped together under a friendly name, predefined relationships between these business items, and predefined calculations. Models are defined using an XML language called Semantic Model Definition Language (SMDL). The file extension for report model files is .smdl.
Publish a report model | To build reports using the model that you just created, you must publish it to a report server. The data source and data source view are included with the model when it is published.

For a step-by-step example of producing a report model, see Step-by-Step Guide to Creating a Report Model in SQL Reporting Services.

See Also

Tasks

Step-by-Step Guide to Creating a Report Model in SQL Reporting Services
How to Create a New Model-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


About Report Folders in SQL Reporting Services

Topic Last Updated—August 2008

Report folders in Configuration Manager 2007 R2 SQL Reporting Services provide a method of sorting and filtering reports stored on the report server. Report folders are particularly useful when you have many reports to manage.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Actions for SQL Reporting Services Folders

Configuration Manager 2007 R2 supports the following actions for managing report folders from the Configuration Manager console.

Create a new report folder | How to Create Report Folders in SQL Reporting Services
Delete an existing report folder | How to Delete Report Folders in SQL Reporting Services
Assign reports to folders | How to Assign Reports to Report Folders in SQL Reporting Services
Modify Report folders | How to Modify Report Folders in SQL Reporting Services

See Also

Tasks

How to Create Report Folders in SQL Reporting Services
How to Modify Report Folders in SQL Reporting Services
How to Delete Report Folders in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

How to Assign Reports to Report Folders in SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2


About Security in SQL Reporting Services

Topic Last Updated—August 2008

SQL Reporting Services in Configuration Manager 2007 R2 uses role-based authorization and Windows authentication to determine which users can perform operations and access items on a report server. Role-based authorization categorizes into roles the actions that a user or group can perform.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Security roles in SQL Reporting Services

To use SQL Reporting Services, a user must be assigned to one or more of the following roles:

Important
The minimum role required to run SQL reports is My Reports.

  • Browser Can view folders, view reports, and subscribe to reports.
  • Content Manager Can manage content on the report server, such as folders and reports.
  • Model Item Browser Can view reporting services models.
  • My Reports Can publish reports and manage folders and reports only in the user’s own folder.
  • Publisher Can publish reports and linked reports to the report server.
  • Report Builder Can view report definitions.
  • System Administrator Can view and modify system role assignments, system role definitions, system properties, and shared schedules.
  • System User Can view system properties and shared schedules.

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services Dialog Boxes


Prerequisites for SQL Reporting Services

Topic Last Updated—August 2008

SQL Reporting Services in Configuration Manager 2007 R2 has external dependencies and dependencies within the product.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Dependencies External to Configuration Manager 2007

The following table describes the external dependencies for SQL Reporting Services running in Configuration Manager 2007.

Dependency More Information

A Microsoft SQL Server 2005 Reporting Services reporting server must be installed and configured in the site hierarchy.

Before you can use SQL Reporting Services integration in Configuration Manager 2007 R2, you must configure reporting services on a SQL Server installation in your network.

For more information about installing and configuring SQL Reporting Services, visit the SQL Reporting Services Web site at http://go.microsoft.com/fwlink/?LinkId=111840.

For more information about configuring SQL Reporting Services for integration with Configuration Manager 2007 R2, see How to Configure Microsoft SQL Server for SQL Reporting Services.

SQL Reporting Services requires Internet Information Services (IIS) 6.0 or later for the Reporting Services Web site.

For more information about installing Internet Information Services, see your Windows Server documentation.

Report model authoring requires the SQL Server Business Intelligence Development Studio component of Microsoft SQL Server.

For information about installing this component, see About Report Models in SQL Reporting Services

Configuration Manager 2007 Dependencies

The following table describes the dependencies within Configuration Manager 2007 for running SQL Reporting Services.

Dependency More Information

The site server must be running Configuration Manager 2007 R2.

SQL Reporting Services requires Configuration Manager 2007 R2.

Remote Configuration Manager consoles must be upgraded to Configuration Manager 2007 R2.

For SQL Reporting Services features to be displayed in remote Configuration Manager consoles, Configuration Manager 2007 R2 Setup must be run to upgrade the Configuration Manager consoles.

Reporting services point site system role.

The reporting services point site system role must be configured before you can use SQL Reporting Services.

For more information about configuring the reporting services point site role, see How to Create a Reporting Services Point for SQL Reporting Services.

See Also

Tasks

How to Configure Microsoft SQL Server for SQL Reporting Services
How to Configure Windows Server 2008 for Site Systems

Concepts

Administrator Checklist for SQL Reporting Services
Planning for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services


Planning for SQL Reporting Services

Topic Last Updated—August 2008

The following considerations should be taken into account when configuring the Configuration Manager 2007 R2 SQL Reporting Services feature.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Performance

  • Location of SQL Reporting Services Installation
    Configuration Manager 2007 R2 supports locating the SQL reporting server on the site server or a remote computer. However, for performance reasons, you should locate the SQL reporting server and the reporting services point on a remote site system.

Security

  • Unattended Report Processing
    To use report subscriptions, you must configure one of the following to allow reports to run unattended:
    • An execution account. This account must be a Microsoft Windows user account. If you configure this account with a password expiration date, or if you change its information in Active Directory, you must also update this information in SQL Reporting Services. You should set read-only permissions to reports for this account. For information about configuring an execution account, see How to Configure Microsoft SQL Server for SQL Reporting Services.
    • Configure the option Credentials stored securely in the report server on the Data Source Authentication tab of the Report Server Properties dialog box. For more information about configuring this option, see Report Server Properties: Data Source Authentication Tab.
  • Credentials Options when Configuring the Connection to the Configuration Manager Database
    Use the option Credentials are not required in the Report Server Properties: Data Source Authentication Tab for testing purposes only. This setting is not recommended for a production environment.

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services


Best Practices for SQL Reporting Services

Topic Last Updated—August 2008

Use the following best practices for SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

  • Optimize SQL Reporting Services Queries
    Optimize your report queries. Usually, the bulk of report execution time is spent executing queries and retrieving results. If you are using SQL Server, tools such as Query Analyzer and Profiler can help you optimize queries.
  • Report Subscription Scheduling
    Whenever possible, schedule report subscription processing to run outside of normal office hours. This will reduce load on the reporting server and improve availability for ad hoc report requests.

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services


Configuring SQL Reporting Services

Topic Last Updated—August 2008

Before you can create, modify, and display SQL Reporting Services reports in the Configuration Manager 2007 console, you must carry out a number of configuration tasks. This section provides configuration information for SQL Reporting Services in Configuration Manager 2007 R2.

Click the related link for detailed information about the associated SQL Reporting Services configuration task.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

How to Configure Microsoft SQL Server for SQL Reporting Services

Provides information about configuring SQL Server for using SQL Reporting Services in your Configuration Manager 2007 R2 site.

How to Create a Reporting Services Point for SQL Reporting Services

Provides the steps required to create a reporting services point.

How to Configure Properties for the Reporting Services Point

Provides the steps to help you configure the reporting services point.

How to Select the Default Report Server for SQL Reports

Provides the steps to help you select the default report server to use when running reports.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Planning for SQL Reporting Services
Prerequisites for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services
Troubleshooting SQL Reporting Services


How to Configure Microsoft SQL Server for SQL Reporting Services

Topic Last Updated—August 2008

Before you can use SQL Reporting Services integration in Configuration Manager 2007 R2, you must configure reporting services on a SQL Server 2005 installation in your network.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To install the SQL Reporting Services component of SQL Server 2005

  1. From the installation media you used to install SQL Server 2005, run setup.exe to launch the SQL Server Setup Wizard.

  2. Accept the end user license agreement, and then click Next.

  3. Review the Installing Prerequisites page, and click Next.

  4. After SQL Server setup performs a configuration check, the Welcome page of the SQL Server Installation Wizard is displayed. Click Next.

  5. Review the results of the system configuration check to identify any problems that might prevent the configuration of SQL Server from completing successfully. Click Next.

    Note
    If you receive an Edition Change Check warning message, you must reapply any previously applied SQL Server Service Packs after you have finished configuring the software.

  6. On the Registration Information page, enter your name, company name, and product key, and then click Next.

  7. On the Components to Install page, make sure that Reporting Services is selected, and then click Next.

  8. On the Instance Name page, specify a name for the instance of SQL Server you are upgrading. If you are upgrading the default instance of SQL Server, select the Default instance check box, and then click Next.

  9. On the Service Account page, specify the account details that the reporting services service will use to log in. Check the Reporting Services check box to start the reporting services service after setup completes. Click Next to continue.

  10. On the Report Server Installation Options page, verify that the option Install but do not configure the server is selected, and then click Next.

  11. On the Error and Usage Report Settings page, select whether you want to inform Microsoft of any error and usage data for SQL Server, and then click Next.

  12. On the Ready to Install page, review the information shown, and then click Install.

  13. After installation is complete, click Next.

  14. On the Completing Microsoft SQL Server 2005 Setup page, review any information shown, and click Finish to close the wizard.

To configure SQL Reporting Services in SQL Server 2005

  1. From the Windows Start menu, navigate to Microsoft SQL Server 2005 / Configuration Tools, and then click Reporting Services Configuration.

  2. In the Report Server Installation Instance Selection dialog box, specify the name of the server hosting SQL Reporting Services, select the database instance from the drop-down menu, and then click Connect.

  3. In Reporting Services Configuration Manager, click Server Status. Verify that Service Status is set to Running. If it is not, click Start, and then click Apply.

  4. Click Report Server Virtual Directory, and then click New to specify a new virtual directory.

  5. In the Create a New Virtual Directory dialog box, select Default Web Site from the Website drop-down list, and specify the name you want to call the virtual directory created by Reporting Services (or use the default ReportServer), and then click OK.

  6. Ensure that Apply default settings is selected, and then click Apply.

  7. Click Report Manager Virtual Directory, and then click New to specify a new virtual directory.

  8. In the Create a New Virtual Directory dialog box, select Default Web Site from the Website drop-down list, and specify the name you want to call the Report Manager virtual directory created by Reporting Services (or use the default Reports), and then click OK.

  9. Ensure that Apply default settings is selected, and then click Apply.

  10. Click Web Service Identity. If you do not want to change the defaults in this section, click Apply.

  11. Click Database Setup, select a server from the Server name drop-down list, and then click Connect.

  12. In the SQL Server Connection Dialog dialog box, specify the SQL Server name and connection details for the Reporting Services server, and then click OK.

  13. On the Database Connection page of Configure Report Server, click New.

  14. In the SQL Server Connection Dialog dialog box, specify a name for the new Reporting Services database (or use the default, ReportServer), and then click OK.

  15. Click Apply to complete configuration of the new database.

  16. Click Email Settings. Specify the following information:

    Note
    If you do not want to use e-mail-based report subscriptions, you do not need to complete this step.

    • Sender Address: Specifies the e-mail address that will appear as the sender address of any e-mail sent from SQL Reporting Services. The account specified must have sufficient permissions to send e-mail from the specified SMTP server.
    • Current Delivery Method: Specifies that the delivery method used to send e-mails will be via SMTP server. This is the only delivery method you can configure through reporting services configuration. For details about configuring other delivery methods, see the SQL Reporting Services documentation.
    • SMTP Server: Specify the name of the SMTP server to use when sending reports. This can be a local or remote server.

    Click Apply.

  17. Click Execution Account. Specify the user name and password of a Windows user account that will be used to run unattended reports—for example, those used by subscriptions. Click Apply.

    Note
    If you do not want to use report subscriptions or if you have configured the option Credentials stored securely in the report server on the Data Source Authentication tab of the Report Server Properties dialog box, you do not need to complete this step.

  18. Click Apply, and then click OK.

  19. Click Exit to close Reporting Services Configuration Manager.

See Also

Tasks

How to Configure Properties for the Reporting Services Point
How to Create a Reporting Services Point for SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Create a Reporting Services Point for SQL Reporting Services

Topic Last Updated—August 2008

Before you can use SQL Reporting Services in Configuration Manager 2007, you must configure a reporting services point. The reporting services point is a site system role that must be configured on a server running Microsoft SQL Server with the Reporting Services component installed. For more information about configuring Reporting Services in SQL Server, see How to Configure Microsoft SQL Server for SQL Reporting Services.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Use the following procedure to create a reporting services point on a Configuration Manager 2007 site system.

To create a reporting services point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code>-<site name> / Site Settings / Site Systems.

  2. Determine whether to create a new site system or to add the reporting services point site role to an existing site system, and then follow the associated step.

    To create a new site system and add the reporting services point role:

    • Right-click Site Systems, click New, and then click Server.
    • On the General page of the New Site Role Wizard, specify the name of the server that will be used to host the reporting services point.

    To add the reporting services point role to an existing site system:

    • Right-click the site system name, and click New Roles.

  3. On the General page of the New Site Role Wizard, configure the general settings for this site system, and then click Next. For information about the options you can specify on this page, see How to Add New Site System Roles. Click Next.

  4. On the System Role Selection page of the wizard, select Reporting Services point, and then click Next.

  5. On the Reporting Services Point page, specify the folder that will be created on the report server to contain the SQL Reporting Services reports used in Configuration Manager and then click Next.

  6. Review the information shown on the Summary page, and then click Next.

  7. Click Close to exit the wizard.

See Also

Tasks

How to Add New Site System Roles
How to Configure Microsoft SQL Server for SQL Reporting Services
How to Copy Configuration Manager Reports to SQL Reporting Services

Reference

Report Options Dialog Box

Concepts

Administrator Checklist for SQL Reporting Services
Copy Reports to Reporting Services Wizard

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Configure Properties for the Reporting Services Point

Topic Last Updated—August 2008

Before you can begin to generate reports in the Configuration Manager 2007 R2 console using SQL Reporting Services, you must configure properties for the reporting services point.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To configure properties for the reporting services point

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services, and expand the node.

  2. Right-click the reporting services point server you want to configure, and then click Properties.

  3. On the General tab of the Report Server Properties dialog box, review information about the currently selected report server. For more information about the items on this tab, see Report Server Properties: General Tab.

    Note
    Information about the report folder will be shown only after you have created a new report or copied existing reports to this report server.

  4. On the Data Source Settings tab of the Report Server Properties dialog box, specify the Configuration Manager 2007 database server and database name to be used as the data source for SQL Reporting Services reports. For more information about the items in this tab, see Report Server Properties: Data Source Settings Tab.

  5. On the Data Source Authentication tab of the Report Server Properties dialog box, specify the credentials used to access reports on the report server. For more information about the items in this tab, see Report Server Properties: Data Source Authentication Tab.

  6. On the Data Source Security tab of the Report Server Properties dialog box, specify permissions for the users who have access to the data source specified in the Data Source Settings tab. For more information about the items in this tab, see Reporting Services Properties: Security Tab.

  7. On the Security tab of the Report Server Properties dialog box, specify the users who have access to the selected report server. For more information about the items in this tab, see Reporting Services Properties: Security Tab.

  8. Click OK to close the Report Server Properties dialog box.

See Also

Tasks

How to Configure Microsoft SQL Server for SQL Reporting Services
How to Create a Reporting Services Point for SQL Reporting Services

Reference

Report Server Properties: Data Source Authentication Tab
Report Server Properties: Data Source Settings Tab
Report Server Properties: General Tab
Reporting Services Properties: Security Tab

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Select the Default Report Server for SQL Reports

Topic Last Updated—August 2008

If you have selected the option Use Reporting Services Reports for Admin console report links in the Report Options dialog box and if you have more than one reporting services point in your Configuration Manager 2007 R2 site hierarchy, you can set the default report server that will be used when displaying SQL Reporting Services reports run from links in the Configuration Manager console.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To change the default report server for displaying reports from Configuration Manager console links

  1. In the Configuration Manager console, navigate to System Center Configuration Manager, right-click the Site Database node, and select Report Options.

  2. In the Report Options dialog box, under Reporting Services Reporting, select the default report server to use when running reports from the drop-down list.

    Note
    This setting only applies to reports run from Configuration Manager console links.

  3. If you want report links in the Configuration Manager console to open using SQL Reporting Services instead of the standard Configuration Manager reports, select Use Reporting Services Reports for Admin console report links.

    Note
    Report links will open in SQL Reporting Services only if the Configuration Manager report has been copied to SQL Reporting Services by using the Copy Reports to Reporting Services Wizard.

  4. If you want reports to open in a new window instead of the Configuration Manager console, select Open reports in a new window.

  5. Click OK to close the Report Options dialog box.

See Also

Tasks

How to Configure Properties for the Reporting Services Point
How to Create a Reporting Services Point for SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Tasks for SQL Reporting Services

Topic Last Updated—August 2008

To use SQL Reporting Services in Configuration Manager 2007 R2, you must complete a number of configuration and management tasks.

The content in this section contains more information about these tasks.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

How to Copy Configuration Manager Reports to SQL Reporting Services

Contains information to help copy the standard Configuration Manager 2007 reports into SQL Reporting Services.

How to View SQL Reporting Services Reports from the Configuration Manager Console

Provides the steps required to view SQL Reporting Services reports in the Configuration Manager 2007 console.

How to Create a New Model-Based Report in SQL Reporting Services

Provides the steps required to create a new model-based report using the Create Report Wizard.

How to Create a New SQL-Based Report in SQL Reporting Services

Provides the steps required to create a new SQL-based report using the Create Report Wizard.

How to Modify an Existing SQL Reporting Services Report

Provides the steps required to modify an existing report.

How to Delete a SQL Reporting Services Report

Contains information about how to delete a SQL Reporting Services report.

How to Create Report Folders in SQL Reporting Services

Contains information about how to create new report categories in SQL Reporting Services.

How to Assign Reports to Report Folders in SQL Reporting Services

Contains information about how to assign report categories in SQL Reporting Services.

How to Modify Report Folders in SQL Reporting Services

Contains information about how to modify report categories in SQL Reporting Services.

How to Delete Report Folders in SQL Reporting Services

Contains information about how to delete report categories in SQL Reporting Services.

How to Export a SQL Reporting Services Report

Contains information about how to export SQL Reporting Services reports in a number of formats.

How to Configure Report Subscriptions in SQL Reporting Services

Contains information about how to configure automatic delivery of SQL Reporting Services reports.

How to Modify a Report Subscription in SQL Reporting Services

Contains information about how to modify subscriptions to SQL Reporting Services Reports.

How to Customize the List of SQL Reporting Services Reports in the Configuration Manager Console

Contains information about how to modify how report lists are displayed in the Configuration Manager console.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Planning for SQL Reporting Services
Prerequisites for SQL Reporting Services

Other Resources

Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Technical Reference for SQL Reporting Services
Troubleshooting SQL Reporting Services


How to Copy Configuration Manager Reports to SQL Reporting Services

Topic Last Updated—August 2008

In Configuration Manager 2007 R2, standard reports can be copied to a Reporting Services server by using the Copy Reports to Reporting Services Wizard. Use the following procedure to copy existing Configuration Manager reports to Reporting Services.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To copy standard Configuration Manager reports to Reporting Services

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services.

  2. Right-click the Reporting Services server that the standard reports will be copied to, and then click Copy Reports to Reporting Services.

  3. On the Data Source Settings page of the Copy Reports Wizard, specify the Configuration Manager 2007 database server and database name from which to copy the reports. For more information about the options on this page, see Report Server Properties: Data Source Settings Tab.

  4. Click Next.

  5. On the Data Source Authentication page of the Copy Reports Wizard, choose the authentication method required to run the copied reports on the Reporting Services server. For more information about the options on this page, see Report Server Properties: Data Source Authentication Tab.

  6. Click Next.

  7. On the Select Reports page of the Copy Reports Wizard, select the reports you want to copy to the Reporting Services server. Select Overwrite existing reports if you want to overwrite any reports that already exist on the Reporting Services server.

    Note
    When Configuration Manager reports are copied to SQL Reporting Services, they are copied to a report folder with the same name as the Configuration Manager report category.

  8. Click Next.

  9. On the Security page of the Copy Reports Wizard, specify which users can access the copied reports and the roles they must belong to. For more information about the options on this page, see Reporting Services Properties: Security Tab.

  10. Click Next.

  11. On the Summary page of the Copy Reports Wizard, review the reports that will be created, and then click Next.

  12. After the reports are copied, click Next.

  13. On the Confirmation page of the Copy Reports Wizard, review the information, and then click Close to exit the wizard.

    Note
    If a report fails to import, it will be indicated by a red cross. Double-click the entry to open the Details dialog box, which lists details of the error in copying the report. Also, the description field allows only 512 characters. Descriptions longer than 512 characters will be truncated.

    Detailed information about the report copying process can be found in the ConversionReport.xml file, in the \SMS\AdminUI\AdminUILog folder on the computer from which you launched the Copy Reports Wizard.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Copy Reports to Reporting Services Wizard

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to View SQL Reporting Services Reports from the Configuration Manager Console

Topic Last Updated—August 2008

Use the following procedure to view SQL Reporting Services Reports in the Configuration Manager 2007 console.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To view Reporting Services reports in the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <reporting services point name>, and expand the node.

  2. In the expanded node, select the report folder containing the report that you want to view. A list of available reports will be shown in the details pane.

  3. Right-click the report you want to view, and then click Run.

    Note
    By default, the report will open in the Configuration Manager console. If you want the report to open in a separate window, select the option Open reports in a new window in the Report Options Dialog Box.

  4. In the results pane, provide any parameters that the report requires, and then click Display.

See Also

Tasks

How to Copy Configuration Manager Reports to SQL Reporting Services
How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Reference

Report Options Dialog Box

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2


How to Create a New Model-Based Report in SQL Reporting Services

Topic Last Updated—August 2008

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Use the Create Report Wizard in Configuration Manager 2007 R2 SQL Reporting Services to create a new model-based report. Model-based reporting allows you to interactively choose the items you want to include in your report.

To create a new model-based report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services.

  2. Right-click the report server name, and select Create Report.

    Note
    If you right-click a report folder and click Create Report, the report will be created in that report folder.

  3. On the Information page of the Create Report Wizard, select Model-based report and then click Next.

  4. On the Model Selection page of the Create Report Wizard, select the report model you want to use from the Model drop-down list. You can browse the views exposed by this model in the Preview window. Click Next to continue.

  5. On the Summary page of the Create Report Wizard, review information about the report that will be created and then click Next.

  6. After the Progress page of the Create Report Wizard is displayed, review the Wizard Completed page and then click Close to exit the wizard and open Microsoft Report Builder.

  7. In Microsoft Report Builder, drag and drop items from the available views into the report builder window. For more information about the options in Microsoft Report Builder, see About Using Microsoft Report Builder to Create Reports in SQL Reporting Services.

  8. When you have finished creating the report in Microsoft Report Builder, click File and then click Save.

  9. In the Save As Report dialog box, select a folder in which to store the report and specify a descriptive name for the report. Click Save to save the report.

  10. Close Microsoft Report Builder.

    Note
    You might need to refresh the display in the Configuration Manager console before the new report is visible.

See Also

Tasks

How to Create a New SQL-Based Report in SQL Reporting Services
Step-by-Step Guide to Creating a Report Model in SQL Reporting Services

Concepts

About Report Models in SQL Reporting Services
Administrator Checklist for SQL Reporting Services
About Using Microsoft Report Builder to Create Reports in SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Create a New SQL-Based Report in SQL Reporting Services

Topic Last Updated—August 2008

Use the Create Report Wizard in Configuration Manager 2007 R2 SQL Reporting Services to create a new SQL-based report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To create a new SQL-based report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services.

  2. Right-click the report server name, and select Create Report.

    Note
    If you right-click a report folder and click Create Report, the report will be created in that report folder.

  3. On the Information page of the Create Report Wizard, select SQL-based report, and then specify the following information:

    • Name—Specify a descriptive name for this report.
    • Description—Specify an optional description for this report.
    • Path—Specify the report folder in which this report will be stored.

    Click Next to Continue.

  4. On the Create datasets page of the wizard, specify the following information:

    • Dataset Name—From the drop-down list, select an existing dataset to use for this report or click the New button to create a new dataset.
      Note
      A dataset contains the SQL query that you want to use in the report. A report can use many datasets, but it must use at least one.

    • Timeout—Specify the time in seconds after which processing of this query will fail if data cannot be retrieved from the data source. The default value is 30 seconds.
    • Display dataset on report—Select this box to display the results of this dataset in the report.

  5. To edit the properties of the selected dataset, click the Edit Command Text button. In the Command Text dialog box, specify the SQL query to be used by this report. When you are finished, click OK to close the Command Text dialog box.

  6. If you want this report to use parameters—for example, if you would like the report to prompt for a Configuration Manager 2007 collection to restrict the report results—click the Report Parameters button. In the Report Parameters dialog box, specify the parameters to be used by this report. When you are finished, click OK to close the Report Parameters dialog box.

  7. Click Next to continue.

  8. On the Summary page of the wizard, review the actions to be taken and then click Next.

  9. After the report is created, the Wizard Completed page is displayed. Review the results from the wizard and then click Close.

    Note
    You might need to refresh the display in the Configuration Manager console before the new report is visible.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Modify an Existing SQL Reporting Services Report

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Modify an Existing SQL Reporting Services Report

Topic Last Updated—August 2008

Use the following procedure to modify a report you have created using SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To modify a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. Right-click a SQL Reporting Services report, and click Properties.

  3. On the General tab of the Report Properties dialog box, you can specify a new name and description for the report. For more information, see Report Properties: General Tab.

  4. On the Datasets tab of the Report Properties dialog box, you can view and edit the SQL code for the report. For more information, see Report Properties: Datasets Tab.

  5. On the Subscriptions tab of the Report Properties dialog box, you can view and edit any subscriptions configured for the report. For more information, see Report Properties: Subscriptions Tab.

  6. On the Security tab of the Report Properties dialog box, you can view and edit the permissions assigned to the report. For more information, see Reporting Services Properties: Security Tab.

  7. Click OK to close the Report Properties dialog box.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Delete a SQL Reporting Services Report

Topic Last Updated—August 2008

To delete a SQL Reporting Services report in Configuration Manager 2007 R2, right-click the report and select Delete. However, before deleting a report, you should note the following consequences:

  • If the report being deleted is linked with another report, the link between the reports will be broken.
  • There is no equivalent of the Windows Recycle Bin in SQL Reporting Services. If you mistakenly delete a report, you might not be able to recover it.

Use the following procedure to delete a SQL Reporting Services report in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To delete a SQL Reporting Services report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Reporting Server> and expand the node.

  2. Right-click a report, and then click Delete.

  3. In the Confirm Object Delete dialog box, click Yes.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services
How to Modify an Existing SQL Reporting Services Report

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Create Report Folders in SQL Reporting Services

Topic Last Updated—August 2008

When you create a report using SQL Reporting Services in Configuration Manager 2007 R2, it must be assigned to a report folder. Report folders provide a method of sorting and filtering reports stored on the report server. Report folders are particularly useful when you have a high number of reports to manage.

Note
When you use the Copy Reports to Reporting Services Wizard to copy Configuration Manager 2007 reports into SQL Reporting Services, report folders are automatically created from the Configuration Manager 2007 report category.

Use the following procedure to create a new report folder in SQL Reporting Services.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To create a new report category

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. Right-click the Report Folders node, and then click New Folder.

  3. In the New Folder dialog box, specify a name for the report folder and, optionally, a description.

  4. Click OK to close the New Folder dialog box.

See Also

Tasks

How to Delete Report Folders in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

How to Assign Reports to Report Folders in SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2


How to Assign Reports to Report Folders in SQL Reporting Services

Topic Last Updated—August 2008

SQL Reporting Services reports in Configuration Manager 2007 R2 can be assigned to report folders using the methods described in the following table.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Method | Description
Drag and Drop | In the Configuration Manager console, you can drag and drop reports from one report folder into another.
Cut/Copy and Paste | Right-click a report, and then click Cut or Copy. Navigate to the destination report folder, right-click inside the results pane, and then click Paste.

See Also

Tasks

How to Create Report Folders in SQL Reporting Services
How to Delete Report Folders in SQL Reporting Services
How to Modify Report Folders in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Modify Report Folders in SQL Reporting Services

Topic Last Updated—August 2008

Use the following procedure to modify the properties of a report folder you have created using SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To modify a report folder

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. Expand the Categories node, right-click a report folder, and then click Properties.

  3. On the General tab of the Reporting Services Folder Properties dialog box, specify the following information:

    • Name: Specify a descriptive name for the report folder.
    • Description: Specify a description for the report folder.

  4. On the Security tab of the Reporting Services Folder Properties dialog box, specify a list of users and their permissions to this report folder. For more information about the options in this tab, see Reporting Services Properties: Security Tab.

  5. Click OK to close the Reporting Services Folder Properties dialog box.

See Also

Tasks

How to Delete Report Folders in SQL Reporting Services
How to Create Report Folders in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

How to Assign Reports to Report Folders in SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2


How to Delete Report Folders in SQL Reporting Services

Topic Last Updated—August 2008

Use the following procedure to delete a report folder from SQL Reporting Services in Configuration Manager 2007 R2.

Important
When you delete a report folder, you also delete all reports stored in that folder.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To delete a report folder

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name> / Report Folders, and expand the node.

  2. Right-click a report folder, and then click Delete.

  3. In the Confirm Folder Delete dialog box, click Yes.

See Also

Tasks

How to Create Report Folders in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

How to Assign Reports to Report Folders in SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2


How to Export a SQL Reporting Services Report

Topic Last Updated—August 2008

Reports generated using SQL Reporting Services in Configuration Manager 2007 R2 can be exported in a variety of formats. Use the following procedure to export SQL Reporting Services reports.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To export a SQL Reporting Services report

  1. While viewing a SQL Reporting Services report, click the Export drop-down list.

  2. In the Export drop-down list, select one of the following file types for exporting the report:

    • XML file with report data—Saves the report in Extensible Markup Language format.
    • CSV (comma delimited)—Saves the report in comma-separated value format.
    • TIFF file—Saves the report in Tagged Image File Format.
    • Acrobat (PDF) file—Saves the report in Acrobat Portable Document Format.
    • Web archive—Saves the report in MIME HTML format (mhtml), viewable in many Web browsers.
    • Excel—Saves the report as a Microsoft Excel spreadsheet.

  3. Click Export to export the report.

  4. When the File Download dialog box is displayed, choose one of the following options:

    • Open—Opens the exported report for viewing in its associated program.
      Note
      The Open button will be displayed only if there is a program on the computer associated with the file type of the report you are exporting.

    • Save—Opens the Save As dialog box, enabling you to save the report in a specified folder.
    • Cancel—Cancels exporting the report.

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services


How to Configure Report Subscriptions in SQL Reporting Services

Topic Last Updated—August 2008

Report subscriptions in SQL Reporting Services enable you to configure the automatic delivery of specified reports by e-mail or to a file share at scheduled intervals. Use the Create Subscription Wizard in Configuration Manager 2007 R2 SQL Reporting Services to configure report subscriptions.

You can also configure other types of report subscriptions, such as data-driven subscriptions from the Web interface included with Microsoft SQL Server Reporting Services. For more information, see your SQL Server documentation.

Important
To configure reports to be delivered by e-mail, you must configure the item E-mail Settings in SQL Reporting Services Configuration Manager. For more information, see How to Configure Microsoft SQL Server for SQL Reporting Services.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To configure a subscription to deliver a report by e-mail

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. In the results pane, right-click a report and then click New Subscription.

  3. On the Subscription Delivery page of the Create Subscription Wizard, specify the delivery properties for this report subscription. From the Report delivered by drop-down list, select E-mail. For more details about the options on this page, see Report Subscription Dialog Box: Subscription Delivery Tab.

  4. Click Next to continue.

  5. On the Subscription Schedule page of the Create Subscription Wizard, configure the schedule by which the report will be generated and delivered. For more details about the options on this page, see Report Subscription Dialog Box: Subscription Schedule Tab.

  6. Click Next to continue.

  7. On the Subscription Parameters page of the Create Subscription Wizard, specify any parameters that this report needs to run. For more details about the options on this page, see Report Subscription Dialog Box: Subscription Parameters Tab.

  8. Click Next to continue.

  9. On the Summary page of the Create Subscription Wizard, review the subscription that will be created and then click Next.

  10. On the Confirmation page of the Create Subscription Wizard, review the actions taken and then click Close to exit the wizard.

To configure a subscription to deliver a report to a file share

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. In the results pane, right-click a report and then click New Subscription.

  3. On the Subscription Delivery page of the Create Subscription Wizard, specify the delivery properties for this report subscription. From the Report delivered by drop-down list, select Windows File Share. For more details about the options on this page, see Report Subscription Dialog Box: Subscription Delivery Tab.

  4. Click Next to continue.

  5. On the Subscription Schedule page of the Create Subscription Wizard, configure the schedule by which the report will be generated and delivered to the file share. For more details about the options on this page, see Report Subscription Dialog Box: Subscription Schedule Tab.

  6. Click Next to continue.

  7. On the Subscription Parameters page of the Create Subscription Wizard, specify any parameters that this report needs to run. For more details about the options on this page, see Report Subscription Dialog Box: Subscription Parameters Tab.

  8. Click Next to continue.

  9. On the Summary page of the Create Subscription Wizard, review the subscription that will be created and then click Next.

  10. On the Confirmation page of the Create Subscription Wizard, review the actions taken and then click Close to exit the wizard.

See Also

Tasks

How to Modify a Report Subscription in SQL Reporting Services

Reference

Report Subscription Dialog Box: Subscription Delivery Tab
Report Subscription Dialog Box: Subscription Parameters Tab
Report Subscription Dialog Box: Subscription Schedule Tab

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Modify a Report Subscription in SQL Reporting Services

Topic Last Updated—August 2008

The procedure in this topic shows you how to modify a report subscription you have created using SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To modify a report subscription

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. Right-click a SQL Reporting Services report, and click Properties.

  3. On the Subscriptions tab of the Report Properties dialog box, view the subscriptions configured for this report.

  4. To delete a report subscription, select a subscription from the list and click the delete button.

  5. To modify a report subscription, select a subscription from the list and click the edit button to open the Report Subscription dialog box.

  6. On the Subscription Delivery tab of the Report Subscription dialog box, configure a delivery method and options for this report subscription. For more information, see Report Subscription Dialog Box: Subscription Delivery Tab.

  7. On the Subscription Schedule tab of the Report Subscription dialog box, configure a delivery schedule for this report. For more information, see Report Subscription Dialog Box: Subscription Schedule Tab.

  8. On the Subscription Parameters tab of the Report Subscription dialog box, configure parameters to be used when running this report. For more information, see Report Subscription Dialog Box: Subscription Parameters Tab

  9. Click OK to close the Report Subscription dialog box.

  10. Click OK to close the Report Properties dialog box.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services

Reference

Report Subscription Dialog Box: Subscription Delivery Tab
Report Subscription Dialog Box: Subscription Parameters Tab
Report Subscription Dialog Box: Subscription Schedule Tab

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


How to Customize the List of SQL Reporting Services Reports in the Configuration Manager Console

Topic Last Updated—August 2008

When you select a SQL Reporting Services report folder in the Configuration Manager console, a list of all reports contained in that folder are displayed. You can customize this display to add or remove information columns for the displayed reports, or you can display only reports that match a filter you specify. Use the following procedures to modify the report columns displayed in the list of reports and to filter the displayed reports matching the criteria you specify.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To add or remove columns in a list of reports

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. Click on a report folder to display the list of reports.

  3. Right-click the report folder, click View, and then click Add/Remove columns.

  4. In the Add/Remove Columns dialog box, specify which columns to display in the results pane. Select the column name from the Available columns list, and click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns.

  5. Click OK to save changes and exit the Add/Remove Columns dialog box.

To use Look for to filter the display of reports

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server Name>, and expand the node.

  2. Click on a report folder to display the list of reports.

  3. In Look for, enter any part of a text string that helps to filter or identify the reports you need, select an item from the in the column for the search criteria (a specific column or All columns), and then click Find Now. The more specific your search string is, the more specific the results will be. For example, typing the letter I in the Look for field will return any item that has the letter I in any displayed column. Typing the word Report in the Look for field and selecting Name from the in drop-down list will return any reports that contain the word Report in the Name column.

    Note
    The Look for facility searches only in the currently selected report folder.

  4. Click Look for to select previous searches. Up to 10 previous searches can be stored.

  5. As a visual indicator that the display is filtered, the title bar will display Filtered view, display x items out of y, where x is the number of reports that match your filter and y is the total number of unfiltered reports. Click Clear when you want to return to displaying all reports.

See Also

Concepts

About Report Folders in SQL Reporting Services
Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Troubleshooting SQL Reporting Services

Topic Last Updated—August 2008

This section provides troubleshooting information for SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

Troubleshooting SQL Reporting Services Issues

Lists possible problems and solutions if you experience issues when using SQL Reporting Services.

Log Files for SQL Reporting Services

Lists the log files used by SQL Reporting Services in Configuration Manager 2007 R2.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Planning for SQL Reporting Services
Prerequisites for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services


Troubleshooting SQL Reporting Services Issues

Topic Last Updated—August 2008

This topic provides troubleshooting information to help you resolve issues using SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Report data displays incorrectly when site server and client are different language versions

When you display reports containing data from client computers running a different language version of Microsoft Windows than the version installed on the site server, localized report data from the client computer might display incorrectly in reports generated by SQL Reporting Services.

Solution

There is currently no workaround to this issue.

Report links in the Configuration Manager console do not work after removing a reporting services point

If you have specified Use Reporting Services Reports for Admin console report links in the Report Options dialog box and then remove the reporting services point site role, report links in the Configuration Manager console will fail to display and you will receive the error message, Unable to launch the report because it does not exist on the report server or the report server is unavailable.

Solution

Use one of the following solutions:

  • Clear the Use Reporting Services Reports for Admin console report links check box before removing the reporting services point site role.
  • In the Report Options dialog box, reselect the reporting point under Classic Reporting and then click OK.

Cannot run reports from the Configuration Manager console

When you try to run a SQL Reporting Services report from the Configuration Manager console, the report fails with insufficient privileges.

Solution

When reports are retrieved from SQL Reporting Services to the Configuration Manager console, the report properties are also retrieved. To retrieve these properties, the user running the report must have the My Reports privilege. Use one of the following workarounds:

  • Ensure the user running the report has the My Reports privilege in SQL Reporting Services.
  • Run the report directly from your SQL Reporting Services Web page.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Prerequisites for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Technical Reference for SQL Reporting Services


Log Files for SQL Reporting Services

Topic Last Updated—August 2008

SQL Reporting Services in Configuration Manager 2007 R2 uses a number of log files in which to record details of its operation. You can use these log files to help you troubleshoot problems with the feature.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

SQL Reporting Services Log Files

The SQL Reporting Services log files are found on the reporting services point server, in the folder %programfiles%\Microsoft SQL Server\<SQL Server Instance>\Reporting Services\LogFiles.

The following table lists the log file names and descriptions.

File Name | Description
ReportServerService_<timestamp>.log | Log file for the Report Server Windows service worker threads.
ReportServerService_main_<timestamp>.log | Log file for the Report Server Windows service management threads.
ReportServerWebApp_<timestamp>.log | Log file for Report Manager.
ReportServer_<timestamp>.log | Log file for the Report Server Web service.

Additionally, when you use the Copy Reports Wizard, a log file named ConversionReport.xml containing the results of the copy reports operation is generated in the folder \SMS\AdminUI\AdminUILog on the computer from which you launched the wizard.

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2
Technical Reference for SQL Reporting Services
Troubleshooting SQL Reporting Services


Technical Reference for SQL Reporting Services

Topic Last Updated—August 2008

Click any link in the following section for technical reference information for SQL Reporting Services in Configuration Manager 2007 R2.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

Example Scenario for Implementing SQL Reporting Services

An example scenario illustrating how SQL Reporting Services integration can be implemented in a Configuration Manager 2007 R2 site.

Step-by-Step Guide to Creating a Report Model in SQL Reporting Services

Provides a step-by-step guide for creating a reporting model to use in SQL Reporting Services.

Step-by-Step Guide to Creating a Model-Based Report in SQL Reporting Services

Provides a step-by-step guide for creating a model-based report in SQL Reporting Services.

Step-by-Step Guide to Creating a SQL-Based Report in SQL Reporting Services

Provides a step-by-step guide for creating a SQL-based report in SQL Reporting Services.

See Also

Concepts

Administrator Checklist for SQL Reporting Services
Planning for SQL Reporting Services
Prerequisites for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services
Troubleshooting SQL Reporting Services


Example Scenario for Implementing SQL Reporting Services

Topic Last Updated—August 2008

This scenario provides an example of how SQL Reporting Services in Configuration Manager 2007 R2 can be implemented and configured to solve the following business requirements:

  • Use an industry-standard reporting system to query the Configuration Manager 2007 database.
  • Enable users who are not familiar with Configuration Manager 2007 reporting to generate ad hoc reports.
  • Allow users to subscribe to reports.
  • Simplify the creation of reports in Configuration Manager 2007 R2
Note
The information in this topic applies only to Configuration Manager 2007 R2.

Implementing and configuring SQL Reporting Services integration in Configuration Manager 2007 R2

Woodgrove Bank has deployed Configuration Manager 2007 R2 to manage and report on the status of computers on the network. John Woods is Woodgrove Bank's IT systems manager. He learns that Configuration Manager 2007 R2 SQL Reporting Services will allow him to accomplish the stated business requirements. He decides to follow this course of action:

Process Reference

John reviews the Microsoft SQL Server Reporting Services Web site and the overview of SQL Reporting Services integration with Configuration Manager 2007 R2 in the Configuration Manager 2007 documentation library.
  • SQL Reporting Services Web site at http://go.microsoft.com/fwlink/?LinkId=111840
  • Overview of SQL Reporting Services

John reviews the process for installing, configuring, and using SQL Reporting Services in Configuration Manager 2007 R2.

Administrator Checklist for SQL Reporting Services

John confirms that his site meets the prerequisites for using SQL Reporting Services.

Prerequisites for SQL Reporting Services

He then reviews important planning information for using SQL Reporting Services in Configuration Manager 2007 R2.

Planning for SQL Reporting Services

John then installs and configures the SQL Reporting Services component of SQL Server 2005.

How to Configure Microsoft SQL Server for SQL Reporting Services

In the Configuration Manager console, John creates and configures a reporting services point and configures a folder in which to store reports. He then sets this as the default reporting point for the site.
  • How to Create a Reporting Services Point for SQL Reporting Services
  • How to Configure Properties for the Reporting Services Point
  • How to Select the Default Report Server for SQL Reports

John copies all existing Configuration Manager 2007 reports into SQL Reporting Services.

How to Copy Configuration Manager Reports to SQL Reporting Services

John’s manager requires some reports that are not included as standard reports with Configuration Manager 2007 R2. He creates a number of new reports using the SQL Reporting Services wizards.
  • How to Create a New Model-Based Report in SQL Reporting Services
  • How to Create a New SQL-Based Report in SQL Reporting Services
  • How to Modify an Existing SQL Reporting Services Report

How to View SQL Reporting Services Reports from the Configuration Manager Console

John’s manager would like certain reports sent to him by e-mail on a daily basis. To accomplish this, John sets up report subscriptions for selected reports.
  • How to Configure Report Subscriptions in SQL Reporting Services
  • How to Modify a Report Subscription in SQL Reporting Services

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

Configuring SQL Reporting Services
Overview of SQL Reporting Services
SQL Reporting Services in Configuration Manager 2007 R2
Tasks for SQL Reporting Services


Step-by-Step Guide to Creating a Report Model in SQL Reporting Services

Topic Last Updated—August 2008

This step-by-step procedure guides you through the process of creating a report model that users in your site can use to build ad hoc model-based reports based on data in the Configuration Manager 2007 R2 database using the Create Report Wizard. Before starting this procedure, ensure that you have installed SQL Server Business Intelligence Development Studio on a computer with network connectivity to the reporting services point server. Perform these procedures on the computer running SQL Server Business Intelligence Development Studio. Refer to your SQL Server documentation for detailed information about SQL Server Business Intelligence Development Studio.

To create a report model, you must complete the following six tasks:

Note
The information in this topic applies only to Configuration Manager 2007 R2.

  • Create the report model project.
  • Define a data source for the report model.
  • Define a data source view for the report model.
  • Define the report model.
  • Publish the report model.
  • Make the published report model available in the Configuration Manager console.

Use the following procedure to create and publish a report model to your reporting server.

To create the report model project

  1. From the Microsoft Windows Start menu, click Microsoft SQL Server 2005, and then click SQL Server Business Intelligence Development Studio.

  2. After SQL Server Business Intelligence Development Studio opens in Microsoft Visual Studio, click File, click New, and then click Project.

  3. In the New Project dialog box, select Report Model Project in the Templates list.

  4. In the Name field, type SampleModel.

  5. To create the report model project, click OK.

  6. The SampleModel solution is displayed in the Solution Explorer pane.

To define the data source for a report model

  1. In the Solution Explorer pane of SQL Server Business Intelligence Development Studio, right-click Data Sources, and then click Add New Data Source.

  2. On the Welcome to the Data Source Wizard page, click Next.

  3. On the Select how to define the connection page, verify that Create a data source based on an existing or new connection is selected and then click New.

  4. In the Connection Manager dialog box, specify the following connection properties for the data source:

    • Server name—Type in the name of your Configuration Manager 2007 database server, or select it from the drop-down list. If you are working with a named instance rather than the default instance, type <database server>\<instance name>.
    • Select Use Windows Authentication.
    • In the Select or enter a database name list box, select the name of your Configuration Manager 2007 database.

  5. To verify that the database connection works, click Test Connection.

  6. If the connection succeeds, click OK to close the Connection Manager dialog box. If the connection does not succeed, verify that the information you entered is correct and then click Test Connection again.

  7. On the Select how to define the connection page, verify that Create a data source based on an existing or new connection is selected, verify that the data source you have just specified is selected in the Data connections list box, and then click Next.

  8. In the Data source name box, type SampleModel and then click Finish.

  9. The data source SampleModel.ds will now be displayed in the Solution Explorer pane under Data Sources.

    Note
    To edit the properties of an existing data source, double-click the data source in the Data Sources folder of the Solution Explorer pane to display the data source properties in Data Source Designer.

To define the data source view for a report model

  1. In Solution Explorer, right-click Data Source Views, and then click Add New Data Source View.

  2. On the Welcome To The Data Source View Wizard page, click Next. The Select a Data Source page appears.

  3. In the Relational Data Sources window, verify that the SampleModel data source is selected and then click Next.

  4. On the Select Tables and Views page, select the tables or views from the Configuration Manager 2007 database that you want to use in the data source view.

  5. If the Name Matching page appears, accept the default selections and click Next.

  6. In the Available Objects list, double-click each table or view you want to add to the model. This will move it to the Included objects list.

  7. Click Next, and then type SampleModel in the Name text box.

  8. Click Finish. The SampleModel.dsv data source view appears in the Data Source Views folder in the Solution Explorer pane.

To define the report model

  1. In Solution Explorer, right-click Report Models, and then select Add New Report Model.

  2. On the Welcome to the Report Model Wizard page, click Next.

  3. On the Select Data Source Views page, verify that SampleModel.dsv is selected in the Available data source views list and then click Next.

  4. On the Select report model generation rules page, accept the default values and then click Next.

  5. On the Collect Model Statistics page, verify that Update model statistics before generating is selected and then click Next.

  6. On the Completing the Wizard page, verify that SampleModel is displayed in the Name field.

  7. To complete the wizard and create the report model, click Run.

  8. To exit the wizard, click Finish.

To publish the report model

  1. In Solution Explorer, right-click the SampleModel project, and then click Deploy.

  2. If any errors or warnings are encountered, they are displayed in the Output window.

To make the published report model available in the Configuration Manager console

  1. In Solution Explorer, examine the Full Path property for the published report model. Copy the published report, SampleModel.smdl, from this folder to the Windows clipboard.

  2. Paste this file into the folder c:\sms\adminUI\XmlStorage\Other.

  3. This report model will now be available for use in the Create Report Wizard.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

About Report Models in SQL Reporting Services
Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Step-by-Step Guide to Creating a Model-Based Report in SQL Reporting Services

Topic Last Updated—August 2008

This step-by-step guide contains procedures to guide you through the process of using SQL Reporting Services in Configuration Manager 2007 R2 to create a model-based report.

This example report displays general details for each computer in a specified collection. Additionally, this report links to the Computer information for a specific computer report to provide further information about any computer you select.

For full details about options in SQL Server Business Development Studio and Microsoft Report Builder, see your SQL documentation.

Important
Before you commence this procedure, you must install The SQL Server Business Intelligence Development Studio component of Microsoft SQL Server.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To create a report model for the report

  1. Open SQL Server Business Intelligence Development Studio.

  2. Click File, New and then click Project.

  3. In the Templates list, select Report Model Project.

  4. In the Name field, type Example Report Model.

  5. Click OK to create the report model project.

  6. In the Solution Explorer pane of SQL Server Business Intelligence Development Studio, right-click Data Sources, and then click Add New Data Source.

  7. On the Welcome to the Data Source Wizard page, click Next.

  8. On the Select how to define the connection page, verify that Create a data source based on an existing or new connection is selected, and then click New.

  9. In the Connection Manager dialog box, specify the following connection properties for the data source:

    • Server name—Type in the name of your Configuration Manager 2007 database server, or select it from the drop-down list. If you are working with a named instance rather than the default instance, type <database server>\<instance name>.
    • Select Use Windows Authentication.
    • In the Select or enter a database name drop-down list, select the name of your Configuration Manager 2007 database.

  10. To verify that the database connection works, click Test Connection.

  11. If the connection succeeds, click OK. If the connection does not succeed, verify that the information you entered is correct, and then click Test Connection again.

  12. On the Select how to define the connection page, verify that Create a data source based on an existing or new connection is selected, verify that the data source you have just specified is selected in the Data connections list box, and then click Next.

  13. In the Data source name box, type Example Report Model and then click Finish.

  14. In Solution Explorer, right-click Data Source Views, and then click Add New Data Source View.

  15. On the Welcome To The Data Source View Wizard page, click Next.

  16. On the Select a Data Source page, verify that Example Report Model is selected in the Relational data sources window and then click Next.

  17. On the Select Tables and Views page, select the tables or views from the Configuration Manager 2007 database that you want to use in this report model. Select the following item:

    • dbo.v_R_System

  18. Click Next to continue.

  19. On the Completing the Wizard page, in the Name field, type Example Report Model then click Finish.

  20. In Solution Explorer, right-click Report Models, then click Add New Report Model.

  21. On the Welcome to the Report Model Wizard page, click Next.

  22. On the Select Data Source Views page, verify that Example Report Model.dsv is selected in the Available data source views list, and then click Next.

  23. On the Select report model generation rules page, accept the default values, and then click Next.

  24. On the Collect Model Statistics page, verify that Update model statistics before generating is selected, and then click Next.

  25. On the Completing the Wizard page, verify that Example Report Model is displayed in the Name field.

  26. To complete the wizard and create the report model, click Run.

  27. To exit the wizard, click Finish.

  28. In Solution Explorer, right-click the Example Report Model project, and then click Deploy. If any errors or warnings are encountered, they are displayed in the Output window.

  29. In Solution Explorer, examine the FullPath property for the Example Report Model.

  30. Copy the files Example Report Model.smdl and Example Report Model.dsv from this folder to c:\sms\adminUI\XmlStorage\Other.

To create a model-based report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services.

  2. Right-click the report server name, and select Create Report. You can also right-click a report folder name to create the report in that folder.

    Important
    Before creating a report using the Create Report Wizard, you must have created at least one report folder on the reporting server. Report folders are created when you use the Copy Reports Wizard or when you configure the report server options.

  3. On the Information page of the Create Report Wizard, select Model-based report, and then click Next.

  4. On the Model Selection page of the Create Report Wizard, select the report model Example Report Model from the Model drop-down list. You can browse the views and entities exposed by this model in the Preview window. Click Next to continue.

  5. On the Summary page of the Create Report Wizard, review information about the report that will be created and then click Next.

  6. After the Progress page of the Create Report Wizard is displayed, review the Wizard Completed page and then click Close to exit the wizard and open Microsoft Report Builder.

  7. In the Microsoft Report Builder design window, click Click to add title and type in Example Report.

  8. From the Fields window, select the following attributes and drag them into the design window in the Drag and drop column fields area. You can order the columns however you want. You can also double-click an attribute in the Fields window to transfer it into the design window.

    • Netbios Name 0
    • CPU Type 0
    • Client Version 0

  9. For more information about the options available in Microsoft Report Builder, see your SQL Server documentation.

  10. Click Run Report to preview how the report will look.

  11. When you have finished creating the report, click File and then click Save.

  12. In the Save As Report dialog box, specify a name for this report and the report folder in which it is to be stored and then click Save.

  13. Close Microsoft Report Builder.

See Also

Tasks

Step-by-Step Guide to Creating a SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Step-by-Step Guide to Creating a SQL-Based Report in SQL Reporting Services

Topic Last Updated—August 2008

This step-by-step guide contains procedures to guide you through the process of using SQL Reporting Services in Configuration Manager 2007 R2 to create a SQL-based report.

This example report displays the name, processor type, and Configuration Manager 2007 client version for each computer in a specified collection. Additionally, this report links to the Computer information for a specific computer report to provide further information about any computer you select.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To create the SQL-based report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server> / Report Folders and expand the node.

  2. Under Report Folders, right-click the report folder in which you want the report to be created, and then click Create Report.

  3. On the Information page of the Create Report Wizard, specify the following:

    • Select the check box for SQL-based Report.
    • In the Name field, type Example SQL-based Report.
    • In the Description field, type This is an example SQL-based report..

  4. Click Next.

  5. On the Create datasets page of the Create Report Wizard, click the New button to create a new dataset, which will be called DataSet1. This dataset will contain the SQL code for the report.

  6. Ensure that Dataset1 is selected in the Dataset Name drop-down list, and then click the Edit Command Text button.

  7. Enter the following SQL statement in the Command Text window of the Command Text dialog box:

    SELECT Netbios_Name0, CPUType0, Client_Version0 FROM V_R_SYSTEM

  8. Click OK to close the Command Text dialog box.

  9. Click Next.

  10. On the Summary page of the Create Report Wizard, review the actions to be taken and then click Next.

  11. On the Wizard Completed page, review the actions taken and then click Finish to close the wizard.

To create a parameter for the SQL-based report to restrict it to a specified collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server> / Report Folders and expand the node.

  2. Right-click the report Example SQL-based Report, and then click Properties.

  3. On the Datasets tab of the Example SQL-based Report Properties dialog box, click the New button to create a new dataset, which will be called DataSet2. This dataset will contain the SQL code for the report prompt parameter.

  4. Ensure that Dataset2 is selected in the Dataset Name drop-down list, and then click the Edit Command Text button.

  5. In the Command Text dialog box, enter the following SQL statement in the Command Text window:

  6. begin if (@filterwildcard = '') SELECT DISTINCT CollectionID, Name FROM v_Collection ORDER BY Name else SELECT DISTINCT CollectionID, Name FROM v_Collection WHERE CollectionID like @filterwildcard ORDER BY Name end

  7. Click OK to close the Command Text dialog box.

  8. Select Dataset1 from the Dataset Name drop-down list, and then click the Report Parameters button.

  9. In the Report Parameters dialog box, click Add and then specify the following values:

    • Parameter Name Specify the name ID.
    • Prompt Text Specify the prompt text Specify a collection name.
    • Valid Values Select this check box to provide a query containing the valid values for this report parameter.
    • Allow Blank Clear this check box to prevent a bank value being specified for the collection parameter.
    • Valid Values Select Query Based.
    • Dataset Name From the drop-down list, select Dataset2.
    • Value field From the drop-down list, select CollectionID.
    • Label field From the drop-down list, select Name.

  10. Click OK to close the Report Parameters dialog box.

  11. On the Datasets tab of the Example SQL-based Report Properties dialog box, select DataSet1 from the Dataset Name drop-down list and then click the Edit Command Text button.

  12. In the Command Text dialog box, append the following SQL code to the query in the Command Text window:

    WHERE CollectionID = @ID

  13. Click OK to close the Command Text dialog box.

To link the SQL-based report to another report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reporting Services / <Report Server> / Report Folders and expand the node.

  2. Right-click the report Example SQL-based Report and then click Properties.

  3. On the Datasets tab of the Example SQL-based Report Properties dialog box, select DataSet1 from the Dataset Name drop-down list.

  4. In the Fields window, locate the Name row and click … to specify a new link.

  5. In the Report Link Dialog dialog box, click … to open the Browse Reports dialog box. Select the report Computer information for a specific computer (in the folder Hardware – General), and then click OK.

  6. In the Report Link Dialog dialog box, select Name from the Parameter drop-down list.

  7. Click OK to close the Report Link Dialog dialog box.

  8. Click OK to close the Example SQL-based Report Properties dialog box.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services
Step-by-Step Guide to Creating a Model-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Desired Configuration Management in Configuration Manager

The Configuration Manager 2007 desired configuration management feature provides a set of tools and resources that can help assess and track configuration compliance of client computers in the enterprise. Click the associated link in the following section for detailed information about planning, configuring, managing, monitoring, and troubleshooting desired configuration management.

In This Section

Overview of Desired Configuration Management

Provides an overview of the desired configuration management feature.

Planning for Desired Configuration Management

Provides planning information for the desired configuration management feature.

Configuring Desired Configuration Management

Provides the configuration checklist and tasks to configure desired configuration management in the environment.

Tasks for Desired Configuration Management

Provides a set of tasks to perform desired configuration management objectives.

Troubleshooting Desired Configuration Management

Provides troubleshooting information for desired configuration management.

Desired Configuration Management Security Best Practices and Privacy Information

Provides security and privacy information and best practices for desired configuration management.

Technical Reference for Desired Configuration Management

Provides technical reference information for desired configuration management.


Overview of Desired Configuration Management

Desired configuration management in Configuration Manager 2007 allows you to assess the compliance of computers with regard to a number of configurations, such as whether the correct Microsoft Windows operating system versions are installed and configured appropriately, whether all required applications are installed and configured correctly, whether optional applications are configured appropriately, and whether prohibited applications are installed. Additionally, you can check for compliance with software updates and security settings.

Compliance is evaluated by defining a configuration baseline that contains the configuration items you want to monitor and rules that define the compliance that you require. This configuration data can be imported from the Web in Microsoft System Center Configuration Manager 2007 Configuration Packs as best practices defined by Microsoft and other vendors, or defined within Configuration Manager, or defined externally and then imported into Configuration Manager.

Note
Download configuration data that has been published by Microsoft and other software vendors and solution providers from the Microsoft System Center Configuration Manager 2007 Configuration Packs Web page (http://go.microsoft.com/fwlink/?LinkId=71837).

After a configuration baseline is defined, it can be assigned to computers through collections and evaluated on a schedule. Client computers can have multiple configuration baselines assigned to them, which provides the administrator with a high level of control.

Client computers evaluate their compliance against each configuration baseline they are assigned and immediately report back the results to the site using state messages and status messages. If a client is not currently connected to the network but has downloaded the configuration items referenced in its assigned configuration baselines, the compliance information will be sent on reconnection.

You can monitor the results of the configuration baseline evaluation compliance from the Desired Configuration Management home page in the Configuration Manager console. You can also run a number of desired configuration management reports to drill down into details, such as which computers are compliant or non-compliant and which element of the configuration baseline is causing a computer to be non-compliant. You can also view compliance evaluation results from the client itself by using the Configurations tab from Configuration Manager Properties.

You can use desired configuration management to support the following business requirements:

  • Compare the configuration of computers in your enterprise against Best Practices configurations from Microsoft and other vendors.
  • Verify the configuration of provisioned computers against one or more custom defined configuration baselines before the computers go into production.
  • Identify computer configurations that are not authorized by change control procedures.
  • Prioritize non-compliance with four levels of severity.
  • Report compliance with regulatory policies and in-house security policies.
  • Identify security vulnerabilities, as defined by Microsoft and other software vendors, across your enterprise.
  • Provide the help desk with the means to detect probable causes for reported incidents and problems by identifying non-compliant configurations.
  • Remediate non-compliance with software distribution that targets computers with software packages or scripts by using a collection that is automatically populated with computers reporting non-compliance.
  • Leverage management products that monitor Windows events on computers to take automatic action when a configuration is reported out of compliance.

For example scenarios of how desired configuration management can be implemented to address these requirements, see Example Scenarios for Implementing Desired Configuration Management.

In This Section

Click any link in the following section for overview information about desired configuration management.

About Configuration Baselines in Desired Configuration Management

Provides information about configuration baselines, and explains how they are used in desired configuration management.

About Configuration Items in Desired Configuration Management

Provides information about configuration items, and explains how they are used in desired configuration management.

About Compliance and Compliance Information in Desired Configuration Management

Provides information about how compliance is evaluated to help you interpret the desired configuration management reports.

About Content Versions in Desired Configuration Management

Provides information about content versions in configuration baselines and configuration items, to help you interpret information in the Configuration Manager console and in reports.

About Configuration Categories in Desired Configuration Management

Provides information about configuration categories and when to use them with desired configuration management.

About Authoring Configuration Data for Desired Configuration Management

Provides information about creating configuration baselines and configuration items, and explains the different options for authoring.

About the Non-Compliance Severity Level in Desired Configuration Management

Provides information about the non-compliance severity level, and explains how to use it with desired configuration management.

About Validation Criteria in Desired Configuration Management

Provides information about how objects and settings are validated for compliance with desired configuration management.

About Compliance Evaluation Schedules in Desired Configuration Management

Provides information about how often computers are assessed for compliance with desired configuration management, and explains how to modify this configuration.

About Reports for Desired Configuration Management

Lists the reports that are available to report compliance information, and help manage and troubleshoot desired configuration management.

About Desired Configuration Management in Configuration Manager Hierarchies

Explains how desired configuration management works if you have a multiple site Configuration Manager hierarchy.

About Forefront Client Security Integration with Configuration Manager 2007 R2

Explains how desired configuration management can monitor the Forefront Client components.

Desired Configuration Management Administrator Workflows

Lists the administrator workflows that are available to help you use imported best practices configuration data from Microsoft® System Center Configuration Manager 2007 Configuration Packs.

Desired Configuration Management Checklists

Lists the administrator checklists that are available to help you use imported best practices configuration data from Microsoft® System Center Configuration Manager 2007 Configuration Packs.

See Also

Concepts

Desired Configuration Management Security Best Practices and Privacy Information

Other Resources

Planning for Desired Configuration Management
Configuring Desired Configuration Management
Tasks for Desired Configuration Management
Troubleshooting Desired Configuration Management
Technical Reference for Desired Configuration Management


About Configuration Baselines in Desired Configuration Management

Baselines are used to define the configuration of a product or system established at a specific point in time, capturing both structure and details. Configuration baselines in Configuration Manager 2007 contain a defined set of required configurations that are evaluated for compliance as a group.

Configuration baselines contain one or more configuration items with associated rules, and they are assigned to computers through collections, together with a compliance evaluation schedule.

Note
Although you can assign configuration baselines to a collection that contains users, the configuration baselines will be evaluated only by computers in the collection, and not by users in the collection.

You can create your own configuration baselines with the Configuration Manager console, and you can import configuration baselines from the following sources:

  • Configuration Packs that define best practices from Microsoft or other vendors
  • Configuration data made available on the Internet through the communities
  • Custom authored configuration baselines from within your own organization, but external to Configuration Manager
  • Another Configuration Manager site

When configuration baselines are imported, unless they were originally created in the same Configuration Manager site, you will not be able to directly modify them in the Configuration Manager console. If you need to refine the configuration items to meet your business requirements, the recommended path is as follows:

  1. Create child configuration items with your custom values.
  2. Duplicate the configuration baseline.
  3. Edit the duplicated baseline, and replace the configuration items with your edited child configuration items.

Configuration Baseline Rules

Configuration baselines rules are used to specify how the configuration items included in the configuration baseline are to be assessed for compliance on client computers. They are used to define your required compliance.

There are fixed types of configuration baseline rules that cannot be changed in Configuration Manager. Configuration items can be added to the following configuration baseline rules:

  • One of the following operating system configuration items must be present and properly configured.
  • These applications and general configuration items are required and must be properly configured.
  • If these optional application configuration items are detected, they must be properly configured.
  • These software updates must be present.
  • These application configuration items must not be present.
  • These configuration baselines must also be validated.

Configuration Baseline Assignment

Before client computers can assess their compliance with configuration baselines in Configuration Manager, the configuration baseline must be assigned to them through collections of computers.

The assignment consists of the following properties:

  • The configuration baseline itself
  • Which collection to target for compliance evaluation, and whether it includes any defined sub-collections
  • The compliance evaluation schedule, which is initially configured with the default compliance evaluation schedule but can be changed for each assignment

Configuration baseline assignments are optional properties for a configuration baseline. A single configuration baseline can be assigned to multiple collections by defining multiple configuration baseline assignments.

Dependent Configuration Baseline

One of the configuration baseline rules is to include another configuration baseline. This nesting capability provides a layered method of defining a base configuration baseline for a wide range of computers and then refining this base configuration with additional configuration baselines that have more specific configurations for computers with similar roles.

Dependent baselines are also used when you want to combine your own business requirements with those of an imported configuration baseline (such as best practices from a Configuration Pack) that cannot be directly edited. When the original configuration baseline is modified and a new version is available, you can import the later version without having to create a new configuration baseline.

Dependent configuration baselines are displayed in the Configuration Manager console as a property of a configuration baseline.

Duplicate Configuration Baseline

A duplicate configuration baseline in Configuration Manager is an exact copy of an existing configuration baseline that does not retain any relationship to the original.

Creating a duplicate configuration baseline might be appropriate if you wanted to create a number of similar but unrelated configuration baselines and you had one configuration baseline that you use as a template. Another scenario is if you needed to redefine the configuration baseline rules or configuration items in an imported configuration baseline.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management
Determine If You Need to Import Configuration Data for Desired Configuration Management

Other Resources

How to Configure Configuration Baselines for Desired Configuration Management


About Configuration Items in Desired Configuration Management

Configuration items in Configuration Manager 2007 define a discrete unit of configuration to assess for compliance. They can contain one or more elements and their validation criteria, and they typically define a unit of configuration you want to monitor at the level of independent change.

Configuration items are the building blocks for configuration baselines, and consequently the same configuration item can be used in multiple configuration baselines.

Configuration Manager 2007 supports the following configuration item types:

Operating system configuration item

A configuration item to determine compliance for settings relating to the operating system version and configuration.

Application configuration item

A configuration item to determine compliance for an application. This can include whether the application is installed as well as details about its configuration.

General configuration item

A configuration item to determine compliance for general settings and objects, where their existence does not depend on the operating system, an application, or a software update.

Note
In desired configuration management reports and in the XML definition view, this configuration item type is referred to as a business policy configuration item.

Software updates configuration item

A configuration item to determine compliance of software updates using the software updates feature in Configuration Manager 2007.

You cannot import, create, or configure software updates configuration items in the Desired Configuration Management node. Instead, these are made available to configuration baselines through the software updates feature when software updates are downloaded. This means that software updates configuration items can be selected to be included in configuration baselines although they are not displayed under the Configuration Items node.

The other configuration items can be imported, created, and configured with the Configuration Manager console. These configuration items display a number of properties, which include the following:

  • General
  • Objects
  • Settings
  • Windows version
  • Applicability
  • Detection method

The properties that are available to each configuration item depend on the configuration item type. For example, you can configure an operating system configuration item to check for the exact version of the operating system. This property is not applicable to the other configuration items, so you will not see the Windows Version property available for other configuration items.

The following table lists the configurable properties of a configuration item in Configuration Manager, and it shows whether the configurable property is available for each configuration item type.

Key:

√ = Available property

Ø = Property not available

Configuration Item Type | General | Windows Version | Objects | Settings | Detection Method | Applicability | Security
General | √ | Ø | √ | √ | Ø | √ | √
Application | √ | Ø | √ | √ | √ | √ | √
Operating System | √ | √ | √ | √ | Ø | Ø | √
Software Updates | √ | Ø | Ø | Ø | Ø | Ø | √

With the exception of software updates configuration items, you can view and edit the properties of each configuration item in the Configuration Items node under Desired Configuration Management in the Configuration Manager console. Use the Software Updates node to view and edit software updates configuration items.

In addition to the configurable properties of a configuration item in the Desired Configuration Management node, you will also see displayed audit information in the General properties, which displays when the configuration item was created, when it was last edited, and by whom. Additionally, a Relationships property tab displays how the configuration item relates to other configuration items and configuration baselines.

Child Configuration Item

A child configuration item is a copy of a configuration item that continues to inherit the properties of the original configuration item. You cannot modify the child configuration item's inherited objects and settings with their validation criteria, but you can add additional validation criteria to the inherited objects and settings, and you can also add new objects and settings to the child configuration item. Therefore, the usual purpose for creating and editing a child configuration item is that it refines the original configuration item to meet your business requirements.

Important
you cannot add Windows security permissions to child configuration items. In this scenario, you must create a new configuration item with the same object, and define the permissions required.

Because of the dependency relationship of properties inherited from the parent to the child configuration item, modifying the original configuration item will affect the child configuration item.

Child configuration items are appropriate when you have imported configuration data from a Best Practices configuration baseline and you want to be able to update the configuration data when new versions are released that will continue to pass their properties onto the child configuration item.

Another scenario for using child configuration item is when you need to retain inheritance for a greater level of administrative control. For example, you can use a child configuration item if you have a configuration item that defines a corporate security policy that all computers must comply with, but your finance department computers are subject to additional security requirements. In this situation, you might create a child configuration item from the corporate security policy configuration item. The child configuration item inherits all the properties from the corporate security policy, but it is edited to contain the additional security requirements. If the corporate security policy changed, the original configuration item could be modified without having to also modify the configuration item for the computers in the finance department. Similarly, if the requirements for the finance department computers changed, only the child configuration item would need to be modified and not the original configuration item that defines the corporate security policy.

Duplicate Configuration Item

A duplicate configuration item is an exact copy of another configuration item that does not retain any relationship to the original configuration item.

You can use a duplicate configuration item as a template to modify just a few properties and independently retain both configuration items, or you can use it when you have imported a read-only configuration item (for example, from a Microsoft System Center Configuration Manager 2007 Configuration Pack) and want to use the configuration item with modification and not retain any inheritance from the original configuration item.

Additionally, if you want to use an imported configuration item but delete from it objects or settings (or their related validation criteria), your only editing choice is to create a duplicate configuration item and edit that duplicate configuration item accordingly.

Uninterpreted Configuration Item

Imported configuration items might not display all their objects and settings in the Configuration Manager console. In this scenario, Configuration Manager displays as much as it can interpret. If the imported configuration item does not contain any data that it can interpret, the Configuration Manager console displays it as an uninterpreted configuration item. This icon displays as follows:

Uninterpreted Configuration Icon Uninterpreted Configuration Icon

Although the Configuration Manager console is not able to display the properties of these configuration items, you can still add them to configuration baselines, and the configuration data is correctly interpreted by client computers when they evaluate their compliance.

When the Configuration Manager console cannot interpret some or all of the configuration content in an imported configuration item, you cannot create duplicate configuration items from it, or create a duplicate configuration baseline that references it. If some of the configuration content can be interpreted, you can create a child configuration item from it.

However, you cannot create child configuration items if the Configuration Manager console cannot interpret any of the configuration content (an uninterpreted configuration item).

When the Configuration Manager console cannot interpret the configuration content, this will also result in blank fields in the desired configuration management reports. For example, you will not see data for the setting or object properties.

For more information about uninterpreted configuration items, see About Authoring Configuration Data for Desired Configuration Management.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Baselines in Desired Configuration Management
About Content Versions in Desired Configuration Management
Determine If You Need To Author Configuration Data Outside the Configuration Manager Console for Desired Configuration Management
Determine If You Need to Create Child Configuration Items for Desired Configuration Management
Determine If You Need to Create Configuration Items for Desired Configuration Management
Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management
Determine If You Need to Import Configuration Data for Desired Configuration Management
Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management

Other Resources

How to Configure Configuration Items for Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


About Compliance and Compliance Information in Desired Configuration Management

Use the following information to understand the compliance information displayed in the Configuration Manager 2007 desired configuration management reports. The reports provide you with the information you need to determine why a client is non-compliant with assigned configuration baselines.

For a list of available reports, see About Reports for Desired Configuration Management.

Desired configuration management evaluates compliance on a number of different levels which consolidate to define the overall compliance of a computer. These levels include the following:

  • The compliance of a configuration item
  • The compliance of a configuration baseline rule
  • The compliance of each configuration baseline
  • The compliance of a client computer

The following sections explain how compliance is evaluated. For information about how the compliance information is sent to the site, see Compliance Sent As State Messages and Status Messages in Desired Configuration Management.

Evaluating the Compliance of a Configuration Item

When a client evaluates configuration items within an assigned configuration baseline, evaluation happens in the following order:

  • Applicability
  • Detection
  • Compliance of objects and settings

The results of the evaluation are reported as the configuration item's Actual Compliance, and reported as one of the values in the following table.

Actual Compliance Value Description

Not Applicable

This value is determined by the applicability property of the configuration item (for example, an exact Microsoft Windows platform version).

If the configuration item is not applicable to the client computer, detection is not evaluated, and the objects and settings in the configuration item are not evaluated.

Not Detected

This value is determined by the detection method configured for an application configuration item or the Windows version configured for an operating system configuration item.

If a configuration item is configured for detection and the configuration item is evaluated as not detected on a client computer, evaluation stops and the objects and settings in the configuration item are not evaluated.

Compliant or Non-Compliant

This value is determined by the object and settings properties and their configured valuation criteria, and the non-compliance severity level if the configured object or setting or does not exist on a client computer.

If the configuration item is applicable and detected, the configuration item is evaluated for compliance with its objects and settings, using the valuation criteria defined for them. The compliance for the configuration reports Compliant or Non-Compliant, as determined by the compliance evaluation.

Failed

This situation could arise as a result of invalid Service Modeling Language (SML) specified in the configuration item.

For more information about SML and its use in desired configuration management, see About Authoring Configuration Data for Desired Configuration Management.

For detailed information about how each configuration item is evaluated, see How Each Configuration Item is Evaluated for Compliance in Desired Configuration Management.

Evaluating the Compliance of a Configuration Baseline Rule

After a configuration item is evaluated for compliance, its Actual Compliance is then evaluated against the configuration baseline rule to which it is applied. The result of this evaluation determines the compliance of the configuration baseline rule.

The configuration baseline rules are as follows:

  • One of the following operating system configuration items must be present and properly configured.
  • These applications and general configuration items are required and must be properly configured.
  • If these optional application configuration items are detected, they must be properly configured.
  • These software updates must be present.
  • These application configuration items must not be present.
  • These configuration baselines must also be validated.

These configuration baseline rules are displayed in the reports as the Required Compliance.

The following table lists the Required Compliance for each configuration baseline rule.

Configuration Baseline Rule | Required Compliance
One of the following operating system configuration items must be present and properly configured. | One of many
These applications and general configuration items are required and must be properly configured. | Required
If these optional application configuration items are detected, they must be properly configured. | Optional
These software updates must be present. | Required
These application configuration items must not be present. | Prohibited
These configuration baselines must also be validated. | Required

The Actual Compliance value (Not Applicable, Detected, Compliant or Non-Compliant) is compared with the Required Compliance of the configuration baseline rule. The results of this comparison determine whether the configuration baseline rule is compliant, or non-compliant:

  • If the Actual Compliance aligns to the Required Compliance, the configuration item is compliant with its configuration baseline rule.
  • If the Actual Compliance conflicts with the required compliance, the configuration item is non-compliant with its configuration baseline rule.

The following table shows how the configuration item’s Actual Compliance aligns or conflicts with the Required Compliance of each configuration baseline rule, which determines the compliance of the configuration baseline rule.

Configuration Baseline Rule Required Compliance Actual Compliance values that results in the configuration baseline rule being Compliant Actual Compliance values that results in the configuration baseline rule being Non-compliant

One of the following operating system configuration items must be present and properly configured.

One of Many
  • Compliant
  • Not Detected
    (if no operating systems items are detected)
  • Non-Compliant
    (if any one operating system item is non-compliant)

These applications and general configuration items are required and must be properly configured.

Required
  • Not Applicable
  • Compliant
  • Non-Compliant

If these optional application configuration items are detected, they must be properly configured.

Optional
  • Not Applicable
  • Not Detected
  • Compliant
  • Non-compliant

These software updates must be present.

Required
  • Not Applicable
  • Compliant
  • Not Detected

These application configuration items must not be present.

Prohibited
  • Not Applicable
  • Not Detected
  • Compliant
  • Non-Compliant

These configuration baselines must also be validated.

Required
  • Compliant
  • Non-compliant

Evaluating the Compliance of Each Configuration Baseline

For each configuration baseline assigned to a client computer, the compliance status has one of the values in the following table.

Configuration Baseline Compliance Status Description

Unknown

There is no compliance information reported from the client.

This situation could arise as a result of any of the following circumstances:

  • The client computer has not yet received the configuration baseline in its machine policy.
  • The client computer has received the configuration baseline but has not completed its evaluation.
  • The client computer cannot contact its management point when it is due to send its first compliance evaluation report.

Failed

Compliance evaluation failed.

This situation could arise as a result of invalid Service Modeling Language (SML) specified in the configuration data.

For more information about SML and its use in desired configuration management, see About Authoring Configuration Data for Desired Configuration Management.

Compliant

If all configuration baseline rules evaluate as compliant, the configuration baseline itself will be compliant.

Non-Compliant

One or more configuration baseline rules evaluate as non-compliant (for example, a required application is not detected).

Evaluating the Compliance of a Client Computer

The overall compliance of a client computer depends on the compliance results of all the configuration baselines assigned to it. The possible compliance values for a client computer are the same compliance values as those used for a single configuration baseline. However, the compliance of all configuration baselines is aggregated.

For example, the client is compliant only if all configuration baselines evaluation as compliant. If a single configuration baseline from the total configuration baselines assigned to the client is non-compliant, the overall compliance of the client evaluates as non-compliant.

See Also

Tasks

How to Identify SML Compliance Evaluation Problems in Desired Configuration Management

Concepts

About Authoring Configuration Data for Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management
How Each Configuration Item is Evaluated for Compliance in Desired Configuration Management
Compliance Sent As State Messages and Status Messages in Desired Configuration Management
About the Non-Compliance Severity Level in Desired Configuration Management
About Reports for Desired Configuration Management
About Validation Criteria in Desired Configuration Management
Example Compliance Evaluation for a Desired Configuration Management Application Item


About Content Versions in Desired Configuration Management

Use the following information to help you understand the differences between configuration baseline (and configuration item) versions, and configuration baseline (and configuration item) content versions in Configuration Manager 2007. Both of these values are displayed in conjunction with configuration data in the Configuration Manager console, and in reports.

Configuration Baseline (and Configuration Item) Versions

Configuration baselines and configuration items in the Configuration Manager 2007 console have properties that are used for administrator control and information in Configuration Manager 2007, and do not form part of the evaluation on the client.

For configuration baselines, these properties are found on the General, Relationships, Assignment, and Security tabs of the configuration baseline properties, and include the following:

  • Display name and description
  • Configuration categories
  • Which configuration baselines reference it as a dependent configuration baseline
  • To which collections the configuration baseline is assigned, and their schedules
  • Auditing information, such as the site in which the configuration baseline was created or imported, and who last updated it and when
  • The security rights that define who can read, edit, and delete the configuration baselines

For configuration items, these properties are found on the General tab, the Relationships tab, and the Security tab of the configuration item properties. They include the following:

  • Display name and description
  • Configuration categories
  • Auditing information, such as the site in which the configuration item was created or imported, and who last updated it and when
  • The security rights that define who can read, edit, and delete the configuration item

The version count of the configuration data always increases by one whenever an administrator modifies these properties of a configuration baseline or configuration item. As an example, if the description of a configuration baseline is edited, the configuration baseline version increments by one.

Content Versions

Configuration baselines and configuration items in the Configuration Manager 2007 console also have content, the part of the configuration data that is downloaded to clients with assigned configuration baselines and used for compliance evaluation.

If you import configuration data into desired configuration management, you are importing the configuration data content. The other properties that you see in the Configuration Manager console, such as its display name and description, is defined or automatically created by the Configuration Manager administrator.

For configuration baselines, the content consists of the configuration rules and the configuration items they reference.

For configuration items, the content is defined with the properties found on the following tabs of the configuration item properties: Windows Version, Objects, Settings, Detection Method, and Applicability. They can include the following:

  • The objects and settings to be assessed by clients
  • The validation and validation criteria that will be used during compliance evaluation
  • The detection method used for application configuration items
  • The applicability for application and general configuration items

Whenever you modify these properties in a configuration baseline or a configuration item, the version count of the content increases by one. As an example, if you add a new setting to a configuration item, the configuration item content increments by one.

The Relationship Between Configuration Data Version and Content Version

The configuration data version and the content version do not always stay in step, because it is possible to modify configuration data without modifying the content.

For example, if you modify a configuration item without modifying the content (for example, add a new configuration category to a configuration item), the configuration item version will increase but the configuration item content will remain the same. However, if you modify the content, both the configuration item version and the content version will increment by one.

It is therefore important to display both versions so that you can track both of them in the Configuration Manager console and in reports.

You will also see a reference to both versions on the client, because although it is mainly the content that is downloaded to the client, an exception is the configuration baseline name and description. Although these properties are not used during the evaluation process, they are displayed on the client to help identify which configuration baselines are downloaded and their compliance state.

Multiple Versions for Configuration Data and Content

When you create and update configuration data in Configuration Manager 2007, previous versions are overwritten so that clients will always evaluate using the latest version. However, multiple versions can be stored and used by clients when the configuration data is imported into Configuration Manager 2007.

The compliance information for a configuration baseline or configuration item indicates which version was used for the evaluation. If a client evaluates different versions of the same configuration data or content, the reports show only one entry for the compliance information, not all values for each version evaluated. When the client evaluates compliance with multiple versions, it reports the results of the last version that was used during the compliance evaluation.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management
About Authoring Configuration Data for Desired Configuration Management
About Reports for Desired Configuration Management


About Configuration Categories in Desired Configuration Management

Configuration categories in Configuration Manager 2007 offer an optional method of sorting and filtering configuration baselines and configuration items within the Configuration Manager console, and in Configuration Manager reports. Configuration categories can be particularly useful when you have a high number of configuration items and configuration baselines to manage.

Both configuration items and configuration baselines in Configuration Manager 2007 share the same configuration categories and have the following default categories, which are examples:

  • Client
  • IT Infrastructure
  • Line of Business
  • Server

You cannot rename the examples, but you can delete them and add your own configuration categories. Configuration items and configuration baselines can belong to more than one configuration category at a time.

Configuration categories appear only in the Configuration Manager console, and in Configuration Manager reports. Configuration categories do not appear on the client Configurations tab or in reports generated from the client with the View Report button.

The category information is not included when you export configuration data to a file. However, configuration categories created in a parent site will be inherited by a child site, and configuration data inherited from a parent site will retain its configuration category information from the parent site.

If you want to add a configuration category to a configuration baseline or configuration item that is imported, or inherited from a parent site, use the Manage Categories action. For more information, see How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management.

See Also

Tasks

How to Create Configuration Categories in Desired Configuration Management
How to Delete Configuration Categories in Desired Configuration Management
How to Use Assigned Configuration Categories in Desired Configuration Management


About Authoring Configuration Data for Desired Configuration Management

Configuration Manager 2007 supports the authoring of configuration data, which consists primarily of configuration baselines and configuration items, in the Configuration Manager console. Configuration Manager is able to present this configuration data in a user-friendly format called DCM Digest, which is a specialized XML document that Configuration Manager uses. You can author configuration data using the Configuration Manager console, or by directly authoring a DCM Digest XML file or Service Modeling Language (SML) file.

Note
For information about the Service Modeling Language, see the SML Workgroup Web site (http://go.microsoft.com/fwlink/?LinkId=78992) and reference the following Web site: http://go.microsoft.com/fwlink/?LinkId=78991.

Configuration data that is created with the Configuration Manager console can be exported into a .cab (cabinet) file. When configuration data is imported into Configuration Manager, the format can be one of the following:

  • DCM Digest XML only.
  • SML XML only.
  • SML XML that contains some DCM Digest XML schema.

Imported configuration data that contains only DCM Digest XML is converted into SML XML during the import process, and all configuration data is displayed and can be modified.

When the imported configuration data consists of SML XML only or contains some DCM Digest XML, some configuration item details might not be displayed in the Configuration Manager console. However, you can still add those configuration items to configuration baselines, and the configuration data is correctly interpreted by client computers when they evaluate their compliance.

Note
When the configuration data is SML XML only, and the Configuration Manager console is unable to interpret it, it is displayed as an uninterpreted configuration item.

Authoring Configuration Data

You can create configuration data in the following ways:

  • You can create configuration data externally with an XML editor and then import it into Configuration Manager if it is first packaged as a .cab file.
  • You can create configuration data within Configuration Manager by using the following wizards:
    • Create Application Configuration Item Wizard
    • Create Operating System Configuration Item Wizard
    • Create General Configuration Item Wizard
    • Create Configuration Baseline

You can also import configuration data that has been published by Microsoft and other software vendors and solution providers as best practices in Microsoft System Center Configuration Manager 2007 Configuration Packs. You can download Configuration Packs from the Microsoft System Center Configuration Manager 2007 Configuration Packs Web page (http://go.microsoft.com/fwlink/?LinkId=71837).

Note
Published configuration data can be digitally signed so that you can verify the publishing source and be sure that the data has not been tampered with. If the digital signature verification check fails, you will be warned and prompted to continue with the import. It is recommended you import only configuration data from external sources if it has a valid digital signature from a trusted publisher.

After the configuration data is imported into the Configuration Manager 2007 site, it can then be managed in the Configuration Manager console, and used to create configuration baseline assignments. For more information, see Desired Configuration Management Administrator Workflows and Desired Configuration Management Checklists.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management
Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management

Other Resources

How to View Compliance Results for Desired Configuration Management
How to Configure Configuration Baselines for Desired Configuration Management
How to Configure Configuration Items for Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


About the Non-Compliance Severity Level in Desired Configuration Management

The non-compliance severity level in Configuration Manager 2007 allows you to rate the severity of the non-compliance status so that you can prioritize attention and remedial action. It can be configured for two purposes:

  • When an object or setting within a configuration item is not present on the client computer.
  • When an object or setting within a configuration item is present on the client computer but fails the validation criteria.

Because you can have many objects or settings within a single configuration item, each with their own non-compliance severity level, the client's compliance evaluation for that configuration item will record the highest non-compliant severity level. Similarly, because a configuration baseline typically contains a number of configuration items, the client's compliance evaluation for the configuration baseline will record the highest non-compliant severity level reported by the configuration items it contains.

These non-compliance details are reported to the site in state messages. In addition, clients send status messages when the compliance status of a configuration item or configuration baseline changes from one compliance status to another, for example, from unknown to compliant or from compliant to non-compliant on re-evaluation. For more information about sending compliance information, see Compliance Sent As State Messages and Status Messages in Desired Configuration Management.

Non-compliance severity levels are also used to produce Microsoft Windows application event messages. These can be displayed on the client computer and collected by management products such as Microsoft System Center Operations Manager 2007. Management products can often be configured to take automatic action on the collected Windows events if they match defined criteria. For example, you could run automatic scripts if critical servers reported non-compliance, or you could send an e-mail to administrators to warn them about desktop misconfiguration.

The non-compliance severity level can be configured with the following options:

  • Information - no Windows event messages: Computers that are not compliant with one or more of the objects or settings in the configuration item (either not present or present but fail the validation criteria) do not log a Windows application event message. Computers send a state message and status message with the non-compliant severity level of Information.
  • Information: Computers that are not compliant with one or more of the objects or settings in the configuration item (either not present or present but fail the validation criteria) log a Windows application event message of the type Informational. State messages and status messages sent by the client will have the non-compliant severity level of Information.
  • Warning: Computers that are not compliant with one or more of the objects or settings in the configuration item (either not present or present but fail the validation criteria) log a Windows application event message of the type Warning. State messages and status messages sent by the client will have the non-compliant severity level of Warning.
  • Error: Computers that are not compliant with one or more of the objects or settings in the configuration item (either not present or present but fail the validation criteria) log a Windows application event message of the type Error. State messages and status messages sent by the client will have the non-compliant severity level of Error.

In addition to using the Windows application events, you can use the status messages in Configuration Manager 2007 to filter on non-compliance results in the Desired Configuration Management home page, in reports, and in queries.

See Also

Tasks

How to Use the Non-Compliance Severity Level
How to Use the Desired Configuration Management Home Page

Concepts

About Configuration Items in Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Compliance and Compliance Information in Desired Configuration Management
About Reports for Desired Configuration Management
Example Scenarios for Implementing Desired Configuration Management


About Validation Criteria in Desired Configuration Management

The validation criteria in Configuration Manager 2007 define how objects and settings within a configuration item are considered compliant or non-compliant. For example, a registry setting can be considered compliant if it is a set value or a range of values that you consider acceptable.

The validation criteria you can specify depends on the data type of the object property or setting.

String operators:

  • Equals
  • Not Equals
  • One Of
  • Begins With
  • Ends With
  • Contains
  • Matches
  • All Of
  • None Of
  • Does not begin with
  • Does not end with
  • Does not contain
  • Does not match

Date and time, integer, floating point, and version operators:

  • Equals
  • Not Equals
  • One Of
  • Greater Than
  • Less Than
  • Between
  • None Of
  • Greater than or equal to
  • Less than or equal to

You can also validate the following file and folder attributes as on, off, or choose to not validate them:

  • Archive
  • Compressed
  • Encrypted
  • Hidden
  • Read Only
  • System

Additionally you can validate the Windows security permissions on registry key objects and on file or folder objects. Permissions can be validated exclusively or non-exclusively. Exclusive validation on permissions means that permissions and groups or users that are not specified, or are specified but not found will result in a non-compliance status. Non-exclusive validation on permissions means that permissions and groups or users that are not specified will not be included when assessing compliance.

See Also

Tasks

How to Edit a Configuration Item in Desired Configuration Management

Concepts

About Configuration Items in Desired Configuration Management


About Compliance Evaluation Schedules in Desired Configuration Management

Topic Last Updated—August 2008

Configuration Manager 2007 clients download configuration baseline assignments with their machine policy, and the actual configuration baseline, with associated dependent configuration baselines and configuration items, is then downloaded within the next two hours. However, the configuration baselines will not be evaluated until their scheduled compliance evaluation time or unless you manually initiate evaluation on the client. Clients that have not yet evaluated their compliance with assigned configuration baselines will report their compliance as Unknown.

Note
If you need to manually initiate evaluation outside the defined compliance evaluation schedule, on Configuration Manager in the Control Panel, click the Configurations tab, select the configuration baselines, and then click Evaluate.

The client ensures that it has the correct version of the configuration data referenced in the configuration baseline assignments before it begins its evaluation. If necessary, the client downloads the configuration data from the site's default management point.

The evaluation schedule initiates a compliance evaluation that starts randomly within the next two hours. This random initiation ensures that the management point is not saturated with compliance results from multiple clients at the same time. The actual evaluation time is displayed on the client Configurations tab and in desired configuration management reports.

The compliance results are sent to the client's assigned management point in state messages and status messages. For more information, see Compliance Sent As State Messages and Status Messages in Desired Configuration Management.

Important
The client's compliance evaluation results are cached locally, for 15 minutes. Unless the client has received notification from its configuration baseline assignment that configuration data has been modified since its last evaluation, the client will not re-evaluate its compliance within this 15 minute window, even if you specify a shorter evaluation compliance schedule or click Evaluate in the Configurations tab.

There is a compliance evaluation schedule associated with each configuration baseline, and clients evaluate compliance with each configuration baseline according to the related schedule. If the computer is not currently connected to the network but the client has downloaded all the configuration data referenced in the assigned configuration baselines, the client performs offline evaluation. When the computer is next connected to the network, the cached compliance information is sent to its management point.

There is a default compliance evaluation schedule of one week configured for the site, which you can modify with your preferred default evaluation schedule. This value is then displayed when you assign a configuration baseline. However, you can override this default value during the assignment process so that if necessary, each assigned configuration baseline has an independent compliance evaluation schedule. For example, you might want to increase the frequency of how often you evaluate for compliance with selected configuration baselines because they monitor configurations that are more likely to change, or because they are high-priority configurations.

As with other schedules within Configuration Manager, the compliance evaluation schedules can be configured as a simple schedule (such as every 6 hours) or a custom schedule (such as every Sunday at 2 a.m.). By default, the time specified is evaluated in the client's local time. To change this to coordinated universal time (UTC), specify a custom schedule for the configuration baseline assignment and then select the UTC option.

See Also

Tasks

How to Assign Configuration Baselines in Desired Configuration Management
How to Configure the Default Compliance Evaluation Schedule for Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
Best Practices for Desired Configuration Management


About Reports for Desired Configuration Management

Use the following reports to view information related to Configuration Manager 2007 desired configuration management, such as compliance information and results.

Configuration Baseline Assignment Information

The following reports have the report category of Desired Configuration Management Assignment:

  • Configuration baseline assignments for a computer
  • Configuration baseline assignments by collection

For more information about configuration baseline assignments, see About Configuration Baselines in Desired Configuration Management.

Compliance Results

The following reports have the report category of Desired Configuration Management - Compliance:

  • Summary compliance for a configuration item by computer
  • Summary compliance for a collection by computer
  • Summary non-compliance a configuration item by validation criteria
  • Summary non-compliance a configuration baseline by validation criteria
  • Non-compliance details for a configuration item on a computer
  • Computers reporting non-compliance for a specific configuration item validation criteria
  • Summary compliance by configuration item
  • Summary compliance by configuration baseline
  • Compliance for a computer by configuration baseline
  • Compliance details for a configuration baseline
  • Compliance for a computer by configuration item
  • Compliance history for a configuration item on a computer

For more information about the compliance information in the reports, see About Compliance and Compliance Information in Desired Configuration Management

Compliance Evaluation Errors

The following reports have the report category of Desired Configuration Management - Errors:

  • Computers with compliance evaluation failures for a specific configuration item
  • Computers with compliance evaluation failures
  • Computers with compliance evaluation failures for a specific configuration baseline
  • All compliance evaluation failures for a given computer
  • Compliance evaluation errors for a configuration baseline on a computer
  • Compliance evaluation errors for a configuration item on a computer

Compliance evaluation might fail because the configuration data containing Service Modeling Language (SML) is not in a valid format, or because the desired configuration management client agent failed to find the objects or settings specified in the configuration data (a discovery failure). For more information about the use of SML with desired configuration management, see About Authoring Configuration Data for Desired Configuration Management.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management
About Configuration Manager Reports

Other Resources

Desired Configuration Management in Configuration Manager
How to View Compliance Results for Desired Configuration Management


About Desired Configuration Management in Configuration Manager Hierarchies

Each site within a Configuration Manager 2007 hierarchy can be enabled or disabled for desired configuration management by enabling or disabling the desired configuration management client agent. Client computers must have installed the Configuration Manager 2007 client and the .NET Framework 2.0 (or later) to support the desired configuration management client agent. Desired configuration management is fully supported with Internet-based client management.

Sites that do not have the desired configuration management client agent enabled can still import and create configuration items and configuration baselines, and they can assign configuration baselines to collections. Desired configuration management works in a similar manner to software distribution packages and advertisements in Configuration Manager in that configuration data that is inherited from parent sites cannot be edited or deleted on child sites, but new configuration items and configuration baselines can be created that will be inherited by further child sites.

You can identify the site at which the configuration baseline or configuration item was created or imported by viewing the Site Code for the configuration baseline or configuration item. This is displayed by default in the home pages of configuration baselines and configuration items, together with other properties to help identification such as the version number, creation and modification date, and by whom it was created and edited. You can also find this information on the General tab of the configuration baseline or configuration item.

Clients always download assigned configuration baselines with their machine policy from their management point (or proxy management point in a Configuration Manager 2007 secondary site), and they send compliance information back to their management point (or Configuration Manager 2007 proxy management point). There is no interaction with distribution points or other site systems, so there are no changes to behavior when roaming.

See Also

Tasks

How to Enable or Disable the Desired Configuration Management Client Agent
How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management
How to Use the Results Columns in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
Prerequisites for Desired Configuration Management
Configuration Baselines Home Page
Configuration Items Home Page


About Forefront Client Security Integration with Configuration Manager 2007 R2

Topic last updated—January 2008

Microsoft Forefront Client Security provides unified virus and spyware protection for business desktops, laptops, and server operating systems. You can use desired configuration management to monitor the Client Security agent on clients managed by Microsoft System Center Configuration Manager 2007 R2 sites.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

To monitor the Client Security agent, you import the configuration pack included on the Configuration Manager 2007 R2 CD, assign the baseline to a collection that contains computers running the Client Security agent, and then monitor the compliance evaluation reports as you would for any other configuration baseline. No additional installation or configuration is needed.

Configuration Manager 2007 does not actually report back about malware or viruses detected; those alerts are monitored by Client Security as long as the Client Security agent is operating correctly.

Monitoring the Client Security Agent

This scenario demonstrates how customers can compare the configuration of their Client Security agent against best practices specified in the Microsoft System Center Configuration Manager 2007 Forefront Client Security Configuration Pack and can detect a potentially detrimental configuration before it negatively affects service level agreements (SLAs).

A. Datum Corporation has deployed Client Security as its antivirus and antispyware solution. Although the Client Security agent is quite reliable, Ellen Adams, a security administrator, wants to know if any clients are not actively using Client Security. Ellen has the goal of obtaining 99.5% compliance with Client Security configuration on all computers running the Client Security agent. Users who disable the Client Security agent might be subject to disciplinary action under the company security policy.

Tommy Hartono, the Configuration Manager administrator, learned that Microsoft published a configuration pack for Client Security in Configuration Manager 2007 R2 that can be applied with desired configuration management in Configuration Manager 2007. They decide to follow the course of action in the following table.

Process | Reference
Tommy checks that the company's Configuration Manager 2007 site is enabled for desired configuration management and that all clients have the Microsoft .NET Framework version 2 or later. | How to Enable or Disable the Desired Configuration Management Client Agent How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management
Tommy runs the Windows Installer file \FCS\FCSConfigPack.msi to extract the configuration baseline FCS_Configuration _Pack.cab to his local hard drive. He then opens the Configuration Manager console and imports the FCS_Configuration _Pack.cab, accepting all of the default wizard options. | How to Import Configuration Items in Desired Configuration Management
Tommy and Ellen review the configuration baseline and the configuration items created by the Import Configuration Data Wizard. They decide not to change any of the default configurations. | Configuration Baselines Home Page Configuration Items Home Page
They assign the configuration baseline to a collection that contains clients running the Client Security agent and configure the evaluation schedule to run every two hours. | How to Assign Configuration Baselines in Desired Configuration Management How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management
When the compliance evaluation results are reported to the site, they view the compliance reports and confirm that there are no business requirements that explain why the clients are configured differently than Microsoft best practices configurations. | How to View Compliance Results for Desired Configuration Management
Tommy monitors the compliance of the laptops using the desired configuration management home page. | How to Use the Desired Configuration Management Home Page
Ellen checks the compliance reports every morning and investigates any non-compliance results before they put the company's computers at risk by not monitoring for viruses and malware. | Company-specific process.

Three months later, as a possible result of the desired configuration management implementation described in the preceding scenario, Ellen confirms that 99.99% of the clients in the organization are running Client Security and that they have sufficient uptime to reduce the risks posed by viruses and malware.

See Also

Other Resources

Overview of Desired Configuration Management


Desired Configuration Management Administrator Workflows

Use the following administrator workflows when using desired configuration management in Configuration Manager 2007 with imported best practices configuration data from Microsoft® System Center Configuration Manager 2007 Configuration Packs.

Configuration Packs from Microsoft and other software vendors and solution providers can be downloaded from the Microsoft® System Center Configuration Manager 2007 Configuration Packs Web page (http://go.microsoft.com/fwlink/?LinkId=71837).

Click any link in the following section for more information about the available administrator workflows that provide a recommended path to using Configuration Packs with Configuration Manager 2007.

Note
More information for each step of the workflows can be found in the corresponding administrator checklist. See Desired Configuration Management Checklists.

In This Section

Administrator Workflow: Using a Configuration Baseline from a Configuration Pack

Provides a dataflow for a recommended path to compare the configuration of computers on your network with a configuration baseline from a Configuration Pack.

Administrator Workflow: Creating a Configuration Baseline with Configuration Items from a Configuration Pack

Provides a dataflow for a recommended path to creating a configuration baseline using configuration items from a Configuration Pack.

Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Adding Configuration Items

Provides a dataflow for a recommended path to refining a configuration baseline from a Configuration Pack, by adding new configurations to include in the compliance assessment.

Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Modifying Configuration Items

Provides a dataflow for a recommended path to refining a configuration baseline from a Configuration Pack, by adding new properties to the specified configuration items.

Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Modifying the Configuration Baseline Rules

Provides a dataflow for a recommended path to refining a configuration baseline from a Configuration Pack, by modifying the configuration baseline rules.

See Also

Other Resources

Desired Configuration Management Checklists


Administrator Workflow: Using a Configuration Baseline from a Configuration Pack

This administrator workflow displays the recommended steps to use a configuration baseline from a Microsoft® System Center Configuration Manager 2007 Configuration Pack in Configuration Manager 2007.

The workflow should be used in conjunction with the following topic: Administrator Checklist: Using a Configuration Baseline from a Configuration Pack.

DCM workflow: Using Best Practices baseline

See Also

Concepts

Desired Configuration Management Administrator Workflows

Other Resources

Desired Configuration Management in Configuration Manager


Administrator Workflow: Creating a Configuration Baseline with Configuration Items from a Configuration Pack

This administrator workflow displays the recommended steps to create a configuration baseline with Configuration Manager 2007 using configuration items from a Microsoft System Center Configuration Manager 2007 Configuration Pack.

The workflow should be used in conjunction with the following topic: Administrator Checklist: Creating a Configuration Baseline with Configuration Items from a Configuration Pack.

DCM workflow: Add Best Practices to new baseline

See Also

Concepts

Desired Configuration Management Administrator Workflows

Other Resources

Desired Configuration Management in Configuration Manager


Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Adding Configuration Items

This administrator workflow displays the recommended steps to refine a configuration baseline from a Microsoft System Center Configuration Manager 2007 Configuration Pack, by adding new configurations items in Configuration Manager 2007 to include in the compliance assessment.

The workflow should be used in conjunction with the following topic: Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Adding Configuration Items.

DCM workflow: Add to Best Practices baseline

See Also

Concepts

Desired Configuration Management Administrator Workflows

Other Resources

Desired Configuration Management in Configuration Manager


Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Modifying Configuration Items

This administrator workflow displays the recommended steps to refine a configuration baseline from a Microsoft System Center Configuration Manager 2007 Configuration Pack, by adding new properties to the specified configuration items in Configuration Manager 2007 to be included in the compliance evaluation.

The workflow should be used in conjunction with the following topic: Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Modifying Configuration Items.

DCM workflow: Edit Best Practices baseline -1

See Also

Concepts

Desired Configuration Management Administrator Workflows

Other Resources

Desired Configuration Management in Configuration Manager


Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Modifying the Configuration Baseline Rules

This administrator workflow displays the recommended steps to refine a configuration baseline from a Microsoft® System Center Configuration Manager 2007 Configuration Pack, by modifying the configuration baseline rules in Configuration Manager 2007 to be evaluated for compliance on client computers.

The workflow should be used in conjunction with the following topic: Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Modifying the Configuration Baseline Rules.

DCM workflow: Edit Best Practices baseline -2

See Also

Concepts

Desired Configuration Management Administrator Workflows

Other Resources

Desired Configuration Management in Configuration Manager


Desired Configuration Management Checklists

Use the following administrator checklists when using desired configuration management in Configuration Manager 2007 with imported best practices configuration data from Microsoft® System Center Configuration Manager 2007 Configuration Packs.

Configuration Packs from Microsoft and other software vendors and solution providers can be downloaded from the Microsoft® System Center Configuration Manager 2007 Configuration Packs Web page (http://go.microsoft.com/fwlink/?LinkId=71837).

Click any link in the following section for more information about the available administrator checklists that provide a recommended path to using Configuration Packs with Configuration Manager 2007.

Note
These checklists are also displayed as administrator workflows. See Desired Configuration Management Administrator Workflows.

In This Section

Administrator Checklist: Using a Configuration Baseline from a Configuration Pack

Provides a checklist for a recommended path to compare the configuration of computers on your network with a configuration baseline from a Configuration Pack.

Administrator Checklist: Creating a Configuration Baseline with Configuration Items from a Configuration Pack

Provides a checklist for a recommended path to creating a configuration baseline using configuration items from a Configuration Pack.

Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Adding Configuration Items

Provides a checklist for a recommended path to refining a configuration baseline from a Configuration Pack, by adding new configurations to include in the compliance assessment.

Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Modifying Configuration Items

Provides a checklist for a recommended path to refining a configuration baseline from a Configuration Pack, by adding new properties to the specified configuration items.

Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Modifying the Configuration Baseline Rules

Provides a checklist for a recommended path to refining a configuration baseline from a Configuration Pack, by modifying the configuration baseline rules.

See Also

Concepts

Desired Configuration Management Administrator Workflows


Administrator Checklist: Using a Configuration Baseline from a Configuration Pack

The following checklist provides a recommended path in Configuration Manager 2007 to compare the configuration of computers on your network with a configuration baseline from a Microsoft System Center Configuration Manager 2007 Configuration Pack.

Step | Reference
Ensure the site is configured for desired configuration management. | Configuring Desired Configuration Management
Download the Configuration Pack, and import it. | How to Import a Configuration Baseline in Desired Configuration Management
Assign the configuration baseline to a collection, and configure the compliance evaluation schedule. | How to Assign Configuration Baselines in Desired Configuration Management How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management
View compliance results. | How to Use the Desired Configuration Management Home Page How to View Compliance with Assigned Configuration Baselines

See Also

Concepts

Administrator Workflow: Using a Configuration Baseline from a Configuration Pack

Other Resources

Desired Configuration Management Checklists
Desired Configuration Management in Configuration Manager


Administrator Checklist: Creating a Configuration Baseline with Configuration Items from a Configuration Pack

The following checklist provides a recommended path to creating a configuration baseline in Configuration Manager 2007, using configuration items from a Microsoft® System Center Configuration Manager 2007 Configuration Pack.

Step | Reference
Ensure the site is configured for Desired Configuration Management. | Configuring Desired Configuration Management
Download the Configuration Pack, and import it. | How to Import Configuration Items in Desired Configuration Management
Create a configuration baseline and add the imported configuration items with the configuration baseline rules you require. | How to Create a New Configuration Baseline in Desired Configuration Management
Assign the new configuration baseline to a collection, and configure the compliance evaluation schedule. | How to Assign Configuration Baselines in Desired Configuration Management How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management
View compliance results. | How to View Compliance with Assigned Configuration Baselines How to View Compliance of a Configuration Item
If you need to make refinements to the Configuration Pack configuration items, create child configuration items and edit the child configuration items. | How to Create a Child Configuration Item in Desired Configuration Management How to Edit a Configuration Item in Desired Configuration Management
Edit the configuration baseline and replace the Configuration Pack configuration items with the edited child configuration items. | How to Remove a Configuration Item from a Configuration Baseline in Desired Configuration Management How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
When new versions of the Configuration Pack become available, download them and import them. You do not need to make modifications to your assigned baseline. | How to Import Configuration Items in Desired Configuration Management

See Also

Concepts

Administrator Workflow: Creating a Configuration Baseline with Configuration Items from a Configuration Pack

Other Resources

Desired Configuration Management Checklists
Desired Configuration Management in Configuration Manager


Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Adding Configuration Items

The following checklist provides a recommended path to refine a configuration baseline from a Microsoft System Center Configuration Manager 2007 Configuration Pack, by adding new configurations items in Configuration Manager 2007 to include in the compliance assessment.

Step | Reference
Ensure the site is configured for desired configuration management. | Configuring Desired Configuration Management
Download the Configuration Pack, and import it. | How to Import a Configuration Baseline in Desired Configuration Management
Create the new configuration items that you need. | How to Create a New Configuration Item in Desired Configuration Management
Create a new configuration baseline and add your newly created configuration items to it. | How to Create a New Configuration Baseline in Desired Configuration Management
Add the Configuration Pack configuration baseline to your newly created configuration baseline. | How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management
Assign the new configuration baseline to a collection and configure the compliance evaluation schedule. | How to Assign Configuration Baselines in Desired Configuration Management How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management
View compliance results. | How to View Compliance with Assigned Configuration Baselines How to View Compliance of a Configuration Item
If you need to make revisions to your configuration items, modify them. | How to Edit a Configuration Item in Desired Configuration Management
Continue to monitor compliance results and either revise your configuration items or remediate non-compliant computers. | How to View Compliance Results for Desired Configuration Management
When new versions of the Configuration Pack become available, download them, and then import them into Configuration Manager 2007. You do not need to make modifications to your assigned baseline. | How to Import a Configuration Baseline in Desired Configuration Management

See Also

Concepts

Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Adding Configuration Items

Other Resources

Desired Configuration Management Checklists
Desired Configuration Management in Configuration Manager


Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Modifying Configuration Items

The following checklist provides a recommended path to refine a configuration baseline from a Microsoft System Center Configuration Manager 2007 Configuration Pack, by adding new properties in Configuration Manager 2007 to the specified configuration items to include in the compliance assessment.

Step | Reference
Ensure the site is configured for desired configuration management. | Configuring Desired Configuration Management
Download the Configuration Pack, and import it. | How to Import a Configuration Baseline in Desired Configuration Management
Create child configuration items for the imported configuration items you want to refine. | How to Create a Child Configuration Item in Desired Configuration Management
Edit the child configuration items for the values you need to refine. | How to Edit a Configuration Item in Desired Configuration Management
Duplicate the imported configuration baseline. | How to Create a Duplicate Configuration Baseline in Desired Configuration Management
Replace the configuration items in the duplicated configuration baseline with the edited child configuration items. | How to Remove a Configuration Item from a Configuration Baseline in Desired Configuration Management How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
Assign the new configuration baseline to a collection, and configure the compliance evaluation schedule. | How to Assign Configuration Baselines in Desired Configuration Management How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management
View compliance results. | How to View Compliance with Assigned Configuration Baselines How to View Compliance of a Configuration Item
If you need to make revisions to your child configuration items, modify them. | How to Edit a Configuration Item in Desired Configuration Management
Continue to monitor compliance results and either revise your child configuration items or remediate non-compliant computers. | How to View Compliance Results for Desired Configuration Management
When new versions of the Configuration Pack become available, download them, and then import them into Configuration Manager 2007. You do not need to make modifications to your assigned baseline unless you need to make revisions to your child configuration items as a result of the new configuration baseline version. | How to Import a Configuration Baseline in Desired Configuration Management

See Also

Concepts

Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Modifying Configuration Items

Other Resources

Desired Configuration Management Checklists
Desired Configuration Management in Configuration Manager


Administrator Checklist: Refining a Configuration Baseline from a Configuration Pack by Modifying the Configuration Baseline Rules

The following checklist provides a recommended path to refine a configuration baseline from a Microsoft® System Center Configuration Manager 2007 Configuration Pack, by modifying the configuration baseline rules in Configuration Manager 2007.

Step | Reference
Ensure the site is configured for desired configuration management. | Configuring Desired Configuration Management
Download the Configuration Pack, and import it. | How to Import a Configuration Baseline in Desired Configuration Management
Duplicate the imported configuration baseline. | How to Create a Duplicate Configuration Baseline in Desired Configuration Management
If you need to remove configuration items from the configuration baseline rules, remove them from the duplicated configuration baseline. | How to Remove a Configuration Item from a Configuration Baseline in Desired Configuration Management
If you need to add configuration items to the configuration baseline rules, add them to the duplicated configuration baseline. | How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
Assign the new configuration baseline to a collection, and configure the compliance evaluation schedule. | How to Assign Configuration Baselines in Desired Configuration Management How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management
View compliance results. | How to View Compliance with Assigned Configuration Baselines How to View Compliance of a Configuration Item
If you need to make revisions to your configuration items, modify them in the duplicated configuration baseline. | How to Edit a Configuration Item in Desired Configuration Management
Continue to monitor compliance results and either revise your configuration items, or remediate noncompliant computers. | How to View Compliance Results for Desired Configuration Management
When new versions of the Configuration Pack become available, download them, and then import them into Configuration Manager 2007. The original configuration items that are still referenced in the duplicate configuration baseline will be automatically upgraded with any revisions. However, if new configuration items are added to the Configuration Pack configuration baseline, you will need to add these to the duplicated configuration baseline. | How to Import a Configuration Baseline in Desired Configuration Management How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management

See Also

Concepts

Administrator Workflow: Refining a Configuration Baseline from a Configuration Pack by Modifying the Configuration Baseline Rules

Other Resources

Desired Configuration Management Checklists
Desired Configuration Management in Configuration Manager


Prerequisites for Desired Configuration Management

Topic Last Updated—August 2008

Desired configuration management has both external dependencies and dependencies within the product.

Dependencies External to Configuration Manager 2007

Dependency | More Information
Clients must be running the Microsoft .NET Framework v2.0 or later. | This is supplied with the latest operating systems, such as Windows Vista, and is also available to download through Windows Update. For computers that do not have at least version 2.0 of the NET Framework, you can download it from the Web (http://go.microsoft.com/fwlink/?LinkID=56407) and install it through software distribution or other deployment mechanisms.

Configuration Manager 2007 Dependencies

Dependency | More Information
The site must be running Configuration Manager 2007 and be enabled for desired configuration management. | This is the default for all new sites and for sites that have been upgraded to Configuration Manager 2007. It is achieved by enabling the desired configuration management client agent. For more information, see How to Enable or Disable the Desired Configuration Management Client Agent.
Reporting Point Site System | The reporting point site system role must be installed before desired configuration management reports can be displayed. For more information about creating a reporting point, see How to Create a Reporting Point.
Clients must be Configuration Manager 2007. | Clients running Systems Management Server (SMS) 2003 are not supported.

See Also

Tasks

How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management


Planning for Desired Configuration Management

The Configuration Manager 2007 desired configuration management feature is highly flexible and modular in providing a number of different ways for you to assess the compliance of computers using configuration baselines and configuration items. Planning for desired configuration management will help you identify the tasks you need to accomplish to meet your business requirements.

Click any link in the following section for planning information about using desired configuration management in Configuration Manager 2007.

In This Section

Best Practices for Desired Configuration Management

Provides best practice information about implementing desired configuration management.

Preparing the Site for Desired Configuration Management

Provides information about the dependencies and configuration required to run desired configuration management.

Determine If You Need to Import Configuration Data for Desired Configuration Management

Helps you decide if you need to import configuration data.

Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management

Helps you decide if you need to create duplication configuration baselines or duplicate configuration items.

Determine If You Need to Create Child Configuration Items for Desired Configuration Management

Helps you decide if you need to create child configuration items.

Determine If You Need to Create Configuration Baselines for Desired Configuration Management

Helps you decide if you need to create configuration baselines.

Determine If You Need to Create Configuration Items for Desired Configuration Management

Helps you decide if you need to create configuration items.

Choose the Configuration Item Type to Create for Desired Configuration Management

Helps you decide which configuration item type you need for desired configuration management.

Determine If You Need To Author Configuration Data Outside the Configuration Manager Console for Desired Configuration Management

Helps you decide if you need to create configuration data externally to Configuration Manager.

Determine If You Need to Export Configuration Data for Desired Configuration Management

Helps you decide if you need to export configuration data.

See Also

Other Resources

Desired Configuration Management in Configuration Manager


Best Practices for Desired Configuration Management

Topic last updated—November 2007

Use the following best practices for desired configuration management in Configuration Manager 2007.

Note
For best practices relating to security and desired configuration management, see Desired Configuration Management Security Best Practices and Privacy Information.

  • Author configuration items that combine multiple objects and settings when these define compliance at the level of independent change.
    Combining logically related objects and settings in a single configuration item rather than defining a single configuration item for each individual object or setting provides better client-side performance when evaluating compliance. It also greatly reduces the number of configuration items for an administrator to manage and for the site to replicate down the Configuration Manager hierarchy.
    Additionally, combining related objects and settings into a single configuration item greatly simplifies the administrative tasks related to a configuration item, including remediation of non-compliant settings. Managing individual settings for an application or component presents an unwieldy approach to configuration management.
    For example, define compliance for server roles, such as Microsoft Exchange mailbox server, rather than through individual Windows or application settings, even if these individual settings are used by more than one server role. An administrator without specialized knowledge of the individual settings that make up compliance for a server role can then use it in his or her configuration baseline.
  • Provide meaningful display names and descriptions for configuration data (and configuration categories) so that they can be used by other administrators without the need to check and interpret their properties.
    Desired configuration management is designed to abstract the complexity of defining computer compliance so that configuration data can be used by administrators who do not have detailed knowledge of the compliance information but want to make use of it. The display names and descriptions should be sufficient for another administrator to successfully identify its purpose without having to understand its contents.
    Additionally, using a standard naming format will help administrators efficiently search and find configuration data.
  • Minimize the number of configuration items, dependent configuration baselines, and configuration baselines that are targeted to computers to define desired compliance.
    Having an unnecessarily high number of configuration items and configuration baselines evaluated on a computer will have a negative impact on client performance. Aim to define desired compliance in as few configuration items and configuration baselines as possible.
  • Use child configuration items where possible, rather than duplicating configuration items.
    Child configuration items provide reuse and a layered administration approach that provides an efficient method of refining the required compliance for different roles. For example, a parent configuration item can identify basic settings and objects once, with multiple child configuration items adding their own compliance requirements that are suitable for different server roles. If the compliance requirements for the basic settings and objects change, they need be changed only once, and this change is automatically inherited by all the child configuration items.
    Similarly, when child configuration items are created from imported configuration data, such as Microsoft System Center Configuration Packs, an administrator can import a later version (for example, when Microsoft or a vendor releases an upgrade to one of their Configuration Packs), and the child configuration item will automatically use the updated parent configuration item.
    For more information about whether you should create a child configuration item or a duplicate configuration item, see Determine If You Need to Create Child Configuration Items for Desired Configuration Management and Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management.
  • Schedule compliance evaluations according to business requirements and available computing resources.
    Each configuration baseline assignment has its own evaluation schedule. Configure the schedule such that up-to-date compliance information is available when it is most likely to be required. For example, this might be before the beginning of an administrative work shift so that staff has current configuration information, or immediately after a scheduled maintenance window to confirm the changes that were made.
    Also, allow sufficient time for computers to evaluate their compliance and send their compliance information to its site. The client does not initiate evaluation immediately at the scheduled time, but within a two-hour window. For more information, see About Compliance Evaluation Schedules in Desired Configuration Management.
    Because compliance evaluation consumes computer resources, do not schedule compliance evaluations too frequently without first assessing the impact on users. For this reason, you will probably want to evaluate workstations less frequently than servers.
  • Use wildcards and searches with caution.
    It is possible and sometimes justified to create configuration items that use wildcards and extensive searches. Be mindful of their impact on both the computer when undergoing evaluation, and related activity. For example, searching for files with wildcards will have a negative impact on the computer CPU usage as well as disk activity, and searching multiple locations in Active Directory Domain Services will have an impact on domain controllers and network bandwidth.

See Also

Concepts

Desired Configuration Management Security Best Practices and Privacy Information

Other Resources

Planning for Desired Configuration Management


Preparing the Site for Desired Configuration Management

To use desired configuration management on your Configuration Manager 2007 site, the following needs to be in place:

  • The site must be running Configuration Manager 2007.
  • Clients must be running the Configuration Manager 2007 client.
  • The desired configuration management client agent must be enabled.
  • Client computers must have installed the .NET Framework v2.0 (or later)
Note
The .NET Framework v2.0 is supplied with the latest operating systems, such as Windows Vista, and is also available to download through Windows Update. You can also download it from the Web (http://go.microsoft.com/fwlink/?LinkID=56407) and install it through software distribution or other deployment methods.

See Also

Tasks

How to Enable or Disable the Desired Configuration Management Client Agent
How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management


Determine If You Need to Import Configuration Data for Desired Configuration Management

You might need to import configuration data in Configuration Manager 2007 for the following reasons:

  • You want to compare the configuration of your computers with best practice configurations from a Microsoft System Center Configuration Manager 2007 Configuration Pack.
  • Separate teams in your organization have created their own configuration baseline or configuration item for the computer roles or applications they own.
  • You have created configuration data on a test network and need to move it over to your production network.
  • You have exported configuration data as a backup precaution and want to restore it on the same Configuration Manager 2007 site.

See Also

Tasks

How to Import a Configuration Baseline in Desired Configuration Management
How to Import Configuration Items in Desired Configuration Management

Concepts

About Authoring Configuration Data for Desired Configuration Management


Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management

You might need to create duplicate configuration baselines in Configuration Manager 2007 for the following reasons:

  • You want to use a configuration baseline you have imported or inherited from a parent site, but you want to add or remove configuration items to the configuration rules.
  • You want to use a configuration baseline you have imported or inherited from a parent site, but you want to edit or remove the configuration items in the configuration baseline rules.
  • You have created a configuration baseline to use as a template for new, independent configuration baselines.

You might need to create duplicate configuration items for the following reasons:

  • You want to use a configuration item you have imported or inherited from a parent site, but you want to edit or remove properties in the configuration item.
  • You have created a configuration item to use as a template for new, independent configuration items.
Important
When you create a duplicate configuration baseline or configuration item, the duplicate does not retain a relationship to the original configuration data. Therefore, if the original configuration data is upgraded, any revisions are not passed to the duplicate configuration baseline or configuration item.

See Also

Tasks

How to Create a Duplicate Configuration Baseline in Desired Configuration Management
How to Create a Duplicate Configuration Item in Desired Configuration Management
How to Import a Configuration Baseline in Desired Configuration Management
How to Import Configuration Items in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


Determine If You Need to Create Child Configuration Items for Desired Configuration Management

You might need to create child configuration items in Configuration Manager 2007 for the following reasons:

  • You want to refine the configuration items you have imported or inherited from a parent site, by making the validation criteria more restrictive, or by adding new properties.
  • You are using a layered administration model by creating a base configuration item to be used for many computers and then need to create a number of different refinements for different computers.
Important
When you create a child configuration item, the child retains a relationship to the original configuration item. Therefore, if the original configuration item is updated, any revisions are passed to the child configuration item. Additionally, if the original child item is deleted, any child configuration items are also automatically deleted.

See Also

Tasks

How to Create a Child Configuration Item in Desired Configuration Management
How to Create a New Configuration Baseline in Desired Configuration Management
How to Import Configuration Items in Desired Configuration Management


Determine If You Need to Create Configuration Baselines for Desired Configuration Management

You might need to create configuration baselines in Configuration Manager 2007 for the following reasons:

  • You need to create your own in-house customized configuration baselines.
  • You want to use an imported configuration baseline but modify it by adding new configuration items. In this case, you would create a new configuration baseline and add the original configuration baseline as one of your configuration baseline rules.

See Also

Tasks

How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management
How to Create a New Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management


Determine If You Need to Create Configuration Items for Desired Configuration Management

You might need to create configuration items in Configuration Manager 2007 for the following reasons:

  • You need to create your own in-house customized configuration items, and this cannot be achieved by creating and then editing child configuration items, or by creating and then editing duplicate child configuration items.

See Also

Tasks

How to Create a New Configuration Item in Desired Configuration Management

Concepts

About Configuration Items in Desired Configuration Management


Choose the Configuration Item Type to Create for Desired Configuration Management

When you create a configuration item in Configuration Manager 2007, you need to decide which configuration item type you need.

Choose an application configuration item type if any of the following apply:

  • You want to check for the presence of an application.
  • You want to use the configuration item with either of these configuration baseline rules:
    • If these optional application configuration items are detected, they must be properly configured.
    • These application configuration items must not be present.

Choose an operating system configuration item type if the following applies:

  • You want the settings and objects in the configuration item to apply to only specified versions of the operating system.

Choose a general configuration item if any of the following apply:

  • You do not need to check for the presence of an application.
  • You do not want to use the configuration item with either of these configuration baseline rules:
    • If these optional application configuration items are detected, they must be properly configured.
    • These application configuration items must not be present.
  • You do not need the settings and objects in the configuration item to apply to only specified versions of the operating system.

See Also

Concepts

About Configuration Items in Desired Configuration Management
Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management


Determine If You Need To Author Configuration Data Outside the Configuration Manager Console for Desired Configuration Management

You might need to author configuration baselines and configuration items for Configuration Manager 2007 outside the Configuration Manager console for the following reasons:

  • In-house customized configuration data you require is produced by administrators or developers who do not have access to the Configuration Manager console.
  • You prefer to write in XML rather than use a Windows interface, and understand the DCM Digest schema.
  • You require configuration data that the Configuration Manager console cannot interpret, and you understand the Service Modeling Language (SML) XML schema.

See Also

Concepts

About Authoring Configuration Data for Desired Configuration Management


Determine If You Need to Export Configuration Data for Desired Configuration Management

Topic Last Updated—August 2008

You might need to export configuration data from Configuration Manager 2007 for the following reasons:

  • You have created configuration data on a test network and need to move it to your production network.
  • You want an independent backup of the site's configuration baselines and configuration items that you have created in case you ever need to restore them on the same Configuration Manager 2007 site.
  • You have created configuration baselines or configuration items you want to share with the Microsoft community.
Note
Export configuration data from the site in which it was created. You cannot export configuration data that has been imported or inherited from a parent site.

See Also

Tasks

How to Export a Configuration Baseline in Desired Configuration Management
How to Export Configuration Items in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


Configuring Desired Configuration Management

To configure a Configuration Manager 2007 site for desired configuration management, you must perform the following two tasks:

  • Enable the desired configuration management client agent.
  • Configure the default compliance evaluation schedule if you want to use a value other than the default of 7 days.

Click any link in the following section for information about configuring desired configuration management.

In This Section

How to Enable or Disable the Desired Configuration Management Client Agent

Contains the steps required to enable or disable the desired configuration management client agent.

How to Configure the Default Compliance Evaluation Schedule for Desired Configuration Management

Contains the steps required to configure the default compliance evaluation schedule.

See Also

Other Resources

Desired Configuration Management in Configuration Manager
Tasks for Desired Configuration Management


How to Enable or Disable the Desired Configuration Management Client Agent

Enabling the desired configuration management client agent in Configuration Manager 2007 makes it possible for clients that are assigned to this site to evaluate compliance with assigned configuration baselines.

The desired configuration management client agent is enabled by default, but clients will not evaluate their compliance until they download one or more configuration baselines and evaluate them.

Disabling the desired configuration client agent prevents Configuration Manager 2007 clients that are assigned to this site from evaluating compliance with assigned configuration baselines.

This setting to enable or disable the desired configuration management client agent, together with any assigned configuration baselines, is downloaded to client computers according the Policy Polling Interval in the Computer Client Agent Properties (by default, every 60 minutes).

Note
When the desired configuration management client agent is enabled on client computers, the Systems Management Properties displays a Configurations tab that lists the downloaded configuration baselines and the results of its compliance evaluation. When the desired configuration management client agent is disabled, the Configurations tab is not visible.

If the Configurations tab is not visible, the client is not running the desired configuration management client agent. This might be because the site is not enabled for desired configuration management, or the client computer has not yet downloaded the policy to enable the desired configuration management client agent, or a local policy has disabled the desired configuration management client agent, or the client is not a Configuration Manager Client.

To enable the desired configuration management client agent

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Agents.

  2. Right-click Desired Configuration Management Client Agent, and then click Properties.

  3. On the General tab, enable the option Enable Desired Configuration Management on clients.

  4. Click OK.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Compliance Evaluation Schedules in Desired Configuration Management

Other Resources

Configuring Desired Configuration Management


How to Configure the Default Compliance Evaluation Schedule for Desired Configuration Management

Topic Last Updated—August 2008

Configuration Manager 2007 clients evaluate their compliance with assigned configuration baselines on a configured schedule. The default evaluation schedule is configured as a property of the desired configuration management client agent. This value is used as the default for all configuration baseline assignments, but each configuration baseline can be configured to have its own schedule.

To configure the compliance evaluation schedule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Client Agents.

  2. Right-click Desired Configuration Management Client Agent, and then click Properties.

  3. On the General tab, click either Simple schedule to configure a simple schedule such as every day, or click Custom schedule and then click Customize if you need to define a more complex schedule.

    Note
    To schedule a time in coordinated universal time (UTC) rather than the default of the client local time, use a custom schedule and specify the UTC option.

  4. Click OK.

See Also

Tasks

How to Assign Configuration Baselines in Desired Configuration Management

Concepts

About Compliance Evaluation Schedules in Desired Configuration Management
About Configuration Baselines in Desired Configuration Management

Other Resources

Configuring Desired Configuration Management


Tasks for Desired Configuration Management

To use desired configuration management in Configuration Manager 2007, you must complete a number of tasks related to configuring and managing configuration baselines and configuration items, and assessing the compliance evaluation information from client computers.

The content in this section has more information about these tasks.

In This Section

  • How to Configure Configuration Baselines for Desired Configuration Management
  • How to Configure Configuration Items for Desired Configuration Management
  • How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management
  • How to View Compliance Results for Desired Configuration Management
  • How to Monitor the Site for Desired Configuration Management

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Configuring Desired Configuration Management


How to Configure Configuration Baselines for Desired Configuration Management

Configuration baselines in Configuration Manager 2007 are used to evaluate compliance on client computers.

The content in this section provides the steps necessary to accomplish the various tasks that relate to configuration baselines in desired configuration management.

In This Section

How to Import a Configuration Baseline in Desired Configuration Management

How to Modify a Configuration Baseline in Desired Configuration Management

How to Create a New Configuration Baseline in Desired Configuration Management

How to Delete a Configuration Baseline in Desired Configuration Management

How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management

How to Disable or Enable Configuration Baselines in Desired Configuration Management

How to Assign Configuration Baselines in Desired Configuration Management

How to Configure Security Permissions on Configuration Baselines in Desired Configuration Management

How to Export a Configuration Baseline in Desired Configuration Management

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Compliance and Compliance Information in Desired Configuration Management

Other Resources

Overview of Desired Configuration Management
Tasks for Desired Configuration Management


How to Import a Configuration Baseline in Desired Configuration Management

Topic Last Updated—August 2008

Configuration baselines in Configuration Manager 2007 reference predefined configuration items and configuration baseline rules around those configuration items. You can import a configuration baseline if it is in a cabinet (cab) file format and adheres to the supported Service Modeling Language (SML) schema.

You can import configuration data from the following sources:

  • Configuration baselines that have been downloaded from the Microsoft System Center Configuration Manager 2007 Configuration Pack Web page (http://go.microsoft.com/fwlink/?LinkId=71837).
  • Configuration baselines that have been exported from Configuration Manager 2007.
  • Configuration baselines that have been externally authored and conform to the SML schema.

When you import a configuration baseline, some or all of the configuration items that are referenced in the configuration baseline might also be included in the cabinet file. During the import process, Configuration Manager verifies that all of the configuration items that are referenced in the configuration baseline are either also included in the cabinet file, or already exist in the Configuration Manager 2007 site. The import process will fail if you attempt to import a configuration baseline that references configuration data that Configuration Manager cannot locate.

Other scenarios where the import process might fail include the following:

  • You try to import a configuration baseline that references configuration items that already exist in the Configuration Manager 2007 site, but are older versions than the same configuration items in the Configuration Manager 2007 site.
  • You try to import a configuration baseline with the same name as one that already exists, and it has the same configuration baseline version but a different content version. For more information about configuration baseline versions and content versions, see About Content Versions in Desired Configuration Management.
  • You export a configuration baseline, delete the configuration baseline from the site, and import it before the original configuration baseline has aged out. By default, deleted configuration data is retained in the database for 90 days and the site maintenance task Delete Aged Configuration Management Data runs once a week. To successfully import configuration data that has been recently deleted, temporarily configure the Delete Aged Configuration Management Data task so that the value for Delete data older than (days) is sufficiently low to delete the original configuration data, and schedule the task to run in the near future. For more information about this maintenance task, see Delete Aged Configuration Management Data Task Overview.

To help troubleshoot import problems, see Import Failures with Desired Configuration Management.

To import a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Right-click Configuration Baselines, Import Configuration Data to load the Import Configuration Data Wizard, and then follow the wizard instructions.

    Note
    For information about the options in the wizard, see Import Configuration Data Wizard.

See Also

Tasks

How to Export a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Modify a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 consist of configuration items and configuration baseline rules. They can additionally contain other configuration baselines. Modifying a configuration baseline can therefore involve one or more tasks.

The content in this section provides the steps necessary to accomplish each task that might be required when modifying a configuration baseline.

In This Section

How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management

How to Remove a Dependent Configuration Baseline from a Configuration Baseline in Desired Configuration Management

How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management

How to Remove a Dependent Configuration Baseline from a Configuration Baseline in Desired Configuration Management

How to Remove a Configuration Item from a Configuration Baseline in Desired Configuration Management

How to Edit a Configuration Item in a Configuration Baseline in Desired Configuration Management

How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management

How to Modify the Rules within a Configuration Baseline in Desired Configuration Management

How to Rename a Configuration Baseline in Desired Configuration Management

See Also

Tasks

How to Assign Configuration Baselines in Desired Configuration Management
How to Create a New Configuration Baseline in Desired Configuration Management
How to Delete a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 can be layered to provide more administrative control by adding one configuration baseline within another configuration baseline. The configuration baseline within another configuration baseline then becomes a dependent configuration baseline. This arrangement is useful in the following two circumstances:

  • A basic configuration baseline is first created that is suitable for a broad range of computers. A second configuration baseline is then created to define additional configurations that are suitable for an identified grouping of computers. Before assigning the second configuration baseline to the identified grouping of computers, the basic configuration baseline is added as a dependent configuration baseline. The benefit of creating a configuration baseline that will be used as a dependent configuration baseline in this manner is that the configuration is defined once but can be used multiple times. It also allows delegated administration where the ownership of the configuration information is different.
  • You download and import a configuration baseline from a Microsoft® System Center Configuration Manager 2007 Configuration Pack and want to keep these recommendations but add your own configuration baseline. Because your configuration baseline is inheriting another configuration baseline, you can update the configuration baseline from the Configuration Pack without needing to reconfigure your own configuration baseline.

To add another configuration baseline to an existing configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to add another configuration baseline to, and then click Properties.

  3. In the Rules tab, click the rule: These configuration baselines must also be validated.

  4. In the Add Required Configuration Items dialog box, select the configuration baseline to include, and then click OK.

Caution
Do not configure loops with dependent configuration baselines, where a configuration baseline contains a dependent configuration baseline that in turn, calls the original configuration baseline. In this scenario, Configuration Manager displays an SMS Provider error, with the error code 2152205056 and description "Referenced configuration items are not available".

See Also

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

How to Modify a Configuration Baseline in Desired Configuration Management
Tasks for Desired Configuration Management


How to Remove a Dependent Configuration Baseline from a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 can be layered for greater administrative control such that one configuration baseline contains another configuration baseline. If you no longer require a configuration baseline to be included in another configuration baseline, remove it from the configuration baseline rules.

Note
Removing another configuration baseline from a configuration baseline will not delete the configuration baseline that you have removed.

To remove another configuration baseline from a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to modify so that it no longer contains another configuration baseline, and click Properties.

  3. In the Rules tab, navigate to the rule These configuration baselines must also be validated and select the configuration baseline you want to remove.

  4. Click Delete, and click OK.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

How to Modify a Configuration Baseline in Desired Configuration Management
Tasks for Desired Configuration Management


How to Remove a Configuration Item from a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 contain configuration items with associated configuration baseline rules. If you no longer require a configuration item to be included in a configuration baseline, remove it from the configuration baseline rules.

Note
Removing a configuration item from a configuration baseline will not delete the configuration item itself.

To remove a configuration item from a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline that contains the configuration item you want to remove, and click Properties.

  3. In the Rules tab, navigate to the rule that contains the configuration item you want to remove and select the configuration item.

  4. Click Delete and then click OK.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Edit a Configuration Item in a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 contain configuration items with associated configuration baseline rules. You can add and remove configuration items from configuration baselines, but you cannot directly edit configuration items from a configuration baseline. To do so, you must modify the configuration item from the Configuration Items node.

To edit a configuration item in a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Download / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item you want to edit, and click Properties.

    Note
    If you cannot immediately see the configuration item you want to edit, you can use the columns to help you locate it by sorting on one of its properties, such as name or category.

  3. Make the change to the configuration item, and click OK.

    Note
    For more information about the options in the Configuration Item Properties dialog box, see Configuration Item Properties.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 contain configuration items with associated configuration baseline rules. You can add a configuration item to a configuration baseline by modifying the configuration baseline rules.

To add a configuration item to a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline to which you want to add a configuration item, and click Properties.

  3. Click the Rules tab, and click the rule you want to associate with the configuration item you are adding to the baseline.

  4. In the Add Required Configuration Items dialog box, select the configuration item to add and click OK.

  5. Click OK to save the changes in the configuration baseline properties.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Modify the Rules within a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 contain configuration items with associated configuration baseline rules. There are fixed types of configuration baseline rules that cannot be changed, but by associating configuration items with each of them, you effectively modify the configuration baseline rules.

The available rules for each configuration baseline are as follows:

  • One of the following operating system configuration items must be present and properly configured.
  • These applications and general configuration items are required and must be properly configured.
  • If these optional application configuration items are detected, they must be properly configured.
  • These software updates must be present.
  • These application configuration items must not be present.
  • These configuration baselines must also be validated.

To modify the rules within a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to modify, and click Properties.

  3. Click the Rules tab, and locate the rule you want to modify.

  4. If you want to add a configuration item to the selected rule, click the rule and in the Add Required Configuration Items dialog box, select the configuration item to add and click OK.

  5. If you want to remove a configuration item from the selected rule, select the configuration item under the rule, and click Delete.

  6. Repeat steps 4 and 5 for additional rules you want to modify.

  7. Click OK to save the changes and exit the configuration baseline properties dialog box.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Rename a Configuration Baseline in Desired Configuration Management

To rename a configuration baseline in Configuration Manager 2007, edit its properties.

To rename a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to rename, and click Properties.

    Note
    If you cannot immediately see the configuration baseline you want to edit, you can use the columns to help you locate it by sorting on one of its properties, such as name or category.

  3. On the General tab, type in your preferred name in the Name option and click OK.

See Also

Tasks

How to Rename a Configuration Item in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Create a New Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 contain predefined configuration items and configuration baseline rules around those configuration items. After a configuration baseline is created, you can assign it to a collection so that computers in that collection will download the configuration baseline and assess their compliance with it.

To create a new configuration baseline:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Right-click Configuration Baselines, click New Configuration Baseline to load the Create Configuration Baseline Wizard, and then follow the wizard instructions.

    Note
    For more information about the options in the wizard, see Create Configuration Baseline Wizard.

See Also

Tasks

How to Import a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

How to Modify a Configuration Baseline in Desired Configuration Management
Tasks for Desired Configuration Management


How to Create a Duplicate Configuration Baseline in Desired Configuration Management

Duplicate configuration baselines in Configuration Manager 2007 are copies of configuration baselines that do not retain any relationship to the original configuration baseline. However, if the original configuration baseline contained read-only configuration items, the duplicate configuration database will also contain read-only configuration items.

The duplicate configuration baseline will by default be assigned the same name as the original configuration baseline, with a sequential number in parentheses as the suffix.

Important
If the configuration baseline was imported and the Configuration Manager console is unable to interpret all the configuration data, the option to duplicate the configuration baseline will not be available.

To create a duplicate configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to duplicate, and then click Duplicate.

  3. In the Item name dialog box, specify a name for the duplicate configuration baseline or accept the default name and then click OK.

See Also

Tasks

How to Rename a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management

Other Resources

How to Modify a Configuration Baseline in Desired Configuration Management
Tasks for Desired Configuration Management


How to Delete a Configuration Baseline in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 contain predefined configuration items and configuration baseline rules around those configuration items. If you have configuration baselines you do not want, you can delete them. However, if you want to keep the configuration baseline and its assignment but temporarily do not want clients to assess their compliance with it, you can disable it.

Deleting the configuration baseline will delete any assignments associated with that configuration baseline, but it will not delete any configuration items it contained.

Important
Other configuration baselines might include the configuration baseline you want to delete. To confirm that it is not being used by another configuration baseline, click the Relationships tab on the configuration baseline properties and confirm that no configuration baselines are listed.

To delete a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Click the configuration baseline you want to delete, and press Delete. Click Show in the Confirm Delete dialog box.

  3. In the Assignments tab, view the assignments for the configuration baseline so that you are aware that these will also be deleted when you delete the configuration baseline.

  4. In the Dependent Baselines tab, view any configuration baselines that include the configuration baseline in its rules. When you delete the configuration baseline, these dependent baselines are automatically modified to remove this configuration baseline from its rules.

  5. Click OK.

See Also

Tasks

How to Disable or Enable Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 must be assigned to one or more collections before client computers in those collections can assess their compliance with the configuration baseline. During the assignment process, you are prompted for both a collection and a compliance evaluation schedule. The collection and compliance schedule then become additional properties of the configuration baseline, which can be viewed with a new tab named Assignments.

Each configuration baseline can have multiple assignments, each with their own compliance evaluation schedule. The default value for an assignment's evaluation schedule is taken from the schedule setting in the General tab of the desired configuration management client agent properties.

There are therefore two ways to set the compliance evaluation schedule for a configuration baseline:

  • In the Set Schedule page of the Assign Configuration Baseline Wizard.
  • In the Assignment tab of the configuration baseline properties, after the configuration baseline has been assigned.

To set the compliance evaluation schedule using the Assign Configuration Baseline Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to assign, and click Assign to a Collection to launch the Assign Configuration Baseline Wizard.

  3. On the Choose Configuration Baselines page, select the configuration baseline displayed, and then click Next.

  4. On the Choose Collection page, specify the collection by typing in the name or using the Browse button and click Next.

  5. On the Set Schedule page, click either Simple and specify the Run every settings, or click Custom and click Customize to define a more complex schedule. Click Next.

  6. On the Summary page, click Next.

  7. On the Confirmation page, click Close.

    Note
    For more information about the options in the wizard, see Assign Configuration Baseline Wizard.

To set the compliance evaluation schedule as a configuration baseline property

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline that has been assigned, and click Properties.

  3. On the Assignments tab, select the configured assignment that contains the compliance evaluation schedule you want to change, and then click Properties.

  4. In the Configuration Baseline Assignment Properties dialog box, under Schedule, either click Simple and specify the Run every settings, or click Custom and click Customize to define a more complex schedule, and then click OK.

  5. Click OK to close the configuration baseline properties dialog box.

    Note
    For more information about the options in the configuration baseline properties dialog box, see Configuration Baseline Properties.

See Also

Tasks

How to Assign Configuration Baselines in Desired Configuration Management
How to Configure the Default Compliance Evaluation Schedule for Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Disable or Enable Configuration Baselines in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 contain predefined configuration items and configuration baseline rules around those configuration items. For client computers to assess their compliance with them, the configuration baselines must be assigned either directly or through another assigned configuration baseline. However, you can stop client computers from assessing their compliance with an assigned configuration baseline by disabling the configuration baseline. To start compliance evaluation again, enable the configuration baseline.

Note
Enabling and disabling a configuration baseline increments the configuration baseline version number to reflect the status change.

To disable or enable a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to disable or enable, and click Disable Baseline or Enable Baseline.

    Note
    You can see whether a configuration baseline is enabled or disabled with the Status column in the Configuration Baseline home page, which will display either Enabled or Disabled. You must refresh the Configuration Baseline node after enabling or disabling a configuration baseline for the Status to change.

See Also

Tasks

How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management
How to Assign Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Assign Configuration Baselines in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 must be assigned to one or more collections of computers before client computers in those collections can assess their compliance with the configuration baseline.

Use the Assign Configuration Baseline Wizard to define configuration baseline assignments, which includes adding or removing configuration baselines from assignments in addition to specifying the evaluation schedule.

Note
After you have assigned a configuration baseline to a collection, you can view the selected collection in the configuration baseline properties, where you can modify the option to include subcollections and also modify the schedule. However, you must use the Assign Configuration Baseline Wizard again to assign the baseline to a new collection.

You can launch the Assign Configuration Baseline Wizard from two different locations in the Configuration Manager console:

  • From the Desired Configuration Management, Configuration Baselines node.
  • From the Computer Management, Collections node.

To assign a configuration baseline to a collection from the Desired Configuration Management, Configuration Baselines node

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to assign, and then click Assign to a Collection to launch the Assign Configuration Baseline Wizard.

  3. In the Choose Collection page, either type in the name of the collection to which you want to assign the configuration baseline or click Browse to select the collection from the Browse Collection dialog box, and click OK.

    Note
    If there are users in the selected collection, configuration baselines will not be evaluated by them. Configuration baselines are evaluated by targeted computers and not users.

  4. Complete the Assign Configuration Baseline Wizard.

    Note
    For more information about the options in the wizard, see Assign Configuration Baseline Wizard .

To assign a configuration baseline to a collection from the Computer Management, Collections node

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection to which you want to assign one or more baselines, and then click Assign Configuration Baseline.

    Note
    If there are users in the selected collection, configuration baselines will not be evaluated by them. Configuration baselines are evaluated on targeted computers and not users.

  3. In the Assign Configuration Baseline Wizard on the Choose Baselines page, click Add to select the baselines you want to assign to this collection. Click Next.

  4. In the Choose Collection page, either type in the name of the collection to which you want to assign the configuration baseline or click Browse to select the collection from the Browse Collection dialog box, and click OK.

  5. Complete the Assign Configuration Baseline Wizard.

    Note
    For more information about the options in the wizard, see Assign Configuration Baseline Wizard .

See Also

Tasks

How to Unassign Configuration Baselines in Desired Configuration Management
How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Unassign Configuration Baselines in Desired Configuration Management

To unassign configuration baselines from clients in Configuration Manager 2007, delete the assignment from the configuration baseline properties.

To unassign a configuration baseline from a collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline that you want to unassign, and click Properties.

  3. In the Assignments tab, select the assignment you want to remove and click Delete.

  4. Click OK.

    Note
    For more information about the options in the configuration baseline properties dialog box, see Configuration Baseline Properties.

See Also

Tasks

How to Assign Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Configure Security Permissions on Configuration Baselines in Desired Configuration Management

Configuration baselines in Configuration Manager 2007 can be secured so that only designated administrators can manage them with assigned permissions.

To configure security permissions on configuration baselines

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline that you want to configure for security permissions, click Properties, and then click the Security tab.

  3. Configure the security permissions you require, and click OK.

    Note
    For more information about the options in the Security tab, see Properties - Security Tab.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Export a Configuration Baseline in Desired Configuration Management

Topic Last Updated—August 2008

Configuration baselines in Configuration Manager 2007 reference predefined configuration items and configuration baseline rules around those configuration items. After creating a configuration baseline, you can export it from Configuration Manager 2007 in a cabinet (.cab) file format and then import it to the same or different Configuration Manager 2007 site.

This procedure allows you to back up configuration baselines independently from a Configuration Manager 2007 full backup, and it can also be used to transfer configuration baselines from one Configuration Manager 2007 site to another.

Note
You cannot export configuration baselines that are imported or inherited from a parent site. These configuration baselines are displayed with a lock icon, and the option to export them will not be available. You can export configuration baselines that you have created when they contain configuration data that is imported or inherited.

When you export a configuration baseline, it will also automatically export any referenced configuration items and dependent configuration baselines that have been created at that site. If the configuration baseline contains imported or inherited configuration data, the reference to these is included in the exported baseline, but the actual configuration data is not included. If the site doesn’t contain the referenced imported or inherited configuration data when the configuration baseline is imported, the import process will fail.

To export a configuration baseline

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Baselines.

  2. Right-click the configuration baseline you want to export, and select Export Configuration Data.

  3. In the Save As dialog box, type in a file name for the saved configuration baseline and click Save.

See Also

Tasks

How to Import a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Configure Configuration Items for Desired Configuration Management

Configuration items Configuration Manager 2007 in make up the lowest level of discrete information you need for managing compliance throughout your organization. Configuration items are the building blocks of configuration baselines and are referenced with configuration baseline rules to define how computers should be configured.

The content in this section provides the steps necessary to accomplish the various tasks that relate to configuration items in desired configuration management.

In This Section

  • How to Import Configuration Items in Desired Configuration Management
  • How to Create a New Configuration Item in Desired Configuration Management
  • How to Edit a Configuration Item in Desired Configuration Management
  • How to Create a Child Configuration Item in Desired Configuration Management
  • How to Create a Duplicate Configuration Item in Desired Configuration Management
  • How to Rename a Configuration Item in Desired Configuration Management
  • How to Configure Security Permissions on Configuration Items in Desired Configuration Management
  • How to Delete a Configuration Item in Desired Configuration Management
  • How to Export Configuration Items in Desired Configuration Management

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Overview of Desired Configuration Management
Tasks for Desired Configuration Management


How to Import Configuration Items in Desired Configuration Management
Important
Before Configuration Manager 2007 imports configuration data, it verifys the file's digital signature. The digital signature verification might fail because the files have been tampered with or because the files have not been signed at all, which is common with applications written internally. Continue to import the configuration data only if you explicitly trust the publisher and the integrity of the files.

Configuration items are used when defining configuration baselines in Configuration Manager 2007, which in turn are assigned to collections so that client computers in the collection can evaluate their compliance according to the configuration items and the configuration baseline rules.

In addition to creating configuration items with the Configuration Manager console, you can import configuration items if they are in a cabinet (cab) file format and adhere to the supported SML schema.

You can import configuration data from the following sources:

  • Best practice configuration data that has been downloaded from the Microsoft® System Center Configuration Manager 2007 Configuration Pack Web page (http://go.microsoft.com/fwlink/?LinkId=71837).
  • Configuration data that has been exported from Configuration Manager 2007.
  • Configuration data that has been externally authored and conforms to the Service Modeling Language (SML) schema.

To import configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Right-click Configuration Items, Import Configuration Data to load the Import Configuration Data Wizard, and follow the wizard instructions.

    Note
    For information about options in the wizard, see Import Configuration Data Wizard.

See Also

Tasks

How to Export Configuration Items in Desired Configuration Management

Concepts

About Authoring Configuration Data for Desired Configuration Management
About Configuration Items in Desired Configuration Management
Determine If You Need to Import Configuration Data for Desired Configuration Management
Determine If You Need To Author Configuration Data Outside the Configuration Manager Console for Desired Configuration Management
Import Configuration Data Wizard


How to Create a New Configuration Item in Desired Configuration Management

Configuration items in Configuration Manager 2007 define a discrete set of configurations you need to manage for compliance, and they can be one of these four types:

  • Application configuration item
  • Operating system configuration item
  • Software updates configuration item
  • General configuration item
Note
Software updates configuration items are automatically created when you download software updates with the software updates feature. You do not create or see these configuration items in the Desired Configuration Management node, but you can select them when defining your configuration baselines.

There are three different ways to create a new configuration item within the Configuration Manager console:

  1. Create a duplicate configuration item from the Configuration Items node. This approach is appropriate if you want an exact copy of an existing configuration item to use as your starting point, but you want to modify it to create an independent configuration item from the original.
    For more information, see Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management.
  2. Create a child configuration item from the Configuration Items node. This approach is appropriate if you want a configuration item that continues to inherit the properties of an existing configuration item but refines them with more granular configuration.
    For more information, see Determine If You Need to Create Child Configuration Items for Desired Configuration Management.
  3. Use a wizard to create one of the supported configuration types. This approach is appropriate if you want to configure all the properties or you have no existing configuration item from which you can create a duplicate or a child configuration item. The wizards to create configuration items are the following:
    • Create Application Configuration Item Wizard
    • Create General Configuration Item Wizard
    • Create Operating System Configuration Wizard

To create a new configuration item by duplicating a configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item that you want to duplicate, and then click Duplicate.

  3. The new configuration item will appear in the Configuration Items node and display with a sequential number in brackets appended to the original name.

To create a new configuration item by creating a child configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item that you want to duplicate, and then click Create Child Configuration Item.

  3. The new configuration item will appear in the Configuration Items node and display with the same base name as the original, but it will have the current creation date.

  4. The configuration inheritance from the original configuration item can be confirmed by viewing the Relationships tab in the configuration item properties.

To create a new configuration item with one of the create configuration item wizards

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Right-click Configuration Items, click New, and then select one of the following, depending on the type of configuration item that you want to create:

    • Application Configuration Item
    • General
    • Operating System Configuration Item
    Note
    If you are not sure which configuration item type to choose, see Choose the Configuration Item Type to Create for Desired Configuration Management.

  3. If you are creating an application configuration item, follow the instructions in the Create Application Configuration Item Wizard.

  4. If you are creating a general configuration item, follow the instructions in the Create General Configuration Item Wizard.

  5. If you are creating an operating system configuration item, follow the instructions in the Create Operating System Configuration Item Wizard.

  6. When you have successfully completed the wizard, the configuration item you have created will display in the Configuration Items node.

See Also

Tasks

How to Edit a Configuration Item in Desired Configuration Management
How to Import Configuration Items in Desired Configuration Management

Concepts

About Configuration Items in Desired Configuration Management
Choose the Configuration Item Type to Create for Desired Configuration Management
Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management
Determine If You Need to Create Child Configuration Items for Desired Configuration Management
Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management


How to Edit a Configuration Item in Desired Configuration Management

To modify a configuration item in Configuration Manager 2007 you have created, you can edit its properties from within the Configuration Manager console. However, configuration items that are imported or inherited from a parent site cannot be directly edited, and their properties display as read-only in the Configuration Manager console. If you want to modify a configuration item you have imported, create either a duplicate or child configuration item, and then edit the properties of the new configuration item.

Some imported configuration items might contain information that is in a valid format but that the Configuration Manager console is unable to interpret and therefore does not display. There are two scenarios where this happens:

  • Configuration Manager is able to interpret some, but not all, of the contents in the configuration item.
  • Configuration Manager is not able to interpret any of the contents in the configuration item.

If some of the contents of the configuration item cannot be interpreted, the configuration item cannot be duplicated and the Duplicate option will not be available for that configuration item. Although you cannot duplicate these imported configuration items, you will be able to create a child configuration item from them. This allows you to add new properties to the child configuration item, which the Configuration Manager console can interpret and displays.

If none of the information in the imported configuration item can be interpreted by the Configuration Manager console, the configuration item cannot be duplicated and you will not be able to create a child configuration item from it. In this scenario, the Configuration Manager displays the configuration items as an uninterpreted general configuration item, and Create Child Configuration Item option will not be available when it is selected.

In both scenarios where the Configuration Manager console cannot interpret the configuration information, you can still add these configuration items to configuration baselines. Client computers will interpret the values correctly and include all the information in the configuration item when they evaluate their compliance

Note
You cannot edit software updates configuration items. These configuration items display under the Software Updates node and not the Desired Configuration Management node. As such, software updates configuration items cannot be edited, deleted, or duplicated, and you cannot create child configuration items from them.

To edit a configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item you want to edit, and then click Properties.

    Note
    If you cannot immediately see the configuration item you want to edit, you can use the columns to help you locate it by sorting on one of its properties, such as name or category.

  3. Make the change to the configuration item, and click OK.

    Note
    For information about each property tab and option, see Configuration Item Properties.

See Also

Tasks

How to Create a Child Configuration Item in Desired Configuration Management
How to Create a Duplicate Configuration Item in Desired Configuration Management
How to Create a New Configuration Item in Desired Configuration Management
How to Create Configuration Categories in Desired Configuration Management
How to Import Configuration Items in Desired Configuration Management

Concepts

About Authoring Configuration Data for Desired Configuration Management
About Configuration Items in Desired Configuration Management


How to Create a Child Configuration Item in Desired Configuration Management

Child configuration items in Configuration Manager 2007 are copies of configuration items that retain a relationship to the original configuration item; therefore, they inherit the original configuration from the parent configuration item.

When you view the properties of a child configuration item in the Configuration Manager console, you will be able to view but not edit the inherited objects and settings with their validation criteria. However, you can add and then edit additional validation criteria to the child configuration item, and you can also add new objects and settings to the child configuration item. Therefore, the usual purpose for creating and editing a child configuration item is that it refines the original configuration item to meet your business requirements.

The child configuration item will be automatically created with the display name of New <type> configuration item - <date and time>, where <type> is one of the three configuration item types supported by the Configuration Manager console, and <date and time> is the date and time on the site server at the time of creating the child configuration item.

To create a child configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item that you want to duplicate, and then click Create Child Configuration Item.

See Also

Tasks

How to Edit a Configuration Item in Desired Configuration Management
How to Rename a Configuration Item in Desired Configuration Management

Concepts

About Configuration Items in Desired Configuration Management
Determine If You Need to Create Child Configuration Items for Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Create a Duplicate Configuration Item in Desired Configuration Management

Duplicate configuration items in Configuration Manager 2007 are copies of configuration items that do not retain any relationship to the original configuration item. This means that the duplicate configuration item does not continue to inherit configuration from the original configuration item.

If the original configuration item was read-only, the duplicate configuration item can be fully edited for the properties that the Configuration Manager console can interpret.

The duplicate configuration item will by default be assigned the same name as the original configuration item, with a sequential number in parentheses as the suffix.

To create a duplicate configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item that you want to duplicate, and then click Duplicate.

  3. In the Item name dialog box, specify a name for the duplicate configuration item or accept the default name and then click OK.

See Also

Tasks

How to Edit a Configuration Item in Desired Configuration Management
How to Rename a Configuration Item in Desired Configuration Management

Concepts

About Configuration Items in Desired Configuration Management
Determine If You Need To Create Duplicate Configuration Baselines or Duplicate Configuration Items for Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Rename a Configuration Item in Desired Configuration Management

To rename a configuration item in Configuration Manager 2007, you must edit its properties. However, imported configuration items cannot be directly edited and their properties display as read-only in the Configuration Manager console. If you want to modify a configuration item you have imported, either create a duplicate or a child configuration item and then edit the properties of the new configuration item.

Note
You cannot edit software updates configuration items. These configuration items display under the Software Updates node and not the Desired Configuration Management node. As such, software updates configuration items cannot be edited, deleted, or duplicated, and you cannot create child configuration items from them.

To rename a configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item you want to edit, and then click Properties.

    Note
    If you cannot immediately see the configuration item you want to edit, you can use the columns to help you locate it by sorting on one of its properties, such as name or category.

  3. On the General tab, type in your preferred name in the Name option and click OK.

See Also

Tasks

How to Edit a Configuration Item in Desired Configuration Management
How to Rename a Configuration Baseline in Desired Configuration Management
How to Use Meaningful Names in Desired Configuration Management

Concepts

About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Configure Security Permissions on Configuration Items in Desired Configuration Management

Configuration items in Configuration Manager 2007 can be secured so that only designated administrators can manage them with assigned permissions.

To configure security permissions on configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item that you want to configure for security permissions, click Properties, and then click the Security tab.

  3. On the Security tab, configure the security permissions you require, and then click OK.

    Note
    For more information about the options in the Security tab, see Properties - Security Tab Tab.

See Also

Concepts

About Configuration Items in Desired Configuration Management
Overview of Configuration Manager Object Security and WMI

Other Resources

Tasks for Desired Configuration Management


How to Delete a Configuration Item in Desired Configuration Management

To delete a configuration item in Configuration Manager 2007, you select it and press Delete. However, before deleting a configuration item, you should note the following consequences:

  • If the configuration item has been added to a configuration baseline, the configuration item will be automatically removed from the configuration baseline when the configuration item is deleted.
  • If the deleted configuration item has a child configuration item, the child configuration item will be automatically deleted when the configuration item is deleted.

The delete action will display the Confirm Deletion dialog box. Click Show to see which configuration baselines reference the configuration item and which configuration items are parent configuration items. You can also view this information from the Relationships tab of the configuration item properties.

Note
You cannot delete a software updates configuration item. These configuration items display under the Software Updates node and not the Desired Configuration Management node. As such, software updates configuration items cannot be edited, deleted, or duplicated, and you cannot create child configuration items from them.

To delete a configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Click the configuration item you want to delete, and then press Delete.

  3. Click Show in the Confirm Deletion dialog box to confirm that other configuration items or configuration baselines will not be adversely affected by the deletion.

  4. Click OK.

    Note
    For information about the options in Confirm Delete dialog box, see Confirm Deletion Dialog Box.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Export Configuration Items in Desired Configuration Management

Topic Last Updated—August 2008

Configuration items in Configuration Manager 2007 contain discrete items of configuration information at a level you need to manage compliance. When they are added to configuration baselines with configuration baseline rules, they are used to determine compliance of client computers.

You can export a configuration item from Configuration Manager 2007 in a cabinet (.cab) file format, providing that it was created at that site. You can then import it to the same or a different Configuration Manager 2007 site. Configuration data is converted to DCM Digest.

This procedure allows you to back up configuration items independently from a Configuration Manager 2007 full backup, and it can also be used to transfer configuration items from one Configuration Manager 2007 site to another.

Note
Export configuration items from the site in which they were created. You cannot export configuration items that have been imported or inherited from a parent site. These configuration items display with the lock symbol, and when they are selected, the option to export configuration data will not be available.

To export configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / Configuration Items.

  2. Right-click the configuration item that you want to export, and then select Export Configuration Data.

  3. In the Save As dialog box, type in a file name for the saved configuration items and then click Save.

  4. Repeat steps 2 and 3 for each configuration item that you want to export.

    Note
    You cannot export to the same file and append the configuration information; instead, you must save to a different file for each export. Exporting a configuration baseline allows you to export multiple configuration items into a single file.

See Also

Tasks

How to Export a Configuration Baseline in Desired Configuration Management
How to Import Configuration Items in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Desired Configuration Management in Configuration Manager


How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management

As you increase your number of configuration items and configuration baselines in Configuration Manager 2007, managing that configuration data can become challenging.

The following procedures can help you manage configuration baselines and configuration items so that you can locate them easily when you need to modify or verify their configuration.

In This Section

  • How to Use Assigned Configuration Categories in Desired Configuration Management
  • How to Use Meaningful Names in Desired Configuration Management
  • How to Distinguish Configuration Data with the Same Name in Desired Configuration Management
  • How to Use Look for and Search in with Desired Configuration Management
  • How to Use the Results Columns in Desired Configuration Management
  • How to Export the Results List in Desired Configuration Management
  • How to Use the Properties Pane in Desired Configuration Management
  • How to Create Configuration Categories in Desired Configuration Management
  • How to Delete Configuration Categories in Desired Configuration Management
  • How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management
  • How to View XML Definitions of Configuration Items and Configuration Baselines in Desired Configuration Management
  • How to Audit Configuration Baselines and Configuration Items in Desired Configuration Management

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Use Assigned Configuration Categories in Desired Configuration Management

Configuration categories in Configuration Manager 2007 are administrator-defined logical groupings ithat you can use to help you more easily manage configuration baselines and configuration items in the Configuration Manager console.

Use the following technique to help you manage configuration baselines and configuration items so that you can locate them easily when you need to modify or verify their configuration.

To use assigned categories to manage configuration baselines and configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To manage configuration baselines, click Configuration Baselines. To manage configuration items, click Configuration Items.

  3. Locate the column Categories to display the categories that have been assigned to the configuration baselines or configuration items.

  4. To sort by ascending or descending order of category name, click the Categories column.

  5. To filter the results of all configuration baselines or configuration items by assigned category, enter the name of the category in Look for, select Categories from Search in, and then click Find Now. Click Clear when you want to return to displaying all configuration baselines or configuration items.

    Note
    For more information about the options on the desired configuration management home pages, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Tasks

How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management
How to Create Configuration Categories in Desired Configuration Management

Concepts

About Configuration Categories in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management
Tasks for Desired Configuration Management


How to Use Meaningful Names in Desired Configuration Management

Configuration baselines and configuration items in Configuration Manager 2007 are, by default, displayed in the Configuration Manager console with the Name column first, so this property is most likely how you will distinguish configuration baselines and configuration items from each other. If you define and use a standard naming technique for each configuration baseline or configuration item you create, it will be easier to identify and sort them by name.

When you create a configuration baseline or configuration item in the Configuration Manager console, the date and time of creation is automatically appended to the name you supply. However, you can modify both your chosen name and the automatically appended date and time in the General tab in the properties of the configuration baseline or configuration item.

Use the following technique to help you manage configuration baselines and configuration items so that you can locate them easily when you need to modify or verify their configuration.

To use meaningful names to manage configuration baselines and configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To manage configuration baselines, click Configuration Baselines. To manage configuration items, click Configuration Items.

  3. Sort the display by name in ascending or descending order by clicking the Name column.

  4. To filter the results of all configuration baselines or configuration items by display name, enter as much of the display name as you need for identification in Look for, select Name from Search in, and then click Find Now. Click Clear when you want to return to displaying all configuration baselines or configuration items.

See Also

Tasks

How to Rename a Configuration Item in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Distinguish Configuration Data with the Same Name in Desired Configuration Management

It is possible to have configuration baselines in Configuration Manager 2007 with the same name and configuration items with the same name. This can make it difficult to distinguish them in the Configuration Manager, under their respective nodes.

However, configurations items that have a different type are easily distinguished in the Configuration Manager console by having a specific icon displayed before the name. The Type column also displays this distinguishing property. For example, you can specify the same name for an application configuration item and an operating systems configuration item, and they would be distinguished in the Configuration Manager with different icons next to their name. In addition, under the Type column you would see Application and Operating System, respectively.

When you duplicate a configuration baseline or a configuration item, the duplicated configuration data is automatically configured with the same name but with an appended number in brackets to help you distinguish it from the original. You can then edit this automatically generated name as you edit its properties. However, it is possible to edit the name so that it is exactly the same as the original, which means it is not easy to distinguish between the original and duplicate although they might have completely different properties.

Another possible scenario where you might encounter configuration data with the same name is when more than one administrator is configuring or importing configuration data and they do not realize the name is not unique. This is particularly relevant if administrators in child sites also create or import configuration baselines or configuration items.

To distinguish configuration data that has the same display name, use the CI Unique ID value. This is a long alphanumeric string that is used by Configuration Manager to uniquely identify each configuration baseline or configuration item.

To view the unique string in the Configuration Manager console, follow this procedure.

To distinguish configuration data with same name

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To distinguish configuration baselines with same name, click the Configuration Baselines node. To distinguish configuration items with same type and name, click the Configuration Items node.

  3. Right-click the node, click View, and then click Add/Remove Columns. Under Available columns, click CI Unique ID, and then click Add.

  4. If you want to view the distinguishing string immediately after the name, ensure CI Unique ID is selected and then click Move Up until it is listed after Name.

  5. Click OK.

    Note
    For more information about the options on the desired configuration management home pages, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Tasks

How to Rename a Configuration Baseline in Desired Configuration Management
How to Rename a Configuration Item in Desired Configuration Management
How to Use the Results Columns in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Use Look for and Search in with Desired Configuration Management

The Look for and Search in options allow you to filter the configuration baselines or configuration items in Configuration Manager 2007 that are displayed in their respective nodes. Use the following technique to help you manage configuration baselines and configuration items so that you can locate them easily when you need to modify or verify their configuration.

To use Look for and Search in to manage configuration baselines and configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To manage configuration baselines, click the Configuration Baselines node. To manage configuration items, click the Configuration Items node.

  3. In Look for, enter any part of a text string that helps to filter or identify the configuration baseline or configuration item you need, select from Search in the column for the search criteria (a specific column or all columns), and then click Find Now. The more specific your search string, the more specific the results. For example, in the Configuration Items display, the letter I when you select Type from Search in will return results for configurations items that have a type of Application or Operating System. However, if you enter App with the same Search in criteria, the results will return only configuration items of the type Application.

    Note
    The Look for facility does not extend further than the node in which it is being used. For example, if you are using it in the Configuration Items node, it will not find configuration baselines in the Configuration Baselines node. It also cannot find software updates configuration items that are located in the Software Updates node.

  4. Click Look for to select previous searches. Up to 10 previous searches can be stored.

  5. As a visual indicator that the display is filtered, the title bar will display Filtered view, display x items out of y, where x is the number of configuration baselines or configuration items that match your filter, and y is the total number of unfiltered configuration baselines items or configuration items. Click Clear when you want to return to displaying all configuration baselines or configuration items.

    Note
    For more information about the options on the desired configuration management home pages, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Use the Results Columns in Desired Configuration Management

The columns in the results pane for the Configuration Baselines node and the Configuration Items node in Configuration Manager 2007 offer an effective method to help you manage configuration baselines and configuration items, so that you can locate them easily when you need to modify or verify their configuration.

You can use the results columns to sort the data displayed. You can also add, delete, and reorder the columns.

To use the results columns to manage configuration baselines and configuration items:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To manage configuration baselines, click the Configuration Baselines node. To manage configuration items, click the Configuration Items node.

  3. Click each column if you want to change the display of the configuration baselines or configuration items according to the column information in ascending or descending order.

  4. To add or remove columns, right-click the node, click View, and then click Add/Remove Columns. To add a new column, in the Add/Remove Columns dialog box, click a column title in the Available columns list, and then click Add. To remove an existing column, in the Add/Remove Columns dialog box, click a column title in the Displayed columns list, and then click Remove. Click OK.

  5. To reorder columns, right-click the node, click View, and then click Add/Remove Columns. In the Add/Remove Columns dialog box, click a column you want to reorder in the Available columns list and then click Move Up or Move Down. Click OK.

    Note
    For more information about the options on the Configuration Baselines home page and the Configurations Items home page, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Tasks

How to Distinguish Configuration Data with the Same Name in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management
Desired Configuration Management in Configuration Manager


How to Export the Results List in Desired Configuration Management

The configuration baselines and configuration items displayed in the results pane from their respective nodes in Configuration Manager 2007 can be exported to a list as a text file. You can use this file as a historical record, and you can also import it into other applications such as Microsoft Office Excel and Word to include in spreadsheets or reports.

Use the following procedure to export the list of configuration baselines or configuration items.

To export the results list to manage configuration baselines and configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To manage configuration baselines, click the Configuration Baselines node. To manage configuration items, click the Configuration Items node.

  3. To export the displayed list in the results pane as a text file, right-click the node, click View, and then click Export list.

  4. Specify a file name in the Save As dialog box, and click the Save as type to specify whichever one of the following formats is suitable for the application into which you want to import the list:

    • Text (tab delimited) (*txt)
    • Text (comma delimited) (*.csv)
    • Unicode Text (tab delimited) (*txt)
    • Unicode Text (comma delimited) (*.csv)

  5. Click Save.

    Note
    For more information about the options on the Configuration Baselines home page and the Configurations Items home page, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Other Resources

Desired Configuration Management in Configuration Manager
Tasks for Desired Configuration Management


How to Use the Properties Pane in Desired Configuration Management

If you want to quickly view the properties of configuration baselines or configuration items to help you identify or verify them, but you do not need to edit the properties, use the properties pane from the Configuration Baselines node or the Configuration Items node in the Configuration Manager console. This is quicker than right-clicking the configuration baseline or configuration item and selecting Properties.

To use the properties pane, follow this procedure.

To use the properties pane to manage configuration baselines and configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To manage configuration baselines, click the Configuration Baselines node. To manage configuration items, click the Configuration Items node.

  3. Click a configuration baseline or configuration item. The bottom of the Configuration Manager results pane will display all the tabbed properties you would see if you selected Properties, but they appear as read-only. You can quickly view the properties of one configuration baseline or configuration item after another without leaving the results pane.

    Note
    For more information about the options on the Configuration Baselines home page and the Configurations Items home page, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Tasks

How to Edit a Configuration Item in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Create Configuration Categories in Desired Configuration Management

You can create configuration categories in Configuration Manager 2007 with two methods:

  • In the wizards used to create the configuration item or configuration baseline.
  • In the General tab of the configuration baseline properties or the configuration item properties.

To create configuration categories in the wizards

  1. In the Identification page of the wizard, click Categories to display the Categories dialog box.

  2. To create a new category, type in the name under Add a new category and then click Add. If you need multiple categories, type in the first name and then press Enter, followed by the next category name, and so on until you entered all the categories you require, and then click Add.

  3. The newly created categories will appear under Available categories, and they will be automatically selected for the configuration baseline or configuration item you are creating. If you do not want the configuration baseline or configuration item you are creating to belong to all the newly created categories, deselect them from the list.

  4. Click OK.

    Note
    For more information about the options in the Configuration Categories dialog box, see Categories Dialog Box.

To create configuration categories by editing the configuration baseline or configuration item properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To create a configuration category in the properties of a configuration baseline, navigate to the Configuration Baselines node, right-click the configuration baseline, and then click Properties.

  3. To create a configuration category in the properties of a configuration item, navigate to the Configuration Items node, right-click the configuration item, and then click Properties.

  4. In the General tab, click Categories to display the Categories dialog box.

  5. To create a new category, type in the name under Add a new category and click Add. If you need multiple categories, type in the first name and then press Enter, followed by the next category name, and so on until you entered all the categories you require, and then click Add.

  6. The newly created categories will appear under Available categories, and they will be automatically selected for the configuration baseline or configuration item you are editing. If you do not want the configuration baseline or configuration item you are editing to belong to all the newly created categories, deselect them from the list.

  7. Click OK, and then click OK to close the properties dialog box for the configuration baseline or configuration item.

    Note
    For more information about the options in the Configuration Categories dialog box, see Categories Dialog Box.

See Also

Concepts

About Configuration Categories in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Delete Configuration Categories in Desired Configuration Management

Configuration categories in Configuration Manager 2007 are optional properties for a configuration item or configuration baseline. They are designed to help improve searching and filtering when you have a large number of configuration items and configuration baselines.

Deleting a configuration category that is being used by configuration items or configuration baselines will automatically deselect the configuration category from those configuration items and configuration baselines before deleting the configuration categories.

There are three ways to delete configuration categories:

  1. Using the action Manage Categories.
  2. In the General tab of the configuration baseline properties or the configuration item properties.
  3. In the wizards used to create a configuration item or a configuration baseline.
    Caution
    Configuration categories are shared between configuration baselines and configuration items, so deleting a configuration category in the Configuration Items node will result in it no longer being available to either configuration items or configuration baselines.

1. To delete configuration categories using the Manage Categories action

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. On the Action pane for either the Configuration Baselines node or the Configuration Items node, click Manage Categories.

  3. In the Categories dialog box, under Available categories, select a category to delete and then click Delete. If configuration baselines or configuration items are currently assigned to the configuration category, you will be warned and prompted to continue.

  4. Repeat step 3 for each configuration category you want to delete.

  5. Click OK.

2. To delete configuration categories in the wizards

  1. In the Identification page of the wizard to create a new configuration baseline or create a new configuration item, click Categories to display the Categories dialog box.

  2. Under Available categories, select a category to delete and click Delete. If configuration baselines or configuration items are currently assigned to the configuration category, you will be warned and prompted to continue.

  3. Repeat step 2 for each configuration category you want to delete.

  4. Click OK.

3. To delete configuration categories when editing the properties of a configuration baseline or configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To delete a configuration baseline in the properties of a configuration baseline, navigate to the Configuration Baselines node, right-click the configuration baseline, and then click Properties.

  3. To delete a configuration item in the properties of a configuration item, navigate to the Configuration Items node, right-click the configuration item, and then click Properties.

  4. In the General tab, click Categories to display the Categories dialog box.

  5. Under Available categories, select a category to delete and then click Delete. If configuration baselines or configuration items are currently assigned to the configuration category, you will be warned and prompted to continue.

  6. Click OK, and then click OK to close the properties dialog box of the configuration baseline or configuration item.

See Also

Tasks

How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Categories in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management

Configuration categories in Configuration Manager 2007 are optional properties for a configuration item or configuration baseline. They are designed to help improve searching and filtering when you have a high number of configuration items and configuration baselines.

There are three ways to assign configuration categories to configuration items and configuration baselines:

  • In the wizards that create the configuration item or configuration baseline.
  • In the General tab of the configuration baseline properties or the configuration item properties.
  • Using the right-click action Manage Categories.

To assign configuration categories in the wizards

  1. In the Identification page of the wizard, click Categories to display the Categories dialog box.

  2. Under Available categories, select the categories you want to assign the configuration item or configuration baseline to.

  3. Click OK.

To assign configuration categories when editing the properties of a configuration baseline or configuration item

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To assign a configuration category to a configuration baseline in the properties of a configuration baseline, navigate to the Configuration Baselines node, right-click the configuration baseline, and then click Properties.

  3. To assign a configuration category to a configuration item in the properties of a configuration item, navigate to the Configuration Items node, right-click the configuration item, and then click Properties.

  4. In the General tab, click Categories to display the Categories dialog box.

  5. Under Available categories, select the categories to which you want the configuration baseline or configuration item to be assigned

  6. Click OK, and then click OK to close the properties of the configuration baseline or configuration item dialog box.

To assign configuration categories using the Manage Categories action

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To assign one or more configuration categories to a configuration baseline, navigate to the Configuration Baselines node, right-click the configuration baselines, and then click Manage Categories.

  3. To assign one or more configuration categories to a configuration item, navigate to the Configuration Items node, right-click the configuration items, and then click Manage Categories.

  4. In the Categories dialog box, under Available categories, select the categories to which you want the configuration baselines or configuration items to be assigned

  5. Click OK.

See Also

Concepts

About Configuration Categories in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to View XML Definitions of Configuration Items and Configuration Baselines in Desired Configuration Management

Authoring configuration items and configuration baselines in the Configuration Manager 2007 Configuration Manager console provides a graphical front end to the underlying Service Modeling Language (SML) schema. However, there might be times when you want to see or check the underlying code, which is in XML format. To do this, follow this procedure.

To view XML definitions of configuration items and baselines

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To view the XML definition of a configuration baseline, right-click the configuration baseline in the Configuration Baselines node, and then select View XML Definition.

  3. To view the XML definition of a configuration item, right-click the configuration item in the Configuration Items node and then select View XML Definition.

  4. The code appears in the default Web browser. Close this window when you have viewed the XML code.

    Note
    For more information about the options on the desired configuration management home pages, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Concepts

About Authoring Configuration Data for Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Audit Configuration Baselines and Configuration Items in Desired Configuration Management

Audit status messages are automatically created for the following actions when using desired configuration management in Configuration Manager 2007:

  • Create a configuration baseline or configuration item.
  • Modify a configuration baseline or configuration item.
  • Delete a configuration baseline or configuration item.
  • Import configuration data.
  • Export configuration data.
Note
Auditing the modification of configuration baselines and configuration items records that the object was modified, but it does not include the modification details of how it was modified.

Additionally, the properties of the configuration baseline and configuration item contain the following information on the General tab to help you identify changes to configuration data:

  • Type
  • Version
  • Site Code
  • Created
  • Created By
  • Last Modified
  • Last Modified By

Use the following procedures to view the audit messages and configuration data properties.

To view the audit status messages for configuration baselines and configuration items

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. Right-click the query All Audit Status Messages from a Specific Site, and then click Show Messages.

  3. In the All Audit Status Messages from a Specific Site dialog box, you are prompted for the site code and time range. Select Site Code, and then type in the site code of the Configuration Manager site that manages desired configuration management.

  4. Select Time, and then either specify the time value for Select data and time or specify the time value for Select date and time.

  5. Click OK.

  6. The audit status messages are displayed in the Status Message Viewer. Locate the status messages that have a Component named Microsoft.ConfigurationManagement.dll for desired configuration management.

  7. Right-click each desired configuration management audit status message, and then select Detail. Displayed in the Status Message Details dialog box is more information such as the action audited, the user security context under which the action was performed, the time, and more information about the action itself in the Description.

  8. Click OK to close the Status Message Details dialog box, and close the Status Message Viewer.

    Note
    For more information about the option in the Status Message Viewer, see Status Message Viewer Window.

To view the configuration data properties to see creation and modification information

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. To view information about configuration baselines, click the Configuration Baselines node. To view information about configuration items, click the Configuration Items node.

  3. Click a configuration baseline or configuration item. The bottom of the pane will display the General tab information, which includes the following properties:

    • Type
    • Version
    • Site Code
    • Created
    • Created By
    • Last Modified
    • Last Modified By
    Note
    For more information about the options on the desired configuration management home pages, see Configuration Baselines Home Page and Configuration Items Home Page.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to View Compliance Results for Desired Configuration Management

After you have assigned Configuration Manager 2007 configuration baselines to client computers, the next step is to view the compliance evaluation results that are returned by computers.

Note
For information about how compliance is evaluated in desired configuration management, see About Compliance and Compliance Information in Desired Configuration Management.

The content in this section provides the steps necessary to accomplish the various tasks that relate to viewing compliance with assigned configuration baselines in Configuration Manager 2007.

In This Section

How to Use the Desired Configuration Management Home Page

How to Use the Non-Compliance Severity Level

How to Determine Why a Computer Reported a Non-Compliance Status for a Configuration Item

How to View Compliance of a Single Computer

How to View Compliance with Assigned Configuration Baselines

How to View Compliance of a Configuration Item

How to View Compliance of a Collection

How to Instruct Helpdesk Administrators to Troubleshoot a Client Computer

How to Remediate Non-Compliant Computers Using Software Distribution

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management

Other Resources

Desired Configuration Management in Configuration Manager
Tasks for Desired Configuration Management


How to Use the Desired Configuration Management Home Page

The home page for the Desired Configuration Management node in Configuration Manager 2007 provides a snapshot of the compliance status of client computers that report up to the site. Compliance evaluation results are sent from client computers to their management point with state messages and status messages.

From the home page, you can perform the following actions:

  • View a list of assigned configuration baselines that are reporting non-compliance, with a summary for each of the compliance evaluation results.
  • Launch a report of the listed configuration baselines to view more detailed information about the compliance evaluation results.
  • View a graphical representation in a pie chart of the compliance evaluation results for assigned configuration baselines.
  • Filter the information shown by the non-compliance severity level and the configuration category.
  • Set the schedule to update the home page information, and request an ad-hoc update of information.
  • Use the section Links and Resources to access useful shortcuts to relevant actions and information.
Note
For more information about each option on the desired configuration management home page, see Desired Configuration Management Home Page.

To view a list of assigned configuration baselines that are reporting non-compliance, with a summary for each of the compliance evaluation results

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Under the section Desired Configuration Compliance Summary, displayed on the left is a list of assigned configuration baselines. By default, these are filtered to display only the configuration baselines that are reporting out of compliance with the severity level of Error or Critical. The configuration baselines are further sorted in descending order for the highest number of non-compliance results. Scroll across to see reported values for the following columns:

    • Name: The specified name of the configuration baseline.
    • Severity: The severity level configured in the configuration item if non-compliance is reported or if the configuration item is not present on the client computer.
    • Assigned Count: The number of computers that have been assigned the configuration baseline.
    • Non-compliant Count: The number of computers that have reported back a non-compliance status with the selected baseline.
    • Compliance Count: The number of computers that have reported back a compliance status with the selected baseline.
    • Failure Count: The number of computers that have reported back a failure in evaluating their compliance status with the selected baseline.
    • Compliance Level (expressed as a number percentage): The number of computers that have reported a compliance status, with the selected baseline divided by the number of computers assigned the configuration baseline, expressed as a number percentage.
    • Compliance Level (expressed as a graphical percentage): The number of computers that have reported a compliance status, with the selected baseline divided by the number of computers assigned the configuration baseline, expressed as a bar chart.

To launch a report of the listed configuration baselines to view more detailed information about the non-compliant computers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Under the section Desired Configuration Compliance Summary, click the name of the configuration baseline that you want to drill into to see a more detailed report on the non-compliance information.

  3. If this is the first time you have launched a report from this home page, you will see the Report Options dialog box. Accept or specify the default reporting point, and optionally specify whether you want to open a new window for reports that are launched from this home page. Click OK.

  4. In the Summary Compliance by Configuration Baseline report, you can further drill down into the details by clicking next to the configuration baseline name to display the report Non-Compliance details for a configuration item on a computer.

  5. Close the reports to return to the Desired Configuration Management home page.

To view a graphical representation of the client computers that are reporting a non-compliance status, using a pie-chart format:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Under the section Desired Configuration Compliance Summary, on the right, a pie chart displays the compliance results for the selected configuration baselines on the left. When more than one configuration baseline is selected, the pie chart displays aggregate data for all the selected configuration baselines. The pie chart is divided into the following sections:

    • Compliant: The percentage of client computers that have reported a compliance status with the selected configuration baseline.
    • Not Compliant: The percentage of client computers that have reported a non-compliance status with the selected configuration baseline.
    • Failed: The percentage of client computers that have failed to return either a compliant or non-compliant status with the selected configuration baseline.
    • Unknown: The percentage of client computers that have been assigned the selected configuration baseline but have not returned compliance status information.

To filter the information shown by severity and category

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Under the section Desired Configuration Compliance Summary, use the drop-down list Choose Minimum Severity to filter the configuration baselines displayed. The non-compliance severity setting is configured in each configuration item. It can be used if the configuration item is not present on client computers and also if it is present but fails the validation criteria. Possible values for Choose Minimum Severity are the following:

    • Information - no Windows event messages: The default. All configuration baselines are displayed. Use this option if you want to see all configuration baselines, including configuration baselines that are not assigned or that have full compliance reported back.
    • Error: The configuration baselines are displayed if any configuration item from them report a non-compliance status and the severity level for the configuration item is configured for Error.
    • Warning: The configuration baselines are displayed if any configuration item from them report a non-compliance status and the severity level for the configuration item is configured for Warning or Error.
    • Information: The configuration baselines are displayed if any configuration item from them report a non-compliance status and the severity level for the configuration item is configured for Warning, Error, or Information.

  3. Under the section Desired Configuration Compliance Summary, use the drop-down list Choose Category to filter the configuration baselines displayed according to their assigned categories.

To set the schedule to update the home page information and request an ad-hoc update of information

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Click Schedule Home Page Summarization on the Actions pane, or select this option by right-clicking on the Desired Configuration Management node.

  3. In the Custom Schedule dialog box, specify the Duration values for how often you want the information to be updated in the home page. The information displayed is dependent on the schedule of the assigned configuration baselines, so setting a more frequent summarization schedule might not result in newer information being displayed.

  4. To request an ad-hoc update of information displayed from hardware inventory results, click Run Home Page Summarization. This sends a request to retrieve, process, and then display the latest information in the home page. This action is not the same as a Refresh, which redisplays the same information.

    Note
    To check when the information was last displayed, view the Last Updated information on the Desired Computer Configuration Compliance Summary bar.

To use the Links and Resources as useful shortcuts to relevant actions and information

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Navigate to the section Links and Resources in the bottom portion of the home page.

  3. Under the section Navigation, click the links to take you to the related section of the tree in the Configuration Manager console.

  4. Under the section Web Reports, click any of the popularly used Web reports to provide more detailed information about the compliance evaluations of client computers.

    Note
    A full list of reports relating to desired configuration management can be found by navigating to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports. To easily locate the reports associated with desired configuration management, sort the list of reports by the Category named Desired Configuration Management.

  5. Under the section Resources, click the links that provide related information to the configuration and use of desired configuration management and Configuration Manager 2007.

See Also

Concepts

About Reports for Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management
About Configuration Categories in Desired Configuration Management
About the Non-Compliance Severity Level in Desired Configuration Management
About Compliance and Compliance Information in Desired Configuration Management

Other Resources

Desired Configuration Management in Configuration Manager


How to Use the Non-Compliance Severity Level

The non-compliance severity level in Configuration Manager 2007 produces Windows application event messages on non-compliant client computers and sends non-compliance information to the Configuration Manager site in status messages.

You can use these status messages in Configuration Manager 2007 to filter on non-compliance results using the following procedures.

To use the non-compliance severity level in Configuration Manager 2007

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management and use the Choose Minimum Severity drop-down list. For example, to see all configuration baselines that are defined, select Information - no Windows event messages. To see configuration baselines that have reported a non-compliance evaluation of Information or Warning, but not Critical, select Warning.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports and right-click the report Summary compliance by configuration item. In the Report Information page, you can filter the results of the report by specifying Minimum Severity before clicking Display.

  3. Define a query to automatically populate a collection for software distribution with client computers reporting a non-compliant status for an application configuration item. You can refine the query by defining the minimum severity level so that, for example, only non-compliant client computers that report a minimum severity level of Error are sent the software distribution through a mandatory advertisement.

See Also

Tasks

How to Remediate Non-Compliant Computers Using Software Distribution

Concepts

About the Non-Compliance Severity Level in Desired Configuration Management
About Compliance and Compliance Information in Desired Configuration Management
Desired Configuration Management Home Page

Other Resources

Tasks for Desired Configuration Management


How to Determine Why a Computer Reported a Non-Compliance Status for a Configuration Item

When client computers in Configuration Manager 2007 report a non-compliance status for a configuration item in an assigned configuration baseline, you can determine why it failed compliance by running the following report: Non-compliance details for a specific configuration item on a computer.

Use the following procedure to view the non-compliance information for a specified configuration item on a computer.

To determine why a configuration item failed compliance on a computer by running a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to desired configuration management.

  3. Right-click the report Non-compliance details for a configuration item on a computer.

  4. In the Report Information page, type in the name of the computer or click Values to select it from a list for the Computer Name. Type in the configuration item name, or click Values to select it from a list for the Configuration Item Name. Optionally, type in or select the Configuration Item Content Version.

  5. Click Display to view the report. Information about the configuration item is displayed, such as which property within the configuration item caused the non-compliance status and the non-compliance severity level.

    Note
    For information about interpreting compliance information, see About Compliance and Compliance Information in Desired Configuration Management.

  6. Close the report.

See Also

Tasks

How to Edit a Configuration Item in Desired Configuration Management

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About the Non-Compliance Severity Level in Desired Configuration Management
About Content Versions in Desired Configuration Management
About Reports for Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to View Compliance of a Single Computer

When a client computer in Configuration Manager 2007 has downloaded assigned configuration baselines and evaluated its compliance with them, it reports the compliance results to its assigned site. You can view the compliance information with a choice of procedures:

  • Run a desired configuration management report from the reporting point.
  • Use Configuration Manager on the client computer.

To view the compliance of a computer by running a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to desired configuration management.

  3. Right-click the report Compliance for a computer by baseline, and click Run.

  4. In the Computer Name text box, type the computer name or click Values to select it from a list.

  5. Click Display to view the report. The list of configuration baselines displays, along with an indication of whether the computer was compliant or non-compliant with each configuration baseline. For more details about which configuration item was out of compliance, drill down into each configuration baseline to view the report Compliance details for a configuration baseline.

  6. Close the report.

To view the compliance of a computer using Systems Management on the client computer

  1. Navigate Configuration Manager in the Control Panel of the client computer, and double-click it to open its properties.

  2. Click the Configurations tab, and view the list of assigned configuration baselines.

  3. View the Compliance State column for each configuration baseline:

    • Compliant: The client computer is in compliance with the evaluated configuration baseline.
    • Non-Compliant: The client computer is out of compliance with the evaluated configuration baseline.
    • Unknown: The client computer has not yet run evaluation of the configuration baseline. If required, initiate evaluation outside the compliance evaluation schedule by selecting the configuration baselines to evaluate, and then click Evaluate.
    Note
    If you have local administrator privileges on the client computer, you can view details of each evaluated configuration baseline to determine which configuration item is reporting a non-compliant status. To do this, select the configuration baseline, and then click View Report.

  4. Click OK

    Note
    For more information about the options in the Configurations tab, see Configuration Manager Properties: Configurations Tab.

See Also

Tasks

How to Instruct Helpdesk Administrators to Troubleshoot a Client Computer

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Reports for Desired Configuration Management


How to View Compliance with Assigned Configuration Baselines

When client computers in Configuration Manager 2007 download assigned configuration baselines and evaluate their compliance with them, they report their compliance results to their management point. You can view this compliance information by configuration baselines with a choice of procedures:

  • View the Desired Configuration Management home page.
  • Run a desired configuration management report from the reporting point.

To view the compliance with assigned configuration baselines using the Desired Configuration Management home page

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. The section Desired Configuration Compliance Summary lists all assigned configuration baselines that report an out-of-compliance status. Each displayed configuration baseline has further details displayed in columns, and you can view the graphical representation in the pie chart of the following compliance status: Compliant, Not Compliant, Failed, Unknown.

  3. If required, filter the display of configuration baselines, using the options Minimum Severity and Category.

    Note
    For more information about the options on the desired configuration management home page, see Desired Configuration Management Home Page.

To view the compliance with assigned configuration baselines by running a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to desired configuration management.

  3. Right-click the report Summary compliance by configuration baseline, and then click Run.

  4. In Report Information, specify any values if you want to refine the report information displayed, and then click Display. For example, you can do the following:

    • If you want to see the compliance results of all assigned configuration baselines, do not enter any additional values.
    • If you want to see the compliance results of a particular assigned configuration baseline, enter the name of the baseline in the Baseline Display Name text box, or click Values and select the name of the configuration baseline.
    • If you want to see the compliance results of assigned configuration baselines that share the same category, enter name of the category in the Category text box, or click Values and select the category for the configuration baselines.
    • If you want to see the compliance results of assigned configuration baselines only if they contain configuration items with a minimum severity level, enter the Minimum Severity, or click Values and select the severity level.

  5. Close the report.

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Reports for Desired Configuration Management

Other Resources

How to View Compliance Results for Desired Configuration Management
Tasks for Desired Configuration Management


How to View Compliance of a Configuration Item

When client computers in Configuration Manager 2007 have downloaded assigned configuration baselines and reported their compliance to their assigned site, you can run the following report to view the compliance information for a specified configuration item: Summary compliance by configuration item.

Follow this procedure to view the compliance information for a specified configuration item.

To view the compliance of a configuration item by running a report

  1. In the Configuration Management console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to desired configuration management.

  3. Right-click the report Summary compliance by configuration item, and then click Run.

  4. In the Report Information page, type in the name of the configuration item or click Values to select it from a list. Supply additional information for the following fields if you need to refine the information that is returned:

    • Category
    • Configuration Item Version
    • Minimum Severity

  5. Click Display to view the report. The configuration item displays with information such as how many computers were compliant or non-compliant with the configuration item, the number of computers that reported compliance information for this configuration item, and the compliance percentage. You can drill down into the configuration item to view another report (Compliance for a computer by configuration item) for more details about the compliance information for the configuration item on each computer.

  6. Close the report.

See Also

Tasks

How to Determine Why a Computer Reported a Non-Compliance Status for a Configuration Item

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Reports for Desired Configuration Management

Other Resources

How to View Compliance Results for Desired Configuration Management
Tasks for Desired Configuration Management


How to View Compliance of a Collection

When client computers in Configuration Manager 2007 download assigned configuration baselines and evaluate their compliance with them, they report their compliance results to their assigned site in state messages. Configuration baselines are assigned to collections, and a collection can have more than one configuration baseline assigned. To view the compliance information by collection, run the report Compliance by collection.

You can run this report with two procedures:

  • From the Desired Configuration Management home page.
  • From the Reports node.

To view the compliance of a collection by running the report Compliance by collection from the home page

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. In the section Links and Resources, under Web Report, click Compliance by collection.

  3. Enter the collection ID, or click Values and select it.

  4. Click Display.

    Note
    For more information about the options on the desired configuration management home page, see Desired Configuration Management Home Page.

To view the compliance of a collection by running the report Compliance by collection from the Reports node

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to desired configuration management.

  3. Right-click the report Summary Compliance for a Collection by Computer, and click Run.

  4. Enter the collection ID, or click Values and select it.

  5. Click Display.

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Reports for Desired Configuration Management

Other Resources

How to View Compliance Results for Desired Configuration Management
Tasks for Desired Configuration Management


How to Instruct Helpdesk Administrators to Troubleshoot a Client Computer

If a user contacts the helpdesk about a computer not working as expected, helpdesk staff can use the Configuration Manager Client Configuration Manager to help diagnose the computer by identifying configurations that are not compliant with the configuration baselines defined in Configuration Manager 2007.

When a client computer downloads its assigned configuration baselines, these are displayed on the Configurations tab of Configuration Manager, together with compliance evaluation results. Users with administrative rights can also view details of the compliance evaluation to see which configuration items are out of compliance.

Note
If the Configurations tab is not visible, the client is not running the desired configuration management client agent. This might be because the site is not enabled for desired configuration management, or the site is enabled for desired configuration management but the client has not yet downloaded its machine policy, or a local policy has disabled the desired configuration management client agent, or the client is not a Configuration Manager Client.

To troubleshoot a client computer using Configuration Manager

  1. Navigate to Configuration Manager in the Control Panel of the client computer, and double-click to open its properties.

  2. Click the Configurations tab, and then view the list of assigned configuration baselines.

    Note
    If there are no configuration baselines displayed but there are configuration baselines assigned to this computer, it is probable that they have not yet been downloaded.

    To accelerate this process, click the Actions tab, click Machine Policy Retrieval & Evaluation Cycle, and then click Initiate Action. Click OK on the informational dialog box Machine Policy Retrieval & Evaluation Cycle. When this has completed, click Refresh on the Configurations tab to display the downloaded configuration baselines.

  3. View the Compliance State column for each configuration baseline. If the configuration baselines are named appropriately, this helps to identify where the computer is out of compliance.

  4. For any configuration baselines that display Non-Compliant, select the configuration baseline, and then click View Report.

  5. View the displayed report to determine the configurations that are reporting out of compliance, and resolve these configurations. You must have local administrator privileges to view these compliance reports.

    Note
    To help interpret the results, see About Compliance and Compliance Information in Desired Configuration Management.

  6. When the non-compliant configurations are resolved, select the configuration baseline, and then click Evaluate. This will re-run the compliance evaluation, and you will see the Compliance State display In Progress.

    Important
    The evaluation results are cached on the client for 15 minutes. If you initiate a re-evaluation within the 15 minute period, the compliance results will be returned from this cache rather than a new evaluation. Therefore, if you make a change on the client that might affect the compliance evaluation results, wait until the 15 minutes have elapsed before initiating a re-evaluation.

  7. If all configuration items are now configured according to the compliance configuration defined in the configuration baselines, all configuration baselines display Compliant in the column Compliance.

  8. Click OK to close Configuration Manager.

    Note
    For more information about the options in the Configurations tab, see Configuration Manager Properties: Configurations Tab.

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Reports for Desired Configuration Management

Other Resources

Troubleshooting Desired Configuration Management
Tasks for Desired Configuration Management


How to Remediate Non-Compliant Computers Using Software Distribution

You can use the compliance results from a Configuration Manager 2007 configuration item or configuration baseline to dynamically populate a collection with computers that report a specific compliance state or a specific non-compliance severity level.

You can then use Configuration Manager 2007 software distribution to assign a package or script to this collection which could, for example, either remediate the non-compliance condition or send a notification to an administrator that this condition requires attention.

For example, an application configuration item that checks for a specific version of Microsoft Office could be configured to report as non-compliant if the version number is not your standard release version. The configuration item could additionally be configured to report a specific non-compliance level such as Error in this case. If you create a collection that dynamically populates with computers that report a non-compliance severity level of Error for this application item, you can then assign to that collection a software distribution package to install the correct version of Office. When the application configuration item is next assessed for compliance, the client computer will report a compliance status and the computer will be dynamically removed from the collection.

The query you use to specify the collection membership defines the non-compliance severity level as a number. These non-compliance severity levels map to the following numbers in the query:

Non-Compliance Severity Level | Number Mapping
Information - no Windows event messages | 1
Information | 2
Warning | 3
Error | 4

You can build your collection query based on the non-compliance severity level of a configuration item or a configuration baseline.

You will need to specify the unique ID associated with the configuration item or configuration baseline, in addition to the display name. You can find the unique ID values by adding the column CI Unique ID to the display columns on the home pages for the Configuration Baselines node, or the Configuration Items node.For more information, follow the procedure in How to Distinguish Configuration Data with the Same Name in Desired Configuration Management.

You can use the query builder to create your collection query, or you can use the query example in the following procedures.

After using these procedures, perform the following steps:

  • Ensure that you have created a Configuration Manager 2007 package containing software or scripts to remediate the non-compliant configuration item or configuration baseline.
  • Create a mandatory advertisement using standard software distribution methods to distribute this package to computers in the collection that you have created.

To remediate non-compliant computers by compliance state using software distribution

  1. Copy the following query and paste it into a text editor, such as Notepad:

    Copy Code
    select SMS_R_System.ResourceId,
SMS_R_System.ResourceType,
SMS_R_System.Name,
SMS_R_System.SMSUniqueIdentifier,
SMS_R_System.ResourceDomainORWorkgroup,
SMS_R_System.Client
from
SMS_R_System inner join SMS_G_System_CI_ComplianceState on SMS_G_System_CI_ComplianceState.ResourceID = SMS_R_System.ResourceId
Where
SMS_G_System_CI_ComplianceState.ComplianceStateName = "<ComplianceState>"
and SMS_G_System_CI_ComplianceState.LocalizedDisplayName = "<BaselineName>"
and SMS_G_System_CI_ComplianceState.CI_UniqueID = "<CI Unique ID>"

  2. In the query, change <ComplianceState> to the compliance state of the configuration item or configuration baseline. This can be one of:

    • compliant
    • non-compliant

  3. In the query, change <BaselineName> to the name of the configuration baseline or the configuration item as it appears in the Configuration Manager console.

  4. In the query, change <CI Unique ID> to the unique ID associated with the configuration item or configuration baseline.

  5. Create the collection by right-clicking the Collections node and then selecting New Collection to launch the New Collection Wizard.

  6. On the General page, specify the collection name and, optionally, specify a description.

  7. On the Membership Rules page, click the second Membership rules icon to display the Query Rules Properties dialog box.

  8. Ensure System Resource is selected as the Resource class, and then click Edit Query Statement.

  9. In the Query Statement Properties dialog box, click Show Query Language.

  10. In the Query Statement Properties dialog box, paste the modified query into the Query Statement edit box.

  11. Click OK to save the query and close the Query Statement Properties dialog box.

  12. In the Query Rule Properties dialog box, optionally select Limit to collection, and then click OK.

  13. On the Membership Rules page of the New Collection Wizard, optionally click Schedule if you want to define a collection membership update schedule that is shorter than the default of every day.

  14. If you are defining an alternative schedule, specify your alternative in the Custom Schedule dialog box, and then click OK.

  15. Complete the wizard.

To remediate non-compliant computers by non-compliance severity using software distribution

  1. Copy the following query and paste it into a text editor, such as Notepad:

    Copy Code
    select SMS_R_System.ResourceId,
SMS_R_System.ResourceType,
SMS_R_System.Name,
SMS_R_System.SMSUniqueIdentifier,
SMS_R_System.ResourceDomainORWorkgroup,
SMS_R_System.Client
from
SMS_R_System inner join SMS_G_System_CI_ComplianceState on SMS_G_System_CI_ComplianceState.ResourceID = SMS_R_System.ResourceId
Where
SMS_G_System_CI_ComplianceState.ComplianceStateName = non-compliant
And SMS_G_System_CI_ComplianceState.MaxNoncomplianceCriticality = "<Severity>"
and SMS_G_System_CI_ComplianceState.LocalizedDisplayName = "<BaselineName>"
and SMS_G_System_CI_ComplianceState.CI_UniqueID = "<CI Unique ID>"

  2. In the query, change <Severity> to the non-compliance severity level of the configuration item or configuration baseline. This can be one of the following:

    • 1 (Information - no Windows event messages)
    • 2 (Information)
    • 3 (Warning)
    • 4 (Error)

  3. In the query, change <BaselineName> to the name of the configuration baseline or the configuration item as it appears in the Configuration Manager console.

  4. In the query, change <CI Unique ID> to the unique ID associated with the configuration item or configuration baseline.

  5. Create the collection by right-clicking the Collections node and then selecting New Collection to launch the New Collection Wizard.

  6. On the General page, specify the collection name and, optionally, specify a description.

  7. On the Membership Rules page, click the second Membership rules icon to display the Query Rules Properties dialog box.

  8. Ensure System Resource is selected as the Resource class, and then click Edit Query Statement.

  9. In the Query Statement Properties dialog box, click Show Query Language.

  10. In the Query Statement Properties dialog box, paste the modified query into the Query Statement edit box.

  11. Click OK to save the query and close the Query Statement Properties dialog box.

  12. In the Query Rule Properties dialog box, optionally select Limit to collection, and then click OK.

  13. On the Membership Rules page of the New Collection Wizard, optionally click Schedule if you want to define a collection membership update schedule that is shorter than the default of every day.

  14. If you are defining an alternative schedule, specify your alternative in the Custom Schedule dialog box, and then click OK.

  15. Complete the wizard.

See Also

Tasks

How to Use the Results Columns in Desired Configuration Management

Concepts

About the Non-Compliance Severity Level in Desired Configuration Management
About Collections
Overview of Queries
Example Scenarios for Implementing Desired Configuration Management

Other Resources

Configuring Software Distribution
Tasks for Desired Configuration Management


How to Monitor the Site for Desired Configuration Management

The content in this section provides the steps necessary to monitor a site for desired configuration management in Configuration Manager 2007.

In This Section

How to Identify Computers that have Changed their Compliance Status in Desired Configuration Management

How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management

How to Identify Computers that Cannot Send their Compliance Status for Desired Configuration Management

How to Identify Computers that Have Not Reported Compliance for a Specified Time for Desired Configuration Management

How to Identify SML Compliance Evaluation Problems in Desired Configuration Management

How to Identify Client Issues with Assigned Configuration Baselines in Desired Configuration Management

See Also

Other Resources

Desired Configuration Management in Configuration Manager
How to View Compliance Results for Desired Configuration Management
How to Configure Configuration Baselines for Desired Configuration Management
How to Configure Configuration Items for Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


How to Identify Computers that have Changed their Compliance Status in Desired Configuration Management

Desired configuration management in Configuration Manager 2007 records the following status message IDs when a client computer changes its compliance status:

  • 11854: A compliance change from non-compliant to compliant or from unknown to compliant.
  • 11855: A compliance change to non-compliant with a non-compliance severity level of Information.
  • 11856: A compliance change to non-compliant with a non-compliance severity level of Warning.
  • 11857: A compliance change to non-compliant with a non-compliance severity level of Error.

For more information about when changes of compliance are sent to the site, see Compliance Sent As State Messages and Status Messages in Desired Configuration Management.

Use the following procedure to find status messages to identify the changes in compliance status.

To identify computers that have changed their compliance status

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. Right-click the query All Status Messages, and then click Show Messages.

  3. In the All Status Messages dialog box, you are prompted for the time period for which you want to check status messages. Enter the time period or date and time, and then click OK.

  4. All status messages are displayed in the Status Message Viewer. Click the Component column, and locate the status messages with a component named Desired Configuration Management.

  5. Identify the change in compliance status messages, which can be any of the following:

    • 11854
    • 11855
    • 11856
    • 11857

  6. For more information about any of the status messages, right-click a status message, and then select Detail.

  7. View the information in the Status Message Details dialog box, and then click OK to close this dialog box, or click Previous or Next to view the details of other status messages.

  8. Click OK to close the Status Message Details dialog box, and close the Status Message Viewer.

    Note
    For information about the options in the Status Message Details dialog box, see Status Message Details Dialog Box.

See Also

Concepts

About the Non-Compliance Severity Level in Desired Configuration Management
About Compliance and Compliance Information in Desired Configuration Management
Compliance Sent As State Messages and Status Messages in Desired Configuration Management
ConfigMgr Status Message Viewer Overview

Other Resources

Tasks for Desired Configuration Management


How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management

Desired configuration management in Configuration Manager 2007 records the following status message ID when a client computer is enabled for desired configuration management and it is assigned a configuration baseline, but compliance evaluation fails because it does not have the prerequisite .NET Framework v2.0 or later:

  • 11802

Use the following procedure to find this status message to identify computers that do not have the .NET Framework v2.0 or later installed.

To identify computers that do not have the .NET Framework v2.0 or later

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. Right-click the query All Status Messages, and then click Show Messages.

  3. In the All Status Messages dialog box, you are prompted for the time period for which you want to check status messages. Enter the time period or date and time, and then click OK.

  4. All status messages are displayed in the Status Message Viewer. Click the Component column, and locate the status messages with a component named Desired Configuration Management.

  5. In the Message ID column, look for 11802 to identify the computers that logged this message.

  6. For more information about these status messages, right-click a status message, and then select Detail.

  7. View the information in the Status Message Details dialog box, and then click OK to close this dialog box, or click Previous or Next to view the details of other status messages.

  8. Click OK to close the Status Message Details dialog box, and close the Status Message Viewer.

    Note
    For information about the options in the Status Message Details dialog box, see Status Message Details Dialog Box.

See Also

Tasks

How to Enable or Disable the Desired Configuration Management Client Agent

Concepts

Prerequisites for Desired Configuration Management
Preparing the Site for Desired Configuration Management
ConfigMgr Status Message Viewer Overview

Other Resources

Tasks for Desired Configuration Management


How to Identify Computers that Cannot Send their Compliance Status for Desired Configuration Management

Desired configuration management in Configuration Manager 2007 records the following status message ID when a client computer has evaluated one or more assigned configuration baselines but cannot send the compliance results to its management point:

  • 11853

Use the following procedure to find this status message to identify computers that failed to send their compliance status.

To identify computers that cannot send their compliance status

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. Right-click the query All Status Messages, and then click Show Messages.

  3. In the All Status Messages dialog box, you are prompted for the time period for which you want to check status messages. Enter the time period or date and time, and then click OK.

  4. All status messages are displayed in the Status Message Viewer. Click the Component column, and locate the status messages with a component named Desired Configuration Management.

  5. In the Message ID column, look for 11853 to identify the computers that logged this message.

  6. For more information about any of the status messages, right-click a status message, and then select Detail.

  7. View the information in the Status Message Details dialog box, and then click OK to close this dialog box, or click Previous or Next to view the details of other status messages.

  8. Click OK to close the Status Message Details dialog box, and close the Status Message Viewer.

    Note
    For information about the options in the Status Message Details dialog box, see Status Message Details Dialog Box.

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management
ConfigMgr Status Message Viewer Overview

Other Resources

Desired Configuration Management in Configuration Manager
Tasks for Desired Configuration Management


How to Identify Computers that Have Not Reported Compliance for a Specified Time for Desired Configuration Management

You can use a Configuration Manager 2007 report to identify all client computers that have not reported the compliance status of a configuration baseline for a specified number of days.

These procedures guide you through the process of using Configuration Manager 2007 to create and display a report using the Configuration Manager console.

To create a Configuration Manager report that identifies client computers that have not reported the compliance status of a configuration baseline for a specified number of days

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting.

  2. Expand the Reporting node, right-click Reports, click New, and then click Report.

  3. On the General page of the New Report Wizard, specify the following:

    • Name: Specify a name for the report such as Computers that have not reported compliance for a specified configuration baseline in a specified number of days.
    • Category: From the drop-down list select Desired Configuration Management - Errors.
    • Comment: Enter a descriptive comment for the report such as This report displays computers that have not reported compliance status for a specified configuration baseline in a specified number of days.
    • Click Edit SQL Statement.

  4. In the Report SQL Statement dialog box, specify the following:

    • SQL statement: Copy and paste the following code into the SQL statement box:
      Copy Code
      select distinct
   sys.Netbios_Name0,
   loc.DisplayName as BaselineName,
   cs.ComplianceStateName as ComplianceState,
   cs.LastComplianceMessageTime,
   DATEDIFF(Day, MAX(cs.LastComplianceMessageTime), GetDate()) AS "Days since last report"
from v_CITargetedMachines target with (NOLOCK)
inner join v_ConfigurationItems ci on ci.CI_ID=target.CI_ID
left join v_LocalizedCIProperties_SiteLoc loc on ci.CI_ID=loc.CI_ID
inner join v_R_System sys on sys.ResourceID=target.ResourceID
left join v_CICurrentComplianceStatus cs with (NOLOCK) on cs.CI_ID=ci.CI_ID and cs.ResourceID=target.ResourceID
where loc.DisplayName = @ciid
GROUP BY
   sys.Netbios_Name0,
   loc.DisplayName,
   cs.ComplianceStateName,
   cs.LastComplianceMessageTime
HAVING (@variable <= DATEDIFF(Day, MAX(cs.LastComplianceMessageTime), GetDate()))
ORDER BY sys.Netbios_Name0
    • Click Prompts.

  5. In the Prompts dialog box, click New to create a new prompt.

  6. In the Prompt Properties dialog box, specify the following:

    • Name: Specify the name variable.
    • Prompt text: Specify Enter number of days.
    • Click OK to close the Prompt Properties dialog box.

  7. In the Prompts dialog box, click New to create a new prompt.

  8. In the Prompt Properties dialog box, specify the following:

    • Name: Specify the name ciid.
    • Prompt text: Specify Baseline display name.
    • Select Provide a SQL statement.
    • Click Edit SQL statement.

  9. In the Prompt SQL Statement dialog box, specify the following:

    • Copy and paste the following code into the SQL statement box:
      Copy Code
      if (@__filterwildcard = '')
begin
   select distinct
   DisplayName,
   CI_UniqueID
   from v_ConfigurationItems ci
   left join v_LocalizedCIProperties_SiteLoc loc on ci.CI_ID=loc.CI_ID
   where ci.CIType_ID=2
   order by DisplayName
end
else
begin
  select distinct
   DisplayName,
   CI_UniqueID
   from v_ConfigurationItems ci
   left join v_LocalizedCIProperties_SiteLoc loc on ci.CI_ID=loc.CI_ID
   where ci.CIType_ID=2
   and Displayname like @__filterwildcard
   order by DisplayName
end
    • Click OK to close the Prompt SQL Statement dialog box.

  10. Click OK to close the Prompt Properties dialog box.

  11. Click OK to close the Prompts dialog box.

  12. In the LinkReportPromptsDialog dialog box, click Yes to update the prompts in the report.

  13. Click OK to close the Report SQL Statement dialog box.

  14. Click Ok to close the dialog box Computers that have not Reported Compliance for a Specified Configuration baseline in a Specified Number of Days.

To run the report that identifies client computers that have not reported the compliance status of a configuration baseline for a specified number of days

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to desired configuration management.

  3. Right-click the report Computers that have not reported compliance for a specified configuration baseline in a specified number of days, and click Run.

  4. In the Report Information page, specify the following information:

    • Enter Number of Days: Specify the number of days since client computers last reported compliance.
    • Baseline Display Name: Specify the name of the configuration baseline or click Values to select it from a list.
      Note
      It is possible for multiple configuration baselines to share the same display name. To help identify the correct configuration baseline, the configuration item unique ID is displayed alongside the configuration baseline name when you click Values. For further information about distinguishing configuration data with the same name, see How to Distinguish Configuration Data with the Same Name in Desired Configuration Management.

  5. Click Display to view the report. A list of client computers that have not reported compliance for the specified number of days is displayed, together with the last successful compliance state and its date and time.

  6. Close the report.

See Also

Tasks

How to Distinguish Configuration Data with the Same Name in Desired Configuration Management

Concepts

About Reports for Desired Configuration Management

Other Resources

Tasks for Desired Configuration Management


How to Identify SML Compliance Evaluation Problems in Desired Configuration Management

When you import configuration data into Configuration Manager 2007, Configuration Manager is able to validate the structure and format of that configuration data when it conforms to the DCM Digest schema. However, when the configuration data contains Service Modeling Language (SML), Configuration Manager is not able to validate the structure or content of the data before sending it to clients.

Note
For more information about how Configuration Manager uses DCM Digest and SML, see About Authoring Configuration Data for Desired Configuration Management.

SML compliance evaluation on the client might fail because of either of the following scenarios:

  • The configuration data containing SML is not in a valid format.
  • The desired configuration management client agent failed to find the objects or settings specified in the configuration data. This is referred to as a discovery failure.

Use the following procedures to identify SML compliance evaluation problems by viewing reports and using status messages.

To identify SML compliance evaluation problems by running reports

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to desired configuration management.

  3. Locate the reports with a category of Desired Configuration Management - Errors.

  4. Right-click one of the reports, and then click Run.

  5. In Report Information, specify any values if required, and then click Display.

  6. View any errors, and then close the report.

To identify SML compliance evaluation problems using status messages

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management / System Status / Status Message Queries.

  2. Right-click the query All Status Messages, and then click Show Messages.

  3. In the All Status Messages dialog box, you are prompted for the time period for which you want to check status messages. Enter the time period or date and time, and then click OK.

  4. All status messages are displayed in the Status Message Viewer. Click the Component column, and then locate the status messages with a component named Desired Configuration Management.

  5. In the Message ID column, look for 11864 or 11865 to identify the computers that logged a failure when processing configuration data containing SML.

  6. For more information about these status messages, right-click a status message, and then select Detail.

  7. View the information in the Status Message Details dialog box, and then click OK to close this dialog box, or click Previous or Next to view the details of other status messages.

  8. Click OK to close the Status Message Details dialog box, and close the Status Message Viewer.

    Note
    For information about the options in the Status Message Details dialog box, see Status Message Details Dialog Box.

See Also

Tasks

How to Import Configuration Items in Desired Configuration Management
How to Import a Configuration Baseline in Desired Configuration Management

Concepts

About Authoring Configuration Data for Desired Configuration Management
Determine If You Need to Import Configuration Data for Desired Configuration Management
ConfigMgr Status Message Viewer Overview

Other Resources

Tasks for Desired Configuration Management


How to Identify Client Issues with Assigned Configuration Baselines in Desired Configuration Management

When clients experience problems downloading configuration data in Configuration Manager 2007, desired configuration management records a status message in the following table.

Message ID | Explanation
11800 | Indicates a download failure for a configuration item.
11801 | Indicates a hash failure for a configuration item.
11850 | Indicates a download failure for SML content.
11851 | Indicates the policy could not be uncompressed.
11858 | Indicates that packages for SML content could not be uncompressed.
11859 | Indicates a failure in evaluating a configuration item.
11860 | Indicates a failure in evaluating SML content.
11861 | Indicates a failure in the SML discovery type process.
11862 | Indicates the SML discovery type is halted.

Use the following procedure to find these status messages to identify client issues with assigned configuration baselines in Configuration Manager 2007.

To identify client issues with assigned configuration baselines

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. Right-click the query All Status Messages, and then click Show Messages.

  3. In the All Status Messages dialog box, you are prompted for the time period for which you want to check status messages. Enter the time period or date and time, and then click OK.

  4. All status messages are displayed in the Status Message Viewer. Click the Component column, and locate the status messages with a component named Desired Configuration Management.

  5. In the Message ID column, look for the following errors to identify client problems with configuration data:

    • 11800
    • 11801
    • 11850
    • 11851
    • 11858
    • 11859
    • 11860
    • 11861
    • 11862
    • 11863

  6. Click OK to close the Status Message Details dialog box, and close the Status Message Viewer.

    Note
    For information about the options in the Status Message Details dialog box, see Status Message Details Dialog Box.

See Also

Concepts

About Authoring Configuration Data for Desired Configuration Management
About Configuration Items in Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
ConfigMgr Status Message Viewer Overview

Other Resources

Tasks for Desired Configuration Management


Troubleshooting Desired Configuration Management

Click any link in the following section for troubleshooting information for desired configuration management with Configuration Manager 2007.

This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=88871.

In This Section

Troubleshooting Desired Configuration Management Issues

Lists possible problems and solutions if you experience issues when using desired configuration management.

Log Files for Desired Configuration Management

Lists and describes the log files created on the client during compliance evaluation for desired configuration management.

Troubleshooting Desired Configuration Management Using Custom Error Codes

Lists possible causes and solutions for Desired Configuration Management Custom Error Codes

See Also

Other Resources

Desired Configuration Management in Configuration Manager


Troubleshooting Desired Configuration Management Issues

Click any link in the following section for troubleshooting Configuration Manager 2007 desired configuration management issues.

In This Section

Problems Editing Configuration Data in the Configuration Manager Console

Lists possible problems and solutions if you experience issues when editing configuration baselines or configuration items in the Configuration Manager console.

Compliance Information Missing in Desired Configuration Management

Describes possible causes and solutions for "Error" or "Unknown" displayed instead of compliance information in desired configuration management reports.

Unexpected Data in Desired Configuration Management Reports

Lists scenarios that produce unexpected data in desired configuration management reports, with solutions to help you interpret this data.

Import Failures with Desired Configuration Management

List the circumstances under which importing configuration data will fail to help you diagnose and resolve import failures.

Unexpected Compliance Results in Desired Configuration Management

Lists known compliance evaluation results for specific scenarios, such as error conditions.

See Also

Other Resources

Troubleshooting Desired Configuration Management
Desired Configuration Management in Configuration Manager


Problems Editing Configuration Data in the Configuration Manager Console

Topic last updated—November 2007

This section provides troubleshooting information to help you resolve issues when you are editing and managing configuration items and configuration baselines in the Configuration Manager 2007 console. For help with individual options within configuration items and configuration baselines, press F1 in the relevant dialog box.

Read-Only Configuration Data

You can edit the properties of configuration baselines and configuration items only if they were created at the same Configuration Manager site. You will not be able to edit them, and they will appear as read-only in the following circumstances:

  • They have been imported from Microsoft System Center Configuration Manager 2007 Configuration Packs.
  • They have been imported from an external source, such as the Configuration Manager 2007 communities.
  • They have been imported from another Configuration Manager 2007 hierarchy.
  • They have been authored externally and then imported.
  • They have been inherited by a parent site in the same Configuration Manager 2007 hierarchy.

Solution

Although this behavior is by design, you can modify imported data in the following ways:

  • If you want to add new configuration items to a read-only configuration baseline, you can create a new configuration baseline and include the read-only configuration baseline as a dependent configuration baseline. For more information, see How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management.
  • If you want to add new objects and settings or additional validation to read-only configuration items, create a child configuration item. For more information, see How to Create a Child Configuration Item in Desired Configuration Management.
  • If you want to remove the configuration of a read-only configuration baseline or a configuration item, you must create a duplicate instead. For more information, see How to Create a Duplicate Configuration Baseline in Desired Configuration Management and How to Create a Duplicate Configuration Item in Desired Configuration Management.

For a recommended path to using imported configuration data with modifications to suit your business requirements, see Desired Configuration Management Administrator Workflows.

Cannot Duplicate Configuration Items

Some configuration items might not have the Duplicate option enabled when they are selected. This happens when the configuration item has been imported into Configuration Manager 2007 and the Configuration Manager console is not able to interpret all of the configuration item content. Because the content cannot be interpreted, it cannot be duplicated.

Solution

Although this behavior is by design, if the Configuration Manager console can interpret some of the content in a configuration item, you can create a child configuration item and then add objects and settings to the child configuration item. For more information about creating child configuration items, see How to Create a Child Configuration Item in Desired Configuration Management.

Cannot Create Child Configuration Item

Some configuration items might not have a Create Child Configuration Item option enabled when they are selected. This happens when the configuration data has been imported into Configuration Manager 2007 and the Configuration Manager console is not able to interpret any of the configuration data content.

In this scenario, the configuration item has the following special icon, which is an uninterpreted configuration item.

Uninterpreted Configuration Icon Uninterpreted Configuration Item Icon

Solution

This behavior is by design, and the special icon warns you that its contents cannot be viewed, duplicated, or used to create a child configuration item. However, you can still add this configuration item to configuration baseline rules, and it will be correctly evaluated by Configuration Manager 2007 clients.

Cannot Delete a Configuration Item Being Referenced by a Configuration Baseline

If a configuration item is referenced by a configuration baseline and the logged-on user does not have modify permissions on this configuration baseline, the Delete option will be unavailable. In addition, if the user lacks modify permissions on any referencing configuration baselines such as a grandparent, the configuration item cannot be deleted.

Solution

Add modify permissions to any referencing configuration baselines.

Configuration Items Do Not Display Details

Some configuration items might not display all their properties in the Configuration Manager console. This happens when the configuration item has been imported into Configuration Manager 2007 and the Configuration Manager console is able to interpret some but not all of the configuration item content.

Solution

This behavior is by design. In this scenario, the Configuration Manager will display the configuration item content that it can display as read-only. You cannot create a duplicate configuration item from this configuration item, but you can create a child configuration item from it and add it to configuration baseline rules, and all the configuration item content will be correctly evaluated by Configuration Manager 2007 clients.

Cannot Add Object Permissions to Child Configuration Items

A child configuration item lets you add objects, settings, and more restrictive validation to the original configuration item. However, you cannot add permissions to objects, such as files, folders, and registry keys.

For more information about child configuration items, see About Configuration Items in Desired Configuration Management.

Solution

This behavior is a known limitation of child configuration items. In this scenario, add the permissions to the parent configuration item from the child site.

Duplicated Configuration Items Display Original Name

When you create a duplicate configuration item, it might display the original name rather than the new name in the Configuration Manager console in the following circumstances:

  • When the configuration item is first created, the duplicate name displays correctly in the results pane, but the properties pane and the properties of the configuration item display the original configuration item name.
  • When the duplicate configuration item is then edited for one of its properties except the display name and then saved, the duplicate name displays the original name in the results pane and in the properties when subsequently opened.

Solution

After creating a duplicate configuration item, edit it and change the duplicate configuration item display name to the required value. The duplicate configuration item name will then display correctly in all places.

Cannot View Properties of a Configuration Item from a Child Site

If you are unable to view the properties of a configuration item from a child site when the configuration item has been replicated from a parent site, this could be because the configuration item was deleted and then re-imported at the parent site before the deletion of the original configuration item had replicated to the child site.

Solution

Use one of the following solutions:

  • When deleting a configuration item from a parent site, wait until the deletion has replicated to the child site before re-importing the configuration item.
  • If you are already experiencing this problem, delete the configuration item from the parent site, wait for replication to take place, and then import the configuration item again.

Configuration Item Script Setting Is Not Displayed Correctly If Script Uses Japanese Characters

If a configuration item script setting uses a Japanese character set, this might not display correctly in the Configuration Manager console. Additionally, the configuration item evaluation might return a compliance state of Error.

Solution

Scripts containing Japanese characters might be encoded using the MBCS format, which the Configuration Manager console cannot support. A workaround is to open the script file in Windows Notepad and save it in UTF-8 format before opening the file in the Configuration Manager console.

Results Pane Displays Blank Names and Descriptions in a Multi-Language Hierarchy

The display name and description chosen for configuration baselines, configuration items, and configuration categories might not display in the results pane on a child site when the child site is in a different language than the parent site. Instead, these names appear blank. However, they are displayed in the original language in the results pane (the lower section of the results pane) and in the properties when you view the properties of the configuration data.

For example, if you create a configuration item on an English version of Configuration Manager 2007, when the configuration item is inherited by a child site that is running a German version of Configuration Manager 2007, the configuration item's display name and description will appear blank in the results pane but display in English in the properties pane, as well as in the properties if you double-click the configuration item.

Solution

This is a known limitation of running desired configuration management in a multi-language hierarchy. In this scenario, refer to the display names in the properties pane or the properties.

See Also

Concepts

About Authoring Configuration Data for Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management
Desired Configuration Management Administrator Workflows


Compliance Information Missing in Desired Configuration Management

Topic last updated—November 2007

This section provides troubleshooting information to help you resolve issues with compliance information missing from the desired configuration management reports in Configuration Manager 2007.

Missing Compliance Information Because Clients Do Not Have the Microsoft .NET Framework Installed

When you are missing compliance information from a computer, check that the client has Microsoft .NET Framework 2.0 or later installed. This is a prerequisite for desired configuration management in Configuration Manager 2007. If this prerequisite is missing, you will see the following symptoms:

  • On the client's Configurations tab, the name of the configuration baseline displays Unknown:ScopeId_<number>, the Last Evaluation value displays N/A, the Compliance State displays Unknown, and clicking View Report displays a message that the report is either empty or not valid. Additionally, the client DCMAgent.log file contains the reference SetupForDiscovery : .Net not installed.
  • On the server reports for desired configuration management, compliance results for the client will be missing from many reports. However, the report Computers with compliance evaluation failures lists computers that do not have Microsoft .NET Framework 2.0 or later installed. From this report, select a computer and drill down to the report All compliance evaluation failures for a specified computer, which displays Cannot further process the baseline CI. Managed client does not have the .Net Framework version 2.0 installed.

Computers that do not meet this prerequisite can also be identified with the status message ID of 11802. For more information, see How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management.

Solution

The Microsoft .NET Framework version 2.0 or later is available to download through Windows Update. Alternatively, you can download it from the Web (http://go.microsoft.com/fwlink/?LinkID=56407) and install it through software distribution or other deployment mechanisms.

The Configuration Baseline Has Not Yet Been Evaluated and Reports "Unknown"

If a computer has never reported compliance for an assigned configuration baseline and a value of Unknown is displayed in reports, it is likely that the client has not yet evaluated its compliance.

Computers that are assigned configuration baselines download them with their machine policy but do not evaluate their compliance until the scheduled time configured in the configuration baseline assignment. For more information about configuring the configuration baseline assignment schedule, see How to Assign Configuration Baselines in Desired Configuration Management.

Until computers have downloaded their assigned configuration baselines and completed the first evaluation, compliance information for these configuration baselines will display Unknown in the desired configuration management reports, and in Configuration Manager in the client's Control Panel.

Solution

Either wait until computers have downloaded their machine policy and the scheduled time or manually initiate evaluation on the client.

To manually initiate evaluation on the client, use the following procedure.

To initiate evaluation of an assigned configuration baseline

  1. On the client computer, navigate to Configuration Manager in the Control Panel of the client computer, and double-click to open its properties.

  2. Click the Configurations tab, and then view the list of assigned configuration baselines.

    Note
    If no configuration baselines are displayed but configuration baselines are assigned to this computer, it is probable that the configuration baseline assignments are not yet downloaded. To accelerate this process, click the Actions tab, click Machine Policy Retrieval & Evaluation Cycle, and click Initiate Action. Click OK in the Machine Policy Retrieval & Evaluation Cycle dialog box. When this has completed, clicking Refresh on the Configurations tab should then display the downloaded configuration baselines.

  3. For any configuration baselines that display Unknown in the Compliance State column, select the configuration baseline and click Evaluate. This runs the compliance evaluation outside the configured schedule, and you will see the Compliance State display change to In Progress and then report either Compliant or Non-Compliant.

  4. Click OK to close Configuration Manager.

Client Evaluation Time Does Not Match the Configuration Baseline Assignment Evaluation Schedule

The Last Evaluation value displayed in the client Configurations tab does not exactly match the configuration baseline assignment schedule but is within a two-hour window.

Solution

This is by design. The evaluation schedule initiates a compliance evaluation that starts randomly within the next two hours. This random initiation ensures that the management point is not saturated with compliance results from multiple clients at the same time.

For more information, see About Compliance Evaluation Schedules in Desired Configuration Management.

Compliance Information in Reports and the Home Page Lags behind Compliance Information in the Client Configurations Tab

The compliance information displayed in the client Configurations tab can be more up-to-date than the compliance information in the desired configuration management reports and displayed in the desired configuration management home page.

Solution

Desired configuration management does not display real-time compliance results in the desired configuration management reports and the desired configuration management home page. There is some latency between the evaluation on the client and the site receiving these results. For more information, see Compliance Sent As State Messages and Status Messages in Desired Configuration Management and About Latency in the Configuration Manager Console.

Either wait until the site compliance information is up-to-date or, when you must have the most recent compliance information, use the client Configurations tab. For more information, see the procedure "To view the compliance of a computer using Configuration Manager on the client computer" in How to View Compliance of a Single Computer.

The Client Reports "Unknown" Compliance for a Modified Configuration Baseline and the Configuration Baseline Name Shows "Unknown:<CI Unique ID>"

If a computer has reported compliance with an assigned configuration baseline and modifications were made to that configuration baseline, the client detects the change when it next downloads its machine policy.

In this scenario, the client no longer knows its compliance state and so reports Unknown for its compliance until the modified configuration baseline is evaluated. Additionally, the configuration baseline name will also display Unknown:<Unique CI ID value>, because the new version of the configuration baseline might include a new display name but will not be downloaded until the evaluation process is initiated.

Solution

Either wait until the scheduled time or manually initiate evaluation on the client.

To manually initiate evaluation on the client, use the following procedure.

To initiate evaluation of an assigned configuration baseline

  1. On the client computer, navigate to Configuration Manager in the Control Panel of the client computer and double-click to open its properties.

  2. Click the Configurations tab and view the list of assigned configuration baselines.

  3. Select the configuration baseline that displays Unknown, and then click Evaluate. This runs the compliance evaluation outside the configured schedule, and you will see the Compliance State display change to In Progress and then report either Compliant or Non-Compliant. Alternatively, it might display Error, in which case check the SmsClient source in the Windows Application event log for more information.

  4. Click OK to close Configuration Manager.

The Client Does Not Update Compliance State If Evaluation Is Initiated Too Soon After the Last Evaluation

If a computer has evaluated compliance with an assigned configuration baseline, the results are cached on the client for 15 minutes.

If the configuration baseline has not changed but something that affects compliance on the client has changed, and you manually initiate reevaluation on the client within 15 minutes, the client will continue to display the same compliance state.

Solution

Wait until 15 minutes have elapsed before reevaluating compliance with an assigned configuration baseline. This 15-minute time-to-live value is not configurable.

However, the time-to-live value is automatically reset if the client downloads a configuration baseline assignment that contains a new or modified configuration baseline.

Configuration Baseline Evaluation Enters Retry State on Client Computers

In some scenarios, evaluation of a configuration baseline might be delayed if the configuration baseline assignment reaches the client computer before the configuration baseline reaches the Configuration Manager 2007 server. This could be due to one or more of the following reasons:

  • The management point experiences communication problems.
  • Network connection problems prevent the configuration baseline from reaching the Configuration Manager 2007 server.
  • If a configuration baseline is created and immediately assigned to a collection, . the assignment can reach the client before the configuration baseline reaches the Configuration Manager 2007 server.

When this situation occurs, the configuration baseline evaluation enters a retry state and waits for 6 hours before retrying. During this time, no other configuration baselines will be evaluated by the client computer.

Solution

When the desired configuration management client agent encounters this scenario, there is no solution except to resolve any communication failures and wait for the retry.

The Client Reports "Unknown" If the Desired Configuration Management Agent is Re-enabled

The client can report Unknown for its compliance state if the following scenario occurred:

  1. The desired configuration management agent was enabled and clients downloaded and evaluated assigned configuration baselines.
  2. The desired configuration management agent was disabled and clients downloaded their machine policy, which instructed them to no longer evaluate compliance.
  3. The desired configuration management agent was reenabled and clients downloaded their machine policy.

In this scenario, even if the assigned configuration baselines have not changed, clients will display Unknown for their compliance state until they have reevaluated compliance with their assigned configuration baselines.

Solution

Either wait until the scheduled time in the assigned configuration baseline or manually initiate reevaluation on the client.

To manually initiate reevaluation on the client, use the following procedure.

To initiate reevaluation of an assigned configuration baseline

  1. On the client computer, navigate Configuration Manager in the Control Panel of the client computer, and double-click to open its properties.

  2. Click the Configurations tab, and then view the list of assigned configuration baselines.

  3. Select the configuration baseline that displays Unknown, and then click Evaluate. This runs the compliance evaluation outside the configured schedule, and you will see the Compliance State display change to In Progress and then report either Compliant or Non-Compliant.

  4. Click OK to close Configuration Manager.

Compliance Results Are Not Sent to the Site for a Long Time and the Client Continues to Display "In Progress"

An assigned configuration baseline might take a long time to complete evaluation for valid reasons, such as if it is checking for compliance using script-based settings or if it is detecting files that used wildcards in the path. However, there are other scenarios in which compliance valuation might be misconfigured in a configuration item and, therefore, will never complete.

To safeguard against the scenario of misconfigured configuration items running continuously, Configuration Manager 2007 clients will time out an evaluation after 6 hours. This value is not configurable.

Solution

Wait until the 6 hours timeout has elapsed, and then investigate the configuration items that did not return compliance information to see whether they can be reconfigured to work more efficiently, or if they need to be reconfigured to correct a misconfiguration.

Use the following desired configuration management report to identify evaluation failures: Compliance evaluation errors for a configuration item on a computer.

Some Report Fields Are Blank for Configuration Items

Some imported configuration items might result in the following fields appearing blank in reports:

  • Setting or Object Name
  • Setting or Object Type
  • Setting or Object Description
  • Instance Data
  • Current Value

Solution

This is by design for configuration items that have been imported and for which Configuration Manager cannot interpret all or some of the configuration item contents. In this scenario, Configuration Manager displays as much as can be interpreted and leaves blank the fields that cannot be interpreted.

If you have a good knowledge of the underlying Service Modeling Language (SML) used to define the uninterpreted configuration item, you can right-click the configuration item in the Configuration Items node, and then click View Xml Definition.

For more information about SML, see About Authoring Configuration Data for Desired Configuration Management.

For more information about uninterpreted configuration items, see About Configuration Items in Desired Configuration Management.

Compliance Information Missing Because of the Non-Compliance Severity Level Filter

If you filter compliance information in reports (or displayed in the desired configuration management home page), some configuration baselines might not be displayed that you expect.

In particular, configuration baselines that experience an evaluation failure because the data could not be found (discovery error) will report a non-compliance severity level of Warning. All configuration baselines that have an evaluation failure because of an infrastructure failure will report a non-compliance severity level of Information.

Solution

Make sure that you check compliance results for all levels of non-compliance severity, even if you did not specify them when defining the configuration item.

For more information, see How to Use the Non-Compliance Severity Level.

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management
Prerequisites for Desired Configuration Management


Unexpected Data in Desired Configuration Management Reports

Topic last updated -- August 2007

This section provides troubleshooting information for when you encounter unexpected data in Configuration Manager 2007 desired configuration management reports; for example, values that you cannot interpret or do not understand.

Configuration Type of Business Policy

Desired configuration reports might refer to a configuration item type of "business policy." The equivalent term in the Configuration Manager console is "general configuration item."

The two terms refer to the same configuration item type, but whereas general configuration item is displayed in the Configuration Manager console, the underlying Service Modeling Language (SML) uses the term business policy. When reports are run, you might see references to the SML terminology.

Solution

Remember that a reference to business policy in the desired configuration management reports is the same as a general configuration item.

CI Unique ID Values

Configuration baselines and configuration items display in the Configuration Manager console with the display name you have selected, and which can be edited in the configuration data General properties.

However, Configuration Manager also automatically generates a unique name for each configuration baseline and configuration item to ensure that the configuration data is uniquely referenced in the Configuration Manager hierarchy. You might need to reference this unique ID value if you have configuration data with the same name. For more information, see How to Distinguish Configuration Data with the Same Name in Desired Configuration Management.

Another scenario in which you might need to use the CI Unique ID value is if the configuration data names display in the wrong language or as a blank entry. (See the section "Names Appear in Wrong Language, or Blank Entries" below.)

The CI Unique ID value is used with both configuration baselines and configuration items.

The following is an example of a CI Unique ID value for a configuration baseline:

  • ScopeId_02E3AB69-4889-AFBF-B5B564E74A21/Baseline_14091de3-eb48-49f-85f2-ae7e541b826e

The following is an example of a CI Unique ID value for a configuration item:

  • ScopeId_CD6A2D43-C7AF-416A-AC1B-4B80241D253D/Application_a2575f17db3e-4b23-a6fb-4c0a4a877d2e

Because of their nonfriendly name, it can be difficult to interpret how the values for the CI Unique ID align to friendly display names, and if they refer to a configuration baseline or a configuration item.

Solution

The CI Unique ID value is not displayed by default in the Configuration Manager console, but it can be added to help you correlate this value with the display name. To add this column, follow the procedure in How to Distinguish Configuration Data with the Same Name in Desired Configuration Management.

Although it might often be obvious when the configuration data is a configuration baseline or a configuration item, a configuration baseline can reference another configuration baseline, as a dependent configuration baseline. In this scenario, it can difficult to determine whether the CI Unique ID refers to a configuration item or a configuration baseline.

To help you identify the configuration data that corresponds to the CI Unique ID, reference the label in the CI Unique ID value that appears after the forward slash (the "/" character). If the CI Unique ID has been automatically generated by Configuration Manager, use the following table as a guideline to help identify the corresponding configuration data. However, if the configuration data has been authored externally to Configuration Manager, then these labels are chosen by the editor.

If there is no label, and no ScopeID is displayed, the configuration item might be a software update configuration item.

Label Within CI Unique ID Value | Corresponding Configuration Data
Baseline | Configuration baseline
OperatingSystem | Operating system configuration item
Application | Application configuration item
BusinessPolicy | General configuration item
GLOBAL | Uninterpreted configuration item
ClonedCI | Duplicate configuration baseline, or duplicate configuration item

Names Appear in Wrong Language, or Blank Entries

The display name and description that you choose for configuration baselines and configuration items and the names for configuration categories are not converted into different languages. For example, if you create a configuration item on an English version of Configuration Manager 2007, it will continue to display the English name on a Japanese client or on a reporting point that is running a German version of Configuration Manager 2007.

Solution

This is by design. Administrator-chosen display names and descriptions for configuration baselines and configuration items are not converted into different languages, but retain their original state.

To help you identify the configuration baseline and configuration item, use the CI Unique ID value, as referenced above.

Validation Criteria Displays in Non-Friendly Format

The validation criteria fields in desired configuration management reports (and the equivalent on the client-side report is Constraints) display the underlying DCM Digest, or Service Modeling Language (SML). This can make it difficult for administrators who have authored the configuration item in the Configuration Manager console to understand what the validation criteria is if they do not have knowledge of DCM Digest of SML.

For more information about DCM Digest, SML and authoring externally to Configuration Manager, see About Authoring Configuration Data for Desired Configuration Management.

An example of a validation criteria displayed in reports is the following:

(number(count(ns_BusinessPolicy_5d552faa-98ef-41fc-8261-33c30e91b3d5_this:File_a3a938fe-5f0c-40e7-8e0c-e0a4d0ba0e14))>number(1))

Solution

Use the Configuration Manager console to view the properties of the configuration item and its validation criteria.

Discovery Error Not Produced when a Specified XML File Is Not Found

If you specify the name and location of an XML file in the General tab of the XML Query Setting Properties dialog box and this file is not found, a discovery error indicating that the file was not found is not produced.

Solution

Configure the option Report a non-compliance event when this instance count fails in the Validation tab of the XML Query Setting Properties dialog box to specify an instance count to verify that the file exists.

For more information, see Unexpected Compliance Results in Desired Configuration Management.

Registry Settings which use Environment Variables are not Validated Correctly

When you configure a registry setting with a validation containing an environment variable, desired configuration management returns unexpected results. Desired configuration management cannot expand the environment variable into a full string.

Solution

This is by design. Configuration Manager 2007 does not support the validation of environment variables (REG_EXPANDSX values) in registry settings. If an environment variable is found in a registry key value, this will be treated as a literal string, and not expanded to its full value.

Multiple, Identical Permissions on a File, Might Result in Non-Compliance when Exclusive File Permissions Are Used

When exclusive file permissions are used in a configuration item object, desired configuration management checks that one set of these permissions are used. However, it is possible that the file inherits a second set of permissions. If the two sets of permissions do not exactly match, desired configuration management reports a non-compliant state for the configuration item.

Solution

If the file inherits a second set of permissions, delete the permissions directly specified for the file so that only the inherited permissions remain.

Web Links for Uninterpreted Configuration Items Display Error in Browser: "The page cannot be found."

Uninterpreted configuration items are configuration items that have been imported into Configuration Manager 2007 and which the Configuration Manager console cannot interpret. In reports, their namespace is used for their display name, which is represented as a long URL that begins with http://.

The following is an example of an uninterpreted configuration item name as displayed in the desired configuration management reports:

  • http://schemas.microsoft.com/systemsmanagementserver/SCOPEID_8BC05373-993D-4571-B490-BF2FAC48B7F3/BUSINESSPOLICY_063A71ED-5C34-42EC-9372-D3237FC3329E/1

If you click these links, a Web browser attempts to connect using the URL as if it were a Web resource and fails with an error that the page cannot be found.

Solution

Do not click these URL links. They are used only to display a unique name for the uninterpreted configuration item and do not reference a Web resource.

For more information about uninterpreted configuration items, see About Configuration Items in Desired Configuration Management.

SQL Server Clusters Fail to Evaluate for Compliance

Desired configuration management does not support discovery of SQL Server instance names when they are in cluster.

If you attempt to specify a SQL query against a clustered SQL installation, it will result in either non-compliance (if the option Report a non-compliance event when this instance count fails is configured), or a discovery error (if evaluating a named instance).

For more information about evaluation failures for SQL query settings, see Unexpected Compliance Results in Desired Configuration Management.

Solution

To evaluation compliance for SQL Server when it is configured in a cluster, use a script setting instead of a SQL query setting.

Client Evaluates Deleted Configuration Baseline After the Configuration Baseline is Deleted and Re-imported with Changed Content

If you import a configuration baseline that is assigned and downloaded to a client, delete the configuration baseline and then re-import it with the same display name but new content version (for example, a new setting or modified validation criteria), the client will not realize that it must download the newly imported configuration baseline. In this scenario the client will continue to evaluate with the previously downloaded configuration baseline that is now deleted from Configuration Manager.

This unusual situation occurs because the client uses the configuration baseline version number to determine if it needs to download a newer version of the configuration baseline it has been assigned to evaluate. By deleting the configuration baseline in Configuration Manager, the version number is reset rather than incremented. However, you should be able to compare the content versions on the client and in the Configuration Manager console to confirm that there is a mismatch.

For more information about configuration data versions and content versions, see About Content Versions in Desired Configuration Management.

Solution

Edit the newly imported configuration baseline and make a non-consequential editing change, such as appending data to the display name, or modifying the description. This will increment the configuration baseline version number (and the content version). Ensure that the configuration baseline version number displayed in the Configuration Manager console is higher than the configuration baseline version number displayed in the client report.

On the next evaluation, the client will download the newer configuration baseline and evaluate with newly imported content.

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Reports for Desired Configuration Management

Other Resources

Troubleshooting Desired Configuration Management


Import Failures with Desired Configuration Management

Topic last updated -- August 2007

This section provides troubleshooting information to help you resolve problems when importing configuration data fails.

For more information about importing configuration data, such as Microsoft System Center Configuration Manager 2007 Configuration Packs, see the following:

  • How to Import a Configuration Baseline in Desired Configuration Management
  • How to Import Configuration Items in Desired Configuration Management
  • Import Configuration Data Wizard

Importing Configuration Data Results in a Failed Message

Potential reasons why importing configuration data might fail are the following:

  • The configuration data references configuration data that Configuration Manager cannot locate, either in its database or in the cabinet file itself.
  • The configuration data is already present in the Configuration Manager database with the same name and configuration data version, but has a different content version.
  • A newer version of the configuration data with same name is already present (or has recently been deleted) in the Configuration Manager database.
  • The configuration data is already present in the Configuration Manager database with the same content version, but the hash calculation identifies it as being different.
  • In a multi-site Configuration Manager hierarchy, the configuration data was originally imported from a parent site. You must update it from the same site and not a child site.

For more information about configuration data versions and content versions, see About Content Versions in Desired Configuration Management.

Solution

Check for the scenarios listed above and resolve them before re-attempting to import. There are no workarounds for these issues.

Use the SMS Provider log file for more detailed information of why the import process failed. This file is named smsprov.log and is located in the folder <ConfigMgrInstallationPath>\Logs on the computer hosting the SMS Provider.

By default, the SMS Provider is installed on the primary site's site server computer, but it can be moved to another computer. To find which server has the SMS Provider installed, reference the SMS Provider location value on the Site Properties: General Tab.

See Also

Concepts

SMS Provider Overview

Other Resources

Troubleshooting Desired Configuration Management Issues
Desired Configuration Management in Configuration Manager


Unexpected Compliance Results in Desired Configuration Management

Topic last updated—August 2007

This section provides troubleshooting information to help you resolve unexpected compliance results when using Configuration Manager 2007 desired configuration management.

Compliance Evaluation Results of Some Known Error Conditions

The following tables display the compliance evaluation results of some known error conditions in Configuration Manager 2007, some of which return a discovery error that is displayed in the desired configuration management reports with the category of Compliance Evaluation Errors.

For more information about these reports, see About Reports for Desired Configuration Management.

Note
When a configuration item is evaluated and returns a discovery error, evaluation stops and other instances, objects, and settings within the same configuration item are not evaluated for compliance. However, the instance count (the Report a non-compliance event when this instance count fails option) for the setting is still evaluated.

Key:

√ = Discovery error

Ø = No discovery error (returns non-compliant if the following option is enabled: Report a non-compliance event when this instance count fails).

SQL Query Setting | Discovery Error
Instance of SQL not found—If Use default instance or Instance name is configured | √
Instance of SQL not found—If All instances is configured | Ø
No SQL Server installed | √
Invalid SQL query | √
SQL Server installed but disabled | √
SQL query returned no value | Ø
SQL database not found | √
Access Denied on SQL Server Instance | Ø
Access Denied on SQL database | Ø
A non-read query (UPDATE, DELETE, DROP, CREATE) | √
SQL Server Access Denied | Ø

File or Folder Setting | Discovery Error
Invalid file path | √
Driver for file does not exist | √
File Access Denied (System) | Ø
Access Denied on one or more files or folders in a wildcard setting | Ø
File does not exist | Ø

Script Setting | Discovery Error
Script errors (divide zero) | √ (but does not apply to JScript)
No software installed or version not matched | √
Invalid script syntax | √ (although dependent on script host)
PowerShell Access Denied | Ø
Script contains UI that blocks execution | √ (after 6-hour time-out period expires)
Script hit infinite loop | √ (after 6-hour time-out period expires)

IIS Metabase Setting | Discovery Error
Query with invalid path | √
IIS not installed | √
Query with non-existent intermediate path | Ø
IIS installed but disabled | IIS service will be started
IIS installed but metabase is not installed | Ø
Metabase Access Denied | Ø

XML Query Setting | Discovery Error
File not found | Ø
File doesn’t contain XML data | √
File is in use | √
File returned Access Denied | Ø
File is encrypted | Ø

Registry Setting | Discovery Error
Non existing registry hive | √
Invalid registry path | Ø
Registry setting that returns no value | Ø

WMI Setting | Discovery Error
WQL query on nonexisting class | √
WQL query with invalid namespace | √
WQL query with invalid syntax (class or filter) | √
Designated value does not exist in the specified class | Ø
Value is an object rather than a standard data type | Ø
Value is a reference | Ø
WMI is disabled | Succeed (service is restarted)

Active Directory Domain Services Setting | Discovery Error
Specified path and the first level of subfolders or Specified path and all subfolders | √
Invalid distinguished name (DN) | √
Active Directory is not present (nonexisting server) | √
Access Denied | Ø
Invalid Active Directory LDAP attribute | Ø

Evaluation Failure for User Account Not Found

A configuration item that evaluates the compliance of Windows security permissions on registry key objects, and on file or folder objects, results in an evaluation failure (discovery error) rather than non-compliance if the specified user account does not exist.

Solution

Specify only valid user accounts for Windows security permissions.

Evaluation Failure for File or Folder Object That Validates SHA1-Hash When File Is Open

A configuration item that evaluates the compliance of a file or folder object by using SHA1-Hash validation results in an evaluation failure (discovery error) when the file is open for write access by another application.

Solution

None.

Inconsistent Compliance Results for Same Configuration Item

When you import configuration items into Configuration Manager 2007, multiple content versions can be stored and evaluated by clients. However, desired configuration management reports can display compliance with a single version only. When there is a difference in compliance results on the same client between one content version and another, this can lead to inconsistent compliance results in the reports, which will display the results from the last evaluated content version.

For more information about content versions, see About Content Versions in Desired Configuration Management.

Solution

This is a known limitation. Use the client report to determine the content version used in the compliance evaluation of a configuration item. As a best practice, avoid this situation by ensuring that the content version on externally authored configuration items is always incremented whenever the configuration item is modified.

File or Folder Object Discovery Returns Multiple Copies of the Same File on Computers Running Windows Vista

On computers running Windows Vista, file or folder object discovery might return multiple copies of the same file when Name pattern search depth is set to Specified path and all subfolders on the General tab of the New File or Folder Properties dialog box.

Computers running Windows Vista utilize User Account Control (UAC) to ask users for permission before performing actions that change system settings such as registry values or system files. If a program is installed that is not UAC-compliant and therefore cannot write to the computer's file system, Windows Vista creates a virtualized copy of the file that is changed within the user's profile. This means that multiple, virtualized copies of files might exist on a computer running Windows Vista that are then discovered by desired configuration management compliance evaluations.

Solution

Consider specifying a different value for Name pattern search depth to more closely specify the location of the file to evaluate for compliance.

Multiple, Identical Permissions on a File, Might Result in Non-Compliance When Exclusive File Permissions Are Used

When exclusive file permissions are used in a configuration item object, desired configuration management checks that one set of the specified permissions are applied to the file. However, it is possible that the file inherits a second set of permissions that might be identical to the specified permissions. In this scenario, desired configuration management reports a non-compliant state for the configuration item.

Solution

If the file inherits a second set of identical permissions, delete the instance permissions on the file so that only the inherited permissions remain.

A Configuration Item with an IIS Setting Returns an Error on Windows 2008 Server Computers

When a configuration item with an Internet Information Services (IIS) setting is evaluated on a computer running Windows Server 2008, a discovery error might be generated in the log file Discovery.log and evaluation might fail.

Solution

To evaluate configuration items with IIS settings on computers running Windows Server 2008, you must install IIS 6.0 Management Compatibility for Internet Information Services 7.0 on the computer running Windows Server 2008.

Configuration Item Settings and Objects That Use the Version Data Type Always Report Compliance

When configuration item settings and objects use the Version data type, they might always evaluate as compliant, despite the version value returned from the client computer being non-compliant. This happens when the value returned from the client computer is a single-digit version number. Desired configuration management expects the version value returned from client computers to be in the format of major version.minor version—for example, 1.2.

Solution

There is currently no solution or workaround for this issue.

Modified Configuration Baselines Continue to Display Compliance Results Prior to Modification in the Report “Compliance details for a configuration baseline”

When a configuration item is modified that is being referenced by a configuration baseline assigned to clients, the Actual Compliance value displayed in the report for those configuration baselines will continue to display the results from when the configuration baseline was last evaluated.

In this scenario, the report "Compliance details for a configuration baseline" might display the modified version of the configuration baseline, even though it has not yet been evaluated for compliance. The report will correctly display the configuration items that were used for the last evaluation (prior to modification).

Solution

Wait for the configuration baseline to be re-evaluated to display compliance results for the modified configuration items.

See Also

Other Resources

Desired Configuration Management in Configuration Manager
Troubleshooting Desired Configuration Management Issues


Log Files for Desired Configuration Management

There are a number of client log files you can reference to help troubleshoot desired configuration management in Configuration Manager 2007.

Client Computer Log Files

The Configuration Manager 2007 client computer log files are found, by default, in %windir%\System32\CCM\Logs. For client computers that are also management points, the client log files are located in the SMS_CCM\Logs folder.

The following table provides the log file names and descriptions.

File Name | Description
dcmagent.log | Provides high level information about the evaluation of assigned configuration baselines, and desired configuration management processes.
ciagent.log | Provides information about downloading, storing and accessing assigned configuration baselines.
sdmagent.log | Provides information about downloading, storing and accessing configuration item content.
sdmdiscagent.log | Provides high level information about the evaluation process for the objects and settings configured in the referenced configuration items.
discovery.log | Provides detailed information about the Service Modeling Language (SML) processes.

See Also

Other Resources

Troubleshooting Desired Configuration Management Issues
Troubleshooting Desired Configuration Management
Desired Configuration Management in Configuration Manager


Troubleshooting Desired Configuration Management Using Custom Error Codes

The following table lists the custom error codes of Desired Configuration Management, the possible problems and possible solutions.

Desired Configuration Management Custom Error Codes

Error Code | Possible Problem | Possible Solution
0x80040752 E_DCM_DOTNETMISSING | Microsoft .NET Framework 2.0 or later not installed | Install Microsoft .NET Framework version 2.0 or later on the client machine, or repair the installation
0x80040764 E_DCM_SDM_INTERNAL_FAILURE | WMI corruption, memory corruption, disk corruption | Retry evaluation, check WMI health
0x80040765 E_DCM_SDM_CLRHOST_LAUNCH_FAILURE | Problem with client installation or.NET Framework 2.0 installation | Repair Microsoft .NET Framework version 2.0 or later installation, and then the Configuration Management client

See Also

Concepts

Custom Error Codes for Configuration Manager 2007

Other Resources

Troubleshooting Desired Configuration Management


Desired Configuration Management Security Best Practices and Privacy Information

Best Practices

Sign configuration data to verify the integrity of your configuration items Published configuration data can be digitally signed so that you can verify the publishing source and be sure that the data has not been tampered with. If the digital signature verification check fails, you will be warned and prompted to continue with the import. You should import Microsoft System Center Configuration Manager 2007 configuration data from external sources only if it has a valid digital signature from a trusted publisher.

Privacy Information

Desired configuration management evaluates your client computers against configuration items to see if they comply with configuration baselines. Compliance information is sent back to the site server and stored in the site database. The information is encrypted while being sent back to the management point but it is not stored in encrypted form in the site database. Information is retained in the database until deleted by the site maintenance task Delete Aged Configuration Management Data every 90 days. You can configure the deletion interval. Compliance information is not sent to Microsoft.

Desired configuration management is not enabled by default. You must configure the configuration items and configuration baselines to monitor. Before configuring desired configuration management, consider your privacy requirements.

See Also

Other Resources

Desired Configuration Management in Configuration Manager
Security Best Practices and Privacy Information for Configuration Manager Features


Technical Reference for Desired Configuration Management

Click any link in the following section for technical references for desired configuration management with Configuration Manager 2007.

In This Section

Comparison of SMS 2003 Desired Configuration Monitoring and Configuration Manager 2007 Desired Configuration Management

Compares the differences between Desired Configuration Monitoring in SMS 2003 and Configuration Manager 2007 Desired Configuration Management.

Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management

Step-by-step guide to authoring the three different types of configuration items in desired configuration management by using the Configuration Manager console.

Example Compliance Evaluation for a Desired Configuration Management Application Item

A walkthrough of an example application configuration item to evaluate compliance results with different computers when using different configuration baseline rules.

Example Scenarios for Implementing Desired Configuration Management

Example scenarios of how desired configuration management can be implemented to address various business requirements.

Step-by-Step Sample Configuration Items for Desired Configuration Management

Collection of sample configuration items to help you create simple but useful configuration items for everyday maintenance tasks.

See Also

Other Resources

Desired Configuration Management in Configuration Manager


Example Scenarios for Implementing Desired Configuration Management

The following sections provide example scenarios of how desired configuration management in Configuration Manager 2007 can be implemented to solve the following business requirements:

  • Comparing the Configuration of Computers against Configuration Packs from Microsoft and Other Vendors
  • Remediating Non-Compliance with Software Distribution that Targets Computers with Software Packages or Scripts by Using a Collection that Is Automatically Populated with Computers Reporting Non-compliance

Comparing the Configuration of Computers against Best Practices Configuration from Microsoft and Other Vendors

This scenario demonstrates how customers can compare the configuration of their Microsoft Exchange Server against best practices specified in Microsoft System Center Configuration Manager 2007 Configuration Packs, and detect a potentially detrimental configuration before it negatively affects service level agreements (SLAs).

Woodgrove Bank has deployed Microsoft Exchange Server as its mission-critical e-mail system. Recently, the bank has experienced a number of system outages in which the Microsoft Exchange Information Store shut down unexpectedly. After several days of investigation, Jason Warren, Woodgrove Bank's Exchange Server administrator, discovered that the outages were the result of a number of incorrect settings. To reduce unplanned downtime in the future, Woodgrove Bank must find a way to detect when its Microsoft Exchange Servers have been misconfigured.

John Woods is Woodgrove Bank's IT systems manager. He learned that Microsoft published a number of recommended configurations for Microsoft Exchange Server 2003 as a Configuration Pack that can be applied with desired configuration management in Configuration Manager 2007. He decides to follow the course of action in the following table.

Process Reference

Jason and John view the Microsoft Configuration Data Download Web page and download a Configuration Pack for Exchange Server 2003.

http://go.microsoft.com/fwlink/?LinkId=71837

They review the process for creating a configuration baseline using Configuration Packs.

Administrator Workflow: Creating a Configuration Baseline with Configuration Items from a Configuration Pack

They check that the bank's Configuration Manager 2007 site is enabled for desired configuration management and that all clients have the Microsoft .NET Framework version 2 or later.

How to Enable or Disable the Desired Configuration Management Client Agent

How to Identify Computers that Do Not Have the .NET Framework v2.0 for Desired Configuration Management

They identify a configuration item for Exchange Server 2003 that closely matches the bank's own server environment and import this into Configuration Manager 2007.

How to Import Configuration Items in Desired Configuration Management

They create a configuration baseline and add the configuration item to the following configuration baseline rule:

  • These applications and general configuration items are required and must be properly configured.

How to Create a New Configuration Baseline in Desired Configuration Management

How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management

They assign the configuration baseline to a collection that contains only servers running Microsoft Exchange Server 2003 and configure the evaluation schedule to run every day at midnight.

How to Assign Configuration Baselines in Desired Configuration Management

How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management

When the compliance evaluation results are reported to the site, they view the compliance reports and confirm that there are no business requirements that explain why the bank's servers are configured differently than Microsoft best practices configurations.

How to View Compliance Results for Desired Configuration Management

John instructs Jason to bring all the Microsoft Exchange Servers into compliance with the configuration baseline and continue to monitor the compliance results.

Company-specific process.

Jason checks the compliance reports every morning and investigates any non-compliance results before they affect performance or put the bank's servers at risk for unplanned downtime.

Company-specific process.

This is a possible result of implementing desired configuration management in this way:

  • Three months later, John confirms that the number of unplanned downtime incidents has dramatically decreased.

Remediating Non-Compliance with Software Distribution that Targets Computers with Software Packages or Scripts by Using a Collection that Is Automatically Populated with Computers Reporting Non-Compliance

This scenario demonstrates how customers can remediate non-compliance of security settings using desired configuration management.

A. Datum Corporation has a number of sales staff who frequently travel to customer locations to provide demonstrations and work with customers to help solve their technical problems. While traveling away from the company network, the sales people often reconfigure their laptops to interface with customer networks and share data. When the sales people return to their offices, their laptops are often out of compliance with the corporate standards. In particular, firewall settings and Microsoft Windows security permissions have often been changed to facilitate the interchange of information.

It is very time consuming for the security team to identify the non-compliant changes and to ensure that these laptops are not running malicious software (malware) and do not pose security risks to the corporate network. A. Datum Corporation wants an automated mechanism for evaluating these laptops, and it remediates them using corrective scripts to ensure they are brought back in line with corporate standards.

Ellen Adams works on the security team at A. Datum Corporation. Working with Tommy Hartono, the Configuration Manager administrator, she takes the course of action in the following table.

Process Reference

Ellen creates a number of configuration items and then a configuration baseline that contains these configuration items.

Collectively, this configuration data defines the required security settings for laptops on the corporate network, and she assigns to them a new configuration category named "Security" so that she can easily locate them if she needs to make modifications at a later date.

The settings are configured with different non-compliance severity levels according to their criticality to more easily identify the settings that pose the greatest threat to the network if they are out of compliance.

How to Create a New Configuration Item in Desired Configuration Management

How to Create a New Configuration Baseline in Desired Configuration Management

How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management

About the Non-Compliance Severity Level in Desired Configuration Management

Tommy assigns the configuration baseline to a collection that contains the laptop computers, and he configures the schedule to run more frequently than the other configuration baselines that do not check for security settings.

How to Assign Configuration Baselines in Desired Configuration Management

How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management

The security team already has a custom script that checks for malicious software and then configures all the required security settings. If malicious software is detected, the script generates an e-mail notification to the security team.

Ellen gives this script to Tommy, who creates a package for it in Configuration Manager and hosts it on Configuration Manager distribution points.

How to Create a Package

Software Distribution Overview

Tommy then creates a collection with a query that will automatically be populated with computers that report out of compliance with the highest non-compliance severity level.

Tommy configures the collection's update membership schedule to run every hour, and then he advertises the packaged script to this collection.

How to Remediate Non-Compliant Computers Using Software Distribution

How to Schedule Collection Updates

Tommy monitors the compliance of the laptops using the desired configuration management home page. He also confirms that the collection is automatically populated with non-compliant computers, that the script is run on these computers, and that the computers are then removed from the collection.

He can easily identify the laptops that report out of compliance with the security baseline by using the non-compliance severity level and the configuration baseline category of Security.

How to Use the Desired Configuration Management Home Page

How to Use the Non-Compliance Severity Level

The security team members are notified with e-mail messages if malicious software is detected so that they know they must locate the laptop to remove the malicious software and perform further checks to confirm the integrity of the data on the laptop.

They make periodic checks on laptops to confirm that computers that raise a Windows event as a result of non-compliance with the security settings are successfully remediated.

Company-specific processes.

This is a possible result of implementing desired configuration management in this way:

  • Non-compliant laptop returns to company network and is automatically remediated.
    One of the sales staff returns from a customer visit. The Configuration Management client running on the laptop downloaded the security configuration baseline when it was previously connected to the corporate network, and the client continued to evaluate its compliance with its assigned configuration baselines.
    The sales person experienced some connection problems and tried disabling the firewall to resolve the issue, but did not enable it again. As soon as the laptop reconnects to the corporate network, its non-compliance results are sent to the Configuration Manager site.
    The laptop is then automatically added to the collection that has the script advertised to it. There is no malicious software detected, so the security team does not need to take further action because the remediating script is automatically run on the laptop.
    The laptop is brought back into compliance without administrator intervention.

See Also

Other Resources

Overview of Desired Configuration Management


Comparison of SMS 2003 Desired Configuration Monitoring and Configuration Manager 2007 Desired Configuration Management

SMS 2003 Desired Configuration Monitoring was published as a Business Solution Add-On for SMS 2003 Service Pack 1, and its objectives were similar to Configuration Manager 2007 desired configuration management in Configuration Manager 2007 in that it allowed you to assess compliance of computers against defined configurations. However, a number of improvements over SMS 2003 Desired Configuration Monitoring have been made in Configuration Manager 2007 desired configuration management. For example, because Configuration Manager 2007 desired configuration management is integrated into the product, it offers the following features:

  • Authoring is supported from within the product using standard Windows interface and wizards.
  • Configuration baselines are delivered as policy with their own schedules.
  • Compliance results are sent immediately with state messages.
  • The Desired Configuration home page and default reports provide easy access to compliance results.

Furthermore, Configuration Manager 2007 desired configuration management uses a standard schema - Service Modeling Language (SML) – instead of proprietary XML. Configuration data is also subject to version control and auditing, and critically provisions for reuse so that over time you can build up configuration data that describes all the computer configurations that you need to manage in the organization, at the level you need to manage it.

If you have been using SMS 2003 Desired Configuration Monitoring, you can download a conversion tool that converts your existing configuration templates into a format that can be imported into Configuration Manager 2007 desired configuration management. For more information about the conversion tool, see the Microsoft® System Center Configuration Manager 2007 Configuration Pack Web page (http://go.microsoft.com/fwlink/?LinkId=71837).

The following table compares the key differences between SMS 2003 Desired Configuration Monitoring and Configuration Manager 2007 desired configuration management.

SMS 2003 Desired Configuration Monitoring Configuration Manager 2007 Desired Configuration Management

External Web-based authoring user interface.

Windows interface authoring, integrated into the product.

Proprietary XML discovery/constraint document.

Built on Service Modeling Language (SML).

Templates stored and managed as files:

  • No version control
  • No type management
  • No reuse/composition

Configuration items and configuration baselines are new objects in Configuration Manager

  • Version control
  • Type management
  • Reuse and composition

Separate scan engine executable.

Discovery/constraint evaluation engine is build into the product (Ccmexec).

Template and scan engine is packaged, delivered, and scheduled using Software Distribution.

Configuration baselines are delivered as assigned policy with individual schedules.

Compliance results stored in WMI and reported with Hardware Inventory.

Compliance results stored in XML on clients and reported using new state messages.

Reports require SQL Reporting Services (SRS) Reports (version 1).

Reports built into the product and the desired configuration management home page offers snapshot compliance information with pie charts and ability to sort results based on the severity level.

See Also

Other Resources

Desired Configuration Management in Configuration Manager


Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management

Topic Last Updated—August 2008

This step-by-step guide contains procedures to guide you through the process of using desired configuration management to author configuration items in Configuration Manager 2007 by using the Configuration Manager console.

The three procedures in this guide provide examples of authoring each type of configuration item:

  • The general configuration item procedure creates a registry setting to determine whether client computers are running Internet Explorer version 7. The procedure also creates a file or folder object to determine whether the Windows user CONTOSO\Administrator has full permissions on the folder <InstallationPath>\Internet Explorer\PLUGINS.
  • The operating system configuration item procedure determines whether client computers are running Windows 2003 Server R2 on the x86 Windows platform.
  • The application configuration item procedure determines whether the program, Microsoft Office Communicator 2005 is installed. The procedure also creates a registry setting to determine whether the Office 2007 installation directory is set correctly.

After you have successfully created the configuration items, they can be added to configuration baselines and assigned to clients through Configuration Manager collections. For further information about this process, refer to the following topics in the Configuration Manager 2007 help:

  • About Configuration Baselines in Desired Configuration Management
  • How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
  • How to Assign Configuration Baselines in Desired Configuration Management

On This Page

Test Network Environment

Authoring a General Configuration Item Using the Configuration Manager Console

Authoring an Operating System Configuration Item Using the Configuration Manager Console

Authoring an Application Configuration Item Using the Configuration Manager Console

Test Network Environment

The guide makes the following assumptions:

  • You are running a functioning Configuration Manager 2007 site with at least one management point.
  • You are logged in with a Windows user account that is a member of the SMS Admins local group on the site server, and this user account has sufficient class security rights to create and modify configuration items. An example of a Windows user account with sufficient rights is the account that was used to install the Configuration Manager 2007 site.
  • The desired configuration management client agent is enabled on the Configuration Manager 2007 site. For details, see the topic Configuring Desired Configuration Management in the Configuration Manager 2007 help.
  • Examples in this guide use the domain name CONTOSO and the Windows user account name Administrator. You can substitute these names with any valid domain name and Windows user account on your test network.

Authoring a General Configuration Item Using the Configuration Manager Console

This procedure guides you through the process of using desired configuration management to author a general configuration item in Configuration Manager 2007.

This example uses a registry setting to determine whether computers are running Internet Explorer 7 and a file or folder object to determine whether users have access to the Internet Explorer plug-ins folder.

To author a general configuration item defining the file or folder object and registry setting to assess for compliance

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Expand the Desired Configuration Management node, right-click Configuration Items, click New, and then click General Configuration Item.

  3. On the Identification page of the Create General Configuration Item Wizard, specify the following:

    • Name: Specify a unique and descriptive name for the configuration item, such as Internet Explorer general configuration item.
    • Description: Specify a description for the configuration item, such as This configuration item determines whether client computers are in compliance with the company's Internet Explorer configuration policy.
    • Click Next.

  4. On the Objects page of the Create General Configuration Item Wizard, click New, and then click File or Folder.

  5. In the New File or Folder Properties dialog box, specify the following in the General tab:

    • Type: From the drop-down list, select Folder.
    • Path: Specify the path C:\Program Files\Internet Explorer.
    • File or folder name: Specify the folder name PLUGINS.
    • Name pattern search depth: From the drop-down list, select Specified Path.
    • Description: Specify a description for the file or folder object, such as This file or folder object is used to determine the compliance of the permissions on the folder C:\Program Files\Internet Explorer\PLUGINS.
    • Is this file or folder from a 64-bit application? Select No.
    • Click the Permission tab.

  6. In the Permission tab, specify the following:

    • Select the option Include permissions.
    • Select the option Non-exclusive. This option indicates that any Windows groups or users that are not specified in the permissions list will not be included when the file or folder object is assessed for compliance.
    • Click Add.

  7. In the Enter Group or User Name dialog box, specify the following:

    • Enter the Group or User Name: Enter the Windows user name CONTOSO\Administrator.
    • Select the type of access control for this group or user Select Allow.
    • Click OK.

  8. In the New File or Folder Properties dialog box, in the Permission tab, specify the following:

    • Under Permission, verify that Full Control is selected.
    • Click OK to close the New File or Folder Properties dialog box.

  9. Click Next.

  10. On the Settings page of the Create General Configuration Item Wizard, click New, and then click Registry.

  11. In the New Registry Setting Properties dialog box, specify the following in the General tab:

    • Display Name: Enter a name for the setting, such as Internet Explorer registry key
    • Description: Enter a description for the setting, such as Validates that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version is equal to 7.0.5600.16384.
    • Hive: From the drop-down list, select HKEY_LOCAL_MACHINE.
    • Key: Specify the key SOFTWARE\Microsoft\Internet Explorer.
    • Value Name: Specify the value Version
    • Is this registry key associated with a 64-bit application? Select No.
    • Click the Validation tab.

  12. In the Validation tab, specify the following:

    • Data Type: From the drop-down list, select String.
    • Select the option Report a non-compliance event when this instance count rule fails.
    • Instance count operator: From the drop-down list select Greater Than.
    • Values: In the Values field, enter 0.
    • Severity: From the drop-down list, select Warning.
    • Under Details, click New.

  13. In the Configure Validation dialog box, specify the following:

    • Name: Enter a name for the validation, such as Registry key version check.
    • Description: Enter a description for the validation, such as Checks that the Internet Explorer version registry key equals 7.0.5600.16384.
    • Operator: From the drop-down list, select Equals.
    • Value: In the Value field, enter 7.0.5600.16384.
    • Click OK to close the Configure Validation dialog box.

  14. Click OK to close the New Registry Setting Properties dialog box.

  15. Click Next.

  16. On the Applicability page of the Create General Configuration Item Wizard, specify the following:

    • Under Windows Platforms, select All Windows Platforms.
    • Click Next.

  17. On the Summary page of the Create General Configuration Item Wizard, review the settings for the configuration item you have created, and then click Next.

  18. View the Progress page of the Create General Configuration Item Wizard. When this is complete, view the summary of actions taken on the Wizard Complete page.

  19. To close the wizard, click Close.

Next Steps

You have now created a general configuration item that can be added to a configuration baseline. For example, to check that client computers have Internet Explorer version 7 installed, and that the Internet Explorer plug-ins folder is correctly configured for security permissions, add this configuration item to a configuration baseline by using the following configuration baseline rule:

  • These application and general configuration items are required and must be properly configured

Authoring an Operating System Configuration Item Using the Configuration Manager Console

This procedure guides you through the process of using desired configuration management to author an operating system configuration item in Configuration Manager 2007 by using the Configuration Manager console.

This operating system configuration item determines whether the client computer operating system is x86 Windows 2003 Server R2.

To author an operating system configuration item to define the Windows version to assess for compliance

  1. In the Configuration Manager Console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Expand the Desired Configuration Management node, right-click Configuration Items, click New, and then click Operating System Configuration Item.

  3. On the Identification page of the Create Operating System Configuration Item Wizard, specify the following:

    • Name: Specify a unique and descriptive name for the configuration item, such as Windows Server 2003 Operating System Configuration Item.
    • Description: Specify a description for the configuration item, such as This configuration item determines compliance for x86 Microsoft Windows Server 2003 R2.
    • Click Next.

  4. On the Microsoft Windows Version page of the Create Operating System Configuration Item Wizard, specify the following:

    • Select the option Specify Windows version by description.
    • From the drop-down list, select All x86 Windows Server 2003 R2.
    • Click Next.

  5. On the Objects page of the Create Operating System Configuration Item Wizard, click Next.

  6. On the Settings page of the Create Operating System Configuration Item Wizard, click Next.

  7. On the You have successfully completed the wizard page of the Create Operating System Configuration Item Wizard, review the actions to be taken in the Details box, and then click Next.

  8. View the Progress page of the Create Operating System Configuration Item Wizard. When this is complete, view the summary of actions taken on the Wizard Complete page.

  9. To close the wizard, click Close.

Next Steps

You have now created an operating system configuration item that can be added to a configuration baseline. For example, to check that client computers are running Windows Server 2003 R2, you could add this configuration item to a configuration baseline by using the following configuration baseline rule:

  • One of the following operating system configuration items must be present and properly configured

Authoring an Application Configuration Item Using the Configuration Manager Console

This example contains procedures to guide you through the process of using desired configuration management to author an application configuration item in Configuration Manager 2007 by using the Configuration Manager console.

The application configuration item determines whether the program Microsoft Office Communicator 2005 is installed, and it also includes a registry setting to determine whether Microsoft Office 2007 is installed in the correct folder.

To author an application configuration item to define a detection method and setting to assess for compliance

  1. In the Configuration Manager Console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Expand the Desired Configuration Management node, right-click Configuration Items, click New, and then click Application Configuration Item.

  3. On the Identification page of the Create Application Configuration Item Wizard, specify the following:

    • Name: Specify a unique and descriptive name for the configuration item, such as Microsoft Office Configuration Item.
    • Description: Specify a description for the configuration item, such as This configuration item determines compliance for Microsoft Office.
    • Click Next.

  4. On the Detection Method page of the Create Application Configuration Item Wizard, specify the following:

    • Specify that Windows Installer (MSI) detection should be used to determine whether the application is installed on client computers.
    • Click Open.
    • In the Open dialog box, browse to the Microsoft Office Communicator installation file, Communicator.msi.
    • Click Open to select this file and close the dialog box.
    • Product Code: This field is populated automatically with the Windows Installer product code of the installer file you selected.
    • Version: This field is populated automatically with the version number of the Windows installer file you selected.
    • Click Next.

  5. On the Objects page of the Create Application Configuration Item Wizard, click Next.

  6. On the Settings page of the Create General Configuration Item Wizard, click New, and then click Registry.

  7. In the New Registry Setting Properties dialog box, specify the following in the General tab:

    • Display Name: Enter a name for the setting, such as Microsoft Office 2007 install location
    • Description: Enter a description for the setting, such as Validates that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\InstallRoot is equal to c:\Program Files\Microsoft Office\Office12\.
    • Hive: From the drop-down list, select HKEY_LOCAL_MACHINE.
    • Key: Specify the key SOFTWARE\Microsoft\Office\12.0\Common.
    • Value Name: Specify the value InstallRoot.
    • Is this registry key associated with a 64-bit application? Select No.
    • Click the Validation tab.

  8. In the Validation tab, specify the following:

    • Data Type: From the drop-down list, select String.
    • Select the option Report a non-compliance event when this instance count rule fails.
    • Instance count operator: From the drop-down list select Greater Than.
    • Values: In the Values field, enter 0.
    • Severity: From the drop-down list, select Warning.
    • Under Details, click New.

  9. In the Configure Validation dialog box, specify the following:

    • Name: Enter a name for the validation, such as Office registry key check.
    • Description: Enter a description for the validation, such as Checks that the Office install location is set to c:\Program Files\Microsoft Office\Office12\.
    • Operator: From the drop-down list, select Equals.
    • Value: In the Value field, enter c:\Program Files\Microsoft Office\Office12\.
    • Click OK to close the Configure Validation dialog box.

  10. Click OK to close the New Registry Setting Properties dialog box.

  11. Click Next.

  12. On the Applicability page of the Create Application Configuration Item Wizard, specify the following:

    • Under Windows Platforms, select All Windows Platforms.
    • Click Next.

  13. On the Summary page of the Create Application Configuration Item Wizard, review the actions to be taken in the Details box, and then click Next.

  14. View the Progress page of the Create Application Configuration Item Wizard. When this is complete, view the summary of actions taken on the Wizard Complete page.

  15. To close the wizard, click Close.

Next Steps

You have now created an application configuration item that can be added to a configuration baseline. For example, to check that Microsoft Office Communicator 2005 is installed and that Microsoft Office 2007 is installed in the correct folder, add this configuration item to a configuration baseline by using the following configuration baseline rule:

  • These application and general configuration items are required and must be properly configured

However, if you want to check that only the computers that have Microsoft Office Communicator 2005 installed, have installed Microsoft Office 2007 in the correct folder, add this application configuration item to a configuration baseline by using the following configuration baseline rule:

  • If these optional application configuration items are detected, they must be properly configured
  • You can also use this application configuration item to check that computers do not have Microsoft Office Communicator 2005 by adding this configuration item to a configuration baseline using the following configuration baseline rule:
  • These application configuration items must not be present

See Also

Tasks

How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
How to Assign Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


Example Compliance Evaluation for a Desired Configuration Management Application Item

This example walks through the desired configuration management compliance evaluation process for an application configuration item to demonstrate how the compliance of a configuration baseline is evaluated. It also demonstrates how the compliance evaluation results of the same configuration item can change, according to the configuration of the computers and the selected configuration baseline rule.

Example Configuration

A desired configuration management application configuration item has been created with the following configuration:

Name: Office on Windows XP Computers.

Applicability: Windows XP only.

Detection method: Windows Installer using Office Product code and Version number.

Objects and Settings: Various

The application configuration item is added to a configuration baseline using one of three possible configuration baseline rules. The configuration baseline is then assigned to the All Systems collection, which contains a total of four computers that are running either Microsoft Windows XP or Windows Server 2003.

The following table displays how the computers in the All Systems collection are configured with regard to the following:

  • Their operating system platform (Applicability)
  • Whether Office XP is installed (Detected)
  • Whether Office XP is configured correctly (Compliance)

Computer | Operating System Platform (Applicability) | Office XP Installed (Detected) | Office XP Configured Correctly (Compliance)
A | Windows Server 2003 platform | Office XP is installed. | Office XP is configured incorrectly.
B | Windows XP platform | Office XP is not installed. | Office XP is not installed.
C | Windows XP platform | Office XP is installed. | Office XP is configured incorrectly.
D | Windows XP platform | Office XP is installed. | Office XP is configured correctly.

The following sections display the desired configuration management compliance evaluation results that this example configuration item will produce when it is added in turn to the following configuration baseline rules:

  • These applications and general configuration items are required and must be properly configured.
  • If these optional application configuration items are detected, they must be properly configured.
  • These application configuration items must not be present.

Compliance Results for a Required Application

If the application configuration item defined earlier is added to the configuration baseline rule These applications and general configuration items are required and must be properly configured, the following table displays the desired configuration management compliance results for the computers defined in the previous table.

Computer | Actual Compliance | Compliance with Configuration Baseline Rule
A | Not applicable | Compliant
B | Not detected | Not compliant
C | Non-compliant | Not compliant
D | Compliant | Compliant

Compliance Results for an Optional Application

If the application configuration item defined earlier is added to the configuration baseline rule If these optional application configuration items are detected, they must be properly configured, the following table displays the desired configuration management compliance results for the computers defined in the first table. The compliance difference from the previous section is that computer B is now compliant with this configuration baseline.

Computer | Actual Compliance | Compliance with Configuration Baseline Rule
A | Not applicable | Compliant
B | Not detected | Compliant
C | Non compliant | Not compliant
D | Compliant | Compliant

Compliance Results for a Prohibited Application

If the application configuration item defined earlier is added to the configuration baseline rule These application configuration items must not be present, the following table displays the desired configuration management compliance results for the computers defined in the first table. The compliance difference from the previous section is that computer D is not compliant with this configuration baseline.

Computer | Actual Compliance | Compliance with Configuration Baseline Rule
A | Not applicable | Compliant
B | Not detected | Compliant
C | Non-compliant | Not compliant
D | Compliant | Not Compliant

See Also

Tasks

How to Assign Configuration Baselines in Desired Configuration Management
How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management
How to Create a New Configuration Item in Desired Configuration Management

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


How Each Configuration Item is Evaluated for Compliance in Desired Configuration Management

Use the following sections to understand how a computer evaluates the compliance of configuration items in Configuration Manager 2007.

Each configuration item in the configuration baseline assigned to the client is evaluated in turn for the following:

  • Applicability
  • Detection
  • The compliance of objects and settings

The result of the evaluation is reported by the client as its Actual Compliance value displayed in desired configuration management reports.

For more information about the reports in desired configuration management, see About Reports for Desired Configuration Management.

For more information about how a computer evaluates its overall compliance, see About Compliance and Compliance Information in Desired Configuration Management.

Refer to the following sections for detailed information about how desired configuration management evaluates each of the following configuration item:

  • General Configuration Item
  • Operating System Configuration Item
  • Application Configuration Item
  • Software Update Configuration Item

How a General Configuration Item is Evaluated for Compliance

Compliance for a general configuration item is evaluated for its Actual Compliance as described in the following table.

Evaluation Step More Information

Applicability

The applicability property in the general configuration item determines whether client computers should evaluate the configuration item or not.

If the configuration item is configured with an applicability value that does not apply to the client (for example, Windows XP Service Pack 1 and the client is running Windows XP Service Pack 2), the Actual Compliance of the general configuration item is set to Not Applicable and the rest of the configuration item is not evaluated on the client.

However, if the configuration item is configured with an applicability value that applies to the client (for example, all Windows platforms and the client is running Windows XP Service Pack 2), the rest of the configuration item is evaluated on the client.

Detection

The detection method is not configurable for a general configuration item, so if the applicability evaluates as true, the objects and settings are then evaluated for compliance.

Compliance of Objects and Settings

If the applicability evaluates as true, the objects and settings are evaluated for compliance with the following results:

  • If the objects and settings are compliant, the compliance of the configuration item is set to Compliant.
  • If the objects and settings are non-compliant, the compliance of the configuration item is set to Non-Compliant.

How an Operating System Configuration Item is Evaluated for Compliance

Compliance for an operating system configuration item is evaluated for its Actual Compliance in the following table.

Evaluation Step More Information

Applicability

The applicability property is not configurable for an operating system configuration item because an operating system configuration item is always considered applicable.

Detection

When an operating system configuration item is defined, the detection evaluation uses the Windows version specified in the operating system configuration item before checking the objects and settings for compliance.

If clients are not running the version of Windows specified, the compliance of the configuration item is set to Not Detected, and the compliance of the objects and settings are not checked.

Compliance of Objects and Settings

If the detection method evaluates as true, the objects and settings are evaluated for compliance with the following results:

  • If the objects and settings are compliant, the compliance of the configuration item is set to Compliant.
  • If the objects and settings are non-compliant, the compliance of the configuration item is set to Non-Compliant.

How an Application Configuration Item is Evaluated for Compliance

An application configuration item is the most complex of the configuration item types because it can be evaluated for all three states: applicability, detection, and compliance with objects and settings. This complexity provides the greatest versatility in how compliance can be assessed, using three different configuration baseline rules.

Note
For an example of how compliance is evaluated for an application configuration item with all three configuration baseline rules, see the topic Example Compliance Evaluation for a Desired Configuration Management Application Item.

Compliance for an application configuration item is evaluated for its Actual Compliance in the following table.

Evaluation Step More Information

Applicability

The applicability property in the application configuration item determines whether or not client computers evaluate the configuration item.

If the configuration item is configured with an applicability value that does not apply to the client (for example, Windows XP Service Pack 1 and the client is running Windows XP Service Pack 2), the Actual Compliance is set to Not Applicable and the rest of the configuration item is not evaluated on the client.

However, if the configuration item is configured with an applicability value that applies to the client (for example, all Windows platforms and the client is running Windows XP Service Pack 2), detection is then evaluated on the client.

Detection

The detection method property of an application configuration item allows you to determine whether the application is present on the computer.

If the application is configured with a detection method and the application is not detected, the Actual Compliance of the configuration item is set to Not Detected and the compliance of the objects and settings are not evaluated.

If the application configuration item is configured with Always assume application is installed or the detection method is configured and the application is detected, the compliance of the objects and settings are then evaluated.

Compliance of Objects and Settings

If the detection method evaluates as true, the objects and settings are evaluated for compliance with the following results:

  • If the objects and settings are compliant, the compliance of the configuration item is set to Compliant.
  • If the objects and settings are non-compliant, the compliance of the configuration item is set to Non-Compliant.

How a Software Update Configuration Item is Evaluated for Compliance

Compliance for a software update configuration item is evaluated for its Actual Compliance in the following table.

Evaluation Step More Information

Applicability

The administrator cannot configure the applicability of a software update configuration item. Instead, the applicability property is hard-coded in the software update by the supplying vendor.

If the software update configuration item is not applicable to the client, as determined by the software update evaluation, the Actual Compliance is set to Not Applicable and the rest of the configuration item is not evaluated on the client.

Detection

The detection method is also hard-coded into a software update configuration item and is the means by which the software update vendor determines whether or not the applicable software update is installed. When evaluating software updates for compliance on client computers, this is the value that is used.

If the software update configuration item is applicable but not detected on the client, as determined by the software update evaluation, the Actual Compliance is set to Not Detected and the rest of the configuration item is not evaluated on the client.

If the software update configuration item is applicable and detected on the client, as determined by the software update evaluation, the Actual Compliance is set to Detected.

Compliance of Objects and Settings

If the software update configuration item is applicable and detected on the client, compliance evaluation stops there.

Software update configuration items have no settings and objects to evaluate, so the compliance of these are predetermined and the Actual Compliance is set to Compliant.

See Also

Concepts

About Reports for Desired Configuration Management
About Compliance and Compliance Information in Desired Configuration Management


Compliance Sent As State Messages and Status Messages in Desired Configuration Management

Topic last updated—November 2007

Compliance information is displayed in the Configuration Manager 2007 desired configuration management reports, and on the report displayed on the Configuration Manager client. The compliance of each assigned configuration baseline is also displayed on the client Configurations tab.

For more information about the available reports, see About Reports for Desired Configuration Management.

For more information about the client Configurations tab, see Configuration Manager Properties: Configurations Tab.

Compliance Information Sent in State Messages

The desired configuration management client mainly uses state messages to send compliance results. State messages offer a quick and efficient mechanism to send client data. State messages process quickly on the management point and include XML attachments for desired configuration management compliance details. State messages are consolidated on the client and sent according to the State message reporting cycle (minutes) value configured in the Computer Client Agent Properties: General Tab. By default, this cycle is set to occur every 15 minutes.

For more information about state messages, see About State Messages. For a list of state messages used in Configuration Manager 2007, see State Messages in Configuration Manager 2007.

The Actual Compliance state (Applicable, Detected, Compliant or Non-Compliant) for each configuration item is sent as a state message to the management point in the following circumstances:

  • When the configuration item is first evaluated.
  • Whenever the client detects a change in the compliance of a configuration baseline.

This change in compliance of the configuration baseline might be from any of the original compliance states to the corresponding new compliance state, as listed in the following table.

Original Compliance State | New Compliance State
Unknown | Compliant
Non-Compliant | Compliant
Compliant | Non-Compliant
Unknown, Compliant , and Non-compliant | Failed
Failed | Unknown, Compliant, and Non-compliant

If the client does not detect a change in its compliance with an assigned configuration baseline, it sends only its overall compliance state with its assigned configuration baseline to the management point, except in the following circumstances:

  • The non-compliance severity level of a setting or object changes.
  • The validation criteria of a setting or object changes after it has previously been reported as non-compliant.

When both of the preceding circumstances apply, the client sends the Actual Compliance state for the configuration item to the management point.

For more information about the compliance states, see About Compliance and Compliance Information in Desired Configuration Management.

Compliance Information Sent in Status Messages

The following status messages are sent by Configuration Manager (with the component name of Desired Configuration Management) whenever there is a change in compliance for configuration items or configuration baselines or whenever there is a change in the non-compliance severity level of a configuration item:

  • 11854: An informational status message that records a change in compliance data from unknown or non-compliant to compliant.
  • 11855: An informational status message that records either of the following states:
    • A change in compliance data from compliant or unknown to non-compliant when the non-compliance severity level is configured as Informational.
    • A change in the non-compliance severity level configuration to Informational and the client is non-compliant.
  • 11856: An warning status message that records either of the following states:
    • A change in compliance data from compliant or unknown to non-compliant when the non-compliance severity level is configured as Warning.
    • A change in the non-compliance severity level configuration to Warning and the client is non-compliant.
  • 11857: An error status message that records either of the following states:
    • A change in compliance data from compliant or unknown to non-compliant when the non-compliance severity level is configured as Error.
    • A change in the non-compliance severity level configuration to Error and the client is non-compliant.

To locate these status messages, see How to Identify Computers that have Changed their Compliance Status in Desired Configuration Management.

See Also

Concepts

About Compliance and Compliance Information in Desired Configuration Management
About Configuration Items in Desired Configuration Management
How Each Configuration Item is Evaluated for Compliance in Desired Configuration Management


Step-by-Step Sample Configuration Items for Desired Configuration Management

Use the procedures in these sample configuration items for Configuration Manager 2007 desired configuration management to help you create simple but useful configuration items for everyday maintenance tasks.

Once created, you can add them to configuration baselines, or use them as building blocks for more complex configuration items. For more information, see Tasks for Desired Configuration Management.

Note
If you have created similar configuration items that you would like to see added to this section, e-mail SMSDocs@Microsoft.com.

To complete the procedures, the following requirements must be met:

  • You are running a functioning Configuration Manager 2007 site with a default management point.
  • You are logged in with a Windows user account that is a member of the SMS Admins local group on the site server, and this user account has sufficient class security rights to create and modify configuration items. An example of a Windows user account with sufficient rights is the account that was used to install the Configuration Manager 2007 site.
  • The desired configuration management client agent is enabled on the Configuration Manager 2007 site. For more information, see How to Enable or Disable the Desired Configuration Management Client Agent.

Click any link in the following section for step-by-step procedures to create sample configuration items using desired configuration management in Configuration Manager 2007.

In This Section

Sample Configuration Item: Check for the Presence of the File Skpswi.dat Using Desired Configuration Management

Creates a general configuration item that checks for the presence of the hidden file Skpswi.dat.

This file is used to exclude drives from Configuration Manager 2007 software inventory. Use this configuration item to monitor that only authorized computers have this file.

Sample Configuration Item: Check that the Windows Firewall is Enabled Using Desired Configuration Management

Creates a general configuration item that checks that the Windows firewall is enabled.

Sample Configuration Item: Check for the Presence of the Client Installation Properties Registry Key Using Desired Configuration Management

Creates a general configuration item that checks if the client installation properties registry key is present on client computers.

See Also

Tasks

How to Enable or Disable the Desired Configuration Management Client Agent

Other Resources

Desired Configuration Management in Configuration Manager
Tasks for Desired Configuration Management


Sample Configuration Item: Check for the Presence of the File Skpswi.dat Using Desired Configuration Management

This procedure guides you through the process of using desired configuration management in Configuration Manager 2007 to create a general configuration item with an object setting to determine whether the file Skpswi.dat is found on client computers.

Purpose of the Configuration Item

The hidden file Skpswi.dat is used by Configuration Manager administrators to avoid the overhead of running software inventory on large disk drives. When it is placed in the root of each folder that must be excluded from Configuration Manager 2007 software inventory, software inventory will not report any inventory data for that drive.

Although this can be a useful feature, it is also possible that it could be used to conceal files that a user does not want to appear in the Configuration Manager 2007 software inventory. Although software inventory is not able to report the presence of this file, desired configuration management can detect it, which allows you to monitor for unauthorized use of this file.

Procedure

To author a general configuration item to check for the presence of the file Skpswi.dat:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Expand the Desired Configuration Management node, right-click Configuration Items, click New, and then click General Configuration Item.

  3. On the Identification page of the Create General Configuration Item Wizard, specify the following:

    • Name: Specify a unique and descriptive name for the configuration item, such as Skpswi.dat file check.
    • Description: Specify a description for the configuration item, such as This configuration item determines whether client computers have unauthorized instances of the file Skpswi.dat.
    • Click Next.

  4. On the Objects page of the Create General Configuration Item Wizard, click New, and then click File or Folder.

  5. In the New File or Folder Properties dialog box, specify the following in the General tab:

    • Type: From the drop-down list, select File.
    • Path: Specify the path C:\.
    • File or folder name: Specify the file name Skpswi.*.
    • Name pattern search depth: From the drop-down list, select Specified path and all subfolders.
    • Description: Specify a description for the file or folder object, such as This file or folder object is used to search for occurrences of the file Skpswi.dat on client computers.
    • Is this file or folder from a 64-bit application? Select No.

  6. Click the Validation tab, and then specify the following:

    • Select the option Report a non-compliance event when this instance count fails.
    • Instance count operator: Select Less than or equal to.
    • Values: Specify the value 2.
    • Severity: From the drop-down list, select Warning.
    Note
    The Configuration Manager 2007 client installation folder contains two copies of the Skpswi.dat file. This configuration item therefore, reports non-compliance if more than two occurrences of the file Skpswi.dat are found on a client computer.

    • Click OK to close the New File or Folder Properties dialog box.
    Note
    You can repeat steps 4 through 6 to create additional objects to assess compliance for the Skpswi.dat file on other drives such as D:\

  7. Click Next.

  8. On the Settings page of the Create General Configuration Item Wizard, click Next.

  9. On the Applicability page of the Create General Configuration Item Wizard, specify the following:

    • Under Windows Platforms, select All Windows Platforms.
    • Click Next.

  10. On the Summary page of the Create General Configuration Item Wizard, review the settings for the configuration item you have created, and then click Next.

  11. View the Progress page of the Create General Configuration Item Wizard. When this is complete, view the summary of actions taken on the Wizard Complete page.

  12. Click Close.

Next Steps

Now you have now created this general configuration item, it can be added to a configuration baseline using the following configuration baseline rule:

  • These application and general configuration items are required and must be properly configured

Assign this configuration baseline to computers that should not have this file installed, and investigate the computers that report non-compliance.

See Also

Tasks

How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
How to Assign Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


Sample Configuration Item: Check that the Windows Firewall is Enabled Using Desired Configuration Management

This procedure guides you through the process of using desired configuration management in Configuration Manager 2007 to create a general configuration item with a WQL query setting to determine whether the firewall service is started and set to automatic.

Purpose of the Configuration Item

These configuration items check for a useful security setting that helps to protect computers from unauthorized incoming connections. The WQL query setting used to determine compliance is slightly different on Windows Vista than on Windows XP operating systems, and so both procedures are given as separate configuration items.

Note
If you need to check the firewall settings for both operating systems, configure the first configuration item and then duplicate it. Then modify the duplicate so that it has a unique name, unique description, the correct WQL query, and the correct operating systems specified for applicability.

These configuration items can also be used as a simple test to ensure that desired configuration management is working as expected.

Procedure for Windows Vista

To author a general configuration item to check that the firewall service is started and set to start automatically - on computers running Windows Vista:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Expand the Desired Configuration Management node, right-click Configuration Items, click New, and then click General Configuration Item.

  3. On the Identification page of the Create General Configuration Item Wizard, specify the following:

    • Name: Specify a unique and descriptive name for the configuration item, such as Security Setting for Windows Vista: Windows Firewall Enabled.
    • Description: Specify a description for the configuration item, such as This configuration item determines whether the firewall service is started and set to automatically start on computers running Windows Vista.
    • Click Next twice.

  4. On the Settings page of the Create General Configuration Item Wizard, click New, and then click WQL Query.

  5. In the New WQL Query Settings Properties dialog box, specify the following on the General tab:

    • Display name: Windows Firewall is running
    • Description: Checks if Windows Firewall service is running
    • Namespace: Root\CIMV2
    • Class: Win32_Service
    • Property: Started
    • WQL query WHERE clause: Name="MpsSvc"

  6. Click the Validation tab, and then specify the following:

    • Data Type: String
    • DetailsSt: Click the New icon.

  7. In the Configure Validation dialog box, specify the following:

    • Name: Started=true.
    • Description: Service should be started.
    • Operator: Equals
    • Value: true
    • Severity: Warning

  8. Click OK twice to close the New WQL Query Setting Properties dialog box.

  9. On the Settings page of the Create General Configuration Item Wizard, click New, and then click WQL Query.

  10. In the New WQL Query Settings Properties dialog box, specify the following on the General tab:

    • Display name: Windows Firewall starts automatically
    • Description: Checks if Windows Firewall service starts automatically
    • Namespace: Root\CIMV2
    • Class: Win32_Service
    • Property: StartMode
    • WQL query WHERE clause: Name="MpsSvc"

  11. Click the Validation tab, and then specify the following:

    • Data Type: String
    • Details: Click the New icon.

  12. In the Configure Validation dialog box, specify the following:

    • Name: StartMode=Auto.
    • Description: Service should start automatically.
    • Operator: Equals
    • Value: Auto
    • Severity: Warning

  13. Click OK twice to close the New WQL Query Setting Properties dialog box.

  14. On the Settings page of the Create General Configuration Item Wizard, click Next.

  15. On the Applicability page of the Create General Configuration Item Wizard, specify the following:

    • All x64 Windows Vista
    • All x86 Windows Vista
    • x64 Windows Vista Original Release
    • x86 Vista Original Release

  16. Click Next twice, and close the Wizard Completed page.

Procedure for Windows XP

To author a general configuration item to check that the firewall service is started and set to automatically start - on computers running Windows XP Professional:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Expand the Desired Configuration Management node, right-click Configuration Items, click New, and then click General Configuration Item.

  3. On the Identification page of the Create General Configuration Item Wizard, specify the following:

    • Name: Specify a unique and descriptive name for the configuration item, such as Security Setting for Windows XP: Windows Firewall Enabled.
    • Description: Specify a description for the configuration item, such as This configuration item determines whether the firewall service is started and set to automatically start on computers running Windows XP.
    • Click Next twice.

  4. On the Settings page of the Create General Configuration Item Wizard, click New, and then click WQL Query.

  5. In the New WQL Query Settings Properties dialog box, specify the following on the General tab:

    • Display name: Windows Firewall is running
    • Description: Checks if Windows Firewall service is running
    • Namespace: Root\CIMV2
    • Class: Win32_Service
    • Property: Started
    • WQL query WHERE clause: Name="sharedaccess"

  6. Click the Validation tab, and then specify the following:

    • Data Type: String
    • Details: Click the New icon.

  7. In the Configure Validation dialog box, specify the following:

    • Name: Started=true.
    • Description: Service should be started.
    • Operator: Equals
    • Value: true
    • Severity: Warning

  8. Click OK twice to close the New WQL Query Setting Properties dialog box.

  9. On the Settings page of the Create General Configuration Item Wizard, click New, and then click WQL Query.

  10. In the New WQL Query Settings Properties dialog box, specify the following on the General tab:

    • Display name: Windows Firewall starts automatically
    • Description: Checks if Windows Firewall service starts automatically
    • Namespace: Root\CIMV2
    • Class: Win32_Service
    • Property: StartMode
    • WQL query WHERE clause: Name="sharedaccess"

  11. Click the Validation tab, and then specify the following:

    • Data Type: String
    • Details: Click the New icon.

  12. In the Configure Validation dialog box, specify the following:

    • Name: StartMode=Auto.
    • Description: Service should start automatically.
    • Operator: Equals
    • Value: Auto
    • Severity: Warning

  13. Click OK twice to close the New WQL Query Setting Properties dialog box.

  14. On the Settings page of the Create General Configuration Item Wizard, click Next.

  15. On the Applicability page of the Create General Configuration Item Wizard, specify the following:

    • All x64 Windows XP Professional
    • All x86 Windows XP
    • x64 Windows XP Professional SP1
    • x64 Windows XP Professional SP2
    • x86 Windows XP Professional Service Pack 2

  16. Click Next twice, and close the Wizard Completed page.

Next Steps

Now that you have created these general configuration items, they can be added to a configuration baseline using the following configuration baseline rule:

  • These application and general configuration items are required and must be properly configured

Assign this configuration baseline to Windows Vista and Windows XP Professional computers that should have the Windows Firewall started automatically, and investigate the computers that report noncompliance.

See Also

Tasks

How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
How to Assign Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


Sample Configuration Item: Check for the Presence of the Client Installation Properties Registry Key Using Desired Configuration Management

This procedure guides you through the process of using desired configuration management in Configuration Manager 2007 to create a general configuration item with an object setting to determine whether the registry key Hkey_Local_Machine\Software\Policies\Microsoft\Ccmsetup\SetupParameters is found on client computers.

Purpose of the Configuration Item

The registry key Hkey_Local_Machine\Software\Policies\Microsoft\Ccmsetup\SetupParameters can be created by Configuration Manager 2007 administrators to store installation properties for the client installation program, CCMSetup. When the Configuration Manager 2007 client is installed on computers containing this registry key, the values in this registry key will be read by CCMSetup and applied to the client installation.

Although this can be a useful feature, installation properties stored in the registry might overwrite site-wide settings specified by the Configuration Manager 2007 administrator causing inconsistent settings to be applied across clients in the Configuration Manager 2007 site. Desired configuration management can be used to detect the presence of this registry key, which allows you to monitor for the unauthorized presence of this registry key.

Procedure

To author a general configuration item to check for the presence of the registry key Hkey_Local_Machine\Software\Policies\Microsoft\Ccmsetup\SetupParameters:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Desired Configuration Management.

  2. Expand the Desired Configuration Management node, right-click Configuration Items, click New, and then click General Configuration Item.

  3. On the Identification page of the Create General Configuration Item Wizard, specify the following:

    • Name: Specify a unique and descriptive name for the configuration item, such as Client setup parameters registry check.
    • Description: Specify a description for the configuration item, such as This configuration item determines whether client computers have instances of the registry key Hkey_Local_Machine\Software\Policies\Microsoft\Ccmsetup\SetupParameters.
    • Click Next.

  4. On the Objects page of the Create General Configuration Item Wizard, click New, and then click Registry Key.

  5. In the New Registry Key Properties dialog box, specify the following in the General tab:

    • Hive: From the drop-down list, select HKEY_LOCAL_MACHINE.
    • Key: Specify the path Software\Policies\Microsoft\Ccmsetup\SetupParameters.
    • Is this registry key associated with a 64-bit application? Select No.
    • Select the option Report a non-compliance event when this instance count fails.
    • Instance count operator: Select Greater than.
    • Values: Specify the value 0.
    • Severity: From the drop-down list, select Warning.
    • Click OK to close the New Registry Key Properties dialog box.

  6. Click Next.

  7. On the Settings page of the Create General Configuration Item Wizard, click Next.

  8. On the Applicability page of the Create General Configuration Item Wizard, specify the following:

    • Under Windows Platforms, select All Windows Platforms.
    • Click Next.

  9. On the Summary page of the Create General Configuration Item Wizard, review the settings for the configuration item you have created, and then click Next.

  10. View the Progress page of the Create General Configuration Item Wizard. When this is complete, view the summary of actions taken on the Wizard Complete page.

  11. Click Close.

Next Steps

Now that you have created this general configuration item, it can be added to a configuration baseline using the following configuration baseline rule:

  • These application and general configuration items are required and must be properly configured

Assign this configuration baseline to computers that should not have this registry key present, and investigate the computers that report non-compliance.

See Also

Tasks

How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
How to Assign Configuration Baselines in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


Queries in Configuration Manager

Many Microsoft System Center Configuration Manager 2007 features use queries against objects within the Configuration Manager 2007 site database. Configuration Manager 2007 queries define and store the criteria for sets of database objects that you want to find. When used against a Configuration Manager 2007 site database, a query is a specific set of instructions that extract information about a defined set of objects. You can create queries and store them in the Configuration Manager 2007 site database. By running a query, you search the database for information about the objects that match the query criteria.

You can import queries into and export queries from the Configuration Manager 2007 site database.

See Also

Concepts

Overview of Queries

Other Resources

Tasks for Queries
Configuration Manager 2007 Features


Overview of Queries

You can create and run queries to locate objects in a Microsoft System Center Configuration Manager 2007 site that match your query criteria. These objects include items such as specific types of computers or user groups. Queries can return most types of Microsoft System Center Configuration Manager 2007 objects, including sites, collections, packages, and saved queries themselves. However, queries are most useful for extracting information related to resource discovery, inventory data, and status messages.

When you create a query, you must specify a minimum of two parameters: where to search and what to search for. For example, to find out the amount of hard disk space that is available on all personal computers in a Configuration Manager 2007 site, you can create a query to search the System Resource About Object Types and search for available hard disk space.

After you create an initial query, you can specify additional query criteria. For example, you can specify that the query results include only personal computers with more than 100 MB of available hard disk space. You can also modify how results are displayed so that you can view the results in an order that is meaningful to you. For example, you can specify that the results be ordered by the amount of available hard disk space in either ascending or descending order.

When you create a query, it is stored by Configuration Manager 2007 and displayed in the Configuration Manager 2007 console under Queries. From this location, you can create a Query , run or update a, view, modify, and delete queries.

When a query is run, Configuration Manager 2007 searches the Configuration Manager 2007 site database for objects that match the query criteria. The results of the query appear in the results pane of the Configuration Manager 2007 console.

Note
Queries targeting Configuration Manager 2007 status messages are best viewed using Status Message Viewer.

See Also

Tasks

How to Modify How Query Results Are Displayed
How to Run or Update a Query
How to Delete a Query
How to Create a Query

Concepts

About Query Elements
About Object Types
About Attributes and Attribute Classes
About Criterion Types
About Logical Operators and Operator Precedence
About Relational Operators
About Group Parentheses
About Attribute Class Joins
How to Modify a Query


About the Optional Alias

The Microsoft System Center Configuration Manager 2007 alias name feature provides a way to assign an alternative name to an attribute class. Typically, it is a shorter name. However, using long aliases might prevent displaying all data in a query. Specifying an alias is optional, but it makes the WBEM Query Language (WQL) syntax easier to read if you are working in Query Language view. In design view, the alias name is displayed with the internationalized attribute class name.

Generally, assigning an alias name is optional. However, there are some complex queries that require the use of the alias feature. For these cases, you should have a working knowledge of WQL. For more information about WQL, see the Microsoft System Center Configuration Manager 2007 software development kit (SDK).

When you use the Select Attribute dialog box to assign an alias name, a drop-down list box is displayed. The first time you assign an alias name to an attribute class, the drop-down list is empty, so you must type a name in the box. Subsequently, each time you assign an alias name for an attribute class, all previously assigned names for that class are displayed in the drop-down list. You can select a previously assigned alias name or specify a new alias name. However, unless you are composing a complex query that requires a new alias name, choose an existing alias name. This prevents Configuration Manager 2007 from automatically creating unnecessary join operations on the Joins tab of the Query Statement Properties dialog box, which makes the query more complex.

If you open the Select Attribute dialog box from the Joins tab, you are only given the option of modifying a previously assigned alias name. You cannot assign an alias name to an attribute class from the Joins tab if one has not already been specified.

Caution
When specifying an alias name for an attribute class, make sure that the new alias name is not already assigned to another attribute class. You can review the query syntax on the Joins tab to verify alias names.

See Also

Reference

Select Attribute Dialog Box

Concepts

About Attributes and Attribute Classes
Overview of Queries


About Query Criterion Values

When you create a query expression by using a criterion type, you compare an attribute that you specify with a value that you select. Constant values must have a data type that is correct for the attribute to which it is being compared. A data type defines the format of a value and the possible range of values. For example, the NetBIOSName attribute is stored as a string and the Disk Storage Size attribute is stored as a number.

There are four data types that are used by Microsoft System Center Configuration Manager 2007: numerical, string, date and time, and parameterized. Each query attribute stores data by using one of these data types. When specifying query attributes, the criterion value that you can specify depends on the data type of the query attribute. Following are guidelines for specifying the appropriate criterion value for each of the four data types.

Numerical Values

You must specify a numeral that the query uses to evaluate the expression. If you specify a value that is not numerical, the query fails.

String Values

You must specify the exact string that the query will use to evaluate the expression — do not use quotation marks unless they are part of the string. For relational operators that perform LIKE comparisons ("is like" or "is not like"), you can use wildcard characters within the string. You can use the following wildcards.

Wildcard | Description
% | Any string of zero or more characters
_ (underscore) | Any single character
[] | Any single character within the range or set (for example [a-f] or [abcdef])
[^] | Any single character not within the specified range (for example [^a-f] or [^abcdef])

Date and Time Values

You must enter a date that the query can use to evaluate the expression. This value must be entered according to the units that are specified by the date and time operator. For example, if you use the "year is after" operator, you would enter the year by using four digits (for example, 2002).

When you write queries by using Configuration Manager 2007 Query Builder, you can express the date and time in any valid SQL format. For more information, see the SQL Server documentation.

Parameterized Values

The Configuration Manager 2007 Administrator console prompts you for the actual value to use when the query runs.

See Also

Concepts

Overview of Queries


About Object Types

When you create a Microsoft System Center Configuration Manager 2007 query, you are searching the Configuration Manager 2007 site database for the set of database objects that match one or more attributes of an Configuration Manager 2007 database object type. An object type is a set of attributes that represents a Configuration Manager 2007 database object, such as a client, a package, an advertisement, or a user group. All objects of a specific type, such as clients, packages, or users, are labeled and grouped together. Each object type has specific attributes that are useful to describe those objects. For example, clients have processor types but user groups do not.

Configuration Manager 2007 object types consist of one or more attribute classes. Attribute classes are container objects that group related attributes within an object type. Each attribute class contains the set of attributes that define the class. For example, the System Resource object type contains an attribute class called Processor with attributes such as CurrentClockSpeed and Manufacturer, and another attribute class called Disk with attributes such as Partitions and SCSIBus. The attributes within the chosen attribute class are used to construct the query.

A query can search against only one Configuration Manager 2007 object type at a time. By default, the System Resource object type is selected. The following Configuration Manager 2007 object types are available for queries.

Object type | Description
Advertisement | A single attribute class with attributes representing the data in a Configuration Manager 2007 advertisement.
Software Metering Rules | A single attribute class with attributes representing the data in a Configuration Manager 2007 software metering rule.
Package | A single attribute class with attributes representing the data in a Configuration Manager 2007 package.
Program | A single attribute class with attributes representing the data in a Configuration Manager 2007 program.
Site | A single attribute class with attributes representing a Configuration Manager 2007 site.
System Resource | Many attribute classes that together characterize the discovery data and inventory data of a system resource. Discovery data is characterized by a single attribute class called System, and the inventory data is characterized by the other classes of the System Resource object type, for example, Logical Disk.
User Resource | A single attribute class representing the discovery data for User objects. This object type represents Configuration Manager 2007 users in a Configuration Manager 2007 site hierarchy.
User Group Resource | A single attribute class representing the discovery data for User Group objects.

See Also

Concepts

Overview of Queries
About Query Elements


About Relational Operators

A relational operator is a query condition (such as, is equal to) that defines how the About Query Criterion Values of the expression is compared with the specified About Attributes and Attribute Classes.

The types of relational operators that are available depend on the data type of the attribute. The data types are numerical, date and time, and string.

Relational operators are typically used when configuring a About Criterion Types to compare one query attribute to another. When adding a relational operator to a query in design view, Microsoft System Center Configuration Manager 2007 prompts you with a drop-down list including all relational operators that are valid for the query expression.

See Also

Concepts

About Query Criterion Values
Overview of Queries


About Logical Operators and Operator Precedence

AND, OR, and NOT are all valid logical operators that can be used in an Microsoft System Center Configuration Manager 2007 query. Logical operators can be used to broaden or narrow the scope of a query. Additionally, Configuration Manager 2007 evaluates expressions by using a particular operator precedence, which can affect the results.

AND

Finds all objects that satisfy two criteria connected by AND. You can use AND to narrow the list of objects that you want to find. For example, you can have Configuration Manager 2007 search for all computers that have a Pentium processor AND more than 64 MB of physical memory.

OR

Finds all objects that satisfy either of the two criteria connected by the OR. You can use OR to assemble a set of objects. For example, you can have Configuration Manager 2007 search for all computers that have a Pentium processor OR more than 64 MB of physical memory.

NOT

Finds all objects that do not satisfy the following expression. You can use NOT to narrow the list of objects that you want to find. For example, you can search for all computers that have a Pentium processor and NOT more than 64 MB of physical memory.

Evaluation Order

You must understand the evaluation order of the logical operators before you can obtain the results that you want. On the Criteria tab in the Query Statement Properties dialog box, the statements are evaluated from top to bottom except for expressions in parentheses, which always come first. In WQL, expressions are evaluated in the following order:

Expressions set inside parentheses

Expressions joined by AND

Expressions joined by OR

Expressions preceded by NOT

Use group parentheses to make complex expressions easier to understand or to force a certain order of evaluation. For example, when more than one OR expression occurs within a complex query, use parentheses to indicate which expressions should be evaluated first.

For more information about logical operators, including sample query syntax that uses logical operators, see the Configuration Manager 2007 SDK.

See Also

Concepts

Overview of Queries


About Attribute Class Joins

SMS Attribute Class Join operations are complex operations in which you specify how to combine data from two different attribute classes. While using the General tab and the Criteria tab in the Query Statement Properties dialog box, as soon as you use an attribute from an attribute class that is not yet in the query, a new join is created automatically for this attribute class.

Because suitable joins are automatically created when the query is built, you can regard the Joins tab in the Query Statement Properties dialog box as an advanced feature that typically you will not need. Nevertheless, there are certain kinds of queries that can only be expressed by manually entering new joins or modifying the ones that are automatically created. With the resulting expression, you specify how objects from these classes are related. For example, you can use a join to search for all discovery data items that have had hardware inventory collected (in WQL notation).

Copy Code
select * from sms r system as r
INNER JOIN
sms g system SYSTEM as g
ON r.ResourceID = g.ResourceID

There are four types of attribute class joins, as described in the following table.

Join type | Description
Inner join | Displays only matching results — always used by joins that are created automatically
Left outer join | Displays all results for the base attribute and only the matching results for the join attribute
Right outer join | Displays all the results for the join attribute and only the matching results for the base attribute
Full join | Displays all the results for both the base attribute and the join attribute
Caution
Join operations are an advanced function of Microsoft SQL Server. Before configuring or modifying a join operation, you must have a good working knowledge of the Structured Query Language (SQL) syntax that is needed to create various types of table joins. For more information about join operations, see About Configuring Attribute Class Joins or your SQL Server documentation.

See Also

Concepts

Overview of Queries
About Configuring Attribute Class Joins


About Group Parentheses

You can use group parentheses to group a set of expressions. A group is a set of expressions that are explicitly combined with parentheses. You can only group a set of expressions that form a subclause, which is a set of expressions that can be logically treated as a single expression.

Use group parentheses to make complex expressions easier to understand or to force a certain order of evaluation. For example, when more than one OR expression occurs within a complex query, use parentheses to indicate which expression should be evaluated first.

By making a set of expressions a group, you ensure that the expressions of the group are treated together and evaluated first. Groups have a higher operator precedence than the logical operators AND, OR, and NOT. For more information about how queries are evaluated and operator precedence, see About Logical Operators and Operator Precedence.

See Also

Concepts

Overview of Queries


About Query Elements

Microsoft System Center Configuration Manager 2007 queries are composed of several different elements that make up the query criteria. The complexity of the query depends on which elements are used and how they are applied. Query elements can be divided into two categories: required elements and optional elements.

Required Elements

To create a valid query, you must include the following elements. Use the General tab in the Query Properties dialog box and the General tab in the Query Statement Properties dialog box to add these elements.

  • Query name (a unique name that identifies the query)
  • Object type
  • Attributes classes
  • Attribute

Optional elements

These elements are not required for a valid query, but you can use them to refine query results. Use the Criteria tab and the Joins tab in the Query Statement Properties dialog box to add the following elements:

  • Criterion types
  • Logical operators
  • Group parentheses
  • Attribute class join

See Also

Concepts

Overview of Queries


About Displaying Query Results

When a query is run, the results are displayed in the results pane of the Microsoft System Center Configuration Manager 2007 Administrator console. You can modify how these results are displayed by using the General tab in the Query Statement Properties dialog box.

The General tab displays a table that includes the query attributes. You can modify how the query results are displayed by moving the query attributes up or down in the table. The order of the attributes in this table, from top to bottom, are the order in which they are displayed within the query results columns, from left to right. In other words, the first attribute listed in this table is displayed in the first column on the left and the last attribute listed in this table is displayed in the last column on the right.

You can also modify how query results are sorted. The sort order determines the order in which the results are displayed within the columns. Choose from ascending, descending, or unsorted. To modify the sort order, highlight a query attribute, and then click Properties.

Finally, after a query is run, you can re-arrange the result columns in the results pane. The re-arranged order will be saved as a user preference across sessions.

See Also

Tasks

How to Modify How Query Results Are Displayed

Concepts

Overview of Queries


About Criterion Types

Criterion types identify the form that query expressions will take and enable you to narrow the results of a query by reducing the number of results that are returned. For example, you can compare a criterion type to a constant value by using the simple value criterion type and return only query results that match the value, such as all processors that equal i386.

The criterion type that you specify in the Criterion Properties: General Tab dialog box identifies the form that the query expression will take. For each criterion type, you are prompted to enter an About Attributes and Attribute Classes and a About Relational Operators (such as, is equal to) in addition to providing the specific information for the criterion type. You can choose from the following five criterion types.

Criterion type | Description
Criterion Properties (Simple Value Criterion Type) | Compares the query attribute to a constant value. You supply a matching value.
Criterion Properties (Null Value Criterion Type) | Compares the query attribute to a null value. Null values are unknown.
Criterion Properties (Attribute Reference Criterion Type) | Compares the query attribute to another attribute. You enter the attribute.
Criterion Properties (Subselected Values Criterion Type) | Compares the query attribute to the results that are returned by another query. You browse for the query name.
Criterion Properties (List of Values Criterion Type) | Compares the query attribute to a list of constant values. Microsoft System Center Configuration Manager 2007 prompts you for a list of values.

When you create a query expression by using a criterion type, you compare an attribute that you specify with a value that you select. Constant values must have a data type that is correct for the attribute to which it is being compared. For more information about working with values and criterion types, see About Query Criterion Values.

See Also

Concepts

Overview of Queries


About Configuring Attribute Class Joins

To configure or modify a join operation, begin with the Joins tab of the Query Statement Properties dialog box. When you create a new join, you must first highlight an existing attribute class, and then click New. You are then prompted to select a join attribute on the General tab of the Attribute Class Join Properties dialog box. The attribute that is highlighted when a new join is created becomes the base attribute.

Join operations are automatically configured for you on both the General tab and the Criteria tab of the Query Statement Properties dialog box when you add attributes from more than one attribute class to the query. To modify an existing join, click the Joins tab, highlight the Join attribute, and then click Properties. When you view or modify the properties of an existing join, the highlighted attribute is the Join attribute.

When the query with a join operation runs, Microsoft System Center Configuration Manager 2007 searches for matches in both attribute classes. The results that are displayed for a join operation depend on the type of join that you select.

Caution
Join operations are an advanced function of Microsoft SQL Server. Before configuring or modifying a join operation, you must have a good working knowledge of the Structured Query Language (SQL) syntax that is needed to create various types of table joins. For more information about join operations, see your SQL Server documentation.

See Also

Concepts

Overview of Queries


About Attributes and Attribute Classes

An attribute class is a container object that groups related attributes. The attributes of an object type are organized into one or more attribute classes. For example, within the System Resource object type there is a Processor attribute class and a BIOS attribute class. Within the Processor attribute class there are attributes such as Device ID, Manufacturer, and Resource ID. The attribute classes from which you can select include all the attribute classes belonging to the object type for the current query. Attribute classes are directly analogous to SQL tables and WBEM WBEM classes.

An attribute is the specific property for which the query searches. Attributes must be members of an attribute class that is associated with the object type of the current query. Attributes are directly analogous to SQL table columns and WBEM properties.

See Also

Concepts

Overview of Queries
About Query Elements
About Object Types


Tasks for Queries

The following section describes tasks related to Microsoft System Center Configuration Manager 2007 queries.

In This Section

How to Create a Query

Describes how to create a query.

How to Modify a Query

Describes how to modify a query.

How to Delete a Query

Describes how to delete a query.

How to Run or Update a Query

Describes how to run or update a query.

How to Modify How Query Results Are Displayed

Describes how to modify how query results are displayed.


How to Create a Query

If you are unfamiliar with creating Microsoft System Center Configuration Manager 2007 queries, it is recommended that you use an existing query as the basis for a new query. If you want to use an existing query as the basis for a new query, click Import Query Statement on the Query Properties dialog box to locate and select the existing query. The new query will inherit the properties of the existing query, which you can then modify.

Note
Some invalid queries do not generate errors. Therefore, if a query does not return data, it might be invalid. Review the query to ensure that, for example, it is not querying a resource for a value that it does not possess.

Note
You must have Create permission for the Query security object class to create a new query.

How to create a query

  1. Navigate to System Center Configuration Manager / Site Database / Computer Management / Queries.

  2. Right-click Queries, point to New, and then click Query.

  3. Complete the settings in the General dialog box, and then click Edit Query Statement.

  4. In the Query Statement Properties dialog box, complete the settings on the following tabs:

  5. Use the General tab to specify the attributes to be returned in the results of the query, the order in which the attribute results are presented within columns, and how they are sorted.

  6. Use the Criteria tab to refine query criteria and limit the results that are returned.

  7. Use the Joins tab to combine data from two different attribute classes or to modify an existing join operation. Joins refine your query and help ensure that useful data returns.

See Also

Concepts

Overview of Queries
About Query Elements


How to Modify a Query

If you want to use an existing Microsoft System Center Configuration Manager 2007 query as the basis for a new query (to preserve the original query), click Browse on the Query Properties dialog box to locate and select the existing query. The new query will inherit the properties of the existing query, which you can then modify.

Note
If you select only a portion of a clause in a query that has multiple clauses, the Delete button is disabled. Select the entire clause.

Note
You must have Modify permission for the Query security object class to modify query properties.

Procedures

How to modify a query

  1. Navigate to System Center Configuration Manager / Site Database / Computer Management / Queries.

  2. Right-click the query that you want to modify, and then click Properties.

  3. Modify the settings in the Query Properties dialog box, and then click Edit Query Statement.

  4. In the Query Statement Properties dialog box, modify the settings on the following tabs:

  5. Use the General tab to modify the attributes to be returned in the results of the query, the order in which the attribute results are presented within columns, and how they are sorted.

  6. Use the Criteria tab to modify the query criteria and limit the results that are returned.

  7. Use the Joins tab to combine data from two different attribute classes or to modify an existing join operation.

See Also

Concepts

Overview of Queries
About Query Elements


How to Delete a Query

Deleting the Microsoft System Center Configuration Manager 2007 query does not remove the Microsoft System Center Configuration Manager 2007 objects returned by the query.

Note
You must have Delete permission for the Query security object to delete that query.

How to Delete a Query

  1. Navigate to System Center Configuration Manager / Site Database / Computer Management / Queries.

  2. Right-click the query that you want to delete, and then click Delete.

See Also

Concepts

Overview of Queries
About Query Elements


How to Run or Update a Query
Note
No rights are needed to run a Microsoft System Center Configuration Manager 2007 query, but query results are limited to the security objects for which you have Read permission.

Note
Some invalid queries do not generate errors. Therefore, if a query does not return data, it might be invalid. Review the query to ensure that, for example, it is not querying a resource for a value that it does not possess.

How to Run or Update a Query

  1. Navigate to System Center Configuration Manager / Site Database / Computer Management / Queries.

  2. Select the query that you want to run or update. The results of the query appear in the results pane of the Configuration Manager console.

See Also

Concepts

About Displaying Query Results
About Query Elements
Overview of Queries


How to Modify How Query Results Are Displayed
Note
You must have Modify permission for the Microsoft System Center Configuration Manager 2007 Query security object class to modify query properties.

How to modify how the query results are displayed

  1. Navigate to Queries.

  2. Select the query that you want to modify.

  3. Right-click the query, and then click Properties.

  4. On the General tab of the Query Properties dialog box, click Edit Query Statement.

  5. On the General tab of the Query Statement Properties dialog box, modify the Results table to specify the attributes that are returned in the query results and how the results are displayed.

See Also

Concepts

About Displaying Query Results
Overview of Queries
About Query Elements
Queries in Configuration Manager


Mobile Device Management in Configuration Manager

The Microsoft System Center Configuration Manager 2007 mobile device management feature helps manage supported Windows Mobile mobile device and Windows CE mobile devices in the enterprise. With mobile device management, you can do the following tasks:

  • Inventory software
  • Inventory hardware
  • Collect files
  • Manage configurations
  • Distribute software

Click the associated link in the following section for detailed information about device management.

In This Section

Overview of Mobile Device Management

Provides an overview of the mobile device management feature.

Prerequisites for Mobile Device Management

Provides information about the prerequisites necessary to use Mobile Device Management.

Configuring Mobile Device Management

Provides the configuration checklist and tasks to configure mobile device management in the environment.

Tasks for Mobile Device Management

Provides a set of tasks to perform mobile device management objectives.

Mobile Device Clients Security Best Practices and Privacy Information

Provides security and privacy information and best practices for mobile device management.

Troubleshooting Mobile Device Management

Provides troubleshooting information for mobile device management.

Technical Reference for Mobile Device Management

Provides technical references for mobile device management.

See Also

Concepts

What's New in Mobile Device Management for Configuration Manager


Overview of Mobile Device Management

System Center Configuration Manager 2007 device management enables mobile device discovery and management. Administrators can use the following Configuration Manager features to administer mobile devices running Microsoft Windows Mobile software for Pocket PC and Smartphone and Windows CE platforms:

  • Hardware inventory
  • Software inventory
  • File collection
  • Software distribution
  • Mobile device configuration items

In This Section

Understanding Mobile Device Management

Provides information about the components in a mobile device management environment.

Supported Mobile Devices

Provides a list of Configuration Manager 2007 supported mobile devices.

Checklist for Mobile Device Management

Specifies the administrator checklist to enable Specifies the administrator workflow for mobile device management.

Administrator Checklist: Configuring Mobile Devices for a Site that Supports Internet-Based Client Management

Specifies the administrator checklist to install Configuration Manager 2007 client mobile devices when they are assigned to a site that supports Internet-based client management.

About Native Mode Certificates for Mobile Device Clients

Specifies a list of requirements for mobile device support of native mode communication.

Deploying Certificates to Mobile Device Clients

Provides information about how certificates are deployed to mobile devices.

About Configuration Items for Mobile Devices

Provides an overview of configuration items for mobile devices.

About Configuration Packages for Mobile Devices

Provides an overview of configuration packages for mobile devices.

About Packages from Definitions for Mobile Device Management

Provides and overview of packages from definition used for mobile device management.

Administrator Workflow for Mobile Device Management

Specifies the administrator workflow for mobile device management.

See Also

Other Resources

Tasks for Mobile Device Management


Understanding Mobile Device Management

Configuration Manager mobile device management allows a system administrator to manage Configuration Manager 2007 Windows Mobile and Windows CE mobile devices in much the same way that Configuration Manager 2007 manages desktop computers. Awareness of mobile device communications and server roles will help you better plan your deployment.

Mobile Device Communication

By default, mobile device clients use HTTP to communicate with the device management points. Mobile device clients poll the device management point at specified intervals to report discovery data and receive policy advertisements. The polling interval is specified by the administrator in the Configuration Manager 2007 Administrator console. For more information on configuring mobile device polling, see Mobile Device Client Agent Properties: General Tab.

Device Management Architecture Diagram

Device Management Point

The device management point is a site role dependent on the Configuration Manager 2007 management point role. The device management point is the communication point for Configuration Manager 2007 Windows Mobile device clients and must reside on the same computer as the Configuration Manager 2007 management point.

The mobile device management point submits configuration and software installation instructions to the mobile device client when a request is made from the mobile device client during the polling interval. Software inventory data, hardware inventory data, and collected files are sent to the device management point.

The device management point receives mobile device client inventory data and sends policies to the mobile device client when the client polls the device management point.

Fallback Status Point

The fallback status point is a site system role that receives Configuration Manager 2007 mobile device client state messages in the event the mobile devices are unable to communicate with their management point. For example:

  • The client is not healthy.
  • The client has been installed with incorrect values specified.

The state messages sent to the fallback status point provide administrators assistance with identifying and diagnosing client problems. For more information, see About the Fallback Status Point in Configuration Manager.

Distribution Point

Mobile device clients receive policy and package information from the device management point. Software is then downloaded by the mobile device from a Configuration Manager 2007 distribution point. This distribution point can be located with the device management point role or it can be located on a separate server.

Mobile device clients use local distribution points and distribution points available while roaming regionally in the Configuration Manager 2007 hierarchy only.

See Also

Concepts

Supported Mobile Devices
Checklist for Mobile Device Management

Other Resources

Tasks for Mobile Device Management


Supported Mobile Devices

The Mobile Device Client requires 0.78 MB of storage space to install. In addition, mobile device management logging on the mobile device can require 256 KB of storage space. The mobile device client is supported on the following platforms:

  • Windows Mobile for Pocket PC 2003
  • Windows Mobile for Pocket PC 2003 Second Edition
  • Windows Mobile for Pocket PC Phone Edition 2003
  • Windows Mobile for Pocket PC Phone Edition 2003 Second Edition
  • Windows Mobile Smartphone 2003
Note
Password management is not supported for Windows Mobile Smartphone 2003.

  • Windows Mobile for Pocket PC 5.0
  • Windows Mobile for Pocket PC Phone Edition 5.0
  • Windows Mobile 5.0 Smartphone
  • Windows CE 4.2 (ARM processor only)
  • Windows CE 5.0 (ARM and x86 processors)
  • Windows Mobile 6 Standard
  • Windows Mobile 6 Professional
  • Windows Mobile 6 Classic
Note
Password management on Windows Mobile for Pocket PC 5.0, Windows Mobile for Pocket PC Phone Edition 5.0 and Windows Mobile 5.0 Smartphone requires the Messaging and Security Feature Pack (MSPF). For more information, see the Windows Mobile Messaging and Security Feature Pack Web page (http://go.microsoft.com/fwlink/?LinkId=80392).

Certification Authority Support for Windows Mobile 5 and Earlier

Windows Mobile 5 and earlier mobile devices must use a certification authority (CA) on Windows Server 2003 or Windows Server 2008 to enroll certificates. For more information about certificates for mobile devices, see About Native Mode Certificates for Mobile Device Clients.

See Also

Concepts

Understanding Mobile Device Management

Other Resources

Overview of Mobile Device Management
Tasks for Mobile Device Management


Checklist for Mobile Device Management

The following checklist outlines the steps required to support mobile device management on Configuration Manager.

Checklist

Step Link

Review the prerequisites for mobile device management.

Prerequisites for Mobile Device Management

Enable mobile device management on one or more management points.

How to Enable a Mobile Device Management Point

Enable mobile device support on one or more distribution points.

How to Enable Distribution Points to Support Mobile Devices

If you will install the mobile device client via Configuration Manager 2007 managed computer clients, distribute the hardware inventory extension to client computers.

How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management

Configure the mobile device client agent for your environment.

How to Configure the Mobile Device Client Agent

Edit the DMCommonInstaller.ini file or ClientSettings.ini file for your environment.

  • The DMCommonInstaller.ini file is used to install the mobile device client via synchronization with a Configuration Manager 2007 managed computer.
  • The ClientSettings.ini is used to manually install or update a mobile device.

How to Edit the Mobile Device Client Configuration .ini File

Create a source folder for mobile device client deployment that contains the files required to install or upgrade the mobile device client.

How to Create a Folder for Mobile Device Client Deployment

Deploy the mobile device client source folder to install or upgrade the mobile device client agent on mobile devices.

How to Install or Upgrade the Mobile Device Management Client

Verify the mobile device client was successfully installed or upgraded.

How to Verify Mobile Device Client Installation or Upgrade

See Also

Concepts

Understanding Mobile Device Management
Prerequisites for Mobile Device Management
Supported Mobile Devices

Other Resources

Overview of Mobile Device Management
Tasks for Mobile Device Management


About Native Mode Certificates for Mobile Device Clients

The public key infrastructure (PKI) certificates required to configure a Configuration Manager 2007 mobile device client to run in native mode are listed in the following tables. For more information about certificates required for native mode, see Certificate Requirements for Native Mode.

Certificates for Mobile Device Clients

Configuration Manager 2007 mobile device management uses the following certificates for native mode:

Configuration Manager Component Certificate Store Certificate Use How the Certificate Is Used By Mobile Devices in Configuration Manager

Site server signing certificate

Root

Document Signing

The site server signing certificate signs the policies that clients download from their management point so that clients know the policies originate from their assigned site.

Clients must be provisioned with a copy of this certificate before they can accept policies signed with it.

Mobile device user certificates

Personal

User Authentication

This certificate authenticates the device to the following servers:

  • Device management point
  • Proxy device management point
  • Distribution point

This certificate is also used to register the device client with Configuration Manager 2007.

Intermediate CA

Root

Certificate Chain Validation

This list of CAs creates an uninterrupted chain of authority to the root authority.

Root CAs for the following:

  • Site server signing certificate
  • Device management point
  • Distribution point

Root

Certificate Chain Validation

Used to register the root CA if not already present.

See Also

Concepts

Certificate Requirements for Native Mode
Deploying Certificates to Mobile Device Clients
Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2008 Certification Authority
Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority

Other Resources

Deploying the PKI Certificates Required for Native Mode


About Configuration Items for Mobile Devices

Microsoft System Center Configuration Manager 2007 configuration items are collections of desired settings to be applied to the mobile device using Configuration Manager 2007. Administrators can use configuration items to distribute the following to Configuration Manager 2007 managed mobile devices:

Configuration Items | Description
Browser Favorite Properties | Specifies the dial-up network configurations that can be distributed to mobile device clients.
Certificate Installation Properties | Specifies the certificate distributed to mobile devices and the store on the device where the certificate is saved.
Dial-up Network Properties | Provides Configuration Manager 2007 password management support for mobile devices that use the Messaging and Security Feature Pack (MSFP).
Exchange ActiveSync (WM03 mode) Properties | Specifies Exchange options to synchronize on the Windows Mobile 2003 mobile device with a desktop computer or server.
Exchange ActiveSync (WM05 mode) Properties | Specifies Exchange options to synchronize on the Windows Mobile 5.0 mobile device with a desktop computer or server.
GPRS Network Properties | Specifies the general packet radio service (GPRS) network options to distribute to mobile devices.
Internet E-mail Properties | Specifies the Internet e-mail settings to configure on the mobile device.
Network Proxy Properties | Specifies the network proxy settings to configure on the mobile device.
Password Policy for MSFP Properties | Specifies the password policies for the messaging and security feature pack (MSFP) to be enforced on the mobile device.
Password Policy for Pocket PC 2003 Properties | Specifies the password policy for the Windows Mobile Pocket PC 2003 mobile device.
Registry Properties | Specifies the registry key, value name, data type, and value to distribute to mobile devices.
Security Policies Properties | Specifies security polices for software installation on the mobile device.
VPN Properties | Specifies the virtual private network (VPN) configurations for the mobile device.
WiFi Settings Properties | Specifies the wireless network connection settings to be configured on the mobile device.

Configuration items are distributed in configuration packages, which can be advertised to Configuration Manager 2007 mobile device clients. Configuration items created on a Configuration Manager 2007 server do not propagate to child sites although configuration packages containing configuration items do propagate in read-only format. For more information about configuration packages, see About Configuration Packages for Mobile Devices.

See Also

Concepts

About Configuration Packages for Mobile Devices

Other Resources

Mobile Device Management Property Pages
New Mobile Device Configuration Item Wizard


About Configuration Packages for Mobile Devices

Microsoft System Center Configuration Manager 2007 uses configuration packages to distribute configuration items to mobile device clients in the same way packages distribute content to computer clients. Like packages for computer clients, configuration packages use programs, distribution points, and advertisements to collections to distribute their content. For more information about packages, see About Packages.

Configuration packages are built automatically based upon settings selections made by the administrator using the Configuration Package wizard. Source locations are defined automatically when creating the configuration package.

Note
Mobile devices do not recognize configuration package access accounts restrictions. Mobile devices do not have domain accounts and therefore cannot be restricted by access accounts.

Configuration items generally represent a set of mobile device settings to be applied to the mobile device and can only be distributed by using Mobile Device Management configuration packages. For more information about configuration items, see About Configuration Items for Mobile Devices.

Actions for Configuration Packages

The following actions in the Action pane can be used to change the contents and configurations of configuration packages. The following actions are available for configuration packages:

  • New Configuration Package. Creates a new configuration package that can distribute and install configuration items on mobile devices.
  • Copy Packages. Copies a package from one distribution to another.
  • New Folder. Creates a new configuration package folder.
  • New Search Folder. Creates a new search folder under the feature with criteria for object properties and the properties of each object.

To uses mobile device actions navigate System Center Configuration Manager / Site Database <database name> / Computer Management / Mobile Device Management / Configuration Packages, and then select the Action from the Actions pane.

See Also

Concepts

About Advertisements
About Distribution Points
About Configuration Items for Mobile Devices
About Packages
About Programs

Other Resources

Create Configuration Package Wizard for Mobile Devices
How to Manage Programs


About Packages from Definitions for Mobile Device Management

Microsoft System Center Configuration Manager 2007 Mobile Device Management includes a set of predefined packages that help administrators with core tasks. These packages perform functions that many administrators of mobile device networks require. These predefined packages include the program for the task they perform.

Package from Definition

The following package definitions are available for mobile device management:

  • Device Management Client Transfer--Transfers a mobile device client deployment folder to Configuration Manager 2007 computer clients. Once the Device Management Client Transfer package is deployed to the desktop computer, the mobile device client will be transferred to a mobile device and installed when a mobile device is synchronized with the desktop computer.
  • Device Management Inventory Extension--Extends the hardware inventory of Configuration Manager 2007 client computers to report whether they synchronize with mobile devices using ActiveSync (Microsoft Windows XP and earlier) or Microsoft Windows Mobile Device Center (the Windows Vista operating system). This also provides Configuration Manager 2007 administrators with information about when the mobile device last synchronized with the computer client.
  • Remove Device Management Client Transfer--Removes the Device Client Transfer package from Configuration Manager 2007 computer clients.
  • Remove Device Management Inventory Extension--Removes the Device Management Inventory Extension package from Configuration Manager 2007 computer clients.

For more information about using and deploying defined packages for mobile devices, see About Package Definition Files.

Procedure

To create a package from definition, perform the following steps:

To create a package from definition

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click Packages, navigate to New, and then click Package from Definition. The Create Package from Definition Wizard opens.

  3. Follow the steps of the Create Package from Definition Wizard to create a package from definition.

See Also

Concepts

About Package Definition Files

Other Resources

Create Package From Definition Wizard


Administrator Workflow for Mobile Device Management

This administrator workflow displays the recommended steps to configure Mobile Device management for Configuration Manager 2007.

Administrator Workflow of Device Management

See Also

Concepts

Checklist for Mobile Device Management


Prerequisites for Mobile Device Management

Microsoft System Center Configuration Manager 2007 Mobile Device Management requires prerequisites be in place on site systems that will support mobile devices and that a proper certificate infrastructure is accessible to mobile devices. This topic describes the three types of prerequisites that are required, and the certificate infrastructure that enables the mobile device to be managed once the mobile device management client is installed and the mobile device is ready to communicate to the Configuration Manager 2007 server.

Site System Prerequisites

To support mobile devices in mixed or native security modes, the following prerequisites are required on distribution points that will be used by devices:

Note
A site must be in native security mode to manage Internet-based mobile devices.

  • Configure Internet Information Services (IIS) and firewalls for communication between Configuration Manager 2007 site servers and mobile devices.
  • Web Distributed Authoring and Versioning (WebDAV) extensions for Internet Information Services (IIS) enabled
  • Background Intelligent Transfer Service (BITS) extensions enabled on the distribution point
  • Mixed mode only: Anonymous access must be enabled on the distribution point.

Secure Communication Prerequisites

To support mobile devices in native security mode the following certificate trust relationships are required:

  • The mobile device client must trust the SSL server authentication certificate of any server from which it gets policy or downloads software. This could be either the firewall/proxy server protecting site systems or, for example in an Internet scenario, it could be the site systems themselves.
  • The site systems (or firewall/proxy) must trust the SSL user authentication certificate used by the mobile device client to secure its half of the SSL connection.
  • The mobile device client must trust the site server signing certificate used by the Configuration Manager 2007 site server to sign policy sent to the mobile device client.
  • Any intermediate certification authority (CA) certificates necessary to complete the certificate trust chain to the PKI root must be installed on the device.

Secure Software Prerequisites

To protect mobile devices from malicious or untrusted software, all Windows Mobile devices starting with Windows Mobile 5.0 and Windows Mobile Smartphone 2003 require installed software come from a trusted source.

  • The Windows Mobile platform verifies both distributed software and any distributed .cab file are signed with a trusted software publishing certificate (SPC). Additionally, once installed on a mobile device, the mobile device client verifies the SPC that signed the code is from a trusted source every time the software is run.
  • Certain software must operate at a privileged level on the mobile device. The Configuration Manager 2007 device management agent requires privileged permission to run on the device. To run with privileges, the Software Publisher Certificate (SPC) used to code-sign the software must be in the SPC store on the device AND be stored in the privileged store on the mobile device. Software signed by certificates in the privileged execution store runs with elevated privileges. Software signed by certificates in the unprivileged execution store runs in a normal user context.

Certificates on Mobile Devices

Microsoft System Center Configuration Manager 2007 security in native mode is heavily dependent on public key infrastructure X.509v3 certificates. Mobile devices themselves do not have a user logon or access to Active Directory to provide security. Certificates are extremely important to mobile device management where they are used to do everything from registering the mobile device client and securing the SSL connections to verifying received software is from a trusted source.

Certificates will be stored in the following locations on the device:

  • Root certificate store - The root certificate for authenticating the server SSL connection and the Site Server Signing Certificate used by the site server to sign policy. Any intermediate certification authority certificates needed to complete the trust chain to the root of the PKI being authenticated will also be stored in the root certificate store.
  • Personal certificate store - The user authentication certificate used to authenticate the user for SSL connection to the server. This is also used to register the mobile device client with the site server.
  • SPC store - Any software publishing certificates (SPC) trusted by the device. This may include the Microsoft Authenticode Certificate used to sign the Microsoft System Center Configuration Manager 2007 mobile device client so it can install on the mobile device. For more information about certificate requirements for Configuration Manager 2007 communication, see About Native Mode Certificates for Mobile Device Clients.
  • Privileged execution store - Any software publishing certificates that are required to allow applications to run with elevated rights on the mobile device.

See Also

Concepts

About Native Mode Certificates for Mobile Device Clients
Understanding Mobile Device Management

Other Resources

Configuring Mobile Device Management
Overview of Mobile Device Management


Configuring Mobile Device Management

The Microsoft System Center Configuration Manager 2007 Mobile Device Management feature requires a number of configuration steps before you can distribute the mobile device client and manage mobile devices. Click the associated link in the following section for information about how to configure Mobile Device Management for Configuration Manager 2007.

In This Section

How to Upgrade from the Device Management Feature Pack

Provides the steps to remove the Mobile Device Feature Pack in preparation for deploying the Configuration Manager 2007 Mobile Device Management.

How to Enable a Mobile Device Management Point

Provides the configuration steps to enable a Configuration Manager 2007 management point to support mobile device clients.

How to Enable Distribution Points to Support Mobile Devices

Provides the configuration steps to enable a Configuration Manager 2007 distribution point to support mobile device clients.

How to Configure the Mobile Device Client Agent

Provides the steps to enable and configure the Configuration Manager 2007 mobile device client agent.

How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management

Provides the steps to enable discovery of client computers that synchronize with mobile devices.

How to Create a Folder for Mobile Device Client Deployment

Provides the steps to create a folder containing all files required for mobile device client installation on mobile devices.

How to Edit the Mobile Device Client Configuration .ini File

Provides the steps to edit the .ini files used during the mobile device client installation, upgrade, and uninstall processes.

How to Install or Upgrade the Mobile Device Management Client

Provides the steps to install or upgrade the Configuration Manager 2007 client on mobile devices.

How to Verify Mobile Device Client Installation or Upgrade

Provides the steps necessary to verify client deployment via log files, collections, and reports.

How to Configure Logging for Windows Mobile and Windows CE Devices

Provides the steps to configure logging on mobile devices and describes log files and their location.

How to Use Queries to Create Windows Mobile Device Collections

Provides the steps to create new collections of mobile devices.

See Also

Concepts

Mobile Device Clients Security Best Practices and Privacy Information

Other Resources

Overview of Mobile Device Management
Tasks for Mobile Device Management
Technical Reference for Mobile Device Management
Troubleshooting Mobile Device Management


How to Upgrade from the Device Management Feature Pack

Upgrading from System Management Server 2003 Device Management Feature Pack to Microsoft System Center Configuration Manager 2007 preserves the following mobile device management information:

  • Mobile device client inventories
  • Mobile device client records
  • Mobile device collections
  • Advertisements created in the Device Management Feature Pack
  • Settings and packages created in the Device Management Feature Pack
Note
Settings packages are not editable but can still be distributed using Configuration Manager 2007.

Procedure

Upgrade from a site running the Device Management Feature Pack using the following steps.

To upgrade a site server running the Device Management Feature Pack to Configuration Manager

  1. Uninstall the Device Management Feature Pack.

  2. Configure Internet Information Services (IIS) and firewalls for communication between Configuration Manager 2007 site servers and mobile devices.

  3. Install Configuration Manager 2007, and enable mobile device management. For more information about upgrading, see Configuration Manager Upgrade and Interoperability Planning and Deployment.

See Also

Concepts

Getting Started with Configuration Manager 2007

Other Resources

Configuration Manager Upgrade and Interoperability Planning and Deployment
Planning and Deploying the Server Infrastructure for Configuration Manager 2007


How to Enable a Mobile Device Management Point

The Configuration Manager device management point is an extension to the Configuration Manager 2007 management point or proxy management point. The device management point allows mobile devices to connect to Configuration Manager 2007 servers and receive policy and configuration settings. Mobile device management also allows mobile devices to report asset management information and status to Configuration Manager.

Prerequisite

To support distribution points for mobile devices, the following are required on the Configuration Manager site system:

  • Internet Information Services (IIS) must be installed and enabled.
  • Web Distributed Authoring and Versioning (WebDAV) extensions for IIS must be enabled.
  • Background Intelligent Transfer Service (BITS) extensions must be enabled.

Procedure

To configure the management point as a device management point, do the following:

To configure the management point as a device management point

  1. In the Configuration Manager console, navigate to server System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <management point computer name>.

  2. In the results pane, right-click ConfigMgr management point, and click Properties. The ConfigMgr Management Point Properties dialog box is displayed.

  3. To enable the device management point role, select the Allow devices to use this management point check box.

  4. Click OK.

See Also

Concepts

Prerequisites for Mobile Device Management
Understanding Mobile Device Management

Other Resources

Configuring Mobile Device Management


How to Enable Distribution Points to Support Mobile Devices

Topic last updated—November 2007

Microsoft System Center Configuration Manager 2007 distribution points provide the primary means for storing packages that can be distributed to mobile device clients. At least one distribution point is needed if mobile devices are to receive advertised packages and configuration packages.

To support distribution points for mobile devices, the following are required on the Configuration Manager site system:

  • The distribution point site role must be enabled on the Configuration Manager 2007 server. For more information, see How to Designate a Distribution Point.
  • Internet Information Services (IIS) must be installed and enabled.
  • Web Distributed Authoring and Versioning (WebDAV) extensions for IIS must be enabled.
  • Background Intelligent Transfer Service (BITS) extensions must be enabled.
Important
If the distribution point will no longer support mobile device clients, clear the Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS check box. If you change from using the default Web site to using a custom Web site, you should manually remove the virtual directories created under the default Web site. This is especially important if you configured the distribution point to Allow clients to connect anonymously (Required for mobile device clients) while using the default Web site and then you disable anonymous connections after switching to the custom Web site; in this case, the old virtual directories will still be configured for anonymous access. For the list of virtual directories created on BITS-enabled distribution points, see About BITS-Enabled Distribution Points.

To enable distribution points to support mobile devices

  1. In the Configuration Manager administrator console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site System / <site name>.

  2. In the details pane, right-click ConfigMgr distribution point, and click Properties. The ConfigMgr distribution point Properties dialog box is displayed.

  3. On the General tab, select the Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS check box.

  4. For mixed mode only, on the General tab, select the Allow clients to connect anonymously (Required for mobile device clients) check box, and click OK.

See Also

Concepts

About Configuration Items for Mobile Devices
About Configuration Packages for Mobile Devices

Other Resources

Software Distribution Overview


How to Configure the Mobile Device Client Agent

The Device Client Agent is used to enable and configure the following:

  • Mobile device poll settings
  • Mobile device software inventory
  • Mobile device hardware inventory
  • Mobile device software distribution
  • Mobile device file collection

When you configure the mobile device client agent, the changes that you make in the properties dialog box are valid for all of the mobile device clients in the Configuration Manager 2007 site.

Procedure

Use the following procedure to modify the mobile device client agent properties:

To modify the mobile device client agent properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. In the results pane, right-click Device Client Agent and then click Properties. The Device Client Agent Properties dialog box is displayed.

  3. Enable device management features and configure settings using these tabs:

    • General
    • Software distribution
    • Software inventory
    • Hardware inventory
    • File collection

  4. Click OK.

See Also

Reference

Mobile Device Client Agent Properties: File Collection
Mobile Device Client Agent Properties: Hardware Inventory
Mobile Device Client Agent Properties: General Tab
Mobile Device Client Agent Properties: Software Distribution Tab
Mobile Device Client Agent Properties: Software Inventory Tab


How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management

Before Configuration Manager can manage a mobile device, the Microsoft System Center Configuration Manager 2007 mobile device client software must be installed on that mobile device. One way to install the mobile device client software is to discover Configuration Manager 2007 desktop computers that synchronize with mobile devices and then distribute the mobile device client installation software through those computers. The mobile device installation files can then be distributed to those managed computers and the mobile device client will be installed the next time the mobile device docs with the computer. To discover mobile devices attached to desktop computers, the hardware inventory of the desktop computers must be extended. The hardware inventory only needs to be extended on Windows XP and older computers. Connected mobile devices are discovered by default by Windows Vista.

Prerequisite

Before you can complete this procedure, the desktop computer must have all of the following installed:

  • Mobile Device Center installed on Windows Vista client computers and ActiveSync running on Windows XP and earlier client computers that will deploy the mobile device client agent to mobile devices. For more information, see the mobile device synchronization web page (http://go.microsoft.com/fwlink/?LinkId=81724).
  • Hardware inventory enabled for desktop computer clients

The hardware inventory of the desktop computer is extended after the Inventory Extension package is downloaded and the program is run. When the next inventory cycle runs, if a computer reports having synchronized with mobile devices then two new classes will appear in the computer hardware inventory when viewed in Resource Explorer: ActiveSync Service and Connected Device.

To verify the hardware inventory has been extended, run the following Configuration Manager 2007 device management reports:

  • Configuration Manager 2007 desktops reporting an ActiveSync-connected device without a Configuration Manager 2007 Device Client.
  • Configuration Manager 2007 desktops reporting a connected Windows Mobile device.

Inventory extension is successful if Configuration Manager 2007 client computers appear in these reports. After the next hardware inventory cycle, you can create reports and collections in Configuration Manager 2007 identifying which Configuration Manager 2007 client computers synchronize with mobile devices.

Use the following procedure to distribute hardware inventory extension.

Procedure

To create the device management inventory extension package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click Packages, click New, and then click Package From Definition. The Create Package from Definition Wizard opens.

  3. In the Create Package from Definition Wizard, in the list of available Package definitions, select the Device Management Inventory Extension template, and then click Next.

  4. Depending upon your Configuration Manager 2007 environment, select one of the following:

    • Always obtain files from a source directory
    • Create a compressed version of the source

    Click Next.

  5. Include the source directory located at <InstallationFolder> \ DeviceClientDeployment \ InventoryExtension, click Next, and then click Finish to create the Device Management Inventory Extension package.

  6. Distribute the newly created inventory extension package to managed computers.

Inventory Extension Files

Extending the hardware inventory of Configuration Manager 2007 client computers deploys the following files:

  • Device management common installer program (DmCommonInstaller.exe)
  • Device management settings file (DmCommonInstaller.ini)
  • Device management inventory extension tool (DmInvExtension.exe)

See Also

Concepts

About Packages from Definitions for Mobile Device Management
How to Configure the Mobile Device Client Agent

Other Resources

Create Package From Definition Wizard
Hardware Inventory Client Agent Properties


How to Create a Folder for Mobile Device Client Deployment

Before the Microsoft System Center Configuration Manager 2007 mobile device client can be installed on mobile devices, a folder containing the files necessary for installation must be created. The mobile device client folder contains files necessary to install, configure, upgrade, and uninstall the mobile device client. The contents of the folder depend upon where it will be deployed. The mobile device source folders can be deployed in the following locations:

  • Computers that synchronize with mobile devices
  • Mobile devices

The topics below describe the procedure to create source folders to deploy the mobile device client.

In This Section

How to Create a Computer-Based Deployed Mobile Device Client Source Folder

How to Create a Computer-Based Mobile Device Client Deployment Folder

How to Create a Mobile Device-Based Deployed Mobile Device Client Source Folder

How to Create a Mobile Device-Based Mobile Device Client Deployment Folder

See Also

Concepts

How to Install or Upgrade the Mobile Device Management Client

Other Resources

Deploying the PKI Certificates Required for Native Mode
How to Edit the Mobile Device Client Configuration .ini File


How to Create a Computer-Based Mobile Device Client Deployment Folder

The Microsoft System Center Configuration Manager 2007 computer-based mobile device client deployment folder contains files required to deploy the mobile device client to all supported mobile devices. Once created, the folder can be distributed to computers that synchronize with mobile devices using Mobile Device Center (Vista) or ActiveSync (Windows XP and earlier) using Configuration Manager 2007 software distribution or other distribution methods. The client installation program (DMClientXfer.exe) then detects the platform of the connected mobile device and installs the correct mobile device client.

Procedure

To create a computer-based mobile device client deployment folder, perform the following steps:

To create a computer-based mobile device client deployment folder

  1. Create a new folder to contain the mobile device client deployment files.

  2. Into the new folder copy all the files in the client transfer folder located at <InstallationFolder> \ DeviceClientDeployment \ ClientTransfer \ <LanguageCode>.

  3. Into the new folder copy the following files located in <InstallationFolder> \ DeviceClientDeployment \ ClientTransfer:

    • DMClientXfer.exe
    • DMCommonInstaller.exe
    • DMCommonInstaller.ini

    For more information, see Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini. The DMCommonInstaller.ini file must be edited for your environment.

  4. In Native or server authentication mode, include all necessary certificates in the new folder. For more information on certificates, see Deploying Certificates to Mobile Device Clients.
Note
The DMCommonInstaller.ini file must be properly configured for the environment. For more information, see How to Edit the DMCommonInstaller.ini File for Mobile Device Management.

See Also

Concepts

How to Edit the DMCommonInstaller.ini File for Mobile Device Management
How to Install or Upgrade the Mobile Device Management Client

Other Resources

How to Create a Folder for Mobile Device Client Deployment
How to Edit the Mobile Device Client Configuration .ini File


How to Create a Mobile Device-Based Mobile Device Client Deployment Folder

The Microsoft System Center Configuration Manager 2007 mobile device-based client deployment folder contains files that target a specific mobile device platform. This folder can then be transferred and run on the mobile device, and it can be run manually or distributed over the air using Configuration Manager 2007 software distribution.

Procedure

To create a mobile device-based mobile device client deployment folder, perform the following steps:

To create a mobile device-based mobile device client deployment folder

  1. Create a new folder.

  2. Into the new folder, copy the following files, which are found in <InstallationFolder> \ DeviceClientDeployment \ ClientTransfer \ <LanguageCode>. Include only the files for the platform of the target mobile device:

    • DeviceClient_[platform type].cab
    • DMClientSetup_[platform type].exe
    • DMInstaller_[platform type].exe
    • SMSPassword_ce4.2_arm.cab (Pocket PC 2003 only)

    Determine the platform-specific files using the following table. For a list of mobile device client installation files, see Installation files for the Mobile Device Client.

    Mobile Device Platform File Platform Type Name

    Microsoft Windows Mobile Pocket PC 2003

    CE4.2_ARM

    Microsoft Windows Mobile Pocket PC 2005

    CE5.0_ARM

    Microsoft Windows Mobile Smartphone 2003

    SP_CE4.2_ARM

    Microsoft Windows Mobile Smartphone 2005

    SP_CE5.0_ARM

    Microsoft Windows CE 4.2 for ARM

    [DmInstaller_ce4.2_ARM.exe and DMInstaller_CE4.2_ARM.cab ]from the Device Management Feature Pack

    Microsoft Windows CE 5.0 for x86

    WINCE5.0_x86

    Microsoft Windows CE 5.0 for ARM

    WINCE5.0_ARM

    Microsoft Windows Mobile 6 Standard

    SP_CE5.0_ARM

    Microsoft Windows Mobile 6 Professional

    CE5.0_ARM

    Microsoft Windows Mobile 6 Classic

    CE5.0_ARM

  3. Rename the copied DMClientSetup_[device type].exe file to DMClientSetup.exe.

  4. Copy the platform-specific enroller file into the new directory. The appropriate enroller file is determined as follows:

    • For all Windows Mobile devices, copy Enroll_ARM.exe.
    • For Windows CE x86, copy Enroll_WinCE5.0_X86.exe.
    • For Windows CE ARM, copy Enroll_WinCE5.0_ARM.exe.

  5. Rename the copied enroller file Enroll.exe.

  6. If certificates are required, include all necessary certificates in the new folder. For more information on certificates, see Deploying Certificates to Mobile Device Clients.

  7. Copy the sample ClientSettings.ini file located by default in <InstallationFolder> \ DeviceClientDeployment \ ClientTransfer on Configuration Manager 2007 servers by default to the new folder. For more information about the values in the ClientSettings.ini file, see How to Edit the Mobile Device Client Configuration .ini File. The ClientSetting.ini file must be edited for your environment.

See Also

Concepts

How to Edit the ClientSettings.ini File for Mobile Device Management
How to Install or Upgrade the Mobile Device Management Client

Other Resources

How to Create a Folder for Mobile Device Client Deployment
How to Edit the Mobile Device Client Configuration .ini File


How to Edit the Mobile Device Client Configuration .ini File

Microsoft System Center Configuration Manager 2007 mobile device client deployment and configuration is defined by one of two .ini files, DMCommonInstaller.ini or ClientSettings.ini. The settings in the .ini file define the behavior of the client deployment process, including the following behaviors:

  • Specify whether to install, upgrade, or uninstall the mobile device client
  • Configure mobile device client settings, such as assigning Configuration Manager 2007 servers, security mode, and so on.

For a complete list of the settings in ClientSettings.ini and DMCommonInstaller.ini, see Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini.

The type of configuration process depends upon the client package transfer method as follows:

Client transfer method | Configuration .ini file type
Via synchronization with a Configuration Manager 2007 computer | DMCommonInstaller.ini
Manually via digital memory card or other method | ClientSettings.ini
Over the air upgrade | ClientSettings.ini
Manually via synchronization with a desktop computer | DMCommonInstaller.ini

ClientSetting.ini files are mobile device platform specific. Because administrators cannot know the mobile device platform type when remotely deploying the mobile device client that synchronizes with a Configuration Manager 2007 computer, DMCommonInstaller.ini must be used. DMCommonInstaller.ini allows the mobile device client to be installed on any supported mobile device platforms that synchronize with a Configuration Manager 2007 computer client.

Sample DMCommonInstaller.ini and ClientSetting.ini files are installed on <InstallationFolder> \ DeviceClientDeployment \ ClientTransfer on Configuration Manager 2007 site servers.

For more information about creating mobile device client deployment packages, see How to Install or Upgrade the Mobile Device Management Client.

Note
The sample .ini file cannot be used without being edited. The file must be modified for your environment.

In This Section

How to Edit the DMCommonInstaller.ini File for Mobile Device Management

Provides the steps to configure the DMCommonInstaller.ini file. The DMCommonInstaller.ini file is used for installing the mobile device client on mobile devices that dock with Configuration Manager 2007 client computers or for over-the-air upgrades.

How to Edit the ClientSettings.ini File for Mobile Device Management

Provides the steps to configure the ClientSettings.ini file. The ClientSettings.ini file is used to manually install the Configuration Manager 2007 mobile device client or to upgrade mobile devices over the air.

See Also

Concepts

How to Install or Upgrade the Mobile Device Management Client
Supported Mobile Devices
Installation files for the Mobile Device Client


How to Edit the DMCommonInstaller.ini File for Mobile Device Management

The DMCommonInstaller.ini file is used during installation of the Microsoft System Center Configuration Manager 2007 mobile device client via an ActiveSync or Mobile Device Center connected Configuration Manager 2007 managed computer. One DMCommoninstaller.ini file contains settings necessary to deploy the mobile device client to all supported platforms. The DMCommonInstaller.ini file has separate sections for each of the following supported platforms:

  • Windows Mobile Smartphone 5.0
  • Windows Mobile Smartphone 2003
  • Windows Mobile Pocket PC 5.0
  • Windows Pocket PC 2003

Windows Mobile 6 platforms use Windows Mobile 5 mobile device client settings. Windows Mobile 6 clients are installed with the following values:

Operating System | Mobile Device Client Type
Windows Mobile 6 Standard | Windows Mobile Smartphone 5.0
Windows Mobile 6 Professional | Windows Mobile Pocket PC 5.0
Windows Mobile 6 Classic | Windows Mobile Pocket PC 5.0

Procedure

To edit the DMCommonInstaller.ini file, do the following:

To edit the DMCommonInstaller.ini file

  1. Navigate to the computer-based mobile device client deployment folder and open the copied DMCommonInstaller.ini file using an ANSI text editor such as notepad.exe. For more information about the mobile device-based mobile device client deployment folder, see How to Create a Mobile Device-Based Mobile Device Client Deployment Folder.

  2. Edit the file for your environment. The DMCommonInstaller.ini file comments include guidance on specific configuration options. Be sure to configure the section or sections specific to the mobile devices being managed by Configuration Manager 2007. For more information about the DMCommonInstaller.ini file values, see Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini.

  3. Save and close the file.
Note
Do not delete any values from the DMCommonInstaller.ini, even if the default value is used.

Note
DMServerName must be configured with the name of the device management point that will manage the mobile device. DMServerName can be specified as a FQDN or NetBIOS server name depending upon the requirements of the environment.

See Also

Concepts

Deploying Certificates to Mobile Device Clients
How to Install or Upgrade the Mobile Device Management Client
About Native Mode Certificates for Mobile Device Clients

Other Resources

Deploying the PKI Certificates Required for Native Mode


How to Edit the ClientSettings.ini File for Mobile Device Management

The ClientSettings.ini file is distributed to mobile devices when manually installing the Microsoft System Center Configuration Manager 2007 client on a mobile device or when distributing configuration information over the air to a Configuration Manager 2007 managed device. The installation of the mobile device client is dependent on proper configuration of the ClientSettings.ini file. The ClientSettings.ini file is platform specific.

If distributing an upgrade package to a single mobile device platform, create a unique ClientSettings.ini file for that platform in your environment. A sample ClientSettings.ini file is located in <ConfigMgrInstallationPath> \ DeviceClientDeployment \ ClientTransfer on Configuration Manager 2007 servers by default.

Unique ClientSettings.ini files are required for each of the following platforms:

  • Windows Mobile Smartphone 5.0
  • Windows Mobile Smartphone 2003
  • Windows Mobile Pocket PC 5.0
  • Windows Pocket PC 2003
  • Windows CE 5 for ARM
  • Windows CE 5 for x86
  • Windows CE 4.2 for ARM

For more information about the .ini file values, see Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini.

Windows Mobile 6 operating systems use Windows Mobile 5 mobile device client settings. Windows Mobile 6 clients are installed with the following values:

Operating System | Mobile Device Client Type
Windows Mobile 6 Standard | Windows Mobile Smartphone 5.0
Windows Mobile 6 Professional | Windows Mobile Pocket PC 5.0
Windows Mobile 6 Classic | Windows Mobile Pocket PC 5.0

Procedure

To edit the ClientSettings.ini file, do the following:

To edit the ClientSettings.ini file

  1. Navigate to the mobile device-based mobile device client deployment folder and open the copied ClientSettings.ini file using an ANSI text editor such as notepad.exe. For more information about the mobile device-based mobile device client deployment folder, see How to Create a Mobile Device-Based Mobile Device Client Deployment Folder.

  2. Edit the file for your environment. The ClientSettings.ini file comments include guidance on specific configuration options. For more information about the ClientSettings.ini file values, see Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini.

  3. Save and close the file.
Note
DMServerName must be configured with the name of the device management point that will manage the device. DMServerName can be specified as a FQDN or NetBIOS server name depending upon the requirements of the environment.

See Also

Concepts

About Native Mode Certificates for Mobile Device Clients
Deploying Certificates to Mobile Device Clients
How to Install or Upgrade the Mobile Device Management Client

Other Resources

Deploying the PKI Certificates Required for Native Mode


How to Install or Upgrade the Mobile Device Management Client

Before a mobile device can be managed by Microsoft System Center Configuration Manager 2007, the mobile device client must be installed on the mobile device. The mobile device client can be deployed using one of the following methods:

Distribute a Configuration Manager 2007 package to an ActiveSync-connected or a Mobile Device Manager-connected client computer. For more information about mobile device synchronization, see the Device Synchronization web page (http://go.microsoft.com/fwlink/?LinkId=86558).

  • Manually install via an ActiveSync-connected or a Mobile Device Center-connected client computer.
  • Manually transfer and run installation files on the mobile device using a memory card or transferring files from a shared directory
  • Upgrade an already managed mobile device over-the-air

The deployment process is also used to install, upgrade and uninstall the policy-aware password program for Pocket PC 2003 mobile devices.

Prerequisites

Installation of the Configuration Mangier 2007 mobile device client on mobile devices requires the following:

  • A properly configured Mobile Device Client Agent. For more information, see How to Configure the Mobile Device Client Agent.
  • A mobile device client deployment folder containing all necessary client installation files. For more information, see How to Create a Folder for Mobile Device Client Deployment.
  • A DMCommonInstaller.ini file or ClientSettings.ini file properly configured for your environment. For more information, see How to Edit the Mobile Device Client Configuration .ini File.

In addition, using Configuration Manager 2007 software distribution to install the device management client requires the following:

  • One or more management points enabled for mobile device management. For more information, see How to Enable a Mobile Device Management Point.
  • One or more distribution points enabled for mobile device management. For more information, see How to Enable Distribution Points to Support Mobile Devices.
  • To target collections of Configuration Manager 2007 managed computers that synchronize with mobile devices the hardware inventory of those computers must be extended. For more information, see How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management.

Certificate Enrollment

If your environment is configured for native mode or server authentication mode, certificate enrollment will be required. Certificate enrollment allows the mobile device user to use a certification authority (CA) to enroll a user authentication certificate. This certificate will be used for SSL authentication when the mobile device communicates with Configuration Manager 2007 servers and for registration in native mode. In order to be issued a certificate the user will need to authenticate to the CA one time during the client installation process. This may require a corporation network connection as most certification authorities are not exposed to the Internet. Enforcing certificate enrollment is configured in either ClientSettings.ini or DMCommonInstaller.ini using the CertEnrollAction=Enroll setting. For more information, see How to Edit the Mobile Device Client Configuration .ini File. The enrollment process can use the enrollment software included with Configuration Manager 2007 or enrollment software produced by the enterprise.

The Mobile Device Client Install and Upgrade Processes

Once the files necessary are on the mobile device, the upgrade or installation process calls the DMInstaller_[platform].exe program. In order to be allowed to run on the device, DMInstaller_[platform].exe is signed with an unprivileged version of the Mobile2Market certificate.

Note
Signing does not apply to Windows Mobile Pocket PC 2003 or Windows CE devices.

The Mobile2Market unprivileged certificate will be trusted by most devices but will not have elevated permissions on the device. DMInstaller_[platform].exe then attempts to install the Microsoft Authenticode code-signing certificate in the privileged execution store and software publishing certificates (SPC) store of the mobile device. If the installation fails and the device is connected via an already managed Configuration Manager 2007 client, a status message will also be sent describing the failure. DMInstaller_[platform].exe will exit the installation process without calling the client setup files. An error log message will also be left on the device in the DMInstaller.log which reads "Access Denied (0x8007005)."

If the mobile operator or mobile device vendor has not restricted privileges on the mobile device and the Mobile2Market unprivileged certificate is trusted by the mobile device then the mobile device is assumed to be unlocked and available to be managed. The Microsoft Authenticode certificate will be installed with elevated privileges. DMInstaller_[platform].exe then calls DMClientSetup_[platform].exe which installs the mobile device management client on the mobile device.

The DMClientSetup.exe then exits and mobile device client installation is complete. For more information about how to verify mobile device installation, see How to Verify Mobile Device Client Installation or Upgrade.

Installing, Upgrading and Uninstalling the Mobile Device Client

The mobile device client setup program (DMClientSetup_[platform].exe) is used to install, update and uninstall the mobile device client on the mobile device. The client installation action is configured in either DMCommonInstaller.ini or ClientSettings.ini using the ClientInstallAction setting. The ClientInstallAction accepts three values:

  • None - Reconfigure the client settings.
  • Install - Installs the mobile device management client or upgrades the device management client if the mobile device client is older than the client deployed with the client installation package
  • Uninstall - Remove the device management client

Mobile device management settings will be set depending upon the state of the mobile device client:

Device state at connection time | Client deployment action
No client | Install deployed client
Older client than deployed client | Upgrade to deployed client
Same client as staged client | Reconfigure client settings
Newer client than staged client | No action
Note
Any Configuration Manager 2007 client settings on the mobile device that do not conform to the new client configuration will be overwritten by the newly installed settings. This includes any settings the user may have changed on the device

Repairing the Mobile Device Client

To repair a damaged mobile device client, uninstall the damaged mobile device client and then reinstall the mobile device client on the mobile device. For more information on uninstalling the mobile device client, see How to Remove the Mobile Device Client.

Log Files for Mobile Device Client Installation

As client installation proceeds on the mobile device, log files are generated on the device. The log files can be used to confirm that the installation was completed. After successful client installation, the following log files can be found on the mobile device:

  • DMInstaller[date:time].log
  • DMClientSetup[date:time].log
  • DMSvc[date:time].log
  • DMCertEnroll[date:time].log will only be present if the mobile device client installation enrolled certificates.

For more information, see How to Configure Logging for Windows Mobile and Windows CE Devices.

Reports for Client Installation

The following reports can be used to verify the progress or success of mobile device client installation:

  • Software Distribution Status Report for DM client install program
  • Configuration Manager client computers reporting ActiveSync-connected devices Device Client
  • Device Client Agent Deployment Status Details
  • Device Client Agent Deployment Failure Report
  • Device Client Agent Deployment Success Report
  • Device Client Agent Health Summary
  • Device Clients in Healthy condition
  • Device Clients in unhealthy condition due to certificate issues
  • Device Clients in unhealthy condition due to communication issues
  • Device Clients in unhealthy condition due to local client issues

In This Section

How to Manually Transfer and Install the Mobile Device Management Client

Provides the steps to create a client deployment package and manually install it on a mobile device.

How to Install the Mobile Device Management Client Using Software Distribution to a Desktop Computer Running ActiveSync or Mobile Device Center

Provides the steps to create a client transfer package and then distribute and install it via a Configuration Manager 2007 managed computer that synchronizes with a mobile device.

How to Upgrade the Mobile Device Management Client Over the Air

Provides the steps to create a client transfer package and then distribute and install it to Configuration Manager 2007 managed mobile devices.

How to Manually Install the Mobile Device Client via ActiveSync or Mobile Device Center Synchronization

Provides the steps to create a client deployment package and then install it via a computer that synchronizes with mobile devices.

See Also

Concepts

Checklist for Mobile Device Management
How to Configure Logging for Windows Mobile and Windows CE Devices
How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management
How to Verify Mobile Device Client Installation or Upgrade

Other Resources

Configuring Mobile Device Management
How to Create a Folder for Mobile Device Client Deployment


How to Install the Mobile Device Management Client Using Software Distribution to a Desktop Computer Running ActiveSync or Mobile Device Center

Desktop computers and laptops that are managed by Microsoft System Center Configuration Manager 2007 and synchronize with mobile devices via Mobile Device Center on the Windows Vista operating system or ActiveSync (Microsoft Windows XP and earlier) can install the Microsoft System Center Configuration Manager 2007 mobile device client on connected mobile devices. For more information about mobile device synchronization, see the mobile device synchronization web page (http://go.microsoft.com/fwlink/?LinkId=81724).

To use Configuration Manager 2007 software distribution to install the mobile device client, you must extend the hardware inventory on Configuration Manager 2007 client computer and add a collection for computers that connect to mobile devices. For more information, see How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management.

Once Configuration Manager can inventory computer clients that synchronize with mobile devices, an advertisement can target those computers with installation files. When the mobile device next synchronizes with the desktop computer, the mobile device management client is installed on the mobile device.

After the package has been distributed to the client computer, the mobile device management client will be installed the next time the mobile device is docked to synchronize. For more information, see How to Verify Mobile Device Client Installation or Upgrade.

A status message is generated when the client transfer program attempts to install, uninstall, upgrade, or verify the settings of the mobile device client. The status message tells the Configuration Manager 2007 administrator whether or not the operation was successful and includes appropriate failure codes if the operation failed. These status messages can be viewed in the Configuration Manager 2007 Administrator console in System Center Configuration Manager / Site Database / System Status / Package Status.

Prerequisites

Using Configuration Manager software distribution to install the device management client requires the following:

  • A collection of desktop computers running ActiveSync or Windows Mobile Device Center. For more information about collections, see About Collections.
  • A mobile device client deployment folder containing all platform-specific files. For more information, see How to Create a Mobile Device-Based Mobile Device Client Deployment Folder.
  • A properly configured DMCommonInstaller.ini file in the mobile device client deployment folder. For more information, see How to Edit the ClientSettings.ini File for Mobile Device Management.

Procedure

To distribute the mobile device client using software distribution, do the following:

To distribute the mobile device client using software distribution

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click Packages, navigate to New, and then click Package From Definition. The Create Package from Definition Wizard opens.

  3. Select Device Management Client Transfer. Click Next.

  4. Select Always obtain files from a source directory or Create a compressed version of the source, depending upon which is appropriate for your environment. Click Next.

  5. Specify whether the source directory is located by Network Path (UNC name) or Local drive on site server.

  6. Click Browse and navigate to the mobile device client deployment folder. Click OK. Click Next. Click Finish to create the client transfer package.

  7. Assign one or more Configuration Manager 2007 distribution points for the mobile device management client transfer package.

  8. Create a Configuration Manager 2007 advertisement for the mobile device management client transfer package.

Note
It is strongly recommended that the mobile device client transfer and hardware extension advertisements for the Configuration Manager 2007 computers clients be set to recur. This ensures that the most current version of the device management software or any changes to device configuration are run every time the mobile device synchronizes.

See Also

Tasks

How to Enable Distribution Points to Support Mobile Devices

Concepts

Deploying Certificates to Mobile Device Clients
How to Create a Computer-Based Mobile Device Client Deployment Folder
How to Edit the DMCommonInstaller.ini File for Mobile Device Management
How to Enable a Mobile Device Management Point

Other Resources

How to Create a Folder for Mobile Device Client Deployment


How to Manually Transfer and Install the Mobile Device Management Client

Mobile devices that support removable digital memory cards or other means to transfer data from a desktop computer can manually transfer the Microsoft System Center Configuration Manager 2007 mobile device client deployment folder. Once the folder is transferred to the mobile device, the mobile device client installation program (DMInstaller_[platform type].exe) can be run locally.

Prerequisites

Using desktop computer synchronization to install the mobile device management client requires the following:

  • A mobile device deployment folder containing platform-specific files. For more information, see How to Create a Mobile Device-Based Mobile Device Client Deployment Folder.
  • A properly configured ClientSettings.ini file. For more information, see How to Edit the ClientSettings.ini File for Mobile Device Management.

Procedure

To manually transfer and install the mobile device client, perform the following steps:

To manually transfer and install the mobile device client

  1. Transfer the mobile device-based mobile device client deployment folder with its contents to the mobile device. For more information about the mobile device client deployment folder, see How to Create a Mobile Device-Based Mobile Device Client Deployment Folder.

  2. On the mobile device, navigate to the transferred directory and run the DMInstaller_[platform type].exe.

  3. Verify that the mobile device client has been installed on the mobile device. For more information about verifying mobile device client installation, see How to Verify Mobile Device Client Installation or Upgrade.

See Also

Concepts

Deploying Certificates to Mobile Device Clients
How to Install or Upgrade the Mobile Device Management Client
How to Edit the DMCommonInstaller.ini File for Mobile Device Management
Installation files for the Mobile Device Client
Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini

Other Resources

Deploying the PKI Certificates Required for Native Mode


How to Upgrade the Mobile Device Management Client Over the Air

To upgrade a managed mobile device client over the air Microsoft System Center Configuration Manager 2007 can send an upgrade package using software distribution to mobile devices. A platform-specific mobile device client deployment folder is required for each mobile device platform in the environment.

Prerequisites

Using Configuration Manager software distribution to upgrade the device management client requires the following:

  • A mobile device deployment folder containing platform specific files. For more information, see How to Create a Mobile Device-Based Mobile Device Client Deployment Folder.
  • A properly configured ClientSettings.ini file. For more information, see How to Edit the ClientSettings.ini File for Mobile Device Management.

Procedure

To distribute a mobile device client upgrade to mobile devices over the air requires the following steps:

To distribute a mobile device client upgrade to mobile devices over the air

  1. In the Configuration Manager console, navigate System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click Packages, navigate Distribute and then click Software to Devices. The Distribute Software to Devices Wizard opens. Click Next.

  3. Select Create a new package and program. Click Next.

  4. Fill out the appropriate package fields (Name, Version, etc.). Click Next.

  5. Specify Always obtain files from a source directory or Create a compressed version of the source. The appropriate setting will depend upon your environment. For more information, see Source File Page.

  6. Specify whether the source directory is located by Network Path (UNC name) or Local drive on site server.

  7. Click Browse and navigate to the new folder created in step 1 above. Click OK. Click Next.

  8. Specify the distribution point or points for the new package. Click Next.

  9. Specify the Name, Comments, Download folder for the new program and where to run the command line.

  10. To specify the Command line of the program, click Browse. The Open file dialog box opens.

  11. For Files of type, select Executable (*.exe). Select DMInstaller_[platform type].exe. Click Open. Click Next.

  12. Specify the device network connection type that must be present for the program to be run. For more information, see Program Properties Page. Click Next.

  13. Using the Distribute Software to Devices Wizard, specify the properties of the advertisement to distribute the newly created package and program. Complete the wizard and then click Close.

The Configuration Manager 2007 mobile device client is advertised, distributed and upgraded on the mobile device. For more information about verifying mobile device client deployment, see How to Verify Mobile Device Client Installation or Upgrade.
Note
The administrator can re-advertise the advertisement for the upgrade to mobile devices.

Note
The user can manually rerun the advertisement from the mobile device.

The Configuration Manager 2007 mobile device client is advertised, distributed and upgraded on the mobile device. For more information about verifying mobile device client deployment, see How to Verify Mobile Device Client Installation or Upgrade.

Installation Files from Over the Air Upgrade

During an over the air upgrade the following files will be copied to the download folder of the mobile device:

  • ClientSettings.ini
  • Certificate files if any
  • DmClientSetup.exe
  • DmInstaller.exe
  • Enroll.exe

The combined total file size is approximately .6 MB. If the mobile device client installation process is not successfully completed a cabinet file (.cab) may also remain on the mobile device.

See Also

Concepts

How to Install or Upgrade the Mobile Device Management Client
How to Edit the DMCommonInstaller.ini File for Mobile Device Management
Deploying Certificates to Mobile Device Clients
Distribute Software to Devices Wizard

Other Resources

Deploying the PKI Certificates Required for Native Mode


How to Manually Install the Mobile Device Client via ActiveSync or Mobile Device Center Synchronization

A desktop computer or laptop that synchronizes with mobile devices can install the Microsoft System Center Configuration Manager 2007 mobile device client during synchronization. Once the mobile device client installation files are distributed to the computer or laptop, the mobile device client can be installed across the Mobile Device Center on the Windows Vista operating system or ActiveSync (Microsoft Windows XP and earlier) connection. For more information about Mobile Device Center (Windows Vista) or ActiveSync (Windows XP and earlier), see the Device Synchronization web page (http://go.microsoft.com/fwlink/?LinkId=81724).

Procedure

To transfer the client installation package and install via a desktop computer, perform the following steps:

To transfer the client installation package and install via a desktop computer

  1. Transfer the mobile device client deployment folder with its contents to a computer that synchronizes with a mobile device.

  2. Connect the mobile device to the computer, and verify that they are synchronized.

  3. Navigate to the mobile device client deployment folder on the computer, and run DMClientXfer.exe. The Configuration Manager 2007 mobile device client is installed on the mobile device.

  4. Verify the mobile device client is installed on the mobile device. For more information, see How to Verify Mobile Device Client Installation or Upgrade. Deployment results are written to DMClientXfer.log in the \temp\smsdm in the user folder.

See Also

Concepts

Deploying Certificates to Mobile Device Clients
How to Edit the ClientSettings.ini File for Mobile Device Management
How to Install or Upgrade the Mobile Device Management Client
Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini

Other Resources

Deploying the PKI Certificates Required for Native Mode


How to Verify Mobile Device Client Installation or Upgrade

After installing or upgrading the mobile device client on mobile devices, the administrator should verify that the installation or upgrade process completed successfully. Client installation or upgrade can be verified in the following ways:

  • Reviewing collections
  • Using the mobile device
  • Reviewing mobile device client installation logs

Verification by All Mobile Devices Collection

After the mobile device client is successfully installed, it will poll the device management point. After the mobile device has polled the device management point, it will appear in the collections of the site database.

Procedure

Verify mobile device client installation using All Devices Clients collection using the following steps:

To verify mobile device client installation using All Devices Clients collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Select All Windows Mobile Devices. The results pane displays the Windows mobile devices collected by the device management point.
Note
New collections can be created to verify specific criteria, such as mobile device client version. For more information, see How to Create a Collection

Verification on the Mobile Device

After the mobile device client is successfully installed, the Device Management icon will appear on the mobile device. The location of the Device Management icon depends upon the platform and configuration of the mobile device.

Procedure for Windows Smartphone Mobile Devices

Verify mobile device client installation on Windows Smartphones and Windows Mobile 6 Standard mobile devices using the following steps:

To verify mobile device client installation on Windows Smartphone and Windows Mobile 6 Standard mobile devices

  1. On the mobile device, click Start. Search the list of programs on the mobile device to find the Device Management program. If Device Management is not visible in the list of programs, click More.

  2. Open Device Management. Advertised Programs are displayed.

  3. Click Info. Connection Information is displayed.

  4. Verify that the Connection Information is appropriate for your mobile device client.

    • For all mobile device client deployments, verify that Last Refreshed information displays the date and time of a recent poll.
    • For updates, verify that Client Version displays the updated client.
    • For upgraded security mode, verify that Security Mode displays the new security mode.

Procedure for Windows Pocket PC Mobile Devices

Verify mobile device client installation on Windows Pocket PC mobile devices using the following steps:

To verify mobile device client installation on Windows Pocket PC and Windows Mobile 6 Professional and Classic mobile devices

  1. On the mobile device, click Start and navigate Settings. The settings pane opens.

  2. In the settings pane, click the System tab.

  3. Open Device Management. Advertised Programs are displayed.

  4. Click Info. Connection Information is displayed.

  5. Verify that the Connection Information is appropriate for your mobile device client:

    • For all mobile device client deployments, verify that Last Refreshed information displays the date and time of a recent poll.
    • For updates, verify that Client Version displays the updated client.
    • For upgraded security mode, verify that Security Mode displays the new security mode.

Log Files for Mobile Device Client Installation

As mobile device client installation progresses on the mobile device, log files are generated on the mobile device. The log files can be used to confirm that the installation was completed. After successfully completing client installation, the following log files can be found on the mobile device:

  • DMInstaller[date:time].log
  • DMClientSetup[date:time].log
  • DMSvc[date:time].log

If mobile device client installation required certificates enrollment, then DMCertEnroll[date:time].log will also be present. For more information, including locations of log files on mobile devices, see How to Configure Logging for Windows Mobile and Windows CE Devices.

See Also

Concepts

How to Configure Logging for Windows Mobile and Windows CE Devices
How to Install or Upgrade the Mobile Device Management Client
How to Use Reports for Mobile Devices

Other Resources

Troubleshooting Mobile Device Management


How to Configure Logging for Windows Mobile and Windows CE Devices

Microsoft System Center Configuration Manager 2007 logging for mobile devices allows administrators to evaluate and troubleshoot mobile device management activities on the mobile device and on the server. The logging capabilities for mobile devices have been significantly enhanced in Configuration Manager 2007. Configuration Manager 2007 now includes the ability to read device client logs using SMSTrace.exe and the ability to configure the level of detail of logging on mobile devices using the logging framework. The mobile device client logging framework is configured via registry settings on the mobile device. There are three levels of scope where settings can be configured:

  • Component
  • Global
  • Default

Settings Scope

Each process that can be logged specifies a component name. If logging settings are specified at the component scope, that scope is used if the component scope exists. If no logging settings exist at the component scope, the logging settings declared at the global scope are used. If no settings exist at the global scope, the default settings defined in the logging framework are used.

Logging settings at the global scope are stored under the following registry key: HKLM\Comm\ApplicationDownload\Logging.

Logging settings at the component scope are stored under a subkey of the global key. The name of the subkey is the name of the component, as in the following example: HKLM\Comm\ApplicationDownload\Logging\<ComponentName>. For example, if the process calls "Component1" as the component name, the process of that component can be controlled via settings under the following key: HKLM\Comm\ApplicationDownload\Logging\Component1.

Minimum and Maximum Values

Some logging settings have minimum and maximum values defined in the framework. This ensures that a user cannot set a value in the registry that would have detrimental effects on the mobile device or that will be too low to collect meaningful information.

If a registry setting value is below the minimum allowed, the minimum value is used. If a registry setting value is above the maximum allowed, the maximum value is used.

Settings

The following table lists the available logging settings. These settings can exist on both global and component registry keys. The Setting Name is the name of the registry value under the key.

Setting Name | Type | Min. Value | Max. Value | Default Value | Description
LogDirectory | REG_SZ | N/A | N/A | "\Temp\DMClientLogs" On Windows Mobile Smartphone 2003 this is redirected to \Storage\temp\DMClientLogs | Directory where log files are created.
MaxLogSizeBytes | DWORD | 1024 (1K) | 1048576 (1 Meg) | 32K | Maximum size of log files, in bytes, for the component before the file rolls over.
MaxLogCount | DWORD | 2 | 24 | 5 | Maximum number of log files for the component. If the number of files exceeds this limit, the oldest files will be deleted.
LogLevel | DWORD | 0 (VERBOSE) | 3 (ERROR) | 3 (ERROR) | Specifies the minimum type of a log statement that will be written to the log. If a log statement falls below this setting, the log statement will be ignored. Specifying anything higher than 3 (ERROR) will prevent all statements from being written to the log file. (This essentially disables logging.)

The logging framework does not detect changes to settings on the fly. Settings are read when the client service starts. For the updated settings to be applied, the device management service must be restarted after changes are made. This can be done in the Device Management Control Panel.

Log Files for Mobile Device Client Installation

As mobile device client installation progresses on the mobile device, log files are generated on the mobile device. The log files can be used to confirm that the installation was completed. After a successful client installation, the following log files can be found on the mobile device:

  • DMInstaller[date:time].log
  • DMClientSetup[date:time].log
  • DMSvc[date:time].log

Naming

The logging framework manages a set of log files for each component. When the logging process is called, it either creates a new log file or opens an existing one for the component. The log file is written to until it rolls over as described below. Every log file name has the following format:

<ComponentName>-<DateStamp>-<TimeStamp>.log

  • <ComponentName> is the name of the component passed into the InitLogger function.
  • <DateStamp> is the date when the log file was created, in YYYYMMHH format.
  • <TimeStamp> is the UTC time when the log file was created, in hhmmss format.

For example, if the component name is "Component1" and the log file was created on June 13, 2006 at 1:05pm UTC, the log file name would be Component1-20060613-130500.log.

Rollover

When a log file exceeds the MaxLogSizeBytes setting, it is "rolled over," meaning the log file is closed and a new one is created. When the total number of log files for the component (currently opened plus rolled-over log files) exceeds the MaxLogCount setting, the oldest file is deleted.

Format

The logging framework writes log entries in a format that is readable by the SMS Trace (smstrace.exe) log viewer. Each entry has the following items:

  • Log text Log text emitted by logging macros (VERBOSE, INFO, WARN, ERROR)
  • Time stamp (Local Time)
  • Date stamp (Local Time)
  • Log Type–-0 for Verbose, 1 for Info, 2 for Warn, 3 for Error
  • Thread
  • Source file

Enabling Logging Levels

Use the following guidelines to determine which logging level should be used:

  • Verbose: Use Verbose log statements only for statements that aid support personnel and Microsoft Support Services in troubleshooting problems on the mobile device. Verbose logging provides detailed information. Examples of data logged under Verbose logging include: tracing function entry/exit, parameters passed to functions, and so on. VERBOSE log statements are written to the log file if the LogLevel is 0.
Note
Use verbose logging with discretion. If used with incorrect settings, it can overload the mobile device with log files.

  • Info: Use Info log statements for statements that notify the end user or support personnel of non-error events related to functional aspects of the mobile device. Examples include the beginning and ending of functional behavior--for example, "Downloading Package" or "Package Download Succeeded". INFO log statements are written to the log file if the LogLevel setting is 1 or lower.
  • Warn: Use Warn log statements to notify the user of an error condition that is handled and does not indicate a failure in the function of the mobile device but that might be helpful for further investigation. WARN log statements are written to file only if the LogLevel setting is 2 or lower.
  • Error: Use Error log statements to notify the user of an error condition that indicates a failure in a functional aspect of the product--for example, "Package Download Failed" or "Package Hash Verification Failed." ERROR log statements are always written to the log file.

Verbose logging can be enabled using the DMCommonInstaller.ini or ClientSettins.ini file during setup or upgrade by setting the value EnableVerboseLogging=True. This enables verbose logging on any client installed or updated using this DMCommonInstaller.ini or ClientSettings.ini file. Verbose logging or any logging level can be enabled on specific mobile devices managed by Microsoft System Center Configuration Manager 2007 by using the Registry Configuration Item to deploy the necessary registry keys and values from the table shown earlier. Log settings can also be modified using a configuration item registry setting distributed with a configuration package. Changes to logging settings will not take effect until the mobile device client is restarted. This can be done by performing a soft reset of the mobile device.

Note
Using the Verbose logging level is not recommended, except at the direction of Microsoft support personnel. The data provided by verbose logging is of little value to enterprise support personnel.

Example Logging Configuration Documents

Because logging settings are stored in the registry, the Registry Configuration Service Provider (CSP) can be used to query or set logging settings on the mobile device.

Querying Logging Settings

The following CSP example shows how to query the global logging settings on a device:

Copy Code
<wap-provisioningdoc>
   <characteristic type="Registry">
      <characteristic type="HKLM\Comm\ApplicationDownload\Logging">
         <parm-query name="LogDirectory"/>
         <parm-query name="MaxLogSizeBytes"/>
         <parm-query name="MaxLogCount"/>
         <parm-query name="LogLevel"/>
      </characteristic>
   </characteristic>
</wap-provisioningdoc>

Setting Logging Settings

The following CSP example shows how to set global logging settings on the device:

Copy Code
<wap-provisioningdoc>
   <characteristic type="Registry">
      <characteristic type="HKLM\Comm\ApplicationDownload\Logging">
         <parm name="LogDirectory" value="\Temp\Logs" datatype="string"/>
         <parm name="MaxLogSizeBytes" value="7000" datatype="integer"/>
         <parm name="MaxLogCount" value="7" datatype="integer"/>
         <parm name="LogLevel" value="0" datatype="integer"/>
      </characteristic>
   </characteristic>
</wap-provisioningdoc>

Log file locations

Mobile device client log files are found in the following locations:

  • Mobile Device Center or ActiveSync Configuration Manager 2007 computer clients
  • Windows CE and Windows Mobile Pocket PC devices
  • Windows Mobile 5 Smartphone and Windows Mobile 6 Standard devices
  • Windows Mobile 2003 Smartphone devices

    Location Path Log Files

    On an ActiveSync or Mobile Device Center Configuration Manager 2007 managed desktop

    %temp%\SmsDm in the user temp folder

    DmClientXfer.log

    DmCommonInstaller.log

    DmInvExtension.log

    On all Windows CE, Windows Mobile Pocket PC, and Windows Mobile 6 Professional devices

    \temp\DmClientLogs

    DmCertEnroll...log

    DmClientSetup…log

    DmInstaller…log

    DmSvc…log

    DMCertResp.htm (in \temp)

    On Windows Mobile Smartphone 5 and Windows Mobile 6 Standard devices

    \ Temp\DmClientLogs in the mobile device storage folder or \temp\DMClientLogs in the mobile device file system

    DmCertEnroll...log

    DmClientSetup…log

    DmInstaller…log

    DmSvc…log

    DMCertResp.htm

    On Windows Mobile Smartphone 2003 devices

    \Storage\temp\DMClientLogs

    DmCertEnroll...log

    DmClientSetup…log

    DmInstaller…log

    DmSvc…log

    DMCertResp.htm

    On a device management site server with no Configuration Manager 2007 client installed

    <InstallationFolder> \ CCM \ Logs

    DmClientHealth.log

    DmClientRegistration.log

    DmpDatastore.log

    DmpDiscovery.log

    DmpFileCollection.log

    DmpHardware.log

    DmpIsapi.log

    DmpSoftware.log

    DmpStatus.log

    FspIsapi.log

    <InstallationFolder> \Logs

    DmpMSI.log

    DmpSetup.log

    Fspmgr.log

    fspMSI.log

    \%windir%\System32\Logfiles\W3SVC1

    Any IIS logs (named by date and time)

    On site servers with Configuration Manager 2007 client installed

    The Configuration Manager 2007 directory is installed in \%windir%\System32\CCM instead.

    DmClientHealth.log

    DmClientRegistration.log

    DmpDatastore.log

    DmpDiscovery.log

    DmpFileCollection.log

    DmpHardware.log

    DmpIsapi.log

    DmpSoftware.log

    DmpStatus.log

    FspIsapi.log

See Also

Tasks

How to Enable Logging for a Component

Concepts

How to Verify Mobile Device Client Installation or Upgrade

Other Resources

How to Edit the Mobile Device Client Configuration .ini File
Registry Properties


How to Use Queries to Create Windows Mobile Device Collections

You can create new Microsoft System Center Configuration Manager 2007 collections for grouping devices in your organization. Creating collections for devices is similar to creating collections for Configuration Manager 2007 computer clients. The only difference is that if a query rule is used, then it must use Device classes as the source of data instead of Desktop classes. Discovery data is contained in the System class (SMS_R_System), which is the same for both Configuration Manager 2007 client computers and devices. For more information on creating collections, see How to Create a Collection.

Microsoft System Center Configuration Manager 2007 collections for mobile devices allow administrators to distribute advertisements to clearly defined groups of mobile devices. This is particularly useful if an advertisement is only valid for a certain mobile device platform or set of platforms. Configuration Manager 2007 allows administrators to create new customized collections. Creating a new collection requires a query which will return the correct set of Configuration Manager 2007 resources.

Procedure

Create a collection of Windows Mobile 6 Pocket PC Devices using the following steps:

To create a collection of Windows Mobile 6 Pocket PC devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click Collections, and then select New Collection. The New Collection Wizard opens.

  3. Type the Name of the new collection and any comments to display with the new collection. Click Next.

  4. Click the Query Rule icon in the Membership rules box. The Query Rule Properties dialog box opens.

  5. Type the Name of the Query Rule.

  6. Click the Edit Query Statement button. The Query Statement Properties dialog box opens.

  7. Click the Show Query Language button. The Query Language tab opens.

  8. Copy the following query and paste it in the Query Statement pane:

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and OperatingSystemNameandVersion = 'Windows CE 5.2 (PocketPC)'

  1. Click OK, and click Next.
  2. Specify the security rights that users have on this object class or instance. Click Next. The new collection is created.
  3. Click Close to close the New Collection Wizard.

Queries for Mobile Device Platforms

Queries for the following mobile device platform can be substituted for the query in the procedure above:

  • All Windows Mobile 6 devices
  • Windows Mobile 6 Professional devices
  • Windows Mobile 6 Standard devices
  • All Windows Mobile 5 devices
  • Windows CE 5 devices
  • Windows CE 4.2 devices
  • All Windows Mobile Smartphone devices (includes Windows Mobile 6 Standard)
  • All Windows Mobile Pocket PC devices (includes Windows Mobile 6 Professional)

All Windows Mobile 6 Devices

Replace the query in the above procedure with the following query to create a collection of all Windows Mobile 6 devices.

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and ( (OperatingSystemNameandVersion = 'Windows CE 5.2 (PocketPC)') or (OperatingSystemNameandVersion = 'Windows CE 5.2 (SmartPhone)'

Windows Mobile 6 Professional and Classic Devices

Replace the following query with that in the procedure to create a collection of all Windows Mobile 6 Professional devices.

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and OperatingSystemNameandVersion = 'Windows CE 5.2 (PocketPC)'

Windows Mobile 6 Standard Devices

Replace the following query with that in the procedure to create a collection of all Windows Mobile 6 Standard devices.

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and OperatingSystemNameandVersion = 'Windows CE 5.2 (SmartPhone)'

Windows Mobile 5 Device

Replace the following query with that in the procedure to create a collection of all Windows Mobile 5 devices.

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and ( (OperatingSystemNameandVersion = 'Windows CE 5.1 (PocketPC)') or (OperatingSystemNameandVersion = 'Windows CE 5.1 (SmartPhone)'

Windows Mobile 2003 Device

Replace the following query with that in the procedure to create a collection of all Windows Mobile 2003 devices.

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and ( (OperatingSystemNameandVersion like 'Windows CE 4.% (PocketPC)') or (OperatingSystemNameandVersion like 'Windows CE 4.% (SmartPhone)'

Windows CE 5 Devices

Replace the following query with that in the procedure to create a collection of all Windows CE 5 devices.

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and OperatingSystemNameandVersion like 'Windows CE 5.0 %'

Windows CE 4.2 Devices

Replace the following query with that in the procedure to create a collection of all Windows Mobile CE 4.2 devices.

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and OperatingSystemNameandVersion like 'Windows CE 4.2 %'

Any Windows Mobile Smartphone Devices

Replace the following query with that in the procedure to create a collection of all Windows Mobile Smartphone devices (including Windows Mobile 6 Standard).

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and OperatingSystemNameandVersion like '%(SmartPhone)'

Any Windows Mobile Pocket PC Devices

Replace the following query with that in the procedure to create a collection of all Windows Mobile Pocket PC devices (including Windows Mobile 6 Professional).

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System where ResourceType = 5 and ClientType = 3 and OperatingSystemNameandVersion like '%(PocketPC)'


Tasks for Mobile Device Management

Microsoft System Center Configuration Manager 2007 device management supports the following tasks.

In This Section

How to View Mobile Device Client Information

Provides the steps to view hardware inventory, software inventory, and files collected by the mobile device client.

How to Create Configuration Items for Mobile Devices

Provides the steps to create collections of settings to distribute to mobile devices.

How to Create Configuration Packages for Mobile Devices

Provides the steps to create a package which distributes configuration items to mobile devices.

How to Create Programs for Mobile Devices

Provides the steps to create a program to be run when a package is distributed to mobile devices.

How to Deploy Software to Mobile Devices

Provides the steps to deploy software to mobile devices.

How to Create an Advertisement for Mobile Devices

Provides the steps to create an advertisement for mobile devices.

How to Use Reports for Mobile Devices

Provides the steps to view reports for mobile devices.

How to Verify Mobile Device Client Health

Provides the steps to verify the health state of mobile device clients.

How to Use Collections for Mobile Device Clients

Provides the steps to view collections of mobile devices.

How to Use Backup and Recovery for Mobile Device Management

Provides the steps to use backup and recovery for mobile device management.

How to Remove the Mobile Device Client

Provides the steps to remove the mobile device client from mobile devices.

How to Remove Mobile Device Management from the Site

Provides the steps to remove mobile device management from Configuration Manager 2007 site servers.

See Also

Concepts

Checklist for Mobile Device Management
Mobile Device Clients Security Best Practices and Privacy Information

Other Resources

Overview of Mobile Device Management
Troubleshooting Mobile Device Management
Technical Reference for Mobile Device Management


How to View Mobile Device Client Information

Among the core features of Device Management for Configuration Manager is the ability to collect information from mobile device clients. The following information can be viewed using Resource Explorer:

  • Software inventory
  • Hardware inventory
  • File collection

In This Section

How to View Hardware Inventory From Mobile Devices

Provides an overview of the hardware inventory and collected files available by using Resource Explorer.

How to View Software Inventory and Collected Files From Mobile Devices

Provides an overview of the software inventory and collected files available by using Resource Explorer.

See Also

Reference

Mobile Device Client Agent Properties

Concepts

About Resource Explorer


How to View Hardware Inventory From Mobile Devices

Microsoft System Center Configuration Manager 2007 administrators can use Resource Explorer to view hardware inventory information reported by mobile device clients to the device management point. For more information about viewing client inventory information, see. How to View Mobile Device Client Information For more information about Resource Explorer, see About Resource Explorer.

The mobile device client agent can be configured to report the hardware inventory information to the mobile device management point. For more information about configuring the mobile device client agent, see How to Configure the Mobile Device Client Agent.

Hardware Inventory Data

With hardware inventory for mobile device client agents enabled, the following categories of inventory are collected from mobile devices during hardware inventory information:

  • Device Certificate Information (Native Mode Certificates) - Certificates enrolled in the personal store on the mobile device including subject name, expiration date and hash codes.
  • Device Certificates - Additional certificates on the mobile device including issuer, store, and valid dates.
  • Device Computer System - Information about the mobile device processor.
  • Device Display - Information about the mobile device display including resolution and number of colors.
  • Device File System - Information about the mobile device file system including size and used space.
  • Device Memory - Information about the memory on the mobile device memory including free program memory and storage memory.
  • Device Network - Information about the mobile device network configuration including bandwidth, IP address, and MAC address.
  • Device Operating System Information - Information about the mobile device operating system including build and version numbers, platform, and locale ID.
  • Device Owner Information - Information about the mobile device owner including name, telephone number, and e-mail address.
  • Device Phone Identification - The phone IMEI number and phone number.
  • Device Power (battery status) - Information about the power supply for the mobile device including battery and battery percentage.
  • Device User Information - The mobile device user name and user locale ID.
  • System - Information about the mobile device system including the name, Configuration Manager 2007 ID, and system type.

For a complete list of hardware inventory data, see Mobile Device Hardware Inventory Data.

See Also

Reference

Mobile Device Client Agent Properties
Mobile Device Client Agent Properties: Hardware Inventory

Concepts

About Resource Explorer
How to Configure the Mobile Device Client Agent

Other Resources

How to View Mobile Device Client Information


How to View Software Inventory and Collected Files From Mobile Devices

Administrators can use Resource Explorer to view software inventory information reported by mobile device clients to the device management point. For more information about viewing client inventory information, see How to View Mobile Device Client Information. For more information about Resource Explorer, see About Resource Explorer.

The mobile device client agent can be configured to report the software inventory information and upload collected files to the mobile device management point. For more information about configuring the mobile device client agent, see How to Configure the Mobile Device Client Agent.

Software Inventory Data

Software inventory data includes the following fields:

  • File Name
  • File Description
  • File Version
  • File Size (Bytes)
  • File Path
  • Modified Date

Collected Files Data

Collected files data includes the following fields:

  • Collection Date
  • File Name
  • File Path
  • File Size (Bytes)
  • Modified Date

See Also

Reference

Mobile Device Client Agent Properties
Mobile Device Client Agent Properties: File Collection
Mobile Device Client Agent Properties: Software Inventory Tab

Concepts

About Resource Explorer
How to Configure the Mobile Device Client Agent

Other Resources

How to View Mobile Device Client Information


How to Create Configuration Items for Mobile Devices

Configuration items in Microsoft System Center Configuration Manager 2007 contain settings to be applied to the mobile device. These configuration items can be included in configuration packages and then advertised to mobile devices. When the built-in program in the configuration package is run, the configuration item settings are applied to the mobile device. For more information on configuration packages, see About Configuration Packages for Mobile Devices.

The following configuration items are available in Configuration Manager 2007:

Browser Favorite Properties

Certificate Installation Properties

Dial-up Network Properties

Exchange ActiveSync (WM03 mode) Properties

Exchange ActiveSync (WM05 mode) Properties

GPRS Network Properties

Internet E-mail Properties

Network Proxy Properties

Password Policy for MSFP Properties

Password Policy for Pocket PC 2003 Properties

Registry Properties

Security Policies Properties

VPN Properties

WiFi Settings Properties

Procedure

To create a configuration item for mobile devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Mobile Device Management.

  2. Right-click Configuration Items and select New Configuration Item. The New Configuration Item Wizard opens.

  3. Complete the New Configuration Item Wizard to create a new configuration item for mobile devices. For more information on the New Configuration Item Wizard, see New Mobile Device Configuration Item Wizard.

See Also

Concepts

About Configuration Items for Mobile Devices
About Configuration Packages for Mobile Devices
How to Create Configuration Packages for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management


How to Create Configuration Packages for Mobile Devices

Configuration packages in Microsoft System Center Configuration Manager 2007 distribute configuration items to mobile device clients in the same way packages distribute content to computer clients. Like packages for client computers, configuration packages use programs, distribution points, and advertisements to collections to distribute their content. For more information about packages, see About Packages.

Note
Mobile devices do not honor configuration package access accounts. Mobile devices do not have domain accounts and therefore cannot be targeted by access accounts.

Configuration items contain settings to be applied to the mobile device and are distributed using Mobile Device Management configuration packages. For more information on configuration items, see About Configuration Items for Mobile Devices.

Procedure

To create a configuration package for mobile devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Mobile Device Management.

  2. Right-click Configuration Package and select New Configuration Package. The Create Configuration Package Wizard opens.

  3. Complete the Create Configuration Package Wizard to create a new configuration package for mobile devices. For more information on the Create Configuration Package Wizard, see Create Configuration Package Wizard for Mobile Devices.
Note
Configuration packages for mobile devices are created with a predefined program. Programs do not need to be created for configuration packages.

See Also

Concepts

About Configuration Items for Mobile Devices
How to Create Configuration Packages for Mobile Devices

Other Resources

Create Configuration Package Wizard for Mobile Devices


How to Create Programs for Mobile Devices

Programs for mobile devices in Microsoft System Center Configuration Manager 2007 are commands distributed with a Configuration Manager 2007 package that tell a mobile device client what should occur when the package is received. Programs for mobile devices are much the same as programs for computer clients. For more information, see About Programs.

Procedure

To create a program for mobile devices, complete the following steps:

To create a program for mobile devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Package Name.

  2. In the results pane, right-click the Programs, select New, and then click Program For Device. The New Program For Device Wizard opens.

  3. Complete the steps in New Program For Device Wizard to create a new program for mobile devices. For more information, see New Program for Device Wizard.
Note
Configuration packages for mobile devices are created with a predefined program. Programs do not need to be created for configuration packages.

Note
Programs for desktop computers cannot run programs on mobile devices.

See Also

Concepts

About Programs
New Program for Device Wizard


How to Deploy Software to Mobile Devices

The Microsoft System Center Configuration Manager 2007 Mobile Device Management feature uses packages to distribute software to mobile device clients. Software can be deployed to mobile devices managed by Configuration Manager in much the same way software is distributed to computer clients.

Important
Although Configuration Manager enables you to easily install software on multiple mobile devices, you must still follow the licensing agreements for any commercial software you use.

Distributing software to mobile devices requires the following steps:

  • Create a package for software distribution.
  • Specify distribution points for software distribution. (This step is required only if the software distribution package includes source files.)
  • Create a program for software distribution.
  • Advertise the program to collections of mobile devices.

Individual wizards are available to complete each of these tasks individually but the Distribute Software to Devices Wizard includes steps for the entire process.

Prerequisites

To distribute software to mobile devices clients requires the following:

  • The Configuration Manager mobile device client must be installed on the mobile device. For more information, see How to Install or Upgrade the Mobile Device Management Client.
  • Software distribution to mobile device clients must be enabled. For more information, see How to Enable Distribution Points to Support Mobile Devices.
  • One or more Configuration Manager 2007 distribution points must be enabled for mobile device software distribution. For more information, see How to Enable Distribution Points to Support Mobile Devices.

Procedure

Use the following procedure to open the Distribute Software to Devices Wizard:

To open the Distribute Software to Devices Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  2. Right-click Packages, navigate to Distribute, and then click Software to Devices. The Distribute Software to Devices Wizard opens.

  3. Follow the steps of the Distribute Software to Devices Wizard to distribute software to mobile devices.
Note
All .cab files to be distributed to Microsoft Windows Mobile 5.0 and newer mobile devices must be signed before distribution. Microsoft Windows Mobile Pocket PC 2003 does not support running signed .cab files. Signed .cab files distributed to Pocket PC 2003 mobile devices will fail to run.

Note
Programs for desktop computers cannot run programs on mobile devices.

When the distributed package is downloaded and run on a mobile device, the software will be installed. A cabinet file (.cab) will be left in the \Temp folder on the mobile device. The size of the file will depend upon the size of the file distributed to the mobile devices. For more information about the Distribute Software to Devices Wizard, see Distribute Software to Devices Wizard.

See Also

Concepts

Distribute Software to Devices Wizard
How to Configure the Mobile Device Client Agent
How to Install or Upgrade the Mobile Device Management Client


How to Create an Advertisement for Mobile Devices

Advertisements for mobile devices in Microsoft System Center Configuration Manager 2007 allow mobile devices to download and install available packages. Advertisements for mobile devices are much the same as advertisements for computer clients. Mobile device advertisement programs will not run on desktop computers and computer advertisement programs will not run on mobile devices. Advertisements can be created in two ways, one for each type of package that can be advertised to mobile devices. The following advertisements can be sent to mobile devices:

  • Advertisements for configuration packages for mobile devices
  • Advertisements for software distribution packages for mobile devices

Advertisements for Configuration Packages for Mobile Devices

Configuration packages are packages specifically for mobile devices. These packages contain one or more configuration items. Configuration items are collections of settings for one or more mobile device platforms.

Procedure

To advertise a configuration package for mobile devices, complete the following steps:

To advertise a configuration package for mobile devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Mobile Device Management / Configuration Packages.

  2. In the results pane, right-click the configuration package to be advertised and then click Advertise to Devices. The Distribute software to Devices Wizard opens.

  3. Complete the steps in the Distribute Package to Devices Wizard to advertise a configuration package for mobile devices. For more information, see Distribute Software to Devices Wizard.

Advertisements for Software Distribution Packages for Mobile Devices

Advertisements for mobile devices are identical to software distribution packages for computer clients except that they target mobile devices and contain content appropriate for mobile devices.

Procedure

To advertise a package for mobile devices requires the following steps:

To advertise a package for mobile devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click Advertisements, select New, and then click Advertisement for Device. The New Advertisement for Device Wizard opens.

  3. Complete the steps in the New Advertisement for Device Wizard to advertise a package for mobile devices. For more information, see Distribute Software to Devices Wizard.
Note
The package must include a program for mobile devices or the advertisement cannot target mobile devices.

See Also

Concepts

About Advertisements
About Configuration Packages for Mobile Devices
About Packages
How to Deploy Software to Mobile Devices


How to Use Reports for Mobile Devices

Microsoft System Center Configuration Manager 2007 reporting includes a set of reports specific to mobile device management. These reports provide information on the following:

  • Managed mobile devices by platform
  • Mobile device client health
  • Mobile device client deployment
  • Mobile device hardware status
  • Mobile device maintenance status
  • Client computers that connect with mobile devices

For more information about Configuration Manager 2007 reports, see Reporting in Configuration Manager.

Procedure

View a Configuration Manager 2007 mobile report for mobile devices using the following steps:

To view a list of reports for mobile devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports. Reports appear in the results pane.

  2. Type "device management" in the Look for box, and then click Find Now. The list of mobile device reports is displayed in the results pane.

  3. Right-click the desired report, and select Run. The selected report runs.

See Also

Concepts

How to Manage Reports
Reporting in Configuration Manager


How to Verify Mobile Device Client Health

Microsoft System Center Configuration Manager 2007 mobile device client health allows administrators to ensure that mobile devices are able to receive policy and report inventory to the Configuration Manager 2007 servers. Client health data is sent to the fallback status point site server. The fallback status point collects client health state data. For more information, see About the Fallback Status Point in Configuration Manager.

Verify mobile device client health using the following steps:

Procedure

To verify mobile device client health

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click one of the following reports depending upon the health state you want to review:

    • Device Client Agent Deployment Status Details
    • Device Client Agent Deployment Failure Report
    • Device Client Agent Deployment Success Report
    • Device Client Agent Health Summary
    • Device Clients in Healthy condition
    • Device Clients in unhealthy condition due to certificate issues
    • Device Clients in unhealthy condition due to communication issues
    • Device Clients in unhealthy condition due to local client issues

  3. Click Run. The Configuration Manager 2007 report runs and portrays mobile device client health.

See Also

Concepts

How to Use Reports for Mobile Devices
How to Verify Mobile Device Client Installation or Upgrade


How to Use Collections for Mobile Device Clients

Microsoft System Center Configuration Manager 2007 collections represent groups of resources managed by the Configuration Manager 2007 and include collections of mobile devices. For more information about collections, see About Collections. The following collections of mobile devices are preconfigured:

  • All Windows Mobile devices
  • All Windows Mobile Pocket PC 2003 devices
  • All Windows Mobile Pocket PC 5.0 devices
  • All Windows Mobile Smartphone 2003 devices
  • All Windows Mobile Smartphone 5.0 devices

Collections for mobile devices, including collections for Windows Mobile 6 mobile devices, can be created using queries. For more information, see How to Use Queries to Create Windows Mobile Device Collections.

Procedure

View a collection of Windows Mobile devices using the following steps:

To view a collection of Windows Mobile devices

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. In the results pane, double-click the collection of mobile devices you want to view. The collection of devices is displayed in the results pane.

See Also

Concepts

About Collections
How to Use Queries to Create Windows Mobile Device Collections


How to Use Backup and Recovery for Mobile Device Management

Microsoft System Center Configuration Manager 2007 backup and recovery supports mobile device management. Mobile device packages, collections, certificates, and reports can be backed up against the possibility of data loss.

Requirements for Backup and Recovery of Mobile Device Management

In order for Configuration Manager 2007 to back up mobile device management, the Backup destination site must be specified with the fully qualified domain name (FQDN) of the site server. For more information about backing up Configuration Manager 2007 sites, see Backing up Configuration Manager Sites. For more information about scheduling a site backup maintenance task, see How To Schedule a Site Maintenance Task.

Recovering Mobile Device Management Site Servers

When restoring a mobile device site server, the site will be restored to the state of the server the last time it was backed up. Mobile device management will be restored with other features of the restored Configuration Manager 2007 server. For more information, see Tasks for Recovering a Site.

See Also

Tasks

How to Back Up a Primary Site
How To Schedule a Site Maintenance Task

Concepts

Backing up Configuration Manager Sites
Overview of Backup and Recovery
Recovering Configuration Manager Sites


How to Remove the Mobile Device Client

To remove the Microsoft System Center Configuration Manager 2007 mobile device client from mobile devices, deploy a client package with a .ini file containing the ClientInstallAction=Uninstall value setting.

A client uninstall package can be created and deployed to Configuration Manager 2007 managed mobile devices in the following ways:

  • Over the air upgrade of the mobile device
  • Transferred manually to mobile devices
  • Transferred to a computer that synchronizes with mobile devices

When the package runs the mobile device client will be uninstalled from the mobile device.

Use the following steps to remove the mobile device client.

Procedure

To remove the mobile device client

  1. Create or copy a mobile device client deployment folder that targets the mobile device platform you want to uninstall. For more information, see How to Create a Folder for Mobile Device Client Deployment.

  2. Edit the ClientSettings.ini with an ASCII text editor such as notepad.exe. Specify ClientInstallAction=Uninstall. For more information, see How to Edit the Mobile Device Client Configuration .ini File and Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini.

  3. Deploy and uninstall the mobile device client by one of the following methods:

    • By software distribution over the air to the mobile device. This requires the ClientInstallAction=Uninstall in a ClientSettings.ini file. For more information, see How to Upgrade the Mobile Device Management Client Over the Air.
    • By manual transfer to the mobile device. This requires the ClientInstallAction=Uninstall in a ClientSettings.ini file. For more information, see How to Manually Transfer and Install the Mobile Device Management Client.
    • By manually running from a computer that connects via Mobile Device Manager or ActiveSync with mobile devices. This requires the ClientInstallAction=Uninstall in a DMCommonInstaller.ini file. For more information, see How to Manually Install the Mobile Device Client via ActiveSync or Mobile Device Center Synchronization.

When the package is run on the mobile device the mobile device client will be uninstalled.

See Also

Concepts

How to Install or Upgrade the Mobile Device Management Client
How to Remove Mobile Device Management from the Site

Other Resources

How to Create a Folder for Mobile Device Client Deployment
How to Edit the Mobile Device Client Configuration .ini File


How to Remove Mobile Device Management from the Site

Removing mobile device management removes support for Microsoft System Center Configuration Manager 2007. To remove the mobile device client from Configuration Manager 2007 managed mobile devices, see How to Remove the Mobile Device Client.

Procedure

Remove mobile device management using the following steps:

To remove mobile device management

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / Site Code / Site Settings / Site.

  2. In the results pane, right-click ConfigMgr device management point, and then click Delete.
Note
Although the ConfigMgr device management point icon is removed immediately from the results pane, the removal may require some minutes to propagate through the Configuration Manager 2007 environment.

See Also

Concepts

How to Remove the Mobile Device Client


How to Remove the Mobile Device Client Installation Files from Desktop Computers

A predefined package is available in Configuration Manager 2007 to remove the mobile device client installer files from Configuration Manager 2007 managed computer desktop computers.

Procedure

Remove the mobile device client via computer clients that synchronize with mobile devices using the following steps.

To remove the mobile device client via computer clients that synchronize with mobile devices

  1. Create a new folder to contain the files needed to remove the mobile device installation files.

  2. Into the new folder, copy the following files in the client transfer folder located at <InstallationFolder> \ DeviceClientDeployment \ ClientTransfer:

    • DMClientXfer.exe
    • DMCommonInstaller.exe
    • DMCommonInstaller.ini

  3. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages.

  4. Right-click Packages, select New, and then click Package from Definition. The Create Package from Definition Wizard opens. Click Next.

  5. On the Package Definition page, select Remove Device Management Client Transfer. Click Next.

  6. Specify how source files should be managed. Click Next.

  7. Specify the new folder containing the source files.

  8. Complete the Create Package from Definition Wizard, and then click Finish.

  9. Distribute the client removal package to Configuration Manager 2007 client computers that synchronize with mobile devices.

See Also

Concepts

How to Install the Mobile Device Management Client Using Software Distribution to a Desktop Computer Running ActiveSync or Mobile Device Center


Mobile Device Clients Security Best Practices and Privacy Information

Mobile devices present interesting security challenges in your enterprise environment. For example, mobile devices by their nature are more easily lost or stolen, which could provide attackers with access to e-mail and other network content if the device is not protected with a strong password. Microsoft System Center Configuration Manager 2007 allows you to better manage your mobile devices by enforcing configurations that enhance security such as passwords and certificates.

Best Practices

Use native mode whenever possible Native mode uses certificates issued by a PKI to provide mutual authentication between site systems and mobile device clients. Native mode is designed to be the most secure mode for Configuration Manager 2007. If you do not enable native mode, you must configure the distribution points that support mobile device clients to allow anonymous access.

Require mobile device clients to use passwords Password management on Windows Mobile for Pocket PC 5.0, Windows Mobile for Pocket PC Phone Edition 5.0 and Windows Mobile 5.0 Smartphone requires the Messaging and Security Feature Pack (MSPF). For more information, see the Windows Mobile Messaging and Security Feature Pack web page (http://go.microsoft.com/fwlink/?LinkId=80392).

After switching to a custom Web site, remove the default virtual directories When you change from using the default Web site to using a custom Web site, Configuration Manager 2007 does not automatically remove the old virtual directories. You should manually remove the virtual directories created under the default Web site. This is especially important if you configured the distribution point to Allow clients to connect anonymously (Required for mobile device clients) while using the default Web site, and then disable anonymous connections after switching to the custom Web site because the old virtual directories will still be configured for anonymous access. For the list of virtual directories created on BITS-enabled distribution points, see About BITS-Enabled Distribution Points.

Privacy Information

Device management allows you to perform hardware inventory, software inventory, file collection, and software distribution on mobile device clients running an embedded version of Windows CE, including Windows Mobile. The privacy concerns that apply to client computers for inventory and software distribution also apply to mobile device clients. Software inventory and file collection are not enabled by default. You can configure what software inventory you want to collect and whether you want to collect files. Hardware inventory and software distribution are enabled by default. Before configuring mobile device management, consider your privacy requirements.


Troubleshooting Mobile Device Management

Use the following topics to help troubleshoot issues that may occur with Microsoft System Center Configuration Manager 2007 mobile device management.

In This Section

The following mobile device management troubleshooting information is available.

Mobile Device Management Policy for File Collection Sent to Client Unnecessarily

Describes and provides the resolution for a known issue with file collection from mobile device clients.

Multiple Mobile Devices Show the Same Device ID

Describes and provides the resolution for a known issue with multiple mobile devices showing the same device ID, and interfering with mobile device management.

Mobile Device Clients Connected via ActiveSync or Mobile Device Center Might Have Problems Locating Distribution Points

Describes and provides the resolution for a known issue with connected mobile devices working within protected boundaries.

How to Downgrade the Mobile Device Client From a Newer Client Version

Describes how to install an older version of the mobile device management client.

How to Perform a Mobile Device Client Self-Test

Describes how to perform a mobile device client self-test to determine if the client can communicate with the mobile device management point.

Known Issues for Mobile Device Management

Describes known issues for mobile device management and provides solutions for those issues where applicable.

Troubleshooting Mobile Device Management Using Custom Error Codes

Lists the custom error codes, possible problem and possible solutions for Mobile Device Management.

See Also

Other Resources

Technical Reference for Mobile Device Management


Mobile Device Management Policy for File Collection Sent to Client Unnecessarily

If Configuration Manager mobile device file collection has been enabled and configured to collect files from mobile devices, and later file collection is turned off, the policy is still sent to the mobile device client with the full list of files that were previously collected.

To prevent this unnecessary data from being transmitted, delete the file collection rules before disabling file collection.

Procedure

Delete the file collection rules for the mobile device client agent using the following steps:

To delete the file collection rules for a mobile device agent

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. In the results pane, right-click Mobile Device Client Agent, and then click Properties. The Device Client Agent Properties dialog box is displayed.

  3. Click the File Collection tab. The File Collection properties are displayed.

  4. Highlight a rule in the Collected Files pane, and click Delete. The rule for file collection is deleted.

  5. Repeat for each rule in the Collected Files pane. After removing all rules, clear the Enable file collection on device clients check box to disable file collection.

See Also

Other Resources

Troubleshooting Mobile Device Management


Multiple Mobile Devices Show the Same Device ID

Microsoft System Center Configuration Manager 2007 mobile device management uses the device ID to identify managed mobile devices. All currently available consumer Pocket PC devices support a unique hardware ID that the Mobile Device Management Agent uses as the Microsoft System Center Configuration Manager 2007 unique identifier, and the mobile device management functionality works as designed.

Certain industrial mobile devices do not report a unique device ID, so multiple mobile devices share the Configuration Manager 2007 unique identifier, rendering the devices individually unmanageable by Configuration Manager 2007. The result is that only a single mobile device discovery data record (DDR) appears in the Configuration Manager 2007 Administrator console, even though multiple mobile devices are successfully communicating with the Configuration Manager 2007 device management point.

To remedy this, create a registry script or use another method to change two registry keys on the mobile device.

Procedure

Use alternative Device Client registry settings to change DeviceID behavior. To do this, create a registry script or use other means to change two registry keys on the device as follows:

To change registry keys on mobile devices to provide unique device IDs

  1. Using a registry editing tool or the registry configuration item, add a DWORD registry value SimDeviceID under the registry key: HKLM\Comm\ApplicationDownload\SimDeviceID.

  2. Set the value to 0. SimDeviceID accepts one of the following values:

    • Value 0 : Use Hardware ID. This is the default value.
    • Value 1 : Generate an ID based on random numbers.
    • Value 2 : Generate ID from MAC address. If this fails return ID "NO_MAC_ADDR_DEVICE"
    • Value 3 : Generate ID from MAC address. If this fails, generate an ID based on random numbers.

  3. Delete the registry value DeviceID from the registry key HKLM\Comm\ApplicationDownload.

  4. The changes will not take effect until a soft reset is performed on the mobile device.

If the mobile device client is running and these changes are made, the mobile device client must be restarted via a soft reset in order for these changes to take effect.

Note
SimDeviceID value options 2 or 3 might leave the mobile device client agent unable to acquire a MAC address because mobile device networking components are still initializing. Values 2 and 3 are not recommended for resetting the DeviceID.

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Registry Properties


Mobile Device Clients Connected via ActiveSync or Mobile Device Center Might Have Problems Locating Distribution Points

Topic last updated—March 2008

Microsoft System Center Configuration Manager 2007 mobile device clients connected via ActiveSync or Mobile Device Center receive a private IP address instead of an IP address reflecting the actual network location of the mobile device. The mobile device client then uses the private IP address when attempting to locate distribution points, which often causes the mobile device client to attempt to download content from an incorrect location. In certain scenarios, the mobile device client might not be able to locate a valid distribution point.

Configuration Manager 2007 includes new functionality that assists in resolving this issue. Creating and configuring a new registry key on the mobile device management point allows the Device Management Point to identify the private IP addresses and subsequently replace the private IP address with one parsed directly from the HTTP communications with the connected computer. The device management point uses the new IP address to identify valid distribution points.

Registry Keys to Replace IP Addresses

The following registry key values support replacing the IP address of the mobile device for 32-bit systems:

Copy Code
HKLM\Software\Microsoft\Sms\MP\ Device Management\Check for ActiveSync Devices
0 = Off: Disabled.
1 = On: Check device client IP addresses against the ActiveSync Addresses list.
HKLM\Software\Microsoft\Sms\MP\ Device Management ActiveSync Addresses

The following registry key values support replacing the IP address of the mobile device for 64-bit systems:

Copy Code
HKLM\Software\Microsoft\Wow6432Node\Sms\MP\ Device Management\Check for ActiveSync Devices
0 = Off: Disabled.
1 = On: Check device client IP addresses against the ActiveSync Addresses list.
HKLM\Software\Microsoft\Wow6432Node\Sms\MP\ Device Management ActiveSync Addresses

Use the following procedure to replace the private IP address of the mobile device with an address from the HTTP communications with the connected computer.

Procedures

To replace the private IP address of the mobile device with an address from the HTTP communications with the connected computer

  1. Create a new registry key, named Device Management, under HKLM\Software\Microsoft\Sms\MP\ for 32-bit systems, or under HKLM\Software\Microsoft\Wow6432Node\Sms\MP\ for 64-bit systems.

  2. Create a new value, named Check for ActiveSync Devices (type hexadecimal), under HKLM\Software\Microsoft\Sms\MP\Device Management (DWORD) for 32-bit Systems, or HKLM\Software\Microsoft\Wow6432Node\Sms\MP\ Device Management (DWORD) for 64-bit systems.

  3. Edit ActiveSync Devices, and set the value to 1 to enable checking for ActiveSync mobile devices.

  4. Create a new value, named ActiveSync Addresses (type multi-string), under HKLM\Software\Microsoft\Sms\MP\Device Management for 32-bit systems, or HKLM\Software\Microsoft\Wow6432Node\Sms\MP\ Device Management for 64-bit systems.

  5. Enter the list of ActiveSync addresses in your environment. For example, 192.168.55.101 is a possible ActiveSync address value.

See Also

Reference

Boundary Properties: Protected Tab

Concepts

How to Install or Upgrade the Mobile Device Management Client
How to Install the Mobile Device Management Client Using Software Distribution to a Desktop Computer Running ActiveSync or Mobile Device Center


How to Downgrade the Mobile Device Client From a Newer Client Version

Topic last updated -- August 2007

The Microsoft System Center Configuration Manager 2007 mobile device client setup program will not install an older Configuration Manager 2007 client version on a mobile device running a newer mobile device client. In order to install an older version of the mobile device client the newer version must first be uninstalled.

To downgrade to an older version of the mobile device client perform the following:

Procedure

To downgrade to an older version of the mobile device client

  1. Remove the newer mobile device client from the mobile device. For more information about removing the mobile device client, see How to Remove the Mobile Device Client.

  2. Remove the mobile device client deployment folder from the synchronizing computer (computer-based installations) or from the mobile device (mobile device-based installations).

  3. distribute a mobile device client installation package to install the client. For more information about installing the mobile device client, see How to Install or Upgrade the Mobile Device Management Client.

See Also

Concepts

How to Install or Upgrade the Mobile Device Management Client
How to Remove the Mobile Device Client

Other Resources

How to Create a Folder for Mobile Device Client Deployment
How to Edit the Mobile Device Client Configuration .ini File


How to Perform a Mobile Device Client Self-Test

Topic last updated -- August 2007

Microsoft System Center Configuration Manager 2007 Mobile Device Management includes a self-test to determine whether the mobile device client is able to communicate with the Configuration Manager 2007 device management point. The Self Test URL is installed with the mobile device client during client installation.

To run the mobile device client self test perform the following steps:

Procedure

To run the mobile device client self test

  1. On the mobile device navigate to the \Temp folder. On Windows Mobile Smartphone 2003 navigate to the \Storage\Temp folder.

  2. Run Self Test. A web browser window will open stating, “Performing Device Management Self Test in 5 Seconds. If your browser doesn’t automatically perform the self test, click here.”

  3. If the browser does not perform the self test, click the link to perform the self test. If the device is communicating with device management point then a web page will display the following:

    • Elapsed time (microseconds)
    • ISAPI start time
    • Site code

Self Test Results

If the mobile device is communicating correctly with the device management point the results will look like the following:

<?xml version=”1.0”?>

<PropList Name=SelfTest_DMP”>

<Prop Name=”ElapsedTimeMS>[time]</Prop>

<Prop Name=”IsapiStartTime”>[ISAPI]</Prop>

<Prop Name=”SiteCode”>[SMS]</Prop>

</PropList>

Where [time] is the number of microseconds elapsed, , [ISAPI] is the start time in year-month-dayTtime format, and [SMS] is the site code of the Configuration Manager 2007 site.

If the self test results in an error then the Configuration Manager 2007 mobile device client is not able to communicate with the Configuration Manager 2007 mobile device management point. Use the browser error message information to troubleshoot the communication issue.


Known Issues for Mobile Device Management

Topic last updated—November 2007

The following are known issues affecting Microsoft System Center Configuration Manager 2007 Mobile Device Management.

Windows Mobile Smartphone 2003 Stores Files Under \Storage

Smartphones running Windows Mobile 2003 use \Storage as the root folder for the mobile device file structure. Files distributed by Configuration Manager 2007 will appear in the \Storage\Temp folder on Windows Mobile 2003 clients. The \Storage folder is automatically added to the download folder by the mobile device client when distributing packages to Smartphones running Windows Mobile 2003.

Solution

In specifying Program properties or script behaviors for Smartphones running Windows Mobile 2003, the Configuration Manager 2007 administrator does not need to specify \Storage for the Download folder. The \Storage folder is automatically specified by Configuration Manager 2007 when distributing packages to Smartphones running Windows Mobile 2003.

Incoming Calls Fail While Mobile Device Is Downloading Data

If the mobile device is downloading files when a call is placed to the phone, the call will fail. This behavior is consistent with mobile devices with phone service. Outgoing calls behave normally. Distributing large packages using Configuration Manager 2007 may affect phone service availability.

Solution

Configuration Manager 2007 administrators should schedule distribution to mobile devices for nonpeak hours to avoid interrupting phone service for mobile device users.

Mobile Device Certificate Enrollment Fails If CA Authorization Is Delayed

When attempting to enroll a personal certificate, if the issuing certification authority (CA) requires manual approval or responds with "Pending" status, enrollment will fail. This can also occur if the CA authorization is delayed for any reason.

Solution

If enrollment fails because the CA is delayed or requires manual authorization, the enrollment process can be rerun by undocking the mobile device and then docking again. If the CA has generated a personal certificate in the interim, enrollment will finish normally.

Inventory Fails to Report on Mobile Devices During Daylight Savings Time

In 2007, the start and end dates for daylight savings time were changed in North America. Because of this change, Microsoft System Center Configuration Manager 2007-managed Windows Mobile 5 and older Windows Mobile–based devices and Windows CE-based devices might fail to report inventory data and collected files until daylight savings time has been properly updated on the mobile device.

Solution

Update the mobile device for daylight savings time. For more information about how to update a mobile device to account for the new start and end dates for daylight savings time, see the daylight savings time Web page (http://go.microsoft.com/fwlink/?LinkId=91730).

Mobile Device Client Installation via Synchronization Fails During Large Data Transfer

If the Configuration Manager 2007 mobile device client attempts to install via ActiveSync or Mobile Device Center synchronization when the mobile device is transferring a large amount of data from the connected computer, the client installation will fail.

Solution

Resynchronize the mobile device with the computer when less data will be transferred between the two. If the mobile device client transfer and installation fails, use another mobile device client installation method.

Mobile Device Client Fails to Communicate with Fallback Status Point

If the mobile device client cannot communicate with the fallback status point, it will continue to unsuccessfully send all fallback status point messages to the fallback status point server.

Solution

To verify that the fallback status point is properly configured, use the client health reports and the hardware inventory extensions in the software developer kit to inventory the fallback status point name. Ensure that the fallback status point server is operating correctly and can be reached by the mobile device client. If necessary, update the mobile device client by correcting the FSPServerName value in the ClientSettings.ini file or in the DMCommonInstaller.ini file and redistributing it to the mobile device. For more information about client health reports, see How to Verify Mobile Device Client Health. For more information about configuring the mobile device client settings, see How to Edit the Mobile Device Client Configuration .ini File.

Home Screen Shortcut Remains After Uninstalling Mobile Device Client

Uninstalling the mobile device client from the mobile device does not remove the shortcut from the mobile device home screen. The shortcut to the uninstalled application will be replaced by other applications as they are used.

Solution

No action is necessary. The shortcut will disappear from the home screen in the course of normal mobile device use.

System Management Server 2003 Device Management Feature Pack Clients Do Not Appear in Collections

Managed mobile devices running the System Management Server (SMS) 2003 Device Management Feature Pack (DMFP) client do not appear in Configuration Manager 2007 collections for Pocket PCs.

Solution

To add SMS 2003 DMFP Pocket PC clients running Windows Mobile 2003, add a membership rule containing the following query statement to the existing membership rules for Pocket PCs running Windows Mobile 2003:

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System inner join SMS_G_System_DEVICE_OS_INFORMATION on SMS_G_System_DEVICE_OS_INFORMATION.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_DEVICE_COMPUTER_SYSTEM on SMS_G_System_DEVICE_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_R_System.ResourceType = 5 and SMS_R_System.ClientType = 3 and SMS_G_System_DEVICE_OS_INFORMATION.MajorVersion = 4 and SMS_G_System_DEVICE_OS_INFORMATION.MinorVersion like '2%' and SMS_G_System_DEVICE_COMPUTER_SYSTEM.PlatformType = 'PocketPC'

To add SMS 2005 DMFP Pocket PC clients running Windows Mobile 2005, add a membership rule containing the following query statement to the existing membership rules for Pocket PCs running Windows Mobile 2005:

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client from SMS_R_System inner join SMS_G_System_DEVICE_OS_INFORMATION on SMS_G_System_DEVICE_OS_INFORMATION.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_DEVICE_COMPUTER_SYSTEM on SMS_G_System_DEVICE_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_R_System.ResourceType = 5 and SMS_R_System.ClientType = 3 and SMS_G_System_DEVICE_OS_INFORMATION.MajorVersion = 5 and SMS_G_System_DEVICE_OS_INFORMATION.MinorVersion <= 1 and SMS_G_System_DEVICE_COMPUTER_SYSTEM.PlatformType = 'PocketPC'

For more information about creating collections using queries, see How to Use Queries to Create Windows Mobile Device Collections.

Mobile Device Client Cannot Find Intranet Device Management Point

If mobile device clients will communicate with an intranet-based device management point, it might be necessary to use the NetBIOS name when defining the device management point in the .ini configuration file during mobile device client setup. This allows the device management point to be resolved even if proxy settings are used for the mobile device to allow it to browse the Internet. Alternatively, set a rule on the proxy server to allow the mobile device to resolve the fully qualified domain name (FQDN) of the device management point on the intranet and also access Internet content.

Changes to the Package in Advertisements to Mobile Device Clients Are Not Saved

In the advertisement properties for an advertisement to mobile device clients, when you change the package for an advertisement created previously, the package change will not take effect if you leave the General tab or select any option other than OK on the General tab.

Solution

After changing the package, click OK on the General tab and then reenter the advertisement to verify that the package change has taken place or to make any additional changes.

Default Collections Will Change Device Management Feature Pack Collection Criteria

When you upgrade a System Management Server (SMS) 2003 site with the Device Management Feature Pack to Configuration Manager 2007 or when you upgrade the parent of an SMS 2003 with the Device Management Feature Pack, the default collections for All Windows Mobile Devices and All Windows Mobile Pocket PC 2003 Devices are upgraded to use the new membership selection queries included with Configuration Manager 2007. When this happens, all of the SMS 2003 Device Management Feature Pack clients are dropped from the collections due to a change in the query.

Solution

Before upgrading, in all SMS 2003 sites with the Device Management Feature Pack installed on them, create new collections with different names that use the same query as the default Device Management Feature Pack collections. Verify that all SMS 2003 mobile device clients are members of the collections before upgrading to Configuration Manager 2007. If you have a child site with the Device Management Feature Pack that will not upgrade to Configuration Manager 2007, you should also modify your advertisements to use the newly created collections. After the mobile device client is upgraded to Configuration Manager 2007, the mobile devices appear in the Configuration Manager 2007 default collections.

Configuration Items Not Supported for Windows Mobile 6

Some configuration items shipping in Configuration Manager 2007 will not function properly on Windows Mobile 6 platform mobile devices because of changes in the Configuration Service Providers shipped on Windows Mobile 6.

Unsupported configuration items on Windows Mobile 6 include the following:

  • Dial-up Networking configuration item.
  • WiFi configuration item does not support the WiFi connection to the Internet with ad hoc networking with shared authentication and encryption disabled.

Unsigned .cab Files Fail to Install If Mobile Device Security Policy Is Set to Prompt

The unsigned .cab file policy on Windows Mobile 5 and newer mobile devices can be managed using the Security Policy configuration item. When .cab files are distributed using Configuration Manager 2007, the prompt for unsigned .cab files is suppressed even if the client .cab signing policy is set to prompt. If a .cab file is installed by the user outside of Configuration Manager 2007, the .cab signing policy will function as expected.

Solution

Sign .cab files distributed by Configuration Manager 2007 for installation on mobile devices.

Error Codes in Reports with No Description

Error conditions reported by mobile device clients might be displayed using standard Windows error codes, without a description of the error. Or they might use error codes that are specific to Configuration Manager 2007.

Solution

Use the following references to find the error description associated with a specific error code displayed in the reports:

  • System Error Codes from the Microsoft Developer Network: http://go.microsoft.com/fwlink/?LinkId=94590
  • Windows Error Messages from the Microsoft Developer Network: http://go.microsoft.com/fwlink/?LinkId=94591
  • Customer error codes in Configuration Manager 2007: Custom Error Codes for Configuration Manager 2007

For more information, see Troubleshooting Mobile Device Management Using Custom Error Codes.

See Also

Other Resources

Troubleshooting Mobile Device Management


Troubleshooting Mobile Device Management Using Custom Error Codes

A list of the custom error codes, possible problem and possible solutions for Mobile Device Management.

Mobile Device Management Custom Error Codes

Error Code | Possible Problem | Possible Solution
-2147220846 FFFFFFFF80040292 | Unable to compute message signature for in-band authentication. | Possibly registration certificate is not valid anymore. Try enrolling a new client authentication certificate on the device.
-2147220843 FFFFFFFF80040295 | Unable to find a valid client authentication certificate for registration. | Try enrolling a new client authentication certificate on the device.
11520 | Mobile device client deployment action failed. Failed to establish ActiveSync or Mobile Device Center connection to the mobile device. | Check the connection to the mobile device.
11521 | Mobile device client deployment action failed. Invalid client settings file. | Check mobile device client settings
11522 | Mobile device client deployment action failed. Error determining running directory for DmClientXfer.exe | Check the running directory for DmClientXfer.exe.
11523 | Mobile device client deployment action failed. Required ActiveSync libraries missing. | Check ActiveSync libraries.
11524 | Mobile device client deployment action failed. Could not determine processor type of attached mobile device. | Check the mobile device's processor type to make sure it is compatible.
11525 | Mobile device client deployment action failed. Could not determine base operating system version of attached mobile device. | Check the operating system of the mobile device to make sure it is compatible.
11526 | Mobile device client deployment action failed. Error determining client version for the attached mobile device. | Check the client version of the mobile device
11527 | Mobile device client deployment action failed. Error creating client settings .ini file. | Check the .ini file
11528 | Mobile device client deployment action failed. Failed to copy files to the attached mobile device. | Copy the files to the mobile device
11529 | Mobile device client deployment action failed. Failed executing the mobile device client installer program on attached mobile device. | Retry installation
11530 | Mobile device client deployment action may have failed. Failed reading status information from the mobile device. | Retry deployment
11540 | Mobile device client deployment action failed. Error determining running directory for the mobile device client installer program. | Check the running directory
11541 | Mobile device client deployment action failed. Error executing the pre-install command line. | Retry executing pre-install command line.
11542 | Mobile device client deployment action failed. Error executing the post-install command line. | Retry executing post install command line.
11550 | Mobile device client installation or upgrade failed. Error during removal of the previous client. | Retry removal of previous client.
11551 | Mobile device client installation or upgrade failed. Invalid client settings file. | Check the client settings file
11552 | Mobile device client installation or upgrade failed. Error installing client CAB file. | Check CAB file
11553 | Mobile device client installation or upgrade failed. Error starting client service. | Start client service
11554 | Mobile device client installation or upgrade failed. Error updating client settings. | Check client settings
11555 | Device Client Deployment failed with unknown error. | Check client deployment log on the mobile device.
11560 | Mobile device client verification or repair failed. Error during removal of previous client. | Retry removal of previous client.
11561 | Mobile device client verification or repair failed. Invalid client settings file. | Check client settings
11562 | Mobile device client verification or repair failed. Error installing client CAB file. | Check CAB file
11563 | Mobile device client verification or repair failed. Error starting client service. | Check client verification and/or repair.
11564 | Mobile device client verification or repair failed. Error updating client settings. | Check client settings.
11565 | Mobile device client verification or repair failed. Error restoring required files. | Retry verification and/or repair
11566 | Mobile device client privileged certificate installation failed. | The mobile device may have a security policy which prevents the client installer from installing certificates into the privileged and SPC certificate stores.
11567 | Encountered unknown error installing the device client. | Check client deployment log on the mobile device.
11568 | Mobile device client setup failed to launch during install. | Restart setup
11570 | Mobile device client removal failed. Error using unload.exe to uninstall the existing client. | Retry unload.exe
11571 | Mobile device client install/upgrade failed. Error enforcing new client. Mobile device rolled back to old client (if existed before). | Retry install/upgrade
11572 | Mobile device client rollback failed during unsuccessful upgrade. Error enforcing old client. | Need to freshly install the client.
11573 | Mobile device client failed to perform post cab install actions. Device client installation failed. | Retry device client installation

See Also

Concepts

Custom Error Codes for Configuration Manager 2007

Other Resources

Troubleshooting Mobile Device Management


Technical Reference for Mobile Device Management

Click any link in the following section for technical references for mobile device management with Microsoft System Center Configuration Manager 2007.

In This Section

Installation files for the Mobile Device Client

Specifies the list the files required to install the mobile device client on mobile devices.

Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini

Specifies the values in DMCommonInstaller.ini and ClientSettings.ini which must be specified to configure the mobile device client.

Support and Core Dependencies for the Windows CE Mobile Device Client

Specifies the core dependencies for Windows CE support of the mobile device client.

Mobile Device Hardware Inventory Data

Specifies the categories and the fields of mobile device hardware inventory data.


Installation files for the Mobile Device Client

Microsoft System Center Configuration Manager 2007 mobile device management requires certain files to perform the following functions:

  • Extend the hardware inventory on Configuration Manager 2007 client computer
  • Copy mobile device installation files onto the mobile device (Deployment via connected computer only)
  • Certificate enrollment
  • Mobile device client software installation
  • Mobile device client configuration

Mobile Device Client Deployment Files

The mobile device client deployment files include the following:

  • DMCommonInstaller.exe
  • DMCommonInstaller.ini
  • DeviceClient_[platform].cab
  • ClientSettings.ini
  • DmInvExtension.exe
  • DMClientXfer.exe
  • DMInstaller_[platform].exe
  • DMClientSetup_[platform].exe
  • SMSPassword_CE4.2.cab
  • Enroll.exe

Mobile device management common installer program (DmCommonInstaller.exe)

Installs the mobile device client deployment applications (device management inventory extension tool and Device Management Client transfer program) on the Configuration Manager 2007 client computer.

Mobile device management installer settings file (DmCommonInstaller.ini)

DMCommonInstaller.ini specifies settings for the mobile device management common installer program (DMCommonInstaller.exe). DMCommonInstaller.ini is used in two circumstances:

  • When deploying the hardware inventory extension to Configuration Manager 2007 computers that synchronize with mobile devices. The version of the file located in the <InstallationFolder / DeviceClientDeployment / InventoryExtension folder should not be modified.
  • When deploying a mobile device client deployment package that targets computers that synchronize with mobile devices via ActiveSync or Window Mobile Device Center. The file specifies files to install, update and uninstall the mobile device client. The DMCommonInstaller.ini file also contains configuration information for the mobile device client including required information about the Configuration Manager 2007 site. DMCommonInstaller.ini contains data for installing, updating, configuring and uninstalling the mobile device client on all platforms. For more information about configuring the DMCommonInstaller.ini file, see How to Edit the DMCommonInstaller.ini File for Mobile Device Management.

Client Settings installer settings file (ClientSettings.ini)

ClientSettings.ini specifies files to install the mobile device client. The ClientSettings.ini file also contains configuration information for the mobile device client including required information about the Configuration Manager 2007 site. ClientSettings.ini files are platform-specific. For more information about configuring the ClientSettings.ini file, see How to Edit the ClientSettings.ini File for Mobile Device Management.

Mobile device management inventory extension tool (DmInvExtension.exe)

DMInvExtension.exe extends hardware inventory on existing Configuration Manager 2007 client computers to identify ActiveSync-connected (Windows XP and earlier) and Mobile Device Center-connected (Windows Vista) mobile devices in the Configuration Manager 2007 site.

Mobile device management client transfer program (DmClientXfer.exe)

DMClientXfer.exe is deployed and run on computers that synchronize with mobile devices. When run the DMClientXfer.exe program communicates with mobile device to determine the mobile device platform and existing version of mobile device client (if any). The program reads DMCommonInstaller.ini and generates a ClientSettings.ini file for client deployment and configuration. The program then copies mobile device client installation files to the mobile device and remotely triggers the mobile device management client installer program on mobile device.

Mobile device management client installer program (DmInstaller_ce4.2_arm.exe, DmInstaller_SP_ce4.2_arm.exe, DmInstaller_SP_ce5.0_arm.exe, DmInstaller_ce5.0_arm.exe, DmInstaller_winCE4.2_arm.exe, DmInstaller_winCE5.0_x86.exe and DmInstaller_winCE5.0_arm.exe)

The DMInstaller_[platform].exe file is used during mobile device client installation. The program first attempts to install the Microsoft Authenticode code-signing certificate in the privileged certificate store and software publishing certificates (SPC) store of the mobile device. If the installation fails the program attempts to log an error message and exits the installation process without calling the client setup files. If certificate is trusted by the mobile device then the Microsoft Authenticode certificate can be installed with elevated privileges and the mobile device is assumed to be unlocked and available to be managed by Configuration Manager 2007. The DMInstaller_[platform].exe program then calls DMClientSetup_[platform].exe which install the mobile device management client on the mobile device.

Mobile device client setup program (DMClientSetup_ce4.2_arm.exe, DMClientSetup_SP_ce4.2_arm.exe, DmClientSetup_SP_ce5.0_arm.exe, DMClientSetup_ce5.0_arm.exe, DMClientSetup_wince4.2_arm.exe, DMClientSetup_wince5.0_arm.exe and DMClientSetup_wince5.0_x86.exe)

The DMClientSetup_[platform].exe program installs the mobile device client on the mobile device. After installing the client, the client setup program then applies specified settings, optionally installs certificates, and starts the client service.

Mobile device client cabinet file (DeviceClient_CE4.2_ARM.cab, DeviceClient_CE5.0_ARM.cab, DeviceClient_SP_CE4.2_ARM.cab, DeviceClient_SP_CE5.0_ARM.cab, DeviceClient_WinCE5.0_ARM.cab, and DeviceClient_WinCE5.0_x86.cab)

The DeviceClient_[platform].cab cabinet file contains data required to install the mobile device client on the mobile device.

Password Policy for Windows Mobile Pocket PC 2003 (SMSPassword_CE4.2.cab)

The SMSPassword_CE4.2.cab installation item provides password management support for Pocket PC 2003 mobile devices. Password policy allows administrators to enable password policy on the device, enforce password time-out, enable password history, and enable administrator mode.

Mobile device client enrollment program (Enroll_ARM.exe, Enroll_WinCE5.0_x86.exe, Enroll_WinCE5.0_ARM.exe)

The enrollment program allows the mobile device user to use a certification authority (CA) to enroll a user authentication certificate. This certificate will be used for SSL authentication when the device communicates with Configuration Manager 2007 servers and for registration in native mode. In order to be issued a certificate the user will need to authenticate to the CA one time during the client installation process. This may require a corporation network connection as most Certification Authorities are not exposed to the Internet. Enforcing certificate enrollment is configured in either ClientSettings.ini or DMCommonInstaller.ini using the CertEnrollAction=Enroll setting. For more information, see How to Edit the Mobile Device Client Configuration .ini File.

Platform-specific Client Deployment Files

Certain mobile device client installation files are specific to the device platform being installed. These files include:

  • DeviceClient_[platform type].cab
  • DMClientSetup_[platform type].exe
  • DMInstaller_[platform type].exe

If certificates must be enrolled on the device to allow it to communicate in your environment then Enroll_[platform type].exe is also required.

  • For all Windows Mobile devices, copy Enroll_ARM.exe
  • For Windows CE x86, copy Enroll_WinCE5.0_X86.exe
  • For Windows CE ARM, copy Enroll_WinCE5.0_ARM.exe

For distribution to a single platform type using manual installation or over the air upgrade this file must be renamed Enroll.exe.

In addition to these files, the mobile device client installation package must include the following files:

  • Either DMCommonInstaller.ini or ClientSetup.ini
  • DMClientXfer.exe (for deployment via connected computer only)

Windows Mobile Pocket PC 2003

DeviceClient_CE4.2_ARM.CAB

DMInstaller_CE4.2_ARM.exe

DMClientSetup_CE4.2_arm.exe

SMSPassword_CE4.2_ARM.cab

Enroll_ARM.exe

Windows Mobile Pocket PC 2005

DeviceClient_CE5.0_ARM.CAB

DMInstaller_CE5.0_ARM.exe

DMClientSetup_CE5.0_arm.exe

Enroll_ARM.exe

Windows Mobile Smartphone 2003

DeviceClient_sp_CE4.2_ARM.CAB

DMInstaller_SP_CE4.2_ARM.exe

DMClientSetup_SP_CE4.2_ARM.exe

Enroll_ARM.exe

Windows Mobile Smartphone 2005

DeviceClient_sp_CE5.0_ARM.CAB

DMInstaller_SP_CE5.0_ARM.exe

DMClientSetup_SP_CE5.0_ARM.exe

Enroll_ARM.exe

Windows CE 4.2

[From the Device Management Feature Pack]

DmInstaller_ce4.2_ARM.exe

DeviceClient_CE4.2_ARM.cab

Windows CE 5.0 for x86

DeviceClient_WINCE5.0_x86.CAB

DMInstaller_CE5.0_x86.exe

DMClientSetup_CE5.0_x86.exe

Enroll_WinCE5.0_X86.exe

Windows CE 5.0 for ARM

DeviceClient_WINCE5.0_ARM.CAB

DMInstaller_CE5.0_ARM.exe

DMClientSetup_CE5.0_ARM.exe

Enroll_WinCE5.0_ARM.exe

Windows Mobile 6 Standard

DeviceClient_sp_CE5.0_ARM.CAB

DMInstaller_SP_CE5.0_ARM.exe

DMClientSetup_SP_CE5.0_ARM.exe

Enroll_ARM.exe

Windows Mobile 6 Professional

DeviceClient_CE5.0_ARM.CAB

DMInstaller_CE5.0_ARM.exe

DMClientSetup_CE5.0_arm.exe

Enroll_ARM.exe

Windows Mobile 6 Classic

DeviceClient_CE5.0_ARM.CAB

DMInstaller_CE5.0_ARM.exe

DMClientSetup_CE5.0_arm.exe

Enroll_ARM.exe

See Also

Concepts

How to Install or Upgrade the Mobile Device Management Client

Other Resources

How to Create a Folder for Mobile Device Client Deployment


Mobile Device Client Configuration Values for DMCommonInstaller.ini and ClientSettings.ini

Microsoft System Center Configuration Manager 2007 uses either DMCommonInstaller.ini or ClientSettings.ini during the mobile device client installation, upgrade and uninstall processes. The values within the .ini file specify whether the client is installed, upgraded or uninstalled and configure how the process is performed. During the install and upgrade processes the values of the .ini file then configure the mobile device client.

Configuration file values

The categories of values in the .ini file are as follows:

  • Installation values
  • Microsoft System Center Configuration Manager 2007 environment values
  • Communication values
  • User interface configuration values
  • Certificate values

Installation values

The DMCommonInstaller.ini file and ClientSettings.ini files define values for client installation.

Installer base values

These values define the files used during mobile device client installation and the basic parameters of the mobile device to be installed. They also specify that verbose logging is to be turned off. For the DMCommonInstaller.ini these files are marked 'Do not change' because they are already configured for specific platforms. For ClientSettings.ini the values specified can be used for the target mobile device platform.

Installer - The name of the platform-specific device management installer program. The file name has the format DMInstaller_[platform].exe. For more information about the mobile device client installer program, see How to Install or Upgrade the Mobile Device Management Client.

ClientSetup - The name of the platform-specific mobile device client setup program. The file name has the format DMClientSetup_[platform].exe.

Client - The name of the platform-specific client cabinet file required for mobile device client installation. The file name has the format DeviceClient_[platform].exe.

ClientVersion - The version of the mobile device client being installed. BaseOSMinVersion - The minimum version number of the platform operating system required to support the client.

BaseOSMaxVersion - The maximum version number of the platform operating system required to support the client.

Devicetype - The type of mobile device supported by the mobile device client.

ProcessorType - The type of processor supported by the mobile device client.

EnableVerboseLogging - Enabled verbose logging on the mobile device. By default this is 'False.'

Note
Windows Mobile 6 devices use Windows Mobile 5 mobile device client installation files. For more information about installation files, see Installation files for the Mobile Device Client.

Installer configurations

These values specify options for the installation process such as whether the client is being installed, updated or uninstalled and whether additional files or commands are applied during the installation process.

ClientInstallAction - Defines the action to be taken by the installer. By default ClientInstallAction is set to 'Install.' This supports three values:

  • 'None' - Makes no change to the mobile device client state.
  • 'Install' - Install the mobile device client distributed with the installation package onto the mobile device.
  • 'Uninstall' - Removes the mobile device client from the mobile device. This option uninstalls the mobile device client.

If the device Mobile device management settings will be set depending upon the state of the mobile device client:

Device state | Client deployment action
No client | Install deployed client
Older client than deployed client | Upgrade to deployed client
Same client as staged client | Reconfigure client settings
Newer client than staged client | No action

InstallType - Defines the type of installation that will be performed. By default InstallType is set to 'Clean.' This supports two values:

  • 'Clean' to remove program database
  • 'Preserve' to keep the record of installed programs
Important
Setting 'InstallType=clean' for a mandatory 'over the air' upgrade will cause the mobile device to repeatedly download and upgrade mobile device client policy.

Pre-InstallCommandLine - Defines the command line to be run before the installation of the mobile device client or other actions on the mobile device. This option is commented out by default.

Post-InstallCommandLine - Defines the command line to be run after the installation of the mobile device client or other actions on the mobile device. This option is commented out by default.

AdditionalFileX - Defines additional files that will be copied to the \temp\dminstall folder on the mobile device when the install program is run. Ensure a unique entry for each file by appending a number to the 'AdditionalFile' name. This option is commented out by default.

Configuration Manager Environment values

The environment values define the environment for the Configuration Manager 2007 mobile device client.

Site Server definitions

The following values define servers the mobile device communicates information to and polls for policy.

DMServerName - The server name of the Device Management Point to which the mobile device will connect. This value must be defined for correct client operation.

Note
If the device management point is changed without updating the server name then mobile device clients will lose communication with the Configuration Manager 2007 server. For information about how to update the mobile device client, see How to Install or Upgrade the Mobile Device Management Client.

ServerPort - Changes the port on which the mobile device client communicates from port 80 (HTTP) or 443 (HTTPS) to the specified port number. Change this value and uncomment if the Configuration Manager 2007 environment uses a custom port configuration. By default this value is commented out.

SiteCode- The three character alphanumeric site code of the site from which the mobile device client will receive policy. If the DMServerName specified for the client is in a primary site, use the site code of the site that the client installed into. If the DMServerName specified for the client is in a secondary site, use the site code of the parent site of the secondary site. This value must be changed for correct mobile device client operation in native security mode. For more information about site codes, see Understanding Configuration Manager Sites.

FSPServerName - The server name of the Fallback Status Point to which the mobile device sends FSP Messages. FSPServerName can be defined as a NetBIOS name, a FQDN, or a URL. Fallback Status Point servers should be defined as a URL and be published in external DNS in order for Internet based devices to connect. Internet-based mobile devices will only use HTTP to contact the Fallback Status Point Server. For more information about Fallback Status Points, see About the Fallback Status Point in Configuration Manager.

FSPPort - The primary http port on which the mobile device client communicates to the Fallback Status Point Server. FSPPort is 80 by default.

FSPAlternatePort - The alternate http port on which the mobile device client communicates to the Fallback Status Point Server. FSPPort is 80 by default.

Communication Values

SecurityMode - Defines the security mode of the mobile device client authentication. The default value for SecurityMode is 'None.' SecurityMode accepts three values:

  • 'None' - No server or client authentication is required.
  • 'SSLServerAuth' - Secure HTTP (HTTPS) server authentication is required. A server certificate will have to be installed on the device, see documentation for more information.
  • 'NativeMode' - Secure HTTP (HTTPS) mutual authentication is required between Device Client and the DMP/DP. A client Auth Certificate is required for registering the client with Configuration Manager 2007 database and signing the client data.

CreateConnection - Defines when a connection for Configuration Manager 2007 mobile device client communication is created. The default value for CreateConnection is 'USER.' CreateConnection accepts three values:

  • ‘ALL’ - Allows the mobile device client to create a connection for any action.
  • ‘USER’ - Allows the mobile device client to invoke a connection only for a user invoked action.
  • ‘NEVER’ - Prevent the mobile device client from invoking connections for any operations. The mobile device client only communicates on an existing connection.

InternetConnected - Indicates whether the device client is connecting to the device management point from the Internet. The default value is 'False.' InternetConnected accepts two values:

  • 'True' - The mobile device client is connecting to the device management point from the Internet.
  • 'False' - The mobile device client is not connecting to the device management point from the Internet.

User interface configuration

EnforceConfig - Defines the mobile device configuration user interface to be disabled for certain options so that the user cannot change the Configuration Manager 2007 mobile device configuration settings. The default value is 'ServerName.' EnforceConfig accepts three values:

  • 'None' - Allows the user to change server name, security mode and auto connect options.
Note
When a mobile device client installer is run, for example when the mobile device is docked, user-modified settings for the server name and security mode will be overwritten.

  • 'ServerName' - Prevents users from editing the server name and security mode options.
  • 'All' - Prevents users from editing the server name, security mode and auto connect options.

Certificate Values

The DMCommonInstaller.ini file and ClientSettings.ini files define values for certificate deployment and enrollment. These values must be edited for your specific environment. The following are categories of values for deploying certificates to devices:

  • Certificate enroller
  • Importing certificates
  • Renewing the site server signing certificate

Certificate enroller values

The following values in the DMCommonInstaller.ini file or the ClientSettings.ini file are used to define certificate enrollment during client installation or upgrade. Define these values for the site environment if certificates are to be enrolled:

CertEnrollAction - Defines whether a certificate is enrolled during mobile device client installation. The default for CertEnrollAction is 'Enroll.' CertEnrollAction accepts three values:

  • 'None' - No certificate is enrolled.
  • 'Enroll' - Enrolls a client authentication certificate and add server certificate to the ROOT certificate store of the mobile device if the existing certificate cannot be used for device registration. The user will be prompted for their credentials to enroll the certificate.
  • 'ForceEnroll' - Enrolls a client authentication certificate and adds a server certificate to the ROOT certificate store of the mobile device regardless of the current state of the existing enrolled certificate. The user will be prompted for their credentials to enroll the certificate CertEnrollAction=Enroll.

CertEnrollServer - The name of the Internet Information Services (IIS) web server front end to the certification authority (CA).

CertEnrollServerPort - The port number of the Internet Information Services (IIS) web server front end of the certification authority (CA).

Note
HTTPS is not supported by the Configuration Manager 2007 mobile device certificate enroller.

CertSubjectName - Specifies a hint for which certificate in the user store to use for registering the mobile device. The mobile device management client tries all the certificates where the subject name contains the valid CertSubjectName criteria. If the value is 'None' then all valid client authentication certificates in the user store will be tried. By default the value is 'None.' The format of the subject name is as follows:

CertSubjectName = The site code of this site server is [sitecode]

where [sitecode] is the site code of the site server. This string is not case sensitive.

CertRequestPage - The web page on a web server that receives the certificate request.

CertDownloadPage - The web page on the web server used for downloading the certificate.

CertChainDownloadPage - The web page on the web server used for downloading the certificate chain.

Importing certificates value: ImportCerts

ImportCerts - Defines that certificate files (*.cer) will be imported to the certificate store on the mobile device. This option can be used to deploy certificates for required for security modes. The certificate files (*.cer) must be included in the mobile device client deployment folder. Certificates to be imported must be in distinguished encoding rules (DER) encoded binary X.509 format. Base-64 encoded X.509 certificates are not supported. The default value is 'False.' ImportCerts takes two values:

  • 'True' - Import certificates.
  • 'False' - Do not import certificates.

Renewing site server signing certificates

EnableSSSCRenewal - Defines whether a site server signing certificate should be renewed when it expires.

  • 'True' - Enable site server signing certificate renewal
  • 'False' - Do not enable site server signing certificate renewal

See Also

Concepts

How to Edit the ClientSettings.ini File for Mobile Device Management
How to Edit the DMCommonInstaller.ini File for Mobile Device Management
How to Install or Upgrade the Mobile Device Management Client


Support and Core Dependencies for the Windows CE Mobile Device Client

Windows CE is a modular operating system designed to be customized for different hardware and for different uses. Windows CE images are built for specific hardware and specific purposes using a tool called Platform Builder. Platform Builder is an Integrated Development Environment (IDE) for building customized embedded Windows CE operating system platforms. It allows you to design, create, build, test, and debug a Windows CE image for Windows CE devices.

Microsoft System Center Configuration Manager 2007 management for Windows CE can be enabled in two ways. The easiest is to use the Platform Builder built-in client. To use the built-in client simply add the version of the device management client included in Platform Builder 5.0 to your Windows CE 5.x device operating system image. This will incorporate all dependencies for the client software and provide mixed mode support for Windows CE 5.x devices. Using the built-in device management client has two limitations:

  • The Platform Builder built-in version of the Configuration Manager 2007 device management client does not support native mode. The "Enterprise Web Pad" template in Platform Builder includes all mobile device client dependencies.
  • There is no Platform Builder built-in client for Windows CE 4.2 devices.
Note
To manage Windows CE 4.2 devices with Microsoft System Center Configuration Manager 2007 requires the Systems Management Server (SMS) 2003 Device Management Feature Pack device client for PocketPC 2003. This client can be installed at run-time. No built-in client for Windows CE 4.2 is available in Platform Builder. The Windows CE 4.2 platform has the same dependency requirements as the Windows CE 5.x client with regard to run-time installation. The dependencies for Windows CE support of the device client are listed below.

To enable native mode support on Windows CE 5.x devices requires the Windows CE 5.0 device management client that ships with Microsoft System Center Configuration Manager 2007. Install the device management client after the image is created and deployed. Launch the mobile device client at run-time on the device.

Note
The Microsoft System Center Configuration Manager 2007 mobile device client requires certain components be installed in Windows CE. In order to run the device client, Windows CE must be installed with all of the following dependencies.

Dependencies for Windows CE Support

The following is a list of Platform Builder catalog items required on the Windows CE operating system in order for it to support the Configuration Manager 2007 mobile device client.

  • Authentication Services (SSPI)
  • Asyncmac NDIS driver
  • C++ Runtime Support for Exception Handling and Runtime Type Information
  • CAB File Installer/Uninstaller
  • Certificates (CryptoAPI 2.0)
  • CoCreateGuid functionality for OLE32
  • COM
  • Command Processor
  • Common Control
  • Compression
  • Console Window
  • Core Server Support
  • Credential Manager
  • Cryptography Services (CryptoAPI 1.0) with High Encryption Provider
  • Database Support
  • Device Manager
  • Display Support
  • FormatMessage API
  • Full C Runtime
  • Gradient Fill Support
  • Internet Explorer Multiple-Language Base API
  • IP Helper API
  • Memory Mapped Files
  • Message Queue - Point-to-Point
  • Minimal GDI Configuration
  • Minimal GWES Configuration
  • Minimal Input Configuration
  • Minimal Window Manager Configuration
  • National Language Support (NLS)
  • Network Driver Architecture (NDIS)
  • Network Utilities (Ipconfig, Ping, Route)
  • PNP Notifications
  • Power Management (Minimal)
  • Schannel (SSL/TLS)
  • Serial Port Support
  • Standard I/O (STDIO)
  • Standard I/O ASCII (STDIOA)
  • Standard Shell
  • Standard String Functions - ASCII (corestra)
  • String Safe Utility Functions
  • System Password
  • Tahoma (Subset 1_07)
  • Target Control Support (Shell.exe)
  • TCP/IP
  • UI-based Notification
  • URL Moniker Services
  • Windows Internet Services
  • Winsock Support

See Also

Concepts

Supported Mobile Devices


Mobile Device Hardware Inventory Data

Microsoft System Center Configuration Manager 2007 mobile device clients can be configured to report hardware to the device management point. For more information about enabling mobile device hardware inventory, see How to Configure the Mobile Device Client Agent. The hardware inventory includes categories of information collected from the mobile device and each category presents specific data. For more information about mobile device hardware inventory, see How to View Mobile Device Client Information.

Mobile Device Hardware Inventory

The following are the categories of hardware inventory data and the data in each category.

  • Device Certificate Information (Native Mode Certificates)
    • Enrolled Certificate Hash Code
    • Enrolled Certificate Subject Name
    • Enrolled Certificate Expiration Date
    • Registered Certificate Hash Code
    • Registered Certificate Subject Name
    • Registered Certificate Expiration Date
  • Device Certificates
    • Issuer
    • Store
    • Subject
    • Thumbprint
    • Valid From
    • Valid To
  • Device Computer System
    • Device ID
    • ISA
    • Number of Processors
    • OEM Information
    • Platform Type
    • Processor Architecture
    • Processor Level
    • Processor Revision
    • Processor Type
  • Device Display
    • Horizontal Resolution
    • Vertical Resolution
    • Number of Colors
  • Device File System
    • Name
    • Size (KB)
    • Used Space
  • Device Memory
    • Program
    • Program Free
    • Storage
    • Storage Free
    • Total
  • Device Network
    • Bandwidth (KB)
    • IP Address
    • Subnet Mask
    • MAC Address
  • Device Operating System Information
    • Build Number
    • Major Version
    • Minor Version
    • Platform
    • System Default Locale ID
  • Device Owner Information
    • Name
    • Telephone
    • E-mail
    • Notes
  • Device Phone Identification
    • IMEI Number
    • Phone Number
  • Device Power (battery status)
    • AC
    • Backup
    • Backup Percent
    • Battery
    • Battery Percent
  • Device User Information
    • User Name
    • User Locale ID
  • System
    • Domain
    • Name
    • SMS ID
    • System Role
    • System Type

See Also

Reference

Mobile Device Client Agent Properties: Hardware Inventory

Concepts

About Resource Explorer
How to View Hardware Inventory From Mobile Devices

Other Resources

How to View Mobile Device Client Information


Network Access Protection in Configuration Manager

The Configuration Manager 2007 Network Access Protection (NAP) feature provides a set of tools and resources that can enforce compliance of software updates on client computers to help protect the integrity of your enterprise network. Click the associated link in the following section for detailed information about planning, configuring, managing, monitoring, and troubleshooting Network Access Protection.

In This Section

Overview of Network Access Protection

Provides an overview of the Network Access Protection feature, with supporting conceptual topics that explain related processes and terminology.

This section also contains the administrator checklist and workflow for deploying Network Access Protection with Configuration Manager.

Prerequisites for Network Access Protection

Lists the external and product dependencies for Network Access Protection in Configuration Manager.

Planning for Network Access Protection

Provides planning information for the Network Access Protection feature.

Configuring Network Access Protection

Provides configuration information for deploying Network Access Protection in Configuration Manager.

This section includes provisioning Active Directory Domain Services, ensuring that computers can support Network Access Protection, configuring the Network Access Protection client agent, and configuring the System Health Validator point.

Configuring the Network Policy Server for Configuration Manager

Provides configuration guidance on how to configure the Network Policy Server on Windows Server 2008, with respect to Network Access Protection in Configuration Manager.

Tasks for Network Access Protection

Provides a set of tasks to perform Network Access Protection objectives, including how to create Configuration Manager NAP policies, how to monitor Network Access Protection, and how to verify components related to Network Access Protection.

Troubleshooting Network Access Protection

Provides troubleshooting information for Network Access Protection.

Network Access Protection Security Best Practices

Provides security and privacy information and best practices for Network Access Protection.

Technical Reference for Network Access Protection

Provides technical reference information for Network Access Protection.

See Also

Other Resources

Software Updates in Configuration Manager


Overview of Network Access Protection

Network Access Protection (NAP) is a policy enforcement platform built into the Windows Vista and Windows Server 2008 operating system that allows you to better protect network assets by enforcing compliance with system health requirements.

Configuration Manager 2007 Network Access Protection lets you include software updates in your system health requirements. Configuration Manager NAP policies define which software updates to include, and a Configuration Manager System Health Validator point passes the client's compliant or non-compliant health state to the Network Policy Server. The Network Policy Server then determines whether the client has full or restricted network access, and whether non-compliant clients will be brought into compliance through remediation.

Remediation with Configuration Manager 2007 Network Access Protection requires that Configuration Manager software updates is configured and operational so that a non-compliant computer can be automatically brought into compliance. For information about configuring software updates, see Software Updates in Configuration Manager.

For more information about Network Access Protection in Windows, see the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

You can use Network Access Protection in Configuration Manager to support the following business requirements:

  • Enforce compliance of software updates as part of a phased deployment. When you have a small number of computers that have failed to install current software updates through standard mechanisms by a target date, you can use Network Access Protection policies in Configuration Manager with an effective date to configure enforced compliance for these few computers.
  • Enforce compliance of software updates as part of an expedited deployment. When you have computers that must urgently install one or more critical software updates (for example, to address a zero-day exploit), you can use Network Access Protection policies in Configuration Manager that are configured to be effective as soon as possible.

For example scenarios of how Network Access Protection can be implemented in Configuration Manager 2007 to address these requirements, see Example Scenarios for Implementing Network Access Protection in Configuration Manager.

Note
For an overview of how Network Access Protection works in Windows, see the Webcast "Introduction to Network Access Protection" (http://go.microsoft.com/fwlink/?LinkId=68775).

Click the associated link in the following section for an explanation of terms used in conjunction with this feature, and for more detailed information on how Network Access Protection works in Configuration Manager.

In This Section

About the Network Access Protection Process

Describes the processes involved when using Network Access Protection in Configuration Manager.

About Phased and Expedited Network Access Protection Deployments

Explains the two different operational scenarios for using Network Access Protection in Configuration Manager.

About the Differences Between Software Updates and Network Access Protection

Compares and contrasts the software updates feature and Network Access Protection feature in Configuration Manager.

About Enabling and Disabling Network Access Protection

Explains the implications involved when enabling or disabling Network Access Protection in Configuration Manager.

About the NAP Client Status in Network Access Protection

Explains the three different statuses a client can have in Configuration Manager with regard to Network Access Protection, which is reported on the Network Access Protection home page and in reports.

About Configuration Manager NAP Policies in Network Access Protection

Explains the term Configuration Manager NAP Policies, and how they are used in Configuration Manager.

About NAP Evaluation in Network Access Protection

Explains the process involved when a client evaluates its compliance with Configuration Manager Network Access Protection (NAP) policies.

About the NAP Effective Date in Network Access Protection

Explains the term "NAP effective date" which is used when configuring and monitoring Configuration Manager Network Access Protection (NAP) policies.

About the Statement of Health (SoH) in Network Access Protection

Explains what the statement of health is and how it is used with Configuration Manager Network Access Protection.

About System Health Validator Points in Network Access Protection

Explains what a System Health Validator point is and how this site system role is used in Configuration Manager, with a detailed breakdown of how it validates client statements of health.

About NAP Health State References in Network Access Protection

Explains what NAP health state references are and how they are used in Configuration Manager by System Health Validator points when validating compliance.

About Compliance for Network Access Protection in Configuration Manager

Explains the processes that Configuration Manager uses to determine whether a client is compliant or non-compliant.

About Enforcing Compliance with Network Access Protection

Explains how enforcing compliance with software updates using Network Access Protection relies on the configuration of the Network Policy Server.

About Network Access Protection Remediation

Explains what remediation means in the context of non-compliant Configuration Manager clients, and how these clients are remediated to be compliant.

About Network Access Protection in Configuration Manager Hierarchies

Explains any considerations to be noted if you are using Network Access Protection in a multi-site Configuration Manager hierarchy.

About Network Access Protection and Multiple Active Directory Forests

Explains the special configurations required if all your site servers and System Health Validators do not reside in the same Active Directory forest.

About Reports for Network Access Protection

Lists the reports that can be used with Network Access Protection in Configuration Manager.

Administrator Workflow: Configure Network Access Protection for Configuration Manager

Provides a flowchart to depict the steps and decisions required to implement Network Access Protection with Configuration Manager.

Administrator Checklist: Configure Network Access Protection for Configuration Manager

Provides a checklist which lists the steps required to implement Network Access Protection with Configuration Manager.

See Also

Concepts

Prerequisites for Network Access Protection
Troubleshooting Network Access Protection
Network Access Protection Security Best Practices

Other Resources

Software Updates in Configuration Manager
Planning for Network Access Protection
Configuring Network Access Protection
Configuring the Network Policy Server for Configuration Manager
Technical Reference for Network Access Protection


About the Network Access Protection Process

Use this information to understand how Configuration Manager 2007 Network Access Protection (NAP) interacts with Configuration Manager 2007 and Windows Network Access Protection, to help protect your network.

Network Access Protection with Software Updates

Configuration Manager 2007 clients that can support Network Access Protection (NAP) can assess whether they are compliant or not with the software updates you select.

Configuration Manager 2007 clients send this information in a statement of health (SoH), which is presented to the Configuration Manager 2007 System Health Validator that resides on the Configuration Manager 2007 role called the System Health Validator point.

The System Health Validator point is installed on a computer running Windows Server 2008 with the Network Policy Server role. It validates whether the client computer is compliant or non-compliant and passes the health state of that computer on to the Windows Network Policy Server.

Enforcing Compliance with Software Updates on the Network Policy Server

The Windows Network Policy Server is configured with policies that determine the action for computers that are known to be compliant, non-compliant, or not able to support NAP (NAP-ineligible).

If the health state of a NAP-capable client cannot be determined, it is deemed an error condition. By default, all error conditions are mapped to a non-compliant state, but they are split into five categories and each category can be configured to map to either compliant or non-compliant.

The action the Network Policy Server can take based on computer health states includes the following:

  • Restrict computers from accessing the full network.
  • Provide full access to the network but for a limited period.
  • Provide full access to the network indefinitely.
  • Remediate non-compliant computers to bring them into compliance with policies.
Important
Although the Network Policy Server supports remediation when it is not enforcing compliance (sometimes referred to as "reporting mode"), this is not supported by Network Access Protection in Configuration Manager 2007. This facility is supported through the standard Configuration Manager 2007 software updates feature.

It is important to realize that the Configuration Manager administrator cannot control the action that will be taken as a result of a computer health state that it passes to the Network Policy Server. However, if the Network Policy Server is configured to enforce compliance through remediation, Configuration Manager services are then used to deliver the software updates needed to bring non-compliant clients into compliance. Once successfully remediated, clients reassess their statement of health, which then changes from non-compliant to compliant, and their health state is updated to compliant.

Configuring Software Updates for Network Access Protection

You select the software updates clients must have in order to be compliant by creating Configuration Manager NAP policies. You can only select software updates that are already downloaded and packaged with the software updates feature.

Unlike software update deployments, which are targeted to collections of your choice, Configuration Manager NAP policies are automatically targeted to all computers assigned to the site. Configuration Manager NAP policies flow down the Configuration Manager hierarchy, similar to the behavior of advertisements and packages in Configuration Manager 2007. Sites that inherit the Configuration Manager NAP policies then automatically target the Configuration Manager NAP polices to clients assigned to the site.

Important
Because of this automatic targeting and inheritance throughout the hierarchy, it is important to remember that a Configuration Manager NAP policy potentially affects every client in the hierarchy.

However, unlike the behavior of advertisements and packages in a Configuration Manager 2007 hierarchy, Configuration Manager NAP policies have the following behavior:

  • Child sites cannot add their own Configuration Manager NAP policies.
  • Child sites cannot modify inherited Configuration Manager NAP policies.
  • Child sites cannot delete inherited Configuration Manager NAP policies.

See Also

Concepts

About Network Access Protection in Configuration Manager Hierarchies
About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection
Determine Your Policy Strategy for Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


About Phased and Expedited Network Access Protection Deployments

Use the following information to identify the two different operational scenarios for Network Access Protection (NAP) in Configuration Manager 2007, and how to configure them.

Phased and Expedited Scenarios

The two Network Access Protection operational scenarios are as follows:

  • Phased Deployment: As a second filter to a deployment of software updates.
  • Expedited Deployment: As an urgency measure (for example, to prevent computers from connecting to the network if they are vulnerable to a zero-day exploit).

These two operational scenarios are described below, along with how they impact the configuration of Configuration Manager NAP policies. For example scenarios, see Example Scenarios for Implementing Network Access Protection in Configuration Manager.

Phased Network Access Protection Deployments

A phased Network Access Protection deployment is a second (or later) filter to a non-urgent deployment of software updates.

In this scenario, software update deployments are created as a routine administrative task with a future deadline (for example, two weeks ahead). Additionally, software update deployments are configured to be enabled for NAP evaluation at a date later than the deployment deadline (for example, four weeks ahead). Coordination with the Network Policy Server administrator ensures that non-compliant computers are remediated either with limited network access or with full network access for a limited time. This strategy results in clients installing the software update either through Configuration Manager software updates or through Network Access Protection remediation as a second filter.

This is a phased, non-urgent deployment in which some users will install the software update ahead of the deadline, most computers will install the software update automatically through the software updates feature, and Network Access Protection is used as a failsafe measure. The phased deployment allows plenty of time for the software update to replicate to distribution points, and the network and servers will not experience performance degradation to service requests.

When these conditions apply, create Configuration Manager Network Access Protection policies as part of your software updates deployment (in the Distribute Software Updates Wizard) and configure the Network Access Protection effective date after the deadline for the deployment. Also configure your deadline with a non-aggressive schedule to allow plenty of time for all clients to receive the software update deployment and also allow for package replication to distribution points.

However, if you have administrators who manage Network Access Protection in Configuration Manager but do not manage software updates, create Configuration Manager Network Access Protection policies with the New Policies Wizard under the Network Access Protection, Policies node, and ensure coordination between the two Configuration Manager administrative roles so that a suitable effective date for the Network Access Protection policy is configured after the deadline configured for the software update deployment.

Expedited Network Access Protection Deployments

An expedited Network Access Protection deployment is created as an urgency measure (for example, to prevent computers from connecting to the network if they are vulnerable to a zero-day exploit).

An expedited deployment describes an out-of-band urgent task usually in response to a security incident, and you want to prevent NAP-capable clients from connecting to the network until they have selected software updates. When these conditions apply, create a Network Access Protection policy that identifies the critical software updates, configure the effective date as As soon as possible, and configure the System Health Validator point to ensure clients get the latest Configuration Manager Network Access Protection policies. You will also need to coordinate with the Network Policy Server administrator to ensure that non-compliant computers are remediated with restricted network access. If it is essential that only computers that are known to be compliant have full access to the network, policies on the Network Policy Server can be configured so that clients that are NAP-ineligible do not have full network access.

An expedited deployment describes an urgent scenario where the risk of computers not having the update is deemed greater than the risk of many computers being unable to connect to the network, with possibly delays or even failed remediation. The negative impact of this scenario is the result of the Configuration Manager software updates feature not having the standard time to install the software update ahead of the enforced compliance. Consequently, a high number of computers are likely to be non-compliant and the network and distribution points (and management points) undergo heavier than usual demand, which could result in remediation failure and negatively affect the performance of other network services. Additionally, the aggressive timeline might mean that the software update package hasn't yet replicated to all the distribution points, so clients might fail to locally install the software updates they need for compliance and attempt downloads from slow and unreliable network connections.

If an expedited scenario is applicable and the software update is not yet deployed, you can deploy the software update with the Distribute Software Updates Wizard, set the NAP evaluation effective date to As soon as possible and configure an automatic installation with the deadline date set as the current date and time. This deployment configuration will target the software update for clients in your selected collection, and it will be enforced on all NAP-capable clients all computers that are assigned to the site, and to all computers that are assigned to sites lower in the Configuration Manager hierarchy. If you are using the default collection All Systems, this will display all the computers that will be targeted with Configuration Manager NAP policies.

However, if you are moving from a phased Network Access Protection deployment to an expedited Network Access Protection deployment, it is much easier to create Network Access Protection policies using the New Policies Wizard from the Policies node under the Network Access Protection node, than by using the software updates feature to configure the Network Access Protection policy as a property of the software update.

Note
If you are moving from a phased Network Access Protection scenario to an expedited Network Access Protection scenario and you have Configuration Manager clients that are NAP-ineligible, modify the software update deployment so that it installs automatically with an early deadline and ensure it is targeted to a collection that includes all your NAP-ineligible clients.

See Also

Tasks

How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection
How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection

Concepts

About the Differences Between Software Updates and Network Access Protection
About Enforcing Compliance with Network Access Protection
Example Scenarios for Implementing Network Access Protection in Configuration Manager
Determine Your Policy Strategy for Network Access Protection
About Network Access Protection Remediation
About the Deploy Software Updates Wizard

Other Resources

Configuring the Network Policy Server for Configuration Manager


About the Differences Between Software Updates and Network Access Protection

Topic last updated—May 2008

Network Access Protection (NAP) in Configuration Manager 2007 is complementary to and not a replacement of the software updates feature inConfiguration Manager 2007. You must have software updates configured with software update packages before you can create Configuration Manager NAP policies.

The following table compares the two features.

Feature | Software Updates | Network Access Protection (NAP)
Requires Windows Server 2008. | No. | Yes - requires Windows Server 2008 for the NAP Windows infrastructure.
Requires additional infrastructure services and configuration outside Configuration Manager. | Yes, Windows Update Service. | Yes - requires Windows Network Policy Server and NAP enforcement mechanisms such as IPsec, 802.1X, DHCP, VPN.
Requires the Active Directory schema to be extended with Configuration Manager 2007 schema extensions, and all primary sites publishing to Active Directory Domain Services. | No. | Yes - this is required to store the health state references. However, if you have multiple Active Directory forests, you can designate a different Active Directory forest from the site server's forest.
Requires an additional Configuration Manager system role. | Yes - the software update point. | Yes - requires the System Health Validator point that runs on the computer running Windows Network Policy Server.
Installation of software updates can be enforced through remediation when the computer connects to the network. | No - computers periodically scan to see whether they require software updates in deployments targeted to them. When they have been configured with a deadline, they will be installed automatically. | Yes - although this is not under the control of Configuration Manager. Instead, it is under the control of the configuration of policies on the Windows Network Policy Server.
Computers can be granted restricted network access until the required software updates are installed. | No. | Yes - although this is not under the control of Configuration Manager. Instead, it is under the control of the configuration of policies on the Windows Network Policy Server.
Software updates can be targeted to specific computers for phased deployment. | Yes, using collections. | No - NAP policies are automatically targeted to all computers assigned to the site, and Configuration Manager NAP policies flow down the Configuration Manager hierarchy. Collections are not used for targeting.
Supported by all Configuration Manager clients. | Yes. | No - only NAP-capable clients such as Windows Vista, Windows Server 2008, and Windows XP Service Pack 3.
Client agent is enabled by default. | Yes - although sites upgraded from SMS 2003 retain existing configuration. | No.
Administrative role separation. | No - a software updates administrator can manage both software updates and NAP policies. | Yes - Configuration Manager can be configured so that administrators can manage Configuration Manager NAP policies but not software updates.

See Also

Concepts

About Enforcing Compliance with Network Access Protection
Network Access Protection Security Rights
About Network Access Protection Remediation
About Configuration Manager NAP Policies in Network Access Protection
About Phased and Expedited Network Access Protection Deployments

Other Resources

Overview of Network Access Protection
Planning for Network Access Protection
Configuring the Network Policy Server for Configuration Manager


About Enabling and Disabling Network Access Protection

Use the following information to identify key issues to take into account when enabling and disabling Network Access Protection (NAP) on a Configuration Manager 2007 site.

Important
Network Access Protection in Configuration Manager has a number of external dependencies and configuration tasks that must be completed for it to work. It is recommended that these be in place before enabling NAP in Configuration Manager. More information about these dependencies and configuration tasks can be found under the See Also section.

Enabling Network Access Protection in Configuration Manager

Enabling Network Access Protection (NAP) on a Configuration Manager 2007 site requires that you enable the Network Access Protection client agent. This will immediately enable any Configuration Manager NAP policies on the site that are either inherited from a parent site enabled for Network Access Protection or were previously created on the site before disabling Network Access Protection. Configuration Manager NAP policies are the means by which Configuration Manager clients that are NAP-capable will assess their compliance for the software updates you select.

Important
Before enabling Network Access Protection, run the report List of Network Access Protection policies. This will display any Configuration Manager NAP policies that will be automatically enabled when you enable the Network Access Protection client agent.

If you are enabling the agent on a child site, make sure that the software updates in the NAP policies are available to clients in your site.

If you are re-enabling the client agent on a site that previously created Configuration Manager NAP policies, you might need to delete old Configuration Manager NAP policies as soon as you re-enable the client agent if the software updates are no longer needed and have been deleted from distribution points.

After you have enabled Network Access Protection on a site, Configuration Manager can then report on NAP-capable computers that are assigned to the site. This includes reporting the number of computers that are in remediation for any System Health Agents you are using with your Network Access Protection deployment.

When Network Access Protection is enabled in Configuration Manager, you can create Configuration Manager NAP policies on the central or primary site. Child sites inherit Configuration Manager NAP policies from their parent site.

Note
Although enabling the Network Access Protection client agent on the site immediately enables any Configuration Manager NAP policies (and allows you to create Configuration Manager NAP policies on the central or primary site), clients will not begin NAP evaluation of policies until they next download their client policy with the new client agent setting.

Until the client receives the new client policy with the Network Access Protection client agent enabled, it will not assess its compliance with its site Configuration Manager NAP policies and will be given a health state of compliant by the System Health Validator point.

Disabling Network Access Protection in Configuration Manager

If you no longer require Network Access Protection (NAP) with Configuration Manager 2007, follow these procedures:

  1. The policies on the Windows Network Policy Servers must be reconfigured or deleted so that they do not reference the Configuration Manager System Health Validator. This can be achieved by either reconfiguring the health policies or selecting in the network policies a different health policy that does not include the Configuration Manager System Health Validator.
  2. If you are disabling Network Access Protection on all your Configuration Manager hierarchies, delete all Configuration Manager NAP policies on the central or primary site where they were created.
  3. Disable the Network Access Protection client agent. This setting will take effect on clients when they next download their client policy. This happens on the next scheduled interval (which, by default, is set to every 60 minutes but can be changed with the option Policy polling interval in the Computer Client Agent Properties: General Tab). The latest client policy can also be downloaded if requested locally on the Configuration Manager client or with a script. For more information, see How to Initiate Policy Retrieval for a Configuration Manager Client.
    Until the client receives the new client policy with the Network Access Protection client agent disabled, it will continue to assess its compliance with its site Configuration Manager NAP policies.
  4. Remove the site system role System Health Validator point from the computers running Windows Network Policy Server.

After disabling Network Access Protection, the home page will continue to show data until it is aged out and the Policies node under Network Access Protection will remain visible until you refresh the Network Access Protection node or reload the Configuration Manager console.

Important
When Network Access Protection has never been enabled for the site, the home page will not display any data except a message informing you that Network Access Protection is not enabled for the site. If you disable Network Access Protection after it has been enabled, any information relating to Network Access Protection continues to display until it ages out and there will no message informing you that Network Access Protection is now disabled.

See Also

Tasks

How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection
How to Enable the Network Access Protection Client Agent
How to Run Network Access Protection Reports
How to View Configuration Manager NAP Policies for Network Access Protection
How to Disable the Network Access Protection Client Agent

Concepts

About Latency in the Configuration Manager Console
About Network Access Protection in Configuration Manager Hierarchies
About Network Access Protection Remediation
About Configuration Manager NAP Policies in Network Access Protection
Prerequisites for Network Access Protection
About System Health Validator Points in Network Access Protection

Other Resources

Planning for Network Access Protection
Configuring the Network Policy Server for Configuration Manager


About the NAP Client Status in Network Access Protection

Topic last updated—May 2008

Use the following information to identify and understand references to the NAP client status in Configuration Manager 2007, which is displayed in reports and the Network Access Protection home page

The NAP client status in Configuration Manager 2007 indicates whether the Configuration Manager client can support Network Access Protection (NAP). Only clients that support Network Access Protection can have compliance enforced and be remediated by the Windows NAP health policy server. These computers have a NAP client status of NAP-capable.

NAP-capable clients include computers that are running Windows Server 2008, Windows Vista, and Windows XP with Service Pack 3.

Note
The NAP-capable status is derived from the operating system capability. It does not verify whether the Network Access Protection Agent service is started. It also cannot detect whether a Configuration Manager local policy has disabled the site setting that enables the Configuration Manager Network Protection client agent.

The NAP client status of NAP-upgradable identifies computers that are running Windows XP Service Pack 2. Upgrade these computers (and computers running Windows XP Service Pack 1) to Windows XP Service Pack 3 if you want to support Network Access Protection on the Windows XP operating system.

You can use software updates to upgrade computers to Windows XP Service Pack 3, or you can download the service pack from the Microsoft Download Center and use software distribution to install it on supported platforms.

Confirm the NAP status of clients by running the following Network Access Reports:

  • List of computers that can be upgraded to support NAP
  • List of NAP-capable and NAP-upgradable computers

See Also

Tasks

How to Enable the Network Access Protection Client Agent
How to Run Network Access Protection Reports

Concepts

About Enforcing Compliance with Network Access Protection
About the Network Access Protection Process
About Network Access Protection Remediation


About Configuration Manager NAP Policies in Network Access Protection

Use the following information to understand what Configuration Manager NAP policies are and their role in Configuration Manager 2007 Network Access Protection (NAP). You will need to create, configure and manage Configuration Manager NAP policies if you want to enforce software updates with Network Access Protection, and will see references to them in the Policies home page, and the Network Access Protection report List of Network Access Protection policies.

Configuration Manager NAP Policies

Configuration Manager NAP policies in Configuration Manager 2007 contain software updates that your company decides are required for compliance by a defined date (the effective date).

When you enable the Configuration Manager 2007 Network Access Protection client agent for a site, Configuration Manager NAP-capable clients assigned to that site will evaluate their compliance by using the Configuration Manager NAP policies that are created on that site or inherited from a parent site.

NAP-capable clients receive Configuration Manager NAP policies with their machine policy, which is downloaded according to the computer client agent polling interval (by default, every hour), or it can be initiated locally from the client (for example, through scripting or Configuration Manager in Control Panel).

If the validation process on the System Health Validator point discovers that the client did not evaluate with up-to-date Configuration Manager NAP policies, the System Health Validator point deems the client non-compliant, even if it is before the effective date in the Configuration Manager NAP policies. This then triggers the client to download its machine policy (which contains the latest Configuration Manager NAP policies) and re-evaluate its compliance to produce a more up-to-date client statement of health.

Applying Configuration Manager NAP policies to new Configuration Manager 2007 clients will have a natural latency until clients are successfully assigned to a site, download policy and evaluate their compliance. Until this process is complete, the client will send a compliant status in its client statement of health to the System Health Validator point.

Managing Configuration NAP Policies

For administrator tasks related to Configuration Manager NAP policies, see How to Configure Configuration Manager NAP Policies for Network Access Protection.

See Also

Tasks

How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Enable the Network Access Protection Client Agent

Concepts

About Reports for Network Access Protection
Policies Home Page
About Compliance for Network Access Protection in Configuration Manager
About the NAP Effective Date in Network Access Protection
About Enforcing Compliance with Network Access Protection
About the NAP Client Status in Network Access Protection
About NAP Evaluation in Network Access Protection
About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection


About NAP Evaluation in Network Access Protection

Use the following information to understand how Configuration Manager 2007 Network Access Protection (NAP) evaluation affects clients and how you can modify the behavior with related configuration options and tasks.

The NAP Evaluation Process

NAP evaluation in Configuration Manager 2007 is the process by which NAP-capable clients in Configuration Manager assess their compliance status and send it in a client statement of health to a System Health Validator point.

They do this by checking whether they require the software updates specified in their Configuration Manager Network Access Protection (NAP) policies by the effective date you have configured as a Configuration Manager NAP property. For more information about setting the effective date, see How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection.

Configuration Options and Tasks Related to NAP Evaluation

By default, the NAP evaluation process happens when the client attempts to connect to the network and once every day. For more information about configuring NAP evaluation options, see How to Configure NAP Evaluation Settings.

To stop NAP evaluation for a specific software update, delete the Configuration Manager NAP policy that contains the software update. For more information, see How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection.

To delay NAP evaluation for a specific software update, modify the effective date in the Configuration Manager NAP policy for a later date. For more information, see How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection.

If you want to stop all NAP-capable clients from assessing their compliance status against Configuration Manager NAP policies, disable the Network Access Protection client agent. For more information, see How to Disable the Network Access Protection Client Agent.

See Also

Concepts

About the NAP Client Status in Network Access Protection
About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection


About the NAP Effective Date in Network Access Protection

Use the following information to understand how the effective date in Configuration Manager 2007 Network Access Protection (NAP) affects clients that can support NAP, and the considerations to take into account when you are configuring it as a property of a Configuration Manager NAP policy.

Client Behavior When Effective Date Becomes Current

The effective date is when a Configuration Manager 2007 Network Access Protection (NAP) policy becomes active on NAP-capable clients, and it is displayed as a default column in the Policies node.

At that time, the client will assess its compliance status by verifying whether it requires the software update listed in the policy. If it is not compliant, the required software update can be enforced through remediation and the client might have restricted network access until remediation is successful. Remediation and restriction are controlled by policies configured on the Microsoft Windows Network Policy Server.

Considerations for Configuring the Effective Date

Because Network Access Protection in Configuration Manager 2007 is complementary to the Configuration Manager 2007 feature software updates, typically most Configuration Manager clients will have the required software updates installed through the software updates feature. Therefore, setting an effective date after the deadline of a software update deployment is a precautionary measure for the few computers that do not install the software update through standard operating procedures.

However, Network Access Protection, unlike software updates, has the ability to restrict network access (through policy configuration on the Windows Network Policy Server) until the software updates in the Configuration Manager NAP policy are installed.

Setting an aggressive effective date has the following two risks:

  • More clients might have restricted network access until remediation is successful, which in turn increases the load on remediation servers, such as distribution points hosting software updates, and software update points.
  • The software update packages containing the required software updates might not have replicated to the remediation distribution points.

You can configure the effective date in a Configuration Manager NAP policy to be a date in the future, or As soon as possible. Select As soon as possible as your effective date only if either of the following apply:

  • The Windows Network Policy Server will not restrict network access for non-compliant computers.
  • The risk of a non-compliant computer having full network access is greater than the risk of it having restricted network access and being unable to remediate in the event that the software update is not yet replicated to the remediation distribution points.

For more information about how to configure the effective date, see How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection.

See Also

Tasks

How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection
How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection
How to View Configuration Manager NAP Policies for Network Access Protection

Concepts

About the NAP Client Status in Network Access Protection
About Network Access Protection Remediation
About Configuration Manager NAP Policies in Network Access Protection
About Phased and Expedited Network Access Protection Deployments


About the Statement of Health (SoH) in Network Access Protection

Use the following information to understand how and why Configuration Manager 2007 clients use a statement of health during the Network Access Protection (NAP) process, and the information it contains.

Statement of Health Contents

In Configuration Manager 2007, all NAP-capable clients produce a statement of health (often abbreviated to SoH) when requested by the Windows Network Access Protection agent.

This statement of health always contains at least the following information:

  • The client's compliance status.
  • The client's site.
  • A time stamp reference to identify the Configuration Manager NAP policies that the client used to evaluate its compliance.

How the Statement of Health is Sent to and from the Client

The Configuration Manager 2007 client sends its statement of health to a Configuration Manager System Health Validator point to be verified before it, in turn, sends a statement of health response (SoHR) containing the client health state to the Microsoft Windows Network Policy Server (NPS).

The client health state is also sent back to the client from the Network Policy Server, in a statement of health response (SoHR).

Compliance Information in a Statement of Health

The client health state can be either compliant (in which case, the client usually has unlimited network access), or the client health state can be non-compliant (in which case, remediation can be invoked to make the client compliant).

Initially, all Configuration Manager NAP-capable clients produce a statement of health with a compliant status, even if the site is not enabled for Network Access Protection. When the site is enabled for Network Access Protection (NAP), all NAP-capable clients assigned to that site will then assess compliance through an evaluation based on any Configuration Manager NAP policies created in that site or inherited from a parent site. From then on, the client statement of health sent to the System Health Validator point can result in enforced remediation if the client is non-compliant.

Cached Statements of Health

It takes time and processing for a client to produce a statement of health, so to increase efficiency, a client statement of health is automatically cached on the client computer. The client will use a cached statement of health if the following Network Access Protection client agent option is not selected: Force a fresh scan for each evaluation. For more information, see How to Configure NAP Evaluation Settings.

The System Health Validator point will accept from clients a cached statement of health if it is within the configured Validity period and it does not conflict with the optional setting Date created must be after (UTC). For more information, see How to Specify the Validity Period for the Statement of Health and How to Specify the Option 'Date created must be after' for the Statement of Health.

Evaluation Failures Recorded in Statement of Health Messages

When the client is enabled for Network Access Protection, the statement of health the client sends to the System Health Validator point can contain a compliance status of compliant if it is compliant with the Configuration Manager NAP policies it has downloaded, or non-compliant if it is not compliant with the Configuration Manager NAP policies that it has downloaded. However, if the client is unable to successfully determine its compliance status, the client statement of health will contain the resulting client failure category and code.

When the client statement of health reaches the System Health Validator point, the System Health Validator point checks if the failure matches one of its listed known failures. If it is a known failure, the System Health Validator point sends the statement of health to the Network Policy Server with the known failure. If the failure is unknown to the System Health Validator point, the System Health Validator point sends the statement of health to the Network Policy Server with an "unknown response state" failure.

For more information about the failure categories, see Configuring Failure Categories for Configuration Manager Network Access Protection.

Validating the Statement of Health on the System Health Validator Point

Before the System Health Validator point sends the statement of health response with the client's health state to the Network Policy Server, it conducts a series of validation checks on the client statement of health it receives.

This means, for example, that a client's statement of health sent to the System Health Validator point with a compliant status can result in the System Health Validator sending a health state of non-compliant to the Network Policy Server. One example of when this can happen is if the client is compliant with the Configuration Manager NAP policies it has downloaded, but there are more up-to-date Configuration Manager NAP policies configured for the site and the client has not yet downloaded them, so its compliant status is out of date, and therefore not valid.

Note
For more information about the different scenarios in which client can send a statement of health with a compliant status, but a statement of health with a health status of non-compliant is sent to the Network Policy Server, see About Compliance for Network Access Protection in Configuration Manager.

If the System Health Validator point is unable to successfully determine the client health state, it sends to the Network Policy Server a statement of health with the encountered server failure category and code.

For a list of the validation checks the System Health Validator point performs on the client statement of health, and the order in which they processed, see System Health Validator Point: Validation Process for Network Access Protection.

Statement of Health Resent as Result of Remediation

If the client goes into remediation as a result of its non-compliant status, it will immediately produce another client statement of health, this time with the list of the Configuration Manager remediation servers (the client's management point, distribution points, and software update point) required to make it compliant. For more information about the remediation process, see About Network Access Protection Remediation.

After the client is successfully remediated, the client produces another statement of health, this time with a compliant status. The System Health Validator point verifies the client health state as compliant and passes this to the Network Policy Server. The statement of health response sent to the client this time includes the action to take for a compliant client, which is usually full access to the network for an unlimited time.

See Also

Tasks

How to Configure NAP Evaluation Settings
How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Enable the Network Access Protection Client Agent
How to Specify the Validity Period for the Statement of Health

Concepts

About Compliance for Network Access Protection in Configuration Manager
Configuring Failure Categories for Configuration Manager Network Access Protection
About Enforcing Compliance with Network Access Protection
About the NAP Client Status in Network Access Protection
About Network Access Protection Remediation
About System Health Validator Points in Network Access Protection


About System Health Validator Points in Network Access Protection

Use this information to identify how the System Health Validator point in Configuration Manager 2007 is used with Network Access Protection.

How the System Health Validator Point Interacts with Configuration Manager Clients and the Windows NAP Infrastructure

The System Health Validator point is the Configuration Manager 2007 site system role that runs on Windows Server 2008 with the Network Policy Server (NPS) role.

When using Network Access Protection (NAP) in Configuration Manager 2007, the System Health Validator point is needed to validate the statement of health from NAP-capable Configuration Manager clients to produce a client health state of compliant or non-compliant, or an error condition that prevented the health state from being determined. For more information about the statement of health, see About the Statement of Health (SoH) in Network Access Protection.

The statement of health with the client computer's health state or error condition is passed to the Network Policy Server, which then decides, based on how the connection request and network policies are configured, whether the client will have full or limited network access. If the client is non-compliant, the Network Policy Server can also enforce compliance through remediation on a restricted network or on the full network for a limited time. For more information about this process, see About Enforcing Compliance with Network Access Protection.

Validating the Client Statement of Health Messages

The System Health Validator point validates a statement of health using a sequential series of checks. These include the following:

  • Time validation when the statement of health was created.
  • Validation against the health state reference.
  • Compliance status and failures.

The System Health Validator point never communicates directly with Configuration Manager 2007 site servers to validate client statements of health. When a Configuration Manager NAP policy is created or modified, or inherited from a parent site, the site server writes a health state reference to Active Directory Domain Services. The System Health Validator point periodically retrieves the health state references for all Configuration Manager primary sites that are enabled for Network Access Protection.

Because Active Directory Domain Services is used to store the health state references, the Active Directory schema must be extended with the Configuration Manager 2007 extensions. The health state reference is published to a System Management container in Active Directory, which requires that Configuration Manager 2007 publishes site information to Active Directory Domain Services. When you have more than one Active Directory forest, and your Configuration Manager site servers and System Health Validator points are not in the same forest, you must designate which forest and domain will store the health state references.

For more information about extending the Active Directory schema for Configuration Manager 2007, and configuring the site to publish to Active Directory Domain Services, see the following topics:

  • How to Extend the Active Directory Schema for Configuration Manager
  • How to Publish Configuration Manager Site Information to Active Directory Domain Services

For more information about designating a forest and domain to store the health state references, see Decide Which Forest Will Publish Health State References for Network Access Protection.

The Validation Process

This section steps through the sequential checks a NAP-capable client undergoes when the System Health Validator point processes the client's statement of health. This process is also depicted with the following flowchart:

System Health Validator Point: Validation Process for Network Access Protection

  1. The first check is whether the client has just been deployed and hasn't yet downloaded the machine policy that will determine whether the Network Access Protection client agent is enabled and which Configuration Manager NAP policies have been defined. Without this policy, Configuration Manager cannot determine whether the client requires software updates, or even if it should have its health state checked. The client is deemed compliant so that it can access the network to download its machine policy. When the client has received its site policy, it immediately sends a new statement of health to be re-evaluated as a fully functional client.
  2. The next check to be made by the System Health Validator point if it determines the client has successfully downloaded its machine policy is to validate the client identity. To do this, it uses the health state reference it periodically retrieves from Active Directory Domain Services. The System Health Validator point checks the identity of the client's Configuration Manager 2007 site so that it can verify that the client is from a known Configuration Manager 2007 site in the hierarchy. If this check fails, the System Health Validator point passes a status of "unknown" to the Windows Network Policy Server, which maps to the Configuration Manager System Health Validator category SHA vendor specific error code received on the Network Policy Server. By default, the category SHA vendor specific error code received is configured as non-compliant, but it can be configured as compliant.
  3. If the client's site is confirmed, the System Health Validator point then confirms whether the Network Access Protection client agent is enabled or disabled on the client. A NAP-capable client with the Network Access Protection client agent disabled will still send a statement of health with Configuration Manager 2007 Network Access Protection. A NAP-capable client that has the Network Access Protection client agent disabled after the previous checks complete will be deemed compliant by the System Health Validator point, and its health state is set to compliant.
  4. The next checks made by the System Health Validator point if the Network Access Protection client agent is enabled are time validation using the settings configured in the System Health Validator point properties. If the Date created must be after option is set, the System Health Validator point checks whether the client's statement of health was created before or after this date. If it was created on the same or earlier date than the configured setting, the client health state is set to non-compliant. If the statement of health was created on a later date than the configured setting on the System Health Validator point, the System Health Validator point then checks whether the client statement of health is older than the Validity period configured on the System Health Validator point. If the statement of health is older than the configured validity period, the client health state is set to non-compliant.
  5. If the System Health Validator confirms that the statement of health is not older than the configured validity period, the System Health Validator point then uses the health state reference to determine whether the client used up-to-date Configuration Manager NAP policies when it evaluated its statement of health. It does this by comparing the time stamp in the health state reference with the time stamp included in the statement of health's compliance information. The time stamp indicates when the Configuration Manager NAP policies were last created or modified. If the time stamp in the health state reference is later than the time stamp in the statement of health, the client health state is set to non-compliant.
  6. If the time stamp in the statement of health is later than or the same as the time stamp in the health state reference, the client compliance status in the statement of health is then checked. If the statement of health contains a compliant status, the System Validator point sets the client health state to compliant. But if the statement of health does not contain a compliant status, the System Health Validator point checks whether a failure occurred on the client to prevent it from producing a compliant status. This condition results in setting one of two failure categories and an error code. If there are no failures, the System Health Validator point sets the client health state to non-compliant.
  7. If the failure category and code are set, the System Health Validator point checks whether the code matches one of its known codes. If there is a successful match, it passes the failure category to the Network Policy Server, which then maps the failure category to one of two client failure categories configured on the Configuration Manager System Health Validator. By default, both failure categories are configured on the Configuration Manager System Health Validator to give the client a non-compliant health state, but they can be configured to compliant. However, if no match is found for the error code, the System Health Validator point passes the failure on to the Network Policy Server under the failure category of SHA vendor specific error code received. This is also configurable on the Configuration Manager System Health Validator, and by default this is configured to give the client a health state of non-compliant.

When non-compliant clients are configured for NAP enforcement and remediation on the Network Policy Server, the System Health Validator point might send instructions to the client, depending on which check failed. If the time validation for the statement of health failed, the System Health Validator point instructs the client to re-evaluate its statement of health and then present a new statement of health. If the time stamp check failed with the health state reference, the System Health Validator point instructs the client to download its machine policy from its management point, re-evaluate its compliance status with the latest Configuration Manager NAP policies, and then present a new statement of health.

If the compliant check failed, the System Health Validator point instructs the client to log this failure. The System Health Validator point supplies the client with static routes to the distribution points that host the software updates the client is missing for compliance. The client installs each software update required, and when these are successfully installed, it then presents a new statement of health.

When the new statement of health is created, the System Health Validator point completes the same validation checks. If each validation criteria now passes the check, the System Health Validator point sets the health state as compliant, which is passed to the Network Policy Server.

See Also

Tasks

How to Create a Configuration Manager NAP Policy for Network Access Protection

Concepts

About Compliance for Network Access Protection in Configuration Manager
About Network Access Protection and Multiple Active Directory Forests
About NAP Health State References in Network Access Protection
About Network Access Protection in Configuration Manager Hierarchies
Network Access Protection Failure Categories and Error Codes
About Network Access Protection Remediation
About Configuration Manager NAP Policies in Network Access Protection
About the Statement of Health (SoH) in Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection

Other Resources

How to Configure the System Health Validator Point for Network Access Protection


About NAP Health State References in Network Access Protection

Use this information to understand how Configuration Manager Network Access Protection (NAP) health state references are used in Configuration Manager 2007, and why you might need to consider their use and configuration in Configuration Manager.

How Health State References are Created, Modified and Retrieved

Configuration Manager (NAP) health state references in Configuration Manager 2007 are stored in Active Directory's System Management container and are used by System Health Validator points when validating client statements of health.

The health state references are published by each site server in the hierarchy, and they are updated when a Configuration Manager Network Access Protection (NAP) policy is created, modified, or inherited from a parent site.

The health state references are then periodically retrieved by the System Health Validator point, cached, and then used during the validation process.

How Health State References Are Used During Compliance Validation

The health state reference is used to verify a client's Configuration Manager site and verifies whether the client used up-to-date Configuration Manager NAP policies when it assessed its compliance with the software updates specified in the Configuration Manager NAP policies.

When a statement of health has been validated by a System Health Validator point, the client's health state is then passed to the Microsoft Windows Network Policy Server (NPS) as either compliant or non-compliant, or with a failure.

The site server publishes the health state reference to a domain controller, using Lightweight Directory Access Protocol (LDAP) (port 389 or 636). This reference is then replicated to the global catalog, and the System Health Validator point retrieves the health state reference with a global catalog query (port 3268 or 3269).

By default, Configuration Manager health state references are published in the site server's Active Directory forest, and retrieved from the System Health Validator points' Active Directory forest. When the site server and System Health Validators do not reside in the same Active Directory forest, you must specify the location of the Configuration Manager health state references. For more information, see About Network Access Protection and Multiple Active Directory Forests and How to Specify the Location of the NAP Health State Reference.

Note
When implementing Configuration Manager Network Access Protection across Active Directory sites, be mindful of Active Directory replication latency. For example, although the site servers publish the Configuration Manager health state reference to a domain controller when Configuration Manager NAP policies are modified, this new data might not be immediately available for retrieval by the System Health Validator point until Active Directory replication has completed.

For this reason, do not enable the Network Access Protection client agent immediately on new Configuration Manager sites, but wait until the Configuration Manager site information has replicated to global catalog servers used by the System Health Validator points. This is particularly important if your Windows Network Policy Server will give non-compliant clients limited network access.

See Also

Tasks

How to Configure the System Health Validator Active Directory Domain Services Query Interval
How to Install the System Health Validator Point
How to Specify the Health State Reference Publishing Account
How to Specify the Health State Reference Querying Account
How to Specify the Location of the NAP Health State Reference

Concepts

About Compliance for Network Access Protection in Configuration Manager
About Network Access Protection and Multiple Active Directory Forests
About Network Access Protection in Configuration Manager Hierarchies
About Configuration Manager NAP Policies in Network Access Protection
About the Statement of Health (SoH) in Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection
About System Health Validator Points in Network Access Protection


About Compliance for Network Access Protection in Configuration Manager

Use the following information to understand how Configuration Manager 2007 determines compliance with software updates for Network Access Protection (NAP). This information will help you prepare your implementation of Network Access Protection and troubleshoot situations when the compliance results are not as expected.

Compliance as a Multi-Staged Process

Determining compliance for Configuration Manager Network Access Protection (NAP) is multi-staged process:

  • The NAP-capable Configuration Manager client evaluates whether it has all the required software updates by their effective date. The client passes this compliant or non-compliant information to the System Health Validator point in its statement of health. If the evaluation fails, the client sends failure information in the statement of health.
  • The System Health Validator point then validates the client's statement of health, using a series of compliance criteria. The validation process uses the Configuration Manager health state reference published to Active Directory Domain Services, and the System Health Validator point configured settings.
  • In some situations, the validation criteria are not suffient for the System Health Validator point to determine whether the client is compliant or non-compliant. This can happen if the client is unknown or an error occurs. The configuration of the System Health Validator on the Network Policy Server then determines if the client is compliant or non-compliant. The default configuration is non-compliant.

Why a Client That Has Required Software Updates Might Be Non-Compliant

Using up to three stages of compliance checking provides Configuration Manager with a sophisticated but efficient method of detecting whether a client is compliant with software updates. However, it can introduce some complexity for administrators who want to understand why a client was reported as non-compliant. For example, although clients that require software updates are always given a health state of non-compliant by a System Health Validator point, clients that do have all the required software updates might be reported as non-compliant by the System Health Validator.

Situations in which a client has all the required software updates, but is deemed non-compliant include the following:

  • If the client site is not known to the System Health Validator point, the client will be given an unknown status rather than compliant or non-compliant. This error condition happens when the System Health Validator point cannot find a health state reference for the site name and code in the client's statement of health. This could occur because a new Configuration Manager site was installed and Active Directory replication is not complete. It can also occur when a client is outside its Configuration Manager hierarchy. The error condition "unknown" maps to the failure category of SHA vendor specific error code received on the System Health Validator on Windows Network Policy Server, which by default is configured as non-compliant. However, this failure category can be configured for either compliant or non-compliant.
  • If any errors occur during validation, a compliant status from the client can change to one of the two server failure categories. By default, both server failure categories are configured as non-compliant on the System Health Validator on Windows Network Policy Server, but both of these can be configured as either compliant or non-compliant.
  • If any of the following validation checks fail, a client that is compliant with its Configuration Manager NAP policies will be deemed non-compliant:
    • The statement of health from the client is older than the System Health Validator point setting for the option Date created must be after. In this scenario, it is likely that new and important Configuration Manager NAP policies were configured, and it is imperative that the client assesses its compliance with the latest Configuration Manager NAP policies.
    • The statement of health from the client is not within the System Health Validator point setting for the option Validity period. In this scenario, the client is using a cached statement of health. If the client reassesses its compliance again, it might no longer be compliant (for example, if software updates have been uninstalled).
    • The client did not evaluate its compliance using up-to-date Configuration Manager NAP policies. In this scenario, the policy time stamp in the client's statement of health is older than the time stamp in the health state reference, which indicates that there have been changes made to the Configuration Manager NAP policies since the client last downloaded its Configuration Manager NAP policies.

Remediation Steps for a Client That Has Required Software Updates

When the client is compliant with its Configuration Manager NAP policies, but non-compliant with the System Health Validator criteria, successful remediation consists of the following steps in sequence:

  • If the client hasn't evaluated against the latest Configuration Manager NAP policies, the client is instructed to download its machine policy, which includes the Configuration Manager NAP policies.
  • The client re-evaluates its compliance and sends a new statement of health to the System Health Validator point.
  • If the status is still compliant and all the validation checks pass, the client will be given a health state of compliant.

See Also

Tasks

How to Specify the Option 'Date created must be after' for the Statement of Health
How to Specify the Validity Period for the Statement of Health

Concepts

Configuring Failure Categories for Configuration Manager Network Access Protection
About the NAP Effective Date in Network Access Protection
About NAP Health State References in Network Access Protection
About Configuration Manager NAP Policies in Network Access Protection
About the Statement of Health (SoH) in Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection
About System Health Validator Points in Network Access Protection


About Enforcing Compliance with Network Access Protection

Use the following information to understand how software updates in Configuration Manager 2007 can be enforced with Network Access Protection, and identify the coordination required between configuration in Configuration Manager and configuration on the Network Policy Server.

The Interaction between Network Access Protection in Configuration Manager and Network Policy Server

Network Access Protection (NAP) in Configuration Manager 2007 works in conjunction with Microsoft Windows Network Policy Server to enforce compliance of selected software updates on clients that are capable of supporting Network Access Protection (NAP-capable clients), such as Windows Vista.

Configuration Manager by itself does not enforce compliance with Network Access Protection; it provides the means by which Configuration Manager clients can produce a statement of health with a non-compliant status if they do not have the required software updates in the Configuration Manager NAP policies you configure. A Configuration Manager System Health Validator point confirms the health state of the computer as compliant, or non-compliant and passes this information to the Network Policy Server. Policies on the Network Policy Server then determine whether non-compliant computers will be remediated and, additionally, whether they will have restricted network access until they are compliant.

Remediation is the mechanism of making a non-compliant computer compliant to ensure that clients conform to compliance policies. Configuration Manager remediation uses the software update packages you have already created, with the software updates feature.

For more information about coordinating the configuration of Network Access Protection so that compliance with software updates can be enforced, see Determine Administrator Roles and Processes for Network Access Protection.

Enforcing Compliance for Clients That Cannot Support NAP (NAP-Ineligible Clients)

NAP-ineligible clients cannot produce a statement of health and therefore cannot have compliance enforced through Network Access Protection.

However, you can still target those computers with the required software updates using software update deployments with a deadline. If the software update is still required by the deadline, it will be installed automatically.

However, unlike Network Access Protection, the software updates feature cannot restrict access to the network until computers are compliant.

For a comparison of software updates and Network Access Protection, see About the Differences Between Software Updates and Network Access Protection.

See Also

Concepts

About Compliance for Network Access Protection in Configuration Manager
About the NAP Client Status in Network Access Protection
Determine Your Policy Strategy for Network Access Protection
About Network Access Protection Remediation
About System Health Validator Points in Network Access Protection


About Network Access Protection Remediation

Use the following information to understand how remediation works in Configuration Manager 2007 Network Access Protection, and how it affects Configuration Manager clients.

The Remediation Process

Remediation in Network Access Protection (NAP) is the means by which clients with a non-compliant health state are brought to a compliant state. Remediation in Configuration Manager 2007 occurs when the network policies on the Microsoft Windows Network Policy Server (NPS) enforce Network Access Protection (NAP) for non-compliant clients. It involves one of the following actions:

  • The client produces a current statement of health.
  • The client downloads the latest Configuration Manager NAP policies, re-evaluates compliance, and produces a current statement of health.
  • The client installs software updates required for compliance, re-evaluates compliance, and produces a current statement of health

Configuration Manager 2007 functionality other than remediation is not supported on the restricted network.

Configuration Manager 2007 remediation can occur when the client has limited network access or full network access for a limited time. When remediation is successful, the client then has full network access if its health state remains compliant.

Important
If the Network Policy Server allows full network access (reporting mode), Configuration Manager 2007 will not remediate on the unrestricted network. This facility is supported through standard Configuration Manager 2007 software updates.

Additionally, if the Network Policy Server is enforcing health policies, Configuration Manager 2007 will always remediate non-compliant computers even if the option on the Network Policy Server Enable auto-remediation of client computers is not enabled.

Remediation Servers

Configuration Manager 2007 remediation servers are the servers that have resources required by clients to become compliant and are the following:

  • The client's management point when the client needs to download the latest Configuration Manager NAP policies.
  • The client's software update point.
  • Distribution points that host the software update packages containing required software updates when the client is non-compliant. The software updates required for compliance are installed with a high priority.

Remediation servers must be configured in a Remediation Server Group on the Network Policy Server if you are using DHCP enforcement. They usually include infrastructure servers such as DNS, WINS, and domain controllers. However, do not add Configuration Manager 2007 remediation servers to Remediation Server Groups because they will be dynamically supplied by a client undergoing remediation.

Remediation Restarts and Retries

If a software update installed through remediation requires a computer restart, the restart is queued until all the software updates required for compliance have been installed. Another restart scenario is when a particular software update requires a restart before installing the software updates required for remediation (service packs often have this requirement).

In these restart scenarios, if remediation occurs on the restricted network, the user is informed that the restart will automatically take place and will see a countdown so that she can save any work. When remediation occurs when the client has full network for a limited time, the user is informed that a restart is needed with a prompt to restart or cancel. If the user cancels, remediation is not complete and the compliance status will remain as non-compliant until the software update installation has completed.

If the client encounters remediation failures, it will retry in the background in case transient conditions are responsible for the failure. If the client cannot connect to the remediation servers it needs, or if it fails to successfully download content, it will retry after 1 minute, then after 2 minutes, after 4 minutes, and continues to retry exponentially until it has tried 8 times over a period of 256 minutes. These retry attempts occur automatically in the background, and they are not configurable properties for Configuration Manager 2007 Network Access Protection.

See Also

Concepts

About Compliance for Network Access Protection in Configuration Manager
About Enforcing Compliance with Network Access Protection
Decide If You Need Additional Distribution Points for Network Access Protection Remediation
About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager


About Network Access Protection in Configuration Manager Hierarchies

Use the following information to understand any implications of implementing Network Access Protection (NAP) in a Configuration Manager 2007 multi-site hierarchy and how this affects the behavior of Configuration Manager NAP policies and roaming clients.

Enable Parent Sites for Network Access Protection before Child Sites

When you implement Network Access Protection (NAP) in a Configuration Manager multi-site hierarchy, enable it in a top-down manner. Create Configuration Manager NAP policies on the central site or primary site where you deploy software updates. Configuration Manager NAP policies automatically flow down the hierarchy.

If you enabled Network Access Protection on a child site first, created Configuration Manager NAP policies, and then enabled Network Access Protection on a site higher in the hierarchy, this results in the following scenarios:

  • If the same Configuration Manager NAP policies are created on the parent site with the same software updates but with different effective dates, the Configuration Manager NAP policies at the child site (and inherited by further child sites) will be overwritten with the new Configuration Manager NAP policies created at the parent site, and the child site cannot modify or delete them.
  • If the parent site doesn't create the same Configuration Manager NAP policies that were created on the child site, the original Configuration Manager NAP policies remain at the child site (and are inherited by further child sites). These Configuration Manager NAP policies can still be modified and deleted at the child site, but new Configuration Manager NAP policies cannot be created at the child site.

If a child site is not enabled for Network Access Protection, you will not be able to view the NAP policies with the Policies node, but running the following report will list them: List of Network Access Protection policies.

Child Site Behavior with Network Access Protection

If your Configuration Manager hierarchy consists of more than two levels of primary sites, disabling Network Access Protection on a child primary site does not block the inheritance of Configuration Manager NAP policies from the parent site to the grandchild site.

You will not be able to modify or delete NAP policies that are inherited from a parent site, and you cannot create NAP policies if the site is inheriting policies from a parent site. However, you can disable Network Access Protection on a child site that has inherited NAP policies.

Network Access Protection and Roaming

When a Configuration Manager NAP-capable client with the Network Access Protection client agent enabled roams to a different Configuration Manager site, it still assesses its compliance status based on the Configuration Manager NAP policies defined in its own site.

The System Health Validator point to which the client passes its client statement of health is dependent not on the Configuration Manager site, but on the underlying Network Access Protection enforcement mechanism. This means that a change of network location might result in the client using a different System Health Validator point when it roams into a different site (for example, if you are using DHCP as your Network Access Protection enforcement).

A roaming NAP-capable client from a Configuration Manager site that isn't enabled for Network Access Protection and is directed to use a site's System Health Validator point will be deemed compliant by the System Health Validator point. In this scenario, the System Health Validator point will increment its SHV Validator Performance counter, Configuration Manager NAP Client Agent Disabled.

System Health Validator points within a Configuration Manager site share the same configuration options, which are used to determine a client's health state. These configuration options are the following:

  • How often the health state reference is retrieved.
  • If the client statement of health needs to be created after a specified date and time.
  • The validity period for the statement of health.

Differences in these configurations between sites in the same Configuration Manager hierarchy can result in a different health state for a client that is compliant with its Configuration Manager NAP policies.

Important
A Configuration Manager client with the Network Access Protection client agent enabled could roam into a different Configuration Manager hierarchy and have its client statement of health validated by a System Health Validator point from outside its Configuration Manager hierarchy. In this scenario, the validation process will fail the site check unless the NAP health state references for both hierarchies publish to the same location.

If the System Health Validator point cannot verify the client's site, this will result in a client health state of unknown, which by default is configured on the Network Policy Server as non-compliant. If the Network Policy Server has network policies configured for limited access for Network Access Protection, these clients cannot be remediated and risk being unable to access the full network. To address this scenario, an exemption policy on the Network Policy Server could give Configuration Manager clients that roam outside their Configuration Manager hierarchy full network access.

See Also

Tasks

How to Configure the System Health Validator Active Directory Domain Services Query Interval
How to Specify the Option 'Date created must be after' for the Statement of Health
How to Specify the Validity Period for the Statement of Health
How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Disable the Network Access Protection Client Agent
How to Enable the Network Access Protection Client Agent
How to Run Network Access Protection Reports
How to View Configuration Manager NAP Policies for Network Access Protection

Concepts

About Compliance for Network Access Protection in Configuration Manager
About NAP Health State References in Network Access Protection
How to Monitor the System Health Validator Point with Performance Counters for Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection
About System Health Validator Points in Network Access Protection
Configuring Exemption Policies for Configuration Manager Network Access Protection


About Network Access Protection and Multiple Active Directory Forests

Use the following information to understand the implications of implementing Network Access Protection (NAP) in Configuration Manager 2007 when your Configuration Manager hierarchy spans more than one Active Directory forest, and identify the supported scenarios for this environment.

Why Multiple Forests Affect Network Access Protection in Configuration Manager

When you are using Network Access Protection (NAP) in Configuration Manager 2007 and your Configuration Manager hierarchy spans more than one Active Directory forest, there are additional configuration requirements. This is because Network Access Protection in Configuration Manager stores health state references in Active Directory. When you create or modify a Configuration Manager NAP policy, the site server publishes or publishes updates to Configuration Manager health state reference in Active Directory.

When a child site inherits Configuration Manager NAP policies from a parent site, that child site's site server also publishes its health state reference to Active Directory. These health state references are then retrieved from Active Directory by the System Health Validator points querying a global catalog server.

By default, site servers publish to their own Active Directory forest and System Health Validator points retrieve the health state references from their own Active Directory forest. So if your site servers and System Health Validator points are not in the same Active Directory forest, you must designate the Active Directory forest and domain that will store the health state references. This designation can even be a completely different forest than both the site servers and System Health Validator points.

The Active Directory forest that stores the Configuration Manager health state references must have been extended with the Configuration Manager 2007 schema extensions; site servers must be configured to publish identity data to Active Directory if their site is enabled for Network Access Protection; and there must be a System Management container in the designated forest that has the appropriate permissions needed by the site servers and System Health Validator points.

Note
For information about how to extend the schema and enable publishing for Configuration Manager 2007 , see How to Extend the Active Directory Schema for Configuration Manager) and How to Publish Configuration Manager Site Information to Active Directory Domain Services.

Supported Scenarios for Multiple Forests

The configuration steps that must be taken for multiple Active Directory forests depend on the topography, the existing configuration, and the decision on where to publish the Configuration Manager 2007 health state references. The following lists four basic scenarios that are supported in Configuration Manager when site servers reside in one Active Directory forest, and all System Health Validator points reside in another Active Directory forest:

  • The Configuration Manager health state references are published to the forest that contains the site servers.
  • The Configuration Manager health state references are published to the forest that contains the System Health Validator points.
  • The Configuration Manager health state references are published to a third Active Directory forest that has trust relationships with the other two forests (either a forest trust or external domain trusts).
  • The Configuration Manager health state references are published to a third Active Directory forest that has no trust relationships with the other two forests (neither a forest trust nor external domain trusts).

To help you decide which forest will publish the health state references, see Decide Which Forest Will Publish Health State References for Network Access Protection.

For procedural steps on how to provision Active Directory and the additional configuration steps required in Configuration Manager when using Network Access Protection across multiple forests, see How to Deploy Network Access Protection Across Multiple Forests.

See Also

Tasks

How to Install the System Health Validator Point
How to Publish Configuration Manager Site Information to Active Directory Domain Services

Concepts

About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


About Reports for Network Access Protection

Use the following information to help you identify which Network Access Protection (NAP) reports to use to help you plan, deploy, monitor, and troubleshoot its implementation with Configuration Manager 2007.

For information about running these reports, see How to Run Network Access Protection Reports.

Planning reports for Network Access Protection:

  • List of computers that would be non-compliant based on selected software updates
  • List of computers that can be upgraded to support NAP
  • List of NAP-capable and NAP-upgradable computers

Deployment reports for Network Access Protection:

  • List of Network Access Protection policies

Monitoring reports for Network Access Protection:

  • List of software updates installed through remediation
  • Comparison of software updates installed by software update deployments and NAP remediation
  • List of computers that installed a specific software update through remediation during a specified period
  • List of non-compliant computers in remediation from last polling interval
  • List of non-compliant computers in remediation within a specified period
  • Summary of non-compliant computers in remediation from last polling interval
  • Summary of non-compliant computers in remediation within a specified period
  • Frequency a computer has been in remediation within a specified period

Troubleshooting reports for Network Access Protection:

  • List of remediation failures for specified time period

See Also

Tasks

How to Run Network Access Protection Reports
How to View Configuration Manager NAP Policies for Network Access Protection

Concepts

About Enforcing Compliance with Network Access Protection
About the NAP Client Status in Network Access Protection
About Network Access Protection Remediation
About Phased and Expedited Network Access Protection Deployments


Administrator Workflow: Configure Network Access Protection for Configuration Manager

This administrator workflow displays the recommended steps to configure Network Access Protection (NAP) for Configuration Manager 2007.

For information about each step of the workflow, see the following topic: Administrator Checklist: Configure Network Access Protection for Configuration Manager.

Administrator workflow for NAP in ConfigMgr

See Also

Other Resources

Network Access Protection in Configuration Manager
Administrator Checklist: Configure Network Access Protection for Configuration Manager


Administrator Checklist: Configure Network Access Protection for Configuration Manager

Topic last updated—May 2008

The following checklist provides the steps necessary to prepare for Network Access Protection (NAP) in Configuration Manager 2007, as well as to install, configure, monitor, and troubleshoot Network Access Protection in Configuration Manager 2007.

Note
For the latest information about designing, configuring and implementing the Network Access Protection infrastructure, refer to the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

Use this checklist with the Administrator Workflow: Configure Network Access Protection for Configuration Manager.

Step Reference

Review concepts for both Microsoft Windows Network Access Protection (NAP) and Configuration Manager 2007.

White paper: "Introduction to Network Access Protection" (http://go.microsoft.com/fwlink/?LinkId=60752) on the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

Understanding Configuration Manager Features.

Overview of Network Access Protection

Ensure that the applicable Network Access Protection architecture is implemented.

White paper: "Network Access Protection Platform Architecture" (http://go.microsoft.com/fwlink/?LinkId=60753) on the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

If DHCP is being used with Network Access Protection, ensure that the following steps are complete:

  • Network Access Protection is enabled on the DHCP servers.
  • Clients have the DHCP enforcement client started.
  • The Network Policy Server is installed and configured for DHCP enforcement.
  • Clients have the Network Access Protection Agent service started and set to automatic

Step-by-Step guide: "Setting Up Dynamic Host Configuration Protocol Enforcement for Network Access Protection in a Test Lab" on the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

If IPsec is being used with Network Access Protection, ensure that the following steps are complete:

  • Certificate Services, the Health Registration Authority, and IIS are all operational.
  • Clients have the IPsec enforcement client started.
  • The Network Policy Server is installed and configured for IPsec enforcement.
  • Clients have the Network Access Protection Agent service started and set to automatic.
  • Clients have Trusted Server Groups configured under Health Registration Settings, using the NAP Client Configuration snap-in.
  • The following Configuration Manager 2007 remediation servers are configured as boundary servers:
    • Management points
    • Software Update points
    • Distribution points that host software update packages
Note
Infrastructure servers such as domain controllers, DNS servers, and WINS servers should also be configured as boundary servers.

Step-by-Step guide: "Setting Up Internet Protocol Security Enforcement for Network Access Protection in a Test Lab" on the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

If a virtual private network (VPN) is being used with Network Access Protection, ensure that the following steps are complete:

  • Certificate Services and Routing and Remote Access are operational.
  • Clients have the VPN enforcement client started.
  • The Network Policy Server is installed and configured for VPN enforcement.
  • Clients have the Network Access Protection Agent service started and set to automatic.

Step-by-Step guide: "Setting Up Virtual Private Network Enforcement for Network Access Protection in a Test Lab" on the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

If 802.1X is being used with Network Access Protection, ensure that the following steps are complete:

  • An 802.1X compliant switch or access point which supports the use of RADIUS tunnel attributes is installed and configured for 802.1X authentication.
  • Clients have the EAP enforcement client started.
  • The Network Policy Server is installed and configured for 802.1X enforcement.
  • Clients have the Network Access Protection Agent service started and set to automatic.
  • In a wired configuration, clients have the Wired AutoConfig service started and set to automatic.
  • In a wireless configuration, clients have the WLAN AutoConfig service started and set to automatic.
  • Clients have enabled and configured 802.1X authentication on network connections.

Step-by-Step guide: " Step By Step Guide: Demonstrate 802.1X NAP Enforcement in a Test Lab" on the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125).

Ensure that Active Directory Domain Services is provisioned for Configuration Manager 2007 by extending the schema, and ensure that sites are successfully publishing to Active Directory Domain Services.

How to Verify Active Directory has been Provisioned for Network Access Protection

How to Extend the Active Directory Schema for Configuration Manager

How to Publish Configuration Manager Site Information to Active Directory Domain Services

In Configuration Manager 2007, install the Configuration Manager System Health Validator points on Windows Server 2008 operating system with the server role of Network Policy Servers and configured as a NAP health policy server.

How to Install the System Health Validator Point

If your Configuration Manager 2007 site servers and System Health Validator points are not in the same Active Directory Domain Services forest, in Configuration Manager 2007 configure the Configuration Manager health state references.

How to Specify the Location of the NAP Health State Reference

How to Specify the Health State Reference Publishing Account

How to Specify the Health State Reference Querying Account

In Configuration Manager 2007, verify that you have clients that are NAP-capable and upgrade them if necessary.

About the NAP Client Status in Network Access Protection

In Configuration Manager 2007, verify that your Configuration Manager software updates infrastructure is configured and operational.

Administrator Checklists for Software Updates

On the Network Policy Server, ensure that the Configuration Manager System Health Validator is configured as appropriate for each error code resolution.

Configuring Failure Categories for Configuration Manager Network Access Protection

On the Network Policy Server, ensure that there are health policies that reference the Configuration Manager System Validator for both compliant and non-compliant Configuration Manager 2007 clients.

Configuring Health Policies for Configuration Manager Network Access Protection

On the Network Policy Server, if you are using DHCP or VPN enforcement, ensure that there is a Remediation Server Group for the infrastructure servers required for Configuration Manager remediation.

Configuring Remediation Server Groups for Configuration Manager Network Access Protection

On the Network Policy Server, ensure that there are connection request and network policies for clients that are compliant and non-compliant, and for clients that cannot support Network Access Protection (NAP-ineligible).

Configuring Connection Request Policies for Configuration Manager Network Access Protection

Configuring Network Policies for Configuration Manager Network Access Protection

In Configuration Manager 2007, enable Network Access Protection.

How to Enable the Network Access Protection Client Agent

In Configuration Manager 2007, create Configuration Manager NAP policies.

How to Create a Configuration Manager NAP Policy for Network Access Protection

In Configuration Manager 2007, monitor Network Access Protection.

View the Network Access Protection home page with the Network Access Protection node.

Network Access Protection Home Page

How to Run Network Access Protection Reports

How to Monitor the System Health Validator Point with Performance Counters for Network Access Protection

In Configuration Manager 2007, troubleshoot Network Access Protection as needed.

Troubleshooting Network Access Protection Issues

Troubleshooting Network Access Protection

See Also

Concepts

Administrator Workflow: Configure Network Access Protection for Configuration Manager

Other Resources

Network Access Protection in Configuration Manager


Prerequisites for Network Access Protection

Topic last updated—May 2008

Network Access Protection (NAP) in Configuration Manager 2007 creates external dependencies as well as dependencies within the product.

Dependencies External to Configuration Manager 2007

Dependency More Information

Network Access Protection (NAP) enforcement technology installed and configured appropriately for one or more of the following: DHCP, IPsec, VPN, or 802.1X.

Note
All Windows NAP enforcement solutions require Windows Server 2008.

Documentation published on the Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125)

One or more Network Policy Servers configured appropriately with remediation server groups, health policies, connection request policies, and network policies.

Configuring the Network Policy Server for Configuration Manager

NAP-capable clients (such as Windows Vista, Windows Server 2008, or computers running Windows XP Service Pack 3).

About the NAP Client Status in Network Access Protection

Perimeter devices are configured to allow traffic between communicating servers.

Determine the Ports Required by Firewalls to Support Network Access Protection

Configuration Manager 2007 Dependencies

Dependency More Information

The site must be running Configuration Manager 2007 and be enabled for Network Access Protection.

To enable the site for Network Access Protection, you must enable the Network Access Protection client agent. This client agent is not enabled by default.

For more information, see How to Enable the Network Access Protection Client Agent.

Note
You do not need to enable the software updates client agent to support Network Access Protection in Configuration Manager 2007.

Clients must be Configuration Manager 2007.

Clients running Systems Management Server (SMS) 2003 are not supported.

An Active Directory forest has the schema extended with the Configuration Manager schema extensions, and it is provisioned with a System Management container in at least one domain.

The site server publishes Configuration Manager NAP health state references to Active Directory Domain Services, and these are retrieved by the System Health Validator point. Publishing to Active Directory Domain Services requires that the schema is extended, but you can elect which forest to use.

For more information, see About Network Access Protection and Multiple Active Directory Forests

The Configuration Manager sites enabled for Network Access Protection are configured to publish site information to Active Directory Domain Services.

How to Publish Configuration Manager Site Information to Active Directory Domain Services

The installation of at least one System Health Validator point on Windows Server 2008, that has the server role of Network Policy Server.

How to Install the System Health Validator Point

Note
Although the System Health Validator can be installed in a different Active Directory forest than the site server's forest, it must be installed in a domain and is not supported in a workgroup.

The software updates feature is configured and has software update deployment packages.

Although the software updates client agent does not need to be enabled on the site, you must have in place the software updates infrastructure, such as a software update point and software update deployment packages hosted on distribution points.

For more information, see the following topics:

Configuring Software Updates

How to Create a Deployment Package

Reporting Point Site System

The reporting point site system role must be installed before Network Access Protection reports can be displayed.

For more information about creating a reporting point, see How to Create a Reporting Point.

See Also

Concepts

About Software Update Deployment Packages
About Enabling and Disabling Network Access Protection
About the NAP Client Status in Network Access Protection
About Configuration Manager NAP Policies in Network Access Protection
About System Health Validator Points in Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager


Planning for Network Access Protection

The Configuration Manager 2007 Network Access Protection (NAP) feature requires careful planning before you implement it in a production environment. Click the associated link in the following section for guidance on how to plan a successful deployment of Network Access Protection in your enterprise. These topics cover both the Windows infrastructure and Configuration Manager.

In This Section

Best Practices for Network Access Protection

Provides best practice information about Network Access Protection in Configuration Manager.

Determine Administrator Roles and Processes for Network Access Protection

Provides guidance on the various roles involved with implementing Network Access Protection and how you can use role separation for software updates and Network Access Protection in Configuration Manager.

Determine Your Policy Strategy for Network Access Protection

Explains how Network Access Protection policies work on the Network Policy Server, so that you can plan a strategy that best meets your business requirements for enforcing compliance of software updates with Network Access Protection in Configuration Manager.

Determine the Ports Required by Firewalls to Support Network Access Protection

Identifies the traffic associated with Network Access Protection in Configuration Manager with the associated port number, so that you can configure intervening firewalls or network devices.

Determine If You Should Install a System Health Validator Point for Network Access Protection

Helps you decide whether you should install a System Health Validator in a Configuration Manager site.

Decide Which Forest Will Publish Health State References for Network Access Protection

Helps you decide which Active Directory forest will publish the health state references required by the System Health Validator point when your System Health Validator points are not in the same Active Directory forest as your site servers.

Decide If You Need Additional Distribution Points for Network Access Protection Remediation

Helps you decide whether you will need to configure additional distribution points as a result of implementing Network Access Protection.

Determine Which Site Systems Are Boundary Servers for IPsec Network Access Protection

Helps you identify which servers you need to configure as boundary servers if you are using IPsec as your Network Access Protection enforcement mechanism.

Decide How To Create Configuration Manager NAP Policies for Network Access Protection

Helps you decide which method you will use to create Configuration Manager NAP policies, for example, using the Network Access Protection node or the Software Updates node in the Configuration Manager console.

Network Access Protection Planning Worksheets

Provides a template planning worksheet of the information you need to gather and record prior to implementing Network Access Protection.

See Also

Other Resources

Overview of Network Access Protection
Configuring the Network Policy Server for Configuration Manager
Configuring Network Access Protection


Best Practices for Network Access Protection

Topic last updated—November 2007

Use the following best practices for Network Access Protection (NAP) in Configuration Manager 2007, and see also Network Access Protection Security Best Practices.

  • Confirm the successful installation of software updates on the unrestricted network using the software updates feature in Configuration Manager before configuring software updates for Network Access Protection.
    Successful remediation of Configuration Manager clients that are non-compliant with software updates relies on the standard software updates operation. If the software updates feature is not operating correctly before introducing Network Access Protection, there is a high risk that clients will fail to access the unlimited network, and troubleshooting will be more difficult.
    For more information about configuring the software updates feature, see Software Updates in Configuration Manager.
  • Confirm Windows Network Access Protection is working with successful remediation before introducing Configuration Manager Network Access Protection.
    Several step-by-step guides are available from the Windows Network Access Protection Web site (http://go.microsoft.com/fwlink/?LinkId=59125). Use these guides to confirm that your Windows Network Access Protection infrastructure is operational with the Windows system health agent and system health validator—for example, by disabling the Windows firewall on a test client and confirming that it is automatically re-enabled. If the underlying Windows infrastructure is not operating correctly, Network Access Protection in Configuration Manager cannot be successful.
  • Plan for how to install the Configuration Manager client on the restricted network with manual remediation steps in the troubleshooting Web site.
    Automatic remediation in Configuration Manager cannot include repairing or installing the Configuration Manager client. When health policies include the Configuration Manager System Health Validator, NAP-capable clients that do not have a Configuration Manager client installed will result in failed compliance. This can result in these computers having limited network access without automatic remediation.
    This means that the Configuration Manager client must be installed manually (or policies are configured to exempt the computer). Have an installation script available on the in-house Network Access Protection Web site so that users can install the Configuration Manager client themselves.
    Aim to streamline this installation script for the most efficient installation, particularly if users are connecting over a slow network, such as a virtual private network (VPN).
    For more information about the Windows Network Access Protection troubleshooting Web site, see Configuring the Remediation User Experience for Configuration Manager Network Access Protection.
  • Test average remediation times to set expectations.
    If your network policies remediate non-compliant computers on the restricted network, it is important to know how long computers might have limited network access and to confirm that this is an acceptable interruption to business continuity. Inform Help Desk engineers and end users, if applicable, of how long it might take for a non-compliant computer to regain full network access so that they understand the length of the delay during normal operation and do not call the Help Desk unnecessarily.
  • Educate users in advance to encourage them to install software updates before the NAP effective date.
    Providing users with an opportunity to install the software updates themselves or having the software updates feature automatically install critical software updates on the unlimited network is always preferable to limiting network access. Consider a communication method to notify users which software updates are marked for Network Access Protection and warn them of the date by which their computers might have limited network access if they are not compliant, and then provide instructions for how they can ensure that their computers are compliant. This notification can help to increase compliance levels and reduce user dissatisfaction if computers remain non-compliant and consequently have limited network access until remediated.
  • Identify computers that should not have Configuration Manager client installed, and configure exemption policies on the Network Policy Server.
    If some computers should not have the Configuration Manager client installed, they will require exemption policies. For more information, see Determine Your Policy Strategy for Network Access Protection and Configuring Exemption Policies for Configuration Manager Network Access Protection.
  • Do not install the WSUS system health agent on a computer that has the Configuration Manager client installed with the Network Access Protection client agent enabled.
    Both the WSUS system health agent and the Network Access Protection client agent connect to a WSUS server and perform the same job of keeping a computer compliant with software updates. Using both system health agents together can result in conflicting configuration and unnecessary processing.

See Also

Concepts

Determine Administrator Roles and Processes for Network Access Protection
Network Access Protection Security Best Practices

Other Resources

Planning for Network Access Protection


Determine Administrator Roles and Processes for Network Access Protection

Topic last updated—May 2008

In a production environment, implementing Network Access Protection (NAP) will require interaction and collaboration with a number of different groups across the enterprise. For example, these groups might include the following:

  • Active Directory Domain Services architects to designate which forest will be used to publish the NAP health state references, and extend the schema with Configuration Manager 2007 schema extensions.
  • Active Directory Domain Services service administrators to extend the schema and configure the System Management container with required security permissions. The same administrators might also be involved in creating or identifying Windows security accounts or groups to be used when configuring the System Health Validator point and NAP policies.
  • Infrastructure architects to design the network and server architecture that will be required to support Network Access Protection, including deciding which enforcement technologies will be used.
  • Public key infrastructure (PKI) specialists to provide certificate services if you are using an IPSec enforcement solution with Network Access Protection.
  • Windows Server administrators to build and configure the Network Policy Servers and supporting Windows services.
  • Firewall administrators to make configuration changes on firewalls and network devices required to support Network Access Protection.
  • Security advisors to help determine the criteria by which software updates are selected for NAP enforcement, the date by which they will be enforced, and whether non-compliant computers will be restricted until compliant.
  • In-house Web designers to build a comprehensive troubleshooting Web site for computers that fail to remediate on the restricted network.
  • Help Desk engineers who might receive calls from users who cannot get access to the network because their computers have restricted access, or when remediation fails.
  • Configuration Manager software distribution administrators to upgrade clients running a supported version of Windows XP to Windows XP Service Pack 3 so that these clients can support Network Access Protection.
  • Configuration Manager software updates administrators to configure software update points and create software update packages on distribution points.
  • Configuration Manager administrators to configure System Health Validator points, configure the Network Access Protection client agent, and then configure and monitor Configuration Manager NAP policies.
  • End users who will require training and notification about the Network Access Protection processes, and what to do if they encounter a problem.

Because a Network Access Protection solution involves so many roles, a successful implementation will depend on identifying who is responsible for the various roles and ensuring collaboration between groups when necessary. A successful ongoing implementation will depend on identifying and adhering to processes that coordinate the various functions between the roles.

Some of the consequences of not having and following defined processes when Network Access Protection is implemented in a production environment are as follows:

  • The Help Desk is inundated with calls from users who are getting Network Access Protection messages and errors.
  • Productivity drops and deadlines are missed because users cannot access the network resources they need.
  • Satisfaction levels for IT services drop and Service Level Agreements (SLAs) are not met.
  • Non-compliant computers are incorrectly given full network access and put corporate resources at risk.

Use a methodology such as ITIL or Microsoft Operations Framework (http://go.microsoft.com/fwlink/?LinkId=88047) to help you implement Network Access Protection within a framework of defined processes. Make sure you document your design, testing procedures, the areas of responsibility, the processes to follow for configuring policies, remediation, and troubleshooting, and then disseminate this information, making sure that it is centrally available and updated.

Note
Review existing company security policies and, if necessary, modify them to include the implementation of Network Access Protection. Company security policies often drive downstream processes to enforce policy compliance.

Role Separation in Configuration Manager

When you are determining the roles required for Network Access Protection in Configuration Manager, there is a potential overlap between software updates and Network Access Protection. These two roles can be combined or separated, depending on your business requirements. Typically, smaller organizations will combine the two roles, but some organizations will want to separate the roles. The Network Access Protection role in Configuration Manager might even be combined with other roles external to the product, such as Network Policy Server administrators or security administrators.

The role separation for software updates and Network Access Protection in Configuration Manager 2007 is supported by having a separate node for Network Access Protection in the Configuration Manager console. Use the Security tab on the properties of the Network Access Protection node to specify permissions to specific users or groups for tasks in Configuration Manager related to Network Access Protection. Then use the Security tab on the properties of the Software Updates node so that the Network Access Protection administrators do not have access to software updates. This configuration results in the following:

  • Network Access Protection administrators can view the resulting Network Access Protection statistics in the Network Access Protection node.
  • Network Access Protection administrators can create, view, modify, and delete NAP policies.
  • Network Access Protection administrators cannot create, view, modify, or delete software update deployments, packages, or templates.

Because the Policies node also has its own Security tab, you can refine the permissions further to control which Network Access Protection administrators can view, create, modify, and delete NAP policies.

However, because you can configure a software update to be enabled for NAP evaluation in the Deploy Software Updates Wizard and as a property of a packaged update, you cannot prevent software update administrators from also configuring Configuration Manager NAP policies from within the Software Updates node.

If you are using role separation in Configuration Manager, you might also want to configure security so that Network Access Protection administrators have access to the Reporting node, so that Network Access Protection administrators can run reports with the category Network Access Protection.

An administrator who only manages Network Access Protection in Configuration Manager 2007 would not need access to the collections, because Configuration Manager NAP policies are automatically targeted to all clients that are assigned to the site.

For more information about the security rights for Network Access Protection in Configuration Manager, see Network Access Protection Security Rights.

See Also

Concepts

Administrator Workflow: Configure Network Access Protection for Configuration Manager
About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection
About the Network Access Protection Process

Other Resources

Administrator Checklist: Configure Network Access Protection for Configuration Manager
Planning for Network Access Protection


Determine Your Policy Strategy for Network Access Protection

To determine a policy strategy for Network Access Protection with Configuration Manager 2007, a number of people must collaborate to decide on objectives, requirements, and processes. This will likely involve the Configuration Manager administrator, the Network Policy Server administrator, and representatives from the security team, the infrastructure team, and possibly the help desk.

Configuring Network Access Protection policies for Configuration Manager requires the configuration of two sets of policies: the Network Access Protection policies defined in Configuration Manager; and Network Access Protection policies defined on the Network Policy Server:

  • The Network Access Protection policies in Configuration Manager determine which software updates computers must have by a defined date. As a result of these, Configuration Manager passes to the Network Policy Server the computer's health state, and if necessary a list of servers required for remediation.
  • The Network Access Protection policies on the Network Policy Server determine whether clients have full network access or restricted network access, and whether non-compliant computers are remediated. The decision is based on the computer's health state received from Configuration Manager. Policies on the Network Policy Server can be configured as follows:
    • NAP-capable clients that are compliant have full network access.
    • NAP-capable clients that are non-compliant have restricted network access until remediated.
    • NAP-capable clients that are non-compliant have full network access for a limited time and are immediately remediated.
    • NAP-ineligible clients have full network access.
    • NAP-ineligible clients have restricted network access but will not be remediated.
    • All error conditions, by default, result in computers having restricted access (with remediation if supported by the client), but they can be configured for full network access.
Note
If health policies are not enforced in the network policy on the Network Policy Server, Network Access Protection in Configuration Manager cannot remediate non-compliant computers. Compliance in this case can be achieved through the defined Configuration Manager software updates functionality. If health policies are enforced in the network policy on the Network Policy Server, Network Access Protection in Configuration Manager always attempts to remediate non-compliant computers, even if the option to auto-remediate non-compliant computers is not enabled in the network policy.

When you have decided on the policy strategy for your network, you should configure connection request policies, health policies, and network policies. The network policies should include settings for the following:

  1. Computers that are NAP capable and compliant.
  2. Computers that are NAP capable and non-compliant.
  3. Computers that are NAP ineligible and therefore you cannot tell if they are compliant or non-compliant.

Typically, these policies are configured as follows:

  1. Compliant computers have full network access.
  2. Non-compliant computers have either limited network access and are remediated, and then have full network access; or they have full network access for a limited time, and they are immediately remediated on the unrestricted network.
  3. NAP-ineligible computers have full network access. However, in a high-security environment where the health status of these computers cannot be assessed, it might be appropriate for them to have restricted network access although they cannot be remediated and therefore will never be able to access the full network.

When you have decided on how the majority of computers will work with Network Access Protection, you can then plan more detailed policies for specific conditions. For example, you might have the following exceptions and exemptions:

  • Specified people will never have restricted network access.
  • Standard networked computers will have full network access for a limited time if non-compliant, whereas home computers will have limited access if non-compliant.
  • During the hours that a local helpdesk is not available, non-compliant computers will have full network access for a limited time rather than limited access.
  • Specified machines will be exempt from health policies. As an example, this exemption is appropriate if the Configuration Manager client must not be installed on selected computers.

Implementing policies for exceptions and exemptions is achieved through policy conditions and ordering. The first policy that matches a connecting computer will be used, which means you usually need to order the more specific policies (the exceptions) before the general policies. If you need policy exemptions for people or computers, create the necessary Microsoft Windows groups to be selected from the Network Policy Server.

Important
If you have NAP-capable computers in Configuration Manager site that is enabled for Network Access Protection but they do not have the Configuration Manager client installed, you must have either exemption policies for these computers that do not reference the Configuration Manager System Health Validator or a means by which computers on the restricted network can install the Configuration Manager client (for example, by providing an installation link on the troubleshooting Web site as part of the user experience).

See Also

Concepts

Configuring Connection Request Policies for Configuration Manager Network Access Protection
Configuring Network Policies for Configuration Manager Network Access Protection
Configuring Failure Categories for Configuration Manager Network Access Protection
Configuring Health Policies for Configuration Manager Network Access Protection
Configuring Remediation Server Groups for Configuration Manager Network Access Protection
Configuring the Remediation User Experience for Configuration Manager Network Access Protection


Determine the Ports Required by Firewalls to Support Network Access Protection

Topic last updated—March 2008

In addition to standard Configuration Manager 2007 traffic, Network Access Protection (NAP) in Configuration Manager 2007 generates the following traffic with associated ports. If you have firewalls or network perimeter devices that block this traffic, they must be reconfigured for Network Access Protection to work with Configuration Manager 2007.

Use the following table to identify the ports used by Network Access Protection in Configuration Manager 2007. For a list of all ports used in Configuration Manager 2007, see Ports used by Configuration Manager.

Additionally, you will need to identify the ports used by the client to the System Health Validator point. These ports are not used directly by Configuration Manager but are established by Windows Network Access Protection and are dependent upon the enforcement client being used. For example, DHCP enforcement will use ports UDP 67 and 68. IPsec enforcement will use ports TCP 80 or 443 to the Health Registration Authority, port UDP 500 for IPsec negotiation and the additional ports needed for the IPsec filters. For more information, see the Windows Network Access Protection documentation, and for help with configuring firewalls for IPsec, see http://go.microsoft.com/fwlink/?LinkId=109499.

Function | Ports | Description
Configuration Manager 2007 site server publishing the Configuration Manager health state reference to Active Directory Domain Services. | TCP 389 (LDAP) or TCP 636 (LDAPS) | Writing to Active Directory Domain Services
System Health Validator point querying Active Directory Domain Services for the Configuration Manager health state reference. | TCP 3268 (Global Catalog lookup) or TCP 3269 (secure global catalog lookup) | Reading from a global catalog server
Installing System Health Validator point and ongoing configuration. | TCP 445 TCP 135 | Server message blocks (SMB) to install Remote procedure calls (RPCs) for configuration
Status messages from the System Health Validator point to the site server. | TCP 445 | Server message blocks (SMB)

See Also

Concepts

About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection
Ports Used by Configuration Manager


Determine If You Should Install a System Health Validator Point for Network Access Protection

Install a System Health Validator point in the Configuration Manager 2007 site if all of the following conditions apply:

  • Configuration Manager can publish to Active Directory Domain Service.
  • You want to enforce compliance of software updates using Network Access Protection (NAP) for one or more sites in your Configuration Manager hierarchy.
  • The Windows infrastructure is in place for NAP, including Network Policy Servers on Windows Server 2008.
  • One or more sites in the Configuration Manager 2007 hierarchy will be enabled for NAP, and in this site some Configuration Manager clients support NAP.
  • A computer is running Windows Server 2008 and is configured as a Network Policy Server in the Configuration Manager site.

If you are using NAP with Configuration Manager, you do not necessarily need a System Health Validator point in each Configuration Manager site. You will need to coordinate with the administrators for Network Policy Servers in deciding the number and location of System Health Validator points in the Configuration Manager hierarchy.

Generally, you will need to install a System Health Validator point on all servers running Network Policy Server and that are configured with policies for NAP. If all these servers are in a single Configuration Manager site, it will be easier to configure them because all System Health Validator points in a single Configuration Manager site share the same configuration. If possible, install them in the highest primary site or in your central site, where you create your Configuration Manager NAP policies. However, if you need different configurations for your System Health Validator points, you must install them in different sites.

Note
Configuration Manager does not assign clients to System Health Validator points; this process is handled by the Windows NAP infrastructure.

See Also

Concepts

About System Health Validator Points in Network Access Protection
Prerequisites for Network Access Protection


Decide Which Forest Will Publish Health State References for Network Access Protection

When your Configuration Manager 2007 hierarchy spans more than one Active Directory forest, but all the site servers and System Health Validator points reside in the same Active Directory forest that has been extended for Configuration Manager 2007, you do not need to decide which forest will publish health state references for Network Access Protection. In this scenario, follow the configuration procedures as if you have a single forest.

However, when all the site servers and System Health Validator points do not reside in the same Active Directory forest, you must identify which forest they reside in, identify whether trust relationships exist between them, and decide which forest will publish the Configuration Manager health state references.

The Active Directory forest that publishes the health state references must be extended with the Configuration Manager 2007 schema extensions, the site servers must be publishing to Active Directory, and permissions must be set appropriately on the System Management container in Active Directory. These Active Directory dependencies might affect your decision on which forest will be used to publish the Configuration Manager health state references.

The following scenarios identify four basic configurations when Network Access Protection in Configuration Manager spans multiple Active Directory forests. Use these scenarios to help you decide which Active Directory forest will publish the health state references.

  1. Site servers reside in one Active Directory forest, and all System Health Validator points reside in another Active Directory forest. Configuration Manager health state references are published to the forest that contains the site servers. Choose this option if you can extend Active Directory Domain Services for Configuration Manager, and if the System Health Validator points reside in a perimeter network.
  2. Site servers reside in one Active Directory forest, and all System Health Validator points reside in another Active Directory forest. Configuration Manager health state references are published to the forest that contains the System Health Validator points. Choose this option if you cannot extend Active Directory Domain Services for Configuration Manager, but you can extend the schema of the second forest.
  3. Site servers reside in one Active Directory forest, and all System Health Validator points reside in another Active Directory forest. Configuration Manager health state references are published to a third Active Directory forest that has trust relationships with the other two forests (either a forest trust or external domain trusts). Choose this option if you cannot extend Active Directory Domain Services for either forest, but you can extend the schema of a new or existing forest.
  4. Site servers reside in one Active Directory forest, and all System Health Validator points reside in another Active Directory forest. Configuration Manager health state references are published to a third Active Directory forest that has no trust relationships with the other two forests (neither a forest trust nor external domain trusts). Choose this option if you cannot extend Active Directory Domain Services for either forest, but you can extend the schema of a new or existing forest that cannot have any trust relationships with the other two forests.

For information on how to provision Active Directory Domain Services for each scenario, see How to Deploy Network Access Protection Across Multiple Forests.

See Also

Concepts

How to Deploy Network Access Protection For a Single Forest
Configuration Manager in Multiple Active Directory Forests
About NAP Health State References in Network Access Protection

Other Resources

Configuring Network Access Protection


Decide If You Need Additional Distribution Points for Network Access Protection Remediation

You might need additional distribution points hosting software update packages when you implement Network Access Protection (NAP) in Configuration Manager 2007. Unlike software update deployments that are targeted to specific collections, NAP policies in Configuration Manager are automatically targeted to all computers that are assigned to the site, and to all computers that are assigned to sites lower in the Configuration Manager hierarchy. If you are using the default collection All Systems, this will display all the computers that will be targeted with Configuration Manager NAP policies and will be received by all computers if they are capable of supporting Network Access Protection.

In a Configuration Manager 2007 hierarchical deployment, this automatic targeting of NAP policies can result in a significant increase in network traffic and processing on distribution points when remediation is invoked.

Decide if you need additional distribution points to host software updates configured for Network Access Protection, and ensure that content is locally available to clients for faster remediation. Also, consider the time required in your environment for the package replication when configuring a Configuration Manager NAP policy with the effective date. If content is not locally available and many clients request it at the same time, clients might take a long while to complete remediation or even time out while remediating.

Important
If you are using branch distribution points to host software updates for Configuration Manager NAP policies, do not enable the option Make this package available on protected distribution points only when requested by clients inside the protected boundary on the Distribution Settings tab for a package's properties. If you set this option, the remediation process might time out if the content has not already been requested from a standard distribution point.

See Also

Concepts

About the Network Access Protection Process
About Network Access Protection Remediation


Determine Which Site Systems Are Boundary Servers for IPsec Network Access Protection

If you are using IPsec as your Network Access Protection enforcement technology with Configuration Manager 2007, you should configure the following site systems as boundary servers:

  • All management points that are located in sites that are enabled for Network Access Protection.
  • All software update points located in sites that are enabled for Network Access Protection.
  • All distribution points that host software updates.

Additionally, you should also configure the following servers as boundary servers to support Network Access Protection in Configuration Manager:

  • The computer running Network Policy Server.
  • Any infrastructure servers that are required on the restricted network, such as DNS servers, WINS servers, domain controllers and global catalog servers.

See Also

Concepts

About Network Access Protection Remediation
About the Network Access Protection Process
Decide If You Need Additional Distribution Points for Network Access Protection Remediation

Other Resources

Administrator Checklist: Configure Network Access Protection for Configuration Manager


Decide How To Create Configuration Manager NAP Policies for Network Access Protection

A Configuration Manager 2007 Network Access Protection (NAP) policy defines which software updates a NAP-capable client must have by a specified date to be compliant.

There are a number of ways that you can create a NAP policy in Configuration Manager. If you are using role separation in Configuration Manager such that administrators who create and manage NAP policies do not also create and manage the software updates feature, then Configuration Manager NAP policies should be created with the New Policies Wizard only. This wizard is initiated from the Policies node under the Network Access Protection Node in the Configuration Manager console.

Note
For more information about role separation for NAP in Configuration Manager, see Determine Administrator Roles and Processes for Network Access Protection.

However, if the same administrators create and manage both software updates and NAP in Configuration Manager, use the following table to help you decide how to create Configuration Manager NAP policies.

Method of Creating NAP Policy When to Use This Method

Use the New Policies Wizard that is initiated from the Policies node under the Network Access Protection node in the Configuration Manager console.

If you are deploying a NAP policy as an expedited deployment, for example, to urgently protect computers from a zero-day exploit, you might find that using the New Policies Wizard is quicker than using one of the methods that are initiated from the Software Updates node.

If you are deploying NAP policies after software update deployments or packages have been configured, you might find that using the New Policies Wizard is quicker than using one of the methods that are initiated from the Software Updates node.

Use the Deploy Software Update Wizard when creating a software deployment.

If all the software updates in a deployment will be selected for a NAP policy that share the same Effective Date.

If you are deploying NAP polices as a phased deployment, with the Effective Date in the policy configured to be a set period of time after the configured deadline for the software update deployment.

Modify the properties of a software update in the update repository.

If you find it easier to locate the software updates you want to include in NAP policies using the Update Repository node. For example, you use the update classifications or products to quickly find the software updates you require for NAP policies.

Note
Only software updates in the update repository that have been downloaded can be selected for a NAP policy.

Modify the properties of a software update in a software update deployment package.

If you find it easier to locate the software updates you want to include in NAP policies using Deployment Packages under the Software Updates node. For example, the software updates you want to include in NAP policies are downloaded but not configured in software update deployments.

Modify the properties of a software update in a software update deployment

If you find it easier to locate the software updates you want to include in NAP policies using Deployment Management under the Software Updates node. For example, you have already created the software update deployment and later want to create NAP policies for all the software updates in the deployment.

Modify the properties of software updates that are displayed in software updates search folders.

If you find it easier to locate the software updates you want to include in NAP policies using search folders under the Update Repository node. For example, you have already identified critical software updates that you want to add to NAP policies and created a search folder for them.

For procedural information on how to create Configuration Manager NAP policies using each of these methods, see How to Create a Configuration Manager NAP Policy for Network Access Protection.

See Also

Concepts

About Configuration Manager NAP Policies in Network Access Protection
About Phased and Expedited Network Access Protection Deployments
About the Differences Between Software Updates and Network Access Protection
Determine Administrator Roles and Processes for Network Access Protection


Network Access Protection Planning Worksheets

Print and complete the following list before you implement Network Access Protection (NAP) with Configuration Manager 2007 to ensure your planning is complete.

Planning Task Required (Yes/No) Completed (Yes/No) Decision or comment.

Extend Active Directory schema in the forest that will contain the Configuration Manager health state references, and enable publishing.

Configure Configuration Manager sites to publish to Active Directory Domain Services.

Install or upgrade computers to support Network Access Protection.

NAP-capable clients have Configuration Manager client installed, are assigned to Configuration Manager sites, and have the following client agents enabled:

  • Hardware inventory.

The software updates feature is configured and operational.

Identify distribution points to be used as remediation servers.

NAP enforcement technology is installed and configured (for example, IPsec, DHCP).

Note
If using IPsec, ensure that infrastructure servers (global catalog servers, DNS, WINS etc) are configured as boundary servers.

NAP enforcement clients and the Network Access Protection service are started on clients.

Network Policy Server(s) is installed.

Installation account is created and configured to install the System Health Validator point(s).

System Health Validator point(s) are installed on Network Policy Server(s).

System Health Validator point(s) are configured for the following options:

Query interval (minutes)

Validity period (hours)

Date created must be after (UTC)

Use the same Active Directory forest

Designate an Active Directory forest

Domain suffix

Health state reference publishing account

Health state reference querying account

Windows groups are created or identified for policy exceptions on the Network Policy Server.

Network Policy Server is configured, including the following items:

  • Health policies
  • Remediation Server Group
  • Connection Request policies
  • Network policies
  • Configuration Manager System Health Validator error code resolutions
  • Logging

Web site for Troubleshooting URL and any back-end scripts/utilities or programs.

Firewalls or perimeter devices are configured:

  • Client to System Health Validator point
  • System Health Validator point to Active Directory

Help desk training and procedures are established.

End user notification and training are in place.


Configuring Network Access Protection

The Configuration Manager 2007 Network Access Protection (NAP) feature requires a number of configuration steps before you can create policies to enforce compliance with software updates. Click the associated link in the following section for information about how to configure Network Access Protection for Configuration Manager.

Note
These topics do not include configuration of the Network Policy Server. For information about configuring Network Access Protection for Configuration Manager on the Network Policy Server, see Configuring the Network Policy Server for Configuration Manager.

In This Section

How to Deploy Network Access Protection For a Single Forest

Lists the default values that will be used when all the System Health Validator points reside in the same Active Directory forest as the site servers, and the requirements for provisioning Active Directory Domain Services for Configuration Manager site publishing.

How to Deploy Network Access Protection Across Multiple Forests

Lists four different scenarios for when all the System Health Validator points do not reside in the same Active Directory forest as the site servers, with configuration steps for each scenario.

How to Prepare the Site for Network Access Protection Clients

Provides information about ensuring clients can support Network Access Protection, including how to deploying Windows XP Service Pack 3 to support Network Access Protection on the Windows XP operating system platform.

How to Configure the Network Access Protection Client Agent

Provides the configuration steps required to enabled or disable the Network Access Protection client agent, and how to configure settings for evaluting compliance with Configuration Manager NAP policies.

How to Configure the System Health Validator Point for Network Access Protection

Provides the configuration steps related to the System Health Validator point, such as the validity period of the statement of health and the location of the health state references.

See Also

Concepts

About Enabling and Disabling Network Access Protection
About the NAP Client Status in Network Access Protection
About System Health Validator Points in Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


How to Deploy Network Access Protection For a Single Forest

When all your site servers that are enabled for Network Access Protection (NAP) and System Health Validator points reside in the same Active Directory forest, no additional Network Access Protection configuration is required to support Network Access Protection in Configuration Manager 2007. However, Active Directory Domain Services must be extended with the Configuration Manager 2007 schema extensions and the site servers must be publishing to Active Directory Domain Services.

Network Access Protection is one of many Configuration Manager features that integrate with Active Directory Domain Services, so these configuration procedures might have already been performed.

Note
If your Network Access Protection implementation in Configuration Manager spans multiple forests, you will have additional configuration steps to perform forConfiguration Manager and Active Directory Domain Services. See the following for more information: About Network Access Protection and Multiple Active Directory Forests.

When your Configuration Manager hierarchy is entirely in one Active Directory forest, there are fewer configuration tasks you must perform to support Network Access Protection in Configuration Manager and the following default values will be used:

  • The site server computer account is used to install the System Health Validator Point.
  • The site server computer account is used to publish the Configuration Manager health state reference to Active Directory.
  • The site server will publish the Configuration Manager health state reference to its Active Directory forest.
  • The System Health Validator point will query its Active Directory forest for the Configuration Manager health state references.
  • The computer account of the System Health Validator point will be used to query Active Directory for the Configuration Manager health state references.

However, if you have not already done so for other Configuration Manager features, you must provision Active Directory and configure Configuration Manager to publish to Active Directory Domain Services.

To deploy Network Access Protection in Configuration Manager for a single forest, the following steps must be completed:

  1. The Active Directory schema must be extended with the Configuration Manager 2007 schema extensions.
  2. A System Management container must be created in each domain for each primary site that will be enabled for Network Access Protection.
  3. Permissions must be set appropriately on the System Management container for each site server.
  4. Each primary site in Configuration Manager enabled for Network Access Protection must be configured to publish to Active Directory Directory Domain Services.

For procedural information on completing steps 1 through to 3, see How to Extend the Active Directory Schema for Configuration Manager.

For procedural information on completing step 4, see How to Publish Configuration Manager Site Information to Active Directory Domain Services.

See Also

Concepts

How to Deploy Network Access Protection Across Multiple Forests
About Network Access Protection and Multiple Active Directory Forests
About System Health Validator Points in Network Access Protection
About NAP Health State References in Network Access Protection

Other Resources

Configuring Network Access Protection


How to Deploy Network Access Protection Across Multiple Forests

The configuration steps that must be taken when deploying Configuration Manager 2007 Network Access Protection (NAP) across multiple Active Directory forests depend on the topography, the existing configuration, and your decision on where to publish the Configuration Manager health state references. If you need help with deciding where to publish the health state references, see Decide Which Forest Will Publish Health State References for Network Access Protection.

Use the following supported scenarios to select the appropriate configuration steps to deploy Network Access Protection in Configuration Manager across multiple Active Directory forests when site servers reside in one Active Directory forest, and all System Health Validator points reside in another Active Directory forest:

  • The Configuration Manager health state references publish to the forest that contains the site servers
  • The Configuration Manager health state references publish to the forest that contains the System Health Validator points
  • The Configuration Manager health state references publish to a third Active Directory forest that has trust relationships with the other two forests (either a forest trust or external domain trusts)
  • The Configuration Manager health state references publish to a third Active Directory forest that has no trust relationships with the other two forests (neither a forest trust nor external domain trusts)

Deploying Configuration Manager Network Access Protection over two forests when the Configuration Manager health state references publish to the forest that contains the site servers

  1. If not already completed for other Configuration Manager features, complete the following steps:
    • Extend the Active Directory schema with the Configuration Manager 2007 extensions. For more information, see How to Extend the Active Directory Schema for Configuration Manager.
    • Enable publishing of the Configuration Manager health state references by creating a System Management container in each domain that contains a site server, and grant Full Control permissions (to this object and all child objects) to the site server computer accounts.
    • Configure each site to publish to Active Directory Domain Services. For more information, see How to Publish Configuration Manager Site Information to Active Directory Domain Services.
  2. As part of the System Health Validator component configuration, complete the following steps:
    • Specify the option to Designate an Active Directory forest. For more information, see How to Specify the Location of the NAP Health State Reference.
    • Specify the fully qualified domain of the site server where you will create your NAP policies in the Domain suffix. This tells the System Health Validator points where they should retrieve Configuration Manager health state references. Because each domain writes the Configuration Manager health state references to the global catalog, the System Health Validator point queries the global catalog in the domain you specify, which means it can retrieve all the Configuration Manager health state references from all domains in that forest.
  3. If there is an outgoing trust relationship from the domain you have specified in the domain suffix and the domain(s) in which the System Health Validator points reside, no further configuration is required. The computer accounts of the System Health Validator points will be used and authenticated across the trust.
  4. If there is no outgoing trust relationship from the domain you have specified in the domain suffix and the domain(s) in which the System Health Validator points reside, the following additional steps must be performed:
    • Create a Microsoft Windows user account in the forest that contains the site servers, and configure this account with a password that never expires.
    • Specify this Windows user account as the Health state reference querying account in the System Health Validator Point Component Properties under the Component Configuration node. For more information, see How to Specify the Health State Reference Querying Account.

Deploying Configuration Manager Network Access Protection over two forests when the Configuration Manager health state references publish to the forest that contains the System Health Validator points

  1. In the forest that contains the System Health Validator points, complete the following steps:
    • Extend the Active Directory schema with the Configuration Manager 2007 extensions. For more information, see How to Extend the Active Directory Schema for Configuration Manager.
    • Create a System Management container in one domain to store the Configuration Manager health state references.
    • Create a domain local group, and grant it Full Control permissions (to this object and all child objects) to the System Management container.
  2. As part of the System Health Validator component configuration, complete the following steps:
    • Select the option to Designate an Active Directory forest. For more information, see How to Specify the Location of the NAP Health State Reference.
    • Specify the fully qualified domain where you created the System Management container in the Domain suffix. This tells the System Health Validator points where they should retrieve Configuration Manager health state references.
  3. If there is an outgoing trust relationship from the domain you have specified in the domain suffix and the domain(s) in which the site servers reside, add the computer accounts of each site server into the local domain group you created.
  4. If there is no outgoing trust relationship from the domain you have specified in the domain suffix and the domain(s) in which the site servers reside, the following additional steps must be performed:
    • Create a Microsoft Windows user account in the forest that contains the System Health Validator points, and configure this account with a password that never expires.
    • Specify this Windows user account as the Health state reference publishing account in the System Health Validator Point Component Properties under the Component Configuration node. For more information, see How to Specify the Health State Reference Publishing Account.
    • Ensure name resolution is configured so that site servers can resolve the forest namespace of the System Health Validator points (for example, with DNS forwarding or root hints).

Deploying Configuration Manager Network Access Protection over two forests when the Configuration Manager health state references publish to a third forest that has trust relationships with the other two forests (either a forest trust or external domain trusts)

  1. In the third Active Directory forest, complete the following steps:
    • Extend the Active Directory schema with the Configuration Manager 2007 extensions. For more information, see How to Extend the Active Directory Schema for Configuration Manager.
    • Create a System Management container in one domain to store the Configuration Manager health state references.
    • Create a domain local group, and grant it Full Control permissions (to this object and all child objects) to the System Management container.
  2. As part of the System Health Validator component configuration, complete the following steps:
    • Specify the option to Designate an Active Directory forest. For more information, see How to Specify the Location of the NAP Health State Reference.
    • Specify the fully qualified domain where you created the System Management container in the Domain suffix. This tells the site servers where to write the Configuration Manager NAP health state references and the System Health Validator points where they should retrieve Configuration Manager NAP health state references.
  3. If it is not already configured, enable the option Publish this site in Active Directory Domain Services on each site that will be enabled for Network Access Protection. For more information, see How to Publish Configuration Manager Site Information to Active Directory Domain Services.
  4. Using the outgoing trust relationship from the domain you have specified in the domain suffix and the domain(s) in which the site servers reside, add the computer accounts of each site server into the local domain group you created.
  5. The computer accounts of the System Health Validator points will be authenticated to retrieve the Configuration Manager health state references over the outgoing trust relationship between the domain you have specified in the domain suffix and the domain(s) in which the System Health Validator points reside, with no further configuration.

Deploying Configuration Manager Network Access Protection over two forests when the Configuration Manager health state references publish to a third forest that has no trust relationships with the other two forests

  1. In the third Active Directory forest, complete the following steps:
    • Extend the Active Directory schema with the Configuration Manager 2007 extensions. For more information, see How to Extend the Active Directory Schema for Configuration Manager.
    • Create a System Management container in one domain to store the Configuration Manager health state references.
    • Create a domain local group, and grant it Full Control permissions (to this object and all child objects) to the System Management container.
    • Create a Microsoft Windows user account to publish the Configuration Manager health state references. Configure this account with a password that never expires, and make it a member of the domain local group you created.
    • Create a Windows user account to retrieve the Configuration Manager health state references. Configure this account with a password that never expires.
  2. Configure the System Health Validator Point Component Properties under the Component Configuration node as follows:
    • Specify the option to Designate an Active Directory forest. For more information, see How to Specify the Location of the NAP Health State Reference.
    • Specify the fully qualified domain where you created the System Management container in the Domain suffix. This tells the site servers where to write the Configuration Manager health state references, and it tells the System Health Validator points where they should retrieve Configuration Manager health state references.
    • Specify the Windows user account you created to publish the Configuration Manager health state references in the health state reference publishing account. For more information, see How to Specify the Health State Reference Publishing Account.
    • Specify the Windows user account you created to read the Configuration Manager health state references in the Health state reference querying account. For more information, see How to Specify the Health State Reference Querying Account.
  3. If it is not already configured, enable the option Publish this site in Active Directory Domain Services on each site that will be enabled for Network Access Protection. For more information, see How to Publish Configuration Manager Site Information to Active Directory Domain Services.
  4. Using the outgoing trust relationship from the domain you have specified in the domain suffix and the domain(s) in which the site servers reside, add the computer accounts of each site server into the local domain group you created.
  5. Ensure name resolution is configured such that site servers and System Health Validator points can resolve the forest namespace of the third Active Directory forest (for example, with DNS forwarding or root hints).

See Also

Tasks

How to Publish Configuration Manager Site Information to Active Directory Domain Services
How to Specify the Health State Reference Querying Account
How to Specify the Health State Reference Publishing Account
How to Specify the Location of the NAP Health State Reference

Concepts

About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection
About Network Access Protection and Multiple Active Directory Forests
Decide Which Forest Will Publish Health State References for Network Access Protection

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


How to Prepare the Site for Network Access Protection Clients

Topic last updated—May 2008

Network Access Protection is enabled for a site by enabling the Network Access Protection client agent. Because this is a site-wide setting, consider upgrading and reassigning clients according to whether they support Network Access Protection.

To help you identify which clients support Network Access Protection and which clients are running Windows XP Service Pack 2 and could support Network Access Protection with a later service pack, run the following Network Access Protection reports:

  • List of computers that could be upgraded to support NAP
  • List of NAP-capable and NAP-upgradable computers

Additionally, run the following query to find a list of computers that are running Windows XP Service Pack 2 so that you can target these computers to be upgraded with Windows XP Service Pack 3:

Copy Code
Select NapUpgradeableCount from v_NAPSystemInfo.

For information about how to run Network Access Protection reports, see How to Run Network Access Protection Reports.

For more information about running queries, see Overview of Queries and How to Create a Query.

Deploying Windows XP Service Pack 3 to Support Network Access Protection on the Windows XP Operating System Platform

Windows XP Service Pack 3 can be installed on supported platforms (Windows XP Service Pack 1 and Service Pack 2) by using software updates. Alternatively, download this service pack from the Microsoft Download Center and upgrade clients by using software distribution. Installation of this service pack might require a restart.

For more information about how to deploy software updates to clients, see Administrator Checklist: Configuring Software Updates. For more information about how to distribute software to clients, see Administrator Checklist: Software Distribution Checklist.

Note
You must start the Network Access Protection service (set, by default, to Manual and not started) and manually start the enforcement clients that you are using in your Network Access Protection environment. This can be achieved with Group Policy. Refer to the Network Access Protection documentation for procedural information about this requirement for Network Access Protection clients.

See Also

Tasks

How to Run Network Access Protection Reports
How to Create a Query

Concepts

About Configuration Manager NAP Policies in Network Access Protection
About Enabling and Disabling Network Access Protection
About the NAP Client Status in Network Access Protection
Overview of Queries


How to Configure the Network Access Protection Client Agent

For the Configuration Manager 2007 site to be enabled for Network Access Protection (NAP), you must configure the Network Access Protection client agent. The content in this section provides the steps necessary to accomplish each task associated with configuring the Network Access Protection client agent.

How to Enable the Network Access Protection Client Agent

How to Configure NAP Evaluation Settings

How to Disable the Network Access Protection Client Agent


How to Enable the Network Access Protection Client Agent

Enabling the Network Access Protection client agent makes it possible for Configuration Manager 2007 clients that support Network Access Protection (NAP) and are assigned to this site to evaluate software updates for their statement of health. Configuration Manager 2007 can also monitor clients that are in remediation for any NAP policy defined on the Network Policy Server.

After enabling the Network Access Protection client agent, you can then create, modify, and delete NAP policies for selected downloaded software updates in the Policies node under Network Access Protection.

If you do not have a System Health Validator point for computers in this site, non-compliant computers in this site cannot have Configuration Manager NAP policies enforced and cannot be restricted through Network Access Protection.

Note
If you cannot see the Policies node under Network Access Protection after enabling Network Access Protection, refresh the node Network Access Protection.

Before enabling the Network Access Protection client agent, ensure that clients have the Windows Network Access Protection Agent service started and set to automatic, and that the Windows Network Access Protection infrastructure is in place. For more information, see Administrator Checklist: Configure Network Access Protection for Configuration Manager.

To enable the Network Access Protection Client Agent

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name>/ Site Settings / Client Agents.

  2. Right-click Network Access Protection Client Agent, and then click Properties.

  3. On the General tab, enable the option Enable Network Protection on clients.

  4. Click OK.

See Also

Tasks

How to Configure NAP Evaluation Settings
How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Install the System Health Validator Point
How to Disable the Network Access Protection Client Agent

Concepts

About Enabling and Disabling Network Access Protection
About the Network Access Protection Process
About the NAP Client Status in Network Access Protection
About Network Access Protection Remediation
About Configuration Manager NAP Policies in Network Access Protection
About the Statement of Health (SoH) in Network Access Protection


How to Configure NAP Evaluation Settings

You define how often and when a Configuration Manager 2007 client evaluates its statement of health by selecting whether to use coordinated universal time, selecting or deselecting the option Force a fresh scan for each evaluation, and specifying a schedule for NAP evaluation.

To configure Network Access Protection (NAP) evaluation settings:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name>/ Site Settings / Client Agents.

  2. Right-click Network Access Protection Client Agent, and then click Properties.

  3. On the Evaluation tab, select or deselect the option UTC (Coordinated Universal Time), depending on whether you want the effective date in Configuration Manager NAP policies to be coordinated universal time, or local time.

  4. On the Evaluation tab, select or deselect the option Force a fresh scan for each evaluation.

  5. Click Simple schedule and Run every to configure a simple schedule, or click Custom schedule and then click Schedule to configure a custom schedule with an optional start date and recurrence pattern.

  6. Click OK.

    Note
    For information about the options in the Network Access Protection Client Agent Properties, Evaluation tab, see Network Access Protection Client Agent Properties: Evaluation Tab

See Also

Concepts

About Compliance for Network Access Protection in Configuration Manager
About the Statement of Health (SoH) in Network Access Protection
About NAP Evaluation in Network Access Protection


How to Disable the Network Access Protection Client Agent

Disabling the Network Access Protection client agent in Configuration Manager 2007 has the following results:

  • Network Access Protection is disabled for the site, which means that status information will no longer be current on the Network Access Protection home page and Configuration Manager 2007 automatic remediation will cease to function as soon as NAP-capable clients download their latest machine policy.
  • The Policies node will no longer be available to view, create, delete, or modify Configuration Manager NAP policies.
  • The Network Access Protection home page will continue to show the existing data until it is aged out.

To disable the Network Access Protection client agent

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name>/ Site Settings / Client Agents.

  2. Right-click Network Access Protection Client Agent, and then click Properties.

  3. On the General tab, deselect the option Enable Network Protection on clients.

  4. Click OK.

  5. Click the Network Access Protection node, and press F5 to refresh the display.

See Also

Tasks

How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection
How to Remove the System Health Validator Point

Concepts

About Latency in the Configuration Manager Console
About Enabling and Disabling Network Access Protection
About the NAP Client Status in Network Access Protection


How to Configure the System Health Validator Point for Network Access Protection

If you are using Network Access Protection (NAP) with Configuration Manager 2007 and you have a Microsoft Windows Network Policy Server in your Configuration Manager 2007 site, you must install and configure one or more System Health Validator points.

After a System Health Validator point has been installed for a site, you can then modify any default Configuration Manager configuration options for the System Health Validator component and these settings will apply to all System Health Validator points in the site.

After a System Health Validator point is installed, the Configuration Manager System Health Validator will be visible in the Network Policy Server console as one of the System Health Validators, under the Network Access Protection node and can now be included in policies to determine network access and remediation for Configuration Manager clients that can support Network Access Protection.

The content in this section provides the steps necessary to accomplish each task associated with configuring the System Health Validator point in Configuration Manager.

How to Configure the System Health Validator Point Installation Account

How to Install the System Health Validator Point

How to Configure the System Health Validator Active Directory Domain Services Query Interval

How to Specify the Validity Period for the Statement of Health

How to Specify the Option 'Date created must be after' for the Statement of Health

How to Specify the Location of the NAP Health State Reference

How to Specify the Health State Reference Publishing Account

How to Specify the Health State Reference Querying Account

How to Remove the System Health Validator Point


How to Configure the System Health Validator Point Installation Account

The Configuration Manager 2007 System Health Validator point resides on the computer running Network Policy Server. To install this component for a site, Configuration Manager needs installation permissions.

When the Network Policy Server is in the same Active Directory forest as the Configuration Manager 2007 site server, or a trust exists between the two server domains, the computer account of the site server is used for installation without further configuration. However, when the Network Policy Server is not in the same Active Directory forest as the site server, or the domain in which the Network Policy Server resides does not trust the site server's domain (for example, through a forest trust or external trust), you must specify an installation account that can be used on the Network Policy Server computer.

This installation account requires administrative rights to install the System Health Validator point and to configure the System Health Validator component.

How you configure the System Health Validator point installation account depends on whether you need to define the Network Policy Server as a site system server, or whether you are adding the System Health Validator role to an existing site system server.

Note
The installation account will be used by all the selected site system roles on the server for both installation and configuration of that component.

To configure the System Health Validator point and specify the installation account on a new site system server:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Site Systems.

  2. Right-click Site System Roles, click New, and then click Server to launch the New Site System Server Wizard.

  3. On the General page, specify the server name and then click Use another account for installing this site system.

  4. Click Set, and in the Windows User Account dialog box, specify the account to use, type in the password and password verification, click OK, and then click Next.

  5. On the System Role Selection page, select System Health Validator.

  6. Click Next, click Finish, and then click Close.

To create the System Health Validator point and specify the installation account on an existing site system server:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Site Systems.

  2. Right-click the existing site system server to which you want to add the System Health Validator point, and then click New Roles to launch the New Site Roles Wizard.

  3. On the General page, specify the server name and then click Use another account for installing this site system.

  4. Click Set, and in the Windows User Account dialog box, specify the account to use, type in the password and password verification, click OK, and then click Next.

  5. On the System Role Selection page, select System Health Validator.

  6. Click Next, click Finish, and then click Close.

See Also

Tasks

How to Install the System Health Validator Point

Concepts

About System Health Validator Points in Network Access Protection


How to Install the System Health Validator Point

How you install a Configuration Manager 2007 System Health Validator point depends on whether you first need to define the Network Policy Server as a site system server, or whether you are adding the System Health Validator point role to an existing site system server.

Note
You cannot install a System Health Validator point on a server share or on a secondary site.

To install a System Health Validator point on a new site system server

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings.

  2. Right-click Site Systems, click New, and then click Server to launch the New Site System Server Wizard.

  3. On the General page, specify the server name, and if you cannot use the site server computer account for installation specify an installation account, and then click Next.

  4. On the System Role Selection page, select System Health Validator.

  5. Click Next, click Finish, and then click Close.

To install a System Health Validator point on an existing site system server

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings.

  2. Right-click the existing site system server to which you want to add the System Health Validator point, and then click New Roles to launch the New Site Roles Wizard.

  3. On the General page, click Next.

  4. On the System Role Selection page, select System Health Validator.

  5. Click Next, click Finish, and then click Close.

See Also

Tasks

How to Remove the System Health Validator Point

Concepts

About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection


How to Configure the System Health Validator Active Directory Domain Services Query Interval

The Configuration Manager 2007 System Health Validator point periodically queries Active Directory Domain Services for NAP health state references and uses the cached results when validating the statement of health presented by Configuration Manager Client NAP-capable clients.

To configure the System Health Validator query interval:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click System Health Validator Point Component, and then click Properties.

  2. On the General tab, specify the number of minutes you want to be used for the Query interval (minutes) option under the Active Directory Domain Services query interval and then click OK.

Note
For more information about the options in this dialog box, see System Health Validator Point Component Properties: General Tab.

See Also

Concepts

About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection


How to Specify the Validity Period for the Statement of Health

The Configuration Manager 2007 System Health Validator point will accept a cached statement of health as long as it does not conflict with its setting for the validity period or the option Date created must be after (UTC).

To configure the validity period for the statement of health

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click System Health Validator Point Component, and then click Properties.

  2. On the General tab, specify the number of hours you want for the Validity period (hours) in the section Statement of health time validation.

  3. Click OK.

Note
For more information about the options in this dialog box, see System Health Validator Point Component Properties: General Tab.

See Also

Concepts

About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection


How to Specify the Option 'Date created must be after' for the Statement of Health

The Configuration Manager 2007 System Health Validator point will determine that a client health status is non-compliant if the following option is set and the client statement of health is created before or on the configured date and time: Date created must be after (UTC).

To configure the option 'Date created must be after' for the statement of health time validation

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click System Health Validator Point Component, and then click Properties.

  2. On the General tab, select Date created must be after (UTC) and then set the date and time.

  3. Click OK.

Note
For more information about the options in this dialog box, see System Health Validator Point Component Properties: General Tab.

See Also

Tasks

How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection
How to Specify the Validity Period for the Statement of Health

Concepts

About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection


How to Specify the Location of the NAP Health State Reference

When the Configuration Manager 2007 site server and System Health Validator points reside in the same Active Directory forest, the Configuration Manager NAP health state reference is located in the same Active Directory forest and the default settings can be used.

When the site server and System Health Validators are not in the same Active Directory forest, you must designate which Active Directory forest and which domain will be used to store and retrieve the NAP health state reference.

Important
The Active Directory forest that will contain the NAP health state reference must be extended with the Configuration Manager 2007 schema extensions, have a System Management container, and Configuration Manager 2007 must be configured to publish to Active Directory. For information about how to extend the Configuration Manager 2007 schema and publish to Active Directory, see How to Extend the Active Directory Schema for Configuration Manager.

To specify the location of the health state reference:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click System Health Validator Point Component, and then click Properties.

  2. On the Health State Reference tab, click Designate an Active Directory forest.

  3. Under the section Active Directory forest settings, specify the fully qualified domain that will contain the health state reference in the field Domain suffix.

  4. Click OK.

Note
For more information about the options in this dialog box, see System Health Validator Point Component Properties: Health State Reference Tab.

See Also

Concepts

About Network Access Protection and Multiple Active Directory Forests
About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection


How to Specify the Health State Reference Publishing Account

When a Configuration Manager 2007 Network Access Protection (NAP) policy is created or modified, the site system writes a NAP health state reference to Active Directory Domain Services so that the System Health Validator point can use it to validate the client statement of health.

If you do not specify a health state reference publishing account, the site server computer account is used, which is appropriate if the site server resides in the same Active Directory forest as the health state reference. However, if you are using a designated Active Directory forest and the site server does not have permission to write to the domain suffix specified, you must specify a Microsoft Windows user account for the health state reference publishing account.

This user account must have Full Control permissions to the System Management container (and all child objects) in the health state reference location.

Important
The Active Directory forest that will contain the health state reference must be extended with the Configuration Manager 2007 schema extensions, have a System Management container, and Configuration Manager 2007 must be configured to publish to Active Directory Domain Services. For information about how to extend the Configuration Manager 2007 schema and publish to Active Directory, see How to Extend the Active Directory Schema for Configuration Manager.

To specify the health state reference publishing account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click System Health Validator Point Component, and then click Properties.

  2. On the Health State Reference tab, under the section Active Directory forest settings, click the Set button next to the Health state reference publishing account.

  3. In the Windows User Account dialog box, specify the account to use, type in the password and password verification, and click OK.

  4. Click OK to close the System Health Validator Component Properties dialog box.

Note
For more information about the options in this dialog box, see System Health Validator Point Component Properties: Health State Reference Tab.

See Also

Tasks

How to Specify the Health State Reference Querying Account
How to Specify the Location of the NAP Health State Reference

Concepts

About Network Access Protection and Multiple Active Directory Forests
About NAP Health State References in Network Access Protection
Network Access Protection Accounts
About System Health Validator Points in Network Access Protection


How to Specify the Health State Reference Querying Account

The Configuration Manager 2007 System Health Validator point periodically retrieves Network Access Protection (NAP) health state references from Active Directory Domain Services so that it can validate a statement of health from Configuration Manager NAP-capable clients.

If you do not specify a health state reference querying account, the computer account of the System Health Validator is used, which is appropriate if the System Health Validator point resides in the same Active Directory forest as the health state reference location, or if you are using a designated Active Directory forest and a trust exists between the domains that contain the System Health Validator points and the domain that contains the health state references.

However, if there is no trust relationship between the domains that contain the System Health Validator points and the domain that contains the health state references, you must specify a Microsoft Windows user account for the health state reference querying account.

Important
The Active Directory forest that will contain the health state reference must be extended with the Configuration Manager 2007 schema extensions, have a System Management container, and Configuration Manager 2007 must be configured to publish to Active Directory Domain Services. For information about how to extend the Configuration Manager 2007 schema and publish to Active Directory, see How to Extend the Active Directory Schema for Configuration Manager.

To specify the health state reference querying account:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click System Health Validator Point Component, and then click Properties.

  2. On the Health State Reference tab, under the section Active Directory forest settings, click the Set button next to the Health state reference querying account.

  3. In the Windows User Account dialog box, specify the account to use, type in the password and password verification, and then click OK.

  4. Click OK to close the System Health Validator Component Properties dialog box.

Note
For more information about the options in this dialog box, see System Health Validator Point Component Properties: Health State Reference Tab.

See Also

Tasks

How to Specify the Health State Reference Publishing Account
How to Specify the Location of the NAP Health State Reference

Concepts

About Network Access Protection and Multiple Active Directory Forests
About NAP Health State References in Network Access Protection
Network Access Protection Accounts
About System Health Validator Points in Network Access Protection


How to Remove the System Health Validator Point

You should remove a Configuration Manager 2007 System Health Validator point if you no longer require this site system role on a Network Policy Server computer.

Important
Before removing a System Health Validator point, you must make sure that there is either another System Health Validator point for the site, or that the Network Policy Server has policies that grant network access and do not reference the Configuration Manager System Health Validator. Failing to do so might result in NAP-capable clients on this site being unable to access either the full or restricted network.

Removing the System Health Validator point role removes all registry keys associated with this role. However, the SMS Executive service installs the following registry key, which you can manually delete if the server is not used for any other Configuration Manager service: HKLM\SOFTWARE\Microsoft\SMS.

To remove the System Health Validator point from a site system server

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Site Systems.

  2. Click the server that has installed the System Health Validator point that you want to remove.

  3. Select Configuration Manager System Health Validator, and then press Delete.

  4. Click Yes to confirm.

See Also

Tasks

How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection
How to Disable the Network Access Protection Client Agent

Other Resources

Configuring the Network Policy Server for Configuration Manager


Configuring the Network Policy Server for Configuration Manager

Topic last updated -- August 2007

After you have installed a Configuration Manager System Health Validator point on the Network Policy Server, configuration to support Network Access Protection (NAP) with Configuration Manager includes the following steps:

  • Create two health policies: one for a compliant status, and another for a non-compliant status. Both must select the Configuration Manager System Health Validator, and one must be configured with a health policy type that passes an SHV check, while the other one must be configured with a health policy type that fails an SHV check. For more information, see Configuring Health Policies for Configuration Manager Network Access Protection.
  • Configure a Remediation Server Group for infrastructure servers if you are using DHCP or VPN NAP enforcement. Add infrastructure servers that are required during remediation, such as DNS servers and domain controllers. There is no need to add any Configuration Manager servers into this remediation server group because these will be dynamically requested by non-compliant Configuration Manager clients. For more information, see Configuring Remediation Server Groups for Configuration Manager Network Access Protection.
  • Configure a connection request policy that selects the Network Access Protection enforcement mechanism as the Type of network access server (such as DHCP Server or Health Registration Authority), and includes a time and day condition. For more information, see Configuring Connection Request Policies for Configuration Manager Network Access Protection.
  • Configure three network policies: one for Configuration Manager compliant computers, one for Configuration Manager non-compliant computers, and one for computers that are not able to support Network Access Protection (that is, they are NAP ineligible). Only the first network policy to match by connecting clients is processed. This means that these three Configuration Manager network policies must be ordered before general network policies that deny access. For more information, see Configuring Network Policies for Configuration Manager Network Access Protection.
    Important
    Policies for Configuration Manager must be configured for Grant Access (even for non-compliant computers so that they can access remediation servers) and no authentication.

  • Configure the Configuration Manager System Health Validator on the Network Policy Server. The properties of the Configuration Manager System Health Validator have a single Settings tab. The Configure button in this tabbed dialog box is not enabled because these settings are configured in the Configuration Manager console, under Component Configuration, System Health Validator Point. However, you can configure here the Error code resolutions that determine whether certain error conditions consider the client to be compliant or non-compliant. For more information, see Configuring Failure Categories for Configuration Manager Network Access Protection.
  • Consider configuring the logging options on the Network Policy Server. For more information, see Configuring Logging for Configuration Manager Network Access Protection.
  • Consider the user experience if remedation fails, by constructing a helpful troubleshooting Web site. For more information, see Configuring the Remediation User Experience for Configuration Manager Network Access Protection.

For more information about Network Access Protection and configuring policies on the Network Policy Server, see "Introduction to Network Access Protection" (http://go.microsoft.com/fwlink/?LinkId=80666) and "Configuring Network Access Protection Policies in Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkId=57932).

In This Section

Use the following topics as guidance for modifying existing policies on the Network Policy Server to include Configuration Manager policies. Before adding policies for Configuration Manager, ensure the following are confirmed as working:

  • Windows clients can successfully remediate using the default Windows policies, for example clients that are not configured with the Windows firewall enabled are restricted, the firewall is then automatically enabled, and then the client has full network access. This proves the underlying infrastructure and configuration is working for Network Access Protection before adding Configuration Manager policies.
  • Configuration Manager clients can successfully install required software updates on the unlimited network using the software updates feature. This proves the underlying infrastructure and configuration is working for software updates in Configuration Manager before moving this functionality into the Network Access Protection environment.
Configuring Health Policies for Configuration Manager Network Access Protection

Specifies the configuration required for health policies on the Network Policy Server for Configuration Manager Network Access Protection.

Configuring Remediation Server Groups for Configuration Manager Network Access Protection

Specifies the configuration required for remediation server groups on the Network Policy Server for Configuration Manager Network Access Protection.

Configuring Connection Request Policies for Configuration Manager Network Access Protection

Specifies the configuration required for connection request policies on the Network Policy Server for Configuration Manager Network Access Protection.

Configuring Network Policies for Configuration Manager Network Access Protection

Specifies the configuration required for network policies on the Network Policy Server for Configuration Manager Network Access Protection.

Configuring Exemption Policies for Configuration Manager Network Access Protection

Provides examples of how you can configure exemption policies for Configuration Manager Network Access Protection.

Configuring Failure Categories for Configuration Manager Network Access Protection

Specifies the steps required for configuring the Configuration Manager System Health Validator failure categories.

Configuring Logging for Configuration Manager Network Access Protection

Specifies the steps required for configuring logging on the Network Policy Server.

Configuring the Remediation User Experience for Configuration Manager Network Access Protection

Provides guidance on how to configure the Web site users are directed to when remediation fails.

See Also

Concepts

Determine Your Policy Strategy for Network Access Protection
Determine If You Should Install a System Health Validator Point for Network Access Protection
About the Network Access Protection Process
About System Health Validator Points in Network Access Protection
About Network Access Protection Remediation

Other Resources

How to Configure the System Health Validator Point for Network Access Protection


Configuring Health Policies for Configuration Manager Network Access Protection

Topic last updated -- August 2007

Before you create the network policies for Configuration Manager 2007 on the Network Policy Server, you must have two health policies that match to a compliant or non-compliant status.

To create the System Health Validator health policies for just Configuration Manager, follow these procedures:

  1. Load the Network Policy Server console.
  2. Expand Polices.
  3. Right-click Health Policies, and then click New.
  4. Under Policy name, type a descriptive name (such as Configuration Manager Compliant for your compliant health policy, and Configuration Manager Non-Compliant for your non-compliant health policy).
  5. For the option Client SHV checks, select Client passes all SHV checks for the compliant health policy, and Client fails one or more SHV checks for the non-compliant template.
  6. Under the section SHVs used in this health policy, select Configuration Manager System Health Validator.

For more information about creating health policies, see the following white paper:

"Configuring Network Access Protection Policies in Windows Server 2008" (http://go.microsoft.com/fwlink/?LinkId=57932).

See Also

Other Resources

Configuring the Network Policy Server for Configuration Manager


Configuring Remediation Server Groups for Configuration Manager Network Access Protection

Topic last updated -- August 2007

Remediation server groups are used with Network Access Protection if you are using DHCP Network Access Protection enforcement or VPN Network Access Protection enforcement. They are not used with 802.1X Network Access Protection (NAP) enforcement mechanism, or IPsec NAP enforcement with a Health Registration Authority. However, with IPsec NAP enforcement, all remediation servers should be configured as boundary servers.

Remediation servers in Network Access Protection are servers that are available on the restricted network. For Configuration Manager 2007, remediation servers include management points, software update points, and the distribution points that host the software updates required to bring computers into compliance. You might also need infrastructure servers such as DNS servers for name resolution, domain controllers for authentication and Group Policy, and a global catalog server for locating Configuration Manager 2007 services.

You configure remediation server groups on the Network Policy Server and reference a particular remediation server group as part of the network policy for non-compliant computers.

Do not add Configuration Manager 2007 remediation servers to a Network Policy Server remediation server group. When remediation is invoked, the client automatically requests connections to its management point, software update point, and the nearest distribution points that host any required software updates. However, you will still need to create or configure a remediation server group that contains infrastructure servers such as DNS servers.

Note
Do not add the Network Policy Server into the remediation server group. This server is automatically added, although not visible in the Network Policy Server console.

To configure a remediation server group in Network Policy Server, follow these steps:

  1. Load the Network Policy Server console, and expand Network Access Protection.
  2. Right-click Remediation Server Groups, and then click New.
  3. In the New Remediation Server Group dialog box, supply a name for the Group Name that you will select in the non-compliant network.
  4. Click Add, and in the Add New Server dialog box, supply a descriptive name of your choice for the Friendly Name, type the IP address or DNS name of the remediation server.
  5. If you typed a DNS name, you can optionally click Resolve to ensure that the name resolves successfully to an IP address.
  6. Click OK to close the Add New Server dialog box.
  7. If you require additional remediation servers, repeat steps 4 through 6.
  8. Click OK to close the New Remediation Server Group dialog box.

See Also

Concepts

About Network Access Protection Remediation

Other Resources

Network Access Protection in Configuration Manager


Configuring Connection Request Policies for Configuration Manager Network Access Protection

Topic last updated -- August 2007

When configuring connection request policies for Configuration Manager Network Access Protection on the Network Policy Server, you need just one connection request policy, and you can edit the built-in policy named Use Windows authentication for all users.

For Configuration Manager Network Access Protection, the settings you need in the connection request policy are the following:

  • On the Overview tab, select Policy enabled.
  • On the Overview tab, in the Network connection method section, specify your Type of network access server. This option refers to the Network Access Protection enforcement technology you are using, such as DHCP Server, or Health Registration Authority for IPsec.
  • On the Conditions tab, specify any Day and time restrictions (the default is to permit 7 days a week and 24 hours).

See Also

Concepts

Configuring Network Policies for Configuration Manager Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


Configuring Network Policies for Configuration Manager Network Access Protection

Topic last updated -- August 2007

When you are configuring the Network Policy Server for Configuration Manager Network Access Protection, you will need to configure three network policies:

  • Compliant (for NAP-capable clients that are proved to be compliant with Configuration Manager Network Access Protection policies, and compliant with the Configuration Manager System Health Validator criteria)
  • Non-Compliant (for NAP-capable clients that are non-compliant with Configuration Manager Network Access Protection policies, or non-compliant with the Configuration Manager System Health Validator criteria)
  • NAP-Ineligible (for clients that cannot support Network Access Protection)

You can either modify existing network policies or create new ones for Configuration Manager:

  • To create new network policies, in the Network Policy Server console expand Policies, right-click Network Policies, and then click New to launch the New Network Policy Wizard.
  • To modify existing network policies, in the Network Policy Server console expand Policies, click Network Policies, right-click the policy to modify in the results pane, and then click Properties. You can use an existing policy as a template by right-clicking the original policy, click Duplicate Policy, right-click the selected duplicate policy, and then click Properties.

The following sections list the properties required in a network policy that relate to Configuration Manager Network Access Protection.

Compliant Network Policy

  • On the Overview tab, select Policy enabled.
  • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
  • On the Conditions tab, add the condition of Health Policies, select the Compliant health policy created earlier, and then click OK.
  • On the Constraints tab, for DHCP and IPsec enforcement only, click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
  • On the Settings tab, click NAP Enforcement under the section Network Access Protection, click Allow full network access, and then click OK.

Non-Compliant Network Policy

  • On the Overview tab, select Policy enabled.
  • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
  • On the Conditions tab, add the condition of Health Policies, select the Non-Compliant health policy created earlier, and then click OK.
  • On the Constraints tab, for DHCP and IPsec enforcement only, click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
  • On the Settings tab, click NAP Enforcement under the section Network Access Protection, and then click one of the following:
    • Allow full network access for a limited time, and then use the Date and Time options to set when computers should have restricted network access if their health state remains non-compliant.
    • Allow limited access if you want non-compliant computers to connect to the restricted network immediately.
  • On the Settings tab, click NAP Enforcement, click Configure in the section Remediation Server Group and Troubleshooting URL, and in the Remediation Servers and Troubleshooting URL dialog box specify the following, and then click OK:
    • In the section Remediation Server Group, select the remediation server group you created earlier, which contains infrastructure servers such as DNS servers.
    • In the section Troubleshooting URL, type in the link to a Web page accessible from the restricted network you want users to see when they are in remediation.
Note
There is no need to select the option Enable auto-remediation of client computers in the section Auto remediation. Network Access Protection in Configuration Manager always automatically remediates non-compliant clients when the health policy is configured for either Allow full network access for a limited time or Allow limited access. However, you might need to select this check box for non-Configuration Manager System Health Agents and System Health Validators.

NAP-Ineligible Network Policy

  • On the Overview tab, select Policy enabled.
  • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
  • On the Conditions tab, add the condition of NAP-Capable Computers, select the Only computers that are not NAP-capable, and then click OK.
  • On the Constraints tab, for DHCP and IPsec enforcement only, click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
  • On the Settings tab, click NAP Enforcement under the section Network Access Protection, click Allow full network access, and then click OK.

See Also

Concepts

Configuring the Remediation User Experience for Configuration Manager Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


Configuring Exemption Policies for Configuration Manager Network Access Protection

Topic last updated -- August 2007

When you are using Network Access Protection with Configuration Manager 2007, the first matching network policy on the Network Policy Server will be applied to connecting clients. This means that exceptions and exemptions require their own policies that match only them, with different settings than standard policy settings.

Examples

The following lists some sample scenarios with guidance on how exemptions can be achieved for Configuration Manager Network Access Protection (NAP):

  • Specified people will never have limited network access.
  • Desktop computers will have full network access for a limited time if non-compliant whereas laptop computers will have limited access if non-compliant.
  • During the hours that a local helpdesk is not available, non-compliant computers will have full network access for a limited time rather than limited access.
  • Specified machines will not be checked for their Configuration Manager health state. This would be applicable if the Configuration Manager client should not be installed on selected computers.

Specified people will never have limited network access

  1. Create a new network policy that has the following configuration:
    • On the Overview tab, select Policy enabled.
    • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
    • On the Conditions tab, add the condition of Windows Groups, click Add Groups, select the group that contains all the people who should always have full network access without remediation, as if compliant. Click the group you have just selected, click OK, and then click OK to close the Windows Groups dialog
    • On the Conditions tab, add the condition of Health Policies, select the Compliant health policy created earlier, and then click OK.
    • On the Constraints tab, for DHCP and IPsec enforcement only click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
    • On the Settings tab, click NAP Enforcement under the section Network Access Protection, click Allow full network access, and then click OK.
  2. Order this policy before the Configuration Manager network policy that references the compliant health policy and does not have a Windows Groups condition.

Desktop computers will have full network access for a limited time if non-compliant whereas laptop computers will have limited access if non-compliant

  1. Create a non-compliant network policy for desktop networked computers:
    • On the Overview tab, select Policy enabled.
    • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
    • On the Conditions tab, add the condition of Machine Groups, click Add Groups, select the group that contains all the computers that should have full network access for a limited time if non-compliant. Click the group you have just selected, click OK, and then click OK to close the Machine Groups dialog box.
    • On the Conditions tab, add the condition of Health Policies, select the Non-Compliant health policy created earlier, and then click OK.
    • On the Constraints tab, for DHCP and IPsec enforcement only click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
    • On the Settings tab, click NAP Enforcement under the section Network Access Protection, and then click Allow full network access for a limited time, and then use the Date and Time options to set when computers should have restricted network access if their health state remains non-compliant.
    • On the Settings tab, click NAP Enforcement, click Configure in the section Remediation Server Group and Troubleshooting URL, and in the Remediation Servers and Troubleshooting URL dialog box specify the following, and then click OK:
      In the section Remediation Server Group, select the remediation server group you created earlier, which contains infrastructure servers such as DNS servers.
      In the section Troubleshooting URL, type in the link to a Web page accessible from the restricted network you want users to see when they are in remediation.
  2. Create a non-compliant network policy for laptop computers:
    • On the Overview tab, select Policy enabled.
    • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
    • On the Conditions tab, add the condition of Machine Groups, click Add Groups, select the group that contains all the laptop computers that should have restricted network access if non-compliant. Click the group you have just selected, click OK, and then click OK to close the Machine Groups dialog box.
    • On the Conditions tab, add the condition of Health Policies, select the Non-Compliant health policy created earlier, and then click OK.
    • On the Constraints tab, for DHCP and IPsec enforcement only, click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
    • On the Settings tab, click NAP Enforcement under the section Network Access Protection, and then click Allow limited access.
    • On the Settings tab, click NAP Enforcement, click Configure in the section Remediation Server Group and Troubleshooting URL, and in the Remediation Servers and Troubleshooting URL dialog box specify the following, and then click OK:
      In the section Remediation Server Group, select the remediation server group you created earlier, which contains infrastructure servers such as DNS servers.
      In the section Troubleshooting URL, type in the link to a Web page accessible from the restricted network you want users to see when they are in remediation.
  3. Order the non-compliant network policy for laptop computers before the non-compliant network policy for desktop computers.

During the hours that a local helpdesk is not available, non-compliant computers will have full network access for a limited time rather than limited access.

  1. Create a non-compliant network policy for full network access for a limited time from 2 a.m. to 4 a.m. only:
    • On the Overview tab, select Policy enabled.
    • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
    • On the Conditions tab, add the condition of Day and Time Restrictions, select 2am-4am, click Permitted, and then click OK.
    • On the Conditions tab, add the condition of Health Policies, select the Non-Compliant health policy created earlier, and then click OK.
    • On the Constraints tab, for DHCP and IPsec enforcement only click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
    • On the Settings tab, click NAP Enforcement under the section Network Access Protection, and then click Allow full network access for a limited time, and then use the Date and Time options to set when computers should have restricted network access if their health state remains non-compliant.
    • On the Settings tab, click NAP Enforcement, click Configure in the section Remediation Server Group and Troubleshooting URL, and in the Remediation Servers and Troubleshooting URL dialog box specify the following, and then click OK:
    • In the section Remediation Server Group, select the remediation server group you created earlier, which contains infrastructure servers such as DNS servers.
    • In the section Troubleshooting URL, type in the link to a Web page accessible from the restricted network you want users to see when they are in remediation.
  2. Make sure this policy is ordered before the non-compliant policy that has no condition for day and time restrictions.

Specified machines will not be checked for their Configuration Manager health state. This would be applicable if the Configuration Manager client should not be installed on selected computers.

  1. Create a new health policy that does not reference the Configuration Manager System Health Validator, but does include the other System Health Validators you are using.
  2. Create a new network policy:
    • On the Overview tab, select Policy enabled.
    • On the Overview tab, select the access permission of Grant Access. Grant access if the connection request matches this policy.
    • On the Conditions tab, add the condition of Machine Groups, click Add Groups, select the Windows group that contains all the computers that must not have the Configuration Manager client installed. Click the group you have just selected, click OK, and then click OK to close the Machine Groups dialog box.
    • On the Conditions tab, add the condition of Health Policies, select the new health policy that does not reference the Configuration Manager System Health Validator, and then click OK.
    • On the Constraints tab, for DHCP and IPsec enforcement only, click Perform machine health check only. Note that this setting should not be selected if you are using VPN or 802.1X as your enforcement mechanism.
    • On the Settings tab, click NAP Enforcement under the section Network Access Protection, click Allow full network access, and then click OK.
  3. Order this network policy before any other that references the Configuration Manager health policies.

See Also

Concepts

Determine Your Policy Strategy for Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


Configuring Failure Categories for Configuration Manager Network Access Protection

When the System Health Validator point in Configuration Manager 2007 is not able to provide a health status to the Network Policy Server because of an error condition, it sends a Failure Category and code to the Network Policy Server. By default, these are matched to a non-compliant status, which is the more secure configuration than matching it a compliant status. However, failure categories can be configured for either compliant or non-compliant in the Configuration Manager System Health Validator properties in the Network Policy Server console.

If the error is on the client side, the System Health Validator point sends either a Client Component Failure Category or a Client Communication Failure Category. In the Configuration Manager System Health Validator properties on the Network Policy Server, these match to SHA not responding to NAP client and SHA unable to contact required services, respectively.

If the error is on the Network Policy Server side, the System Health Validator point sends either a Server Component Failure Category or a Server Communication Failure Category. In the Configuration Manager System Health Validator properties on the Network Policy Server, these match to SHV not responding and SHV unable to contact required services, respectively.

Any other errors including a compliance status of Unknown (for example, if the System Health Validator was unable to retrieve a system health reference for the client's site) match to the option SHA vendor specific error code received.

To change the default error mapping of Non-compliant to Compliant, use the following steps:

  1. Load the Network Policy Server console, and navigate to Network Access Protection, and then expand System Health Validators.
  2. Right-click Configuration Manager System Health Validator, and then click Properties.
  3. Use the drop-down list against each of the follow error conditions and configure them for compliant or non-compliant:
    • SHV unable to contact required services.
    • SHA unable to contact required services.
    • SHA not responding to NAP Client.
    • SHV not responding.
    • SHA vendor specific error code received.
  4. Click OK.

See Also

Concepts

Network Access Protection Failure Categories and Error Codes
About System Health Validator Points in Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


Configuring Logging for Configuration Manager Network Access Protection

When you are using Network Access Protection with Configuration Manager 2007, you might want to configure logging options on the Network Policy Server to help you identify and troubleshoot Network Access Protection operations.

The Network Policy Server can be configured to log to a local file (in either IAS format or Database-compatible format) and also to a Microsoft SQL Server. By default, the local file logs Accounting requests, Authentication requests, and Periodic status to a weekly file to the folder %windir%\system32\LogFiles with the file name IN<date>.log.

When using Configuration Manager Network Access Protection (NAP), consider changing the default logging creation interval to daily so that you can more easily locate the entries you need.

To modify the logging configuration on the Network Policy Server, follow these steps:

  1. Load the Network Policy Server console.
  2. Click the Accounting node.
  3. Right-click Local File, and then click Properties.
  4. Click the Log File tab to modify the logging folder, the format of the files, and when a new log file should be created.

See Also

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


Configuring the Remediation User Experience for Configuration Manager Network Access Protection

Although remediation with Network Access Protection (NAP) in Configuration Manager 2007 is designed to happen automatically, you should plan the user experience so that you provide troubleshooting information specific to your users if remediation fails. This could include basic information about why there is a delay in accessing the network and a Help Desk number to call. Or it could include links to help diagnose and resolve the issue outside Configuration Manager. Providing user help is particularly important if your Network Policy Server restricts non-compliant computers and remediation fails.

Remediation can fail for a number of reasons, including the following:

  • The computer does not have the Configuration Manager client installed.
  • The client cannot contact its management point (for example, there is a network problem).
  • Content is not available (for example, the softare update package has been deleted or there are network problems between the client and distribution points).

Each network policy that enforces compliance on the restricted network can specify a troubleshooting URL, which directs users to a local Web site that is accessible on the restricted network. If it contains links to resources, these must also be accessible from that restricted network. You must provide the local Web site and build your own customized page using basic HTML. If remediation fails, the Network Access Protection client notification will display a More Information button to access the Web site.

As an example, your Web page might include some branding information to reassure users the interruption to network access is a necessary part of your company's normal procedure with a Help Desk number to call. Then you could include a separate section on diagnosis, such as automatic or manual checking for the presence of the Configuration Manager client with a link to install it if necessary. The diagnostics section could generate a file to either send to the Help Desk or to be saved locally that contains configuration information about the computer to help identify the computer and its configuration status.

Make sure you have this page available, and confirm the links before deploying Network Access Protection.

To specify the Troubleshooting URL, follow this procedure:

  1. On the Network Policy Server, edit the network policy for non-compliant computers.
  2. Click the Settings tab, and then click NAP Enforcement under the section Network Access Protection.
  3. Click Configure in the section Remediation Server Groups and Troubleshooting URL.
  4. In the Troubleshooting URL section, type in the link to a Web page accessible from the restricted network you want users to see when they are in remediation.
  5. Click OK to close the Remediation Servers and Troubleshooting URL dialog box, and then click OK to close the network policy properties.

You can also use Group Policy settings to configure branding for the Network Access Protection client that appears on the computer notification area. Specify your choice of title, description and image for the User Interface Settings, under the following Group Policy location: Computer Configuration \ Windows Settings \ Security Settings \ Network Access Protection. Locally, you can specify the same settings with the Windows Vista MMC snap-in named NAP Client Configuration.

See Also

Concepts

Configuring Network Policies for Configuration Manager Network Access Protection

Other Resources

Configuring the Network Policy Server for Configuration Manager
Overview of Network Access Protection


Tasks for Network Access Protection

There are many tasks that need to be performed to successfully use Network Access Protection (NAP) in Configuration Manager 2007. The content in this section provides the steps necessary to accomplish each task.

In This Section

How to Configure Configuration Manager NAP Policies for Network Access Protection

How to Monitor Network Access Protection

How to Verify Network Access Protection Components

See Also

Other Resources

Configuring Network Access Protection


How to Configure Configuration Manager NAP Policies for Network Access Protection

If you are using Network Access Protection (NAP) with Configuration Manager 2007, the content in this section provides the steps necessary to configure the NAP policies in Configuration Manager 2007 to enforce software updates for compliance.

  • How to Create a Configuration Manager NAP Policy for Network Access Protection
  • How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection
  • How to View Configuration Manager NAP Policies for Network Access Protection
  • How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection
  • How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection

See Also

Other Resources

Network Access Protection in Configuration Manager
Tasks for Network Access Protection


How to Create a Configuration Manager NAP Policy for Network Access Protection

A Configuration Manager Network Access Protection (NAP) policy in Configuration Manager 2007 defines which software updates a NAP-capable client must have by a specified date to be compliant. Before you can define a Configuration Manager NAP policy, you must first enable the Network Access Protection client agent and the software update must be downloaded with the software updates feature.

Note
You cannot create Configuration Manager NAP policies on secondary sites or on a child site if the parent site is enabled for Network Access Protection. These sites will inherit Configuration Manager NAP policies from the primary or parent site, and these policies cannot be added to, deleted, or modified except on the site on which they were created.

You can create a Configuration Manager NAP policy in a number of ways:

  • With the New Policies Wizard.
  • When creating a software update deployment with the Deploy Software Update Wizard.
  • Modifying the properties of a software update in the update repository.
  • Modifying the properties of a software update in a software update deployment package.
  • Modifying the properties of a software update in a software update deployment.

Additionally, if you have created software updates search folders, you can modify the properties of software updates that are displayed in the search folders.

To help you decide which procedure to use when creating Configuration Manager NAP policies, see Decide How To Create Configuration Manager NAP Policies for Network Access Protection.

To create a Configuration Manager NAP policy with the New Policies Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Network Access Protection / Policies.

  2. Right-click Policies and then click New Policies to launch the New Policies Wizard.

  3. Select the software updates you want to include in the Configuration Manager NAP policy, and then click Next.

  4. Configure the effective date by selecting either As soon as possible or the Date and time and selecting the date and time that the policy will become effective.

  5. Click Finish, and then click Close.

To create a Configuration Manager NAP policy with the Deploy Software Update Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Select the software updates you want to deploy, right-click, and select Deploy Software Updates to launch the Deploy Software Update Wizard. For more information about finding software updates in the Configuration Manager console, see How to Find Software Updates in Configuration Manager.

  3. Select the options you want to create for your software update deployment, and click Next until you come to the page Set NAP Evaluation.

  4. Click Enable NAP evaluation, and then configure the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  5. Click Next, Finish, and Close to complete the wizard.

To create a Configuration Manager NAP policy by modifying a software update in the update repository

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Find the software update that you want to configure for NAP evaluation, right-click, and then click Properties.

  3. On the NAP Evaluation tab, click Enable NAP evaluation, and then configure the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  4. Click OK.

To create a Configuration Manager NAP policy by modifying a software update in a deployment package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages / <deployment package name> / Software Updates.

  2. Right-click the software update that has been configured for NAP evaluation and that you want to change the effective date for, and then click Properties.

  3. On the NAP Evaluation tab, click Enable NAP evaluation, and then configure the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  4. Click OK.

To configure the effective date by modifying a software update in a software update deployment

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management / <deployment name> / Software Updates.

  2. Right-click the software update that has been configured for NAP evaluation and that you want to change the effective date for, and then click Properties.

  3. On the NAP Evaluation tab, click Enable NAP evaluation, and then configure the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  4. Click OK.

See Also

Tasks

How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection
How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection
How to Configure Search Folders for Software Updates
How to Deploy Software Updates
How to Enable the Network Access Protection Client Agent
How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection

Concepts

About Configuration Manager NAP Policies in Network Access Protection
About Folders and Search Folders
About the NAP Effective Date in Network Access Protection
Decide How To Create Configuration Manager NAP Policies for Network Access Protection


How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection

Software updates to be included in Configuration Manager 2007 Network Access Protection (NAP) evaluation are not necessarily evaluated as soon as the client receives the Configuration Manager NAP policy, but at the effective date configured in the policy. The effective date is the time the NAP policy actually becomes active, and can be configured for "As soon as possible" or a specified date and time.

On the effective date, the client will include the selected software update when evaluating its statement of health. The effective date is in Coordinated Universal Time (UTC).

You can set the effective date in the following places:

  • When creating a Configuration Manager 2007 NAP policy with the New Policies Wizard.
  • When creating a software deployment with the Deploy Software Update Wizard.
  • Modifying a Configuration Manager 2007 NAP policy.
  • Modifying the properties of a software update in the update repository.
  • Modifying the properties of a software update in a software update deployment package.
  • Modifying the properties of a software update in a software update deployment.
  • Additionally, if you have created software updates search folders, you can modify the properties of software updates that are displayed in the search folders.

To configure the effective date when creating a Configuration Manager NAP policy with the New Policies Wizard:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Network Access Protection / Policies.

  2. Right-click Policies, and then click New Policies to launch the New Policies Wizard.

  3. Select the software updates you want to include in the NAP policy, and then click Next.

  4. Configure the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  5. Click Finish, and then click Close.

To configure the effective date when creating a software update deployment with the Deploy Software Update Wizard:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Select the software updates you want to deploy, right-click, and select Deploy Software Updates to launch the Deploy Software Update Wizard. For more information about finding software updates in the Configuration Manager console, see How to Find Software Updates in Configuration Manager.

  3. Select the options you want to create for your software update deployment, and click Next until you come to the page Set NAP Evaluation.

  4. Click Enable NAP evaluation, and then configure the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  5. Click Next, Finish, and Close to complete the wizard.

To configure the effective date by modifying a Configuration Manager NAP policy:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Network Access Protection / Policies.

  2. Right-click the NAP policy that contains the effective date you want to change, and then click Properties.

  3. On the General tab, modify the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  4. Click OK.

To configure the effective date by modifying a software update in the Update Repository:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

  2. Find the software update that has been configured for NAP evaluation, right-click, and then click Properties.

  3. On the NAP Evaluation tab, modify the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  4. Click OK.

To configure the effective date by modifying a software update in a deployment package:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages / <deployment package name> / Software Updates.

  2. Right-click the software update that has been configured for NAP evaluation and that you want to change the effective date for, and then click Properties.

  3. On the NAP Evaluation tab, modify the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  4. Click OK.

To configure the effective date by modifying a software update in a software update deployment:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management / <deployment name> / Software Updates.

  2. Right-click the software update that has been configured for NAP evaluation and that you want to change the effective date for, and then click Properties.

  3. On the NAP Evaluation tab, modify the effective date either by selecting As soon as possible or selecting Date and time and specifying the date and time that the policy will become effective.

  4. Click OK.

See Also

Tasks

How to Configure Search Folders for Software Updates

Concepts

About Folders and Search Folders
About the NAP Effective Date in Network Access Protection
About Enforcing Compliance with Network Access Protection
About NAP Evaluation in Network Access Protection
About Configuration Manager NAP Policies in Network Access Protection


How to View Configuration Manager NAP Policies for Network Access Protection

After you have created Configuration Manager NAP Network Access Protection (NAP) policies in Configuration Manager 2007, the easiest way to view them in the Configuration Manager console with their Effective Date is by using the Policies node. However, the properties of a packaged software update under the Software Updates node will also display the Effective Date if it is configured for NAP evaluation.

You can also view the Configuration Manager NAP policies by running the following report: List of Network Access Protection policies.

To view Configuration Manager NAP Policies in the Policies node

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Network Access Protection / Policies.

  2. View the policies displayed in the results pane.

To display the NAP evaluation properties of a software update

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Updates Repository.

  2. Navigate to the node that contains the software update until you can see the software update details in the results pane.

  3. View the NAP Evaluation column. When a software update is included in a Configuration Manager NAP policy, this column will display the Effective Date.

See Also

Tasks

How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection
How to Run Network Access Protection Reports

Concepts

About the NAP Effective Date in Network Access Protection


How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection

You can stop a software update in Configuration Manager 2007 being included in Network Access Protection (NAP) evaluation with either of the following two procedures:

  • Delete the Configuration Manager NAP Policy that contains the software update included in NAP evaluation.
  • Deselect the Enable NAP evaluation option in the software update properties.

To delete the Configuration Manager NAP policy that contains the software update included in NAP evaluation:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Network Access Protection / Policies.

  2. Select the NAP policy that contains the software update you no longer want included in NAP evaluation.

  3. Press Delete, and click OK to confirm.

To deselect the Enable NAP evaluation option in the software update properties:

  1. Locate the software update from the Software Updates node.

  2. Right-click the software update, and click Properties.

  3. Click the Network Access Protection tab.

  4. Deselect the option Enable NAP evaluation.

  5. Click OK.

See Also

Tasks

How to Find Software Updates in Configuration Manager

Concepts

About Enabling and Disabling Network Access Protection
About NAP Evaluation in Network Access Protection
About Configuration Manager NAP Policies in Network Access Protection


How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection

A zero-day exploit usually means administrators must ensure clients have a critical software update installed as soon as possible, rather than incorporating this update into the standard administrative routine of updating computers.

In this scenario, Network Access Protection (NAP) in Configuration Manager 2007 can be configured so that selected software updates are enforced in an expedited manner, even if this results in restricted network access. This configuration involves setting the effective date to As soon as possible and also configuring the statement of health time validation option Date created must be after (UTC).

To configure a Configuration Manager NAP policy for a zero-day exploit

  1. Configure your Configuration Manager NAP policy with an effective date of As soon as possible.

  2. In the System Health Validator Point Component Properties, on the General tab, enable the option Date created must be after (UTC) and specify the date and time that you created the Configuration Manager NAP policy.

See Also

Tasks

How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection
How to Specify the Option 'Date created must be after' for the Statement of Health

Concepts

About the NAP Effective Date in Network Access Protection
About Phased and Expedited Network Access Protection Deployments
About System Health Validator Points in Network Access Protection


How to Monitor Network Access Protection

After Network Access Protection (NAP) is enabled and functioning for a Configuration manager site, the Network Access Protection node will provide you with basic information about how this is affecting clients in that site. For example, it will report the number of NAP-capable clients that have undergone remediation, the most frequently requested software updates required for remediation, and any remediation errors.

For more detailed information, however, use the Network Access Protection reports and the performance counters on the System Health Validator point.

The content in this section provides the steps necessary to accomplish monitoring tasks associated with Network Access Protection.

  • How to Run Network Access Protection Reports
  • How to Monitor the System Health Validator Point with Performance Counters for Network Access Protection

See Also

Concepts

About the Network Access Protection Process
About Reports for Network Access Protection
About System Health Validator Points in Network Access Protection

Other Resources

Tasks for Network Access Protection


How to Run Network Access Protection Reports

Network Access Protection (NAP) reports in Configuration Manager 2007 help you to plan, deploy, monitor, and troubleshoot the implementation of Network Access Protection in Configuration Manager 2007.

To run a Network Access Protection report

  1. Ensure you have a Reporting point defined for the site.

  2. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  3. In the Look For box, type Network Access Protection, ensure the Search In drop-down menu has Category selected, and then click Find Now.

  4. Right-click the Network Access Protection report you want to run, and select Run Report.

See Also

Concepts

About Reports for Network Access Protection


How to Monitor the System Health Validator Point with Performance Counters for Network Access Protection

Installing the Configuration Manager 2007 System Health Validator point results in the creation of a number of Performance counters for the object Configuration Manager System Health Validator. This allows you to baseline and monitor the following:

  • How often the Configuration Manager System Health Validator point processes statements of health.
  • When a newly installed client hasn't yet downloaded its Configuration Manager NAP policies.
  • How often a statement of health (SoH) is out of date.
  • How often a client is non-compliant with Configuration Manager NAP policies and requires software updates.
  • The number of compliant clients and the number of non-compliant clients.
  • Configuration Manager clients that have the Network Access Protection agent disabled.
  • Failures that occur on either the Configuration Manager client or the System Health Validator point.

These counters can be monitored by the Configuration Manager 2007 Management Pack for Operations Manager 2007, which can also monitor events the SMS_SYSTEM_HEALTH_VALIDATOR writes to the Windows Application event log on the Network Policy Server.

The individual Configuration Manager System Health Validator counters are listed in the following table:

Counter Name Description

Compliance is invalid

Total number of statement of health responses where the client SoH had invalid compliance information.

This condition usually indicates some kind of data corruption between the client and the System Health Validator point.

Compliance information missing

Total number of statement of health responses where the client SoH was missing the compliance information.

This condition occurs when the Network Access Protection client agent is enabled but the computer has not yet downloaded the site Configuration Manager NAP policies. This condition occurs with new clients.

The System Health Validator point will give a client in this condition a health state of compliant so that it can locate its site and management point to download Configuration Manager NAP policies and assess its compliance.

Compliance newer than health state reference

Total number of statement of health responses where the client SoH had compliance information that was newer than the health state reference.

This condition occurs when the client returns a compliance status using Configuration Manager NAP policies that are newer than the site health state reference. The statement of health is considered current.

No ConfigMgr NAP policies

Total number of statement of health responses where the client SoH had compliance information that indicated that no Configuration Manager NAP Policy had been defined yet.

This condition occurs when the Configuration Manager Network Access Protection client agent is enabled but no software updates are marked for NAP evaluation.

Compliance out of date

Total number of statement of health responses where the client was non-compliant because the client compliance information was older than the health state reference.

This condition occurs when the client's compliance information is older than the health state reference.

The System Health Validator point will give a client in this condition a non-compliant health state so that it can download the latest Configuration Manager NAP policies and re-evaluate its compliance.

Compliance matches health state reference

Total number of statement of health responses where the client SoH had compliance information that matched the health state reference and was hence deemed compliant by the Configuration Manager System Health Validator.

This condition occurs when the client's compliance information matches the health state reference. The statement of health is considered current.

Software updates not installed

Total number of statement of health responses where the client was non-compliant because all the required software updates were not installed.

This condition occurs when the client does not have applicable software updates by the Effective Date as defined in the Configuration Manager NAP policies.

The System Health Validator point will give a client in this condition a health state of non-compliant so that it can be remediated to install the software updates required for compliance.

ConfigMgr NAP client agent disabled

Total number of statement of health responses where the client was considered compliant because Configuration Manager NAP client agent was disabled (or client had no Configuration Manager NAP Client Agent policy.

This condition occurs under the following circumstances:

  • When the site is enabled for Network Access Protection but the NAP-capable client has not yet downloaded the latest machine policy to enable the new client agent setting.
  • When the System Health Validator point is installed on the site but the Network Access Protection client agent on that site is not enabled for NAP-capable clients.
  • When the site is enabled for Network Access Protection and the Network Access Protection client agent is enabled, but individual clients have a local policy that disables the Network Access Protection client agent or the Windows Network Access Protection service is not running on the client computer.
  • In a roaming scenario where a NAP-capable client from a Configuration Manager site not enabled for Network Access Protection roams into a Configuration Manager site that is enabled for Network Access Protection with a System Health Validator point.

SoH Expired (Absolute Date)

Total number of statement of health responses where the client was non-compliant because the SoH failed the time validation - Date created must be after.

This condition occurs when a client's statement of health is created before the date and time setting Date created must be after, which is configured in the System Health Validator Point Component Properties.

The System Health Validator point will give a client in this condition a health state of non-compliant so that it can be remediated to produce a newer statement of health. The client will be instructed to re-evaluate its statement of health.

SoH Expired (TTL)

Total number of statement of health responses where the client was non-compliant because the SoH failed the time validation - Validity period.

This condition occurs when a client's statement of health is outside the Validity period configured in the System Health Validator Point Component Properties.

The System Health Validator point will give a client in this condition a health state of non-compliant so that it can be remediated to produce a newer statement of health. The client will be instructed to re-evaluate its statement of health.

SoH Requests Total

Total number of statement of health requests received by the Configuration Manager System Health Validator.

SoH Requests/second

Number of statement of health requests received per second by the Configuration Manager System Health Validator.

SoH Response Failures

Number of times an error condition prevented the Configuration Manager System Health Validator from generating a statement of health response

SoH Response: Client Failures

Total number of statement of health responses where client failures were detected.

This condition occurs when the client is unable to assess its compliance because of an error condition on the client, which is either a component failure or a communication failure.

These failures can result in a health state of compliant or non-compliant, depending on how the Configuration Manager System Health Validator is configured on the Windows Network Policy Server. By default, both client failure categories are configured as non-compliant.

SoH Response: Compliant

Total number of statement of health responses where the client was compliant.

This condition occurs when the client's compliant status is successfully validated by the System Health Validator point because all the following apply:

  • The statement of health is not older than the setting Date created must be after.
  • The statement of health is within the configured Validity period.
  • The client site is valid.
  • The client has used up-to-date Configuration Manager NAP policies.

A failure did not occur on either the Configuration Manager client or the System Health Validator point.

SoH Response: Non-compliant

Total number of statement of health responses where the client was non-compliant.

This condition occurs when one of these situations apply:

  • The statement of health is older than the setting Date created must be after.
  • The statement of health is not within the configured Validity period.
  • The client does not have up-to-date Configuration Manager NAP policies.
  • The client has returned a non-compliant status because it does not have applicable software updates by the Effective Date as defined in the Configuration Manager NAP policies.

SoH Response: Server Failure

Total number of statement of health responses where server failures were detected.

This condition occurs when the System Health Validator point is unable to validate a client statement of health because of an error condition on the server, which is either a component failure or communication failure.

These failures can result in a health state of compliant or non-compliant, depending on how the Configuration Manager System Health Validator is configured on the Windows Network Policy Server. By default, both server failure categories are configured as non-compliant.

SoH Response: Unknown

Total number of statement of health responses where the client compliance could not be validated.

This condition occurs when the client's site was not known to the System Health Validator point. This can happen if Active Directory replication has not yet completed for a new Configuration Manager site or if the client is outside its Configuration Manager hierarchy.

This failure can result in a health state of compliant or non-compliant, depending on how the Configuration Manager System Health Validator is configured on the Windows Network Policy Server. By default, this error condition is configured as non-compliant.

See Also

Tasks

How to Configure the System Health Validator Active Directory Domain Services Query Interval
How to Specify the Option 'Date created must be after' for the Statement of Health
How to Specify the Validity Period for the Statement of Health

Concepts

Configuring Failure Categories for Configuration Manager Network Access Protection
About NAP Health State References in Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection


How to Verify Network Access Protection Components

When Network Access Protection (NAP) in Configuration Manager 2007 is installed and configured, you should verify that all the processes are working as expected. The following procedures explain how to verify the following:

  • How to Verify a Client is Capable of Supporting Network Access Protection
  • How to Verify Client Statements of Health for Network Access Protection
  • How to Verify Active Directory has been Provisioned for Network Access Protection
  • How to Verify the System Health Validator Point is Working Correctly for Network Access Protection
  • How to Verify the System Health Validator Point is Receiving Client Statements of Health in Network Access Protection
  • How to Verify Clients are Going into Remediation with Network Access Protection
  • How to Verify Clients are Successfully Remediated with Network Access Protection

See Also

Concepts

Log Files for Network Access Protection

Other Resources

Tasks for Network Access Protection


How to Verify a Client is Capable of Supporting Network Access Protection

To verify a Configuration Manager 2007 client is capable of supporting Network Access Protection (NAP), you can use either of the following procedures:

  • Run a Configuration Manager 2007 query.
  • Run a Configuration Manager 2007 report.

To verify a client is capable of supporting Network Access Protection by running a query

  1. Run the following Configuration Manager 2007 query:

    Copy Code
    Select NapEnabledCount from v_NAPSystemInfo

  2. Verify that the client computer name appears in the query result. If the client appears in the query result, the client is capable of supporting Network Access Protection. If the client does not appear in the query result, the client is not capable of supporting Network Access Protection or its status is not yet known to Configuration Manager 2007.

To verify a client is capable of supporting Network Access Protection by running a report

  1. Run the following Network Access Protection report: List of NAP-capable and NAP-upgradable computers.

  2. Verify that the client computer name appears in the report as NAP-capable. If the client computer is listed as NAP-capable in the report, the client is capable of supporting Network Access Protection. If the client is not listed as NAP-capable in the report, the client is not capable of supporting Network Access Protection or its status is not yet known to Configuration Manager 2007.

See Also

Concepts

About the NAP Client Status in Network Access Protection
How to Verify Network Access Protection Components


How to Verify Client Statements of Health for Network Access Protection

When verifying client statements of health, there are three verifications you can do:

  • Verify that a client is producing a statement of health.
  • Verify that a client is producing a statement of health for the Configuration Manager System Health Agent (when more than one System Health Agent is being used on the same client).
  • Verify that a client is producing a statement of health using its site Configuration Manager NAP policies.

To verify that a client is producing a statement of health:

  • Check for the presence of a recently entered line in the SMSSHA.log file: BEGIN merged SoH dump. If this line is present, the client is producing a statement of health. If this line is not present, the client is not producing a statement of health.

To verify that a client is producing a statement of health for the Configuration Manager System Health Agent (when more than one System Health Agent is being used on the same client):

  • Query the Windows Management Instrumentation (WMI) namespace using the single instance class root\ccm\smsnapagent, and verify that the following properties of the class CCM_StatementOfHealth have data recently added: StatementOfHealth, LastSoHGenerationTime, and LastEvaluationTime. If these properties have data, the client is producing a statement of health for the Configuration Manager System Health Agent. If these properties do not have data, the client is not producing a statement of health for the Configuration Manager System Health Agent.

To verify that a client is producing a statement of health using its site Configuration Manager NAP policies:

  • Verify the following log line entry exists in the SMSSHA.log file. If this entry is present, the client is producing a statement of health using its site Configuration Manager NAP policies. If it is not present, the client is not producing a statement of health using its site Configuration Manager NAP policies.

    • CORE: HandleSMSSystemHealthStateV1 soon after the line BEGIN merged SoH dump.

See Also

Concepts

How to Verify Network Access Protection Components
Troubleshooting Network Access Protection

Other Resources

Tasks for Network Access Protection


How to Verify Active Directory has been Provisioned for Network Access Protection

Before you can use Network Access Protection (NAP) in Configuration Manager 2007, you must provision Active Directory Domain Services by extending the schema with Configuration Manager 2007 schema extension and site servers must be publishing Configuration Manager health state references to Active Directory.

To verify Active Directory has been provisioned for Network Access Protection, you can use either of the following procedures:

  • Verify the existence of an Active Directory attribute.
  • Verify the existence of an entry in the System Health Validator point log file.

To verify Active Directory has been provisioned for Network Access Protection by verifying the existence of an Active Directory attribute:

  • Check for the existence of the Active Directory attribute mSSMSHealthState for the site's object in the System Management container. If this attribute exists, Active Directory has been provisioned for Network Access Protection. If this attribute does not exist, Active Directory is not provisioned for Network Access Protection.

To verify Active Directory has been provisioned for Network Access Protection by verifying the existence of an entry in the System Health Validator point log file:

  • Check for the existence of the following line in the System Health Validator point log file SmsSHVADCacheClient.log: AD Schema is EXTENDED for SMSv4 NAP. If this entry exists, Active Directory has been provisioned for Network Access Protection. If this entry does not exist, Active Directory is not provisioned for Network Access Protection.

See Also

Tasks

How to Publish Configuration Manager Site Information to Active Directory Domain Services

Concepts

About NAP Health State References in Network Access Protection
How to Verify Network Access Protection Components
Troubleshooting Network Access Protection

Other Resources

How to Extend the Active Directory Schema for Configuration Manager
Tasks for Network Access Protection


How to Verify the System Health Validator Point is Working Correctly for Network Access Protection

The following procedures allow you to check that the System Health Validator point in Configuration Manager 2007 is working correctly:

  • Verifying the System Health Validator point is installed correctly.
  • Verifying the System Health Validator service is running.
  • Verifying the System Health Validator point has successfully initialized.
  • Verifying the System Health Validator point has successfully retrieved Configuration Manager health state references from Active Directory Domain Services.

To verify that the System Health Validator point is installed correctly:

  • Look for Event ID 1015 from the SMS Server in the Application event log on the System Health Validator point, with the Task SMS_SYSTEM_HEALTH_VALIDATOR and the description that the Site Component Manager successfully installed this component on this site system. If you see this entry, the System Health Validator point is installed correctly. If this entry does not exist, the System Health Validator point is not installed correctly.

To verify that the System Health Validator service is running:

  • Look for Event ID 7036 from Source Service Control Manager in the System log with the description The SMS_SYSTEM_HEALTH_VALIDATOR service entered the running state. If you see this entry, the System Health Validator service is running. If this entry does not exist, the System Health Validator service is not running.

To verify that the System Health Validator point has successfully initialized:

  • Look for the following line in the %systemdrive%\SMSSHV\SMS_SHV\Logs\SmsSHV.log: Completed Phase 1 initialization. Service is now fully operational. If you see this entry, the System Health Validator point has successfully initialized. If this entry does not exist, the System Health Validator point has not successfully initialized.

To verify that the System Health Validator point has successfully retrieved Configuration Manager health state references from Active Directory Domain Services:

  • Look for the existence of the log file %systemdrive%\SMSSHV\SMS_SHV\Logs\SmsSHVADCacheClient.log. If this file exists, the System Health Validator point has successfully retrieved Configuration Manager health state references from Active Directory. If this file does not exist, the System Health Validator point has not successfully retrieved Configuration Manager health state references from Active Directory Domain Services.

See Also

Concepts

How to Verify Network Access Protection Components
Troubleshooting Network Access Protection

Other Resources

Tasks for Network Access Protection


How to Verify the System Health Validator Point is Receiving Client Statements of Health in Network Access Protection

To verify that the System Health Validator point in Configuration Manager 2007 is receiving client statements of health, you can use either of the following procedures:

  • Verify the existence of a log file on the System Health Validator point.
  • Use the Configuration Manager System Health Validator performance counters for the System Health Validator point.

To verify that the System Health Validator point is receiving client statements of health by verifying the existence of a log file on the System Health Validator point

  • Check for a file named %systemdrive%\SMSSHV\SMS_SHV\Logs\SMSSHVquarValidator.log.

    If this log file exists, the System Health Validator point has received client statements of health. If this log file has a current date and time, it is a good indication that the System Health Validator point is currently receiving client statements of health.

    However, if this log file does not exist or has not been updated recently, the System Health Validator point is not receiving client statements of health.

To verify that the System Health Validator point is receiving client statements of health by using the Configuration Manager System Health Validator performance counters

  • Monitor the performance counters for Configuration Manager System Health Validator: SoH Requests Total and SoH Requests/second.

    If these counters are greater than 0, the System Health Validator point is receiving client statements of health.

    If these counters are 0, the System Health Validator point is not receiving client statements of health.

See Also

Concepts

How to Verify Network Access Protection Components
Troubleshooting Network Access Protection

Other Resources

Tasks for Network Access Protection


How to Verify Clients are Going into Remediation with Network Access Protection

To verify that the Configuration Manager 2007 clients are going into remediation, you can use any one of the following procedures:

  • Run Network Access Protection reports.
  • Check a client log file for a particular entry.
  • Check for the presence of the Network Access Protection icon on the notification area.

To verify that clients are going into remediation by running Network Access Protection reports:

  1. Run one of the following Network Access Protection reports:

    • List of non-compliant computers in remediation from last polling interval
    • List of non-compliant computers in remediation within a specified period
    • Summary of non-compliant computers in remediation from last polling interval

  2. Verify that computers are listed in these reports. If computers are listed, clients are going into remediation. If no computers are listed, clients are either not going into remediation or the latest information is not available from the last polling interval.

To verify that clients are going into remediation by checking a client log file:

  • Locate the client log file %windir%\system32\CCM\Logs\ccmcca.log, and search for the following line: CORE: In Restricted or Probation access state, triggering remediation. If this line exists in the file, that client has gone into remediation. If this line does not exist in the file, that client has not gone into remediation.

To verify that clients are going into remediation using the Network Access Protection icon on the notification area:

  • When a computer undergoes remediation on the restricted network, the Network Access Protection icon will be visible in the notification area, informing users that the computer has restricted network access until required updates are installed..

    Note
    If the computer is remediating with full network access for a limited time, the Network Access Protection notification will not appear unless there is a remediation failure or a restart is required.

See Also

Tasks

How to Verify Clients are Successfully Remediated with Network Access Protection

Concepts

How to Verify Network Access Protection Components
Troubleshooting Network Access Protection

Other Resources

Tasks for Network Access Protection


How to Verify Clients are Successfully Remediated with Network Access Protection

To verify that Network Access Protection (NAP) in Configuration Manager 2007 is successfully remediating non-compliant Configuration Manager 2007 clients, you can use either of the following procedures:

  • Use the Network Access Protection client notification.
  • Look for specific state message changes logged on the client.

To verify that clients are successfully remediated using the Network Access Protection client notification

  • When the Network Access Protection client notification appears, click it to watch its progress and for confirmation of remediation.

    Note
    If the computer is remediating on the full network for a limited time, the Network Access Protection notification will not appear unless there is a remediation failure or if a restart is required for remediation to complete.

To verify that clients are successfully remediated using client logging

  1. Locate the client log file %windir%\system32\CCM\Logs\StateMessage.log.

  2. Look for the state message changes with Type="200" IDType="200"/><State ID="2" (which means the client is entering deferred enforcement state) or Type="200" IDType="200"/><State ID="3" (which means the client is entering restricted access state) changing to Type="200" IDType="200"/><State ID="1" (which means the client is entering unrestricted access state).

    If you confirm these state message changes exist in the log file, the client is successfully remediated. If these state message changes are not present, the client is not successfully remediated.

See Also

Concepts

How to Verify Network Access Protection Components
Troubleshooting Network Access Protection

Other Resources

Tasks for Network Access Protection


Troubleshooting Network Access Protection

Click any link in the following section for troubleshooting information for Network Access Protection in Configuration Manager 2007.

This content might have been updated. For the most recent version, see http://go.microsoft.com/fwlink/?LinkId=88868.

In This Section

Troubleshooting Network Access Protection Issues

Lists possible problems and solutions if you experience issues when using Network Access Protection in Configuration Manager 2007.

Log Files for Network Access Protection

Lists and describes the log files created on the client and System Health Validator point during Network Access Protection operation in Configuration Manager 2007.

Network Access Protection Failure Categories and Error Codes

Lists and describes the failure categories and errors for clients and the System Health Validator point.

See Also

Other Resources

Network Access Protection in Configuration Manager


Troubleshooting Network Access Protection Issues

Click any link in the following section for troubleshooting Configuration Manager 2007 Network Access Protection issues.

In This Section

Cannot Create Configuration Manager NAP Policies for Network Access Protection

Lists possible problems and solutions if you cannot create Configuration Manager NAP Policies in the Configuration Manager console.

The System Health Validator Point Will Not Install or is Reporting Errors for Network Access Protection

Lists possible problems and solutions if you cannot successfully install the Configuration Manager System Health Validator point.

The Policies Node is Not Displaying in the Configuration Manager Console for Network Access Protection

Lists possible problems and solutions if the Policies node does not display in the Configuration Manager console.

Computers Fail to Connect to Either the Full Network or the Restricted Network using Network Access Protection

Lists possible problems and solutions if computers fail to connect to either the full network or the restricted network when using Network Access Protection with Configuration Manager 2007.

Computers fail to have any network connectivity.

Computers Have Full Network Access When They Should Not Using Network Access Protection

Lists possible problems and solutions if computers have full network access when they should not using Network Access Protection with Configuration Manager 2007.

For example, computers that are not compliant with software updates continue to have full network access.

Computers Do Not Have Full Network Access When They Should Using for Network Access Protection

Lists possible problems and solutions if computers do not have full network access when they should using Network Access Protection with Configuration Manager 2007.

For example, computers that are compliant with software updates have limited network access.

Client Fails to Successfully Remediate with Network Access Protection

Lists possible problems and solutions if computers fail to successfully remediate when using Network Access Protection with Configuration Manager 2007.

For example, computers do not automatically move from the restricted network to the unlimited network.

See Also

Concepts

About the Network Access Protection Process
Log Files for Network Access Protection
How to Verify Network Access Protection Components

Other Resources

Overview of Network Access Protection


Cannot Create Configuration Manager NAP Policies for Network Access Protection

This section provides troubleshooting information to help you resolve issues when you cannot create Configuration Manager NAP policies in the Configuration Manager 2007 console.

Network Access Protection (NAP) is Not Enabled for the Site

When the Configuration Manager site is not enabled for Network Access Protection, you cannot create Configuration Manager NAP policies.

Solution

Enable Network Access Protection by enabling the Network Access Protection client agent: How to Enable the Network Access Protection Client Agent.

For more information, see About Enabling and Disabling Network Access Protection.

NAP Policy Creation on Secondary Sites or Child Primary Sites

You cannot create Configuration Manager NAP policies from a secondary site, or if a primary site higher in the hierarchy is enabled for Network Access Protection.

Solution

None. This is by design because Configuration Manager NAP policies flow down the Configuration Manager hierarchy. For more information, see About Network Access Protection in Configuration Manager Hierarchies.

You Do Not Have Permissions to Create Configuration Manager NAP Policies

You must have appropriate permissions to create Configuration Manager NAP policies.

Solution

Log in as a user that has appropriate permissions, or reconfigure the permissions. For more information, see Network Access Protection Security Rights.

Software Updates Have Not Been Downloaded or They Are Already Enabled for NAP Evaluation

You can create a Configuration Manager NAP policy only if the software update exists in a software update package (using the software updates feature), or if it doesn't already exist in a Configuration Manager NAP policy.

Solution

To create a software update deployment, see How to Deploy Software Updates.

To verify existing Configuration Manager NAP policies, see How to View Configuration Manager NAP Policies for Network Access Protection.

See Also

Concepts

Troubleshooting Network Access Protection

Other Resources

Overview of Network Access Protection


The System Health Validator Point Will Not Install or is Reporting Errors for Network Access Protection

This section provides troubleshooting information to help you resolve issues related to installing the System Health Validator Point in Configuration Manager 2007.

Installation on Microsoft Windows Server 2003 or Windows 2000 Server

The Configuration Manager System Health Validator point must be installed on Microsoft Windows Server 2008, running the Network Policy Server role. Installation on other operating systems is not supported.

Solution

None. The requirement for Windows Server 2008 is one of the prerequisites for Network Access Protection. For more information, see Prerequisites for Network Access Protection.

Installation on a Workgroup Server

Although the installation of the Configuration Manager System Health Validator point will complete on a workgroup server, all Configuration Manager site systems must be installed on computers that are a member of a Windows 2000 or Windows 2003 Active Directory domain as a member server (recommended) or domain controller (not recommended). Running any site system on workgroup computers is not supported in Configuration Manager 2007.

For more information:

  • Prerequisites for Network Access Protection
  • Prerequisites for Installing Configuration Manager

Solution

Install the System Health Validator point on a member server (recommended) or a domain controller (not recommended) that is in a Windows Active Directory domain.

Network Policy Server is Not Running

The installation of the System Health Validator point requires that the Network Policy Server role is installed and running.

Solution

Add the role Network Policy and Access Services to the server running Windows Server 2008, and then ensure that the following service is running: Internet Authentication Service.

The Network Policy Server is in a Different Domain from the Site Server

By default, the site server computer account is used to install a site system role. If this account cannot be authenticated on the computer on which you are installing the System Health Validator point, installation will fail until you configure an installation account.

Solution

Specify an installation account. For procedural information, see How to Configure the System Health Validator Point Installation Account.

Additionally, in this scenario you must also configure the location of the health state reference and the accounts for publishing and querying the health state references. For more information, see the following:

  • How to Specify the Location of the NAP Health State Reference
  • How to Specify the Health State Reference Publishing Account
  • How to Specify the Health State Reference Querying Account
  • About Network Access Protection and Multiple Active Directory Forests

Perimeter Devices Block Installation Packets

If perimeter devices such as firewalls and routers are configured to restrict network traffic between the site server and the computer on which you are installing the System Health Validator point, these must be reconfigured to allow the required packets.

Solution

Configure these devices for the ports required. For information, see Determine the Ports Required by Firewalls to Support Network Access Protection.

An Error Condition Prevents Installation

There are many miscellaneous reasons why an installation can fail.

Solution

Identify the problem and then resolve the problem indicated.

To identify the problem, follow these steps:

  • Reference the setup log on the Network Policy Server for installation errors. For more information, see Log Files for Network Access Protection.
  • Reference the Application Event log on the Network Policy Server for installation errors.

See Also

Concepts

Troubleshooting Network Access Protection

Other Resources

Overview of Network Access Protection


The Policies Node is Not Displaying in the Configuration Manager Console for Network Access Protection

This section provides troubleshooting information to help you resolve the issue of the Policies node not displaying in the Configuration Manager 2007 console.

Network Access Protection is not Enabled for the Site

The site must be enabled for the Network Access Protection node, and its child node of Policies to display in the Configuration Manager console.

Solution

Enable the Network Access Protection client agent on the site. For more information, see How to Enable the Network Access Protection Client Agent.

The Configuration Manager Console Requires a Refresh

Information displayed in the Configuration Manager console does not automatically refresh. For more information, see About Latency in the Configuration Manager Console.

Solution

Click the Network Access Protection node, and then press F5.

See Also

Concepts

Troubleshooting Network Access Protection

Other Resources

Overview of Network Access Protection


Computers Fail to Connect to Either the Full Network or the Restricted Network using Network Access Protection

This section provides troubleshooting information to help you resolve issues when computers fail to connect to either the full network or the restricted network using Network Access Protection in Configuration Manager 2007.

NAP Enforcement Mechanism (for example, DHCP, IPsec with a Health Registration Authority) Is Not Configured Correctly

The operation of Network Access Protection (NAP) in Configuration Manager relies on the underlying Windows NAP infrastructure. If this is not correctly configured, Configuration Manager NAP operation is not possible.

Solution

Make sure that NAP is working correctly without Configuration Manager before you introduce health checks for the Configuration Manager System Health Validator. Check your underlying NAP infrastructure and reconfigure as appropriate.

For configuration information, see the documentation and step-by-step guides on the Network Access Protection Web site at (http://go.microsoft.com/fwlink/?LinkId=93844).

There is No Matching Policy on the Network Policy Server

For Configuration Manager NAP, you must have at least one connection request policy and three network policies.

Solution

Check the policy configuration on the Network Policy Server. For more information, see Configuring the Network Policy Server for Configuration Manager and the documentation on the Network Access Protection Web site at (http://go.microsoft.com/fwlink/?LinkId=93844).

The Matching Policy on the Network Policy Server has been Incorrectly Configured as Deny Access

It is a common misunderstanding that non-compliant computers should be denied network access. Even if computers are non-compliant, the network policies for Configuration Manager must be configured for Grant Access.

Solution

Reconfigure the policies so that computers are granted network access. For more information, see Configuring Network Policies for Configuration Manager Network Access Protection and the documentation on the Network Access Protection Web site at (http://go.microsoft.com/fwlink/?LinkId=93844).

See Also

Concepts

Troubleshooting Network Access Protection

Other Resources

Overview of Network Access Protection


Computers Have Full Network Access When They Should Not Using Network Access Protection

This section provides troubleshooting information to help you identify and resolve why computers have full network access when they should not using Network Access Protection in Configuration Manager 2007.

Clients do not Support Network Access Protection (NAP)

Configuration Manager clients must be able to support Network Access Protection (NAP). For more information, see About the NAP Client Status in Network Access Protection.

Solution

If possible, upgrade clients to support Network Access Protection. For more information, see How to Prepare the Site for Network Access Protection Clients.

If the site contains some clients that cannot support Network Access Protection, reconfigure network policies on the Network Policy Server so that NAP-ineligible clients have limited network access (although they cannot be remediated). For more information, see Determine Your Policy Strategy for Network Access Protection.

Microsoft Windows NAP Service is not Started, or a Local Configuration Manager Policy Disables the Site Setting to Enable the Network Access Protection Client Agent

Both of these conditions could explain why non-compliant computers have full network access.

Solution

The Windows NAP service is not started by default. Start it and configure it for automatic startup.

If a local policy is preventing the Network Access Protection client agent from being enabled on the client, remove or reconfigure the local Configuration Manager policy.

The Network Policy Server Has Been Configured so that Non-Compliant Computers Have Full Network Access for a Limited Time

This is legitimate policy configuration that results in non-compliant computers having full network access for a limited time. During this time, computers will undergo automatic remediation and, if successful, will then present a compliant status, which gives them full network access.

Solution

If non-compliant computers should never have access to the full network, reconfigure the network policy so that Full network access for a limited time is not selected. For more information, see Configuring Network Policies for Configuration Manager Network Access Protection.

Clients Have Not Downloaded their Machine Policy to Enable the Network Access Protection Client Agent

If you have recently enabled the Network Access Protection client agent, clients will have full network access until they download their machine policy according to schedule (by default, every 60 minutes). You can view or change the interval with the option Policy polling interval in the Computer Client Agent Properties: General Tab.

Solution

Either wait until clients have downloaded their client policy according to schedule, or initiate retrieval of the policy from the client, either manually or with a script.

To initiate retrieval of the client policy, see How to Initiate Policy Retrieval for a Configuration Manager Client.

It Is Before the Effective Date in the Configuration Manager NAP Policy

Configuration Manager clients will not be restricted if they do not have the selected software updates before the date configured in the Configuration Manager NAP policy. For more information, see About the NAP Effective Date in Network Access Protection.

Solution

If non-compliant computers must not have full network access before the effective date, reconfigure the effective date. For more information, see How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection.

Clients Have Not Downloaded the Latest Configuration Manager NAP Policies

If you have recently configured or added Configuration Manager NAP policies, clients will not immediate evaluate them.

Solution

Wait until clients download their policy (which includes the Configuration Manager NAP policies), according to schedule (by default, every 60 minutes).

To expedite the process for selected clients, initiate an ad-hoc retrieval of the policy from a client, see How to Initiate Policy Retrieval for a Configuration Manager Client.

To expedite the process for all clients, stop and restart the service SMS_SYSTEM_HEALTH_VALIDATOR on the Network Policy Server computer. This will force clients that send their statement of health to the Network Policy Server to download the latest Configuration Manager NAP policies and re-evaluate their compliance. However, if policies on the Network Policy Server are configured to restrict non-compliant computers, computers will have restricted network access while they perform this operation.

For an ongoing solution, consider specifying a shorter query interval on the System Health Validator point. For more information, see How to Configure the System Health Validator Active Directory Domain Services Query Interval.

Also, check the Active Directory replication delay from the site server writing the Configuration Manager 2007 health state reference and replicating it to the global catalog server used by the System Health Validator point.

An Error Condition Has Occurred

By default, the Configuration Manager System Health Validator on the Network Policy Server is configured to map all errors to a non-compliant state. Clients are then given network access according to a non-compliant status. However, these errors can be configured to compliant, which could result in a client that doesn't have the required software updates having full network access because it encountered an error.

Solution

Reconfigure the Configuration Manager System Health Validator error condition from compliant to non-compliant. For more information, see Configuring Failure Categories for Configuration Manager Network Access Protection.

The System Health Validator Point Is Not Installed or Not Operational

The Configuration Manager System Health Validator point must be installed and operational for non-compliant clients to be restricted.

Solution

Install the System Health Validator point. For procedural information, see How to Install the System Health Validator Point.

If the System Health Validator point is installed, but not operational, identify and correct the operational problem using the following steps:

  • Check the status messages that relate to the System Health Validator point.
  • Verify each Network Access Protection component: How to Verify Network Access Protection Components
  • Refer to the Network Access Protection log files for errors: Log Files for Network Access Protection

The Network Policy Server Does Not Have Policies Configured For Configuration Manager

The Network Policy Server must have policies that include the Configuration Manager System Health Validator. For more information, see About Enforcing Compliance with Network Access Protection.

Solution

Create or modify policies on the Network Policy Server. For more information, see Configuring the Network Policy Server for Configuration Manager.

The Network Policy Server Has Policies Configured that do not Select the Check Box Enable Auto-Remediation Of Client Computers

Configuration Manager will always remediate if Network Access Protection is enforced. For more information, see Determine Your Policy Strategy for Network Access Protection.

Solution

None. It is not possible to restrict Network Access Protection clients in Configuration Manager 2007 without automatic remediation.

Policies Are Misconfigured

Policies on the Network Policy Server that are configured to give non-compliant computers full network access for a limited time, or are not configured for NAP enforcement, or there is an incorrect ordering of network policies, or some other misconfiguration can all result in computers having full network access when they should not.

The network access granted to compliant or non-compliant computers is dependent on how the policies are configured on the Network Policy Server. For more information, see Determine Your Policy Strategy for Network Access Protection.

Solution

If the policies are misconfigured such that non-compliant computers should not have full network access, reconfigure them. For more information, see Configuring Network Policies for Configuration Manager Network Access Protection.

Clients Are Using a Cached Statement of Health

Clients can present a cached statement of health that might be out of date. For more information about how a statement of health is used with Network Access Protection, see About the Statement of Health (SoH) in Network Access Protection.

To see under which conditions clients will use a cached statement of health, see NAP Evaluation Conditions for Configuration Manager Clients.

Solution

To modify the setting so that clients never use a cached statements of health, see How to Configure NAP Evaluation Settings.

To reconfigure the validity period for a cached statement of health, see How to Specify the Validity Period for the Statement of Health.

For an ad-hoc solution that does not affect other clients, restart the client computer.

Client Is Assigned To a Child Site and the NAP Policy Has Not Yet Replicated Down the Hierarchy

Configuration Manager NAP policies are designed to replicate down the hierarchy, and this can result in a delay between creating or modifying a Configuration Manager NAP policy, and taking effect on a client in a child site.

Solution

Wait for site replication to complete.

See Also

Concepts

Troubleshooting Network Access Protection

Other Resources

Overview of Network Access Protection


Computers Do Not Have Full Network Access When They Should Using for Network Access Protection

This section provides troubleshooting information to help you identify and resolve why computers do not have full network access when they should when using Network Access Protection in Configuration Manager 2007.

The Configuration Manager Health State Reference Has Not Completed Active Directory Replication

Network Access Protection relies on Active Directory Domain Services to publish and retrieve health state references.

When installing a new Configuration Manager site, wait until replication for the Configuration Manager site is complete before configuring Configuration Manager Network Access Protection (NAP) policies.

Solution

Wait for Active Directory replication to complete.

The System Health Validator Point Cannot Retrieve the Configuration Manager Health State Reference

Network Access Protection uses Active Directory Domain Services to publish and retrieve health state references. If this is not configured and operational, compliant clients might have limited network access.

Solution

First, ensure that the Active Directory schema has been extended with the Configuration Manager 2007 schema extensions and that the Configuration Manager site is publishing to Active Directory. For more information, see the following:

  • How to Extend the Active Directory Schema for Configuration Manager
  • How to Publish Configuration Manager Site Information to Active Directory Domain Services
  • How to Verify Site Information is Published to Active Directory Domain Services

Second, ensure that the Configuration Manager health state reference settings are configured appropriately for your environment. For more information, see the following:

  • About Network Access Protection and Multiple Active Directory Forests
  • How to Specify the Location of the NAP Health State Reference
  • How to Specify the Health State Reference Publishing Account
  • How to Specify the Health State Reference Querying Account

An Error Condition Occurred

By default, a client that experiences an error condition during the Network Access Protection process will be deemed non-compliant. However, error conditions can be reconfigured to give clients a compliant status, which can then result in full network access. For more information, see Network Access Protection Failure Categories and Error Codes.

Solution

Locate the error by referencing the Network Access Protection logs, and then correct the error. For more information about the log files, see Log Files for Network Access Protection.

Alternatively, you can reconfigure the failure category on the Network Policy Server so that it maps to a compliant status. For more information, see Configuring Failure Categories for Configuration Manager Network Access Protection.

Another System Health Agent (Not Configuration Manager) Is Responsible for a Non-Compliant Status

When the Network Policy Server is checking the health state of multiple System Health Agents and not just Configuration Manager, a Configuration Manager client that is compliant with the configured software updates can be non-compliant for a different System Health Agent, and as such, have limited network access.

Solution

None. Logging on the Network Policy Server will identify which System Health Agent returned a non-compliant health state.

The Network Policy Server Has Network Policies Configured Incorrectly for Configuration Manager

Network Access Protection in Configuration Manager replies on the correct configuration of policies on the Network Policy Server.

Solution

Ensure that the policies are configured correctly on the Network Policy Server. For more information, see the following:

  • Configuring Network Policies for Configuration Manager Network Access Protection
  • Configuring the Network Policy Server for Configuration Manager

The Computer Sends Its Statement Of Health to a System Health Validator Point Outside its Configuration Manager Hierarchy

This scenario will result in the client having an unknown health state, which by default, maps to SHA vendor specific error code received on the Configuration Manager System Health Validator on the Network Policy Server. By default, the option SHA vendor specific error code received is configured for Non-compliant.

Solution

If this unwanted behavior, reconfigure SHA vendor specific error code received on the Configuration Manager System Health Validator from Non-compliant to Compliant. For more information, see Configuring Failure Categories for Configuration Manager Network Access Protection.

The Network Access Protection Agent is Re-Enabled

If you enabled Network Access Protection, create some Configuration Manager NAP policies, and then disable Network Access Protection, this does not automatically delete the Configuration Manager NAP policies. Therefore, when you re-enable Network Access Protection on the same site, the old Configuration Manager NAP policies are also re-enabled.

For more information, see About Enabling and Disabling Network Access Protection.

Solution

Delete old Configuration Manager NAP policies you do not want. For more information, see How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection.

See Also

Concepts

Troubleshooting Network Access Protection

Other Resources

Overview of Network Access Protection


Client Fails to Successfully Remediate with Network Access Protection

This section provides troubleshooting information to help you identify and resolve why clients fail to successfully remediate with Network Access Protection (NAP) in Configuration Manager 2007.

The Windows Network Access Protection Agent Service Was Not Started

The Windows Network Access Protection Agent Service must be started before the Configuration Manager client receives the client policy to enable the Network Access Protection client agent. This allows the Configuration Manager Network Access Protection client agent to bind to the Windows Network Access Protection agent.

If the Windows Network Access Protection Agent Service is started after the Network Access Protection client agent is enabled on the Configuration Manager client (or remains not started), the client's statement of health fails to be validated on the Configuration Manager System Health Validator point. In this scenario, if failure categories on the System Health Validator map to a non-compliant health state, clients might have limited network access without being able to remediate.

To identify this scenario, look for the following entries in the client log file, SMSSHA.LOG:

Warning - "CORE: SHA Registered successfully with the NAP Agent, but could not successfully bind"

Error - "CORE: NAP Agent Service might not be running"

Solution

If computers are on the restricted network as a result of this scenario, follow these steps so that the client can move from the restricted network to the unlimited network:

  1. Ensure that the Windows Network Access Protection Agent Service is started and configured to automatically start on the computer. Manually change the service setting if necessary.
  2. Restart the computer. This causes the Configuration Manager client to download its client policy, and the Network Access Protection client agent will automatically bind to the Windows Network Access Protection agent.

If computers are not on the restricted network as a result of this scenario, but the Windows Network Access Protection Agent Service was started after you enabled the Configuration Manager Network Access Protection client agent, follow these steps:

  1. Ensure that the Windows Network Access Protection Agent Service is started and configured to automatically start on all NAP-capable computers running the Configuration Manager client. If necessary, configure Group Policy to start this service and confirm that computers have been configured with the setting.
  2. Either restart Configuration Manager client computers or disable the Network Access Protection client agent for one policy cycle (by default, every 60 minutes) and then re-enable the Network Access Protection client agent.

An Operating System Deployment Installs the Configuration Manager Client before Configuring Network Access Protection in Windows

When you deploy an operating system in a Network Access Protection environment using the operating system deployment feature in Configuration Manager, and you use custom task sequence steps to enable the enforcement clients and start the Network Access Protection in Windows, failing to add a restart step to the task sequence can result in the computer being non-compliant and being unable to successfully remediate.

Solution

Manually restart the computer.

To correct the operating system deployment configuration, see Planning for Operating System Deployment in a NAP-Enabled Environment.

Software Updates Have Not Yet Replicated to Local Distribution Point

In this scenario, a client undergoing remediation can time-out when attempting to retrieve software updates from a remote distribution point.

Solution

Wait until replication is complete.

Avoid this situation by configuring an effective date that is after the software update packages have replicated to all distribution points. To modify the effective date of existing Configuration Manager NAP policies, see How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection.

Software Updates Are on a Protected Distribution Point

This configuration can result in clients being unable to access software updates if their network location is not identified as being within the boundaries configured for the protected distribution point.

Solution

Reconfigure the protected distribution point, or add the software update package to an unprotected distribution point.

Software Updates Are on a Branch Distribution Point

A client can time-out trying to retrieve required software updates if attempting to download them from a branch distribution point and the software update package is configured for the option Make this package available on protected distribution points only when requested by clients inside the protected boundaries.

Solution

If the user waits, the content will eventually download and remediation will be automatically retried.

Avoid this situation by configuring software update packages that reference software updates selected for Network Access Protection so that they are not configured for the option Make this package available on protected distribution points only when requested by clients inside the protected boundaries.

Client Cannot Connect to Remediation Servers

Clients using Network Access Protection in Configuration Manager are dependent on being able to communicate with remediation servers. For more information, see About Network Access Protection Remediation.

Solution

To ensure that clients can communicate with the servers they need, verify the following:

  • Ensure that the client's default management point is operational.
  • If you are using DHCP or VPN NAP enforcement, ensure that any infrastructure servers, such as DNS servers and domain controllers, are specified in a Remediation Server Group and included in the network policy on the Network Policy Server:
    • Configuring Remediation Server Groups for Configuration Manager Network Access Protection
    • Configuring Network Policies for Configuration Manager Network Access Protection
  • If you are using IPsec Network Access Protection enforcement, ensure that all remediation servers (including Configuration Manager management points, software update points, and distribution points) are configured as boundary servers.

The Network Access Protection Client Agent Was Disabled After the Client Went into Remediation

In this scenario, the client can present a non-compliant health state, but remediation is no longer possible.

Solution

Restart the computer to initiate download of the machine policy. This will result in disabling the Network Access Protection client agent and a compliant status.

The Network Access Protection Client Agent Is Re-Enabled

If you re-enable the Network Access Protection agent, this re-enables previously configured Configuration Manager NAP policies. If these policies contain software updates that are no longer hosted on distribution points, remediation is not possible because the content is no longer available.

Solution

To resolve this situation, complete one of the following steps:

  • Delete the old Configuration Manager NAP policies, and then restart the computer. For procedural information, see How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection.
  • Create a new software updates package with the missing software updates in the Configuration Manager NAP policies. When the content is available, a user who is a local administrator should then click Try Again. If the user has low rights, the user can then restart the computer. For more information about creating software update packages, see How to Create a Deployment Package.

Computer Does Not Have the Configuration Manager Client Installed

In this scenario, the health state of the client cannot be checked by the Configuration Manager System Health Validator. By default, this maps to an error condition that deems it non-compliant. Remediation in Configuration Manager does not include automatically installing the Configuration Manager client, so this client will never be automatically remediated.

Solution

If the computer should install the Configuration Manager client, provide a means by which users can manually install the Configuration Manager client when on the restricted network. For more information, see Configuring the Remediation User Experience for Configuration Manager Network Access Protection.

If the computer should not have the Configuration Manager client installed, configure a network policy on the Network Policy Server such that this computer does not have its health state checked by the Configuration Manager System Health Validator. For more information, see Determine Your Policy Strategy for Network Access Protection and Configuring Exemption Policies for Configuration Manager Network Access Protection.

Unknown Causes

If none of the conditions above apply to the remediation failure, view the Configuration Manager Network Access Protection report List of remediation failures for specified time period to help identify the error. For more information, see How to Run Network Access Protection Reports.

See Also

Concepts

Troubleshooting Network Access Protection

Other Resources

Overview of Network Access Protection


Log Files for Network Access Protection

There are a number of log files you can reference to help troubleshoot Network Access Protection in Configuration Manager 2007.

Configuration Manager Log Files

The following Configuration Manager logs are created with Network Access Protection (NAP) and can be used to verify normal operation, as well as to help diagnose problems.

The Configuration Manager 2007 client computer log files are found, by default, in %windir%\CCM\Logs. For client computers that are also management points, the log files are found in %ProgramFiles%\SMS_CCM\Logs.

Log file name Description

Ccmcca.log

This file logs the processing of compliance evaluation based on Configuration Manager NAP policy processing. It also contains the processing of remediation for each software update required for compliance.

locationservices.log

This log is used by other Configuration Manager features (for example, information about the client's assigned site), but it also contains information specific to Network Access Protection when the client is in remediation. It records the required remediation servers (management point, software update point, and distribution points that host content required for compliance), which are also sent in the client statement of health.

SMSSha.log

This is the main log file for the Configuration Manager Network Access Protection client, and it contains a merged statement of health information from the two Configuration Manager components: location services (LS) and the configuration compliance agent (CCA).

This log file also contains information about the interactions between the Configuration Manager System Health Agent and the operating system NAP agent, and also between the Configuration Manager System Health Agent and both the computer compliance agent and location services. It provides information about whether the NAP agent successfully initialized, the statement of health data, and the statement of health response.

CIAgent.log

This tracks the process of remediation and compliance. However, the software updates log file, Updateshandler.log provides more informative details on installing the software updates required for compliance.

SDMAgent.log

This log file is shared with the Configuration Manager feature desired configuration management, and it also contains the tracking process of remediation and compliance. However, the software updates log file, Updateshandler.log provides more informative details about installing the software updates required for compliance.

On the server side for the System Health Validator point, you should first check the Windows Application event log on the Windows Network Policy Server computer. This log will record any failure categories and errors with the source being SMS_SYSTEM_HEALTH_VALIDATOR. These are also raised as Configuration Manager status messages. For more information about the failure categories and error codes, see Network Access Protection Failure Categories and Error Codes.

More detailed logging information can be found in the Configuration Manager logs and the System Health Validator point log files are located in %systemdrive%\SMSSHV\SMS_SHV\Logs.

Log file name | Description
Ccmperf.log | This log contains information about the initialization of the System Health Validator point performance counters.
SmsSHV.log | This is the main log file for the System Health Validator point. It logs the basic operations of the System Health Validator service, such as the initialization progress.
SmsSHVADCacheClient.log | This log file contains information about retrieving Configuration Manager health state references from Active Directory Domain Services.
SmsSHVCacheStore.log | This log file contains information about the cache store used to hold the Configuration Manager NAP health state references retrieved from Active Directory Domain Services, such as reading from the store and purging entries from the local cache store file.
SmsSHVRegistrySettings.log | This log is used to record any dynamic changes to the System Health Validator component configuration while the service is running.
SmsSHVQuarValidator.log | This log file records client statement of health information and processing operations. To obtain full information, change the registry key LogLevel from 1 to 0 in the following location: HKLM\SOFTWARE\Microsoft\SMSSHV\Logging\@GLOBAL

Additionally, setup information for the System Health Validator point can be found in a setup log on the computer running the Network Policy Server.

Log file name | Description
<InstallationPath>\Logs\SMSSHVSetup.log | This log file records the success or failure (with failure reason) of installing the System Health Validator point.

Network Policy Server Log Files

The following two log files can be used to help identify which policy configured on the Network Policy Server was used for each connecting client, and which System Health Agent was responsible for the compliant or non-compliant status. When you are using multiple System Health Agents and System Health Validators, Configuration Manager reports on all computers that undergo remediation. This might include computers that were compliant for Configuration Manager but failed a different health check, such as having the latest antivirus software signatures.

Log file name | Description
IN<date>.log | By default, this file is created in %windir%\system32\LogFiles, but it can be configured to an alternative location. For more information, see Configuring Logging for Configuration Manager Network Access Protection.
%windir%\Tracing\IASNAP.log | Enable this logging with the following command to provide detailed information about the Network Policy Server operation when NAP policies are configured: Netsh ras set tr * en

See Also

Concepts

Network Access Protection Failure Categories and Error Codes
How to Verify Network Access Protection Components

Other Resources

Troubleshooting Network Access Protection Issues


Network Access Protection Failure Categories and Error Codes

The function of the System Health Validator point in Configuration Manager 2007 is to pass to the Network Policy Server a statement of health for a Configuration Manager client that it has validated as either compliant or non-compliant. If it is unable to do this because of an error condition, the System Health Validator point instead passes to the Network Policy Server a statement of health with a blank health status and one of four failure categories with an error code.

By default, all failure categories on the Network Policy Server equate to a heath state of non-compliant. However, each failure category can be configured on the Configuration Manager System Health Validator on the Network Policy Server so that, for example, a failure on the System Health Validator point does not result in all clients having restricted network access.

If the failure is on the client side so that the Configuration Manager Network Access Protection (NAP)-capable client is unable to evaluate its compliance status, the client sends either a Client Component Failure Category or a Client Communication Failure Category in its statement of health to the System Health Validator point, with a failure error code. The System Health Validator point verifies that the failure error code matches one of its known client failure error codes, and then passes the statement of health unchanged to the Network Policy Server. If there is no match on the System Health Validator point for the particular failure error code, the System Health Validator point sets the compliance state as "Invalid" and passes this to the Network Policy Server. Again, by default, this is mapped to a health state of non-compliant on the Network Policy Server.

If the failure is on the server side so that the System Health Validator point is unable to validate a client statement of health that has a known compliance status, the compliance status is removed in the client statement of health and instead a Server Component Failure Category or a Server Communication Failure Category is added before the statement of health is passed to the Network Policy Server. The server failure is also sent to the client that logs the error (but otherwise takes no action).

As well as being passed to the Network Policy Server, these failures are logged on both the client (in the file SMSSha.log) and the System Health Validator point (SmsSHVQuarValidator.log). The failures are also logged in the Application event log on the Network Policy Server and raised as Configuration Manager status messages.

Client Failure Categories and Errors

The following table lists the possible client failure error codes (with descriptions) that will be validated and passed to the Network Policy Server if the Configuration Manager NAP-capable client is unable to evaluate its compliance status. These error codes reside in the registry on the System Health Validator point under the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMSSHV\Settings\ClientFragility. You can manually add your own error codes into the registry with your choice of description. You do not need to restart the service SMS_SYSTEM_HEALTH_VALIDATOR for these new error codes to be used by the System Health Validator point.

Failure Description | Failure Error Code (hexadecimal)
AD Not Accessible | 80040301
Assigned MP Refresh Failed | 80040300
Bad Client Certificate | 80040305
Bad Server Certificate | 80040304
Client Health Evaluation Internal Error | 80040246
Client Not Assigned | 80040302
Internal Location Error | 80040303
Message Verification Failed | 80040309
Proxy MP Refresh Failed | 80040307
Resident MP Refresh Failed | 80040308
Server Unreachable | 80040306
SHA not yet initialized | 80270007

Server Failure Categories and Codes

If the System Health Validator point is unable to retrieve the Configuration Manager health state reference from Active Directory Domain Services (for example, because the schema is not extended or the information has not yet replicated), the compliance status in the statement of health is changed to "unknown" rather than setting it to a blank value with a server category failure. This scenario falls under the category of SHA vendor specific error code received on the Network Policy Server, and it is also, by default, configured as non-compliant.

However, once the health state reference is successfully retrieved, the System Health Validator point can encounter a number of different errors that prevent validation from succeeding. Many are standard Microsoft Windows errors and independent from Configuration Manager, with examples being out of memory, name resolution failure, and network path not found. The System Health Validator point generates just one failure error when it is unable to validate the statement of health. The Application event log on the Network Policy Server computer should be used to determine the cause of this failure.

Failure Description | Failure Error Code (hexadecimal)
System Health Validation point failure | 8ABC0404

See Also

Concepts

About the Statement of Health (SoH) in Network Access Protection
Configuring Failure Categories for Configuration Manager Network Access Protection
About NAP Health State References in Network Access Protection
Log Files for Network Access Protection
How to Verify Network Access Protection Components


Network Access Protection Security Best Practices

Do not rely on NAP to secure a network from malicious users Network Access Protection is designed to help administrators maintain the health of the computers on the network, which in turn helps maintain the network’s overall integrity. For example, if a computer has all of the software updates required by the Microsoft System Center Configuration Manager 2007 NAP policy, the computer is considered compliant, and it will be granted the appropriate access to the network. Network Access Protection does not prevent an authorized user with a compliant computer from uploading a malicious program to the network or disabling the NAP agent.

Use consistent NAP policies throughout the site hierarchy to minimize confusion Misconfiguring NAP policy could result in clients accessing the network when they should be restricted or valid clients being erroneously restricted. The more complicated your NAP policy design, the higher the risk of misconfiguration. Configure the Configuration Manager 2007 NAP client agent and Configuration Manager 2007 System Health Validator points to use the same settings throughout the hierarchy, or through additional hierarchies in the organization if clients might roam between them.

Important
If a Configuration Manager client with the Network Access Protection client agent enabled roams into a different Configuration Manager hierarchy and has its client statement of health validated by a System Health Validator point from outside its hierarchy, the validation process will fail the site check. This will result in a client health state of unknown, which by default is configured on the Network Policy Server as non-compliant. If the Network Policy Server has network policies configured for limited network access, these clients cannot be remediated and risk being unable to access the full network. An exemption policy on the Network Policy Server could give Configuration Manager clients that roam outside their Configuration Manager hierarchy unrestricted network access.

Do not enable the Network Access Protection client agent immediately on new Configuration Manager sites Although the site servers publish the Configuration Manager health state reference to a domain controller when Configuration Manager NAP policies are modified, this new data might not be immediately available for retrieval by the System Health Validator point until Active Directory replication has completed. If you enable the Network Access Protection client agent before replication has completed, and if your Windows Network Policy Server will give non-compliant clients limited network access, you can potentially cause a denial of service attack against yourself.

Do not rely on NAP as an instantaneous or real-time enforcement mechanism There are inherent delays in the NAP enforcement mechanism. While NAP helps keep computers compliant over the long run, typical enforcement delays may be on the order of several hours or more due to a variety of factors, including the settings of various configuration parameters.

See Also

Other Resources

Network Access Protection in Configuration Manager
Security Best Practices and Privacy Information for Configuration Manager Features


Network Access Protection Accounts

The following accounts are used with Configuration Manager 2007 Network Access Protection (NAP) and might need to be configured if your Configuration Manager hierarchy spans more than one Active Directory forest:

Account | Purpose | Default | Configuration
System Health Validator Installation Account | Installing the System Health Validator as a Configuration Manager site role. | Computer account of the site server. | Select the option Use another account for installing this site system either during the New Site System Server Wizard or by modifying the properties of an existing site server.
Health state reference publishing account | Writing the health state reference to Active Directory when a Configuration Manager NAP policy is created or modified. | Site server computer account. | Health state reference publishing account in Site Settings, Component Configuration, System Health Point Component, Properties, Health State Reference tab.
Health state reference querying account | Periodically retrieving the health state references from Active Directory. | System Health Validator point computer account. | Health state reference querying account in Site Settings, Component Configuration, System Health Point Component, Properties, Health State Reference tab.
Important
Using the default setting of a computer account is more secure than configuring the use of a Microsoft Windows user account because the password is automatically generated and renewed. You should therefore use the default settings when the site server and System Health Validator points are in the same forest and where a trust exists. If you have multiple System Health Validator points in a single Configuration Manager site and you cannot use the computer account to retrieve the health state references, they must share the same Windows user account and any auditing should include the computer source to distinguish authorization attempts between one server and another.

See Also

Concepts

Network Access Protection Security Best Practices

Other Resources

Network Access Protection in Configuration Manager


Network Access Protection Security Rights

By default, the Configuration Manager 2007 administrator has all rights for each object class or instance, but this can be modified and new administrators can be added with restricted rights wherever the properties of the object has a Security tab.

Configuring security rights is most commonly used to configure and control delegated administration, where selected administrators have just enough security rights to perform their job and no more, adhering to the security best practice of least privilege. For example, administrators can view Configuration Manager NAP policies but not modify or delete them. For more information about configuring security rights in Configuration Manager, see Overview of Configuration Manager Object Security and WMI and How to Assign Rights for Objects to Users and Groups.

For more information about delegated administration and how role separation can be used with Network Access Protection in Configuration Manager, see Determine Administrator Roles and Processes for Network Access Protection.

You can set the following security rights on both the Network Access Protection node and the Policies node:

  • Administer
  • Create
  • Delegate
  • Delete
  • Distribute
  • Manage folders
  • Modify
  • Network Access
  • Read
Note
The Distribute and Manage folders rights are not applicable to Network Access Protection.

To configure these security rights, perform the following steps:

  1. Right-click either the Network Access Protection node or the Policies node.
  2. Click Properties, and then click Security.
  3. Configure the security rights you require, and then click OK.

See Also

Tasks

How to Assign Rights for Objects to Users and Groups

Concepts

Determine Administrator Roles and Processes for Network Access Protection
Overview of Configuration Manager Object Security and WMI


Technical Reference for Network Access Protection

Click any link in the following section for technical references for Network Access Protection in Configuration Manager 2007.

In This Section

Network Access Protection Flowcharts

Provides a number of flowcharts that show the processes involved with Network Access Protection in Configuration Manager 2007.

Example Scenarios for Implementing Network Access Protection in Configuration Manager

Example scenarios of how Network Access Protection can be implemented with Configuration Manager 2007 to address the business requirements of a phased and expedited deployment.

NAP Evaluation Conditions for Configuration Manager Clients

Provides a table reference for the conditions under which the Configuration Manager 2007 Network Access Protection client agent will perform a NAP evaluation rather than use cached results.

See Also

Other Resources

Overview of Network Access Protection
Network Access Protection in Configuration Manager


Network Access Protection Flowcharts

Click any link in the following section for flow charts that show the various processes involved when using Network Access Protection in Configuration Manager 2007.

In This Section

System Health Validator Point: Validation Process for Network Access Protection

Details the validation process on the System Health Validator point.

Configuration Manager Network Access Protection SoH Generation

Details how a statement of health is generated on a Configuration Manager 2007 client.

Enforced Compliance with Network Access Protection in Configuration Manager

Details the remediation processes in Configuration Manager 2007.

SoH Response to Non-Compliant Configuration Manager Client with Network Access Protection

Details the statement of health response process when a Configuration Manager client is deemed non-compliant.

See Also

Other Resources

Network Access Protection in Configuration Manager
Technical Reference for Network Access Protection


System Health Validator Point: Validation Process for Network Access Protection

This flowchart shows the decision processes the System Health Validator point in Configuration Manager 2007 makes in determining whether a Configuration Manager 2007 client is compliant or non-compliant when it receives a client statement of health (SoH). The resulting compliant or non-compliant status is then passed to the Windows Network Policy Server (NPS) to determine what network access to grant and whether remediation will be invoked.

System Health Validator flowchart for ConfigMgr

See Also

Concepts

About System Health Validator Points in Network Access Protection

Other Resources

Network Access Protection Flowcharts
Network Access Protection in Configuration Manager


Configuration Manager Network Access Protection SoH Generation

Topic last updated -- August 2007

This flowchart shows how the Configuration Manager System Health Agent (SHA) generates a statement of health (SoH) in Configuration Manager 2007.

The flowchart uses the following abbreviations:

  • LS = Location Services
  • CCA = Configuration Compliance Agent
Data Flow of how NAP generates Statement of Health

See Also

Concepts

About the Statement of Health (SoH) in Network Access Protection

Other Resources

Network Access Protection in Configuration Manager
Network Access Protection Flowcharts


Enforced Compliance with Network Access Protection in Configuration Manager

This flowchart shows the processes involved when compliance is enforced on non-compliant Configuration Manager clients in Configuration Manager 2007.

Data Flow of NAP Enforced Compliance

See Also

Concepts

About Enforcing Compliance with Network Access Protection

Other Resources

Network Access Protection in Configuration Manager
Network Access Protection Flowcharts


SoH Response to Non-Compliant Configuration Manager Client with Network Access Protection

This flowchart shows what happens when a statement of health (SoH) response is sent to a non-compliant Configuration Manager client in Configuration Manager 2007.

Data Flow of NAP when non-compliant clients

See Also

Concepts

About the Statement of Health (SoH) in Network Access Protection
About Enforcing Compliance with Network Access Protection

Other Resources

Network Access Protection in Configuration Manager
Network Access Protection Flowcharts


Example Scenarios for Implementing Network Access Protection in Configuration Manager

Topic last updated—May 2008

The following sections provide example scenarios of how Network Access Protection (NAP) in Configuration Manager 2007 can be implemented to solve the following business requirements:

  • Enforce compliance of software updates as part of a phased deployment
  • Enforce compliance of software updates as part of an expedited deployment

Enforce compliance of software updates as part of a phased deployment

This scenario demonstrates how you can use Network Access Protection in Configuration Manager as a part of phased deployment of software updates, restricting network access to the few computers that fail to install required software updates by a specified date.

Woodgrove Bank receives the monthly notification of software updates from Microsoft, and it wants to help protect the network from computers that are vulnerable to the exploits addressed in the software updates. It decides the course of action in the following table.

Process Reference

Software updates that address a security vulnerability are assessed by the company security team, led by Kevin Verboort. This team verifies whether the vulnerability is applicable to their environment, and if it is, the business impact on corporate assets and business continuity, together with the circumstances under which the vulnerability could be exploited.

The software updates that are not security-related are assessed by other teams responsible for those areas.

Internal process that is company-specific

Kevin then works with Mary North, who is the Configuration Manager administrator for software updates. She takes the security team's list of critical security updates and runs a report to see how many computers on the network are potentially vulnerable to the exploit addressed in the security update.

About a quarter of computers on the network are found to be potentially vulnerable from the listed software security updates, and all these computers support NAP.

Network Access Protection report: List of computers that would be non-compliant based on selected software updates

For more information, see the following topics:

  • About Reports for Network Access Protection
  • How to Run Network Access Protection Reports

Kevin decides, based on the security implications and business impact analysis, that all computers should install the security software updates through software updates within two weeks.

For the few computers that fail to install the software updates in this time period, the installation will be enforced through Network Access Protection on the limited network.

Determine Your Policy Strategy for Network Access Protection

Mary also receives a list of nonsecurity updates that should be installed within four weeks.

Internal process that is company-specific

Over the course of a week, Mary tests the installation of the selected software updates on a representative group of computers to ensure that installation is successful and applications continue to function as expected.

Configuring Software Updates

Mary submits two Requests for Change (RFCs):

  • The nonsecurity software updates that will be installed within four weeks, without Network Access Protection enforcement.
  • The security software updates that will be installed through software updates initially, and through Network Access Protection as a failsafe enforcement measure.

Both RFCs are granted.

Internal process that is company-specific

Mary then talks to the Network Policy Server administrator to communicate when the Configuration Manager NAP policies will be created, and the date that the security software updates will become effective in them.

The two administrators work together to ensure that non-compliant computers will be automatically remediated on the limited network, and that the software updates are available on the Troubleshooting Web site if remediation fails.

Mary also provides the Help Desk with advance notification of the software updates installation, and which software updates will be enforced through Network Access Protection.

Determine Administrator Roles and Processes for Network Access Protection

Configuring the Remediation User Experience for Configuration Manager Network Access Protection

Mary confirms that the software updates packages she created for the software updates have now replicated to all distribution points in the hierarchy.

Mary then uses the Deploy Software Updates Wizard to create two deployments and targets both to the All Systems collection in the central site:

  • The nonsecurity software updates that have a deadline of four weeks.
  • The security software updates that have a deadline of two weeks, and a NAP-effective date of four weeks.

Software Distribution - Packages report: Distribution status of a specific package

How to Deploy Software Updates

How to Configure NAP Evaluation for Software Updates

Mary sends a confirmation notice of the deployment to the security team, the Network Policy Server team, and the Help Desk.

The Help Desk distributes user notification with a warning that computers might lose network connectivity if the required security software updates are not installed by the due date, and encourages users to install them themselves as soon as possible.

Internal process that is company-specific

Mary monitors compliance of the software updates.

At the end of three weeks, a number of computers remain non-compliant with the security software updates. Each computer owner is sent an e-mail notification that their computer is out of compliance with security policies and risks losing network connectivity to be automatically remediated if it remains non-compliant by the end of the week.

Network Access Protection report: List of computers that would be non-compliant based on selected software updates

For more information, see the following topics:

  • About Reports for Network Access Protection
  • How to Run Network Access Protection Reports

Two days before the effective date configured in the NAP policies, Mary notes that only a handful of computers now remain non-compliant with the security software updates.

Mary forwards this report to the security team and notifies the Help Desk about which computers remain non-compliant and support Network Access Protection.

Internal process that is company-specific

Mary continues to monitor compliance for the selected software updates, and forwards progress reports to the security team at an agreed interval.

Internal process that is company-specific

After six weeks, Mary notes that 85percent of computers are reporting compliance with the nonsecurity software updates, and 100 percent of computers are reporting compliance with the security software updates.

Mary reviews the process to see if modifications are required and investigates the computers that have not installed the nonsecurity updates.

Network Access Protection reports:

  • List of software updates installed through remediation
  • Comparison of software updates installed by software update deployments and NAP remediation
  • List of computers that installed a specific software update through remediation during a specified period
  • List of remediation failures for specified time period

Mary makes her reports available to the security team and invites feedback from the Help Desk to identify any technical or communication improvements.

Internal process that is company-specific

Configuration Manager NAP policies might impact users in the following ways during a phased deployment:

  • Laptop returns to corporate network after period of absence:
    A salesman frequently travels to customer sites, but returns to corporate headquarters for important meetings. He has briefly scanned the e-mail notifications to install security updates but did not install them, and the deadline came and went without any repercussions.
    When he arrives at headquarters for the meeting, he connects his computer to the network and shortly after logging on he sees a notification that his computer has limited network access because it is not compliant with security policies. He remembers the e-mail notifications and searches for them, looking for instructions on what to do. By the time he has found the e-mail and read it, his computer has already installed the required software updates and he has unlimited network access. His computer continues to install the nonsecurity updates in the background.
  • User on vacation returns to work:
    A user returns to work after several weeks of vacation. Although her computer was fully compliant before she left, her computer was switched off while she was gone, so it was not able to receive software updates during that time. When she returns to work, she switches on the computer, logs on, and loads Microsoft Outlook. However, her mailbox will not connect to the server and she sees a notification that she has limited network access because her computer is not compliant.
    Unaware of the e-mail notifications that have gone out in the last few weeks, she calls the Help Desk who confirms that her computer is one of the computers that were listed as non-compliant by the effective date in the Configuration Manager NAP policy. The Help Desk explains that her computer will be automatically remediated and all she has to do is wait, and they will ring back to confirm that connectivity is restored after half an hour.
    The user gets a cup of coffee and catches up on the latest news in the office during her absence. On her return, she sees that her computer now has full network access, confirms this with the Help Desk, and her user assistance ticket is closed.
  • Setting up a new computer:
    A new user receives her desktop computer, running Windows Vista and imaged with a Configuration Manager client. She unpacks the computer, connects it up and switches it on. After completing the initial setup, a balloon pops up, informing her that her computer has limited network access.
    She clicks on the notification and sees that her computer is installing software updates that are required for the company's security policy. She tidies away the boxes and on returning to her computer sees another notification that the computer now has unlimited network access. She configures her desktop while in the background, nonsecurity updates and the applications she requires are automatically installed.
  • Guests are denied full network access:
    A consultant from another company connects his laptop into the corporate network. The guest sees that his computer has limited network access and that remediation on the restricted network has failed. He contacts the Help Desk.
    This behavior is by design. Because this computer does not have a Configuration Manager client installed, the System Health Validator point cannot validate whether the computer is compliant or non-compliant. In this scenario, the Configuration Manager System Health Validator on the Network Policy Server is configured to give the computer a non-compliant health state, and automatic remediation is not possible.
    The Help Desk confirms that their procedure in this scenario is to explain to the guest that full network access is not possible, but that they can use the Web proxy server on the restricted network. The guest uses the proxy Web server for Internet access and a VPN connection to his own corporate network.
  • Momentary loss of network connectivity for a few users:
    Even before the effective date, some users notice a Network Access Protection notification that their computer is not compliant and has limited network access. Very soon afterwards they see another messaging informing them that their computer is now compliant and they have full network access. Some users are concerned about these messages and ring the Help Desk. They are informed that this is expected behavior for Network Access Protection to ensure that computers are up-to-date with requirements, and not symptomatic of a problem.
    As time progresses, users become accustomed to the new process and only ring the Help Desk if they see a failure message.
    Note
    There are a number of scenarios that might result in a client being deemed non-compliant by the System Health Validator, and which do not relate to whether the client has software updates installed. These scenarios include a client having a cached statement of health that is older than the configured statement of health validity period, and the client does not have the latest Configuration Manager NAP policies. Be aware that Configuration Manager 2007 clients can go into remediation for a number of reasons, and educate users and the Help Desk of this possibility before deployment.

    For more information on this scenario, see About Network Access Protection Remediation and About Compliance for Network Access Protection in Configuration Manager.

Enforce compliance of software updates as part of an expedited deployment

This scenario demonstrates how you can use Network Access Protection in Configuration Manager as a part of an expedited deployment of a software update that must be urgently installed to protect network resources.

Woodgrove Bank receives an urgent notification from Microsoft regarding a critical software security update, and it wants to immediately minimize the number of computers on the network that are vulnerable to the exploit. It decides on the course of action described in the following table.

Process Reference

Kevin Verboort receives the security notification, and as the security chief officer he calls the security team to an urgent meeting to review the critical software security update and understand the security implications for their environment.

The security threat is assessed for the business impact on corporate assets and business continuity, and the circumstances under which the vulnerability could be exploited.

Internal process that is company-specific

While the meeting is in progress, Mary North, who is the Configuration Manager administrator for software updates, has been asked to run a report to find out how many computers on the network are potentially vulnerable to the exploit addressed in the security software update.

Over half of the computers on the network are found to be potentially vulnerable from the listed software security updates, and most of these computers support Network Access Protection.

Network Access Protection report: List of computers that would be non-compliant based on selected software updates.

Network Access Protection report: List of NAP-capable and NAP-upgradeable computers.

For more information, see the following topics:

  • About Reports for Network Access Protection
  • How to Run Network Access Protection Reports

The security team decides that the risk of computers being vulnerable to the security exploit addressed by the security software update is important enough that computers should install it immediately, even at the risk of short-term lost productivity.

Determine Your Policy Strategy for Network Access Protection

Mary creates a software update package, downloading the software update and adding it to all distribution points in the hierarchy.

How to Create a Deployment Package

Mary initiates a minimal test of this software update on a representative group of computers to ensure that installation is successful and basic applications continue to function as expected.

Internal process that is company-specific

Kevin initiates the emergency procedure for an out-of-band Request for Change, which is immediately reviewed and granted.

Notification is sent to Mary, to the Network Policy Server administrators, to the Help Desk, and to teams monitoring service resources to warn them of a sudden increase of traffic when a high number of computers attempt remediation in a short space of time.

Internal process that is company-specific

After confirming that there are no problems with the tested software update, Mary uses the New Policies Wizard to identify the software update and configures the effective date for As soon as possible.

She then configures the System Health Validator point component properties and configures the option Date created must be after (UTC) with the current date and time.

How to Create a Configuration Manager NAP Policy for Network Access Protection

How to Specify the Option 'Date created must be after' for the Statement of Health

Mary knows that she has some computers that cannot support Network Access Protection, and these are computers running Windows XP Service Pack 1, and Windows Server 2003. The security update is applicable to the computers running Windows XP Service Pack 1, but it is not applicable to servers running Windows Server 2003.

Mary creates a software update deployment for the software update, with a deadline of As soon as possible. She targets this software update deployment to a collection that contains Windows XP Service Pack 1 only.

How to Deploy Software Updates

Mary sends a confirmation notice that the Change of Request work has been completed, which is forwarded to interested parties.

Internal process that is company-specific

Mary monitors compliance of the critical security software update and reports progress to the security team.

In particular, special attention is paid to the computers that cannot support Network Access Protection, because failed installations on these computers will not prevent them from accessing the network. Any installation failures on these machines are immediately reported to the Help Desk to proactively investigate and resolve them to ensure compliance.

Network Access Protection report: List of computers that would be non-compliant based on selected software updates.

For more information, see the following topics:

  • About Reports for Network Access Protection
  • How to Run Network Access Protection Reports

After 24 hours, 90 percent of the applicable computers are compliant with the software update. Mary investigates the non-compliant computers and discovers that they are not currently on the corporate network for legitimate reasons.

An e-mail notification is sent to them, requesting that they install the software update manually. Mary knows that if this mechanism fails (for example, the user is on vacation and left her computer turned off), compliance will be enforced when the computer is connected to the corporate network.

Internal process that is company-specific

Mary continues to monitor compliance for the selected software updates and forwards progress reports to the security team at an agreed-upon interval.

Internal process that is company-specific

At the end of an agreed-upon period with the security team, Mary confirms all computers are now reporting compliance with the selected software update and reviews the process to see if modifications are required to more effectively install urgent software updates.

Network Access Protection reports:

  • List of software updates installed through remediation
  • Comparison of software updates installed by software update deployments and NAP remediation
  • List of computers that installed a specific software update through remediation during a specified period
  • List of remediation failures for specified time period

Mary makes her findings available to the security team and invites feedback from the Help Desk to identify any technical or communication improvements.

Internal process that is company-specific

Configuration Manager NAP policies might impact users in the following ways when using Network Access Protection as an expedited deployment of an urgent security update:

  • Inconsequential loss of network connectivity for most users:
    Most users lose network connectivity at the same time, and applications that require network connectivity report errors until remediation is complete. For many users, this is only a short period of time, and some users do not even notice.
  • Important loss of network connectivity for managers:
    A manager is in the middle of a presentation at corporate headquarters and is using slides hosted on a remote computer. In the middle of her presentation, her computer loses network connectivity and a notification informs her that her computer is not compliant with network policies and has limited network access until compliant.
    The manager is not very happy with the interruption to her presentation, and she resolves that next time she will copy the slides locally to her computer. She is not sure how long the loss of connectivity will be, but she decides to take a break in the presentation and invite questions and discussions on the slides presented so far. After 10 minutes, she sees a notification that says her network connectivity is restored and she continues with her presentation.
  • Loss of network connectivity has impact on deliverables:
    A developer is working through some changes to an in-house application that needs to be checked in by the end of the day. At four o'clock he completes his changes but they fail to check in with a network failure error. He then notices that his computer has limited network access and he calls the Help Desk.
    The Help Desk explains about the urgent software update that must be installed immediately, and asks for his patience while it automatically installs. He clicks on the Network Access Protection notification and can see that his computer is installing software updates through the Configuration Manager System Health Agent, but the installation is taking a long time.
    The Help Desk investigates and confirms that his network segment is heavily saturated, and distribution points are also running more slowly than usual because of the higher than usual demand. The developer realizes he is unlikely to check in his new code by the end of the day and informs his manager. He goes home leaving his computer switched on. He returns the following day to find that it is reconnected to the network, so he can now check in his code.
  • Network loss continuation for remote offices:
    A user in a remote branch loses connectivity while trying to send e-mails. He contacts the Help Desk and learns about the critical software update. However, his computer fails to install the software update and on investigation, the Help Desk discovers remediation failures are due to network timeouts. The software update package has not yet replicated to the branch distribution point and the computer is attempting to download the software update across a slow and unreliable network connection.
    The Help Desk engineer explains how the user can install the software update from the Troubleshooting Web site, and then instructs him to reboot his machine. The user follows this advice, and after the reboot, his computer is connected with unlimited access.

See Also

Concepts

About the Differences Between Software Updates and Network Access Protection
About the Network Access Protection Process
About Phased and Expedited Network Access Protection Deployments
Determine Administrator Roles and Processes for Network Access Protection
About Compliance for Network Access Protection in Configuration Manager
About Network Access Protection Remediation


NAP Evaluation Conditions for Configuration Manager Clients

Topic last updated -- August 2007

The following table lists the conditions under which the Configuration Manager 2007 Network Access Protection client agent will perform a full NAP evaluation rather than use a cached statement of health (SoH). Using a cached statement of health results in faster connections, but the NAP evaluation information might be out of date. For more information about the statement of health in Configuration Manager 2007 Network Access Protection, see About the Statement of Health (SoH) in Network Access Protection.

Reference this table to help you troubleshoot unexpected delays and processing on the client, as well as understand better how Network Access Protection in Configuration Manager 2007 affects clients in production environments.

The option Force a fresh scan for each evaluation is enabled or canceled on the Evaluation tab of the Network Access Protection client agent properties, where you can also configure the NAP evaluation schedule. For more information about these options, see How to Configure NAP Evaluation Settings.

Key:

√ = NAP evaluation performed

Ø = NAP evaluation not performed

Option Force a fresh scan for each evaluation | NAP evaluation cycle | Modified Configuration Manager NAP policies | Location Services component detected a change | Windows NAP Agent requests SoH when cached SoH is present | Windows NAP Agent requests SoH when cached SoH is not present
Enabled | √ | √ | √ | √ | √
Not enabled | √ | Ø | Ø | Ø | √

See Also

Concepts

Configuration Manager Network Access Protection SoH Generation

Other Resources

Technical Reference for Network Access Protection


Discovery in Configuration Manager

After a Microsoft System Center Configuration Manager 2007 site system has been installed and configured, you can begin adding resources and clients to the site. This is done using discovery, the term used for a variety of methods that search for resources across your network.

The following configurable discovery methods are available for locating resources in Configuration Manager 2007:

  • Active Directory System Group Discovery
  • Active Directory Security Group Discovery
  • Active Directory System Discovery
  • Active Directory User Discovery
  • Network Discovery
  • Heartbeat Discovery

Several resource discovery methods are already fine-tuned to discover a specific type of resource. Network discovery, which is by far the broadest and most commonly used discovery method, can be fine-tuned by you to find the type of resources you're looking for.

The topics in this section provide detailed information about configuring and using the various discovery methods for finding resources in clients in Configuration Manager 2007.

Note
If you are looking for information about how to have clients automatically discover their site code, see About Client Site Assignment in Configuration Manager.

In This Section

Discovery Overview

Provides an overview of discovery methods.

Configuring Discovery in Configuration Manager

Provides procedures for running Configuration Manager 2007 discovery.

Discovery Privacy Information

Discusses privacy considerations when running discovery.

Troubleshooting Discovery

Notes common issues and solutions for discovery.

Technical Reference for Discovery

Includes additional reference material about discovery.

See Also

Other Resources

Configuration Manager 2007 Features


Discovery Overview

Microsoft System Center Configuration Manager 2007 provides you with six configurable methods of discovery to search your network for resources. Each of these methods provides you with a different view of your network and will result in a different set of discovered resources.

All of these methods are configurable, but they are disabled upon site installation (with the exception of Heartbeat Discovery) and must be enabled prior to use. All use the same procedures for enabling the method.

In This Section

About Configuration Manager Discovery

Provides information about the discovery process in Configuration Manager.

About Active Directory System Group Discovery

Provides information about the Active Directory System Group Discovery method in Configuration Manager.

About Active Directory Security Group Discovery

Provides information about the Active Directory Security Group Discovery method in Configuration Manager.

About Active Directory System Discovery

Provides information about the Active Directory System Discovery method in Configuration Manager.

About Active Directory User Discovery

Provides information about the Active Directory User Discovery method in Configuration Manager.

About Network Discovery

Provides information about the Network Discovery method in Configuration Manager.

About Heartbeat Discovery

Provides information about the Heartbeat Discovery method in Configuration Manager.

About DHCP Servers and Network Discovery

Provides information about using DHCP servers for Network Discovery in Configuration Manager.

About Router Hops in Network Discovery

Provides information about the role of router hops in the Network Discovery method.

Discovery Troubleshooting Flowcharts

Provides end-to-end workflows for Configuration Manager discovery processes.


About Configuration Manager Discovery

Within Microsoft System Center Configuration Manager 2007, once you've installed your central Configuration Manager site, you'll want to begin adding clients and resources to the site. These are added using one of the available Configuration Manager discovery methods, which search your network to find resources that you can use with Configuration Manager 2007. You must use at least one discovery method before you can use most Configuration Manager functionality. In short, it's necessary to "discover" computers on your network before you can install the Configuration Manager 2007 client software that allows you to deliver packages, updates, and so forth to those clients.

Resources

Although many of these discovered resources are computers on which you can install the client software, other resources can also be discovered and added to the Configuration Manager database. These other resources include Active Directory objects (such users, groups, and computers), as well as other site systems, routers, hubs, printers, and other IP-addressable devices on your network.

For a more in-depth discussion of resources within Configuration Manager 2007, see About Resources.

Discovery Methods

Six methods of discovery are available in Configuration Manager 2007:

  • Network Discovery
  • Heartbeat Discovery
  • Active Directory System Group Discovery
  • Active Directory Security Group Discovery
  • Active Directory System Discovery
  • Active Directory User Discovery

The most commonly used, however, will probably be Network Discovery, as it's the most generalized form of discovery. It allows Configuration Manager 2007 to perform a broad search of your network by checking the DHCP leases, looking at routers' Address Resolution Protocol (ARP) caches, or looking for SNMP)-enabled devices in a community. Because of the broad spectrum of resources connected to your network, network discovery is also likely to find resources such as printers that are not capable of becoming Configuration Manager 2007 clients.

Configuration Manager 2007 can also communicate with Active Directory to locate resources such as computer accounts, user accounts, system groups, and security groups already existing in your accounts database.

Configuration Manager 2007 also uses Heartbeat Discovery, but instead of it being used to create new database records, it is used to keep existing records up to date. Heartbeat Discovery is the only configurable discovery method that is automatically enabled when Configuration Manager 2007 is installed.

Configuration Manager 2007 also creates database records for site server and site system computers when you assign a site system role to that computer, as well as when inventory is collected from a Configuration Manager client. This method of discovery is automatic and not configurable.

Database Records

As Configuration Manager 2007 discovers resources, it creates records in the Configuration Manager database. This record is called a data discovery record (DDR) and the file generated has a .DDR extension. The specific information contained in each record varies depending on the resource "discovered," but it can include data such as the NetBIOS name of a computer, IP address and IP subnet of a computer or device, operating system, MAC address, and so on.

Depending on the discovery method used, resource DDRs are periodically regenerated to keep the discovery data up to date in the database and to verify that the resource is still a valid resource within the Configuration Manager 2007 site.

See Also

Other Resources

Discovery Overview


About Active Directory System Group Discovery

The Configuration Manager 2007 Active Directory System Group Discovery method searches for system group resources by polling the closest Active Directory domain controller. The Active Directory domain can be in mixed mode or native mode.

As with other Active Directory discovery methods, this method is configurable by the administrator. When configuring it, you can specify the containers to be polled and the polling schedule.

For more information on configuring this discovery method, see How to Configure Active Directory System Group Discovery.

Active Directory System Group Discovery provides additional information about computers discovered by Active Directory System Discovery. Active Directory System Group Discovery returns the following group information about computer accounts:

  • Organizational unit
  • Global groups
  • Universal groups
  • Nested groups
  • Nonsecurity groups

This method returns the objects as reflected in Active Directory when the discovery method last ran. Although this information is updated when the next poll takes place, you should not consider this method to be dynamic.

Note
You must have Modify permission on the Site Security object or instance to configure the Active Directory System Group Discovery method.

See Also

Tasks

How to Configure Active Directory System Group Discovery

Concepts

About Configuration Manager Discovery

Other Resources

Active Directory System Group Discovery Properties
Discovery Overview


About Active Directory Security Group Discovery

The Configuration Manager 2007 Active Directory Security Group Discovery method searches for security groups by polling the closest Active Directory domain controller. The Active Directory domain can be in mixed mode or native mode.

As with other Active Directory discovery methods, this method is configurable by the administrator. When configuring it, you can specify the containers to be polled and the polling schedule.

For more information on configuring this discovery method, see How to Configure Active Directory Security Group Discovery.

This method returns the objects as reflected in Active Directory when the discovery method last ran. Although this information is updated when the next poll takes place, you should not consider this method to be dynamic.

Note
You must have Modify permission on the Site Security object or instance to configure the Active Directory Security Group Discovery method.

See Also

Tasks

How to Configure Active Directory Security Group Discovery

Concepts

About Configuration Manager Discovery
About Active Directory Security Group Discovery

Other Resources

Discovery Overview


About Active Directory System Discovery

Topic Last Updated—August 2008

The Configuration Manager 2007 Active Directory System Discovery method searches for system resources by polling the closest Active Directory domain controller. The Active Directory domain can be in mixed mode or native mode.

As with other Active Directory discovery methods, this method is configurable by the administrator. When configuring it, you can specify the containers to be polled and the polling schedule.

For more information on configuring this discovery method, see How to Configure Active Directory System Discovery.

The system attributes returned by Active Directory System Discovery can be configured by the administrator, but by default they include the following information about the computer account:

  • Computer name
  • Operating system
  • Object class
  • DNS Host name
  • Domain

This method returns the objects as reflected in Active Directory when the discovery method last ran. Although this information is updated when the next poll takes place, you should not consider this method to be dynamic.

Note
You must have Modify permission on the Site Security object or instance to configure the Active Directory System Discovery method.

See Also

Tasks

How to Configure Active Directory System Discovery

Concepts

About Configuration Manager Discovery

Other Resources

Active Directory System Discovery Properties
Discovery Overview


About Active Directory User Discovery

The Configuration Manager 2007 Active Directory User Discovery method searches for computer user resources by polling the closest Active Directory domain controller. The Active Directory domain can be in mixed mode or native mode.

As with other Active Directory discovery methods, this method is configurable by the administrator. When configuring it, you can specify the containers to be polled and the polling schedule.

For more information on configuring this discovery method, see How to Configure Active Directory User Discovery.

The user attributes returned by Active Directory User Discovery can be configured by the administrator, but by default they include the following information about the user account:

  • User name
  • DNS host name
  • Object class
  • Active Directory domain
  • Active Directory container name

This method returns the objects as reflected in Active Directory when the discovery method last ran. Although this is updated when the next poll takes place, you should not consider this method to be dynamic.

Note
You must have Modify permission on the Site Security object or instance to configure the Active Directory User Discovery method.

See Also

Tasks

How to Configure Active Directory User Discovery

Concepts

About Configuration Manager Discovery

Other Resources

Active Directory User Discovery Properties
Discovery Overview


About Network Discovery

The Configuration Manager 2007 Network Discovery method searches for network resources by polling your network for any IP addressable resources. This means you can discover not only computers, but also printers, routers, bridges, and so on. By default, only the subnet and local domain on which your site server resides is searched, but you can discover other subnets and domains throughout your enterprise network using DHCP), SNMP), or other mechanisms.

Note
The more subnets and domains that are discovered, the more network traffic is generated. To mitigate the impact on the network, you can schedule several small discoveries instead of a single large one. However, such small discoveries would run serially, and you would need to change the scope of your Network Discovery before running it each time.

Network Discovery can provide an extensive list of attributes as part of the discovery record, including:

  • NetBIOS name
  • IP addresses
  • Resource domain
  • System roles
  • SNMP community name
  • MAC addresses

Network Discovery is often the most commonly used of the discovery methods, and as such, it has the most flexibility of all configurable discovery methods. It can be used, for instance, to find computers that can become Configuration Manager clients, identify where they are located on your network, and identify how they are distributed, enabling you to formulate a more specific plan for locating and implementing your Configuration Manager sites, site servers, and site systems.

Effectively Using Network Discovery

To configure Network Discovery effectively, you must know the general topology of your network. The Network Discovery method can be used to determine this before being used to discover resources. For more information on discovering your network's topology using this method, see How to Determine Your Network's Topology.

There are three levels of network discovery available to you:

  • Topology. This level causes Network Discovery to discover IP-addressable resources, such as subnets and routers using SNMP. For an example, see Topology-Only Network Discovery.
  • Topology and client. This level additionally discovers potential clients such as computers, as well as resources such as printers and gateways using SNMP, DHCP, and the Windows Browser. For an example, see Topology and Client-only Network Discovery.
  • Topology, client, and client operating systems. In addition to topology and potential clients, Network Discovery also determines the computer's operating system name and version using SNMP, DHCP, Windows Browser, and Windows Networking calls. For an example, see Topology, Client, and Operating System Network Discovery.

Depending on the size of your network and the degree to which it is under the umbrella of the Configuration Manager site, you might want to run the Network topology option first to determine which subnets or domains you need to run a more in-depth discovery on. Additionally, each of these levels produces progressively heavier network traffic. You should take this fact into consideration when choosing the level at which to run Network Discovery and when determining the best time to run Network Discovery to avoid interfering with other network traffic.

Note
You must have Modify permission on the Site Security object or instance to configure the Network Discovery method.

See Also

Tasks

How to Configure Network Discovery

Concepts

About Configuration Manager Discovery

Other Resources

Discovery Overview
Network Discovery Properties


Topology-Only Network Discovery

When the Network Discovery method is used in Configuration Manager 2007, and the Topology option is selected, only routers and subnets are discovered and stored in the Configuration Manager site database.

In general, how extensive this discovery is depends largely on the number of router hops you select for the Network Discovery run. A hop is the passing of data between two network nodes, so increasing the number of hops will dramatically increase the extent of the discovery.

For example, a topology-only discovery with 0 router hops will discover the subnet on which the originating server resides, up to and including any router that it encounters. A topology-only discovery with 1 router hop will discover that same subnet and router, any subnets linked to that first router, and routers on those subnets.

The following diagram shows what this type of Network Discovery finds when it runs on Server 1 with 0 router hops specified: subnet D and Router 1.

Topology-Only Network Discovery Diagram

For additional information on how router hops have an impact on Network Discovery, see About Router Hops in Network Discovery.

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Topology and Client-only Network Discovery
Topology, Client, and Operating System Network Discovery


Topology and Client-only Network Discovery

When the Network Discovery method is used in Configuration Manager 2007, and the Topology and Client option is selected, routers, subnets, and potential clients are discovered and stored in the Configuration Manager site database.

The following diagram shows what this type of Network Discovery finds when it runs on Server 1 with 0 router hops specified: subnet D and Router 1, and all potential clients on subnet D.

Network Client Discovery Diagram: Router hops

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Topology-Only Network Discovery
Topology, Client, and Operating System Network Discovery


Topology, Client, and Operating System Network Discovery

When the Network Discovery method is used in Configuration Manager 2007, and the Topology, client, and client operating system option is selected, routers, subnets, potential clients, and their operating systems are discovered and stored in the Configuration Manager site database. (Operating system information is needed for collections that depend on the operating system type.)

The following diagram shows what this type of Network Discovery finds when it runs on Server 1 with 0 router hops specified: subnet D, Router 1, all potential clients on subnet D, and their operating system types and versions.

Network DiscoveryTopology Client Operating Diagram

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Topology-Only Network Discovery
Topology and Client-only Network Discovery


About Heartbeat Discovery

The Configuration Manager 2007 Heartbeat Discovery method is the only one of the configurable discovery methods that is automatically enabled when Configuration Manager is installed. This is because Heartbeat Discovery is designed to keep data discovery records (DDRs) updated in the Configuration Manager database.

This discovery method is very important to the continued maintenance of your site database, as it ensures that resource records are current and won't accidentally be aged out of the Configuration Manager database.

As noted, Heartbeat Discovery updates existing DDRs rather than creating new ones. By default, it generates an updated DDR for each client every seven days, although this timing is configurable. Although you can configure Heartbeat Discovery to update client DDRs as frequently as you want, if you configure it to run less than once every 25 hours (the default client refresh cycle) the updated DDR will be reported no less than once every 25 hours.

Note
Heartbeat Discovery is active only on computers that have already been installed as Configuration Manager clients.

Heartbeat Discovery Process

Heartbeat Discovery runs on installed Configuration Manager clients according to the schedule you specify. With this method enabled, the Client Component Installation Manager (CCIM) on the client causes the Cliex32.dll to generate a DDR, which is then written to the management point. This file is the same size as a normal DDR (approximately 1 KB per client), and so it will generate approximately the same network traffic.

Potential Problems

With a functioning Configuration Manager system, only two potential problems are present with the Heartbeat Discovery method. The first is a relatively simple problem to avoid: ensure that Heartbeat Discovery is not disabled by accident. If you disable Heartbeat Discovery, data discovery records are refreshed only when another discovery method is invoked or run on a schedule. Even then, only those DDRs that are included in the second discovery method will be updated.

Note
Heartbeat Discovery is useful for maintaining up-to-date discovery data on clients that are not normally affected by one of the other discovery methods, such as a server that users seldom log on to.

The second potential issue with Heartbeat Discovery is based on the fact that its schedule is configurable. It is important to ensure that any schedule you create causes the DDRs to be updated frequently enough so that the original DDR isn't viewed by Configuration Manager as obsolete or deleted from the database.

See Also

Tasks

How to Configure Heartbeat Discovery
How to Enable a Discovery Method

Concepts

About Configuration Manager Discovery

Other Resources

Discovery Overview


About DHCP Servers and Network Discovery

When configuring Network Discovery to discover a client, you can set it to use DHCP servers to discover DHCP clients. Although this functionality is useful, it does have some limitations.

The primary limitation to using DHCP servers for the Network Discovery method is that the site server computer$ account must have user-level security access to the DHCP server specified on the DHCP tab of the Network Discovery Properties dialog box.

This means that one of the following conditions must be true:

  • The specified server is the DHCP server of the Configuration Manager site server.
  • The computer running Network Discovery and the DHCP server are in the same domain.
  • The computer running Network Discovery and the DHCP server trust each other.
  • The site server computer$ account has the same user name and password as a local computer account on the DHCP server.
  • The site server computer$ account has the same user name and password as an account in the DHCP server's domain.
  • The site server is a member of the DHCP users group.

See Also

Tasks

How to Configure Network Discovery

Reference

Network Discovery Properties: DHCP Tab


About Router Hops in Network Discovery

In Configuration Manager 2007, the degree to which a large network is mapped at one time by Network Discovery is determined by the number of router hops that a Network Discovery run is set for. Each router hop made during the network discovery can significantly increase the amount discovered if a network is broken into multiple nodes.

To get a better idea of how router hops can affect the amount of network resources discovered, consider the following network:

Example of Router Hops in Network Discovery

A Network Discovery, running from Server 1, finds the following routers (and their attached subnets), depending on how many router hops are specified:

  • Zero router hops: Router B
  • One router hop: Routers A, B, C, and E
  • Two router hops: All routers

More detailed examples can be seen for router hops ranging from zero to four hops by clicking the following links:

  • Zero router hop: Example of Initial Network Discovery, Hop Count 0
  • One router hops: see Example of Initial Network Discovery, Hop Count 1
  • Two router hops: Example of Initial Network Discovery, Hop Count 2
  • Three router hops: Example of Initial Network Discovery, Hop Count 3
  • Four router hops: Example of Initial Network Discovery, Hop Count 4

See Also

Tasks

How to Determine Your Network's Topology

Concepts

About Router Hops in Network Discovery
Topology-Only Network Discovery


Example of Initial Network Discovery, Hop Count 0

To get a better idea of how router hops can affect the amount of network resources discovered, consider the following network:

Example of Initial Network Discovery, Hop Count 0

Running a topology-only Network Discovery from Server 1 with zero router hops will discover Router 1 and subnet 10.1.10.0.

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Example of Initial Network Discovery, Hop Count 1
Example of Initial Network Discovery, Hop Count 2
Example of Initial Network Discovery, Hop Count 3
Example of Initial Network Discovery, Hop Count 4
Topology-Only Network Discovery


Example of Initial Network Discovery, Hop Count 1

To get a better idea of how router hops can affect the amount of network resources discovered, consider the following network:

Example of Initial Network Discovery, Hop Count 2

Running a topology-only Network Discovery from Server 1 with one router hop will discover the following:

  • Router 1 and subnet 10.1.10.0 (found with zero hops).
  • Subnets 10.1.20.0 and 10.1.30.0, subnet A, and Router 2 (found on the first hop).

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Example of Initial Network Discovery, Hop Count 0
Example of Initial Network Discovery, Hop Count 2
Example of Initial Network Discovery, Hop Count 3
Example of Initial Network Discovery, Hop Count 4
Topology-Only Network Discovery


Example of Initial Network Discovery, Hop Count 2

To get a better idea of how router hops can affect the amount of network resources discovered, consider the following network:

Example of Initial Network Discovery, Hop Count 3

Running a topology-only Network Discovery from Server 1 with two router hops will discover the following:

  • Router 1 and subnet 10.1.10.0 (found with zero hops).
  • Subnets 10.1.20.0 and 10.1.30.0, subnet A, and Router 2 (found on the first hop).
  • Subnets B and C, and Router 3 (found on the second hop).

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Example of Initial Network Discovery, Hop Count 0
Example of Initial Network Discovery, Hop Count 1
Example of Initial Network Discovery, Hop Count 3
Example of Initial Network Discovery, Hop Count 4
Topology-Only Network Discovery


Example of Initial Network Discovery, Hop Count 3

To get a better idea of how router hops can affect the amount of network resources discovered, consider the following network:

Example of Initial Network Discovery, Hop Count 4

Running a topology-only Network Discovery from Server 1 with two router hops will discover the following:

  • Router 1 and subnet 10.1.10.0 (found with zero hops).
  • Subnets 10.1.20.0 and 10.1.30.0, subnet A, and Router 2 (found on the first hop).
  • Subnets B and C, and Router 3 (found on the second hop).
  • Subnets D and E, and Router 4 (found on the third hop).

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Example of Initial Network Discovery, Hop Count 0
Example of Initial Network Discovery, Hop Count 1
Example of Initial Network Discovery, Hop Count 2
Example of Initial Network Discovery, Hop Count 4
Topology-Only Network Discovery


Example of Initial Network Discovery, Hop Count 4

To get a better idea of how router hops can affect the amount of network resources discovered, consider the following network:

Example of Initial Network Discovery, Hop Count 4

Running a topology-only Network Discovery from Server 1 with two router hops will discover the following:

  • Router 1 and subnet 10.1.10.0 (found with zero hops).
  • Subnets 10.1.20.0 and 10.1.30.0, subnet A, and Router 2 (found on the first hop).
  • Subnets B and C, and Router 3 (found on the second hop).
  • Subnets D and E, and Router 4 (found on the third hop).
  • Subnet F (found on the fourth hop).

See Also

Tasks

How to Determine Your Network's Topology

Concepts

Example of Initial Network Discovery, Hop Count 0
Example of Initial Network Discovery, Hop Count 1
Example of Initial Network Discovery, Hop Count 2
Example of Initial Network Discovery, Hop Count 3
Topology-Only Network Discovery


Configuring Discovery in Configuration Manager

Before you can use a discovery method in Configuration Manager 2007 to find resources to populate your collections, it is first necessary to configure that method. This entails not only enabling the discovery method, but in some cases, fine-tuning it to effectively use the discovery method in your enterprise.

Click the related link for detailed information about the associated discovery method task.

In This Section

How to Enable a Discovery Method

Specifies how to enable any of the discovery methods available in Configuration Manager.

How to Configure Active Directory System Group Discovery

Specifies how to configure the Active Directory System Group Discovery method.

How to Configure Active Directory Security Group Discovery

Specifies how to configure the Active Directory Security Group Discovery method.

How to Configure Active Directory System Discovery

Specifies how to configure the Active Directory System Discovery method.

How to Configure Active Directory User Discovery

Specifies how to configure the Active Directory User Discovery method.

How to Manage Network Discovery

Specifies how to configure the Network method.

How to Configure Heartbeat Discovery

Specifies how to configure the Heartbeat Discovery method.

See Also

Other Resources

Discovery Overview


How to Enable a Discovery Method

With the exception of the Heartbeat Discovery method, all configurable discovery methods in Configuration Manager 2007 must be enabled before they can be used to "discover" resources on a network. Each method can also be disabled using the same procedure used to enable it. Once a discovery method has been enabled, it also needs to be configured to your specific discovery needs.

Heartbeat discovery comes enabled with the installation of Configuration Manager 2007 and does not need to be enabled. Although it can be disabled using this procedure, it is strongly recommended that you do not do so, as this method is automatic and used primarily to ensure that data discovery records (DDRs) are up to date, rather than to discover new resources.

To enable a discovery method

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click the discovery method that you want to enable and then click Properties.

  3. On the General tab, select the Enable <discovery method> check box.

    Note
    If this check box is already selected, the discovery method can be disabled by clearing the check box.

  4. Click OK.

See Also

Other Resources

Discovery Overview


How to Configure Active Directory System Group Discovery

Active Directory System Group Discovery polling can generate significant network traffic, so you should schedule the discovery to occur at times when this network traffic will not adversely affect business uses of your network.

Note
You must have Modify permission for the Site Security object class or instance to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To configure Active Directory System Group Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Active Directory System Group Discovery, and then click Properties.

  3. Enable the discovery method if it is not already enabled.

  4. On the General tab, click the New icon to specify a new Active Directory container.

  5. On the New Active Directory Container dialog box, specify the container to search by location. Three options are available:

    • Local domain: Searches for Active Directory containers in the domain in which the computer hosting the Configuration Manager console resides.
    • Local forest: Searches for Active Directory containers in the forest in which the computer hosting the Configuration Manager console resides.
    • Custom LDAP or GC Query: Searches for Active Directory containers using a Lightweight Directory Access Protocol (LDAP) or General Catalog (GC) query.
      If this option is selected, you can either enter the path to an existing query to run the search or click Browse to navigate to a query.

  6. Select any additional search options to use. Two options are available:

    • Recursive: Specifies that the search includes child containers. This check box is selected by default. If it is cleared, child containers are not searched.
    • Include groups: Specifies that objects within groups are discovered by this method. If it is selected, you can discover objects in other domains, but the likelihood of discovering the same object more than once is increased. If this check box is cleared, duplicate objects and objects in other domains are less likely to be found. This will result in the discovery process completing more quickly. This check box is cleared by default.

  7. Click OK.

  8. On the Polling Schedule tab, click the Schedule button and set a custom schedule if desired. By default, the Active Directory System Group Discovery method polls once per day.

  9. To run the discovery method immediately, select the Run discovery as soon as possible check box.

    Note
    This check box is cleared when the run request is made to the Configuration Manager site database.

  10. Click OK.

See Also

Tasks

How to Enable a Discovery Method

Concepts

About Active Directory System Group Discovery
New Active Directory Container Dialog Box

Other Resources

Active Directory System Group Discovery Properties
Discovery Overview


How to Configure Active Directory Security Group Discovery

Active Directory Security Group Discovery polling can generate significant network traffic, so you should schedule the discovery to occur at times when this network traffic will not adversely affect business uses of your network.

Note
You must have Modify permission for the Site Security object class or instance to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To configure Active Directory Security Group Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Active Directory Security Group Discovery, and then click Properties.

  3. Enable the discovery method if it is not already enabled.

  4. On the General tab, click the New icon to specify a new Active Directory container.

  5. On the New Active Directory Container dialog box, specify the container to search by location. Three options are available:

    • Local domain: Searches for Active Directory containers in the domain in which the computer hosting the Configuration Manager console resides.
    • Local forest: Searches for Active Directory containers in the forest in which the computer hosting the Configuration Manager console resides.
    • Custom LDAP or GC Query: Searches for Active Directory containers using a Lightweight Directory Access Protocol (LDAP) or a General Catalog (GC) query.
      If this option is selected, you can either enter the path to an existing query to run the search or click Browse to navigate to a query.

  6. Select any additional search options to use. Two options are available:

    • Recursive: Specifies that the search includes child containers. This check box is selected by default. If it is cleared, child containers are not searched.
    • Include nested groups: Specifies that objects within groups are discovered by this method. If it is selected, you can discover objects in other domains, but the likelihood of discovering the same object more than once is increased. If this check box is cleared, duplicate objects and objects in other domains are less likely to be found. This will result in the discovery process completing more quickly. This check box is cleared by default.

  7. Click OK.

  8. On the Polling Schedule tab, click the Schedule button and set a custom schedule if desired. By default, the Active Directory Security Group Discovery method polls once per day.

  9. To run the discovery method immediately, select the Run discovery as soon as possible check box.

    Note
    This check box is cleared when the run request is made to the Configuration Manager site database.

  10. Click OK.

See Also

Tasks

How to Enable a Discovery Method

Concepts

About Active Directory Security Group Discovery
New Active Directory Container Dialog Box

Other Resources

Active Directory Security Group Discovery Properties
Discovery Overview


How to Configure Active Directory System Discovery

Active Directory System Discovery polling can generate significant network traffic, so you should schedule the discovery to occur at times when this network traffic will not adversely affect business uses of your network.

Note
You must have Modify permission for the Site Security object class or instance to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To configure Active Directory System Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Active Directory System Discovery, and then click Properties.

  3. Enable the discovery method if it is not already enabled.

  4. On the General tab, click the New icon to specify a new Active Directory container.

  5. In the New Active Directory Container dialog box, specify the container to search by location. Three options are available:

    • Local domain: Searches for Active Directory containers in the domain in which the computer hosting the Configuration Manager console resides.
    • Local forest: Searches for Active Directory containers in the forest in which the computer hosting the Configuration Manager console resides.
    • Custom LDAP or GC Query: Searches for Active Directory containers using a Lightweight Directory Access Protocol (LDAP) or a General Catalog (GC) query.
      If this option is selected, you can either enter the path to an existing query to run the search or click Browse to navigate to a query.

  6. Select any additional search options to use. Two options are available:

    • Recursive: Specifies that the search includes child containers. This check box is selected by default. If it is cleared, child containers are not searched.
    • Include groups: Specifies that objects within groups are discovered by this method. If it is selected, you can discover objects in other domains, but the likelihood of discovering the same object more than once is increased. If this check box is cleared, duplicate objects and objects in other domains are less likely to be found. This will result in the discovery process completing more quickly. This check box is cleared by default.

  7. Click OK.

  8. On the Polling Schedule tab, click the Schedule button and set a custom schedule if desired. By default, the Active Directory System Discovery method polls once per day.

  9. To run the discovery method immediately, select the Run discovery as soon as possible check box.

    Note
    This check box is cleared when the run request is made to the Configuration Manager site database.

  10. On the Active Directory Attribute tab, verify that all desired Active Directory attributes that you want to discover are displayed. By default, only the required attributes are displayed.

    If you want to discover an additional attribute, click the New icon to add an attribute to the list. In the Specify Attribute Name dialog box, type the name of the attribute you want to discover and then click OK.

  11. Click OK.

See Also

Tasks

How to Enable a Discovery Method

Concepts

About Active Directory System Discovery
New Active Directory Container Dialog Box

Other Resources

Active Directory System Discovery Properties
Discovery Overview


How to Configure Active Directory User Discovery

Active Directory User Discovery polling can generate significant network traffic, so you should schedule the discovery to occur at times when this network traffic will not adversely affect business uses of your network.

Note
You must have Modify permission for the Site Security object class or instance to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To configure Active Directory User Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Active Directory User Discovery, and then click Properties.

  3. Enable the discovery method if it is not already enabled.

  4. On the General tab, click the New icon to specify a new Active Directory container.

  5. On the New Active Directory Container dialog box, specify the container to search by location. Three options are available:

    • Local domain: Searches for Active Directory containers in the domain in which the computer hosting the Configuration Manager console resides.
    • Local forest: Searches for Active Directory containers in the forest in which the computer hosting the Configuration Manager console resides.
    • Custom LDAP or GC Query: Searches for Active Directory containers using a Lightweight Directory Access Protocol (LDAP) or a General Catalog (GC) query.
      If this option is selected, you can either enter the path to an existing query to run the search or click Browse to navigate to a query.

  6. Select any additional search options to use. Two options are available:

    • Recursive: Specifies that the search includes child containers. This check box is selected by default. If it is cleared, child containers are not searched.
    • Include groups: Specifies that objects within groups are discovered by this method. If it is selected, you can discover objects in other domains, but the likelihood of discovering the same object more than once is increased. If this check box is cleared, duplicate objects and objects in other domains are less likely to be found. This will result in the discovery process completing more quickly. This check box is cleared by default.

  7. Click OK.

  8. On the Polling Schedule tab, click the Schedule button and set a custom schedule if desired. By default, the Active Directory User Discovery method polls once per day.

  9. To run the discovery method immediately, select the Run discovery as soon as possible check box.

    Note
    This check box is cleared when the run request is made to the Configuration Manager site database.

  10. On the Active Directory Attribute tab, verify that all desired Active Directory attributes that you want to discover are displayed. By default, only the required attributes are displayed.

    If you want to discover an additional attribute, click the New icon to add an attribute to the list. In the Specify Attribute Name dialog box, type the name of the attribute you want to discover and then click OK.

  11. Click OK.

See Also

Tasks

How to Enable a Discovery Method

Concepts

About Active Directory User Discovery
New Active Directory Container Dialog Box

Other Resources

Active Directory User Discovery Properties
Discovery Overview


How to Manage Network Discovery

To ensure effective use the Network Discovery method in Configuration Manager 2007, a large number of tasks are available to administrators. This section provides information about using and configuring this method, including using Network Discovery to determine your network topology, configuring Network Discovery itself, and determining when a Network Discovery run is complete.

Click the related link for detailed information about the associated Network Discovery task.

In This Section

How to Determine Your Network's Topology

Specifies how to use Network Discovery to map your network's topology.

How to Configure Network Discovery

Specifies the general steps needed to configure Network Discovery as a whole.

How to Schedule Network Discovery

Specifies how to schedule a Network Discovery run, and whether to use a one-time-only run, a recurring run, or a collection of multiple runs.

How to Set the Number of Router Hops for Network Discovery

Specifies how to set the number of router hops that Network Discovery will take when searching for network resources.

How to Search a Specific Subnet Using Network Discovery

Specifies how to set Network Discovery to search a specific subnet for resources.

How to Search a Specific Domain Using Network Discovery

Specifies how to set Network Discovery to search a specific domain for resources.

How to Search a Specific SNMP Community Using Network Discovery

Specifies how to set Network Discovery to search a specific SNMP community for resources.

How to Search a Specific DHCP Server Using Network Discovery

Specifies how to set Network Discovery to search a specific DHCP server for resources.

How to Verify that Network Discovery is Complete

Specifies how to tell whether a Network Discovery run has completed or not.

See Also

Concepts

About Configuration Manager Discovery
About Network Discovery


How to Configure Network Discovery

The Network Discovery method can generate significant network traffic depending on the type of discovery being run, so you should schedule the discovery to occur at times when this network traffic will not adversely affect business uses of your network. For more information on the types of Network Discovery and their impact on your network, see About Network Discovery.

Note
You must have Modify permission for the Site Security object class to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

How to configure Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. Enable the discovery method if it is not already enabled.

  4. On the General tab, select the type of discovery you want to run. Three types are available:

    • Typology
    • Typology and client
    • Typology, client, and client operating system

  5. If you are working with a slow network, select the Slow Network check box under Network speed.

    Note
    Selecting the Slow network check box will allow Configuration Manager to make allowances for a slower network by doubling SNMP timeouts and reducing the number of SNMP sessions. This might increase the duration of the discovery, however.

  6. On the Subnets tab, select the Search local subnets check box if you want to run discovery on those local subnets. This option is normally selected by default.

  7. If you want to run discovery on subnets in addition to (or instead of) your local subnets, click the New icon.

    In the New Subnet Assignment dialog box, enter the Subnet and Mask information, ensure that the Enable subnet search check box is selected, and then click OK.

  8. On the Domains tab, select the Search local domain check box if you want to run discovery on the local domain. This option is normally selected by default.

  9. If you want to run discovery on domains in addition to (or instead of) your local domain, click the New icon.

    In the Domain Properties dialog box, type the name of the domain to be searched in the discovery in the Domain box, ensure that the Enable domain search check box is selected, and then click OK.

  10. On the SNMP tab, specify the SNMP communities to include in the discovery and place them in the order in which you want to search.

    Note
    Network Discovery uses SNMP community names to gain access to routers that are SNMP devices. Gaining access to a router informs Network Discovery about other routers and subnets linked to the first router. SNMP community names are similar to passwords and Network Discovery can get information only from an SNMP device for which you have specified a community name. Each SNMP device can have its own community name, but often the same community name is shared among several devices. Additionally, most SNMP devices have a default community name of Public (in addition to any others they have). This name can often be used if you do not know any other community names. However, some organizations delete the Public community name from their devices as a security precaution.

  11. If you want to run discovery on SNMP communities in addition to those displayed, click the New icon.

    On the New SNMP Community Name dialog box, type the name of the community to be searched and then click OK.

  12. From the Maximum Hops drop-down list, select the maximum number of router hops for the discovery run to make. For more information on the impact of the number of router hops you select, see About Router Hops in Network Discovery.

  13. If you want to use specific SNMP devices to discover resources with, make sure they are listed on the SNMP Devices tab. If they are not displayed, click the New icon, and in the New SNMP Devices dialog box, type the IP address or name of the specific device and then click OK.

    Specifying an SNMP device will provide information to Network Discovery of other routers and subnets linked to that device.

    Note
    Any device name used must resolve to a valid IP address.

  14. On the DHCP tab, specify any DHCP servers to use to discover DHCP clients if desired.

    To add a new DHCP server to the list, click the New icon and in the New DHCP Server dialog box, type the IP address or resolvable name of the DHCP server, and then click OK.

    Note
    If the server that is running Network Discovery is using a static IP address instead of leasing one from a DHCP server, Network Discovery will not communicate with any DHCP servers unless you specify them on the DHCP tab of the Network Discovery Properties dialog box.

    For more information on the limitations of using DHCP servers for Network Discovery, see About DHCP Servers and Network Discovery.

  15. To use the site server's DHCP server for discovery, select this check box.

  16. On the Schedule tab, click the New icon to set a schedule for running the configured Network Discovery. Generally, Network Discovery generates a large amount of network traffic. You should take this fact into consideration when scheduling the discovery.

    Note
    If multiple schedules are displayed on the Schedule tab at the same time, all schedules will result in a run of Network Discovery as it is configured at the time indicated in the schedule. This is also true for recurring schedules.

  17. Click OK.

  18. After running Network Discovery, verify that the discovery is complete.

    For more information on doing this, see How to Verify that Network Discovery is Complete.

See Also

Tasks

How to Determine Your Network's Topology
How to Verify that Network Discovery is Complete

Concepts

About Network Discovery


How to Determine Your Network's Topology

If you're working with a network of any substantial size, using Network Discovery in Configuration Manager 2007 is usually more efficient if you've mapped your network topology before discovering potential clients and their operating systems. Doing this is more efficient because once you've determined the topology of your network, you can pick and choose which parts of it to discover, as well as when and in what order to discover the parts. This approach also allows you to more closely control the impact of Network Discovery on your network traffic.

The degree to which a large network is mapped at one time by Network Discovery is determined by the number of router hops that a Network Discovery run is set for. Each router hop made during the network discovery can significantly increase the amount of resources discovered if a network is broken into multiple nodes. For more information on how router hops affect Network Discovery, see About Router Hops in Network Discovery.

Once a topology-only discovery has been run, you can use the results as a map for running additional discoveries.

Note
You must have Modify permission for the Site security object class to use the Network Discovery method to determine your network topology. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To determine your network topology

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Configure Network Discovery as discussed in How to Configure Network Discovery with the following specifics:

    • On the General tab, select Topology from the Type of Discovery options.
    • On the Subnets tab, ensure that the Search local subnets check box is selected. This is normally done by default.
      Note
      If you know the specific subnets making up your network, you can clear the Search local subnets check box and use the New icon to add the specific subnets you'd like to search. For large networks, it is often best to search only one or two subnets at one time to minimize the impact on network traffic.

    • On the Domains tab, ensure that the Search local domain check box is selected. This is normally done by default.
    • Using the Maximum hops drop-down list, specify how many router hops Network Discovery should make in mapping your topology. If you are unsure, use a small number, as you can increase it later.
      For more information on how the number of hops will affect the mapping of your network topology, see About Router Hops in Network Discovery.

See Also

Tasks

How to Configure Network Discovery

Concepts

About Network Discovery
About Router Hops in Network Discovery


How to Schedule Network Discovery

Network Discovery can be scheduled for a single run or to run on a recurring basis. Unlike the Active Directory discovery methods, this method cannot be run on an ad hoc basis. However, if you want to run the method as soon as possible after configuring it, you can simply schedule it with a start time in the very near future.

Multiple discovery schedules can be created at the same time using this method. If this is done, all schedules will result in a Network Discovery run, and the run will be in the form in which it is configured at the time the run begins. In the event of a recurring schedule, this is also true.

Note
You must have Modify permission for the Site Security object class to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To schedule a Network Discovery run

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Schedule tab, click the New icon to set a schedule for running the configured Network Discovery.

  4. In the Custom Schedule dialog box, set a Start time using the drop-down list.

  5. Using the Duration drop-down lists, select a duration for the discovery run. This will serve as the maximum length of time for the run. If all items are discovered before this time is up, the run will continue with minimal network traffic until this time is up, searching for (and not finding) additional resources. If the run is not completed before this time is up, only resources discovered before the time expires will be included.

  6. In the Recurrence pattern group box, select how this schedule will recur. Four choices are available:

    • None: The scheduled run is a one-time-only event.
    • Weekly: The scheduled run will occur weekly at the same start time.
    • Monthly: The scheduled run will occur monthly at the same start time.
    • Custom Interval: The scheduled run will occur at a custom interval set by the administrator.

  7. Click OK, and then click OK again.

To modify an existing Network Discovery schedule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Schedule tab, select a schedule to modify from the schedules displayed and then click the Properties icon.

  4. In the Custom Schedule dialog box, make any changes necessary and then click OK.

  5. Click OK.

See Also

Tasks

How to Verify that Network Discovery is Complete

Reference

Network Discovery Properties: Schedule Tab

Concepts

About Network Discovery


How to Set the Number of Router Hops for Network Discovery

In Configuration Manager 2007, the degree to which a large network is mapped at one time by Network Discovery is determined by the number of router hops that a Network Discovery run is set for. Each router hop made during the network discovery can significantly increase the amount discovered if a network is broken into multiple nodes. For more information on how router hops affect Network Discovery, see About Router Hops in Network Discovery.

Note
You must have Modify permission for the Site security object to configure this aspect of Network Discovery. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To set the number of router hops for a Network Discovery run

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. From the Maximum Hops drop-down list on the SNMP tab, select the maximum number of router hops for the discovery run to make.

  4. Click OK.

See Also

Reference

Network Discovery Properties: SNMP Tab

Concepts

About Network Discovery
About Router Hops in Network Discovery


How to Search a Specific Subnet Using Network Discovery

Network Discovery in Configuration Manager 2007 can be set to search a specific subnet or set of subnets during a discovery run. By default, it is set to search local subnets; however, this option can be changed, and additional subnets can be added, deleted, enabled, or disabled on an ad hoc basis. If one or more subnets are displayed on the Subnets tab of the Network Discovery Properties dialog box, only subnets that are marked as Enabled will be searched by the discovery method the next time a scheduled run is started.

Specifically disabling a subnet search during Network Discovery will not preclude a search of that subnet for resources if those resources are included in another configured aspect of the Network Discovery run. It will disable only a specific search of that subnet.

Note
You must have Modify permission for the Site Security object class to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To add a subnet to be searched by Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Subnets tab, click the New icon.

  4. In the New Subnet Assignment dialog box, enter the Subnet and Mask information, ensure that the Enable subnet search check box is selected, and then click OK.

  5. Click OK.

To enable or disable the search of a subnet by Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. If the subnet search to be enabled or disabled is for the local subnets, select or clear the Search local subnets check box on the Subnets tab.

  4. If the subnet search to be enabled or disabled is not for the local domain, select the specific subnet from the displayed list on the Subnets tab, and then click the Enable/Disable icon.

  5. Click OK, and then click OK again.

To delete a subnet from the Network Discovery search

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Subnets tab, select the specific subnet to be deleted from the displayed list of subnets.

  4. Click the Delete icon.

  5. Click OK.

To modify a subnet to be searched by Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Subnets tab, click the Properties icon.

  4. Make any changes necessary, and then click OK.

  5. Click OK.

See Also

Tasks

How to Verify that Network Discovery is Complete

Reference

Network Discovery Properties: Subnets Tab

Concepts

About Network Discovery


How to Search a Specific Domain Using Network Discovery

Network Discovery in Configuration Manager 2007 can be set to search a specific domain or set of domains during a discovery run. By default, it is set to search the local domain; however, this option can be changed, and additional domains can be added, deleted, enabled, or disabled on an ad hoc basis. If one or more domains are displayed on the Domains tab of the Network Discovery Properties dialog box, only domains that are marked as Enabled will be searched by the discovery method the next time a scheduled run is started.

Specifically disabling a domain search during Network Discovery will not preclude a search of that domain for resources if those resources are included in another configured aspect of the Network Discovery run. It will only disable a specific search of that domain.

Note
You must have Modify permission for the Site Security object class to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To add a domain to be searched by Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Domains tab, click the New icon.

  4. In the Domain box, type the name of the domain to be searched in the Network Discovery run.

  5. Ensure that the Enable domain search check box is selected, and then click OK.

  6. Click OK.

To enable or disable the search of a domain by Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. If the domain search to be enabled or disabled is for the local domain, select or clear the Search local domain check box on the Domains tab.

  4. If the domain search to be enabled or disabled is not for the local domain, select the domain from the displayed list on the Domains tab, and then click the Enable icon.

  5. Click OK, and then click OK again.

To delete a domain from the Network Discovery search

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Domains tab, select the domain to be deleted from the displayed list of domains.

  4. Click the Delete icon.

  5. Click OK.

To modify a domain to be searched by Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the Domains tab, click the Properties icon.

  4. Make any changes necessary, and then click OK.

  5. Click OK.

See Also

Tasks

How to Verify that Network Discovery is Complete

Reference

Network Discovery Properties: Domains Tab

Concepts

About Network Discovery


How to Search a Specific SNMP Community Using Network Discovery

Network Discovery in Configuration Manager 2007 can be set to search a specific SNMP community or set of communities during a discovery run. SNMP communities can be added or deleted to the search list on an ad hoc basis. Network Discovery uses community names to gain access to routers that are SNMP devices. Gaining access to a router informs Network Discovery about other routers and subnets linked to the first router.

Note
SNMP community names are similar to passwords, and Network Discovery can get information only from an SNMP device for which you have specified a community name. Each SNMP device can have its own community name, but often the same community name is shared among several devices. Additionally, most SNMP devices have a default community name of Public (in addition to any others they have). This name can often be used if you do not know any other community names. However, some organizations delete the Public community name from their devices as a security precaution.

If multiple SNMP communities are displayed on the SNMP tab of the Network Discovery Properties dialog box, they will be searched by Network Discovery in the order in which they are displayed. Place the most common or popular names at the top of the list, as the list is searched from the top down and this will help minimize network traffic.

You can also use the IP address or resolvable name of a specific SNMP device to help discover resources. This is set using the SNMP Devices tab of the Network Discovery Properties dialog box.

Note
You must have Modify permission for the Site Security object class to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To add an SNMP community to a Network Discovery search

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the SNMP tab, click the New icon.

  4. In the New SNMP Community Name dialog box, type the name of the community to be searched and then click OK.

  5. Use the Move Up or Move Down icon to change the search order of the communities if necessary.

  6. Click OK.

To delete an SNMP community from a Network Discovery search

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the SNMP tab, select the SNMP community from the displayed list.

  4. Click the Delete icon.

  5. Click OK.

To add a specific SNMP device to a Network Discovery search

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the SNMP Device tab, click the New icon.

  4. In the New SNMP Devices dialog box, type the IP address or name of the specific device and then click OK.

    Note
    Any device name used must resolve to a valid IP address.

  5. Click OK.

See Also

Tasks

How to Verify that Network Discovery is Complete

Reference

Network Discovery Properties: SNMP Devices Tab
Network Discovery Properties: SNMP Tab

Concepts

About Network Discovery


How to Search a Specific DHCP Server Using Network Discovery

Network Discovery in Configuration Manager 2007 can be set to use a specific DHCP) server or set of servers to discover DHCP clients during a discovery run. You can set it to always use the site server's DHCP server, and additional domains can be added or deleted on an ad hoc basis.

If the server that is running Network Discovery is using a static IP address instead of leasing one from a DHCP server, Network Discovery will not communicate with any DHCP servers unless you specify them on the DHCP tab of the Network Discovery Properties dialog box.

For more information on the limitations of using DHCP servers for Network Discovery, see About DHCP Servers and Network Discovery.

Note
You must have Modify permission for the Site Security object class to configure this discovery method. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

To add a DHCP server for searching by Network Discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the DHCP tab, click the New icon

  4. In the New DHCP Server dialog box, type the IP address or resolvable name of the DHCP server.

  5. Click OK.

  6. To use the site server's DHCP server for discovery, select this check box on the DHCP tab.

  7. Click OK.

To delete a DHCP server from the Network Discovery search

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the DHCP tab, select the DHCP server to delete from the displayed list.

  4. Click the Delete icon.

  5. To remove the site server's DHCP server from the Network Discovery search, select this check box on the DHCP tab.

  6. Click OK.

See Also

Tasks

How to Verify that Network Discovery is Complete

Reference

Network Discovery Properties: DHCP Tab

Concepts

About Network Discovery


How to Verify that Network Discovery is Complete

When running Network Discovery in Configuration Manager 2007, the time required to run discovery can vary dramatically depending on a variety of factors. These factors can include one or more of the following:

  • The size of your network
  • The topology of your network
  • The maximum number of hops being made to find routers in the network
  • The type of discovery being conducted

Because Network Discovery does not have an alert message that tells you when discovery is complete, it might be necessary to verify this yourself.

To verify that Network Discovery is complete

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Status / Status Message Queries.

  2. Right-click All Status Messages and click Show Messages.

  3. Use the Select Date and Time drop-down list to estimate how long ago the discovery was started and to show you all status messages since that time.

    Note
    You can also use the Specify Date and Time option to select a given date and time that you ran the discovery method. This option is most useful when you ran Network Discovery on a given date and want to retrieve only messages from that date without having to view all messages since then as well.

  4. Search the Message ID column for the following:

    Message ID: 502

    Description: This component stopped.

    Component: SMS_WINNT_SERVER_DISCOVERY_AGENT

    Note
    If a large number of messages are shown, it is often easiest to click the Message ID column header to order the messages by their ID. When doing this, however, you will want to check the Date/Time column for your message to verify that it's the correct one if you've run Network Discovery more than once during the period in question.

  5. If no message 502 is displayed, search the Message ID column for the following:

    Message ID: 500

    Description: This component started.

    Component: SMS_WINNT_SERVER_DISCOVERY_AGENT

    This information verifies that Network Discovery was launched and simply has not yet completed. If this information is not present, reschedule Network Discovery.

See Also

Tasks

How to Configure Network Discovery

Concepts

About Network Discovery


How to Configure Heartbeat Discovery

Unlike the other configurable discovery methods within Configuration Manager 2007, Heartbeat Discovery is already enabled with a standard Configuration Manager site installation. As a result, you need to configure only the schedule for how often clients send an updated data discovery record (DDR) to the management point.

To set the Heartbeat Discovery schedule, you must have Modify permissions for the Site Security object class or instance. For more information about security permissions, see Classes and Instances for Object Security in Configuration Manager.

Note
If client push installation is enabled on your Configuration Manager site, you should set this schedule interval to less than the client rediscovery interval period set for site maintenance. This will prevent the needless reinstallation of clients. The client rediscovery interval can be viewed by selecting Tasks on the Site Maintenance node, right-clicking Clear Install Flag, and then clicking Properties.

Although Heartbeat Discovery is enabled by default, if it becomes disabled accidentally, it can be re-enabled in the same manner as any other discovery method. For more information, see How to Enable a Discovery Method.

To configure the Heartbeat Discovery schedule

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Heartbeat Discovery, and then click Properties.

  3. In the Heartbeat schedule group box, specify how often clients will create and send a heartbeat DDR to the management point.

  4. Click OK.

See Also

Tasks

How to Enable a Discovery Method

Concepts

About Configuration Manager Discovery
About Heartbeat Discovery

Other Resources

Discovery Overview


Discovery Privacy Information

Discovery in Microsoft System Center Configuration Manager 2007 is a fairly low-risk activity. It might be possible for an attacker to engineer a denial of service attack by creating a large number of data discovery records (DDRs), but this is just one of many ways attackers can try to overwhelm site systems . There are no additional security recommendations for discovery, but you should be aware of the type of data collected by discovery and any potential privacy implications with that data collection.

Privacy Information

Discovery creates records for network resources and stores them in the database. Data discovery records contain computer information such as IP address, operating system, and computer name. Active Directory discovery methods can also be configured to discover any information that is stored in Active Directory.

The only discovery method that is enabled by default is Heartbeat Discovery, but that method only discovers computers that are already Configuration Manager 2007 clients. Before configuring additional discovery methods or extending Active Directory discovery, consider your privacy requirements.

Discovery information is not sent back to Microsoft. Discovery information is stored in the site database. Information is retained in the database until deleted by the site maintenance tasks Delete Aged Discovery Data every 90 days. You can configure the deletion interval.

See Also

Other Resources

Discovery in Configuration Manager
Security Best Practices and Privacy Information for Configuration Manager Features


Troubleshooting Discovery

Topic last updated—November 2007

You can use the topics in this section when you need to troubleshoot discovery issues in Microsoft System Center Configuration Manager 2007.

In This Section

Troubleshooting Discovery Issues

Describes common issues and possible solutions.

Discovery Troubleshooting Flowcharts

A collection of flowcharts showing discovery process.

See Also

Concepts

Frequently Asked Questions for Discovery

Other Resources

Discovery in Configuration Manager


Troubleshooting Discovery Issues

Topic last updated—January 2008

This topic provides information about troubleshooting issues with Microsoft System Center Configuration Manager 2007 discovery.

To enable verbose logging for the Data Discovery Manager component, on the site server computer, in the registry key HKLM\Software\Microsoft\SMS\Components\SMS_DISCOVERY_DATA_MANAGER, set Verbose logging = 1.

Discovery Does Not Return Any Results

When you configure Active Directory System Discovery (or Active Directory System Group Discovery or Active Directory User Discovery), you do not see any results in the collections.

Solution

Configuration Manager 2007 might not have sufficient access to Active Directory Domain Services. Configuration Manager 2007 must have Read access to the containers that you specify for Active Directory System Discovery, Active Directory System Group Discovery, and Active Directory User Discovery. Configuration Manager 2007 uses the site server computer account to perform Active Directory discovery. When the site server computer account is used in domains other than the domain in which the site server is located, the account must have user rights on those domains. The account must at least be a member of the Domain Users group or local Users group on the domains.

Active Directory Discovery Is Not Returning Specified Attributes

You configure Active Directory User Discovery or Active Directory System Discovery to discover extended Active Directory object attributes, but the attributes you configure are not returned in the discovery information.

Solution

The following types of attributes are supported for Active Directory discovery:

  • ADSTYPE_DN_STRING
  • ADSTYPE_CASE_EXACT_STRING
  • ADSTYPE_CASE_IGNORE_STRING
  • ADSTYPE_PRINTABLE_STRING
  • ADSTYPE_NUMERIC_STRING
  • ADSTYPE_BOOLEAN
  • ADSTYPE_INTEGER
  • ADSTYPE_UTC_TIME
  • ADSTYPE_LARGE_INTEGER
  • ADSTYPE_DN_WITH_STRING

The following types of attributes are not supported for Active Directory discovery:

  • ADSTYPE_OCTET_STRING
  • ADSTYPE_PROV_SPECIFIC
  • ADSTYPE_OBJECT_CLASS
  • ADSTYPE_NT_SECURITY_DESCRIPTOR
  • ADSTYPE_UNKNOWN and ADSTYPE_INVALID
  • ADSTYPE_DN_WITH_BINARY

Nonexistent Computers Being Discovered

You have computers that existed at one time but no longer exist on the network, but they are still being discovered.

Solution

Active Directory System Discovery uses two pieces of information to determine whether a computer is a member of a network:

  1. The computer's account in Active Directory Domain Services.
  2. Successful IP address name resolution.

If Active Directory Systems Discovery can obtain both pieces of information, the computers are discovered and a data discovery record (DDR) is created for each computer. This behavior can be prevented by enabling DNS scavenging on your DNS server.

Network Discovery Not Finding Computers

Network Discovery runs but does not find any computers.

Solution

Network Discovery will create a DDR for a resource only if it can positively determine the resource's subnet mask or Active Directory site. The subnet mask can be determined if the following conditions are met:

  • The client's IP address is listed in a trusted router's ARP cache, and the router has only a single IP address on that interface.
  • The client has a Simple Network Management Protocol (SNMP) agent running, and Network Discovery is configured to use the community name the client is configured for.
  • The client is a Microsoft Dynamic Host Configuration Protocol (DHCP) client.
    Note
    The site server computer account must have domain user credentials in the same domain as the DHCP server.

Network Discovery Cannot Determine Operating Systems

You use Network Discovery to discover computers, but the operating system version information for some discovered computers is not included in the results.

Solution

This behavior occurs when a discovered computer uses the RestrictAnonymous=1 setting. Configuration Manager 2007 does not use the network abstraction layer (NAL) for authentication. Therefore, Network Discovery makes only anonymous connections. To discover the operating system, you must enable an alternate method of discovery, such as Active Directory System Discovery.

Active Directory System Discovery Not Finding All the Computers in the OU

You configure Active Directory System Discovery, and some computers are discovered but some are not.

Solution

Active Directory System Discovery will create a DDR for a resource only if it can resolve the name to the IP address by using DNS. If a valid DNS entry does not exist for a computer, Configuration Manager 2007 does not discover the computer but does create a status message stating there were errors for that computer. You might see these computers referred to as "bogus" in adsysdis.log.

See Also

Other Resources

Discovery in Configuration Manager


Discovery Troubleshooting Flowcharts

The troubleshooting administrator workflows for Configuration Manager 2007 discovery provide end-to-end workflows for specific processes used to discover client resources.

Click the link in the following section for more information about the available collections administrator workflows.

In This Section

Discovery Data Processing Through Discovery Data Manager Flowchart

Provides an end-to-end workflow for processing discovery data through the Discovery Data Manager.

Discovery Data Manager: Parent Site Change Flowchart

Shows end-to-end process for Microsoft System Center Configuration Manager 2007 Discovery Data Manager when a change occurs in the parent site.

Discovery Data Manager: Site Boundary Change Flowchart

Shows end-to-end process for Microsoft System Center Configuration Manager 2007 Discovery Data Manager when a change occurs in the site boundary.

Active Directory Security Group Discovery Flowchart

Shows end-to-end process for Microsoft System Center Configuration Manager 2007 Active Directory Security Group Discovery.

Active Directory System Discovery Flowchart

Shows end-to-end process for Microsoft System Center Configuration Manager 2007 Active Directory System Discovery.

Active Directory System Group Discovery Flowchart

Shows end-to-end process for Microsoft System Center Configuration Manager 2007 Active Directory System Group Discovery.

Active Directory User Discovery Flowchart

Shows end-to-end process for Microsoft System Center Configuration Manager 2007 Active User Discovery.

See Also

Other Resources

Discovery in Configuration Manager
Troubleshooting Discovery


Discovery Data Processing Through Discovery Data Manager Flowchart

The following flowchart shows the end-to-end process for processing discovery data through the Microsoft System Center Configuration Manager 2007 Discovery Data Manager.

Flow Chart of Discovery Data Manager Behavior


Discovery Data Manager: Parent Site Change Flowchart

Topic last updated—November 2007

The following flowchart shows the end-to-end process for Microsoft System Center Configuration Manager 2007 Discovery Data Manager when there is a change in the parent site.

Flow Chart of Discovery Data Manager Behavior

See Also

Other Resources

Troubleshooting Discovery


Discovery Data Manager: Site Boundary Change Flowchart

Topic last updated—November 2007

The following flowchart shows the end-to-end process for Microsoft System Center Configuration Manager 2007 Discovery Data Manager when there is a change in the site boundary.

Flow Chart of Discovery Data Manager Behavior

See Also

Other Resources

Troubleshooting Discovery


Active Directory Security Group Discovery Flowchart

Topic last updated—November 2007

The following flowchart shows the end-to-end process for Microsoft System Center Configuration Manager 2007 Active Directory Security Group Discovery.

Flowchart: Active Directory Security Group Discove

See Also

Other Resources

Troubleshooting Discovery


Active Directory System Discovery Flowchart

Topic last updated—November 2007

The following flowchart shows the end-to-end process for Microsoft System Center Configuration Manager 2007 Active Directory System Discovery.

flowchart Active Directory System Discovery

See Also

Other Resources

Troubleshooting Discovery


Active Directory System Group Discovery Flowchart

Topic last updated—November 2007

The following flowchart shows the end-to-end process for Microsoft System Center Configuration Manager 2007 Active Directory System Group Discovery.

flowchart: Active Directory System Group Discovery

See Also

Other Resources

Troubleshooting Discovery


Active Directory User Discovery Flowchart

Topic last updated—November 2007

The following flowchart shows the end-to-end process for Microsoft System Center Configuration Manager 2007 Active User Discovery.

Flowchart: Active Directory User Discovery

See Also

Other Resources

Troubleshooting Discovery


Technical Reference for Discovery

In This Section

Frequently Asked Questions for Discovery

A list of frequently asked questions about Microsoft System Center Configuration Manager 2007 discovery.


Frequently Asked Questions for Discovery

Topic last updated—November 2007

What’s the difference between Active Directory System Discovery and Active Directory System Group Discovery?

Active Directory System Discovery retrieves details about the computer, such as computer name, Active Directory container name, IP address, and Active Directory site. It generates a data discovery record (DDR) for each computer it discovers in Active Directory Domain Services.

Active Directory System Group Discovery works only for systems that are already discovered and assigned to the local primary site and any direct child secondary sites. Active Directory System Group Discovery is not available for secondary sites. If a resource has been discovered and is assigned to the site, Active Directory System Group Discovery extends other discovery methods by retrieving details such as organizational unit, global groups, universal groups, and nested groups. Active Directory System Group Discovery cannot discover a computer that has not already been discovered by another method.

How do I discover user groups in Active Directory?

The Active Directory User Discovery method discovers users and the user groups of which they are members.

How can I use Configuration Manager to determine the OU that a computer is a member of?

You need to configure Active Directory System Group Discovery and have it perform a discovery cycle. To force a discovery cycle, in the Active Directory System Group Discovery Properties dialog box, click the Polling tab and then select Run discovery as soon as possible to report the OUs and containers the client is a member of. When this data has been added to the site database, you can create queries and collections using that data. Use the System Container Name or System OU Name attributes from the System Resource class.

See Also

Tasks

Troubleshooting Discovery Issues


Inventory in Configuration Manager

You can use Configuration Manager 2007 to inventory hardware and software on Configuration Manager 2007 clients and to collect files from those clients. You can view inventory for a client in Resource Explorer, and you can query on inventory properties to generate reports or create collections.

Click the associated link in the following section for detailed information about planning, configuring, managing, monitoring, and troubleshooting Configuration Manager 2007 inventory.

In This Section

Overview of Inventory

Planning for Inventory

Configuring Inventory

Tasks for Collecting Inventory

Troubleshooting Inventory

Inventory Security Best Practices and Privacy Information

Technical Reference for Inventory

See Also

Other Resources

Configuration Manager 2007 Features


Overview of Inventory

You can use Configuration Manager 2007 to collect hardware and software inventory from Configuration Manager 2007 clients by enabling the client agents on a site-by-site basis.

When the hardware inventory client agent is enabled for Configuration Manager 2007 sites, hardware inventory data gives you system information (such as available disk space, processor type, and operating system) about each computer. When the software inventory client agent is enabled, you can inventory information such as inventoried file types and versions present on client computers. The software inventory client agent can also collect information about files inventoried on client systems. Configuration Manager 2007 software inventory can also collect files, not just details about the files, from client computers. With file collection, you specify a set of files to be copied from clients to the Configuration Manager 2007 site server that the clients are assigned to.

When enabled, the inventory client inventory agents create an inventory report based on the client inventory information collected and send it to the client's management point. The management point then forwards the inventory information to the Configuration Manager site server, which stores the inventory information in the site database.

You can employ several Configuration Manager 2007 features to use the data collected by using hardware inventory and software inventory. For example:

  • You can build queries that include computers based on their hardware configuration or installed software. The queries are useful to technical analysts and others who want to proactively prevent problems by checking for computers with configuration problems, such as insufficient disk space.
  • You can build collections with queries that include computers based on their hardware configuration or installed software. Those collections can then be used to advertise software packages to computers that require the software and are capable of supporting it.
  • You can produce reports that display useful hardware configuration or installed software details. The reports are useful to managers, systems analysts, and others who need to make decisions based on information about the current computer infrastructure.
  • You can use Resource Explorer to view the complete inventory data for individual computers. This view of individual computers is especially useful when remotely troubleshooting computer problems.

When either the hardware inventory client agent or software inventory client agent inventories a client system, the first inventory report returned will always be a full inventory. Subsequent inventory reports, created according to the inventory schedule set for the inventory agent in the client agent properties, will contain only delta, or changed, inventory information. Delta inventory reports, for both hardware and software inventory, are processed in the order in which they are received by the site server. If a delta inventory report for a client is missing or out of order, it will be rejected by the site server and a full inventory report will be requested the next time the client performs an inventory action.

Configuration Manager 2007 provides limited support for clients that switch between multiple operating systems. Configuration Manager 2007 can discover a client in multiple boot states (for example, when it boots as Microsoft Windows 2000 Professional and when it boots as Windows XP Professional) and install the Configuration Manager 2007 client software on all discovered states. However, inventory that is collected from multiple-boot clients will only reflect the information from the operating system that was running at the time that inventory was taken.

In This Section

About Collecting Hardware Inventory

About Collecting Software Inventory

About File Collection

About Scheduling Inventory

Overview of Asset Intelligence

About Resource Explorer

See Also

Other Resources

Inventory in Configuration Manager


About Collecting Hardware Inventory

When enabled, the Configuration Manager 2007 hardware inventory client agent automatically collects detailed information about the hardware characteristics of clients in a Configuration Manager 2007 site. By using this feature, you can collect a wide variety of information about client computers, such as memory, operating system, and peripherals for client computers.

The hardware inventory feature collects data from client computers by querying several data stores on client computers, such as the registry and Windows Management Instrumentation (WMI) namespace classes. The hardware inventory client agent does not query for all possible WMI classes, but it does provide the ability to report on approximately 1,500 hardware properties from almost 100 different WMI classes by default.

Note
The information queried by the hardware inventory agent can be modified to inventory custom inventory needs for your organization. For more information about modifying the default information collected by the hardware inventory client agent, see How to Extend Hardware Inventory.

The initial client hardware inventory collected by the hardware inventory client agent is a full inventory collection based on the reporting requirements specified in the site's SMS_def.mof file stored on the primary site server. The initial full inventory establishes a baseline for future inventory collections.

Subsequent inventory collections are performed at the schedule specified in the hardware inventory client agent properties. Typically, only information that has changed, or deltas, will be collected from the initial baseline inventory report created during the first full inventory. Delta inventory reporting greatly reduces network traffic generated by client inventory reporting because the delta inventory data is usually only a fraction of a complete inventory collection.

Client hardware inventory information can be queried to build collections. For example, you could create a collection of all computers that have Pentium 4 processors and at least 512 MB of RAM.

With every hardware inventory collection, Configuration Manager 2007 updates the site database with the current inventory information while keeping a history of previous inventory information collected from the client. Both the current and historical hardware inventory information for a client can be viewed using Resource Explorer. For more information about Resource Explorer, see About Resource Explorer.

The hardware inventory client agent also collects some basic information about installed client software. You can collect information about the applications installed on clients and registered in the client's registry. However, by using software inventory, you can collect a significantly larger amount of information about client software.

To enable and configure hardware inventory client agent settings for a site, you use the general tab of the hardware inventory client agent properties. For more information about enabling and configuring the hardware inventory client agent, see How to Configure Hardware Inventory for a Site.

In This Section

About the Hardware Inventory Client Agent

About MOF Files Used by Hardware Inventory

About MIF Files Used by Hardware Inventory

See Also

Concepts

Overview of Inventory


About the Hardware Inventory Client Agent

Hardware inventory is the process of gathering hardware-related information from current clients in a Microsoft System Center Configuration Manager 2007 site. The information gathered includes processor type, network card, amount of memory, and disk information. Configuration Manager 2007 stores this data in the site database, where you can use the information in queries to generate and view reports, or to build hardware-specific collections. For example, you could create a collection of all computers with a specific amount of RAM installed.

Client hardware inventory settings are configured in the Hardware Inventory Client Agent properties in the Configuration Manager console. To extend the default information collected by hardware inventory client agent, you must modify the configuration.mof and sms_def.mof files located on the primary site server computer.

See Also

Tasks

How to Configure Hardware Inventory for a Site

Concepts

How to Extend Hardware Inventory
Overview of Inventory


About MOF Files Used by Hardware Inventory

Configuration Manager 2007 inventories hardware information about clients based on the contents of two Managed Object Format (MOF) files stored on the primary site server in the <ConfigMgr install directory>\inboxes\clifiles.src\hinv directory. The two MOF files used by hardware inventory processes are the Configuration.mof and SMS_def.mof MOF files.

About the Configuration.mof File

The Configuration.mof file is used to define the data classes to be inventoried by the hardware inventory client agent. Data classes can be created to inventory existing or custom WMI repository data classes or registry keys present on client systems.

The Configuration.mof also defines and registers the WMI providers used to access computer information during hardware inventory. Registering providers defines the type of provider to be used and the classes that the provider supports. WMI, and Configuration Manager 2007 hardware inventory can only access registered providers.

Important
The Configuration.mof file cannot be used to register new providers on Configuration Manager 2007 clients. New or custom providers must be manually compiled by clients before attempting to inventory data that relies on the new provider.

When Configuration Manager 2007 clients request computer policies as part of their normal policy polling interval, the Configuration.mof is attached to the policy body downloaded and compiled by clients. When data classes are added, modified, or deleted from the Configuration.mof, clients automatically compile changes made to inventory related data classes the next time the client compiles a requested computer policy. No further action is necessary to inventory new or modified data classes on Configuration Manager 2007 clients.

About the SMS_def.mof File

The SMS_def.mof file defines the reporting classes used by the hardware inventory client agent to determine whether or not specific client data class information is reported. Reporting classes are based on the WMI repository data classes, and attributes of those classes, existing on clients by default or added to them by customizing the Configuration.mof file.

Reporting class information in the SMS_def.mof file is converted into a reporting policy provided to clients during their normal computer policy polling interval. After the client compiles the new reporting policy, the reporting policy information is stored in the client system WMI repository in the InventoryDataItem class of the Root\CCM\Policy\Machine WMI namespace.

Note
Unlike the Configuration.mof file, the SMS_def.mof file is never directly sent to clients. Only the policy generated by the contents of the SMS_def.mof is actually compiled by Configuration Manager 2007 clients.

See Also

Concepts

About Collecting Hardware Inventory
How to Extend Hardware Inventory
About Providers Used in Hardware Inventory


About MIF Files Used by Hardware Inventory

Management Information Format (MIF) files can be used to extend hardware inventory information collected from clients by the Configuration Manager 2007 hardware inventory client agent. During hardware inventory, the information stored in MIF files is added to the client inventory report and stored in the site database, where you can use the data in the same ways that you use default client inventory data. Two MIF files can be used when performing client hardware inventories: NOIDMIF and IDMIF.

By default, NOIDMIF and IDMIF file information is not inventoried by Configuration Manager 2007 sites. To enable NOIDMIF and IDMIF file information to be inventoried, NOIDMIF and IDMIF collection must be enabled. You can choose to enable one or both types of MIF file collection for Configuration Manager 2007 sites on the MIF Collection tab of the hardware inventory client agent properties. For more information about enabling MIF collection for Configuration Manager 2007 sites during hardware inventory, see Hardware Inventory Client Agent Properties: MIF Collection Tab.

Important
Configuration Manager 2007 creates new tables or modifies existing tables in the site database to accommodate the properties in IDMIF and NOIDMIF files. However, IDMIF and NOIDMIF files are not validated, so they could be used to alter tables that you do not want altered. Valid data could be overwritten by invalid data. Large amounts of data could be loaded, causing delays in all Configuration Manager 2007 functions. To mitigate this risk, you should enable IDMIF and NOIDMIF collection only when needed.

NOIDMIF Files

Standard MIF files used in Configuration Manager 2007 hardware inventory are called NOIDMIF files. NOIDMIF files do not contain a unique identifier for the data. Configuration Manager 2007 automatically associates NOIDMIF file data with the client that the NOIDMIF file is collected from when reporting inventory information.

Note
NOIDMIF files themselves are not sent to the site server during a client hardware inventory cycle. The information contained within the NOIDMIF file is collected and added to the client inventory report.

If the classes defined in an inventoried NOIDMIF file do not already exist in the Configuration Manager 2007 site database, new inventory class tables are created in the site database to store the inventoried information. Subsequent inventories will inventory the data stored in the NOIDMIF file and update the existing inventory data for the client in the site database. If the NOIDMIF file is removed from the client, all the classes and properties relating to the NOIDMIF file are deleted from the current inventory information for the client in the site database.

In order for NOIDMIF file information to be inventoried by default, the NOIDMIF file must be stored in the following directory on Configuration Manager 2007 clients:

%Windir%\System32\CCM\Inventory\Noidmifs

IDMIF Files

Custom MIF files, called IDMIF files, can also be used in Configuration Manager 2007 hardware inventory. IDMIF files contain a unique ID and are not associated with the computer they are collected from. IDMIF files can be used to collect inventory data about devices that are not Configuration Manager 2007 clients; for example, a shared network printer, DVD player, photocopier, or similar equipment that is not associated with a client-specific computer.

When IDMIF collection is enabled for a site, IDMIF files are only collected if they are within the size limit specified for custom MIF files defined in the General tab of the hardware inventory client agent properties. For more information about specifying maximum custom MIF file size, see Hardware Inventory Client Agent Properties: General Tab.

Important
Because IDMIF files are not associated with a Configuration Manager 2007 client, they are collected by the hardware inventory client agent and sent to the site server along with the client hardware inventory report. Depending on the maximum custom MIF size specified for the site, IDMIF collection may cause increased network bandwidth usage during client inventories and should be planned for before enabling IDMIF file collection.

IDMIF files are identical to NOIDMIF files, with these exceptions:

  • IDMIF files must have a delta header that provides architecture, and a unique ID. NOIDMIF files are automatically given a similar header by the system during processing on the client.
  • IDMIF files must include a top-level group with the same class as the architecture being added or changed, and that group must include at least one property.
  • Like NOIDMIF files, IDMIF files have key properties that must be unique. Any class that has more than one instance must have at least one key property defined, or subsequent instances overwrite previous instances.
  • Removing IDMIF files from clients does not cause the associated data in the site database to be deleted during subsequent hardware inventories.
  • IDMIF file information is not added to client inventory reports and the files themselves are sent across the network to be processed at the site server.

In order for IDMIF file information to be inventoried by default, the IDMIF file must be stored in the following directory on Configuration Manager 2007 clients:

%Windir%\System32\CCM\Inventory\Idmifs

See Also

Tasks

How to Extend Hardware Inventory Using MIF Files
How to Change the Default MIF Storage Location

Concepts

About Collecting Hardware Inventory


About Collecting Software Inventory

When enabled, the Configuration Manager 2007 software inventory client agent can collect software inventory data directly from files (such as .exe files) by inventorying the file header information. Configuration Manager 2007 can also inventory unknown files — files that do not have detailed information in their file headers. This provides a flexible, easy-to-maintain software inventory method. You can also have Configuration Manager 2007 collect copies of files that you specify. Software inventory and collected file information for a client can be viewed using Resource Explorer. For more information about Resource Explorer, see About Resource Explorer.

While software inventory is capable of inventorying encrypted and compressed files, software inventory may run much slower due to the additional processing required. When encrypted files are inventoried, an un-encrypted copy of the file must be created to inventory. In addition, if antivirus software is running on the client machine, the antivirus software will detect the inventory agent opening the files scanned by software inventory and will rescan them to ensure they are not infected with a virus.

The file collection tab of the software inventory client agent properties is used to enable and configure software inventory client agent settings for a site. For more information about enabling and configuring file collection properties, see How to Configure Software Inventory for a Site.

Note
Software inventory can use considerable network capacity. The amount of network capacity used depends on the number of Configuration Manager clients you have, how frequently you schedule software inventory, and the size of the files you collect (if any). If you expect that software inventory will significantly affect network activity, consider running this process during non-peak hours.

In This Section

About the Software Inventory Client Agent

About Display Names for Inventoried Products

About File Collection

See Also

Concepts

Overview of Inventory


About the Software Inventory Client Agent

Software inventory is the process of gathering software information from client computers in a Microsoft System Center Configuration Manager 2007 site. The information gathered can include data on the operating system, installed programs, and any files you want to inventory or collect. Configuration Manager 2007 stores this data in the site database, where you can use the information in queries to generate and view reports, or to build software-specific collections. For example, you can create a collection of all computers that are running Microsoft Windows® XP and that have Microsoft Office 2003 installed.

To enable and configure software inventory client agent settings for a site, you use the General tab of the software inventory client agent properties. For more information about enabling and configuring the software inventory client agent, see Software Inventory Client Agent Properties: General Tab.

See Also

Tasks

How to Configure Software Inventory for a Site
How to Exclude Files From Software Inventory

Concepts

About Collecting Software Inventory


About Display Names for Inventoried Products

During software inventory, the Microsoft System Center Configuration Manager 2007 software inventory client agent retrieves information from files installed on clients. File information, including the names of the manufacturers that produced the files and the names of the files (or software products) themselves is inventoried. After file data is collected, you can view the software inventory for a client using Resource Explorer. For more information about Resource Explorer, see About Resource Explorer.

Because manufacturer and product names are retrieved from file header information, any inconsistencies in the way these names are entered in the header information will also appear in Resource Explorer and in any query results based on inventoried file display names. Such inconsistencies can make it more difficult to read and query against software inventory information because the data appears under multiple manufacturer or product names rather than under a single name.

To resolve this problem, you can set display names for inventoried products on the inventoried names tab of the software inventory client agent tab. For more information about the inventoried names tab of the software inventory client agent properties, see Software Inventory Client Agent Properties: Inventory Names Tab. For example, you can change variations of a manufacturer name to a single display name as follows:

Change these inventoried names | To this display name
Northwind Traders | Northwind Traders, Inc.
Northwind Traders Inc | Northwind Traders, Inc.
Northwind traders inc | Northwind Traders, Inc.

When you refresh the view of software inventory in Resource Explorer you will see the manufacturer name "Northwind Traders, Inc." instead of the three variations of this name. You will also see this manufacturer name when you run queries.

Note
When you specify a single display name (for example, Northwind Traders, Inc.) to replace several inventoried names, you are not changing the names that appear in the actual header information of files on clients. Instead, the names in the Configuration Manager 2007 site database are changed to the new display name.

See Also

Concepts

About Collecting Software Inventory
How to Set Display Names for Inventoried Products


About File Collection

When a file is specified for collection, the Microsoft System Center Configuration Manager 2007 software inventory agent searches for that file when it runs a software inventory scan on each client in the site. If the software inventory client agent finds a file that should be collected, the file is attached to the inventory file and sent to the site server.

The site server collects the five most recently changed versions of collected files and stores them in the <ConfigMgr installation directory>\Inboxes\Sinv.box\Filecol directory. If a file has not changed since the last software inventory was collected, the file will not be collected again.

Note
Files larger than 20MB are not collected by Configuration Manager 2007 software inventory file collection processes.

The general tab of the software inventory client agent properties is used to enable and configure software inventory client agent settings for a site. For more information about the general tab of the software inventory client agent properties, see Software Inventory Client Agent Properties: File Collection Tab.

See Also

Tasks

How to Collect Files from Clients

Concepts

About Collecting Software Inventory
How to View Files Collected From Clients


About Scheduling Inventory

The hardware and software inventory client agents each collect inventory according to a schedule that is specified in the client agent properties in the Configuration Manager 2007 console for a site.

Note
Because software inventory is more computer resource intensive than hardware inventory, consider scheduling software inventory to recur less frequently than client hardware inventories.

Type | Description
Simple Schedule | An interval between inventory cycles. For example, every 24 hours or every 6 weeks.
Custom Schedule | A start time and an interval for inventory collection. For example, every Sunday or on the first Thursday of every month.

By default, both hardware and software inventory collection schedules are set to run every 7 days. If the client is not running when inventory is scheduled to run, the agent will collect inventory the next time the client is started.

Note
Although the simple schedule allows less flexibility in scheduling inventory, this method usually causes less network traffic than the Custom Schedule option. This is because the time interval between each client's inventory report is based on the time that the Configuration Manager 2007 client was installed, and the first policies were retrieved, for each client. When Custom Schedule is selected, all clients will begin the inventory process at exactly the same time.

When you modify an inventory collection schedule on the site server, Configuration Manager 2007 updates the client computer policies downloaded and compiled by clients according to their normal client policy polling interval. When the client inventory agent detects a schedule change, it generates a delta inventory file. The next inventory occurs according to the new schedule.

Configuration Manager 2007 keeps historical inventory records for the number of days specified for a site in the Delete Aged Inventory History site maintenance task. The default setting is 90 days. Current inventory records are never deleted.

See Also

Concepts

Overview of Inventory

Other Resources

Configuring Inventory


About Resource Explorer

When hardware or software inventory information is collected from Configuration Manager clients, it can be viewed using Resource Explorer. When Resource Explorer is started, a new MMC console opens that displays the information collected from clients by hardware inventory and software inventory. The contents of the Resource Explorer results pane vary based on what node selected in the console tree. Resource Explorer can be used to view client hardware, hardware history, and software inventory information.

If a resource is a Configuration Manager client, and if you are collecting hardware inventory at your site, the information displayed for that resource includes a list of the hardware installed on the client and similar details. If you are collecting software inventory, the information displayed also includes a list of installed software. If a resource is not a Configuration Manager client, no inventory is collected, so there will be no information about that resource in Resource Explorer.

Note
For easier readability of inventory items with many properties, right-click the item in the results pane, and then click Properties to display details about the item in a new dialog box.

See Also

Tasks

How to Start Resource Explorer Using the Configuration Manager Console
How to Start Resource Explorer From the Command Line

Concepts

Overview of Inventory


Planning for Inventory

You should complete the necessary planning required before enabling the hardware and software client agents in the Configuration Manager console. Hardware and software inventory client agents are configured on a sitewide basis.

Hardware Inventory Planning

If hardware inventory is required for clients in a site, the following settings should be considered:

Setting | Reference
Enabling the hardware inventory client agent | How to Configure Hardware Inventory for a Site
Hardware inventory reporting schedule | About Scheduling Inventory
MIF collection settings | About MIF Files Used by Hardware Inventory

For more information about the hardware inventory client agent, see About the Hardware Inventory Client Agent.

Software Inventory Planning

If software inventory is required for clients in a site, the following settings should be considered:

Setting | Reference
Enabling the software inventory client agent | How to Configure Software Inventory for a Site
Software inventory reporting schedule | About Scheduling Inventory
Inventoried product display names | About Display Names for Inventoried Products
Inventory file collection | About File Collection

For more information about the software inventory client agent, see About the Software Inventory Client Agent.

See Also

Concepts

Client Agent Planning Worksheet
Overview of Inventory


Configuring Inventory

You can use the information in this section to help configure Configuration Manager inventory.

In This Section

Inventory Configuration Checklist

How to Configure Hardware Inventory for a Site

How to Configure Software Inventory for a Site

See Also

Concepts

Overview of Inventory


Inventory Configuration Checklist

This checklist outlines the steps you should take when configuring client hardware and software inventory for Configuration Manager 2007 clients after inventory agent planning has been completed.

Step Reference

Review Configuration Manager inventory overview documentation.

Overview of Inventory

Configure the hardware inventory client agent properties. When configuring the hardware inventory client agent properties for the site, you should consider:

  • Scheduling hardware inventories
  • MIF file collection

How to Configure Hardware Inventory for a Site

About Scheduling Inventory

About MIF Files Used by Hardware Inventory

Configure the software inventory client agent properties. When configuring the software inventory client agent properties for the site, you should consider:

  • Scheduling client software inventories
  • File types to inventory on clients
  • Files to be collected from clients

How to Configure Software Inventory for a Site

About Scheduling Inventory

About Display Names for Inventoried Products

About File Collection

See Also

Concepts

Planning for Inventory

Other Resources

Configuring Inventory


How to Configure Hardware Inventory for a Site
Note
You must have Modify permission for the site security object class or instance to perform this procedure.

To configure hardware inventory for a site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. In the results pane, right-click Hardware Inventory Client Agent, and then click Properties.

  3. Use the Hardware Inventory Client Agent Properties dialog box, General tab, to enable and schedule hardware inventory. The General tab is also used to configure the maximum custom MIF (IDMIF) file size that will be processed by the site.

  4. Click the MIF Collection tab, and specify whether you want to collect IDMIF or NOIDMIF files from clients.

See Also

Tasks

How to Start Resource Explorer Using the Configuration Manager Console


How to Configure Software Inventory for a Site
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To configure software inventory for a site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. In the results pane, right-click Software Inventory Client Agent, and then click Properties.

  3. In the Software Inventory Client Agent Properties dialog box, click the General tab, and enable and schedule software inventory.

  4. Click the Inventory Collection tab, specify the file names or file types, and then select the reporting detail for files you want inventoried.

  5. Click the File Collection tab, and specify any files you want to collect from clients.

  6. Click the Inventory Names tab, specify a single, consistent display name that you want to use for a manufacturer or software program, and then specify the inventoried manufacturer or software program names that currently appear in Resource Explorer.

See Also

Tasks

How to Start Resource Explorer Using the Configuration Manager Console

Other Resources

Configuring Inventory


Tasks for Collecting Inventory

You can use the tasks in this section to help perform client inventory tasks.

In This Section

How to Encrypt Client Inventory Reports

How to Set Display Names for Inventoried Products

How to Exclude Files From Software Inventory

How to Collect Files from Clients

How to View Files Collected From Clients

How to Start Resource Explorer Using the Configuration Manager Console

How to Start Resource Explorer From the Command Line

How to Extend Hardware Inventory

How to Change the Default MIF Storage Location

See Also

Other Resources

Inventory in Configuration Manager


How to Encrypt Client Inventory Reports

By default, inventory reports from clients assigned to mixed mode sites are signed, but not encrypted. For further security of inventory report processing in Configuration Manager 2007 sites configured to operate in mixed mode, you can enable encryption of inventory reports sent by clients.

Note
By default, client inventory data is encrypted using SSL for Configuration Manager 2007 sites configured to operate in native mode.

To encrypt client inventory reports

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right click <site code> - <site name> and click Properties.

  3. Click the Site Mode tab.

  4. In the Client settings box, enable the Encrypt data before sending to Management Point check box.

See Also

Other Resources

Tasks for Collecting Inventory


How to Set Display Names for Inventoried Products

During software inventory, manufacturer names and product names are retrieved from the header information of files installed on clients in the site. Because these names are not always standardized in the file header information, when you view software inventory information in Resource Explorer or run queries, different versions of the same manufacturer or product name can sometimes appear.

Use this procedure to identify whether there are variations of a manufacturer or product name, and to change those variations to a single, consistent display name.

Note
You must have Modify permissions for the Site security object class or instance to perform this procedure. Also, you should configure and collect software inventory at least once so that you can view this information in Resource Explorer.

To set display names for inventoried products

  1. In the Configuration Manager console, select a client and start Resource Explorer.

  2. In the left pane of the Resource Explorer console, expand Software, and then expand Product Details.

  3. Under Product Details, review the list of manufacturer names. Note whether there are different versions of the same manufacturer name and whether you want to change these variations to a single, consistent display name.

  4. For each manufacturer, click the manufacturer name to view the inventoried names of files or software products. Note whether there are slightly different versions of the same product name.

  5. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  6. In the results pane, right-click Software Inventory Client Agent, and then click Properties.

  7. In the Software Inventory Client Agent Properties dialog box, click the Inventory Names tab.

  8. Complete the settings in this tab to define the manufacturer and product names to display in software inventory reports or queries. Specify the display names you want to use, and then specify the inventoried names you want to change to the display name. The display names that you specify in this tab will then appear in Resource Explorer instead of the original inventoried names.

    Note
    If a file name contains the % character, it is replaced with a blank space.

See Also

Tasks

How to Start Resource Explorer Using the Configuration Manager Console

Concepts

About Display Names for Inventoried Products

Other Resources

Tasks for Collecting Inventory


How to Exclude Files From Software Inventory

You can create a hidden file named Skpswi.dat and place it in the root of a client hard drive to exclude it from software inventory. You can also place this file in the root of any folder structure you want to exclude from software inventory. This procedure can be used to disable software inventory on a single workstation or server client, such as a large file server.

The Skpswi.dat file only prevents software inventory for computer clients and does not affect mobile device client inventory.

Note
Software inventory will not inventory the client drive again unless this file is deleted from the drive on the client computer.

To exclude files from software inventory

  1. Using Notepad.exe, create an empty file named SkpSwi.dat.

  2. Right click the SkpSwi.dat file and click properties. In the file properties for the SkpSwi.dat file, select the Hidden attribute.

  3. Place the SkpSwi.dat file at the root of each client hard drive that you do not want to collect software inventory from.

See Also

Other Resources

Tasks for Collecting Inventory


How to Collect Files from Clients
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

To collect files from clients

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. In the results pane, right-click Software Inventory Client Agent, and then click Properties.

  3. Right-click Software Inventory Client Agent, and then click Properties.

  4. In the Software Inventory Client Agent Properties dialog box, click the General tab, and enable and schedule software inventory.

  5. Click the File Collection tab, and specify files to be collected from clients during software inventory.

See Also

Concepts

About File Collection
About Scheduling Inventory

Other Resources

Tasks for Collecting Inventory


How to View Files Collected From Clients
Note
You must have Read and View Collected Files permission for the Collection security object class or instance to view files that have been collected from clients in a collection.

To view a file collected from a client

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Expand Collections, and select a collection that contains the client whose collected files you want to view.

  3. In the results pane, right-click the name of the client whose collected files you want to view, point to All Tasks, and then click Start Resource Explorer.

  4. In the left pane, click Software.

  5. Click Collected Files. The list of files collected from the client appears in the results pane.

  6. Right-click a file, point to All Tasks, and then click View File to view the file. Another option is to right-click a file, select All Tasks, and then click Save to save the file in a different location, outside of Configuration Manager 2007, for viewing the file in another application.

See Also

Concepts

About Resource Explorer

Other Resources

Tasks for Collecting Inventory


How to Start Resource Explorer Using the Configuration Manager Console

You can start Resource Explorer to view collected client inventory properties by using the Configuration Manager console or programmatically from the Run dialog box or from the command line.

Note
You must have Read permission for the Collection security object class or instance to use resource explorer to view client inventory information from a collection.

To start Resource Explorer using the Configuration Manager console

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Expand Collections and select the collection that contains the client whose inventory you would like to view.

  3. Right-click the client name, click All Tasks, and then click Start Resource Explorer.

See Also

Tasks

How to Start Resource Explorer From the Command Line

Other Resources

Tasks for Collecting Inventory


How to Start Resource Explorer From the Command Line

You can start Resource Explorer from the Configuration Manager console. Alternatively, you can start it from the command line by specifying one of the following:

  • An explicit resource using the resource identifier
  • A query that returns a resource

When using Resource Explorer from the command line, you might also need to specify a collection that the resource belongs to, for example, if the user does not have appropriate security credentials to access all resources, but has credentials for accessing specific collections.

Using Resource Explorer from the command line is frequently a faster way to view data than using the Configuration Manager console for occasional inventory data review or for accessing client inventory information from a computer that does not have the Configuration Manager 2007 console installed.

To start Resource Explorer by specifying a resource identifier

  1. Click Start and then Run

  2. In the Run dialog box, enter the following command to open Resource Explorer:

    Copy Code
    <console path>\resourceexplorer.msc -s -sms:ResourceID=<n> -sms:Connection=<namespace path>

Comments

When entering the command to start Resource Explorer by specifying a resource identifier:

  • <console path> is the full path to resourceexplorer.msc. If you are starting Resource Explorer from the Run dialog box, you must enter the full path to resourceexplorer.msc:
    <install drive letter>\sms\adminui\bin\resourceexplorer.msc.
  • <n> is the ResourceID of the Configuration Manager client that you want to display inventory for.
  • <namespace path> is the path to the Windows Management Instrumentation (WMI) namespace that contains the client data (\\<site server name>\root\sms\site_<site code>)

Example

The following command displays inventory data for the client associated with ResourceID=1:

Copy Code
c:\sms\adminui\bin\resourceexplorer.msc -s -sms:ResourceID=1 -sms:Connection=\\<site server name>\root\sms\site_<site code>

To start Resource Explorer by specifying computer name

  1. Click Start and then Run

  2. In the Run dialog box, enter the following command to open Resource Explorer:

    Copy Code
    <console path>\resourceexplorer.msc -s -sms:ResExplrQuery="SELECT ResourceID FROM SMS_R_SYSTEM WHERE Name = "<computer name>" -sms:Connection=<namespace path>
    Note
    Your query might return more than one instance, but Resource Explorer only displays the first instance that is returned.

Comments

When entering the command to start Resource Explorer by specifying a computer name:

  • <console path> is the full path to resourceexplorer.msc. If you are starting Resource Explorer from the Run dialog box, you must enter the full path to resourceexplorer.msc:
    <install drive letter>\sms\adminui\bin\resourceexplorer.msc.
  • <computer name> is the name of the computer Resource Explorer will attempt to display inventory data for.
  • <namespace path> is the path to the Windows Management Instrumentation (WMI) namespace that contains the client data (\\<site server name>\root\sms\site_<site code>)

Example

The following command displays inventory data for the client named MyComputer:

Copy Code
c:\sms\adminui\bin\resourceexplorer.msc -s -sms:ResExplrQuery="Select ResourceID FROM SMS_R_System WHERE Name = "MyComputer" -sms:connection=\\<site server name>\root\sms\site_<site code>

To start Resource Explorer by specifying a resource in a specific collection

  1. Click Start and then Run

  2. In the Run dialog box, enter the following command to open Resource Explorer:

    Copy Code
    <console path>\resourceexplorer.msc -s -sms:CollectionID=<Collection ID> -sms:ResExplrQuery=<WQL Query> -sms:Connection=<namespace path>

Comments

When entering the command to start Resource Explorer by specifying a resource in a specific Collection:

  • <console path> is the full path to resourceexplorer.msc. If you are starting Resource Explorer from the Run dialog box, you must enter the full path to resourceexplorer.msc:
    <install drive letter>\sms\adminui\bin\resourceexplorer.msc.
  • <Collection ID> is the CollectionID of the Configuration Manager collection that the resource is a member of. This option may be necessary for administrators who do not have permissions to query the All Systems collection.
  • <WQL Query> is a valid WQL query that will determine the ResourceID for a resource, located within the specified collection, that you want to display inventory data for.
  • <namespace path> is the path to the Windows Management Instrumentation (WMI) namespace that contains the client data (\\<site server name>\root\sms\site_<site code>)

Example

The following command displays inventory data for the client named MyComputer located in the custom Tier 2 Admin collection:

Copy Code
c:\sms\adminui\bin\resourceexplorer.msc -s -sms:CollectionID=<Tier 2 Admin collection's Collection ID> -sms:ResExplrQuery "Select ResourceID FROM SMS_R_System WHERE Name = "MyComputer"-sms:Connection=\\<site server name>\root\sms\site_<site code>

See Also

Other Resources

Tasks for Collecting Inventory


How to Extend Hardware Inventory

Although Configuration Manager 2007 can automatically inventory computer hardware information from clients by simply enabling the hardware inventory client agent, additional information that is not reported by default can be collected by extending hardware inventory.

Hardware inventory can be extended by inventorying additional WMI classes, additional WMI class attributes, registry keys, and other customizations to accommodate your organization's requirements. Hardware inventory can also be modified to reduce the amount of information reported by clients during hardware inventory. For example, you may want to inventory default or custom WMI data class information or registry keys not inventoried by default or reduce the amount of information that is reported by default hardware inventory.

In This Section

You can customize the hardware inventory information that is collected from Configuration Manager clients in the following ways.

How to Extend Hardware Inventory Using the Configuration.mof File

The Configuration.mof file is used to add new data class information to clients for hardware inventory reporting.

How to Extend Hardware Inventory Using the SMS_def.mof File

The SMS_def.mof file is used to modify or add new reporting class information for client hardware inventory reporting.

How to Extend Hardware Inventory Using MIF Files

Use IDMIF or NOIDMIF files to add additional inventory information for client hardware inventory reporting.

External Resources

"Start to Finish Guide to MOF Editing" at: http://go.microsoft.com/fwlink/?LinkId=91463.

See Also

Concepts

About MOF Files Used by Hardware Inventory
About MIF Files Used by Hardware Inventory
About Providers Used in Hardware Inventory


How to Extend Hardware Inventory Using the Configuration.mof File

The Configuration.mof file is used to modify data class information inventoried by clients during hardware inventory.

You can use Notepad to modify the Configuration.mof file.

To extend hardware inventory using the Configuration.mof file

  1. On the primary site server computer, navigate to <ConfigMgr installation directory>\inboxes\clifiles.src\hinv directory.

  2. Using Notepad.exe, open the Configuration.mof file and make any necessary changes.

  3. Close the Configuration.mof file and save changes.

See Also

Concepts

How to Extend Hardware Inventory


How to Extend Hardware Inventory Using the SMS_def.mof File

The SMS_def.mof file is used to modify reporting class information inventoried by clients during hardware inventory. The SMS_def.mof file consists of a list of classes and attributes that relate to data classes stored in the WMI repository of Configuration Manager 2007 clients.

Classes and properties that have the reporting qualifier set to TRUE are collected and those set to FALSE are not. However, there is an exception: if a class is set to TRUE then any class properties with the key attribute are collected, even if the individual property is set to FALSE.

You can use Notepad.exe to modify the SMS_def.mof file. If there are properties or classes that you no longer want to collect, set them to FALSE. If you want to inventory new classes or properties, set them to TRUE.

Important
Be careful when modifying the SMS_def.mof file. It was not designed to be executed with all or most of the class reporting qualifiers set to TRUE. The size of the inventory report file can affect the performance of your network. If you modify the file, first verify the size of a typical client's complete hardware inventory and make sure it is acceptable for your networking environment. Then, test the new file in a test lab before replacing the default SMS_def.mof on the primary site server.

To extend hardware inventory using the SMS_def.mof file

  1. On the primary site server computer, navigate to <ConfigMgr installation directory>\inboxes\clifiles.src\hinv directory.

  2. Using Notepad.exe, open the SMS_def.mof file and make any necessary changes.

  3. Close the SMS_def.mof file and save changes.

See Also

Concepts

How to Extend Hardware Inventory


How to Extend Hardware Inventory Using MIF Files

The IDMIF and NOIDMIF collection can be used to extend Configuration Manager 2007 client inventory information reported by clients. NOIDMIF files extend the hardware inventory information for existing Configuration Manager 2007 clients. IDMIF files are used to add information to the site database for devices and objects that are not Configuration Manager 2007 clients.

Important
Configuration Manager 2007 creates new tables or modifies existing tables in the site database to accommodate the properties in IDMIF and NOIDMIF files. However, IDMIF and NOIDMIF files are not validated, so they could be used to alter tables that you do not want altered. Valid data could be overwritten by invalid data. Large amounts of data could be loaded, causing delays in all Configuration Manager 2007 functions. To mitigate this risk, you should enable IDMIF and NOIDMIF collection only when needed.

Using NOIDMIF Files to Extend Hardware Inventory

NOIDMIF files are used to add additional data to information stored in the site database for Configuration Manager 2007 clients during hardware inventory.

To extend hardware inventory collected from clients using a NOIDMIF file

  1. Using a text editor such as Notepad.exe, create a NOIDMIF file containing the data that will be added to the client hardware inventory information reported during hardware inventory, and save it with a .MIF file name extension.

  2. Place the NOIDMIF file in the %Windir%\System32\CCM\inventory\noidmifs directory on a Configuration Manager 2007 client.

  3. When the client performs its next scheduled hardware inventory, the information stored in the NOIDMIF file will be added to the client inventory report sent to the site server for processing.

Using IDMIF Files to Extend Hardware Inventory

IDMIF files are used to add nonclient information to the site database during client hardware inventory.

Important
Because IDMIF files are not associated with a Configuration Manager 2007 client, they are collected by the hardware inventory client agent and sent to the site server along with the client hardware inventory report. Depending on the maximum custom MIF size specified for the site, IDMIF collection may cause increased network bandwidth usage during client inventories and should be planned for before enabling IDMIF file collection.

To extend hardware inventory collected from clients using an IDMIF file

  1. Using a text editor such as Notepad.exe, create an IDMIF file containing the data that will be added to the site database during hardware inventory, and save it with a .MIF file name extension.

  2. Place the IDMIF file in the %Windir%\System32\CCM\inventory\idmifs directory on a Configuration Manager 2007 client.

  3. When the client performs its next scheduled hardware inventory, the IDMIF file will be copied, and the copy will be sent to the site server's inventory processing inbox for processing.

See Also

Concepts

About MIF Files Used by Hardware Inventory
How to Extend Hardware Inventory


How to Change the Default MIF Storage Location

In order for a MIF file to be collected by hardware inventory, it must be located in the correct location on the client system. By default, the files should be located in the following directories:

  • IDMIF files should be located in %windir%\System32\CCM\Inventory\idmif.
  • NOIDMIF files should be located in %windir%\System32\CCM\Inventory\noidmif.

The MIF storage location can be changed after the client is installed by modifying the registry keys for IDMIF and NOIDMIF files, respectively.

To change the default storage location for IDMIF files

  1. Click Start, click Run, type regedit, and then press ENTER to start the registry editor.

  2. Navigate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Client\Configuration\Client Properties\IDMIF Directory

  3. Enter a new path.

  4. Exit the registry editor.

To change the default storage location for NOIDMIF files

  1. Click Start, click Run, type regedit, and then press ENTER to start the registry editor.

  2. Navigate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Client\Configuration\Client Properties\NOIDMIF Directory

  3. Enter a new path.

  4. Exit the registry editor.

See Also

Other Resources

Tasks for Collecting Inventory


Troubleshooting Inventory

The information in this section can be used to help troubleshoot Configuration Manager inventory.

In This Section

Running Software Inventory When Disk Space Is Low

Attempting to Inventory Non-Existent Data Classes

Inventorying Data Strings Longer than 254 Characters

Troubleshooting Inventory Using Custom Error Codes

See Also

Concepts

Overview of Inventory


Running Software Inventory When Disk Space Is Low

When the software inventory agent begins an inventory cycle on a client, it first determines whether enough resources are available on the client for it to complete the inventory successfully. If resources are limited, the agent might skip file collection or not run at all. If the agent does not run, it will attempt to run within 24 hours from the current time.

The client must have the following minimum resources for the software inventory agent to successfully complete an inventory cycle:

  • 3 MB of free virtual memory
  • 500 KB of free disk space
  • Hard disk storage capacity of 210 percent of all the files that are to be collected. (The agent makes a copy of each file it collects.)

See Also

Concepts

Troubleshooting Inventory


Attempting to Inventory Non-Existent Data Classes

When performing hardware inventory, the hardware inventory client agent retrieves information about installed computer hardware by reading Windows Management Instrumentation (WMI) data classes. In some cases, WMI data classes to be inventoried may not be present on a client system. For example, Windows Vista clients have new WMI data classes that Windows XP clients do not, but the class information is set to be inventoried in the default Configuration Manager 2007 SMS_def.mof file.

When a client attempts to inventory a nonexistent data class, no status message is sent to the site server. To determine whether a client is attempting to inventory a nonexistent WMI data class, you can review the client InventoryAgent.log log file for entries similar to the following:

Collection: Class "<Class Name>" does not exist

See Also

Concepts

Troubleshooting Inventory


Inventorying Data Strings Longer than 254 Characters

When performing hardware inventory, if a property of a data class contains a string value greater than 254 characters, the inventory information for that property will not be processed or stored in the site database. For example, if you attempt to inventory the Win32_NTEventLogFile data class and one of the event log string entries is longer than 254 characters, the inventoried data for that property will be rejected by the management point when the client inventory report is processed.

When this situation occurs, you may see entries in the MP_Hinv.log log file similar to the following message when the client inventory report is processed:

Hinv: warning skipping instance of array property as exceeds max length. Class: "<data class name>" Property: "<data class property>"

See Also

Concepts

Troubleshooting Inventory


Client Access License Data Collection Error Handling

When collecting Client Access License data, it is possible that errors can occur. Some of these error conditions are detectable, and have been assigned error messages. However, there are some reasons that CAL data cannot be gathered from some servers. Furthermore, some specific conditions may result in predictable count miscalculations.

Error Messages

The following list describes the known issues that may prevent CAL data collection from individual servers. These messages are found in the Application Log on the individual servers running the Configuration Manager client. It is recommended that an aggregation tool, such as Microsoft System Center Operations Manager, be used to gather these logs for easier viewing.

Error Message | Reason
Security log cannot be accessed. No information about users or device connections will be provided. | Access to the NT Log has been denied.
Security log wrap is found. Some unique users or device connections may not be reported. | The NT Log has wrapped.
Value of configuration variable XXX is invalid. For more information, refer to SCCM documentation. | The MOF is improperly configured.
AUDIT_SUCCESS local security policy is not enabled. Client Access License (CAL) information will not be collected. | The “AUDIT_SUCCESS” Audit Policy is not set. For more information, see the Tech Net Security Center (http://go.microsoft.com/fwlink/?LinkId=74458) and search for "audit success".
Device Client Access License (CAL) information is not collected on Windows 2000 Servers. No action is needed. | Device CAL collection on Windows 2000 Servers is not supported.
Client Access License (CAL) information is collected only on computers running Windows Server Operating Systems. CAL information will not be collected on this machine. | CAL information is not collected on non-server operating systems.
Internal error. Client Access License (CAL) collector returns HRESULT=xxx. Please contact Microsoft Support. | This generic message is logged when the collection code returns an error other than those errors in this list.

Reasons CAL Data Cannot Be Collected

In addition to situations that present error messages, it is possible that CAL data will not be collected on some servers and no error messages will be written to the Application logs on those servers. Some known reasons are:

  • The server site code is different than the current site code
  • The server does not have the Configuration Manager client installed
  • The Asset Intelligence data collection cycle has not yet inventoried the server

Miscalculations in Device CAL inventory

Because device CAL data collection depends on IP addresses to identify devices, there are a few situations that will result in miscalculation of device CAL counts. These situations are as follows:

  • A computer that has more than one Network Interface Card (NIC) will be counted as using one device CAL for each IP address. This can potentially result in an increased CAL count.
  • A computer that has changed IP addresses can be counted as using one device CAL for each IP address. This can potentially result in an increased CAL count.
  • When a computer has been assigned an IP that was previously assigned to another computer, the two computers may be counted as using a single CAL. This can potentially result in a decreased CAL count.
  • Multiple computers that access servers using a single IP address because of NAT translation will be counted as a single CAL. This can potentially result in a decreased CAL count.
  • In general, any situation that increases or decreases the number of IP addresses associated with one or more computers will influence the count of CALs represented in the CAL usage reports.


Troubleshooting Inventory Using Custom Error Codes

The table lists error code, possible problem and possible solution for Inventory custom error codes.

Inventory Custom Error Codes

Error Code | Possible Problem | Possible Solution
0x80040900 | A valid WMI instance inventoried could not be added to the report. The __Path property may be undefined. | Rebuild the WMI database

See Also

Concepts

Troubleshooting Inventory
Custom Error Codes for Configuration Manager 2007


Modifying the Default Configuration Manager SMS_def.mof File Before Upgrading

Topic last updated—November 2007

When upgrading SMS 2003 sites to customizations made to the existing SMS 2003 SMS_def.mof hardware inventory reporting file are not maintained and will be overwritten by the default Configuration Manager 2007 hardware inventory SMS_def.mof reporting file during the site upgrade process.

When upgrading SMS 2003 sites using a customized SMS_def.mof hardware inventory reporting file, the customized file should be backed up and the customizations added to the appropriate Configuration Manager 2007 hardware inventory reporting file after the upgrade has completed.

Modifying the Default SMS_def.mof That Shipped with the Configuration Manager Installation Media Might Cause Upgrades to Fail

If the default SMS_def.mof file that shipped with the Configuration Manager 2007 installation media is modified before upgrading a Systems Management Server (SMS) 2003 site, errors similar to the following example might occur when the SMS_def.mof is compiled on the site server during the upgrade process:

error SYNTAX 0X80044007: Illegal constant value. (Numeric value out of range or strings without quotes)

During a site upgrade, depending on the state of the current installation, the Configuration Manager 2007 Setup program modifies the default SMS_def.mof. If the default SMS_def.mof file that shipped with the installation media has been modified, Setup might not be able to properly update the SMS_def.mof and the upgrade might fail.

Solution

Do not modify the default Configuration.mof or SMS_def.mof files that shipped with the Configuration Manager 2007 installation source files before upgrading an SMS 2003 site.

See Also

Concepts

Troubleshooting Inventory
About MOF Files Used by Hardware Inventory


Inventory Security Best Practices and Privacy Information

Collecting inventory exposes potential vulnerabilities. Attackers can:

  • Send invalid data.
  • Send excessively large amounts of data.
  • Access inventory information as it is transferred to the site systems.

Inventory attacks are usually considered less serious than attacks that could force unauthorized software distribution because the inventory information can be available through other means.

Best Practices for Inventory

Enable inventory encryption In Microsoft System Center Configuration Manager 2007 native mode, client communications with the management point are encrypted with SSL. In mixed mode, by default, client inventory reports and collected files sent to management points are signed, but not encrypted. For more information about encrypting inventory reports sent to management points, see How to Encrypt Client Inventory Reports.

Disable IDMIF and NOIDMIF collection in high security environments The IDMIF and NOIDMIF collection can be used to extend hardware inventory collection. When necessary, Configuration Manager 2007 creates new tables or modifies existing tables in the site database to accommodate the properties in IDMIF and NOIDMIF files. However, IDMIF and NOIDMIF files are not validated, so they could be used to alter tables that you do not want altered. Valid data could be overwritten by invalid data. Large amounts of data could be loaded, causing delays in all Configuration Manager 2007 functions. To mitigate this risk, you can disable the IDMIF and NOIDMIF collection on the Hardware Inventory Client Agent properties.

Note
Extending hardware inventory collection by using SMS_def.mof extensions does not have the same security issues. All SMS_def.mof extensions must be made on the server side, which requires administrative rights.

Do not use file collection to collect critical files or sensitive information Configuration Manager 2007 collections inventory using all the rights of the LocalSystem account, which has the ability to collect copies of critical system files, such as the registry or security account database. When these files are available at the site server, someone with the Read Resource rights or NTFS rights to the stored file location could analyze their contents and possibly discern important details about the client in order to be able to compromise its security.

Privacy Information

Hardware inventory allows you to retrieve any information that is stored in WMI on your Configuration Manager 2007 clients. Software inventory allows you to discover all files of a specified type or to collect any specified files from clients. Asset Intelligence enhances the inventory capabilities by extending hardware and software inventory and adding new license management functionality.

Hardware inventory is on by default and the WMI information collected is determined by the SMS_def.mof file. You can modify the .mof file to collect more or less information. Software inventory and file collection are off by default. Asset Intelligence Data Collection is not enabled by default on new installations, but if it was previously enabled for a SMS 2003 SP3, then it is still enabled after upgrade.

Inventory information is not sent back to Microsoft. Inventory information is stored in the site database. In native mode, inventory is encrypted during transfer to the management point. In native mode, you have the option to enable inventory encryption. Data is not stored in encrypted form in the database in either mode. Information is retained in the database until deleted by the site maintenance tasks Delete Aged Inventory History or Delete Aged Collected Files every 90 days. You can configure the deletion interval.

Before configuring hardware inventory, software inventory, file collection, or Asset Intelligence data collection, consider your privacy requirements.

See Also

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features
Inventory in Configuration Manager


Technical Reference for Inventory

This section contains technical reference information about Configuration Manager 2007 inventory.

In This Section

About Providers Used in Hardware Inventory

Describes the providers used by Configuration Manager 2007 hardware inventory.

See Also

Concepts

Overview of Inventory


About Providers Used in Hardware Inventory

When extending hardware inventory to be collected from Configuration Manager 2007 clients, the Configuration.mof file is modified to inventory computer client information leveraging a registered inventory data provider.

Note
Providers used during Configuration Manager 2007 client hardware inventory are listed at the top of the Configuration.mof file and are registered on clients when they receive the first computer policy and compile the Configuration.mof file, as part of normal computer policy, for the first time.

Providers Used in Hardware Inventory

The following table lists the types of providers registered and used by default in Configuration Manager 2007 hardware inventory.

Provider | How Used
WMI Data Provider | Used to inventory existing client WMI data class information.
Registry Property Provider | This provider is used to collect information from specific registry keys.
Registry Instance Provider | This provider is used to collect information from multiple registry keys according to a specific condition. The best use for the Registry Instance Provider is for inventorying various subkeys under one main registry key that all have similar data values that you want to inventory without creating more than one reporting class.
View Provider | This provider can be used to join multiple data classes into one class or perform simple WQL queries for inventory reporting.
Asset Intelligence Provider | This provider is used to query specific Asset Intelligence inventory information.

See Also

Concepts

How to Extend Hardware Inventory
Technical Reference for Inventory


Remote Tools in Configuration Manager

Configuration Manager 2007 remote tools allow you to remotely access and operate client computers in the Configuration Manager 2007 site which have the remote tools client agent components installed. Click the associated link in the following section for detailed information about configuring, managing and using Configuration Manager 2007 remote tools.

In This Section

Overview of Remote Tools

Provides an overview of the remote tools feature.

Configuring Remote Tools

Provides tasks to configure remote tools in the environment.

Tasks for Remote Tools

Provides the configuration checklist and tasks to configure software updates in the environment.

Remote Tools Security Best Practices and Privacy Information

Provides troubleshooting information for remote tools.

Troubleshooting Remote Tools Using Custom Error Codes

Provides a list of custom error codes, possible problems and possible solutions.

See Also

Other Resources

Configuration Manager 2007 Features


Overview of Remote Tools

The Remote Tools feature in Configuration Manager 2007 allows permitted viewers to access any client computer in the Configuration Manager 2007 site that has the remote tools client agent components installed.

Remote Control is a sub-feature of the remote tools application. You can use remote control to view or operate a computer anywhere in the Configuration Manager 2007 site hierarchy. You can use remote control to troubleshoot hardware and software configuration problems on remote client computers and to provide remote help desk support when access to the user's computer is necessary.

Configuration Manager 2007 supports remote control of both Workgroup computers and computers joined to a domain.

In order to remote control a client computer, the Configuration Manager 2007 administrator must be added to the Permitted viewers list in the Security tab of the Remote Tools Client Agent Properties dialog box.

To use remote tools, the option Enable Remote Tools on clients must be selected in the Remote Tools Client Agent Properties dialog box.

The Configuration Manager remote tools client agent is based upon the collaboration technology developed for Windows Vista which utilizes the RDP protocol.

To maintain consistency with the Configuration Manager remote tools client agent, some of the Windows 2000 remote tools have been removed. For more information see, What's New in Remote Tools for Configuration Manager

Both the Configuration Manager and Windows 2000 remote tools are started in the same way from the Configuration Manager 2007 administrator console.

You can use the Configuration Manager 2007 Remote Tools Client Agent Properties dialog box to override user configured settings for Remote Desktop and Remote Assistance if you prefer to use these methods of remote administration.

In This Section

Click any of the following links for more information:

About the Windows 2000 Remote Control Client Viewer

About the Configuration Manager Remote Control Client Viewer


About the Windows 2000 Remote Control Client Viewer

When you initiate a remote control session on a Windows 2000 client computer, the Remote Control Client Viewer window appears. You can use this window to view and perform work on the client computer.

When the Remote Control Client Viewer window is active, all mouse actions and keystrokes on the computer running the Configuration Manager console are passed to the selected client computer, except for the following key sequences:

  • CTRL+ALT+DELETE
  • CTRL+ESC
  • ALT+TAB
  • ALT+KEY
Important
If you are initiating a remote control session with a computer running Windows 2000 the computer must not be running Virtual Machine Additions or you will not be able to control the mouse.

In addition, the start key and the application key on the Configuration Manager console computer (if present) do not pass output to the client computer remote control session.

To allow these key sequences to be passed to client computers, the Remote Control Client Viewer window has a set of icons in the upper right hand corner which can be used to pass various commands through to the client computer and also to see a magnified view of a selected portion of the Remote Control Client Viewer window.

The following commands are available:

display task list icon | Simulates clicking the Start button on the client computer.
ALT TAB icon | Simulates the ALT+TAB key sequence on the client computer.
CTRL ALT DEL icon | Simulates the CTRL+ALT+DELETE key sequence on the client computer.
toggle alt key icon | Allows ALT+KEY sequences to be passed to the client computer.
positions display icon | Opens the Area dialog box which you can use to navigate around the remote control window when its area exceeds the area shown in the Remote Control Client Viewer window.

The Configuration Manager console computer inherits the keyboard settings of the selected client computer when the Remote Control Client Viewer window is active. For example, if the selected client computer keyboard has caps lock on, then the Configuration Manager console keyboard will send keystrokes to the client computer with caps lock on.

While a client computer is being controlled, the client computer's keyboard and mouse remain active. Both the administrator using the Remote Control tool and the user at the client see all keystrokes entered from either keyboard. It is possible for both the Configuration Manager 2007 administrator and the user at the client computer to both enter commands simultaneously which could result in an incorrect command being entered. It is therefore important for the Configuration Manager 2007 administrator to communicate with the user at the client computer before the remote control session takes place.

Note
If you are remotely controlling a client and a maximized MS-DOS window appears in the Remote Control Client Viewer window, mouse controls do not function. To restore mouse controls, press ALT+ENTER to reduce the size of the MS-DOS window.

The graphics display settings of the computer running the Configuration Manager console affects how the remote client computer is displayed in the Remote Control Client Viewer window. If the computer running the Configuration Manager console has at least the same resolution as the client computer, the remote client computer screen is displayed in the same resolution as the computer running the Configuration Manager console.

If you view the selected client computer display in a sized window, or if the client has a higher resolution video display, the Remote Control Client Viewer window cannot display the client computer's entire desktop. To move the display within the Remote Control Client Viewer window, use the window's scroll bars or use the navigation window.

See Also

Concepts

Overview of Remote Tools


About the Configuration Manager Remote Control Client Viewer

When you initiate a remote control session on a client computer running Windows XP or later, the Configuration Manager Remote Control window appears. You can use this window to view and perform work on the client computer.

When the Configuration Manager Remote Control Window is active, all mouse actions and keystrokes on the computer running the Configuration Manager console are passed to the selected client computer, except for the following key sequences:

  • CTRL+ALT+DELETE
  • CTRL+ESC
  • ALT+TAB
  • ALT+KEY

In addition, the start key and the application key on the Configuration Manager console computer (if present) do not pass output to the client computer remote control session.

Note
It is not possible to send a CTRL+ALT+DELETE command from the Configuration Manager Remote Control window to the client computer being remotely administered. If you need to do this, you should connect to the client computer using Remote Desktop.

For more information about keyboard shortcuts that are available in Windows XP use the following link: http://go.microsoft.com/fwlink/?LinkId=91229

While a client computer is being controlled, the client computer's keyboard and mouse remain active. Both the administrator using the Remote Control tool and the user at the client see all keystrokes entered from either keyboard. It is possible for both the Configuration Manager 2007 administrator and the user at the client computer to both enter commands simultaneously which could result in an incorrect command being entered. It is therefore important for the Configuration Manager 2007 administrator to communicate with the user at the client computer before the remote control session takes place.

If you view the selected client computer display in a sized window, or if the client computer has a higher resolution video display, the Configuration Manager Remote Control window may not be able to display the client computer's entire desktop. To move the display within the Configuration Manager Remote Control window, use the window's scroll bars. You can also use the Full Screen and Scale to Fit commands from the View menu of the Configuration Manager Remote Tools window to adjust the screen resolution to fit the administrator's screen.

See Also

Concepts

Overview of Remote Tools


Configuring Remote Tools

To configure a site for remote tools, you may need to perform certain tasks.

Click any link in the following section for information about configuring your Configuration Manager 2007 site for using Configuration Manager 2007 remote tools.

In This Section

How to Configure the Configuration Manager 2007 Remote Tools Client Agent

Contains information about configuring the Configuration Manager 2007 remote client agent. The remote tools client agent must be configured before you can use remote tools in Configuration Manager 2007

See Also

Concepts

Remote Tools in Configuration Manager


How to Configure the Configuration Manager 2007 Remote Tools Client Agent

In order to use Configuration Manager 2007 remote tools, you must first configure options for the remote tools client agent.

To configure the Configuration Manager Remote Tools Client Agent:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Settings / Client Agents.

  2. Right-click Remote Tools Client Agent, and then click Properties.

  3. In the Remote Tools Client Agent Properties dialog box, specify the following values in the General tab:

    • Enable Remote Tools on clients - Enable this option.
    • Users cannot change policy or notification settings in the Remote Control Control Panel Enable this option if you do not want users on client computers to be able to change remote control settings from the client computer's control panel.
    • Ask for permission when an administrator tries to access clients If this option is enabled, you will not be able to remotely control a client computer until the user gives permission.
    • Clients running Windows 2000 Level of access allowed: Specify the level of remote access the Configuration Manager 2007 administrator will be given when using remote control on Windows 2000 client computers. Choose from No Access and Full Control.
    • Clients running Windows XP or later Level of access allowed: Specify the level of remote access the Configuration Manager 2007 administrator will be given when using remote control on Windows XP or later client computers. Choose from No Access, View Only and Full Control.
    • Click the Security tab.

  4. In the Remote Tools Client Agent Properties dialog box, specify the following values in the Security tab:

    • Click the new permitted viewer button New Icon.
    • In the New Permitted Viewer dialog box, enter a Windows user name or Windows group to receive permission to use Configuration Manager 2007 remote control.
    • Click OK.
    • Click the Notification tab.

  5. In the Remote Tools Client Agent Properties dialog box, specify the following values in the Notification tab:

    • Display a visual indicator Enable this option if you would like the user of the client computer being remote controlled to see a visual indicator that a remote control session is active. If selected, the indicator can be shown on the desktop or on the Windows taskbar.
    • Play a sound Enable this option if you would like the user of the client computer being remote controlled to hear a sound to indicate that a remote control session is active. If selected, the sound can be played at the beginning and end of the remote control session or continuously throughout the session.
    • Click the Remote Assistance tab.

  6. In the Remote Tools Client Agent Properties dialog box, specify the following values in the Remote Assistance tab:

    • Manage Remote Assistance settings Specify whether to allow Configuration Manager 2007 to manage remote assistance for solicited and unsolicited sessions.
    • Remote Assistance settings Level of access allowed: Specify the level of access allowed for remote assistance sessions. Choose from None, Remote Viewing and Full Control.
    • Click the Remote Desktop tab.

  7. In the Remote Tools Client Agent Properties dialog box, specify the following values in the Remote Desktop tab:

    • Configure Remote Desktop settings Specify whether to allow Configuration Manager 2007 to manager remote desktop settings.
    • Allow permitted viewers to connect using remote desktop session Specify whether to allow Windows users and groups in the Permitted Viewers list to initiate remote desktop connections from the Configuration Manager console.
    • Disable Remote Desktop Connection Disables the ability to initiate remote desktop connections from the Configuration Manager console.

  8. Click OK to close the Remote Tools Client Agent Properties dialog box.

See Also

Concepts

Configuring Remote Tools


Tasks for Remote Tools

Click any link in the following section for information about remote tools tasks.

In This Section

How to Audit Remote Control Usage

Contains information about auditing Configuration Manager 2007 remote control usage.

How to Remotely Administer a Client Computer

Contains information about using Configuration Manager 2007 remote control.

How to Modify the Remote Tools Permitted Viewer Accounts

Contains information about modifying remote tools accounts.

How to Use Configuration Manager Remote Control from the Command Line

Contains information about using remote control using the command line.

See Also

Concepts

Remote Tools in Configuration Manager


How to Audit Remote Control Usage

You can use Configuration Manager 2007 reports to view audit information for the remote tools feature. Two reports are available:

  • Remote Control - All computers remote controlled by a specific user
  • Remote Control - All remote control information

To run the report Remote Control - All computers remote controlled by a specific user:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports in the category Status Messages - Audit.

  3. Right-click the report Remote Control - All computers remote controlled by a specific user, and click Run.

  4. In the Report Information page enter the Windows user name you wish to report on, in the form DOMAIN\Username.

  5. Click Display to view the report. A list of client computers that have been remote controlled by the specified user will be displayed, together with the time when the client computer was remote controlled and the computer that the specified user initiated the remote control session from.

  6. Close the report.

To run the report Remote Control - All remote control information:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports in the category Status Messages - Audit.

  3. Right-click the report Remote Control - All remote control information, and click Run.

  4. Click Display to view the report. A list of client computers that have been remote controlled will be displayed, together with the time when the client computer was remote controlled, the user who initiated the remote control session and the computer that the specified user initiated the remote control session from.

  5. Close the report.

See Also

Concepts

Tasks for Remote Tools


How to Remotely Administer a Client Computer

The procedure for remotely administering client computers in Configuration Manager 2007 differs slightly depending on the operating system of the client computer being administered. Windows 2000 client computers continue to use the same remote tools as those found in SMS 2003.

Note
The user account under which the Configuration Manager administrator is logged in must be added to the Permitted Viewers list for the Remote Tools Client Agent in order to remotely administer client computers.

Remotely Administer a Windows XP or later Client Computer

To remotely administer a Windows XP or later client computer:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Select a collection containing the client you wish to remotely administer.

  3. Right-click the client computer you wish to remotely administer, click Start and then click Remote Tools.

  4. The Configuration Manager Remote Control window will open containing a view onto the screen of the selected client computer.

  5. When you are finished with the remote control session, close the Configuration Manager 2007 Remote Control window.

Remotely Administer a Windows 2000 Client Computer

To remotely administer a Windows 2000 client computer:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Select a collection containing the client you wish to remotely administer.

  3. Right-click the client computer you wish to remotely administer, click Start and then click Remote Tools.

  4. In the Remote Tools window, click the Remote Control button to start the session.

  5. The Remote Control window will open containing a view onto the screen of the selected client computer.

  6. When you are finished with the remote control session, close the Remote Control and Remote Tools windows.

See Also

Concepts

Tasks for Remote Tools


How to Modify the Remote Tools Permitted Viewer Accounts

Local administrator rights are not required for a user to be able to use Microsoft System Center Configuration Manager 2007 Remote Tools. If a Remote Tools user is on the Permitted Viewers list and has the Use remote tools right for the collection, the user can use Remote Tools on the client.

To specify a new remote tools permitted viewer account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site server name> / Site Settings / Client Agents.

  2. In the results pane, right-click Remote Tools Client Agent and then click Properties.

  3. In the Remote Tools Client Agent Properties dialog box, click the Security tab.

  4. Click the new button to open the New Viewer dialog box, and then specify an existing Microsoft Windows user account or group name.

  5. Click OK to close the dialog box, and then click OK to close the Remote Tools Client Agent Properties dialog box.

To remove a remote tools permitted viewer account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site server name> / Site Settings / Client Agents.

  2. In the results pane, right-click Remote Tools Client Agent and then click Properties.

  3. In the Remote Tools Client Agent Properties dialog box, click the Security tab.

  4. In Permitted Viewers, click the viewer name and then click the delete button.

  5. Click OK.

Security

Important
Bypassing the Use remote tools right for the collection is easy for knowledgeable or determined attackers. They could set up a Configuration Manager 2007 site that is not part of your hierarchy and create resource records for clients they want to control, and then grant themselves Use remote tools permission on those resources. Alternately, they could use the Remote.exe /SMS:nosql switch to create a remote tools session without verifying the permissions in the site database. You should think of collection security for Remote Tools as an organizational convenience, not a security tool.

Members of global groups that are members of local groups listed in the Permitted Viewers list are not enumerated, and thus members of global groups are not granted access permissions when they are nested in local groups. To avoid confusion, explicitly specify all global groups on the Permitted Viewers list.

The Permitted Viewers list is intentionally ambiguous because a user is authenticated against the list at the client, and the site server might not have access to the same domains as the client. Consequently, you can enter an account name in the Permitted Viewers list without specifying a domain for the account. However, the list must be clear at the client. Therefore, it is recommended that you enter an account name in the Permitted Viewers list by using the domain\account format to remove any ambiguity that might occur at the client.

See Also

Concepts

About the Remote Tools Permitted Viewer Accounts
New Permitted Viewer Dialog Box

Other Resources

How to Configure Configuration Manager 2007 Accounts


How to Use Configuration Manager Remote Control from the Command Line

Configuration Manager 2007 supports launching the remote tools application from the Windows command line. The methods for launching this differ for the Windows 2000 remote tools and the newer remote tools for Windows XP and later.

Procedures

To launch remote tools from the Command Line for Windows XP

  • To launch remote tools from the command line you must provide the required arguments. Open a command prompt and provide the following information:
    RC.exe <address type> <address or resource ID> [\\Site Server Name\]

    Note
    The first address type represents the Configuration Manager 2007 Resource ID, and the second address type represents the IP address or host name of the computer you want to remote control. If the Configuration Manager 2007 database is located on different computer you must also provide the Site Server Name.

You can launch remote tools with no command line arguments; however the remote control viewer will be launched with no active connection. To establish a connection, select File - Connect and configure a remote connection.

To launch remote tools from the Command Line for Windows 2000

  • To launch remote tools from the command line you must provide the required arguments. Open a command prompt and provide the following information:
    Remote.exe <address type> <address or resource ID> [\\Site Server Name\]

    Note
    The first address type represents the Configuration Manager 2007 resource ID and the second address type represents the IP address or host name of the computer you want to remote control. If the Configuration Manager 2007 database is located on different computer you must also provide the Site Server Name.

See Also

Concepts

Tasks for Remote Tools


Remote Tools Security Best Practices and Privacy Information

Microsoft System Center Configuration Manager 2007 remote control makes centralized administration easier. However, administrators with remote control permissions might be able to spy on users, compromising security and privacy. As mentioned earlier, there is no way to protect against an administrator improperly using administrative rights.

Security Best Practices for Remote Tools

Use either Group Policy or Configuration Manager to configure Remote Assistance settings, but not both You can use both Configuration Manager 2007 and Group Policy to make configuration changes to the Remote Assistance settings. When Group Policy is refreshed on the client, by default it optimizes the process by changing only the policies that have changed on the server. Configuration Manager 2007 changes the settings in the local security policy, which might not be overwritten unless the Group Policy update is forced. Setting policy in both places could lead to inconsistent results. Choose one of these methods to configure your Remote Assistance settings.

Do not consider the “Ask for permission” setting to be adequate security for remote tools for Windows 2000 clients Even if you enable the Ask for permission when an administrator tries to access clients option on the Remote Tools Client Agent properties, if you remotely administer a Windows 2000 client computer, disconnect, and then reconnect within 10 seconds, you can re-establish the remote administration session without asking for permission. Also on Windows 2000 client computers, anyone with local administrator rights can modify the registry temporarily to remove the permissions requirement and then re-enable it.

Enable "Ask for permission" setting Although there are ways around the setting Ask for permission when an administrator tries to access clients, you should still enable it to reduce the chance of users being spied upon while working on confidential tasks.

Enable notification You should enable the settings Display a visual indicator and Play a sound to reduce the chance of users being spied upon while working on confidential tasks.

Prevent users from changing policy or notification settings You should enable the setting Users cannot change policy or notification settings in the Remote Control Control Panel to prevent users from making changes that could make it easier for them to be spied on. .

Limit the Permitted Viewers list Local administrator rights are not required for a user to be able to use Remote Tools. If the collection and Permitted Viewers list security is met, the Remote Tools user can use Remote Tools on the client.

Specify required global groups Members of global groups that are members of local groups listed in the Permitted Viewers list are not enumerated, and thus members of global groups are not granted access permissions when they are nested in local groups. To avoid confusion, explicitly specify all global groups on the Permitted Viewers list.

Specify the domain context for user accounts The Permitted Viewers list is intentionally ambiguous because a user is authenticated against the list at the client, and the site server might not have access to the same domains as the client. Consequently, you can enter an account name in the Permitted Viewers list without specifying a domain for the account. However, the list must be clear at the client. Therefore, it is recommended that you enter an account name in the Permitted Viewers list by using the domain\account format to remove any ambiguity that might occur at the client.

Do not rely on collection security to control remote tools access Bypassing collection security for Remote Tools is easy for knowledgeable or determined people. They could set up a Configuration Manager 2007 site that is not part of your hierarchy and create resource records for clients they want to control. They could grant themselves any rights they want on those resources. Also, anyone with the Use Remote Tools right can use the command line version of Windows 2000 Remote Tools with the /SMS:NOSQL option to bypass checking the database. You should think of collection security for Remote Tools as an organizational convenience and effective for staff that follow your policies and procedures.

Do not enter passwords for privileged accounts when remotely administering Windows 2000 computers The password is secure to the client computer, but the password is entered through the virtual keyboard. Software that observes keyboard input could capture the password. Or if the program being run on the client computer is not the program that the remote control user assumes, the program might be capturing the password. When accounts and passwords are required, the end user should enter them.

Privacy Information

Remote control allows you to view active sessions on Configuration Manager 2007 client computers and potentially view any information stored on those computers. Remote control is not enabled by default. You can configure remote control to provide prominent notice and get consent from a user before a control session begins, or to monitor users without their permission or awareness. Before configuring remote control, consider your privacy requirements.

No information is collected during the remote control session, but auditing status is generated when a session is initiated. Auditing status is stored in the site database and deleted by default every 180 days. The deletion behavior is configurable by setting both the Status Filter Rule properties and the site maintenance task. No auditing status information is sent back to Microsoft.

See Also

Concepts

Remote Tools in Configuration Manager

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features


Troubleshooting Remote Tools Using Custom Error Codes

The following table lists the Remote Tools custom error codes, possible problems and possible solutions.

Remote Tools Custom Error Codes

Error Code | Possible Problem | Possible Solution
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | Another remote control session is already in progress. Remote Control does not support multiple concurrent remote control sessions. | Wait for other remote control session to terminate and try again.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Level of access allowed is set to “No Access” in the Remote Tools client agent General tab on the site server or in the Remote Control control panel applet. | Set the Level of access allowed to “Full Control” or “View Only” (XP and above) in the Remote Tools client agent on the site server, or in the Remote Control control panel applet (if override administrator settings is allowed).
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | Remote Control Agent was not properly installed on the client. | Re-install or repair the ConfigMgr client.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | No interactive session found on the client. | Ensure that a user is logged in at the client and that the screen is unlocked. Or use Remote Desktop to control the client.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | Remote computer screen is locked. | Unlock the remote computer, or use Remote Desktop to control the client.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,6) | Failed to create the RDP session. | Re-install or repair the ConfigMgr client.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,8) | Remote Tools is disabled. | Enable Remote Tools in the Remote Tools client agent on the site server.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,9) | Failed to launch the Remote Control Agent process. | Re-install or repair the ConfigMgr client.

See Also

Concepts

Custom Error Codes for Configuration Manager 2007

Other Resources

Troubleshooting Configuration Manager 2007


Wake On LAN in Configuration Manager

Configure scheduled Configuration Manager 2007 activities to take place outside business hours using the Wake On LAN feature, which has the following benefits:

  • Helps to achieve a higher success rate for Configuration Manager activities.
  • Reduces the associated network traffic during business hours.
  • Helps to conserve power by not requiring computers to be left on outside business hours.

Click the associated link in the following section for detailed information about planning, configuring, managing, monitoring, and troubleshooting Wake On LAN.

In This Section

Overview of Wake On LAN

Provides an overview of the Wake On LAN feature.

Prerequisites for Wake On LAN

Provides both external dependencies and dependencies within the product for Wake On Lan feature.

Planning for Wake On LAN

Provides planning information for the Wake On LAN feature.

Configuring Wake On LAN

Provides the configuration checklist and tasks to configure Wake On LAN in the environment.

Tasks for Wake On LAN

Provides a set of tasks to perform Wake On LAN objectives.

Troubleshooting Wake On LAN

Provides troubleshooting information for Wake On LAN.

Technical Reference for Wake On LAN

Provides technical reference information for Wake On LAN.

Wake On LAN Security Best Practices

Provides security and privacy information and best practices for Wake On LAN.

See Also

Other Resources

Configuration Manager 2007 Features


Overview of Wake On LAN

Wake On LAN in Configuration Manager 2007 supports the following scenarios:

  • Sending a wake-up transmission prior to the configured deadline for a software update deployment. Wake-up packets are sent only to computers that require the software updates and have not already installed them.
  • Sending a wake-up transmission prior to the configured schedule of a mandatory advertisement, which can be for software distribution or a task sequence.

For example scenarios of how Wake On LAN can be implemented in Configuration Manager 2007 to address these requirements, see Example Scenarios for Implementing Wake On LAN.

Each site must be independently configured for Wake On LAN, using either unicast or subnet-directed broadcast as the transmission method. Wake-up packets are sent from the primary site server to computers assigned to its site.

Note
Wake-up packet transmissions are sent only from primary site servers. You cannot configure secondary site servers or other computers acting as proxies to send wake-up packets.

Computers are woken up before the scheduled activity to ensure that they have completed startup. By default, this occurs 3 minutes before the scheduled activity, but this setting can be configured with the transmission offset option as a Wake On LAN advanced setting. You can also control the amount of network bandwidth that will be used when sending wake-up packets, using the Wake On LAN advanced options. For more information, see How to Configure Wake On LAN Advanced Options.

Wake On LAN in Configuration Manager 2007 supports waking up computers in sleep states S1 through S5. For more information about sleep states, see Sleep States for Wake On LAN.

On wake-up, the Configuration Manager Client registers the system as busy for the specific wake-up task it receives, until the task is complete. This prevents the computer from going back into a sleep state based on its power management settings before the task can complete. Wake On LAN does not return computers to a sleep state but power management schemes can configure computers to shut down or hibernate after a period of inactivity. Windows Vista supports power management schemes through Group Policy.

If you are using Configuration Manager 2007 Internet-based client management, wake-up transmissions are not sent to clients when they are on the Internet. Wake On LAN transmissions are always sent at the scheduled time, ignoring any maintenance windows that might be in effect on a client computer.

In This Section

Click any of the following links for more information:

About Unicast Wake-Up Packets for Wake On LAN

About Subnet-Directed Broadcast Wake-Up Packets for Wake On LAN

Wake On LAN in Configuration Manager Hierarchies

Administrator Workflow: Enabling Wake On LAN

Administrator Checklist: Enabling Wake On LAN

See Also

Concepts

About Maintenance Windows

Other Resources

Wake On LAN in Configuration Manager
Deploying Configuration Manager Sites to Support Internet-Based Clients


About Unicast Wake-Up Packets for Wake On LAN

Unicast, as the transmission method for sending wake-up packets to a computer in a Configuration Manager 2007 site, uses the IP address of the target computer from hardware inventory to route to the target computer's subnet, and it uses the Media Access Control (MAC) address of the target computer from hardware inventory to construct the wake-up packet. When the wake-up transmission reaches the target computer's subnet, the wake-up packet is sent directly to the target computer.

If the target computer has changed its IP address since it last sent its inventory information, the wake-up packet will reach the wrong computer but it will not wake it up because the MAC address in the wake-up packet transmission will not match.

Note
If you have computers that move between subnets, you might be able to reduce the likelihood of failed wake-up transmissions by increasing the Dynamic Host Configuration Protocol (DHCP) lease time and configuring the hardware inventory schedule to run more frequently.

One of the benefits of using unicast to send wake-up packets is that you rarely have to reconfigure the network infrastructure. However, one possible exception to this is the following:

  • Switches must forward UDP packets, and not all switches are configured to do so by default.

Consult your vendor's network card documentation to see if it can support unicast wake-up packets, and if it has to be specifically configured in the network adapter properties. Newer network cards are more likely to support this. This configuration might be referred to as Directed Packet, to differentiate it from traditional subnet-directed broadcast, which might be referred to as Magic Packet, although both methods of transmissions use the same magic packet format.

See Also

Concepts

Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN
Prerequisites for Wake On LAN

Other Resources

Overview of Wake On LAN


About Subnet-Directed Broadcast Wake-Up Packets for Wake On LAN

Subnet-directed broadcasts, as the transmission method for sending wake-up packets to a computer in a Configuration Manager 2007 site, uses the Media Access Control (MAC) address and IP subnet address of the target computer from hardware inventory. The wake-up transmission is sent to the computer's last known subnet, and it is then broadcast to all computers on that subnet. For this method to be successful, all intervening routers must be configured to forward subnet-directed broadcasts. During this broadcast, the computer that has the MAC address specified in the wake-up transmission will respond.

Because this transmission method uses the subnet address rather than the IP address, it will succeed if the target computer has changed IP addresses but remained in the same subnet. The use of subnet-directed broadcasts is the more traditional method of sending wake-up packets, so this transmission method might be more compatible with a wider range of computer network adapters than transmitting wake-up packets using unicast. However, subnet-direct broadcasts are not supported with IPv6, and are often disabled on routers.

Important
If you are using subnet-directed broadcasts as the Wake On LAN transmission method, it is highly recommended you include the additional security measure of allowing only the Configuration Manager site server to send subnet-directed broadcast traffic using a non-default port number for the wake-up packets.

See Also

Tasks

How to Configure the Ports Used for Wake On LAN
How to Configure Wake On LAN for Unicast or Subnet-Directed Broadcast

Concepts

Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN
Secure Routers for Subnet-Directed Broadcasts for Wake On LAN


Wake On LAN in Configuration Manager Hierarchies

Each site in the Configuration Manager 2007 hierarchy can be independently enabled or disabled for Wake On LAN. When a Wake On LAN activity is targeted at client computers, the wake-up transmission is sent only to client computers that are assigned to that site. Because advertisements and software update deployments are inherited by child sites, the site server in the child site is responsible for sending the wake-up transmissions to its assigned clients if the site is enabled for Wake On LAN.

If the child site is not enabled for Wake On LAN, client computers in that site will not be sent wake-up packets.

As an example, if you target a software update deployment to a collection containing computers at multiple sites, wake up packets will be sent only to collection members assigned to sites where Wake On LAN is enabled.

See Also

Other Resources

Overview of Wake On LAN


About Reports for Wake On LAN

The following reports are available for Configuration Manager 2007 Wake On LAN, with the report category of Wake On LAN:

  • All sites that are enabled for Wake On LAN
  • History of Wake On LAN activity
  • All computers targeted for Wake On LAN activity
  • All objects pending wake-up activity
  • Errors received while sending wake-up packets for a defined period

See Also

Tasks

How to Enable or Disable Wake On LAN for a Site

Concepts

About Configuration Manager Reports

Other Resources

Wake On LAN in Configuration Manager


Administrator Workflow: Enabling Wake On LAN

This administrator workflow displays the recommended steps to enable Wake On LAN in a Configuration Manager 2007 site.

For information about each step of the workflow, see the following topic: Administrator Checklist: Enabling Wake On LAN

Administrator workflow for enabling Wake On LAN

See Also

Other Resources

Wake On LAN in Configuration Manager


Administrator Checklist: Enabling Wake On LAN

The following checklist provides the steps necessary to configure and use Wake On LAN in a Configuration Manager 2007 site:

Step Reference

Check the prerequisites for using Wake On LAN with Configuration Manager 2007, and make any required changes to your network infrastructure and computers.

Prerequisites for Wake On LAN

Overview of Wake On LAN

Planning for Wake On LAN

Configure the port number to use for Wake On LAN.

How to Configure the Ports Used for Wake On LAN

Enable Wake On LAN for the site.

How to Enable or Disable Wake On LAN for a Site

Select either unicast (the default) or subnet-directed broadcast as the transmission method for Wake On LAN.

How to Configure Wake On LAN for Unicast or Subnet-Directed Broadcast

Check whether you need to fine-tune the configuration for packet delivery, such as by changing the number of retries and the transmission offset.

How to Configure Wake On LAN Advanced Options

Enable Wake On LAN where required for the following:

  • Software update deployments
  • Software distribution mandatory advertisements
  • Task sequence mandatory advertisements

How to Configure a Software Update Deployment for Wake On LAN

How to Configure a Software Distribution Mandatory Advertisement for Wake On LAN

How to Configure a Task Sequence Mandatory Advertisement for Wake On LAN

Monitor Wake On LAN activity.

How to Monitor Wake On LAN Activity

See Also

Concepts

Administrator Workflow: Enabling Wake On LAN

Other Resources

Wake On LAN in Configuration Manager


Prerequisites for Wake On LAN

Wake On LAN in Configuration Manager 2007 has both external dependencies and dependencies within the product.

Dependencies External to Configuration Manager 2007

Dependency | More Information
Network cards must support the standard magic packet format. | All network cards that have the Windows Logo certificate support this magic packet format.
Computers must be configured for wake-up packets on the network card and in the computer BIOS. | Refer to your hardware vendor's documentation for information about how to configure this.
If you are using Wake On LAN with subnet-directed broadcast, all routers between the site server and target computers must allow IP directed broadcasts, and support IPv4. | Typically, routers are configured to not allow subnet-directed broadcast. Subnet-directed broadcasts are not supported with IPv6.

Configuration Manager 2007 Dependencies

Dependency | More Information
Hardware inventory must be enabled, and completed an inventory schedule. | About Collecting Hardware Inventory How to Configure Hardware Inventory for a Site
The Configuration Manager site must be a primary site. | You can configure child primary sites for Wake On LAN, but not secondary sites. Clients in secondary sites will be sent wake-up packets from their assigned primary site.
Client computers must be running the Configuration Manager 2007 client. | Clients running Systems Management Server (SMS) 2003 do not support Wake On LAN. Mobile devices do not support Wake On LAN capability.

See Also

Other Resources

Overview of Wake On LAN


Planning for Wake On LAN

A successful implementation of Wake On LAN in Configuration Manager 2007 relies on careful planning considerations for your enterprise network. You should not attempt to implement this feature without consultation with your network architects to ensure the network infrastructure can support wake-up transmissions.

Click any link in the following section for guidance on planning for Wake On LAN in Configuration Manager 2007.

In This Section

Determine If You Should Enable Wake On LAN

Provides guidance to help you decide if you should use Wake On LAN in Configuration Manager 2007.

Determine Administrator Roles and Processes for Wake On LAN

Provides guidance on the various roles and processes involved with implementing Wake On LAN in Configuration Manager, and some of the possible consequences of not identifying these processes and roles.

Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN

Provides guidance to help you determine the best transmission method for your network and business requirements.

Determine If Wake-Up Packets Traverse the Network for Wake On LAN

Provides guidance on determining if wake-up transmissions successfully traverse the network to reach target computers.

Determine the Ports Required by Firewalls to Support Wake-Up Packets for Wake On LAN

Provides information about port configuration required on intervening firewalls and network devices.

Secure Routers for Subnet-Directed Broadcasts for Wake On LAN

Provides guidance on the additional security configuration you should employ on routers when using subnet-directed broadcasts as your wake-up transmission.

See Also

Other Resources

Configuring Wake On LAN
Overview of Wake On LAN
Wake On LAN in Configuration Manager


Determine If You Should Enable Wake On LAN

Enable Wake On LAN if all of the following conditions apply:

  • You need to deploy any of the following at a time when client computers are turned off, in a sleep state S1 through S5:
    • Software update deployments with a deadline.
    • Mandatory task sequence advertisements.
    • Mandatory software distribution advertisements.
  • Computers have network cards that support the industry-standard magic packet format.
  • Computers are configured to support Wake On LAN in the BIOS and as part of the network-card configuration.
  • The network infrastructure can support and transmit the wake-up packets to target computers.

You can enable or disable Wake On LAN independently on each primary site in the Configuration Manager hierarchy, which provides a great deal of flexibility in using Wake ON LAN. For example, you can enable Wake On LAN on a central site, disable it on a child site, and then enable it on a grandchild site.

Enabling Wake On LAN is not necessary if the conditions above do not apply. However, enabling the site for Wake On LAN alone will not result in sending wake-up packets. To send wake-up packets, the option Enable Wake On LAN must also be configured in software update deployments or advertisements.

If you are enabling Wake On LAN on a child site, software update deployments and advertisements that are inherited from a parent site will include the Enable Wake On LAN configuration.

If you are enabling Wake On LAN for a primary site that has a secondary site, wake-up packets will always be sent from the primary site to the secondary site if targeted clients are in the secondary site.

To control bandwidth when sending wake-up packets, see How to Configure Wake On LAN Advanced Options.

See Also

Concepts

Sleep States for Wake On LAN
Prerequisites for Wake On LAN
Wake On LAN in Configuration Manager Hierarchies

Other Resources

Wake On LAN in Configuration Manager


Determine Administrator Roles and Processes for Wake On LAN

Topic last updated—November 2007

In a production environment, implementing Wake On LAN in Configuration Manager 2007 involves various processes that might require interaction and collaboration with a number of different groups across the enterprise. For example, these groups might include the following:

  • Asset management to identify existing network cards and their configuration to ascertain whether they can support Wake On LAN.
  • Procurement for new desktop computers and network cards to support the Wake On LAN technology with your chosen wake-up transmission method.
  • Build engineers to ensure that new desktop computers include network cards that support the Wake On LAN technology and are configured appropriately (such as BIOS settings or network driver settings).
  • Desktop engineers who replace network cards in existing computers if they do not support the Wake On LAN technology, and who ensure appropriate configuration.
  • Infrastructure and network architects to ensure that firewalls, routers, and switches are configured to allow the wake-up transmission packets using an agreed port number, and to ascertain the impact of Wake On LAN traffic with regard to the available network bandwidth.
  • Security advisors to help determine whether subnet-directed broadcast or unicast should be used as the wake-up transmission method, and to agree on security mitigations for securing routers if applicable.
  • Configuration Manager administrators responsible for configuring software distribution, software updates, and task sequences to identify which advertisements and software update deployments should be enabled for Wake On LAN. Additionally, hardware inventory and software distribution might be used to update network drivers.
  • Active Directory Group Policy administrators to configure power management options (supported with Windows Vista).
  • End users who might require training and notification about turning off their computers at the end of the day if this is not their normal working practice.
Important
Consult the network card vendor for details about how to enable Wake On LAN for each network card and driver because the configuration for this will vary for each vendor and possibly for each network card and driver.

Because a Wake On LAN solution can involve a number of different roles and processes, a successful implementation will depend on identifying who is responsible for the various roles and ensuring collaboration between groups when necessary. A successful ongoing implementation will depend on identifying and adhering to processes that coordinate the various functions between the roles.

Some of the consequences of not having and following defined processes when Wake On LAN in Configuration Manager is implemented in a production environment are as follows:

  • Computers are not woken up as expected, which impacts the success rate of computer management. This in turn can negatively affect service level agreements (SLAs) and, in the case of software updates, can mean that computers are vulnerable to security exploits.
  • If computers cannot be successfully managed outside office hours, user efficiency will be negatively impacted if users have to wait for software distributions and operating system deployments to complete. In the case of delivering software updates that require a restart during the day, this negatively impacts business continuity.
  • If you are using subnet-directed broadcast as your wake-up transmission method and do not secure routers, this exposes the network to an unnecessary security risk.
  • Inactive computers are not turned off, so the power savings expected are not realized.

Use a methodology such as ITIL or Microsoft Operations Framework (http://go.microsoft.com/fwlink/?LinkId=88047) to help you implement Wake On LAN within a framework of defined processes. Make sure you document your design, testing procedures, the areas of responsibility, and the processes to follow for configuring, monitoring, and troubleshooting, and then disseminate this information, making sure that it is centrally available and updated.

Note
Review existing company security policies, and if necessary, modify them to include the implementation of Wake On LAN.

See Also

Concepts

Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN
Secure Routers for Subnet-Directed Broadcasts for Wake On LAN

Other Resources

How to Configure Wake On LAN Activities
Planning for Wake On LAN


Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN

When choosing the transmission method of sending wake-up packets, you should consider the advantages and disadvantages of each method to best meet your business requirements. The following table outlines the advantages and disadvantages of both methods to help you determine which transmission method to choose.

Transmission method Advantage Disadvantage

Unicast

More secure solution than subnet-directed broadcasts because the packet is sent directly to a computer rather than to all computers on a subnet.

Does not require reconfiguration of routers.

Consumes less network bandwidth than subnet-directed broadcast transmissions.

Supported with IPv4 and IPv6.

Wake-up packets will fail to find target computers that have changed their subnet address since the last hardware inventory schedule.

Switches might need to be configured to forward UDP packets.

Some network adapters might not respond to wake-up packets in all sleep states when using unicast as the transmission method.

Subnet-Directed Broadcast

Higher success rate than unicast if you have computers that frequently change their IP address within the same subnet.

No switch reconfiguration is required.

High compatibility rate with computer adapters for all sleep states, because subnet-directed broadcasts were the original transmission method for sending wake-up packets.

Less secure solution than using unicast because an attacker could send continuous streams of ICMP echo requests from a falsified source address to the directed broadcast address, causing all of the hosts to reply to that source address. This type of denial of service attack is commonly called a smurf attack and is usually mitigated by not allowing subnet-directed broadcasts If routers are configured to allow subnet-directed broadcasts, the additional configuration is recommended for security reasons:

  • Routers should be configured to allow only IP-directed broadcasts from the Configuration Manager site server, using a specified UDP port number.
  • Configuration Manager 2007 must be configured to use the specified non-default port number.

Might require reconfiguration of all intervening routers to enable subnet-directed broadcasts.

Consumes more network bandwidth than unicast transmissions.

Supported with IPv4 only; IPv6 is not supported.

See Also

Concepts

About Subnet-Directed Broadcast Wake-Up Packets for Wake On LAN
About Unicast Wake-Up Packets for Wake On LAN

Other Resources

Overview of Wake On LAN
Wake On LAN in Configuration Manager


Determine If Wake-Up Packets Traverse the Network for Wake On LAN

To support Wake On LAN in Configuration Manager 2007, computer network cards must support the standard magic packet format, which is supported on all network cards that have the Windows Logo certification. Additionally, most modern network cards support the standard "magic packet" format. Refer to the documentation or contact the supplier or vendor to confirm whether Wake On LAN is supported on the motherboard and network card and to learn how to configure it.

You can use a network analyzer, such as Microsoft Network Monitor 3.1 (http://go.microsoft.com/fwlink/?LinkId=101189), to verify whether wake-up packets successfully traverse your network infrastructure and reach the computers' network segment. Attach a network hub to the target computer's network port, and connect to the hub both the target computer and the computer from which you will capture network packets with a network analyzer.

The packet format for a wake-up packet as represented in hexadecimal format is as follows:

FF FF FF FF FF FF followed by 16 repetitions of the target computer's MAC address

If you cannot see this packet on the same network segment as the target computer, and you have confirmed the hardware support and configuration on the computer, check the following:

  • When you are using subnet-directed broadcasts as your wake-up transmission method, verify that routers are correctly configured to pass IP-directed broadcasts from the site server using the port number specified in Configuration Manager 2007.
  • Verify that the IP network address of the target computer has not changed since the last hardware inventory information.

See Also

Tasks

How to Configure the Ports Used for Wake On LAN
How to Configure Wake On LAN for Unicast or Subnet-Directed Broadcast

Concepts

About Subnet-Directed Broadcast Wake-Up Packets for Wake On LAN
About Unicast Wake-Up Packets for Wake On LAN
Secure Routers for Subnet-Directed Broadcasts for Wake On LAN

Other Resources

Wake On LAN in Configuration Manager


Determine the Ports Required by Firewalls to Support Wake-Up Packets for Wake On LAN

The default port used by Configuration Manager 2007 to send wake-up packets to target computers is UDP port 9.

However, this default port number can be changed as a site property, so you should ensure that any intervening firewalls and networking devices between the site server and its assigned clients are configured to allow the same UDP port number as configured in Configuration Manager 2007.

See Also

Tasks

How to Configure the Ports Used for Wake On LAN

Concepts

Ports Used by Configuration Manager


Secure Routers for Subnet-Directed Broadcasts for Wake On LAN

If you are using subnet-directed broadcast as the transmission method of sending wake-up packets, all intervening routers between the primary site server and client computers must allow IP-directed broadcasts. To help mitigate the security risks associated with this configuration, take these additional configuration steps:

  1. Configure Wake On LAN in Configuration Manager 2007 to use a nondefault port number.
  2. Configure routers to only allow IP-directed broadcasts from the site server, using the nondefault port number you configured in Configuration Manager 2007.
Note
The security risks associated with subnet-directed broadcasts are that an attacker could send continuous streams of Internet Control Message Protocol (ICMP) echo requests from a falsified source address to the directed broadcast address, causing all the hosts to reply to that source address. This type of denial of service attack is commonly called a smurf attack and is typically mitigated by not allowing subnet-directed broadcasts.

See Also

Tasks

How to Configure the Ports Used for Wake On LAN
How to Configure Wake On LAN for Unicast or Subnet-Directed Broadcast

Concepts

About Subnet-Directed Broadcast Wake-Up Packets for Wake On LAN
Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN

Other Resources

Wake On LAN in Configuration Manager


Configuring Wake On LAN

You must configure a Configuration Manager 2007 site for Wake On LAN before you can send wake-up packets with software update deployments and mandatory advertisements.

In This Section

This section has the following content for tasks relating to configuring Wake On LAN:

How to Configure the Ports Used for Wake On LAN

How to Enable or Disable Wake On LAN for a Site

How to Configure Wake On LAN for Unicast or Subnet-Directed Broadcast

How to Configure Wake On LAN Advanced Options

See Also

Concepts

Administrator Workflow: Enabling Wake On LAN
Administrator Checklist: Enabling Wake On LAN

Other Resources

Overview of Wake On LAN


How to Configure the Ports Used for Wake On LAN

When a site is enabled for Wake On LAN, wake-up packets can be transmitted using a transmission method of either unicast (the default) or subnet-directed broadcast. The default port for the wake-up transmission is UDP port 9. However, you can select an alternative UDP port number using the Ports tab on the site properties.

To configure the port number for Wake On LAN packets, follow the procedure shown below.

To configure the ports used for Wake On LAN:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> – <site name>, and then click Properties.

  3. On the Ports tab in the site properties dialog box, ensure Wake on LAN (UDP) is selected as an active port, right-click this entry, and then select Properties.

  4. In the Port Detail dialog box, specify the port number you want to use for wake-up transmissions and click OK.

  5. Click OK to close the site properties dialog box.

    Note
    For information about the options in the Site Properties: Ports tab, see Site Properties: Ports Tab.

See Also

Tasks

How to Enable or Disable Wake On LAN for a Site

Concepts

Ports Used by Configuration Manager

Other Resources

Wake On LAN in Configuration Manager
Configuring Wake On LAN


How to Enable or Disable Wake On LAN for a Site

Enabling Wake On LAN in Configuration Manager 2007 allows the primary site server to send wake-up packets for the following Configuration Manager activities:

  • Software update deployments
  • Software distribution advertisements
  • Task sequence advertisements

Before you can enable these activities for Wake On LAN, you must enable the site for Wake On LAN.

To prevent the site server sending wake-up packets, disable the site for Wake On LAN.

To enable or disable the site the Wake On LAN, follow this procedure.

To enable or disable Wake on LAN for a site:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name> and then click Properties.

  3. On the Wake On LAN tab in the site properties dialog box, select the option Enable Wake On LAN for this site.

  4. Click OK.

    Note
    For information about the options in the Wake On LAN tab, see Site Properties: Wake On LAN Tab.

See Also

Tasks

How to Configure the Ports Used for Wake On LAN

Reference

Wake On LAN Advanced Properties Dialog Box

Other Resources

Overview of Wake On LAN
Wake On LAN in Configuration Manager


How to Configure Wake On LAN for Unicast or Subnet-Directed Broadcast

When a Configuration Manager 2007 site is enabled for Wake On LAN, wake-up packets are transmitted using the transmission method of either Unicast (the default) or subnet-directed broadcast.

To configure this option, follow this procedure.

To configure Wake On LAN for Unicast or subnet-directed broadcast transmission:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> – <site name>, and then click Properties.

  3. On the Wake On LAN tab, either select the option Unicast if you want wake-up packets to be sent using unicast transmission, or select the option Subnet-directed broadcasts if you want wake-up packets to be sent using subnet-directed broadcast transmission.

  4. Click OK.

    Note
    For information about the options in the Site Properties: Wake On LAN tab, see Site Properties: Wake On LAN Tab.

See Also

Concepts

Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN

Other Resources

Overview of Wake On LAN
Wake On LAN in Configuration Manager


How to Configure Wake On LAN Advanced Options

The advanced configuration for Wake On LAN allows you to fine-tune how wake-up packets are sent to computers, with the following options:

  • The maximum number of transmission retries and the delay period in between the retries.
  • The maximum number of transmission threads.
  • The transmission offset, to specify when wake-up packets are sent prior to a scheduled activity.

To configure the Wake On LAN advanced options, follow this procedure.

To configure Wake on LAN advanced options

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> – <site name> and then click Properties.

  3. On the Wake On LAN tab, click Advanced.

  4. In the Wake On LAN Advanced Properties dialog box, configure the following options:

    • Retries and Delay under the Transmission retries section.
    • Maximum and Wait (seconds) under the Transmission maximum section.
    • Transmission threads under the Transmission threads section.
    • Transmission offset (minutes) under the Transmission offset section.

  5. Click OK, and then click OK to close the site properties dialog box.

    Note
    For information about the options in the Wake On LAN Advanced Properties dialog box, see Wake On LAN Advanced Properties Dialog Box.

See Also

Reference

Site Properties: Wake On LAN Tab

Other Resources

Wake On LAN in Configuration Manager
Configuring Wake On LAN


Tasks for Wake On LAN

The content in this section provides the steps necessary to configure Wake On LAN activities and monitor Wake On LAN in Configuration Manager 2007. The content in this section provides the steps necessary to accomplish each task.

  • How to Configure Wake On LAN Activities
  • How to Monitor Wake On LAN

See Also

Other Resources

Wake On LAN in Configuration Manager


How to Configure Wake On LAN Activities

You can configure software update deployments, software distribution advertisements, and task sequence advertisements for Wake On LAN in Configuration Manager 2007. The content in this section provides the steps necessary to accomplish each task.

In This Section

This section has the following content for tasks relating to configuring Wake On LAN:

How to Configure a Software Update Deployment for Wake On LAN

How to Configure a Software Distribution Mandatory Advertisement for Wake On LAN

How to Configure a Task Sequence Mandatory Advertisement for Wake On LAN

See Also

Other Resources

Overview of Wake On LAN


How to Configure a Software Update Deployment for Wake On LAN

When a Configuration Manager 2007 site is enabled for Wake On LAN, software updates that are configured with a deadline can be configured for Wake On LAN with the option Enable Wake On LAN. This option is specified as a software update deployment property, and it can also be enabled in the Deploy Software Updates Wizard on the Deployment Schedule page.

Use the following procedure to configure an existing software update deployment for Wake On LAN.

To configure a software update for Wake On LAN

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployments.

  2. Right-click the deployment you want to configure for Wake On LAN, and then click Properties.

  3. On the Schedule tab, select the option Enable Wake On LAN.

  4. Click OK.

See Also

Tasks

How to Deploy Software Updates

Concepts

About the Deploy Software Updates Wizard
About Software Update Deployments

Other Resources

Overview of Wake On LAN


How to Configure a Software Distribution Mandatory Advertisement for Wake On LAN

When a Configuration Manager 2007 site is enabled for Wake On LAN, software distribution assignments that are configured with a mandatory advertisement can be configured for Wake On LAN. This option is specified as advertisement property, and can also be enabled in the Distribute Software Wizard on the Assign Program page.

Use the following procedure to configure software distribution for Wake On LAN.

To configure a software distribution mandatory advertisement for Wake On LAN

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click the advertisement that supports the software distribution you want to enable for Wake On LAN, and then click Properties.

  3. On the Schedule tab, select the option Enable Wake on LAN.

    Note
    If this option is not enabled, the advertisement is not configured as a mandatory assignment. Only software distributions that are configured as mandatory can be enabled for Wake On LAN.

  4. Click OK.

See Also

Tasks

How to Assign a Mandatory Advertisement

Concepts

About Advertisements

Other Resources

Distribute Software Wizard
Overview of Wake On LAN
Wake On LAN in Configuration Manager


How to Configure a Task Sequence Mandatory Advertisement for Wake On LAN

When a Configuration Manager 2007 site is enabled for Wake On LAN, task sequences that are configured with a mandatory advertisement can be configured for Wake On LAN. This option is specified as an assignment schedule property and can also be enabled in the New Advertisement Wizard on the Schedule page.

Use the following procedure to configure a task sequence mandatory advertisement for Wake On LAN.

To configure a task sequence mandatory advertisement for Wake On LAN

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

  2. Right-click the advertisement that supports the operating system deployment that you want to enable for Wake On LAN, and then click Properties.

  3. On the Schedule tab, select the option Enable Wake on LAN.

    Note
    If this option is not enabled, the advertisement is not configured as a mandatory assignment. Only task sequences that are configured as mandatory can be enabled for Wake On LAN.

  4. Click OK.

See Also

Tasks

How to Advertise Task Sequences

Other Resources

Overview of Wake On LAN
Wake On LAN in Configuration Manager


How to Monitor Wake On LAN

Use the following tasks to help you monitor Wake On LAN in Configuration Manager 2007:

How to Identify Which Computers Will Be Sent Wake-Up Packets for Wake On LAN

How to Identify Which Sites are Configured for Wake On LAN

How to Monitor Wake On LAN Activity

See Also

Other Resources

Overview of Wake On LAN


How to Identify Which Computers Will Be Sent Wake-Up Packets for Wake On LAN

When a Configuration Manager 2007 site is enabled for Wake On LAN, the following activities can be enabled for Wake On LAN:

  • Software update deployments that are configured with a deadline
  • Mandatory software distribution advertisements
  • Mandatory task sequence advertisements

Only computers that require software updates enabled for Wake On LAN are sent wake-up packets. For example, if a particular software update is targeted to the All Systems collection but only a few computers require the software update, only those few computers are woken up rather than all the computers in the collection. However, advertisements always run on the targeted computers and so computers that are targeted with advertisements that are configured for Wake On LAN will always be sent wake-up packets.

To determine which computers will be sent wake-up packets, run the following report: All computers targeted for Wake On LAN activity.

To run this report, follow the steps in the procedure shown below.

To identify which computers will be woken up by running a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to Wake On LAN.

  3. Right-click the report All computers targeted for Wake On LAN activity, and then click Run.

  4. In the Report Information window, enter the component name by typing in Software Distribution, or Software Updates, or Operating System. Alternatively, click Values to select the component name.

  5. Click Display to view the report.

See Also

Other Resources

Overview of Wake On LAN
Tasks for Wake On LAN
Wake On LAN in Configuration Manager


How to Identify Which Sites are Configured for Wake On LAN

In a hierarchical deployment of Configuration Manager 2007, each primary site can be independently enabled for Wake On LAN. In a site configured for Wake On LAN, wake-up packets are sent by the primary site server to computers assigned to the site.

To identify which sites are enabled for Wake On LAN and the site servers that can send wake-up packets, run the following report: All sites that are enabled for Wake On LAN.

To run this report, follow the steps in this procedure.

To identify which sites are configured for Wake On LAN by running a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports relating to Wake On LAN.

  3. Right-click the report All sites that are enabled for Wake On LAN, and then click Run.

  4. In the Report Information window, click Display to view the report.

See Also

Tasks

How to Enable or Disable Wake On LAN for a Site

Other Resources

Overview of Wake On LAN
Wake On LAN in Configuration Manager


How to Monitor Wake On LAN Activity

You can monitor Wake On LAN activity in Configuration Manager 2007 with the following procedures:

  • Using the Wake On LAN performance counters for SMS Wake On LAN Communication.
  • Identifying wake-up activity for a defined period with the report History of Wake On LAN activity.

To monitor Wake On LAN by using the Wake On LAN performance counters

  1. In the Performance utility, ensure the site server is selected as the target computer and from the Performance object dropdown menu, select SMS Wake On LAN Communication.

  2. Select either All counters or select Select counters from list:, and click one or more of the following options:

    • Number of packets per second
    • Total number of packets failed
    • Total number of packets sent
    • Total number of requests pending

  3. Click Add for each Wake On LAN performance counter you require.

  4. Click Close.

To identify Wake On LAN activity for a defined period by running a report

  1. In the administrator console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so you can more easily find the reports relating to Wake On LAN.

  3. Right-click the report History of Wake On LAN activity, and then click Run.

  4. In the Report Information window, either accept the default value of 1 Period in Days or type in your preferred number of days from which you require Wake On LAN activity information, and then click Run.

  5. In the Report Information window, click Display to view the report.

See Also

Other Resources

Overview of Wake On LAN
Configuring Wake On LAN
How to Configure Wake On LAN Activities
Wake On LAN in Configuration Manager


Troubleshooting Wake On LAN

Click any link in the following section for troubleshooting information for Wake On LAN in Configuration Manager 2007.

In This Section

Troubleshooting Wake On LAN Issues

Lists possible problems and solutions if you experience issues when using Wake On LAN in Configuration Manager 2007.

Log Files for Wake On LAN.

Lists and describes the function of log files used with the Wake On LAN feature.

See Also

Other Resources

Wake On LAN in Configuration Manager


Troubleshooting Wake On LAN Issues

Topic last updated—November 2007

This topic provides troubleshooting information to help you resolve issues when Wake On LAN in Configuration Manager does not successfully wake up computers.

Computers Do Not Wake Up Because the Computer Does Not Support Wake On LAN Transmissions

A successful deployment of Wake On LAN depends on many factors external to Configuration Manager. On the computer itself, these include the following:

  • The network adapter (and driver) supports the magic packet format that is used for Wake On LAN technology.
  • If you are using unicast as your transmission method rather than subnet-directed broadcast, whether the network adapter (and driver) supports this.
  • The appropriate configuration has been performed to support wake-up packets. The configuration will be vendor-dependent and is likely to include configuring the BIOS and the driver or adapter properties in Windows. However, for older network adapters, it could include connecting wires or moving jumpers on the adapter.
    Note
    If you want to wake up computers using Wake On LAN in Configuration Manager, ensure that the BIOS is not configured with a password. If a BIOS password is set, the computer cannot complete startup until the password is supplied manually.

Solution

Refer to your vendor's documentation for information about support for wake-up packets and required configuration.

Computers Do Not Wake Up Because the Network Infrastructure Does Not Support Wake On LAN Transmissions

A successful deployment of Wake On LAN depends on many factors external to Configuration Manager. On the network, these might include (but are not limited to) the configuration of firewalls, routers, and switches to allow the wake-up transmission packets using the port number specified in Configuration Manager.

Note
Application-level firewalls such as ISA Server cannot detect wake-up transmissions as a protocol, so a protocol rule of "Allow all IP traffic" will not be sufficient to forward wake-up packets. Instead, configure an IP filter rule to forward UDP packets on the port number specified in Configuration Manager, with the source address of the site server configured for Wake On LAN.

Solution

Consult your networking team and vendor documentation for information about allowing the wake-up packets to traverse the network. Wake-up transmissions use UDP rather than TCP, which means that the sending site server has no knowledge of whether the packets reach the intended computers. You can use a network monitor to confirm whether the wake-up packets traverse the network successfully. For more information, see Determine If Wake-Up Packets Traverse the Network for Wake On LAN.

The default port number used for Wake On LAN in Configuration Manager 2007 is 9, but this can be changed to a custom port number. For procedural information about verifying or changing the port number, see How to Configure the Ports Used for Wake On LAN.

Computers Do Not Wake Up Because the Client Has Not Completed a Hardware Inventory Cycle

The wake-up packets sent by the site server are constructed using the MAC address of the target computer, using hardware inventory information previously collected. If hardware inventory is not enabled for the site or if the target computer is a new Configuration Manager client that has not yet sent its inventory information back to the site, the site server cannot construct the wake-up packets.

Solution

Ensure that hardware inventory is configured and that clients that need to be woken up have completed at least one hardware inventory cycle.

For more information, see How to Configure Hardware Inventory for a Site.

Computers Do Not Wake Up Because They Have Changed Their IP Address Since the Last Hardware Inventory Cycle

When the site server uses unicast as the wake-up transmission method, it sends the wake-up packet to the target computer's last known IP address (from hardware inventory). If the target computer no longer has the same IP address, it will not receive the wake-up packets.

When the site server uses subnet-directed broadcast as the wake-up transmission method, it sends the wake-up packet to the target computer's last known IP subnet address (from hardware inventory). If the target computer no longer has the same subnet address (for example, it is a client that frequently roams in the Configuration Manager hierarchy), it will not receive the wake-up packets.

Solution

Increasing the DHCP lease time and configuring the hardware inventory schedule to run more frequently can help to reduce the likelihood of sending wake-up packets to out-of-date addresses.

Additionally, if computers frequently change IP addresses but keep the same subnet address, selecting subnet-directed broadcast rather than unicast as the transmission method will prove more effective in waking up computers.

For more information, see the following topics:

  • About Unicast Wake-Up Packets for Wake On LAN
  • About Subnet-Directed Broadcast Wake-Up Packets for Wake On LAN
  • Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN

See Also

Concepts

Determine Administrator Roles and Processes for Wake On LAN
Example Scenarios for Implementing Wake On LAN
Prerequisites for Wake On LAN

Other Resources

Troubleshooting Wake On LAN


Log Files for Wake On LAN

Use the following log files to help you troubleshooting Wake On LAN in Configuration Manager 2007.

Configuration Manager Site Server Log Files

The Configuration Manager 2007 site server log files related to Wake On LAN are located in the folder <ConfigMgrInstallationPath>\Logs on the site server.

Note
If the following log files are not present, check that Wake On LAN is enabled for the site. For more information, see How to Enable or Disable Wake On LAN for a Site.

Log File Name | More Information
Wolmgr.log | Contains information about wake-up procedures such as when to wake up advertisements or deployments that are configured for Wake On LAN.
WolCmgr.log | Contains information about which clients need to be sent wake-up packets, the number of wake-up packets sent and retried.

Configuration Manager Client Log Files

There are no client-side log files for Wake On LAN.

Configuration Manager cannot track the progress of wake-up packets after they are sent, but you can use any network monitoring tool to verify whether wake-up packets successfully traverse your network infrastructure and reach the computers' network segment. For more information, see Determine If Wake-Up Packets Traverse the Network for Wake On LAN.

See Also

Tasks

How to Identify Which Sites are Configured for Wake On LAN
How to Identify Which Computers Will Be Sent Wake-Up Packets for Wake On LAN
How to Monitor Wake On LAN Activity

Concepts

Prerequisites for Wake On LAN
Determine the Ports Required by Firewalls to Support Wake-Up Packets for Wake On LAN

Other Resources

Wake On LAN in Configuration Manager


Wake On LAN Security Best Practices

Best Practices

Use unicast for sending wake-up packets Unicast is more secure than subnet-directed broadcasts because the packet is sent directly to a computer rather than to all computers on a subnet. However, unicast will not work in all environments. For more information, see Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN.

If you must use subnet-directed broadcasts, configure routers to allow IP-directed broadcasts only from the site server and only on a non-default port number Subnet directed broadcasts are vulnerable to smurf attacks. Limiting the broadcasts to a trusted source, the site server computer, and a non-default UDP port, help to mitigate the risk. For more information, see Secure Routers for Subnet-Directed Broadcasts for Wake On LAN.

See Also

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features
Wake On LAN in Configuration Manager


Technical Reference for Wake On LAN

Click any link in the following section for technical references on Wake On LAN with Configuration Manager 2007.

In This Section

Sleep States for Wake On LAN

Lists and describes the various sleep states for a computer, and which ones Configuration Manager 2007 supports with Wake On LAN.

Example Scenarios for Implementing Wake On LAN

Example scenarios of how Wake On LAN can be implemented in Configuration Manager 2007 to address specific business requirements.

See Also

Other Resources

Wake On LAN in Configuration Manager


Sleep States for Wake On LAN

Wake On LAN in Configuration Manager 2007 supports waking up computers in sleep states S1 through S5. Sleep states describe the possible power states for a computer, as listed in the following table.

Sleep State | Description
S0 | The computer is on and fully functional.
S1 | The computer appears to be off with the CPU stopped. RAM is refreshed, and the computer is running in a low power mode.
S2 | The computer appears to be off with the CPU stopped. RAM is refreshed, and the computer is running in a lower power mode than S1.
S3 (Standby) | The computer appears to be off with no power to the CPU. RAM is in slow refresh.
S4 (Hibernate) | The computer appears to be off with no power to the hardware. System memory has been saved as a temporary file on the hard disk.
S5 (Off) | The computer is off with no power to the hardware, and the operating system has been shut down without saving system memory to disk.

See Also

Other Resources

Wake On LAN in Configuration Manager


Example Scenarios for Implementing Wake On LAN

Topic last updated—November 2007

The following sections in this topic provide example scenarios of how Wake On LAN in Configuration Manager 2007 can be implemented:

  • Achieving Compliance Levels by Installing Software Updates on Computers That Are Turned Off
  • Installing Large Software Applications Overnight When the Company Policy Mandates That Workstations Must Be Turned Off to Reduce Electricity Costs
  • Waking Up Computers to Install a New Operating System

Achieving Compliance Levels by Installing Software Updates on Computers That Are Turned Off

This scenario demonstrates how you can use Wake On LAN in Configuration Manager to help achieve higher success rates for installing software updates within a specified time frame.

Woodgrove Bank has a security policy that requires that all computers on the network running Windows have critical security software updates installed within two weeks of release. The installation of these software updates on servers has a 100% success rate, but only 80% success rate on desktops despite the Configuration Manager administrator deploying them with a deadline one week after release. On investigation, the computers that do not have the software updates installed are turned off for various reasons—for example, because users are on vacation or sick leave or because the computers are not in everyday use and turned on only when needed for a specific application or process.

There is often not enough time to track down each computer, turn it on, and install the required software updates to meet the compliance deadline.

To help achieve the compliance levels in a timely and efficient fashion, Woodgrove Bank decides on the course of action outlined in the following table.

Process Reference

Mary North is the Configuration Manager administrator and is responsible both for hardware inventory and for software updates. She already has a list of network cards in each managed desktop from hardware inventory data.

The inventory data indicates that there is a mixture of network cards from different vendors in existing computers. Replacing these network cards is not a viable option.

About Collecting Hardware Inventory

Mary references the documentation for the various network cards and learns that all of them support the magic packet format and should support Wake On LAN.

On her own test network running Configuration Manager 2007, she enables Wake On LAN for a site and configures a software update deployment with a deadline and enables it for Wake on LAN.

For more information, see the following topics:

  • How to Enable or Disable Wake On LAN for a Site
  • Configuring Software Updates
  • How to Configure a Software Update Deployment for Wake On LAN

Mary conducts tests with representative network cards using standard build computers to see whether they will be woken up when turned off and then install the software update deployment.

Of her 10 test computers, only 1 is successfully woken up.

Mary consults the vendor information associated with the network cards and discovers that most of them cannot support wake-up if they are using unicast transmissions, but that all of them support Wake On LAN with subnet-directed broadcasts.

Mary changes the wake-up transmission method for the Configuration Manager site from the default of unicast to subnet-directed broadcast. This time, 8 of the 10 are successfully woken up and then install the software update deployment.

How to Configure Wake On LAN for Unicast or Subnet-Directed Broadcast

Mary investigates the 2 computers that are not woken up and references the specific documentation for those computers and network cards. She discovers that she needs to modify the BIOS setting on one computer and configure a driver option on the other:

  • Following the specific vendor's instructions for her computer, she configures the BIOS by pressing F2 when the computer starts up to enter BIOS Setup, selects the Power menu, changes the Wake on LAN option to Power On, and then presses F10 to save and exit the BIOS Setup.
  • Following the specific vendor's instructions for her network card, she configures the driver option by loading Device Manager, expanding the Network Adapters section, right-clicking the adapter, selecting Properties, clicking the Advanced tab, selecting Wake on LAN Options, clicking Properties, and then enabling the options Enable PME and Wake on Magic Packet for the Wake on Settings.

After these 2 computers are reconfigured, all 10 are successfully woken up.

Manual process that is specific to the computer and network card.

Important
Instructions for how to enable Wake On LAN will be different for different vendors. Check their instructions.

Mary concludes that implementing Wake On LAN for subnet-directed broadcast will be the most effective configuration for Woodgrove's business requirements and that she will need to factor in additional ad-hoc reconfiguration for a small percentage of computers.

Internal process that is company-specific.

Mary discusses her findings with other teams, including security advisors and the network team:

  • The security advisors agree that the business benefits of installing critical security updates in a timely fashion outweigh the security risks involved in implementing subnet-directed broadcasts, providing that a non-default port number is used and routers are configured to mitigate the risk associated with smurf attacks. They would have preferred to use unicast as the wake-up transmission method but understand that replacing all the existing network cards to support this method would not be feasible. The network has additional security controls to ensure that only authorized staff has access to it.
  • The network team validates that the bandwidth requirements are sustainable if the wake-up transmissions are sent outside office hours. They also agree to the security precautions for a non-default port number and for reconfiguring the routers.

For more information, see the following topics:

  • Determine If You Should Enable Wake On LAN
  • Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN
  • Determine the Ports Required by Firewalls to Support Wake-Up Packets for Wake On LAN
  • Secure Routers for Subnet-Directed Broadcasts for Wake On LAN

The following Requests for Change (RFCs) are submitted:

  • Routers will be configured to securely allow subnet-directed broadcasts.
  • All primary sites running Configuration Manager will be configured for Wake On LAN using subnet-directed broadcast and a non-default port number.
  • All critical software update deployments will be enabled for Wake On LAN and configured to install at 3 A.M.

The RFCs are granted, and the in-house security policy is updated.

Internal process that is company-specific.

Mary then talks to the desktop support engineers and build team to explain that implementing Wake On LAN might require reconfiguration of existing computers if they fail to wake up, and that supporting Wake On LAN might require consideration for new builds.

Determine Administrator Roles and Processes for Wake On LAN

When all the infrastructure changes are in place, Mary enables critical software update deployments for Wake On LAN and monitors deployment status closely.

About Software Updates Reports

As a result of this course of action, critical software updates are installed on 97% of computers after one week. This leaves a comfortable margin of one more week to track down and correct the 3% of desktop computers that failed to wake up, perhaps because their network card drivers were not configured for wake-up operation, the BIOS needed reconfiguring, or jumpers or wires needed to be configured correctly on the network card.

Using the combination of software updates with a deadline for the majority of computers, using Wake On LAN for the few computers that were turned off, and manual intervention for the minority of computers that remained non-compliant, Woodgrove Bank can now meet its compliance levels every month.

Installing Large Software Applications Overnight When the Company Policy Mandates That Workstations Must Be Turned Off to Reduce Electricity Costs

This scenario demonstrates how you can use Wake On LAN in Configuration Manager to save electricity costs by turning off computers outside office hours but continue to manage them without interruption to business continuity.

To save money on their electricity costs, A. Datum Corporation has a new company policy to shut down all computers at the end of the working day. Whereas users previously left their computers on for overnight maintenance, such as installing and upgrading software, now they are instructed to turn off their computers running Windows Vista before leaving the office. To enforce this management directive, Active Directory Group Policy is used to configure the power management options so that inactive workstations are automatically shut down after a sustained period of inactivity.

The challenge for the IT department is to continue to manage those computers with minimal interruption to users. An example is the requirement to upgrade to Office 2007 all the workstations running Office 2003. Users rely on Office applications to complete many of their day-to-day tasks, and their productivity would be seriously affected if these applications were not available throughout the day. After the IT department tests the upgrade deployment, they discover that the resulting installation package is several hundred megabytes and takes, on average, between 2 and 3 hours to install.

Because of the length of time to install the application and the impact on the network bandwidth, it is obviously preferable to perform the upgrade outside business hours. With the recent policy to turn off all workstations outside office hours, this deployment problem can be solved by implementing Wake On LAN.

Tommy Hartono is the Configuration Manager administrator responsible for delivering the upgrade package to desktops, and he decides on the course of action described in the following table.

Process Reference

Tommy reads the overview of Wake On LAN in Configuration Manager 2007 and realizes that mandatory software distribution advertisements can be enabled for Wake On LAN.

This would provide a solution to installing Office 2007 overnight without disrupting users or negatively impacting network bandwidth and distribution points during office hours.

Overview of Wake On LAN

He reads about the two different transmission methods that are available to send wake-up packets in Configuration Manager and makes inquiries with the network team about whether the company routers allow subnet-directed broadcasts.

The security team has mandated that routers will not allow the transmission of subnet-directed broadcast packets, even if they are reconfigured to mitigate the security risk.

To adhere to the in-house security policy, Tommy must use unicast as the wake-up transmission method, even if the success rate is lower than if using subnet-directed broadcast.
  • Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN

As a pilot test, Tommy enables a single primary site for Wake On LAN, creates a mandatory software distribution advertisement to install in an hour's time, enables the advertisement for Wake On LAN, and then targets a collection with a selected test computer.

He initiates a policy download for the test computer and then turns the computer off.

The computer wakes up and, a few minutes later, installs the advertisement.

After a successful proof of concept, Tommy widens his pilot test to five computers, configures a mandatory advertisement to install Office 2007 at midnight, and enables the advertisement for Wake On LAN.

For more information, see the following topics:

  • How to Enable or Disable Wake On LAN for a Site
  • How to Create an Advertisement
  • How to Assign a Mandatory Advertisement
  • How to Configure a Software Distribution Mandatory Advertisement for Wake On LAN
  • How to Initiate Policy Retrieval for a Configuration Manager Client

The following morning, Tommy discovers that one of the computers did not wake up. After conducting some tests, he concludes that the particular network card will not respond to unicast wake-up packets.

Tommy decides that this is an acceptable trade-off for a low percentage of computers and investigates the following alternative plans for the next business day if computers failed to wake up:

  • Targeting these computers to install at the end of business hours and instructing the user of this planned upgrade so that they do not work within this time period and do not turn off their computer.
  • Requesting a Group Policy exemption for these computers and instructing users to leave their computers on before going home on the allocated day.

Internal process that is company-specific.

The pilot and processes prove successful, so Tommy enables Wake On LAN for all his primary sites and installs Office 2007 overnight in a staged approach.

He monitors the success of the installation and follows up with individual computers that were targeted but did not begin the installation.

How to View the Status of an Advertisement

As a result of this course of action, the following objectives are met:

  • The majority of computers are always turned off outside business hours, which saves the company a considerable amount of money in electricity costs.
  • Business continuity is maintained because workstations are upgraded outside business hours.
  • Network bandwidth is not negatively impacted by installing large software packages during business hours.

Waking Up Computers to Install a New Operating System

This scenario demonstrates how you can use Wake On LAN in Configuration Manager to support the installation of an operating system deployment.

Coho Winery takes delivery of a new batch of computers. They have slightly different specifications, depending on which department requires them. However, they come with the company's current build, which is Windows XP Professional and the Configuration Manager client installed. Coho Winery wants to upgrade them to Windows Vista before they go into production, using a known operating system deployment image and task sequence.

Jenni Merriam is the Configuration Manager administrator, and she takes the course of action described in the following table.

Process Reference

Jenni uses the central site to provision new computers using the operating system deployment feature before they are deployed to users.

They are then checked by support engineers and taken to their final location.

Jenni enables Wake on LAN in the central site only and connects the new computers into the same network segment as the site server.

For more information, see the following topics:

  • Operating System Deployment in Configuration Manager
  • How to Enable or Disable Wake On LAN for a Site

The computers are turned on, the Configuration Manager client automatically assigns to the central site, and the client reports its hardware inventory back to the site.

Jenni confirms that all computers are operational and turns them off until they are needed for deployment.

How to Configure Hardware Inventory for a Site

Because there are no routers between the site server and the computers, there are no network devices to configure and the network impact of a subnet-directed broadcast would be contained to the single network segment.

For this reason, Jenni leaves the default transmission method of subnet-directed broadcast.

Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN

Jenni configures the mandatory task sequence advertisement associated with the operating system deployment to be enabled for Wake On LAN.

When a request comes in to deploy a specific computer, she moves it into the targeted collection.

How to Configure a Task Sequence Mandatory Advertisement for Wake On LAN

Within a few minutes, the targeted computer is woken up and it begins to upgrade using the Windows Vista image.

When the deployment is complete, Jenni checks that everything is operational:

  • If everything is satisfactory, the computer is sent to its final location where, so that it can be assigned to its correct operational site, it runs a script to uninstall the Configuration Manager client and reinstall it.
  • If there are any problems or issues with the upgrade, Jenni resolves these before the computer can be deployed.

Internal processes that are company-specific.

As a result of this course of action, the following objectives are met:

  • Computers are deployed with Windows Vista immediately, instead of waiting for the supplier image to be updated. Deploying Windows Vista early helps to reduce the total cost of ownership because it offers a more reliable and secure operating system than Windows XP.
  • The upgrade method is streamlined and provides a reliable process.
  • The network sustains a minimal increase in traffic that does not negatively impact business continuity.
  • The method of sending wake-up packets results in a high success rate without reconfiguration or incurring security risks.

See Also

Concepts

Prerequisites for Wake On LAN

Other Resources

Overview of Wake On LAN
Operating System Deployment in Configuration Manager
Software Distribution in Configuration Manager
Software Updates in Configuration Manager
Technical Reference for Wake On LAN


Application Compatibility Toolkit Connector in Configuration Manager

The Application Compatibility Toolkit Connector (ACT Connector) allows you to collect data and produce reports about computers and applications on your network that will assist with Windows Vista deployment planning.

The following topics are included in this section:

  • Overview of the Application Compatibility Toolkit Connector
  • Prerequisites for the Application Compatibility Toolkit Connector
  • Planning for the Application Compatibility Toolkit Connector
  • Configuring the Application Compatibility Toolkit Connector
  • Tasks for the Application Compatibility Toolkit Connector


Overview of the Application Compatibility Toolkit Connector

The Application Compatibility Toolkit Connector (ACT Connector) assists administrators with collecting the necessary computer and application compatibility information to help plan for a Windows Vista deployment.

The ACT Connector provides the following functionality:

  • Inventories installed software applications and creates reports that will assist with determining which applications are Windows Vista compatible.
  • Retrieves device driver compatibility for installed devices and creates reports that will assist with determining which device drivers will need to be upgraded to support the Windows Vista operating system.

Click any of the following links for more information:

Administrator Workflows for the Application Compatibility Toolkit Connector

Application Compatibility Toolkit Connector Terminology

About the Application Compatibility Toolkit Connector

  • About Feature Reports for the Application Compatibility Toolkit Connector

See Also

Other Resources

Application Compatibility Toolkit Connector in Configuration Manager


Administrator Workflows for the Application Compatibility Toolkit Connector

This section provides workflows that walk you through the basic tasks needed to use the Application Compatibility Toolkit Connector:

  • Application Compatibility Toolkit Connector Application Compatibility Workflow
  • Application Compatibility Toolkit Connector Device Driver Compatibility Workflow

See Also

Other Resources

Planning for the Application Compatibility Toolkit Connector


Application Compatibility Toolkit Connector Application Compatibility Workflow

This workflow represents the steps needed to evaluate Windows Vista application compatibility.

Important
You must have the Application Compatibility Toolkit installed to evaluate Windows Vista application compatibility.

Application Compatibility Workflow

See Also

Concepts

Application Compatibility Toolkit Connector Application Compatibility Checklist


Application Compatibility Toolkit Connector Device Driver Compatibility Workflow

This workflow represents the steps needed to evaluate Windows Vista device driver compatibility.

Device Driver Compatibility Workflow

See Also

Other Resources

Administrator Workflows for the Application Compatibility Toolkit Connector


Application Compatibility Toolkit Connector Terminology

The following terms are used when describing concepts and actions related to the Microsoft System Center Configuration Manager 2007 Application Compatibility Toolkit Connector (ACT Connector).

Application Compatibility Toolkit

The Microsoft Application Compatibility Toolkit (ACT) is a lifecycle management tool that assists in identifying and managing your overall application portfolio, reducing the cost and time involved in resolving application compatibility issues, and helping you quickly deploy Windows Vista. For more information about the Microsoft Application Compatibility Toolkit use the following link: http://go.microsoft.com/fwlink/?LinkId=91277

Log Processing Service

The ACT Log Processing Service transfers the Windows Vista compatibility information collected by the ACT data collection package.

Data Collection Package (DCP)

The ACT data collection package (DCP) is a package that must be installed on a Configuration Manager 2007 client computer to collect data that will be used by ACT to assess an application's compatibility with Windows Vista. The DCP package will remain on the target computer for configured amount of time specified when creating the DCP and it will then uninstall itself.

See Also

Other Resources

Overview of the Application Compatibility Toolkit Connector


About the Application Compatibility Toolkit Connector

The Application Compatibility Toolkit Connector (ACT Connector) is a Configuration Manager 2007 feature that enables administrators to determine the availability of device drivers that are required for Windows Vista and also determine the compatibility of applications with Windows Vista. By using the ACT Connector you can send a list of devices that is collected by Configuration Manager 2007 to Microsoft in order to obtain device driver availability information. Using the information provided by the ACT Connector, an administrator can determine what, if any, actions must be taken to get target computers compatible device drivers. The ACT Connector also provides information about the compatibility of applications with Windows Vista using the data collected by ACT.

Application Compatibility Toolkit Connector (ACT Connector)

The ACT Connector is a feature that is installed in the Configuration Manager 2007 administrator console and is used to assist with evaluating computers for Windows Vista operating system readiness. The ACT Connector can provide hardware readiness reports without any additional configuration. However if you plan to evaluate application readiness as part of your Windows Vista planning you will need to install the Application Compatibility Toolkit on your network.

For more information about installing the Configuration Manager 2007 ACT Connector use the following link: How to Install the Configuration Manager 2007 Application Compatibility Toolkit Connector.

Configuring the Application Compatibility Toolkit (ACT) Server

If you plan to evaluate Windows Vista application compatibility as part of your Windows Vista deployment planning you must install ACT and then install the Configuration Manager 2007 ACT Connector. For more information about configuring ACT on your network use the following link: http://go.microsoft.com/fwlink/?LinkId=91277

Data Collection Package

The data collection package (DCP) is a package that is created in ACT and then deployed to Configuration Manager 2007 computers. The DCP collects information about applications so that ACT can evaluate if the application is compatible with the Windows Vista operating system. For more information about deploying the DCP use the following link: How to Create the Application Compatibility Toolkit Connector Data Collection Package

ACT Connector Reports

The ACT Connector creates reports in the category Upgrade Assessment - Windows Vista. The reports are provided to assist in three primary areas:

  • Planning a Windows Vista deployment.
  • Gathering appropriate device drivers prior to deploying Windows Vista.
  • Assessing the installed applications prior to deploying the Windows Vista operating system.

The reports are available to help with planning a Windows Vista deployment and contain the following information:

  • Computers that meet Windows Vista system requirements.
  • Computers with devices installed that have Windows Vista compatible device drivers.
  • Computers with installed applications compatible with Windows Vista.

This information provides a high level analysis of hardware and application compatibility with Windows Vista. The reports display which device drivers are available either in the driver catalog or with Windows Vista. You can also create reports that will display the readiness of a specific Configuration Manager 2007 collection for Windows Vista. For more information about creating reports use the following link: How to Manage Application Compatibility Toolkit Connector Reports

See Also

Other Resources

Overview of the Application Compatibility Toolkit Connector


About Feature Reports for the Application Compatibility Toolkit Connector

Reports have been created for the Application Compatibility Toolkit in Configuration Manager 2007.

Use the following link for information about the available ACT Connector reports.

In This Section

Available Application Compatibility Toolkit Connector Reports

See Also

Concepts

Reporting in Configuration Manager
How to Create Application Compatibility Toolkit Connector Reports


Available Application Compatibility Toolkit Connector Reports

There are three application compatibility toolkit connector report categories, each with available reports that retrieve data used to accomplish a variety of objectives. This section describes each of the application compatibility toolkit connector reports by category.

Upgrade Assessment - Windows Server 2008

  • Windows Server 2008 Upgrade Assessment - Hardware summary for all computers in a specific collection
    This report returns information about amount of memory installed, available hard drive space, and the processor speed for each computer in the selected collection. This information is helpful with determining if the installed hardware meets the minimum system requirements for the Windows Server 2008 operating system.
Note
For computers that do not pass the operating system check you can still install Windows Vista; however, you will need to perform a full operating system installation.

  • Windows Server 2008 Upgrade Assessment - Hardware summary
    This report displays a summary of all computers in a specific collection that do not meet, meet, or exceed the minimum system requirements required to install Windows Server 2008.
  • Computers that meet the recommended system requirements for Windows Server 2008
    This report displays a summary of all computers in a collection that meet the recommended system requirements for Windows Server 2008.
  • Computers that meet the minimum system requirements for Windows Server 2008
    This report displays a summary of all computers in a collection that meet the minimum system requirements for Windows Server 2008.
  • Computers that do not meet the minimum system requirements for Windows Server 2008
    This report displays a summary of all computers in a collection that do not meet the minimum system requirements for Windows Server 2008.

Upgrade Assessment - Windows Vista

  • Windows Vista Upgrade Assessment - Hardware summary
    This report displays a summary of all computers in a collection that do not meet, meet, or exceed the minimum system requirements required to install Windows Vista.
  • Windows Vista Upgrade Assessment - Hardware summary for all computers in a specific collection
    This report returns information about amount of memory installed, available hard drive space, and the processor speed for each computer in the selected collection. This information is helpful with determining if the installed hardware meets the minimum system requirements required for Windows Vista.
  • Windows Vista Upgrade Assessment - Device driver per computer
    This report displays a summary of all device drivers installed on a computer and determines if the required device drivers are available with Windows Vista, a Windows update, or an external dynamic update. The report can also determine if the device driver is obsolete or if the device driver availability is unknown.
  • Windows Vista Upgrade Assessment - Device drivers available from a source external to Microsoft
    This report displays a summary of all computers in a specific collection that require device drivers available from a source external to Microsoft.
  • Windows Vista Upgrade Assessment - Device drivers compatible with Windows Vista
    This report displays a summary of all computers in a specific collection that already have device drivers installed that are compatible with Windows Vista.
  • Windows Vista Upgrade Assessment - Device drivers that are not available
    This report displays a summary of all device drivers in a specific collection that are no longer available, obsolete, or the device driver availability is unknown.
  • Application Compatibility Toolkit application status for a specific collection and a specific application
    This report displays computers in a specific collection with a specific application installed. The report also displays which of those applications are compatible with Windows Vista. This report is helpful with determining which applications will work with Windows Vista.
  • Minimum System Requirements, Compatible Device Driver Availability, and Application Status for Windows Vista for computers in a specific collection
    This report displays the computers in a specific collection that meet the minimum system requirements for processor speed, hard drive space, and installed memory. This report is helpful with identifying computers that meet the system requirements to install Windows Vista.
  • Application Compatibility Toolkit application status for a specific computer
    This report displays the applications installed on a computer and indicates the Application Compatibility Toolkit status associated with each application. This report is helpful with determining which applications are compatible with Windows Vista.
  • Minimum system requirements and compatible device driver availability for Windows Vista for computers in a specific collection
    This report displays the computers in a specific collection and indicates if the minimum processor speed, hard drive space, and installed memory requirements are met. The report also indicates if the needed device drivers are available with Windows Vista or in the driver catalog.
  • Application Compatibility Toolkit application status for a specific collection
    This report displays the applications currently installed on computers in the selected collection. The report also displays the Application Compatibility Toolkit status for each application. This report is useful with determining which applications are compatible with Windows Vista.
  • Application Compatibility Toolkit application status for a specific collection with a specified status
    This report displays all computers in a specific collection with a specified My Assessment status.
  • Computers that meet the recommended system requirements for Windows Vista
    This report displays all computers in a specific collection which meet or exceed the recommended system requirements for processor speed, hard drive space, and installed memory for Windows Vista.
  • Computers that meet the minimum system requirements for Windows Vista
    This report displays all computers in a specific collection which meet the minimum recommended system requirements for processor speed, hard drive space, and installed memory for Windows Vista.
  • Computers that do not meet the minimum system requirements for Windows Vista
    This report displays all computers in a specific collection that do not meet the minimum recommended system requirements for processor speed, hard drive space, and installed memory for Windows Vista.
  • Availability of required device drivers for a specific collection for a specific device
    This report displays the specific device driver requirements for a specific device installed on a computer in a specific collection.
  • Availability of device drivers in the driver catalog for a specific computer
    This report displays the availability of device drivers in the driver catalog that are required by a computer for a specific device. This report is helpful with determining which device drivers must be added to the driver catalog and added to a driver package and copied to a distribution point.
  • Availability of required device drivers for a specific collection for a specific device
    This report displays the specific device driver requirements for a specific device installed on a computer in a specific collection.
  • Recommended System Requirements, Compatible Device Driver Availability, and Application Status for Windows Vista for computers in a specific collection
    This report displays the computers in a specific collection that meet the recommended system requirements for processor speed, hard drive space, and installed memory. This report is helpful with identifying computers that meet the system requirements to install Windows Vista.
  • Availability of device drivers required in the driver catalog for a specific collection
    This report displays the devices installed in a specified collection and indicates if the device driver is available with Windows Vista. If the device driver is not available with Windows Vista the report will indicate if the required device driver is available in the driver catalog or the location where the device driver is available.
  • Recommended System Requirements and Compatible Device Driver Availability for Windows Vista, and Application Status for computers in a specific collection
    This report displays the computers in a specific collection that meet the recommended system requirements for processor speed, hard drive space, and installed memory. This report is helpful with identifying computers that meet the system requirements to install Windows Vista.

See Also

Concepts

Reporting in Configuration Manager
How to Create Application Compatibility Toolkit Connector Reports


Prerequisites for the Application Compatibility Toolkit Connector

The following sections describe the external and internal prerequisites or dependencies that are required for the Configuration Manager 2007 Application Compatibility Toolkit Connector.

Dependencies External to Configuration Manager 2007

Dependency More Information

Application Compatibility Toolkit (ACT)

If you plan to capture application compatibility information as part of your Windows Vista upgrade planning you will need to setup ACT.

The Microsoft Application Compatibility Toolkit (ACT) is a lifecycle management tool that assists in identifying and managing your overall application portfolio, reducing the cost and time involved in resolving application compatibility issues, and helping you quickly deploy Windows Vista and Windows updates. Fore more information about the Microsoft Application Compatibility Toolkit use the following link: http://go.microsoft.com/fwlink/?LinkId=91277

Configuration Manager 2007 Dependencies

See Also

Other Resources

Overview of the Application Compatibility Toolkit Connector


Planning for the Application Compatibility Toolkit Connector

Use the following links for more information about configuring the Configuration Manager 2007 site for using the Application Compatibility Toolkit Connector (ACT Connector).

In This Section

Prepare the Configuration Manager Site for the Application Compatibility Toolkit Connector Checklist

Application Compatibility Toolkit Connector Application Compatibility Checklist


Prepare the Configuration Manager Site for the Application Compatibility Toolkit Connector Checklist

The following checklists include the tasks required for using the Application Compatibility Toolkit Connector (ACT Connector).

Identifying Installed Applications

Use the following procedure to identify the applications that are currently installed on computers on the network. The Application Compatibility Connector (ACT) will use the information collected to create a list of all applications that will be evaluated for Windows Vista compatibility.

Important
Before you deploy the data collection package you should configure and run a Configuration Manager 2007 hardware inventory. For more information about using Configuration Manager 2007 inventory see: Inventory in Configuration Manager

Task Reference

Create the Inventory Data Collection Package (DCP)
  • You must create an ACT data collection package (DCP) to inventory existing software applications that are installed on computers in the Configuration Manager 2007 site. For more information about creating the inventory DCP see: How to Create the Application Compatibility Toolkit Connector Data Collection Package.

Document the log processing share
  • Document the share location specified for Where to output collected data. This is the location where log files will be accessed by ACT when evaluating the collected information. The location specified is a network share configured when you setup ACT.

Distribute the DCP to Configuration Manager 2007 computers
  • Distribute the DCP to Configuration Manager 2007 computers using Configuration Manager 2007 software distribution. For more information about using Configuration Manager 2007 software distribution see: Software Distribution in Configuration Manager

Determining Application Compatibility

Use the following procedure to evaluate the applications installed on specific computers in a Configuration Manager 2007 collection.

Task Reference

Create the Inventory Data Collection Package (DCP)
  • You must create an ACT data collection package that will be distributed to each computer you want to evaluate. The first DCP you create will inventory all applications that are currently installed. When you create this ACT package select Inventory Selector.

Create the Windows Vista Compatibility Evaluator DCP
  • You must create a second DCP that will be used to collect information about installed applications on specific computers. When you create this ACT package select Windows Vista Compatibility Evaluator.

Distribute the DCP to Configuration Manager 2007 computers
  • You must distribute the DCP to Configuration Manager 2007 computers that have the applications installed you want to evaluate for compatibility. For more information about using Configuration Manager 2007 software distribution see Software Distribution in Configuration Manager.

See Also

Other Resources

Configuring the Application Compatibility Toolkit Connector


Application Compatibility Toolkit Connector Application Compatibility Checklist

The following checklist includes the tasks you perform to prepare the Configuration Manager 2007 environment for assessing Windows Vista application compatibility.

Important
You must have the Application Compatibility Toolkit (ACT) installed to evaluate Windows Vista application compatibility.

Task Reference

Install the Configuration Manager 2007 Application Compatibility Toolkit Connector (ACT Connector).

You must install the Configuration Manager 2007 ACT Connector if you plan to evaluate computers in your site for Windows Vista compatibility.

For more information about how to install the Configuration Manager 2007 ACT Connector, see How to Install the Configuration Manager 2007 Application Compatibility Toolkit Connector.

Configure the ACT Server.

You must configure the Configuration Manager 2007 ACT Connector so that Configuration Manager 2007 can view the application compatibility assessments generated by ACT.

For more information about configuring the ACT Connector so that it can read information collected by ACT, see How to Configure the Application Compatibility Toolkit Connector.

Establish how many computers you plan to evaluate for Windows Vista compatibility and create a collection.

You must decide how many computers you plan to evaluate for Windows Vista compatibility.

If you plan to evaluate less than five thousand computers you can create a Configuration Manager 2007 collection that contains the computers you plan to evaluate.

If you plan to evaluate more than five thousand computers you can create a Configuration Manager 2007 collection that performs an application inventory. It is recommended that the collection contain less than 50,000 computers so that ACT can process collected information in approximately seven days. For more information about Configuration Manager 2007 collections see: Collections Overview. To perform the application inventory, you must also create an ACT data collection package with only the Inventory Evaluator enabled. Use Configuration Manager 2007 software distribution to distribute the ACT package to the computers you plan to evaluate.

Once the inventory information has been collected, create a Configuration Manager 2007 collection that contains 5,000 or fewer that have a representative sample of applications installed that you want to evaluate.

Create an ACT data collection package with the Windows Vista Compatibility Evaluator enabled.

You must create an ACT data collection package with the Windows Vista Compatibility Evaluator enabled so that ACT can assess Windows Vista application compatibility. You can use Configuration Manager 2007 software distribution to distribute the ACT data collection package. Using the default ACT data collection package settings of a three-day duration and uploading data every eight hours on a collection with 5,000 computers, you may find that it takes approximately seven days for ACT to process the collected data.

For more information about creating the ACT data collection package, see How to Create the Application Compatibility Toolkit Connector Data Collection Package.

Review the Application Compatibility Toolkit Connector Reports.

You can review the Windows Vista application compatibility information in Configuration Manager 2007 by viewing the ACT Connector reports Located in the category Upgrade Assessment - Windows Vista. You should allow several days for the application compatibility information to be evaluated. This period of time will depend on the number of computers receiving the ACT data collection package with the Vista Compatibility Evaluator enabled as well as the duration and data upload schedule of the data collection package. For more information about the ACT Connector reports, see How to Manage Application Compatibility Toolkit Connector Reports.

Create a new Windows Vista collection.

You should use the New Windows Vista Collection Wizard to create a collection that contains the computers you plan to upgrade to Windows Vista.

For more information about creating a New Windows Vista collection, see How to Create a Custom Collection for Windows Vista Deployment.

See Also

Concepts

Application Compatibility Toolkit Connector Application Compatibility Workflow


Configuring the Application Compatibility Toolkit Connector

To configure a site for the application compatibility toolkit connector, you may need to perform certain tasks.

Click any link in the following section for information about configuring your Configuration Manager 2007 site for using the Application Compatibility Toolkit Connector.

In This Section

How to Install the Configuration Manager 2007 Application Compatibility Toolkit Connector

How to Uninstall the Application Compatibility Toolkit Connector

How to Create the Application Compatibility Toolkit Connector Data Collection Package

How to Configure the Application Compatibility Toolkit Connector

How to Manage Windows Vista Custom Collections

See Also

Other Resources

Application Compatibility Toolkit Connector in Configuration Manager


How to Install the Configuration Manager 2007 Application Compatibility Toolkit Connector

The Application Compatibility Toolkit Connector (ACT Connector) is a tool that assists with assessing Windows Vista deployment readiness. After the ACT connector is installed a node is created in the Configuration Manager 2007 administrator console.

Use the following procedure to install the ACT Connector:

Procedures

To install the ACT Connector

  1. Install and configure a Configuration Manager 2007 site.

  2. Insert the Configuration Manager 2007 installation media and select System Center Configuration Manager Application Compatibility Toolkit Connector from the autorun screen, or start Setup.exe from the Configuration Manager installation media, or from a copy of the installation media located on a network share or other storage media to start the System Center Configuration Manager Application Compatibility Toolkit Connector.

  3. On the Welcome page click Next.

  4. On the License agreement page select I accept the license agreement and click Next.

  5. On the Installation page click Next to start the installation. If you want to review the installation information you specified on previous pages, click Back.

  6. Click Finish to complete the Configuration Manager 2007 Application Compatibility Toolkit Connector installation.

See Also

Other Resources

Configuring the Application Compatibility Toolkit Connector


How to Uninstall the Application Compatibility Toolkit Connector

Use the following procedure to uninstall the Application Compatibility Toolkit Connector (ACT Connector) from a Configuration Manager 2007 computer.

Procedure

To uninstall the ACT Connector

  1. Navigate to Add or Remove Programs in the Control Panel of the Configuration Manager 2007 client computer.

  2. To uninstall the ACT Connector, select Application Compatibility Toolkit Connector, and click Remove.

  3. In the Warning dialog box click Continue.

  4. To complete the uninstall click Yes to remove the Application Compatibility Toolkit Connector (ACT Connector).

See Also

Other Resources

Configuring the Application Compatibility Toolkit Connector


How to Create the Application Compatibility Toolkit Connector Data Collection Package

If you plan to inventory application compatibility as part of the Windows Vista deployment planning you will need to setup an application compatibility toolkit server and deploy ACT Data Collection Packages (DCP) to the computers you want to evaluate. The Inventory DCP is used to inventory all applications installed on your network. The Windows Vista Compatibility Evaluator is used to inventory applications installed on a specific computer.

You must configure the ACT data collection packages using ACT.

Select the following evaluators when configuring the ACT DCP's:

  • Inventory Collector. Provides an inventory of installed software.
  • Windows Vista Compatibility Evaluator. Provides potential application compatibility issue details relating to the use of Graphical Identification and Authentication (GINA) DLLs, to services running in Session 0 in a production environment, and to any application components deprecated in the Windows Vista operating system.

Fore more information about configuring and deploying the data collection packages use the following link: http://go.microsoft.com/fwlink/?LinkId=91593

See Also

Concepts

How to Deploy the Application Compatibility Toolkit Data Collection Package

Other Resources

Configuring the Application Compatibility Toolkit Connector


How to Configure the Application Compatibility Toolkit Connector

The Application Compatibility Toolkit (ACT) log processing service uses collected compatibility information to help determine Windows Vista deployment readiness. You can configure where the collected compatibility data will be stored and accessed by ACT.

Use the following procedure to configure the ACT Connector:

Procedure

To configure the ACT Connector

  1. In the Configuration Manager console, navigate to
    System Center Configuration Manager / Site Database / Computer Management / Application Compatibility Toolkit Connector / ACT

  2. To open the properties of the ACT server right-click the ACT server in the results pane and select Properties. Alternatively you can select Configure ACT Server in the Actions pane or click the Actions menu and select Configure ACT Server.

  3. To specify the Microsoft SQL server that contains the ACT database type the name of the server and click the Connect button. Alternatively, you can click the drop down and select Browse for more to open the Select Server dialog box. Select the server you want to use and click OK.

  4. Specify the ACT Database to connect to using the drop down and selecting the database.

  5. To close the ACT Configuration properties dialog box, click OK.

See Also

Other Resources

Configuring the Application Compatibility Toolkit Connector


How to Manage Windows Vista Custom Collections

You can create custom Configuration Manager 2007 collections based on Windows Vista application and hardware system requirements.

Click any link in the following section for more information.

In This Section

How to Create a Custom Collection for Windows Vista Deployment

How to Update an Existing Windows Vista Custom Collection


How to Create a Custom Collection for Windows Vista Deployment

Use the New Windows Vista Deployment Collection Wizard to create a static Configuration Manager 2007 collection that will contain only computers that meet an administrator's specified criteria. You can then create and assign a Windows Vista operating system image to the new custom collection. For more information about creating an operating system image, see Planning for Operating System Deployment

You do not need to specify any selection criteria to complete this wizard. However, if you do not specify any selection criteria the collection will contain no members. Use the following procedure to create custom collection to deploy the Windows Vista operating system.

Procedures

To create a custom collection for a Windows Vista deployment

  1. In the Configuration Manager console, navigate to
    System Center Configuration Manager / Site Database / Computer Management / Application Compatibility Toolkit Connector.

  2. In the Actions pane, select New Windows Vista Deployment Collection to open the New Windows Vista Deployment Collection Wizard. You can also click Actions, and then click New Windows Vista Deployment Collection.

  3. On the General page, in the Name box, type a unique name for the new collection. Also provide an optional comment that will be used to identify this collection in the Comment window. Click Next.

  4. Use the Selection Criteria page to specify the Windows Vista system requirements that must be met to be included in this collection. Click Browse to open the Browse Collection dialog box and select the collection that will be searched for computers that meet the requirements specified. Select the collection and click OK. You can also configure the following requirements that must be met to be included in the new collection:

    1. System Requirements - Select this option to define the collection membership requirements for the general Windows Vista system requirements. If member computers must meet the minimum system requirements, select Minimum System Requirements. If the member computers must meet the recommended system requirements for Windows Vista, select Recommended System Requirements.
    2. Device Driver Availability - Select this option to define the collection membership requirements for device driver availability. If only computers that require device drivers contained with the Windows Vista installation should be added, select Available in Windows Vista. To include computers that can obtain device drivers from the driver catalog or contained with the Windows Vista installation, select Available in the driver catalog or in Windows Vista.
    3. Application Compatibility Toolkit (ACT) Status - Select this option to define the collection membership requirements based on ACT application status. To include only computers that do not have any known Windows Vista application compatibility issues according to ACT, select Ready. To include computers with known minor Windows Vista application compatibility issues and no known Windows Vista application compatibility issues, select Minor Issues and Ready.
    4. Click Next.

  5. On the Security page specify the security rights that will be assigned to this collection, and click Next to complete the wizard.

  6. On the Confirmation page, click Close to close the wizard.

See Also

Other Resources

Tasks for the Application Compatibility Toolkit Connector


How to Update an Existing Windows Vista Custom Collection

You cannot update the membership rules associated with a Windows Vista collection because the New Windows Vista collections you create are static. If you want to evaluate a new collection you must create a new Windows Vista collection.

See Also

Concepts

How to Create a Custom Collection for Windows Vista Deployment


Tasks for the Application Compatibility Toolkit Connector

The links in this section provide the necessary information to complete each associated application deployment toolkit connector task.

In This Section

How to Deploy the Application Compatibility Toolkit Data Collection Package

How to Run a Device Driver Synchronization Package

How to Manage Application Compatibility Toolkit Connector Reports

See Also

Other Resources

Application Compatibility Toolkit Connector in Configuration Manager


How to Deploy the Application Compatibility Toolkit Data Collection Package

After you have created the Application Compatibility Toolkit (ACT) data collection package (DCP) you must deploy the DCP to the Configuration Manager 2007 collection that contain the computers you plan to evaluate.

You must select the appropriate method to deploy the DCPs. The following list displays the methods you can choose from:

  • Configuration Manager 2007 software distribution. Use the software deployment feature in Configuration Manager 2007 to deploy the DCPs to Configuration Manager 2007 client computers. The only requirement is that the computers must be Configuration Manager 2007 clients. For more information about using Configuration Manager 2007 software distribution use the following link: Software Distribution in Configuration Manager
  • Group Policy Software Installation. Use the Group Policy Software Installation feature of Active Directory in Windows Server 2003 and Windows 2000 Server to deploy the DCPs. The only requirement is that the client computers must belong to the Active Directory forest. To use Group Policy to distribute the DCPs, create an .msi package for each DCP.
  • Logon scripts. Use logon scripts in Windows Server 2003 and Windows 2000 Server to initiate the installation of the DCPs. The only requirement is that a user must log on to a domain from the client computers.
  • Non-Microsoft deployment software. If the organization has a non-Microsoft software deployment infrastructure, use that method to deploy the DCPs. For information on the requirements of the non-Microsoft deployment software, consult the software vendor.
  • Manual distribution. For computers that either are not connected to the network or have slow network connections, such as small branch offices, manual distribution methods are available. These methods include distributing the collection packages through e-mail or on physical media such as a USB flash device or CD.

The method you use for deploying the data collection package is largely based on the existing infrastructure. The preference of deployment methods is as follows:

  • If the organization has a Configuration Manager 2007 infrastructure, Configuration Manager 2007 is the most appropriate method for deploying the data collection package.
  • If the organization has an Active Directory infrastructure, use Group Policy Software Installation.
  • If the organization has an identity and authentication infrastructure other than Active Directory, such as Windows domains, use logon scripts.
  • When the software deployment infrastructure is based on a non-Microsoft product, use that method.

Fore more information about configuring and deploying the data collection packages use the following link: http://go.microsoft.com/fwlink/?LinkId=91593

See Also

Concepts

How to Create the Application Compatibility Toolkit Connector Data Collection Package

Other Resources

Configuring the Application Compatibility Toolkit Connector


How to Run a Device Driver Synchronization Package

You can gather Windows Vista device driver compatibility information by running a device driver status synchronization. When you select Run Device Driver Status Synchronization Configuration Manager 2007 will receive device driver compatibility information from the Microsoft Corporation and the Application Compatibility Toolkit community to help determine device driver Windows Vista compatibility.

Use the following procedure to run a driver status synchronization:

Important
Before you run the device driver synchronization you must perform a Configuration Manager 2007 hardware inventory. For more information about performing a hardware inventory see How to Configure Hardware Inventory for a Site.

Procedure

To run a device driver status synchronization

  1. In the Configuration Manager console, navigate to
    System Center Configuration Manager / Site Database / Computer Management / Application Compatibility Toolkit Connector

  2. To run the driver status sync, click Run Device Driver Synchronization in the Actions pane. Alternatively, use the Actions menu and select Run Device Driver Status Synchronization.

  3. To initiate the synchronization. Click Run.

See Also

Other Resources

Tasks for the Application Compatibility Toolkit Connector


How to Manage Application Compatibility Toolkit Connector Reports

You can create and view Application Compatibility Toolkit Connector reports.

Select any of the following links for more information about managing Application Compatibility Toolkit Connector reports.

In This Section

How to Create Application Compatibility Toolkit Connector Reports

How to View Application Compatibility Toolkit Connector Reports

See Also

Other Resources

Tasks for the Application Compatibility Toolkit Connector


How to Create Application Compatibility Toolkit Connector Reports

You can create new Application Compatibility Toolkit Connector reports in Configuration Manager 2007.

Use the following procedure to create a new report in Configuration Manager 2007.

Procedure

To create a new report

  1. In the Configuration Manager console, navigate to
    System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. Right-click Reports, point to New, and then click Report to open the Report Properties dialog box.

  3. Click the General tab, and then specify the following:

    • Name. Specifies the name of the report. The report name must be unique within the report category. This is a required setting.
    • Category. Specifies the category for the report. Categories are case sensitive and, unless a new category is being created for the report, it is recommended that the category be selected from the Category drop-down list. Select any of the following categories: Upgrade Assessment - Windows Server 2008, Upgrade Assessment - Windows Vista or Upgrade Assessment - Windows XP. This is a required setting.
    • Comment. Specifies a description for the report. This is an optional field that helps to describe the purpose of the report.
    • SQL statement. Specifies the SQL statement used to retrieve the report data. Click Edit SQL Statement to create the SQL statement that will retrieve the desired data. For more information about creating SQL statements for reports, see SQL Query Statement Reference. This is a required setting.
    • Prompts. Allows you to create a report prompt. For more information about creating report prompts, see How to Create or Modify Report Prompts.

  4. Click Next, on the Display page to configure whether the data in the report is automatically updated and whether to provide a chart for the report.

  5. Click Next, and then on the Links tab, specify one of the following:

    • No Link. Specifies that a link is not configured.
    • Link to another report. Specifies that a link to another report is configured. Click Select to specify the target report from the Select Report dialog box. If the target report requires prompts, you must specify the column from the source report that will be used to provide the data for each prompt in the target report. To configure the column, double-click a prompt, type the column number in the Column text box, and then click OK.
    • Link to Computer Details. Specifies that a link to computer details is configured. The source report must contain a column that contains the computer name. In the Computer name column text box, specify the column that contains the computer name, and then click OK.
    • Link to Status Message Details. Specifies that a link to status message details is configured. The source report must contain a column that specifies a status message record ID. In the Record ID column text box, specify the column that contains the status record ID, and then click OK.
    • Link to URL. Specifies that a link to a URL resource is configured. Specify the URL in the URL text box, and then click OK.

  6. Click Next.

  7. On the Security page specify the security rights that should be assigned to this report, and then click Next.

  8. On the Wizard Completed page, click Close to exit the New Report Wizard.

See Also

Concepts

Reporting in Configuration Manager

Other Resources

How to Manage Application Compatibility Toolkit Connector Reports


How to View Application Compatibility Toolkit Connector Reports

Reports in Configuration Manager 2007 are opened in Report Viewer, which can be opened from the Configuration Manager console. Reports can be opened from any computer that has access to a reporting point for the site and for users that have sufficient rights to view the reports. For more information about the security rights needed to view reports, see Reporting Security Best Practices.

Important
You must have an existing Configuration Manager 2007 reporting point to run and view reports. For more information about configuring Configuration Manager 2007 reporting, see Configuring Reporting

Use the following procedures to open an application compatibility toolkit connector report from the Configuration Manager console.

Procedure

To run a report from the Configuration Manager console

  1. In the Configuration Manager console, navigate to
    System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports results pane, sort the existing reports by category by clicking the Category column heading, and then locating the group named Upgrade Assessment reports.

  3. Right-click the name of the report that you want to run, and then click Run.

  4. In the Report Options dialog box, use the drop down to specify the default reporting point for reports that run from the home page. To open a new window to view the report, select Open a new window when running reports form the home page, and then click OK

See Also

Concepts

Reporting in Configuration Manager

Other Resources

How to Manage Application Compatibility Toolkit Connector Reports


Application Compatibility Toolkit Connector Privacy Information

This feature enables Microsoft System Center Configuration Manager 2007 administrators to send a list of devices identified by Configuration Manager 2007 to Microsoft to obtain the device driver status for the Windows Vista® operating system.

If the Application Compatibility Toolkit Connector is installed, the Configuration Manager 2007 administrator can choose to run Driver Status Synchronization in the Configuration Manager 2007 console. This selection initiates a one-time synchronization such that a list of devices found in the environment will be sent to the Microsoft and status of the drivers for the devices will be returned to Configuration Manager 2007. The status indicates if there is a device driver available that is compatible with Windows Vista.

The upload data contains no information that will be used to identify you or the computers in your company.

See Also

Other Resources

Application Compatibility Toolkit Connector in Configuration Manager
Security Best Practices and Privacy Information for Configuration Manager Features


Troubleshooting the Application Compatibility Toolkit Connector

This section provides information to help troubleshoot the Application Compatibility Toolkit Connector feature in Configuration Manager 2007. This content might have been updated. For the most recent content, see http://go.microsoft.com/fwlink/?LinkId=93779.

Application Compatibility Toolkit (ACT) Reports Are Not Removed When you Upgrade ACT

When you upgrade ACT, some ACT reports are not removed by default.

Solution

You can manually delete the unnecessary reports.


Out of Band Management in Configuration Manager 2007 SP1

Topic last updated—March 2008

The Configuration Manager 2007 SP1 out of band management feature allows you to manage desktop computers independently from the Configuration Manager client or the computer operating system.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Overview of Out of Band Management

Provides an overview of the out of band management feature in Configuration Manager 2007 SP1 and related conceptual information.

Prerequisites for Out of Band Management

Lists the external and product dependencies for the out of band management feature.

Planning for Out of Band Management

Provides planning information for the out of band management feature

Configuring Out of Band Management

Provides the configuration tasks to configure out of band management.

Tasks for Out of Band Management

Provides a set of tasks to perform out of band management objectives.

Out of Band Management Security Best Practices and Privacy Information

Provides security and privacy information and best practices for out of band management.

Troubleshooting Out of Band Management

Provides troubleshooting information for out of band management.

Technical Reference for Out of Band Management

Provides technical references for out of band management.

See Also

Other Resources

Configuration Manager 2007 Features


Overview of Out of Band Management

Topic last updated—May 2008

Out of band management in Configuration Manager 2007 SP1 provides powerful management control for computers that have the Intel vPro chip set and Intel Active Management Technology (Intel AMT) firmware versions 3.2.1 or later.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Out of band management allows an administrator to connect to a computer's management controller when the computer is turned off, in sleep or hibernate modes, or otherwise unresponsive through the operating system. By way of contrast, in-band management is the classic approach used by Configuration Manager and its predecessors whereby an agent runs in the full operating system on the managed computer and the management controller accomplishes tasks by communicating with the management agent.

Out of band management supplements in-band management. While in-band management supports a wider range of operations because its environment is the full operating system, in-band management might not be functional if the operating system is not present or is not operational. In these situations, the supplementary capabilities of out of band management allow administrators to manage these computers without requiring local access to the computer.

Out of band management tasks include the following:

  • Powering on one or many computers (for example, for maintenance on computers outside business hours).
  • Powering off one or many computers (for example, the operating system stops responding).
  • Restarting a nonfunctioning computer or booting from a locally connected device or known good boot image file.
  • Re-imaging a computer by booting from a boot image file that is located on the network or by using a PXE server.
  • Reconfiguring the BIOS settings on a selected computer (and bypassing the BIOS password if this is supported by the BIOS manufacturer).
  • Booting to a command-based operating system to run commands, repair utilities, or diagnostic applications (for example, upgrading the firmware or running a disk repair utility).
  • Configuring scheduled software update deployments and advertisements to wake up computers prior to running.

For example scenarios of how out of band management can be used, see Example Scenarios for Using Out of Band Management.

Some of the preceding tasks are performed from the Configuration Manager console, while others require running the out of band management console that is supplied with Configuration Manager 2007 SP1. Out of band management uses Windows remote management technology (WS-MAN) to connect to the management controller on a computer.

Note
Out of band management is not supported for clients that are managed over the Internet with Internet-based client management. Additionally, Configuration Manager clients that are blocked by the Configuration Manager infrastructure continue to accept out of band management communication.

The following table outlines the new options and features that out of band management provides in Configuration Manager 2007 SP1.

Feature or Scenario More Information

Security-based management

Out of band management integrates with an internal public key infrastructure (PKI), using the following certificates:

  • A provisioning certificate that is installed on the out of band service point that allows computers to be configured for out of band management.
  • A Web server certificate that is installed on each computer that will be managed out of band so that communication is authenticated and is encrypted using Transport Layer Security (TLS).

Administrators must be authenticated using Kerberos before they can manage computers out of band.

Out of band management activity is recorded and auditable.

AMT provisioning

Enables and configures AMT-based computers for out of band management. Supported scenarios include the following:

  • Automatic provisioning out of band for new computers that do not have the Configuration Manager 2007 SP1 client installed.
  • Automatic provisioning in-band for computers running the Configuration Manager 2007 SP1 client.

For more information, see the following topics:

  • How to Provision Computers for AMT
  • Example Scenarios for Implementing Out of Band Management

Enhanced inventory data

Provides hardware inventory data from the AMT chip, such as asset tag, BIOS UUID, power state, processor, memory, and drive information.

Enhanced network discovery method

Identifies computers with a management controller and its provisioning status.

This information can be used to build query-based collections to group computers for out of band management activities, such as provisioning and power control.

For more information, see How to Discover Computers with Management Controllers.

Power control

Enables power on, power off, and restart capabilities for a single computer or selected computers in a collection.

Computers can also be woken up by scheduled mandatory advertisements and software update deployments with a deadline.

For more information, see the following topics:

  • How to Power Off a Computer Using Out of Band Management
  • How to Power On or Restart a Computer Using Out of Band Management

Out of band management console

A dedicated management console that is run from the Configuration Manager console or from a command prompt to initiate out of band management tasks, including IDE redirection and serial-over-LAN sessions.

Note
Capabilities might vary depending on the manufacturer of the managed computer. For example, IDE redirection and serial-over-LAN capability can be disabled by the manufacturer.

For more information, see the following topics:

  • How to Run the Out of Band Management Console
  • Out of Band Management Console

IDE redirection

Enables the computer to boot from a boot image file or locally connected device rather than from its disk IDE interface. This is useful for diagnosing, repairing, or imaging a hard drive.

Serial over LAN

Serial-over-LAN technology encapsulates the data from a virtual serial port and sends it over the existing network connection established by the out of band management console.

This allows you to run a terminal emulation session for the managed computer, in which you can run commands and character-based applications. For example, this might include reconfiguring the BIOS or, working in conjunction with IDE redirection, you can update the firmware or run diagnostic utilities.

For more information, see the following topics:

  • How to Configure BIOS Settings for a Computer Using Out of Band Management
  • How to Update the Firmware for a Computer Using Out of Band Management
  • How to Run Commands, Repair Utilities, and Diagnostic Applications for a Computer Using Out of Band Management

For more in-depth information about using out of band management in Configuration Manager 2007 SP1, see the following topics in this section:

  • Certificate Requirements for Out of Band Management—Lists the public key infrastructure (PKI) certificate requirements to run out of band management in Configuration Manager 2007 SP1.
  • About Certificates for Out of Band Management—Provides information about the deployment and usage of the PKI certificates used with out of band management.
  • About AMT Provisioning for Out of Band Management—Provides information about provisioning computers for AMT, which is a necessary procedure before computers can be managed out of band.
  • About Reports for Out of Band Management—Lists the reports that are available for working with out of band management.
  • About the AMT Status and Out of Band Management—Lists the values, descriptions, and queries for the AMT status that is displayed in the Configuration Manager console and reports.
  • Administrator Checklist: Enabling Out of Band Management—Provides the administration steps required to enable out of band management for a site.

See Also

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Certificate Requirements for Out of Band Management

Topic Last Updated—August 2008

The information in this topic assumes basic knowledge of PKI certificates. For more information about Microsoft PKI solutions, see the following references:

  • Active Directory Certificate Services in Windows Server 2008: http://go.microsoft.com/fwlink/?LinkId=115018
  • Certificate Services in Windows Server 2003: http://go.microsoft.com/fwlink/?LinkId=78389
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This PKI solution requires Microsoft Certificate Services using certificate templates that are issued by an enterprise certification authority. Template-based certificates can be issued only by an enterprise certification authority running on the Enterprise Edition or on the Datacenter Edition of Windows Server 2003 or Windows Server 2008. However, do not use version 3 templates (Windows Server 2008, Enterprise Edition). These certificate templates create certificates that are not compatible with Configuration Manager. For more information about the certificate deployment and usage, see About Certificates for Out of Band Management.

For example step-by-step configuration for these certificates, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

Important
These certificate requirements must be met before you can use out of band management in a Configuration Manager 2007 SP1 site.

Certificates Required for Out of Band Management

The public key infrastructure (PKI) certificates required for Configuration Manager 2007 SP1 out of band management are listed in the following table.

Configuration Manager Component Certificate Use Microsoft Certificate Template to Use Specific Information in Certificate How the Certificate Is Used in Configuration Manager

Out of band service point

AMT Provisioning

Web server (modified)

The server hosting the out of band service point site system role requires the Windows security permission of Read and Enroll for this certificate template.

Enhanced Key Usage value must contain Server Authentication (1.3.6.1.5.5.7.3.1) and the following object identifier: 2.16.840.1.113741.1.2.3.

The subject name field must contain the fully qualified domain name (FQDN) of the server hosting the out of band service point.

Supported key lengths: 1024, 1536, and 2048 bits.

This certificate resides in the Windows Personal store in the Computer certificate store of the out of band service point site system server.

This AMT provisioning certificate is used to prepare computers for out of band management. It is configured in the out of band management component and then automatically installed on the out of band service point site system server.

You must request this certificate from a certification authority that supplies AMT provisioning certificates, and the BIOS extension for the AMT-based computers must be configured with the root certificate thumbprint (also referred to as the certificate hash) for this provisioning certificate.

VeriSign is a typical example of an external certification authority that provides AMT provisioning certificates, but you can also use your own internal certification authority.

The server hosting the out of band service point must be able to chain successfully to the certificate's root certification authority. (The root certification authority certificate and intermediate certification authority certificate for VeriSign are installed by default with Windows.)

AMT-based computers

Server authentication

Web server

The server hosting the primary site server site system role requires the Windows security permission of Read and Enroll for this certificate template.

Enhanced Key Usage value must contain Server Authentication (1.3.6.1.5.5.7.3.1).

The subject name field must contain the fully qualified domain name (FQDN) of the AMT-based computer.

Maximum supported key length: 2048 bits.

This certificate resides in the nonvolatile random access memory of the management controller in the computer and is not visible from Windows.

The primary site server requests this certificate for each AMT-based computer it provisions. The primary site server also revokes the certificate that it issued when AMT provisioning information is removed for AMT-based computers.

This solution requires that you have a Microsoft enterprise certification authority that automatically approves certificate requests from the primary site server, and that the issuing certification authority is configured with the Issue and Manage Certificates permission for the primary site server.

Important
When this certificate is installed on AMT-based computers, the certificate chain to the root certification authority is also installed. AMT-based computers cannot support certification authority certificates with a key length greater than 2048 bits.

After the certificate is installed on AMT-based computers, this certificate authenticates the AMT-based computers to the out of band service point site system server and to computers running the out of band management console, and encrypts all data transferred between them using Transport Layer Security (TLS).

See Also

Tasks

How to Configure AMT Provisioning
How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management
About Certificates for Out of Band Management
Overview of Out of Band Management
Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management


About Certificates for Out of Band Management

Topic Last Updated—August 2008

This topic provides details about the deployment and usage of the Configuration Manager 2007 SP1 public key infrastructure (PKI) certificates used with out of band management and covers the following areas:

  • Certification Authority Requirements for Out of Band Management
  • The AMT Provisioning Certificate
  • The Web Server Certificate for AMT-Based Computers
  • CRL Checking and Certificate Revocation for Out of Band Management Certificates
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The certificate requirements are listed in the following topic: Certificate Requirements for Out of Band Management.

For a step-by-step example deployment, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

Certification Authority Requirements for Out of Band Management

The certificate deployment requirements for AMT provisioning include the use of automatically approving certificates so that the site server can request and immediately retrieve a certificate for each AMT-based computer that it provisions. To help secure automatic approval, security controls are required to ensure that only trusted computers request certificates. The use of certificate templates with a Microsoft enterprise certification authority (CA) provides this level of security control by having access level controls on the certificate templates. Although you can automatically approve all certificate requests with a stand-alone Microsoft CA, this solution does not offer any security controls and is not supported with out of band management in Configuration Manager 2007 SP1.

A Microsoft enterprise CA supports different versions of certificate templates:

  • Version 1 was introduced with Windows Server 2000 and is supported with all server editions of Windows Server 2003 and Windows Server 2008.
  • Version 2 was introduced with Windows Server 2003 and is supported with the Enterprise and Datacenter Editions of Windows Server 2003 and Windows Server 2008. Version 2 templates are not supported with the Standard Editions of Windows Server 2003 and Windows Server 2008.
  • Version 3 is introduced with Windows Server 2008 and is supported with the Enterprise and Datacenter Editions of Windows Server 2008. However, these certificate templates create certificates that are not compatible with Configuration Manager and must not be used for either out of band management or native mode.

You can see the different template versions in the Certificate Templates MMC by referencing the Minimum Supported CAs column: version 1 templates are listed as Windows 2000, version 2 templates are listed as Windows Server 2003, Enterprise Edition, and version 3 templates are listed as Windows Server 2008.

Version 1 certificate templates allow you to configure the security permissions that help to secure who can read, enroll, and manage the templates. However, to change any other properties of the certificate template, such as its name, its intended purpose, and its validity period, you must use version 2 or version 3 templates.

Customizing the certificate templates for out of band management is recommended and might be required to deploy the provisioning certificate, as outlined in the following sections. Any template customization requires that the CA is running the Enterprise Edition of the Windows Server operating system.

Certificate Template Versions and the Provisioning Certificate

The provisioning certificate installed in each site that will manage AMT-based computers out of band requires a specific object identifier (OID) that does not exist in the default certificate templates, in addition to the server authentication capability (OID 1.3.6.1.5.5.7.3.1). This means that an existing certificate template must be modified to include the custom object identifier. To do this, use a version 2 certificate template, because Configuration Manager does not support certificates that are created with a version 3 template. A version 2 template is not supported with the Standard Editions of Windows Server 2003 or Windows Server 2008.

However, if you are using an external CA for the provisioning certificate and the company provides its own method of requesting the certificate (for example, connecting to their Web enrollment site), you do not need to use a certificate template for the provisioning certificate.

If you are using an external CA that requires you to submit your request by using a certificate request file or if you are using your own internal CA to supply the provisioning certificate, you cannot use a version 1 certificate template. Instead, you must use a version 2 template so that it can be modified to include the custom OID. For an example deployment for submitting a certificate request to an external CA and using your own internal CA, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

Certificate Template Versions and the Certificates for AMT-Based Computers

Each AMT-based computer requires a certificate that is installed in the management controller memory, and this certificate requires server authentication capability only (OID 1.3.6.1.5.5.7.3.1). This requirement matches the default version 1 template named Web Server. You could therefore use the Web Server template, modifying only the security permissions so that the site server can read and enroll using this template.

However, if you duplicate the Web Server template, you have more control over the certificate that is used because you can change the name and description to identify that it is being used with out of band management. You can also change properties of the certificate, such as its validity period and the key size. Because of the greater control offered by version 2 templates, these templates are recommended for out of band management. Using these templates requires the Enterprise Edition of the Windows server operating system.

The AMT Provisioning Certificate

The following sections provide information about whether you can use your own internal CA or must use an external CA to request the provisioning certificate, and information about the certificate Subject name requirements.

Choosing Between an External CA and Using Your Internal CA

Configuration Manager cannot manage AMT-based computers out of band until they are provisioned. By default, AMT-based computers are configured by the computer manufacturer to use external certification authorities (CAs), such as VeriSign, Go Daddy, Comodo, and Starfield. If you purchase a provisioning certificate from one of the external CAs and configure Configuration Manager to use this provisioning certificate, AMT-based computers will trust the CA of the provisioning certificate and provisioning can succeed.

If you plan to use your internal CA to supply the provisioning certificate, one of the following conditions must be true:

  • Your computer supplier provided you with a customized firmware image that includes the certificate thumbprint of your internal root certificate. For more information about using a customized firmware image, see Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer.
  • You will manually add the certificate thumbprint of your internal root certificate to each computer that will be provisioned for out of band management in Configuration Manager 2007 SP1. Refer to your computer manufacturer instructions for information about how to configure the AMT certificate hash option with your certificate thumbprint value.

If you need more information about how to locate the certificate thumbprint of your internal root certificate thumbprint, see How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning.

Certificate Subject Name Requirements

During the AMT provisioning process, Configuration Manager configures the host name and DNS suffix in the AMT BIOS extensions with the FQDN of the AMT-based computer retrieved from the Configuration Manager database. The DNS suffix is then checked against the subject name in the provisioning certificate. The subject name in the provisioning certificate contains the FQDN of the site system server configured with the out of band service point role.

If the FQDN of the AMT-based computer shares the same namespace as the FQDN specified in the AMT provisioning certificate, AMT provisioning succeeds. If the FQDN of the AMT-based computer does not share the same namespace as the FQDN specified in the AMT provisioning certificate, AMT provisioning fails.

The following are examples of when the AMT-based computer shares the same namespace as the out of band service point:

  • The FQDN of the AMT-based computer is computer1.contoso.com, and the FQDN of the out of band service point is server1.contoso.com.
  • The FQDN of the AMT-based computer is computer1.sales.contoso.com, and the FQDN of the out of band service point is server1.contoso.com.
  • The FQDN of the AMT-based computer is computer1.sales.contoso.com, and the FQDN of the out of band service point is server1.marketing.contoso.com.

In the preceding examples, the AMT-based computer and the out of band service point share the contoso.com namespace.

The following are examples of when the AMT-based computer does not share the same namespace as the out of band service point:

  • The FQDN of the AMT-based computer is computer1.contoso.com, and the FQDN of the out of band service point is server1.northwindtraders.com.
  • The FQDN of the AMT-based computer is computer1.northwindtraders.com, and the FQDN of the out of band service point is server1.contoso.com.

In the preceding examples, the AMT-based computer and the out of band service point do not share a common namespace. Consequently, AMT provisioning will fail, even if both computers belong to the same Active Directory forest.

The provisioning certificate is installed on the out of band service point site system server, and this server's FQDN must be supplied in the provisioning certificate's subject name. If you are using your own internal CA to supply the provisioning certificate, the FQDN of the out of band service point site system server can be automatically configured with the certificate request. For more information, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

Important
You cannot provision AMT-based computers if they do not share the same namespace as the out of band service point. This means that AMT-based computers from a different Active Directory forest cannot be provisioned, and forests with a noncontiguous namespace will be unable to use out of band management unless the AMT-based computers and out of band service point belong to the same DNS tree.

Renewing the AMT Provisioning Certificate

Because an expired AMT provisioning certificate will result in provisioning failure, ensure that you renew your AMT provisioning certificate and configure out of band management with the new certificate before the original expires. Ensure that you request a new certificate in plenty of time before the existing certificate expires, which is particularly important if you are using an external CA for your provisioning certificate.

To help you identify when the AMT provisioning certificate is about to expire, Configuration Manager generates a warning status message with ID 7210 when the provisioning certificate in use is 40 days or less from expiration. This status message will be repeated once a day until the certificate is replaced with a validity period greater than 40 days or until the validity period is less than 15 days. When the validity period is less than 15 days, an error status message with ID 7211 is generated until the certificate is replaced with a validity period greater than 15 days.

Note
You must configure the out of band management component configuration properties with the new certificate. Installing the new certificate into the Certificates local store in the out of band service point site system computer is not sufficient. For more information, see How to Configure AMT Provisioning.

For more information about using status messages to monitor out of band management, see How to Monitor Out of Band Management.

For more information about site status configuration, see How to Configure Site Status Configuration.

The Web Server Certificate for AMT-Based Computers

Although it is more typical to think of workstation computers serving as a client to a Web site on a server, the opposite is true with out of band management. The AMT-based computers run a Web server component within their firmware, and the computers that manage them (the out of band service point, and any computer running the out of band management console) act as the client.

The certificate installed in the AMT memory requires server authentication capability so that it is authenticated to the computers that manage it and data sent between them is encrypted using transport layer security (TLS). TLS is an industry standard protocol closely related to SSL 3.0 and helps to secure against message tampering, interception, and forgery. For more information about TLS, see http://go.microsoft.com/fwlink/?LinkId=108709.

Out of band management does not use mutual PKI authentication; although the AMT-based computer is authenticated to the computer managing it, there is no corresponding client PKI certificate on the computer managing it. Instead, these communications are secured using a TLS connection and the following user accounts:

  • Windows user accounts using Kerberos authentication to run the out of band management console.
  • AMT Provisioning and Discovery Accounts using HTTP Digest authentication.
  • AMT MEBx Account using HTTP Digest authentication.
  • AMT User Accounts using Kerberos authentication.
  • AMT Remote Admin Account using HTTP Digest authentication.

Renewing the Web Server Certificate for AMT-Based Computers

An expired Web server certificate that is not renewed for AMT-based computers will result in Configuration Manager being unable to manage that computer out of band.

Configuration Manager monitors the certificates that it deploys to the AMT-based computers and automatically requests a new certificate before the original certificate expires. This helps to ensure seamless continuity and a sufficient grace period if the issuing CA cannot be immediately contacted.

When you install an out of band service point, an out of band management maintenance task is automatically enabled that periodically checks the remaining validity period of certificates that it has issued to AMT-based computers. It makes this check every 7 days and requests a new certificate when the expiration period is 42 days or less.

If you need to adjust these settings or initiate a check for certificates that are near expiration, see How to Customize Maintenance Tasks for Out of Band Management.

CRL Checking and Certificate Revocation for Out of Band Management Certificates

The following sections cover certificate revocation and certificate revocation list (CRL) checking for the provisioning certificate on the out of band service point and the Web server certificate on the AMT-based computers.

Provisioning Certificate

AMT-based computers do not support downloading a certificate revocation list (CRL) to check whether the provisioning certificate is revoked. This means that AMT-based computers will still accept a provisioning certificate that has been revoked by the issuing CA. If you know that the provisioning certificate has been revoked, delete it from the certificate store on the out of band service point site system server. Then deploy a new provisioning certificate, and configure it in the out of band management component properties. If you cannot immediately deploy a valid AMT provisioning certificate, remove the out of band service point role until you have a replacement certificate.

Web Server Certificate

CRL checking by the computers that manage the AMT-based computers (the out of band service point site system, and any computer running the out of band management console) is not supported by Windows Remote Management (WinRM). This means that the site server and any computer running the out of band management console will still accept a Web server certificate that has been revoked for an AMT-based computer.

The Web server certificate issued to each AMT-based computer during the provisioning process is automatically revoked by Configuration Manager in the following scenarios:

  • You remove the provisioning information from the computer, using Configuration Manager. The site server revokes the certificate with the revocation reason of Superseded.
  • You provision the computer and Configuration Manager discovers a certificate previously issued to the same AMT-based computer. This might happen if the AMT-based computer is locally configured with the option to remove provisioning configuration in the BIOS extensions. The site server revokes the certificate with the revocation reason of Superseded and requests a new certificate.
  • The out of band management maintenance task Evaluate Provisioned AMT Computer Certificates runs according to its configured schedule. When a certificate is found to be within the configured expiration period for renewal, the site server revokes the certificate with the revocation reason of Superseded and requests a new certificate. For more information about this maintenance task, see the previous section “Renewing the Web Server Certificate for AMT-Based Computers.”

The Web server certificate is not revoked when you update the data in the management controller.

The primary site server computer must have the permission Issue and Manage Certificate on the issuing certification authority.

Important
Make sure that you communicate to your PKI administrators the circumstances in which the Web server certificates can be automatically revoked by Configuration Manager. Explain that this action is an expected process for certificate management rather than denoting a security problem with the AMT-based computers.

See Also

Tasks

How to Provision Computers for AMT
How to Remove Provisioning Information for AMT-Based Computers
How to Update AMT Settings in Provisioned Computers Using Out of Band Management

Concepts

About AMT Provisioning for Out of Band Management
About the AMT Provisioning and Discovery Account
About the AMT Remote Admin Account
About the MEBx Account
About the AMT User Accounts
Determine Administrator Roles and Processes for Out of Band Management


About AMT Provisioning for Out of Band Management

Topic last updated—May 2008

Before AMT-based computers can be managed out of band in Configuration Manager 2007 SP1, they must be provisioned for AMT (set up and configured).

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

AMT provisioning results in the following external interactions between Configuration Manager and the networking infrastructure:

  • The site server checks the Configuration Manager database to ensure that a public key infrastructure (PKI) certificate is not already issued to the AMT-based computer. If a certificate is found, it is revoked.
  • The site server requests a PKI certificate from an internal issuing certification authority on behalf of AMT-based computers. This certificate request contains the FQDN of the computer that will be managed out of band and uses a certificate template that is configured with server authentication capability. The issuing certification authority (CA) server approves the request, and the certificate is granted to the site server computer.
  • The AMT-based computers are published as a computer object to Active Directory Domain Services, with a link to the Windows computer object in Active Directory Domain Services.
  • A service principal name (SPN) for the AMT-based computers is registered in Active Directory Domain Services so that administrators can connect to them using the out of band management console.

Additionally, the following internal interactions occur between Configuration Manager and the nonvolatile random access memory (NVRAM) of the management controller in the AMT-based computer, after the out of band management component on the site server connects to the AMT-based computer by using a specified AMT provisioning account and port number:

  • The PKI certificate retrieved by the site server is installed on the AMT-based computer, including the certificate chain up to the root CA certificate.
  • The fully qualified domain name (FQDN) of the AMT-based computer is retrieved from the Configuration Manager database and is configured on the AMT-based computer. The Windows computer time is used to configure the system time.
  • The AMT settings configured in Configuration Manager, such as whether to use IDE redirection and serial over LAN, respond to a network ping, and support a Web interface, are configured on the AMT-based computers. Additionally, the AMT remote password is reset to a random and strong password, any AMT user accounts are deleted, and support for Kerberos authentication is enabled on the AMT-based computer.
Note
In the log file, Amtopmgr.log, you will see references to first-stage provisioning and second-stage provisioning. The first two points in the preceding list occur during the first-stage provisioning. The last point in the preceding list occurs during second-stage provisioning. For more information about the log files used with out of band management, see Log Files for Out of Band Management.

For more information about how to provision a computer, see How to Provision Computers for AMT.

For more information about the certificates used for AMT provisioning, see About Certificates for Out of Band Management.

Updating the Data in the Management Controller Memory

Computers that are already provisioned for AMT do not dynamically reconfigure with new AMT settings that are configured in Configuration Manager. If you change the Configuration Manager AMT settings after AMT-based computers are provisioned for AMT, you must initiate an action on these computer resources to update the data in the management controller memory. Updating the data in the management controller memory for an AMT-based computer results in it getting the latest AMT settings. Additionally, the AMT-based computer's SPN is reregistered, and its Active Directory object is refreshed (or published if it doesn't exist). Updating the data in the management controller memory does not result in revoking the AMT certificate.

Removing AMT Provisioning Information

There might be occasions when you want to remove the provisioning information for an AMT-based computer, such as when you no longer want the computer to be managed out of band by Configuration Manager 2007 SP1 but want to use another out of band solution. The following options are available for removing provisioning information from the computer:

  • You can remove the configuration data from the management controller but keep identification information about the computer, such as its name, IP address, and DNS suffix. Configuration data includes whether IDE redirection and serial over LAN are enabled, network pings are supported, and the Web interface is enabled.
  • You can remove both configuration data and identification information from the management controller.

In both cases, the AMT certificate is revoked, the SPN is deleted, and the Active Directory object is deleted.

After the AMT provisioning information is removed, by default, an AMT-based computer will automatically provision again if it is in a collection that is configured for automatic AMT provisioning. However, you can disable automatic provisioning and re-enable it later.

For more information about removing provisioning information for an AMT-based computer and using automatic provisioning again, see How to Remove Provisioning Information for AMT-Based Computers.

Renaming AMT-Based Computers and Domain Changes

If you rename a computer that is already provisioned for AMT by Configuration Manager or move the computer to another domain, you must remove all the provisioning information from the AMT-based computer and then reprovision it. You can remove the provisioning information either before naming or moving the computer or after renaming or moving the computer. However, do not reprovision the computer until the name change or domain move is complete. If you fail to perform these procedures, the AMT-based computer cannot be managed out of band after the change of name or domain move.

When you remove the provisioning information, select the option to remove both configuration data and identification information from the management controller; and if applicable, select the option to disable automatic provisioning and re-enable it after the name change or domain move has taken place.

See Also

Tasks

How to Run the Out of Band Management Console

Concepts

About Certificates for Out of Band Management
Certificate Requirements for Out of Band Management
Configuration Manager AMT Provisioning Process for Out of Band Management
Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager
Overview of Out of Band Management


About Reports for Out of Band Management

Topic last updated—May 2008

The following reports are available for Configuration Manager 2007 SP1 out of band management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

  • Computers with out of band management controllers
    This report has a category of SMS Site - Client Information. It displays computers that are discovered to have management controllers and displays their AMT version number and provisioning status. For information about how to configure discovery for management controllers, see How to Discover Computers with Management Controllers.
  • Status of client out of band management provisioning
    This report has a category of SMS Site - Client Information and displays a list of computers that have been provisioned for out of band management. The report includes the computer name, IP address, DNS suffix, AMT version number, and the time when the AMT-based computer was last provisioned.
  • Out of band management console activity
    This report has a category of Status Messages - Audit. This report displays status messages relating to the out of band management console. It also displays the time (in local time for the administrator running the report), the user name, the source computer from which the out of band management console was run, and the destination computer to which the out of band management console connected.

Because the out of band management reports belong to two different reporting categories, you can locate them quickly by using the following text in the Look for field from the Reports node: out of band.

See Also

Concepts

About AMT Provisioning for Out of Band Management
About Configuration Manager Reports
Overview of Out of Band Management


About the AMT Status and Out of Band Management

Topic last updated—May 2008

The AMT status is used with out of band management in Configuration Manager 2007 SP1 to identify the capability and provisioning status of the management controller on AMT-based computers. This status is displayed in the Configuration Manager console, in the report Computers with out of band management controllers, and can also be used to construct queries.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The follow tables lists the possible AMT status values, with their corresponding description and query values.

AMT Status Description Query

Unknown

The AMT status is not yet known. This occurs when network discovery that is configured for management controllers has not taken place or because the computer has not contacted the out of band service point site system server to be provisioned.

Select * from sms_r_system where AMTStatus is null

Not Supported

Configuration Manager cannot detect AMT by using the network interface. This status can mean either of the following:

  • The computer does not have AMT capability and cannot support out of band management.
  • The computer has AMT capability, but the AMT network interface is closed because the time limit for out of band provisioning has expired.

Select * from sms_r_system where AMTStatus=0

Detected

AMT capability is detected on this computer, but the out of band service point is unable to provision it for AMT. This scenario can occur when the computer has been previously provisioned for AMT outside Configuration Manager and the password for the AMT Remote Admin Account or the MEBx Account has been changed and is unknown.

Select * from sms_r_system where AMTStatus=1

Not Provisioned

AMT capability is detected on this computer, and it can be provisioned for AMT by the out of band service point.

Select * from sms_r_system where AMTStatus=2

Provisioned

AMT capability is detected on this computer, and it can be managed out of band by Configuration Manager. The computer might have been provisioned for AMT by the out of band service point or by another AMT solution.

Select * from sms_r_system where AMTStatus=3

If the AMT network interface is not open because the time limit for out of band provisioning has expired (one of the possible causes for the AMT status of Not Supported), you can use the following query to identify management controllers after computers have completed a hardware inventory cycle. If required, modify the AMT version number in the query to match your exact AMT version. However, this query cannot determine the AMT status, such as whether the AMT-based computer can be provisioned in-band by Configuration Manager.

Copy Code
Select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_SYSTEM inner join SMS_G_System_AMT_AGENT on
SMS_G_System_AMT_AGENT.ResourceID = SMS_R_SYSTEM.ResourceID where
SMS_G_System_AMT_AGENT.AMT like ‘3.2.0’

The AMT Status column is not displayed by default in the Configuration Manager console. To display this column for a collection, use the following procedure.

To display the AMT Status column in the Configuration Manager console

  1. In the Configuration Manager console, right-click a collection, click View, and then click Add/Remove columns.

  2. Under Available columns, click AMT Status, and then click Add.

  3. If you do not want the AMT status to be displayed last, ensure that AMT Status is selected, and then click Move Up until it is listed in the order you require.

  4. Click OK.

  5. View the value in the AMT Status column in the results pane.

For more information about the report Computers with out of band management controllers, see About Reports for Out of Band Management.

See Also

Tasks

How to Identify Computers That Are Provisioned for AMT
How to Identify Computers That Can Support Out of Band Management

Concepts

About AMT Provisioning for Out of Band Management
About the AMT Remote Admin Account
About the MEBx Account
Prerequisites for Out of Band Management


Administrator Checklist: Enabling Out of Band Management

Topic last updated—May 2008

The following checklist provides the steps necessary to configure and use out of band management in a Configuration Manager 2007 SP1 site.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Step | Reference
Check the prerequisites for using out of band management with Configuration Manager 2007 SP1, and make any required changes to your network infrastructure and computers. | Prerequisites for Out of Band Management
Ensure that the appropriate public key infrastructure (PKI) certificates are in place. | Certificate Requirements for Out of Band Management
Create an Active Directory organizational unit (OU) or container for each domain that will contain computers that will be managed out of band. Configure the required security permissions on the OU or container.. | How to Prepare Active Directory Domain Services for Out of Band Management
Install the out of band service point in the primary site, and if required, configure the transmission packets. | How to Install the Out of Band Service Point How to Configure Power On Transmissions for Scheduled Wake-Up Activities
Configure AMT provisioning. | How to Configure AMT Provisioning
Configure AMT settings and at least one AMT User Account. | How to Configure AMT Settings and AMT User Accounts
If required, configure one or more AMT Provisioning and Discovery Accounts. | Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management How to Add an AMT Provisioning and Discovery Account
Optional but recommended: If you will provision Configuration Manager 2007 SP1 clients for AMT, enable discovery for management controllers. | How to Discover Computers with Management Controllers
Provision computers for AMT. | How to Provision Computers for AMT
Configure the site to send power-on commands using out of band management. | How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management
Verify that computers are provisioned for AMT and can support out of band management. | How to Identify Computers That Are Provisioned for AMT

See Also

Concepts

Example Scenarios for Implementing Out of Band Management
Overview of Out of Band Management

Other Resources

Tasks for Out of Band Management


Prerequisites for Out of Band Management

Topic last updated—May 2008

Running Configuration Manager 2007 SP1 out of band management creates external dependencies as well as dependencies within the product.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Important
Out of band management in Configuration Manager 2007 SP1 has external dependencies on the Intel Active Management Technology (Intel AMT) and on Microsoft public key infrastructure (PKI) technologies. If you need authoritative configuration information or technical details about these external dependencies, refer to the product documentation for the related technologies.

For Intel Active Management Technology (Intel AMT) information, refer to the Intel documentation or the documentation from your computer manufacturer.

For Microsoft PKI information, refer to Windows Server 2008 Active Directory Certificate Services (http://go.microsoft.com/fwlink/?LinkId=115018) and Public Key Infrastructure for Windows Server 2003 (http://go.microsoft.com/fwlink/?LinkId=78389).

Dependencies External to Configuration Manager 2007

The following table lists the external dependencies for running Configuration Manager 2007 SP1 out of band management.

Dependency More Information

A Microsoft enterprise certification authority (CA) with certificate templates to deploy and manage the certificates required for out of band management.

The issuing certification authority must automatically approve certificate requests from the primary site server on behalf of AMT-based computers.

Important
AMT-based computers cannot support certification authority certificates with a key length greater than 2048 bits.

The out of band service point and each desktop computer that will be managed with the out of band management feature must have specific public key infrastructure (PKI) certificates that are managed independently from Configuration Manager.

For more information, see the following topics:

  • Certificate Requirements for Out of Band Management
  • About Certificates for Out of Band Management
  • Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management

Desktop computers with the following configuration:

  • Intel vPro Technology or Intel Centrino Pro Technology.
  • Intel AMT version 3.2.1 or later.
  • Intel HECI driver.

Consult your computer manufacturer's documentation, and download the latest HECI driver from the Intel Web site.

If you have AMT-based computers that have a version of AMT that is lower than 3.2.1, you might be able to support them with out of band management and reduced functionality by using Intel's translator. For more information, see http://go.microsoft.com/fwlink/?LinkId=108363.

You must create and configure with the correct security permissions an Active Directory container for the domain in which the AMT-based computers reside. If the site manages AMT-based computers from multiple domains, the same container name and path must be used for all domains.

Note
It is not necessary to extend the Active Directory schema for out of band management.

This Active Directory container (or organizational unit) is required for publishing the AMT-based computer object during the AMT provisioning process.

For more information, see How to Prepare Active Directory Domain Services for Out of Band Management.

If you will provision new computers for AMT without the Configuration Manager 2007 SP1 client installed, you might need the following:

  • DNS servers that resolve the host name of ProvisionServer to the IP address of the out of band service point site system server.
  • DHCP server with an active scope.

The DNS entry can be automatically registered by Configuration Manager 2007 SP1 if DNS automatic updates are supported. For more information, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.

If computers will resolve the host name of ProvisionServer using DNS, ensure that the DHCP scope options include DNS servers (006) and Domain name (015), and that the DHCP server dynamically updates DNS with the computer resource record.

Windows Remote Management (WinRM) must be installed on each site system server that hosts the out of band service point role and on any computer that runs a remote Configuration Manager console.

To download the latest version of WinRM and for more information, see http://go.microsoft.com/fwlink/?LinkId=105682.

If the out of band service point site system role is installed on Windows Server 2003, Windows Server 2003 Service Pack 2 or later is required.

Important
If you are running Windows Server 2003 Service Pack 2, the following hotfix must be installed: 942841.

For more information about the hotfix, see http://go.microsoft.com/fwlink/?LinkId=106107.

Configuration Manager 2007 SP1 Supported Configurations

MSXML 6.0 is required on computers that run the out of band management console.

The Configuration Manager 2007 SP1 2007 setup prerequisite check includes the check for MSXML 6.0.

For more information, see Setup Prerequisite Checks.

The Windows feature Telnet Client must be installed on computers running Windows Vista or Windows Server 2008 if they will run the out of band management console and perform serial-over-LAN commands.

Serial over LAN uses the Telnet protocol to run a terminal emulation session for the managed computer, in which you can run commands and character-based applications. For more information, see Overview of Out of Band Management.

Computers that will be managed out of band must belong to the same Active Directory forest as the out of band service point's forest and must share the same namespace.

The following AMT-based computers cannot be provisioned by Configuration Manager:

  • Workgroup computers.
  • Computers that reside in a different Active Directory forest from the out of band service point site system server.
  • Computers that reside in the same Active Directory forest as the out of band service point site system server but do not share the same namespace (noncontiguous namespace).
    For example, an AMT-based computer with the FQDN of computer1.northwindtraders.com cannot be provisioned by the out of band service point site system with the FQDN of contoso.com, even if they belong to the same Active Directory forest.

Intervening network devices such as routers and firewalls must allow the traffic associated with out of band management activity.

The following ports are used by out of band management:

  • From the AMT management controllers to the out of band service point site system server for provisioning: TCP 9971.
  • From the out of band service point site system server to AMT managed controllers for discovery: TCP 16992.
  • From the out of band service point site system server to AMT management controllers for power control, provisioning, and discovery: TCP 16993.
  • From computers running the out of band management console to AMT management controllers for general management tasks: TCP 16993.
  • From computers running the out of band management console to AMT management controllers for serial over LAN and IDE redirection: TCP 16995.

Full IPsec environments are not supported.

Do not configure IPsec policies for the AMT communication between the out of band service point site system server and computers that will be managed out of band.

Refer to the port information in the preceding row to determine which ports are required for out of band management.

802.1X environments are not natively supported by Configuration Manager.

If you have AMT-based computers that use 802.1X, see the following information about using the Intel WS-MAN translator: http://go.microsoft.com/fwlink/?LinkId=108363.

Configuration Manager 2007 Dependencies

The following table lists the dependencies within Configuration Manager 2007 for running Configuration Manager 2007 SP1 out of band management.

Dependency More Information

The site must be running Configuration Manager 2007 SP1 and have installed the out of band service point.

See How to Install the Out of Band Service Point.

If you will provision computers for AMT with the Configuration Manager client, computers must have the Configuration Manager 2007 SP1 client installed.

Clients prior to Configuration Manager 2007 SP1 cannot initiate provisioning for AMT, and these computers must use out of band provisioning for AMT or be upgraded to Configuration Manager 2007 SP1.

For more information about AMT provisioning choices, see How to Provision Computers for AMT.

If you will use network discovery to identify computers with management controllers, you must first install the out of band service point and configure the AMT Provisioning and Discovery Account.

For more information, see the following topics:

  • How to Discover Computers with Management Controllers
  • How to Add an AMT Provisioning and Discovery Account

You must have the following security rights for the collection that contains the computer that you want to manage out of band:

  • View management controllers: This security right allows you to discover computers with management controllers and initiate power control actions from the Configuration Manager console.
  • Manage management controllers: This security right allows you to view and manage computers by using the out of band management console.

For more information about configuring security rights in the Configuration Manager console, see Overview of Configuration Manager Object Security and WMI.

Reporting point site system.

The reporting point site system role must be installed before out of band management reports can be displayed.

For more information about creating a reporting point, see How to Create a Reporting Point.

See Also

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Planning for Out of Band Management

Topic last updated—May 2008

This section provides planning information about using out of band management in Configuration Manager 2007 SP1.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Determine Whether You Should Use Out of Band Management

Determine Administrator Roles and Processes for Out of Band Management

Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN

Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer

Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS

Determine Whether You Should Install the Out of Band Service Point

Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management

Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager

See Also

Concepts

Prerequisites for Out of Band Management

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Determine Whether You Should Use Out of Band Management

Topic last updated—March 2008

Use the out of band management feature in a Configuration Manager 2007 SP1 site if both of the following conditions apply:

  • You want to manage computers with the tasks, features, and supported scenarios that are listed in Overview of Out of Band Management.
  • You meet all the prerequisites for out of band management as listed in Prerequisites for Out of Band Management.
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Other Resources

Planning for Out of Band Management


Determine Administrator Roles and Processes for Out of Band Management

Topic last updated—March 2008

In a production environment, implementing out of band management in Configuration Manager 2007 SP1 involves various processes that might require interaction and collaboration with a number of different groups across the enterprise.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

These groups might include the following:

  • Procurement for new desktop computers that support out of band management.
  • Security advisors and infrastructure administrators to help determine appropriate options and values in the computer BIOS extensions. For more information, see Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer.
  • Active Directory Domain Services service administrators to create and configure the Active Directory container or organizational unit (OU) into which the AMT-based computers are published.
  • Public key infrastructure (PKI) specialists to create, deploy, and manage the PKI certificates required for out of band management.
  • Active Directory Domain Services data administrators to create the AMT user accounts that are used when running the out of band management console.
  • DNS and DHCP administrators, if you will provision AMT-based computers out of band (without the Configuration Manager 2007 SP1 client installed).
  • Infrastructure and network architects to ensure that firewalls, routers, and switches are configured to allow the network traffic associated with out of band activity, and to ascertain the impact of network traffic when sending power-on commands to multiple computers and across WAN links.
  • Configuration Manager administrators responsible for configuring software distribution, software updates, and task sequences to identify which advertisements and software update deployments should be enabled for Wake On LAN and whether to configure the site for wake-up packets only, power-on commands only, or both of these configurations.
  • Help desk engineers who might require training in using the out of band management console for troubleshooting scenarios.
  • End users who might require training and notification about turning off their computers at the end of the day if this is not their normal working practice.

Because an out of band management solution can involve a number of different roles and processes, a successful implementation will depend on identifying who is responsible for the various roles and ensuring collaboration between groups when necessary. A successful ongoing implementation will depend on identifying and adhering to processes that coordinate the various functions between the roles.

Some of the consequences of not having and following defined processes when out of band management in Configuration Manager is implemented in a production environment are as follows:

  • Computers fail to provision or configure as expected, which impacts the success rate of computer management. This in turn can negatively affect service level agreements (SLAs) and business continuity.
  • A critical component, such as DNS configuration or firewall configuration, prevents AMT provisioning and delays out of band management operation because these infrastructure changes were not requested in a timely manner.
  • Computers are not woken up for scheduled activities as expected, which impacts the success rate of software distribution, software updates, and task sequences. In the case of software updates, this can mean that computers are vulnerable to security exploits.
  • Not enough time is allowed to power on multiple computers that need to install security updates by a defined date to achieve required compliance levels.
  • If nonfunctioning computers cannot be successfully remediated without a visit to the computer, productivity will be negatively impacted if users have to wait for a help desk engineer to arrive.

Use a methodology such as ITIL or Microsoft Operations Framework (http://go.microsoft.com/fwlink/?LinkId=88047) to help you implement out of band management within a framework of defined processes. Make sure you document your design, testing procedures, the areas of responsibility, and the processes to follow for configuring, monitoring, and troubleshooting. Then disseminate this information, making sure that it is centrally available and updated.

Note
Review existing company security policies, and if necessary, modify them to include the implementation of out of band management.

See Also

Concepts

Example Scenarios for Implementing Out of Band Management
Prerequisites for Out of Band Management

Other Resources

Configuring Out of Band Management
Planning for Out of Band Management


Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN

Topic last updated—March 2008

If you are deciding whether to use the Wake On LAN feature in Configuration Manager 2007 or the out of band management feature in Configuration Manager 2007 SP1, review the following topics to understand the supported scenarios, options, and prerequisites for each feature:

  • Overview of Wake On LAN
  • Prerequisites for Wake On LAN
  • Overview of Out of Band Management
  • Prerequisites for Out of Band Management
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

If you cannot choose which feature to use based on this information, to best meet your business requirements, you should consider the advantages and disadvantages of both features.

The following table outlines the advantages and disadvantages of Wake On LAN and out of band management to help you choose which feature to use.

Feature Advantage Disadvantage

Wake On LAN

Does not require that the site is running Configuration Manager 2007 SP1.

Supported by many network adapters.

UDP wake-up packets are quick to send and process.

Does not require a PKI infrastructure.

Does not require any changes to Active Directory Domain Services.

Supported on workgroup computers, computers from another Active Directory forest, and computers in the same Active Directory forest but using a noncontiguous namespace.

Less secure solution than out of band management because it does not use authentication or encryption. If subnet-directed broadcast transmissions are used for the wake-up packets, this has the security risk of smurf attacks. For more information about securing subnet-directed broadcast transmissions with Wake On LAN, see Secure Routers for Subnet-Directed Broadcasts for Wake On LAN.

Might require manual configuration on each computer for BIOS settings and adapter configuration.

No confirmation that computers are woken up.

Wake-up transmissions as multiple UDP packets can unnecessarily saturate available network bandwidth.

Cannot wake up computers interactively.

Cannot return computers to sleep state.

Management features are restricted to waking up computers only.

Out of band management

More secure solution than Wake On LAN because it provides authentication and encryption using standard industry security protocols. It can also integrate with an existing PKI deployment, and the security controls can be managed independently from the product.

Supports automatic centralized setup and configuration (provisioning).

Established transport session for a more reliable connection and auditable connection.

Computers can be woken up interactively (and restarted).

Computers can be powered down interactively.

Additional management capabilities, which include the following:

  • Restarting a non-functioning computer and booting from a locally connected device or known good boot image file.
  • Re-imaging a computer by booting from a boot image file that is located on the network or by using a PXE server.
  • Reconfiguring the BIOS settings on a selected computer (and bypassing the BIOS password if this is supported by the BIOS manufacturer).
  • Booting to a command-based operating system to run commands, repair utilities, or diagnostic applications (for example, upgrading the firmware or running a disk repair utility).

Requires that the site is running Configuration Manager 2007 SP1.

Supported only on desktop computers that have the Intel vPro chip set and Intel Active Management Technology (Intel AMT) firmware version 3.2.1 or later.

The transport session requires more time to establish, higher processing on the server, and an increase in data transferred.

Requires a PKI deployment and specific certificates.

Requires an Active Directory container that is created and configured for publishing AMT-based computers.

Cannot support workgroup computers, computers from another Active Directory forest, or computers from the same Active Directory forest but using a noncontiguous namespace.

Might require infrastructure changes to DNS and DHCP if provisioning out of band (the Configuration Manager 2007 SP1 client is not installed).

Both features support waking up computers for the following scheduled activities:

  • Software update deployments that are configured with a deadline.
  • Mandatory advertisements for software distribution or a task sequence.

If you are using Wake On LAN and out of band management in the same Configuration Manager 2007 SP1 site, you must choose how the site will wake up computers for scheduled activities that are configured for Wake On LAN. The following options are located on the Site Properties: Wake On LAN Tab:

  • Use power on commands if the computer supports this technology, otherwise use wake-up packets
  • Use power on commands only
  • Use wake-up packets only

Make your choice based on which feature you are using and whether the computers assigned to the site support the feature. Also take into consideration the advantages and disadvantages of both features as listed above. For example, wake-up packets are less reliable and are not secured, but power on commands take longer to establish and require more processing on the site system server that is configured with the out of band service point.

Important
Because of the additional overhead involved in establishing, maintaining, and terminating an out of band management session, conduct your own tests so that you can accurately judge how long it takes to wake up multiple computers using out of band power on commands in your environment (for example, across slow WAN links to computers in secondary sites). This knowledge will help you determine whether waking up multiple computers for scheduled activities using power on commands with out of band communication is practical when you have a high number of computers to wake up within a short period of time.

After configuring the wake-up option for the site, all software update deployments and mandatory advertisements that are configured for Wake On LAN will use the same setting. You cannot configure which feature to use on an individual basis; for example, you cannot configure all software updates to use wake-up packets only or a specific mandatory advertisements to use power on commands only.

See Also

Tasks

How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management

Reference

Site Properties: Wake On LAN Tab

Other Resources

How to Configure Wake On LAN Activities
Planning for Out of Band Management


Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer

Topic last updated—May 2008

If you haven't yet purchased the computers that you want to manage out of band with Configuration Manager 2007 SP1, decide whether you need a customized firmware image from your computer manufacturer.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Computers that can be managed out of band have BIOS extensions that can include options such as enabling serial over LAN and IDE redirection and that can set values such as a certificate thumbprint of a root certification authority that is used during the AMT provisioning process.

Check which BIOS extension settings are available from your computer manufacturer, and decide whether you need a customized image to enable or disable options and specify your choice of values.

Some typical examples of why you might need a customized firmware image include the following:

  • You want to specify an alternative external certification authority to issue the AMT provisioning certificate, or you want to use your own internal certification authority to issue the AMT provisioning certificate.
    Note
    If you want to use your own internal certification authority, you will need to supply the certificate thumbprint of your root certification authority. If you need more information about how to do this, see How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning.

  • The default firmware image enables serial over LAN and IDE redirection, but to comply with your internal security policies, computers on your company network must not support these highly privileged management options. For more information about serial over LAN and IDE redirection, see Overview of Out of Band Management.
  • The default firmware image does not enable bypassing the BIOS password, and you want to be able to use this option when powering up or restarting computers out of band with the out of band management console.
  • The default firmware image has the value of ProvisionServer for the provisioning server name, but you want to use either a different name or the IP address of the server that will host the out of band service point role. For more information about this scenario, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.
  • You want your AMT-based computers to use a MEBx password that is different from the default value of admin.

If you think you might benefit from a customized firmware image, discuss the available BIOS extensions with your computer manufacturer or supplier.

See Also

Other Resources

Planning for Out of Band Management


Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS

Topic last updated—March 2008

If you are provisioning computers for AMT in Configuration Manager 2007 SP1 without the Configuration Manager 2007 SP1 client installed (out of band provisioning), you need to decide whether you should register an alias for the out of band service point in DNS.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

AMT-based computers contact a provisioning server for out of band provisioning using the value specified in the BIOS extensions for the provisioning server. The value can be a short name, a fully qualified domain name (FQDN), or an IP address. Typically, the value is the short name of ProvisionServer. You can change this value on each computer by configuring the BIOS extensions, or you can request the value you want to use as part of a customized firmware image. For more information about customizing the firmware image, see Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer.

Caution
Using the default name of ProvisionServer could present a security risk if a record with this name is configured to resolve to an IP address of the wrong or rogue computer. If an incorrect IP address is given to AMT-based computers, provisioning will not succeed and the AMT-based computers cannot be managed. Configuring the provisioning server value with an alternative name or IP address is more secure than using a well-known name.

If you are using the default name of ProvisionServer, ensure that you have configured the entry in DNS before turning on the AMT-based computers. Additionally, ensure that you secure the DNS record (for example, using DNS secure dynamic updates so that only the owner can modify this record) to safeguard against the record being modified such that it no longer resolves to the out of band service point site system computer.

When a name is used rather than an IP address, the AMT-based computer must be configured with an FQDN and at least one DNS server. This is typically achieved using DHCP configuration options, but these values can also be specified in the BIOS extensions. When an AMT-based computer first starts up, it uses DNS to resolve the name of the provisioning server using one of the following methods:

  • If the short name of ProvisionServer is specified in the BIOS extensions, DNS attempts to resolve this name in the AMT-based computer's domain to the IP address that belongs to the out of band service point in the computer's Configuration Manager site. The computer then contacts this server to begin the provisioning process. Unless the site system server is actually configured with the name of ProvisionServer, this solution requires an alias (CNAME) record in DNS for the out of band service point site system server. You can configure Configuration Manager to automatically register this alias in the out of band service point's configured DNS domain, or you can manually create the alias record. For more information, see How to Register an Alias in DNS for the Out of Band Service Point.
  • If an alternative short name is specified for the provisioning server and this name is not the same as the configured name of the out of band service point site system server, you must manually create the alias record in DNS. For more information, see the second procedure in How to Register an Alias in DNS for the Out of Band Service Point. With the alternative name resolved to the IP address of the out of band service point site system server, the AMT-based computer then contacts this server to begin the provisioning process.
  • If an FQDN is specified for the provisioning server and this value matches the FQDN of the out of band service point site system server in the Configuration Manager site that will manage the AMT-based computer, there is no need for an alias in DNS. DNS resolves the FQDN to the IP address of the out of band service point site system server, and the AMT-based computer then contacts this server to begin the provisioning process.

If an IP address is specified as the provisioning server in the BIOS extensions, there is no need for an alias in DNS. This IP address must be owned by the out of band service point site system server in the Configuration Manager site that will manage the AMT-based computer.

Register an alias for the out of band service point in DNS if both of the following conditions apply:

  • You will provision computers for AMT out of band (without the Configuration Manager 2007 SP1 client installed).
  • The AMT-based computers are configured with either the value of ProvisionServer or an alternative server name (short name or FQDN) that is not already registered in DNS as a host name (an A record).

Do not register an alias for the out of band service point in DNS if any of the following conditions apply:

  • You will provision only computers for AMT in-band. (The Configuration Manager 2007 SP1 client is installed.)
  • The AMT-based computers are configured with the IP address of the out of band service point rather than a name for the provisioning server.
  • The DNS domain for the out of band service point contains out of band service points from other Configuration Manager sites, and all AMT-based computers are configured with the same name for the provisioning server.

See Also

Tasks

How to Register an Alias in DNS for the Out of Band Service Point

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Planning for Out of Band Management


Determine Whether You Should Install the Out of Band Service Point

Topic last updated—May 2008

Install an out of band service point in the Configuration Manager 2007 SP1 site if both of the following conditions apply:

  • You want to manage computers out of band and meet all the prerequisites for the feature. For a list of prerequisites, see Prerequisites for Out of Band Management.
  • The site is configured as a primary site and does not already have the out of band service point role installed.
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Other Resources

Planning for Out of Band Management


Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management

Topic last updated—May 2008

You might need to configure an AMT Provisioning and Discovery Account in Configuration Manager 2007 SP1 site so that Configuration Manager can discover computers that have management controllers and provision them for out of band management. Use the following information to determine whether you need to configure an AMT Provisioning and Discovery account.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In the following statements, provisioning in-band refers to using the Configuration Manager 2007 SP1 client for AMT provisioning; provisioning out of band refers to provisioning without the Configuration Manager 2007 SP1 client installed and is suitable for new computers. For more information, see About AMT Provisioning for Out of Band Management.

Specify an AMT Provisioning and Discovery Account if any one of the following conditions applies:

  • The AMT-based computer has never been provisioned, and your manufacturer delivered the computer with a customized MEBx password. (It is not admin.) When this is the case, add an AMT Provisioning and Discovery Account named admin and specify the password that was provided by the manufacturer.
  • The AMT-based computer has never been provisioned, and your manufacturer delivered the computer with the default MEBx password of admin, but you have configured the MEBx password in the computer’s BIOS extensions. When this is the case, add an AMT Provisioning and Discovery Account named admin and specify the password that you configured in the BIOS extensions.
  • The AMT-based computer has been previously provisioned by another AMT management solution, and the provisioning information has been partially removed (either by that management solution or by locally configuring the BIOS extensions). When this is the case, and you want to discover or provision these computers in-band by using Configuration Manager, add an AMT Provisioning and Discovery Account named admin and specify the password for the AMT Remote Admin Account that was configured by the other management solution.

Do not specify an AMT Provisioning and Discovery Account in Configuration Manager if any one of the following conditions applies:

  • The AMT-based computers that you want to provision for out of band management with Configuration Manager have never been provisioned and are supplied by the manufacture without a customized MEBx Account. An AMT MEBx Account that is not customized is named admin, and the password is admin. Furthermore, you have not configured the MEBx Account with your own choice of password by configuring the computer BIOS extensions.
  • The AMT-based computer has been previously provisioned by another AMT management solution, the provisioning information has been fully removed (either by that management solution or by locally configuring the BIOS extensions), and you want to discover or provision these computers in-band.
  • The AMT-based computer has been previously provisioned by another AMT management solution, the provisioning information has been fully removed or partially removed (either by that management solution or by locally configuring the BIOS extensions), and you want to provision these computers out of band by specifying all the required information in the Import Computers for Out of Band Management Wizard. For more information about migrating AMT-based computers, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

There is no technical limit to the number of AMT Provisioning and Discovery Accounts that you can configure. However, specifying many accounts might negatively impact network traffic during the discovery process because each account will be tried in turn until either the authentication is successful or there are no more accounts to try.

See Also

Tasks

How to Add an AMT Provisioning and Discovery Account
How to Discover Computers with Management Controllers
How to Provision Computers for AMT


Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager

Topic Last Updated—August 2008

If you have AMT-based computers that have been provisioned and managed outside Configuration Manager 2007 SP1 (referred to as “the other management solution” in the following table) and you want to manage these computers using out of band management in Configuration Manager 2007 SP1, you will need to decide on a migration strategy.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The available choices are listed in the following table.

Migration Strategy Procedures More Information

Use in-band provisioning with Configuration Manager.
  • Remove the provisioning information from the AMT-based computers either by using the other management solution or manually for each computer by configuring the BIOS extensions and selecting the option for a full or partial removal of provisioning information. Install the Configuration Manager 2007 SP1 client, and assign the client computers to the Configuration Manager 2007 SP1 site.
  • If the provisioning information was partially rather than fully removed, specify the remote admin account and password as an AMT Provisioning and Discovery Account on the Provisioning Settings tab of the Out of Band Management component properties.
  • Provision these computers by using the in-band AMT provisioning method in Configuration Manager 2007 SP1.

This method requires that the Configuration Manager 2007 SP1 client is installed and that the AMT version is 3.2.1 or higher.

Use out of band provisioning with Configuration Manager, with an export utility.
  • Use an export utility from the other management solution to remove the provisioning information from the AMT-based computers and capture the computer information into a comma-separated values (CSV) file.
  • Provision these computers using the out of band AMT provisioning method in Configuration Manager 2007 SP1, using the CSV file with the Import Computer for Out of Band Management Wizard.

This method automatically provides all the computer information required to import multiple computers, so you do not need to provide this information yourself.

Important
Store the CSV file securely, and ensure that you can access it securely when you run the Import Computer for Out of Band Management Wizard.

There might be a time limit between running the export utility and importing the CSV file into the Configuration Manager database, so you might need to plan these two procedures carefully so that you allow enough time for the AMT-based computers to be provisioned by Configuration Manager. For example, you might need to export and import in batches, performing these procedures during a time when there is plenty of available network bandwidth.

Refer to the documentation accompanying the export utility provided by the other management solution for more information about how to use the export utility and to identify any time-limit requirements.

When you use the exported CSV file, an instruction is automatically sent to Configuration Manager to prevent automatic in-band provisioning if the Configuration Manager 2007 SP1 client is installed. If you want to override this behavior, right-click the resource, click Out of band management, and then click Enable automatic provisioning.

Use out of band provisioning with Configuration Manager, without using an export utility.
  • Fully remove or partially remove the provisioning information from the AMT-based computers by using one of the following methods:
    • Centrally, using the other management solution.
    • Locally, manually selecting the option to remove provisioning information in the BIOS extensions.
  • Provision these computers using the out of band AMT provisioning method in Configuration Manager 2007 SP1, using the Import Computer for Out of Band Management Wizard.

This method requires that you manually provide all the computer information required to import the computers into the Configuration Manager database, such as the FQDN and SMBIOS GUID (also known as the UUID). If you partially removed the provisioning information, you must also manually provide the AMT remote admin password, either in the wizard or as an AMT Provisioning and Discovery Account. You can create a CSV file to use with the wizard to import multiple computers, or you can enter the information in the wizard for a single computer.

Important
If you manually specify the AMT remote admin password in the wizard, it cannot be specified in clear text but must instead be encoded by using Base 64. For more information about how to encode text by using Base 64, see the knowledge base article about sample base 64 encoding and decoding (http://go.microsoft.com/fwlink/?LinkId=122491).

When the following condition applies, use in-band provisioning with Configuration Manager:

  • You will install the Configuration Manager 2007 SP1 client and the computer is running AMT version 3.2.1 or higher.

If all of the following conditions apply, use out of band provisioning with Configuration Manager and an export utility:

  • The other management solution has a utility for exporting the AMT-based computers into a file that is suitable for importing into Configuration Manager.
  • There is sufficient time to perform the export, import, and provisioning within any time limits required by the export utility.
  • You have installed the Intel WS-MAN translator on the out of band service point site system server if you have AMT-based computers with a version of AMT that is lower than 3.2.1.

If any of the following conditions apply, use out of band provisioning with Configuration Manager without using an export utility:

  • You do not have an export utility from the other management solution that can export the AMT-based computers into a file that is suitable for importing into Configuration Manager.
  • You can provide all the computer information required to import the computers into the Configuration Manager database.

For information about removing the AMT provisioning information from the other management solution and running the export procedure, see the documentation that accompanies this management solution.

For information about provisioning AMT-based computers in-band using the Configuration Manager 2007 SP1 client or for provisioning AMT-based computers out of band without an export utility, see How to Provision Computers for AMT.

For information about importing the AMT-based computers from another management solution into Configuration Manager, see How to Migrate AMT-Based Computers to Configuration Manager After Running an Export Utility.

See Also

Tasks

How to Configure AMT Provisioning

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Planning for Out of Band Management


Configuring Out of Band Management

Topic last updated—March 2008

You must configure a Configuration Manager 2007 SP1 site for out of band management before you can manage computers out of band.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

How to Prepare Active Directory Domain Services for Out of Band Management

How to Install the Out of Band Service Point

How to Configure Power On Transmissions for Scheduled Wake-Up Activities

How to Configure AMT Provisioning

How to Register an Alias in DNS for the Out of Band Service Point

How to Configure AMT Settings and AMT User Accounts

How to Discover Computers with Management Controllers

How to Provision Computers for AMT

How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management

How to Update AMT Settings in Provisioned Computers Using Out of Band Management

How to Add an AMT Provisioning and Discovery Account

How to Remove Provisioning Information for AMT-Based Computers

How to Customize Maintenance Tasks for Out of Band Management

How to Migrate AMT-Based Computers to Configuration Manager After Running an Export Utility

See Also

Concepts

Administrator Checklist: Enabling Out of Band Management
Example Scenarios for Implementing Out of Band Management

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


How to Prepare Active Directory Domain Services for Out of Band Management

Topic last updated—March 2008

Out of band management in Configuration Manager 2007 SP1 requires that Configuration Manager publishes a computer object to an Active Directory organizational unit (OU) or container or for each domain that will contain AMT-based computers.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

When you perform the following procedures, AMT-based computers that are provisioned for out of band management can be published to Active Directory Domain Services.

After you have performed the procedures, you must configure the out of band management component with the name and location of the OU or container, in the Out of Band Management Component Configuration Properties: General Tab. When the site manages AMT-based computers from multiple domains, the same name and location must be created in Active Directory Domain Services for each domain, although you configure only one instance in Configuration Manager.

Important
The primary site server computer account must be granted full control permissions to the out of band management OU or container and all of its child objects.

Note
Extending the Active Directory schema and publishing site information to Active Directory Domain Services is not required for out of band management, but it is recommended for other features and functionality in Configuration Manager. For more information, see Decide If You Should Extend the Active Directory Schema.

To create and configure an OU in Active Directory Domain Services

  1. On a domain controller, log in with an administrative account that has permissions to create OUs in your selected domain.

  2. Click Start, click Programs, click Administrator Tools, and then click Active Directory Users and Computers.

  3. Click View, and then click Advanced Features.

  4. If necessary, connect to the domain.

  5. Right-click the domain object or another OU in which you want to create the OU, click New, and then click Organizational Unit.

  6. In the New Object - Organizational Unit dialog box, type the name of your choice, such as Out of Band Management Controllers, and then click OK.

  7. Right-click the OU that you have just created, and then click Properties.

  8. Click the Security tab.

  9. Click Add to add the primary site server computer account, and then grant the account Full Control permissions.

  10. Click Advanced, select the primary site server's account, and then click Edit.

  11. In the Apply onto list, select This object and all child objects.

  12. Click OK.

    Note
    Repeat this procedure for each domain that will contain AMT-based computers that will be managed out of band.

To create and configure security for a container in Active Directory Domain Services

  1. On a domain controller, log in with an administrative account that has permissions to create containers in your selected domain.

  2. Click Start, click Run, and then enter adsiedit.msc to launch the ADSIEdit console.

    Note
    The ADSIEdit console is included with the Windows Server support tools. These tools can be installed by running suptools.msi from the Windows Server installation disk, from the following folder: \SUPPORT\TOOLS.

  3. If necessary, connect to the domain.

  4. Expand the tree and right-click the domain or container in which you want to create the container, click New, and then click Object.

  5. In the Create Object dialog box, select Container, and then click Next.

  6. In the Value field, type the name of your choice, such as Out of Band Management Controllers, and then click Next.

  7. Click Finish.

  8. Right-click the container that you have just created, and then click Properties.

  9. Click the Security tab.

  10. Click Add to add the primary site server computer account, and then grant the account Full Control permissions.

  11. Click Advanced, select the primary site server’s computer account, and then click Edit.

  12. In the Apply onto list, select This object and all child objects.

  13. Click OK, and close the ADSIEdit console.

    Note
    Repeat this procedure for each domain that will contain AMT-based computers that will be managed out of band.

See Also

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Configuring Out of Band Management
How to Extend the Active Directory Schema for Configuration Manager


How to Install the Out of Band Service Point

Topic last updated—March 2008

How you install a Configuration Manager 2007 SP1 out of band service point depends on whether you are installing it onto a new site system server or whether you are adding the out of band service point to an existing site system server.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

You cannot install an out of band service point on a server share or on a secondary site, and you can install a single out of band service point only in a Configuration Manager 2007 SP1 primary site. If the option to install the out of band service point is not available in the wizard, check for these conditions.

To install an out of band service point on a new site system server

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings.

  2. Right-click Site Systems, click New, and then click Server to launch the New Site System Server Wizard.

  3. On the General page, specify the server name. If you cannot use the site server computer account for installation, specify an installation account, and then click Next.

  4. On the System Role Selection page, select Out of band service point, and click Next.

  5. On the Out of Band Service Point page, change any default settings you require for how out of band transmission packets are sent.

    Note
    For more information about each of these options, see ConfigMgr Out of Band Service Point Properties: General Tab.

  6. Click Next, click Next, and then click Close.

To install an out of band service point on an existing site system server

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings.

  2. Right-click the existing site system server to which you want to add the out of band service point, and then click New Roles to launch the New Site Roles Wizard.

  3. On the General page, click Next.

  4. On the System Role Selection page, select Out of band service point, and click Next.

  5. On the Out of Band Service Point page, change any default settings you require for how out of band transmission packets are sent.

    Note
    For more information about each of these options, see ConfigMgr Out of Band Service Point Properties: General Tab.

  6. Click Next, click Next, and then click Close.

See Also

Tasks

How to Delete Site System Roles From Site Systems
How to View Site System Roles Assigned to Site Systems

Other Resources

Configuring Out of Band Management


How to Configure Power On Transmissions for Scheduled Wake-Up Activities

Topic last updated—January 2008

Configuring the out of band service point properties in Configuration Manager 2007 SP1 allows you to fine-tune how power on transmissions are sent to computers when you are using power on commands to wake up computers for scheduled activities, such as software updates with a deadline. These options help you to control the CPU utilization of the out of band service point when multiple computers are targeted for power on commands.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Use the following procedure to configure settings for power on transmissions.

To configure out of band transmissions

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems.

  2. Expand the site system server that is configured with the out of band service point role.

  3. In the results pane, right-click ConfigMgr out of band service point, and then select Properties.

  4. On the General tab, configure the following options:

    1. Retries and Delay under the Transmission retries section.
    2. Maximum and Wait (seconds) under the Transmission maximum section.
    3. Transmission threads under the Transmission threads section.
    4. Transmission offset (minutes) under the Transmission offset section.

  5. Click OK.

See Also

Tasks

How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management

Reference

ConfigMgr Out of Band Service Point Properties: General Tab

Concepts

Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN

Other Resources

Configuring Out of Band Management


How to Configure AMT Provisioning

Topic last updated—May 2008

You must provision computers for AMT before they can be managed out of band in Configuration Manager 2007 SP1. For more information about provisioning for AMT, see About AMT Provisioning for Out of Band Management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Before configuring AMT provisioning in Configuration Manager 2007 SP1, ensure that an Active Directory organization unit or container for out of band management controllers is created and configured with the appropriate permissions, and ensure that you have the required certificates for out of band management. For more information, see the following topics:

  • How to Prepare Active Directory Domain Services for Out of Band Management
  • Certificate Requirements for Out of Band Management
Note
Before you can provision computers for AMT, you must also install an out of band service point in the primary site. You can perform this site role installation either before or after performing the following procedures. For more information, see How to Install the Out of Band Service Point.

Use the following procedures to prepare the certificates for out of band management, and then configure the out of band management component for AMT provisioning. After configuring AMT provisioning options, configure the AMT settings. For more information, see How to Configure AMT Settings and AMT User Accounts.

To prepare the certificates for out of band management

  1. Request, install, and prepare the AMT provisioning certificate issued by a certification authority that is trusted by the AMT-based computers. For more information, see About Certificates for Out of Band Management.

  2. Ensure that you have a Microsoft enterprise certification authority (CA) to automatically issue certificates requested by the site server. These certificate requests will supply the subject name and must include the certificate capability of server authentication.

    Note
    For step-by-step instructions for preparing these certificates, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

To configure the out of band management component for AMT provisioning

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click Out of Band Management, and then click Properties.

  2. On the General tab, specify an organizational unit or container for the option Active Directory container. If the site will manage AMT-based computers from only one domain, specify this domain's organizational unit or container. If the site will manage AMT-based computers from multiple domains, specify the details for any one domain.

  3. Click Set to specify a strong password for the MEBx Account that Configuration Manager will set in AMT when the computer is provisioned for the first time. If your manufacturer has provided you with a customized password (it is not admin) or if you have changed the password for the MEBx Account in AMT, you must specify this password by creating and configuring an AMT Provisioning and Discovery Account. For more information, see How to Add an AMT Provisioning and Discovery Account.

    Note
    To specify your choice of password for the MEBx Account, it must be at least 8 characters and a maximum of 32 characters, together with at least one each of an uppercase, a lowercase, a numeric, and a symbol character. Symbol characters include ! @ # $ % ^ & * and exclude : (colon) “ ” (double quotes) _ (underscore).

  4. Use the default value of 9971 for the AMT provisioning port, unless you have been provided with a different value from your computer manufacturer.

  5. If you are using out of band AMT provisioning (the Configuration Manager 2007 SP1 client is not installed) and you want Configuration Manager to automatically register the name ProvisionServer in DNS, enable the option Register ProvisionServer as an alias in DNS. For more information about this option, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.

  6. Click Browse next to the option Provisioning certificate, and select the certificate file that contains the exported AMT provisioning certificate with the private key. Type in the password that was created when the certificate was exported, and then click OK.

  7. Click Select next to the option Certificate template, and in the AMT Certificate Configuration dialog box, specify the following:

    1. Issuing CA: Click the drop-down menu to see a list of enterprise CAs that are retrieved from Active Directory Domain Services and displayed by the FQDN. Select the CA that will issue the certificates for AMT-based computers. The name of the CA will automatically display in the field CA name.
    2. AMT certificate template: Click the drop-down menu to see a list of templates that are available to the site server and retrieved from the selected CA. Select the certificate template that will be used to request the certificates for AMT-based computers.

  8. Click OK to close the Certificate Configuration dialog box.

  9. Click the Provisioning Settings tab.

  10. In the section AMT Provisioning and Discovery Accounts, click the New icon.

  11. In the AMT Provisioning and Discovery Account dialog box, specify the following:

    1. Name: Enter the name of the provisioning account configured in the BIOS extensions.
    2. Password: Enter the password that is configured in the BIOS extensions for the provisioning account.
    3. Confirm password: Reenter the password for confirmation.
    4. Description: Optionally, enter a description that will help you identify the account. The description is particularly useful if you have multiple accounts to configure to help you identify which account relates to which computers.

  12. Click OK to close the AMT Provisioning and Discovery Account dialog box.

  13. Click OK to close the Out of Band Management Properties dialog box.

See Also

Tasks

How to Add an AMT Provisioning and Discovery Account
How to Provision Computers for AMT

Reference

Out of Band Management Properties: General Tab
Out of Band Management Configuration Properties: Provisioning Settings Tab

Concepts

About AMT Provisioning for Out of Band Management
Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management

Other Resources

Configuring Out of Band Management


How to Register an Alias in DNS for the Out of Band Service Point

Topic last updated—May 2008

Registering an alias in DNS for the out of band service point in Configuration Manager 2007 SP1 allows AMT-based computers to automatically provision for AMT out of band. (The Configuration Manager 2007 SP1 client is not installed.)

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

For more information about how AMT-based computers use DNS during the provisioning process, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.

Typically, AMT-based computers are configured in the BIOS extensions to use the name of ProvisionServer for the provisioning server. This name must resolve to the IP address of the site system server that has the out of band service point role. When this name is not already registered in DNS, an alias (CNAME) record in DNS is required.

Configuration Manager can automatically register the alias of ProvisionServer if your DNS servers support dynamic updates. (The record is created by the site server.) Alternatively, you can manually create an alias record, which would be appropriate if your DNS servers do not support dynamic updates or you are using an alternative name to ProvisionServer.

Note
To use this feature, a host record (an A record) for the out of band service point site system server must be registered in DNS.

Use the following procedures to automatically register the alias of ProvisionServer in DNS or manually add the record to a Microsoft DNS server. For information about manually adding CNAME records for non-Microsoft DNS servers, refer to your DNS documentation.

Important
Do not enable this option if you have not yet installed the out of band service point role. For information about installing the out of band service point role, see How to Install the Out of Band Service Point.

To automatically register an alias of ProvisionServer in DNS

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration, right-click Out of Band Management, and then click Properties.

  2. On the General tab, select Register ProvisionServer as an alias in DNS, and then click OK.

To manually register an alias in Microsoft DNS

  1. In the DNS console, expand the Forward Lookup Zones folder for the server you want to work with.

  2. Right-click the domain that contains the out of band service point, and then click New Alias (CNAME).

  3. Type in ProvisionServer or your alternative name for the Alias name field.

  4. In the Fully qualified domain name (FQDN) for target host field, type or browse to the fully qualified domain name of the site system server hosting the out of band service point.

  5. Click OK.

See Also

Tasks

How to Configure AMT Provisioning
How to Identify Computers That Are Provisioned for AMT
How to Provision Computers for AMT

Reference

Out of Band Management Properties: General Tab

Concepts

Prerequisites for Out of Band Management

Other Resources

Configuring Out of Band Management


How to Configure AMT Settings and AMT User Accounts

Topic last updated—May 2008

When computers are provisioned for AMT in Configuration Manager 2007 SP1, they are configured with AMT settings such as whether IDE redirection and serial over LAN are enabled, whether bypassing the BIOS password is allowed, and whether to respond to ping commands. Additionally, they are configured with AMT User Accounts that are used to connect to the AMT-based computer by using the out of band management console.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To use the out of band management console, you must configure at least one AMT User Account by specifying a Windows domain global security group or domain user account and then enable the specific AMT rights for that AMT User Account.

Important
If you configure AMT settings and AMT User Accounts after computers are provisioned for AMT, you must update the AMT memory for these computers so that they are reconfigured with the new settings. Computers that are already provisioned for AMT do not dynamically reconfigure with new AMT settings and AMT User Accounts. For more information, see How to Update AMT Settings in Provisioned Computers Using Out of Band Management.

Use the following procedure to configure AMT settings and AMT User Accounts for out of band management.

To configure AMT settings and AMT User Accounts

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration.

  2. Right-click Out of Band Management, click Properties, and then click the AMT Settings tab.

  3. To configure AMT User Accounts, perform one of the following actions:

    • To create a new AMT account: Click the New icon, and in the AMT User Account Setting dialog box, specify the Windows user account or security group, select the AMT features to enable for the account, and then click OK. A maximum of 32 accounts that use up to 4 different domains is supported.
    • To edit an existing AMT user account: Select the account, click the Properties icon, and in the AMT User Account Setting dialog box, select or cancel the AMT features to enable for the account, and then click OK.
    • To delete an AMT user account: Select the account, and then click the Delete icon.

  4. In the field Default IDE redirect image, either browse to or type in the default network path and name of the image file (with an .iso or .img file extension) or type in a drive that is attached to the computer running the out of band management console. This value will be displayed in the out of band management console for when an AMT-based computer is configured to restart using a boot image file.

  5. Select or cancel the configuration options for the following:

    1. Enable Web interface
    2. Enable serial over LAN and IDE redirection
    3. Allow ping responses
    4. Enable BIOS password bypass for power on and restart commands

  6. If you have installed and configured the Intel translator with all default settings on the out of band service point site system server, select Enable support for Intel WS-MAN translator.

  7. Change the value for Kerberos clock tolerance, if required. This is the allowed difference between the clock of the management controller and the timestamp of a received message. (It is used to help eliminate replay attacks.)

  8. Click OK.

See Also

Tasks

How to Manage Computers Using the AMT Web Console
How to Power On or Restart a Computer Using Out of Band Management
How to Provision Computers for AMT
How to Update AMT Settings in Provisioned Computers Using Out of Band Management

Reference

AMT User Account Settings Dialog Box
Out of Band Management Properties: AMT Settings Tab

Concepts

About AMT Provisioning for Out of Band Management
About the AMT User Accounts

Other Resources

Configuring Out of Band Management


How to Discover Computers with Management Controllers

Topic Last Updated—August 2008

Discovering computers with management controllers is helpful for when you want to provision AMT-based computers in-band by using Configuration Manager 2007 SP1. For more information about AMT provisioning, see How to Provision Computers for AMT.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

After management controllers are discovered, you can identify them using the procedures in How to Identify Computers That Can Support Out of Band Management.

The discovery process requires that the out of band service point is installed and that it has an account that it can use to successfully access the management controllers, which might require that you configure AMT Provisioning and Discovery Accounts. For more information about these procedures, see the following topics:

  • How to Install the Out of Band Service Point
  • Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management
  • How to Add an AMT Provisioning and Discovery Account

The out of band service point looks for network devices that are listening on the IANA registered port numbers TCP 16992 and TCP 16993.

Management controllers can be discovered in the following ways:

  • During network discovery, if the administrator has configured network discovery to include management controllers.
  • When an administrator initiates discovery of management controllers for a collection or a resource.
  • When the out of band service point provisions an AMT-based computer. This process happens automatically.

Use the following procedures to discover computers with management controllers.

To configure network discovery of management controllers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Discovery Methods.

  2. Right-click Network Discovery, and then click Properties.

  3. On the General tab, select Enable discovery of out of band management controllers.

  4. Click OK.

    Note
    For more information about network discovery and how to schedule it to run, see About Network Discovery and How to Schedule Network Discovery.

To initiate discovery of computers with management controllers for a collection

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Right-click the collection for which you want to initiate discovery of management controllers, click Out of Band Management, and then click Discover Management Controllers.

  3. Click OK in the confirmation dialog box.

To initiate discovery of selected computers with management controllers

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. From one of the collections, select one or multiple resources for which you want to initiate discovery of management controllers, right-click and select Out of Band Management, and then click Discover Management Controllers.

  3. Click OK in the confirmation dialog box.

See Also

Concepts

About Configuration Manager Discovery
Overview of Out of Band Management
Prerequisites for Out of Band Management

Other Resources

Configuring Out of Band Management


How to Provision Computers for AMT

Topic last updated—May 2008

Before computers can be managed out of band in Configuration Manager 2007 SP1, they must be provisioned by Configuration Manager. You can provision computers for AMT either out of band (without the Configuration Manager 2007 SP1 client) or in-band (using the Configuration Manager 2007 SP1 client). Consider the following information to help you decide on which method to use:

  • Automatic out of band provisioning: This method is suitable for new computers that do not have an operating system installed. It is also suitable if a new computer has an operating system installed but does not have the Configuration Manager 2007 SP1 client installed.
    Important
    This provisioning method requires that you specify the correct SMBIOS GUID for each computer. The SMBIOS GUID is also known as the UUID, and your computer manufacturer or supplier should be able to provide this value if you cannot locate it.

    The computer firmware is configured to contact a provisioning server, which can be specified as an IP address in the BIOS extensions or located with a DNS record.
    This provisioning method works within the first 24 hours of the computer booting up from the manufacturer. After this time period, AMT must be activated for another 24-hour time period, or you must use in-band provisioning. Entering a new certificate thumbprint (also known as a certificate hash) will reactivate AMT, as will removing the provisioning information from AMT by configuring the BIOS extensions. For more information, refer to your computer's manufacturer instructions for configuring the BIOS extensions.
  • Automatic in-band provisioning with the Configuration Manager client: This method is suitable if you want computers with a management controller and running the Configuration Manager 2007 SP1 client to be automatically provisioned.
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

If you have AMT-based computers that are currently managed by another AMT solution and want them to be managed by Configuration Manager, you must decide on a migration strategy. For more information, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

When the Configuration Manager 2007 SP1 client is installed on a new computer, Configuration Manager gives preference to in-band provisioning and does not process out of band provisioning requests by the computer. The exception to this preference occurs when you are migrating AMT-based computers by using an export utility, as explained in the migration topic referenced previously.

Use the following procedures to provision computers for AMT so that they can be managed out of band in Configuration Manager 2007 SP1. If you need to apply new AMT configuration options to computers that are already provisioned, see How to Update AMT Settings in Provisioned Computers Using Out of Band Management.

Important
Before running these procedures, ensure that you have created and configured an Active Directory container, you have an out of service point installed, and the required certificates are in place. For more information about preparing the certificates, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

To provision computers for AMT using automatic out of band provisioning

  1. Ensure that computers can locate a provisioning server. This can be achieved by a number of methods, including the following:

    • Specify the out of band service point's IP address as the Provisioning Server in the BIOS extensions of the computer.
    • Configure computers to use DNS where they can resolve the name of ProvisionServer to the IP address of the out of band service point. For more information, see How to Register an Alias in DNS for the Out of Band Service Point.
      Note
      If you need more information about the various methods in which the provisioning server can be located by AMT-based computers, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.

  2. Right-click Collections, and then click Import Out of Band Computers.

  3. Follow the instructions in the wizard. If you need more information, see Import Computer for Out of Band Management Wizard.

  4. Right-click the collection that you selected in the wizard, click Update Collection Membership, click OK, and then press F5 to display the computers that you have just imported.

  5. Ensure that the power cable and network adapter is connected to the computer. There is no need to start up the computer if it is not already running.

  6. Monitor provisioning progress. For more information, see How to Identify Computers That Are Provisioned for AMT.

To provision computers for AMT using automatic in-band provisioning with the Configuration Manager 2007 SP1 client

  1. Optionally, discover computers that have management controllers and then create a collection for just these computers:

    • To discover computers with management controllers, see How to Discover Computers with Management Controllers.
    • Create a collection by using the following query: Select * from sms_r_system where AMTStatus=2 or AMTStatus=1.

  2. Right-click a collection that contains computers to be provisioned in-band, click Modify Collection Settings, and select Out of Band.

  3. Select Enable automatic out of band management controller provisioning, and then click OK.

  4. Monitor provisioning progress. For more information, see How to Identify Computers That Are Provisioned for AMT.

See Also

Tasks

How to Configure AMT Provisioning
How to Install the Out of Band Service Point

Concepts

About AMT Provisioning for Out of Band Management
Certificate Requirements for Out of Band Management
Configuration Manager AMT Provisioning Process for Out of Band Management
Example Scenarios for Implementing Out of Band Management

Other Resources

Configuring Out of Band Management


How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management

Topic last updated—March 2008

Powering on computers by using out of band management in Configuration Manager 2007 allows computers assigned to the site to wake up if they are in a sleep state—for example, if they are in hibernation or turned off—so that they can respond to scheduled management tasks.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Computers can be brought out of a sleep state using the following methods:

  • By sending wake-up packets from the site server, without establishing a session with target computers and without authentication.
  • By sending power on commands from the out of band service point, using an established and authenticated session.
Note
Before computers can be woken up using power on commands, you must install an out of band service point and computers must be provisioned for out of band management. For more information, see How to Install the Out of Band Service Point and How to Provision Computers for AMT.

To help you decide whether to use wake-up packets or power on commands, see Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN.

To configure the site to send power on commands using out of band management

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management.

  2. Right-click <site code> - <site name>, and then click Properties.

  3. On the Wake On LAN tab in the site properties dialog box, select the option Enable Wake On LAN for this site, and then select one of the following options:

    • Use power on commands if the computer supports this technology; otherwise, use wake-up packets
    • Use power on commands only

  4. Click OK.

See Also

Reference

Site Properties: Wake On LAN Tab

Concepts

Prerequisites for Out of Band Management
Prerequisites for Wake On LAN

Other Resources

Configuring Out of Band Management
Wake On LAN in Configuration Manager


How to Update AMT Settings in Provisioned Computers Using Out of Band Management

Topic last updated—March 2008

You must update AMT-based computers for out of band management if you change the AMT settings in Configuration Manager 2007 SP1 after the computers are provisioned by Configuration Manager. Computers that are already provisioned for AMT are not automatically reconfigured.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

If you have AMT-based computers that are provisioned by another AMT management solution, these computers must be migrated before they can be updated by Configuration Manager. For more information, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

Use the following procedure to apply new AMT settings to computers that are already provisioned by Configuration Manager.

To update computers for new AMT settings

  • From the Collections node in the Configuration Manager console, locate the AMT-based computer to update, right-click the computer, click Out of Band Management, click Update Provisioning Data in Management Controller Memory, and then click OK.

See Also

Tasks

How to Configure AMT Settings and AMT User Accounts
How to Configure AMT Provisioning
How to Provision Computers for AMT

Other Resources

Configuring Out of Band Management


How to Add an AMT Provisioning and Discovery Account

Topic last updated—May 2008

You might need to configure an account for AMT provisioning and discovery for the AMT-based computers that will be managed out of band by Configuration Manager 2007 SP1. For example, you must specify an account if your manufacturer provided you with a customized MEBx account that is not named admin and has a password other than admin. Another example is if you have locally changed password for the MEBx Account in the computer’s BIOS extensions. For more information to help you decide whether you need to specify an AMT Provisioning and Discovery Account and its configuration requirements, see Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

If an AMT Provisioning and Discovery Account is needed for an AMT-based computer but is not specified, Configuration Manager cannot provision the AMT-based computer for out of band management or discover whether it has a management controller and its AMT status. For more information about AMT provisioning and discovery of management controllers, see the following topics:

  • About AMT Provisioning for Out of Band Management
  • How to Identify Computers That Can Support Out of Band Management
  • About the AMT Status and Out of Band Management

Use the following procedure to add an account in Configuration Manager for AMT provisioning and discovery.

To add an account for AMT provisioning and discovery

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration.

  2. Right-click Out of Band Management, and then click Properties.

  3. Click the Provisioning Settings tab.

  4. In the section AMT Provisioning and Discovery Accounts, click the New icon.

  5. In the AMT Provisioning and Discovery Account dialog box, specify the following:

    1. Name: Enter the name of the MEBx Account or Remote Admin Account. Unless you have been provided with a customized account name by your manufacturer, specify admin.
    2. Password: Enter the password that is configured in the BIOS extensions for the account.
    3. Confirm password: Reenter the password for confirmation.
    4. Description: Optionally, enter a description that will help you identify the account. The description is particularly useful if you have multiple accounts to configure to help you identify which account relates to which computers.

  6. Click OK, and then click OK to close the Out of Band Management Properties dialog.

See Also

Tasks

How to Discover Computers with Management Controllers
How to Provision Computers for AMT

Concepts

Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management

Other Resources

Configuring Out of Band Management


How to Remove Provisioning Information for AMT-Based Computers

Topic last updated—March 2008

There might be occasions when you want to remove the provisioning information for an AMT-based computer, such as when you no longer want the computer managed out of band by Configuration Manager 2007 SP1 but by another AMT solution instead.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The following options are available for removing provisioning information for the computer:

  • You can remove the configuration data for the management controller (including whether IDE redirection and serial over LAN are enabled, network pings are supported, and the Web interface is enabled) but keep identification information about the computer (including its host name, IP address, and DNS suffix).
  • You can remove both the configuration data and the identification information from the computer.

Additionally, the following actions are performed when you remove provisioning information:

  • The primary site server revokes the certificate that was issued to the AMT-based computer when it was provisioned. The revocation reason is Superseded.
  • The primary site server removes the Active Directory object that was published to Active Directory Domain Services.
  • The primary site server deletes the SPN for the AMT-based computer.

By default, AMT-based computers will automatically reprovision with Configuration Manager if you have configured out of band or in-band AMT provisioning. (For example, AMT-based computers are running the Configuration Manager 2007 SP1 client and they are members of a collection configured with the setting Enable Automatic Out of Band Management Controller Provisioning). To prevent automatic provisioning, select the option Disable automatic out of band provisioning when you remove provisioning information for the computer.

Note
If you disable automatic reprovisioning and later want to automatically provision these AMT-based computers, right-click the resource, click Out of Band Management, and then click Enable Automatic Provisioning. If you reassign the client to another Configuration Manager 2007 SP1 hierarchy that is configured for automatic in-band provisioning, the automatic AMT provisioning status of disabled is not carried forward to the new hierarchy.

Use the following procedure to remove provisioning information for an AMT-based computer if you no longer want to manage it out of band with Configuration Manager 2007 SP1.

To remove provisioning information for an AMT-based computer with the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. From one of the collections, right-click one or multiple AMT-based computers, click Out of Band Management, and then click Delete Provisioning Data from Management Controller Memory.

  3. Select a data removal option.

  4. If you want to prevent the AMT-based computer from automatically reprovisioning in-band, select the option Disable automatic out of band provisioning.

  5. Click OK.

See Also

Tasks

How to Identify Computers That Are Provisioned for AMT
How to Provision Computers for AMT
How to Run the Out of Band Management Console

Concepts

About AMT Provisioning for Out of Band Management
About Certificates for Out of Band Management


How to Customize Maintenance Tasks for Out of Band Management

Topic last updated—March 2008

Out of band management in Configuration Manager 2007 SP1 has the following maintenance tasks that are enabled automatically when you install the out of band service point:

  • Evaluate Provisioned AMT Computer Certificates
  • Reset AMT Computer Passwords
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In most cases, you will not need to change the default settings for these tasks. Refer to the following table for more information about these tasks.

Task Description Settings

Evaluate Provisioned AMT Computer Certificates

This task checks the validity period of the certificate issued to AMT-based computers and automatically requests a new certificate before it expires.

Requesting a certificate renewal 42 days before it expires allows plenty of time if there are issues, such as the issuing certification authority is not available or there are connectivity issues.

Schedule: Every Saturday between 12 AM and 5 AM.

Pending days to expiration: 42.

Reset AMT Computer Passwords

This task resets the remote password that is used by Configuration Manager to manage AMT-based computers. For security purposes, computer account passwords are regularly changed (every 30 days) unless this Windows functionality is disabled (for example, by using Group Policy).

If the computer account password is reset and the AMT remote password is not reset, Configuration Manager will be unable to connect to the AMT-based computer by using out of band communication.

Do not disable this task unless you disable the Windows functionality of automatic password changes for computer accounts.

Password reset interval (days): 28.

If you need to customize the maintenance tasks for out of band management, use the following procedure.

Note
You must have Read or Modify permission for the site security object class or instance to perform this procedure.

To customize an out of band management maintenance task

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Site Maintenance / Tasks.

  2. Right-click one of the following tasks, and then click Properties.

    • Evaluate Provisioned AMT Computer Certificates
    • Reset AMT Computer Passwords

  3. In the task properties dialog box, change the settings as required.

  4. Click OK.

See Also

Concepts

About Certificates for Out of Band Management

Other Resources

Configuring Out of Band Management


How to Migrate AMT-Based Computers to Configuration Manager After Running an Export Utility

Topic last updated—May 2008

Configuration Manager 2007 SP1 cannot automatically manage AMT-based computers that have been provisioned by another AMT management solution. If you have decided to migrate these computers using an export utility supplied with the other management solution, you can provision these computers out of band using the following procedure.

For more information about deciding on a migration strategy, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

Before running this procedure, ensure that you meet the following prerequisites:

  • You have the CSV file that was produced as a result of running the export procedure from your other management solution, and it is accessible from the Configuration Manager console.
  • You have configured the Configuration Manager site for AMT provisioning. For more information, see How to Configure AMT Provisioning.
  • The AMT-based computers will be able to locate the out of band service point in their assigned site as their provisioning server. This can be achieved in various ways, including an alias record in DNS that is configured with the FQDN of the site system server that is configured with the out of band service point role. For more information, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.
  • If the computers you want to migrate are running a version of AMT that is less than 3.2.1, you have installed and configured the Intel WS-MAN translator on the site system server with the out of band service point role. For more information, see http://go.microsoft.com/fwlink/?LinkId=108363.

To migrate AMT-based computers from another management solution after using their export utility

  1. Create an empty collection that will contain the imported computers. For more information, see How to Create a Collection.

  2. Click the collection, and view the columns in the results pane. If the AMT Status column and AMT Version column are displayed, go to step 3. If either or both of these columns are not displayed, perform the following actions:

    1. Right-click the collection, click View, and then click Add/Remove columns.
    2. Under Available columns, click AMT Status and AMT Version as required, and then click Add.
    3. If you do not want these columns to be displayed last in the Configuration Manager console, click the column that you have added, click Move Up until it is listed in the order you require, and then click OK.

  3. If you have already configured Configuration Manager to use the Intel WS-MAN translator, go to step 4. If you need to enable this option, perform the following actions:

    1. Navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration.
    2. Right-click Out of Band Management, and then click Properties.
    3. Click the AMT Settings tab, select Enable support for Intel WS-MAN translator, and then click OK.

  4. Run the Import Computer for Out of Band Management Wizard using the following steps:

    1. Right-click Collections, and then click Import Out of Band Computers.
    2. On the Select Source Page of the wizard, ensure that the option Import computers using a file is selected (the default), and then click Next.
    3. On the Choose Mapping Page of the wizard, specify the exported CSV file, use the File Preview information to make any changes required to correctly assign the values to the listed columns, and then click Next.
    4. Confirm the information shown on the Data Preview Page, and then click Next.
    5. On the Choose Target Collection Page, enter or browse to the collection that you created in step 1, and then complete the wizard.

  5. Update the collection membership for the collection created in step 1 using the following actions:

    1. Right-click the collection.
    2. Click Update Collection Membership, and then click OK.
    3. Press F5 to refresh the display.

  6. Monitor the progress of AMT provisioning. For more information, see How to Identify Computers That Are Provisioned for AMT.

See Also

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Configuring Out of Band Management
Import Computer for Out of Band Management Wizard
Planning for Out of Band Management


Tasks for Out of Band Management

Topic last updated—March 2008

The content in this section provides the steps necessary to accomplish tasks related to using out of band management in Configuration Manager 2007 SP1.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Before running these tasks, ensure that the site is configured for out of band management. For more information, see Administrator Checklist: Enabling Out of Band Management.

In This Section

How to Identify Computers That Can Support Out of Band Management

How to Identify Computers That Are Provisioned for AMT

How to Run the Out of Band Management Console

How to Power Off a Computer Using Out of Band Management

How to Power On or Restart a Computer Using Out of Band Management

How to Configure BIOS Settings for a Computer Using Out of Band Management

How to Update the Firmware for a Computer Using Out of Band Management

How to Run Commands, Repair Utilities, and Diagnostic Applications for a Computer Using Out of Band Management

How to Manage Computers Using the AMT Web Console

How to Monitor Out of Band Management

See Also

Concepts

Example Scenarios for Using Out of Band Management

Other Resources

Configuring Out of Band Management
Out of Band Management in Configuration Manager 2007 SP1


How to Identify Computers That Can Support Out of Band Management

Topic last updated—May 2008

To manage computers out of band in Configuration Manager 2007 SP1, computers must have management controllers that are capable of supporting out of band management in Configuration Manager 2007 SP1, and they must be provisioned for AMT by Configuration Manager.

When Configuration Manager has discovered computers with management controllers, identifying these computers allows you to monitor their provisioning status for AMT and initiate AMT provisioning if they have the Configuration Manager 2007 SP1 client installed. For more information about discovering computers with management controllers, see How to Discover Computers with Management Controllers.

For more information about provisioning computers for AMT, see How to Provision Computers for AMT.

Use the following procedures to identify computers that can support out of band management by running a report, using the Configuration Manager console, or running a query. You must have a reporting point installed to run reports in Configuration Manager.

For more information about the AMT status values, see About the AMT Status and Out of Band Management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To identify computers that can support out of band management by running a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports with the category of SMS Site - Client Information.

  3. Locate the report Computers with out of band management controllers, right-click it, and then click Run.

  4. In the Report Information window, enter or select a version number for AMT, and then click Display to view the report.

  5. View the value displayed for each computer in the column AMT Status.

To identify computers that can support out of band management by using the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Click a collection, and view the columns in the results pane. If the AMT Status column is displayed, go to step 6. If the AMT Status column is not displayed, right-click the collection, click View, and then click Add/Remove columns.

  3. Under Available columns, click AMT Status, and then click Add.

  4. If you do not want the AMT status to be displayed last, ensure that AMT Status is selected, and then click Move Up until it is listed in the order you require.

  5. Click OK.

  6. View the value in the AMT Status column in the results pane to identify computers that can support AMT.

To identify computers that can support out of band management by running a query

  • Run one of the following queries:

    • To display computers that have a management controller that can be provisioned for AMT by Configuration Manager, run Select * from sms_r_system where AMTStatus=2
    • To display computers that have a management controller and have been successfully provisioned for AMT, run Select * from sms_r_system where AMTStatus=3

See Also

Tasks

How to Configure AMT Provisioning
How to Create a Reporting Point

Concepts

About the AMT Status and Out of Band Management

Other Resources

Tasks for Out of Band Management


How to Identify Computers That Are Provisioned for AMT

Topic last updated—May 2008

To manage computers out of band in Configuration Manager 2007 SP1, computers must be provisioned for AMT.

Identifying computers that are provisioned for AMT allows you to monitor the provisioning status for AMT and create a collection for computers that can be managed out of band.

For more information about provisioning computers for AMT, see How to Provision Computers for AMT.

Use the following procedures to identify computers that are provisioned for AMT by running a report, using the Configuration Manager console, and running a query. You must have a reporting point installed to run reports in Configuration Manager.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To identify computers that are provisioned for AMT by running a report

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the Reports node, click the Category column to sort the reports so that you can more easily find the reports with the category of SMS Site - Client Information.

  3. Locate the report Status of client out of band management provisioning, right-click it, and then click Run.

  4. In the report, view the computers that have been provisioned and can be managed out of band by Configuration Manager.

To identify computers that are provisioned for AMT by using the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. Click a collection, and view the columns in the results pane. If the AMT Status column is displayed, go to step 6. If the AMT Status column is not displayed, right-click the collection, click View, and then click Add/Remove columns.

  3. Under Available columns, click AMT Status, and then click Add.

  4. If you do not want the AMT status to be displayed last, ensure that AMT Status is selected, and then click Move Up until it is listed in the order you require.

  5. Click OK.

  6. View the value in the AMT Status column in the results pane to identify computers with the value of Provisioned.

To identify computers that are provisioned for AMT by running a query

  • Run the following query: Select * from sms_r_system where AMTStatus=3

See Also

Tasks

How to Configure AMT Provisioning
How to Create a Reporting Point

Concepts

About the AMT Status and Out of Band Management

Other Resources

Tasks for Out of Band Management


How to Run the Out of Band Management Console

Topic last updated—May 2008

The out of band management console in Configuration Manager 2007 SP1 allows you to connect to a computer to manage it even if it does not have the Configuration Manager client installed, if the operating system is not responding, or if the computer is powered down. You can run multiple out of band management consoles to connect to different AMT-based computers at the same time. However, an AMT-based computer cannot be managed by more than one out of band management console at the same time. In this scenario, the second and subsequent connections will fail to restart the computer or to establish a serial connection.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The computer must be provisioned for AMT before you can connect to it by using the out of band management console, and you must be logged on using one of the AMT user accounts that are specified and configured with administrative rights in the Out of Band Management Properties: AMT Settings Tab.

You cannot run multiple out of band management consoles to manage the same computer.

Use the following procedures to run the out of band management console.

To run the out of band management console from the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. From one of the collections, right-click the resource that you want to manage by using the out of band management console, click Out of Band Management, and then click Out of Band Management Console.

    Note
    The Out of Band Management Console option is available for a resource only if it is provisioned for AMT. If the resource is outside its assigned site, ensure that you are a member of the SMS Admins group for the computer’s assigned site. For more information about this group, see About the SMS Admins Group.

  3. When you have completed your out of band management tasks for the currently selected computer, you can leave the console running and connected or perform one of the following actions:

    • Click File, and then click Exit to disconnect from the computer and exit the out of band management console.
    • Click Connection, and then click Disconnect so that you can reconnect to the same computer later.

To run the out of band management console from the command prompt

  1. Open a command prompt and type the following: <ConfigMgrInstallPath>\bin\oobconsole.exe -s <siteserver> -t <resourceID>.

    Note
    If you are running the out of band management console outside the client's assigned site, specify the site server in the client's assigned site.

  2. When you have completed your out of band management tasks for the currently selected computer, you can leave the console running and connected or perform one of the following actions:

    • Click File, and then click Exit to disconnect from the computer and exit the out of band management console.
    • Click Connection, and then click Disconnect so that you can reconnect to the same computer later.

See Also

Tasks

How to Provision Computers for AMT

Other Resources

Tasks for Out of Band Management


How to Power Off a Computer Using Out of Band Management

Topic last updated—March 2008

You can power off a computer in Configuration Manager 2007 if it has been provisioned for AMT. You can power off a single computer or multiple computers in a selected collection.

This power control action is available from the Configuration Manager console and from the out of band management console.

Caution
Powering off a computer should be performed as a last resort in a troubleshooting scenario where the operating system is not responding. Powering off a computer has the same effect as removing the power cable from the computer: the operating system does not shut down properly, unsaved work will be lost, and logged in users are given no notice of the power off action.

Use the following procedures to power off a computer.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To power off computers from the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. From one of the collections, select one or multiple resources to power off, right-click Out of Band Management, and then click Power Control.

    Note
    The Power Control option is available for a resource only if it is provisioned for AMT.

  3. In the Power Control dialog box, select Power off, and then click OK to confirm the action.

To power off a single computer by using the out of band management console

  1. Connect to the resource using the out of band management console.

  2. Click Power Control, click Power Off, and then click Yes to confirm the action.

See Also

Tasks

How to Provision Computers for AMT
How to Run the Out of Band Management Console

Other Resources

Tasks for Out of Band Management


How to Power On or Restart a Computer Using Out of Band Management

Topic last updated—March 2008

You can power on or restart a computer in Configuration Manager 2007 if it has been provisioned for AMT. You can power on or restart a single computer or multiple computers in a selected collection. The power-on and restart power control actions are available from the Configuration Manager console and the out of band management console.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

When you power on or restart a computer by using the out of band management console, you can also select the boot action to perform when the computer has powered up or restarted. The boot options available depend on what the computer supports, but typically include the following:

  • Boot normally
  • Boot from local CD or DVD drive
  • Boot from local hard drive
  • Boot from IDE redirection location
  • Boot from the network
  • Boot to BIOS
Note
If you power on or restart a computer that has a BIOS password configured, by default the computer will wait for the password to be entered until after it has powered on or restarted. If the computer supports bypassing the BIOS password for AMT management (this setting is manufacturer-dependent), selecting the option Enable BIOS password bypass in the Out of Band Management Properties: AMT Settings Tab or in the out of band management console will enable the computer to boot after the power on or restart action is performed.

Additionally, you can power on a computer prior to the configured deadline for a software update deployment and prior to the configured schedule of a mandatory advertisement, which can be for software distribution or a task sequence.

Caution
Restarting a computer should be performed as a last resort in a troubleshooting scenario where the operating system is not responding. Restarting a computer has the same effect as pressing the restart button: the operating system does not shut down properly, unsaved work will be lost, and logged in users are given no notice of the restart command.

Use the following procedures to power on or restart a computer.

To power on or restart individual computers from the Configuration Manager console

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Collections.

  2. From one of the collections, select one or multiple resources to power on or restart, right-click Out of Band Management, and then click Power Control.

    Note
    The Power Control option is available for a resource only if it is provisioned for AMT.

  3. In the Power Control dialog box, select Power on if the computer is turned off or Restart Computer if the computer is running, and then click OK.

To power on or restart a single computer using the out of band management console

  1. Connect to the resource using the out of band management console.

  2. Click Power Control.

  3. If you want the computer to use a boot option that is different from its default configuration after it has powered on or restarted, select it from the Boot option list.

  4. If you select a boot option that uses IDE redirection, click Boot from local drive or Boot from file, and ensure that the default value associated with the option specified is correct for the computer. If you want to use another value, click the dropdown menu for the local drive, or click Browse to select the path and file name that contains the image file that you want to use.

    Note
    To use the Boot from local drive and Boot from file options, the option Enable serial over LAN and IDE redirection must be selected in the Out of Band Management Properties: AMT Settings Tab.

  5. Optionally, select Bypass BIOS password and Lock remote keyboard if required and if these options are supported by the AMT-based computer.

  6. Click Power On if the computer is turned off, or click Restart Computer if the computer is running.

To power on computers prior to the configured deadline for a software update deployment and prior to the configured schedule of a mandatory advertisement

  1. Ensure that the site is configured to send power-on commands for scheduled wake-up activities. For more information, see How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management.

  2. Configure the scheduled activity for wake up. For more information, see the following:

    • How to Configure a Software Update Deployment for Wake On LAN.
    • How to Configure a Software Distribution Mandatory Advertisement for Wake On LAN.
    • How to Configure a Task Sequence Mandatory Advertisement for Wake On LAN.

See Also

Tasks

How to Configure BIOS Settings for a Computer Using Out of Band Management
How to Provision Computers for AMT
How to Run Commands, Repair Utilities, and Diagnostic Applications for a Computer Using Out of Band Management
How to Run the Out of Band Management Console
How to Update the Firmware for a Computer Using Out of Band Management

Other Resources

Tasks for Out of Band Management


How to Configure BIOS Settings for a Computer Using Out of Band Management

Topic last updated—May 2008

You can remotely view and change BIOS settings of a computer in Configuration Manager 2007 SP1 if the computer has been provisioned for AMT.

Note
To use this option, the out of band management component must be configured with the option Allow serial over LAN and IDE-Redirect for AMT devices in the following location: Out of Band Management Properties: AMT Settings Tab.

This out of band management option uses serial-over-LAN technology and runs a terminal emulation session within the out of band management console so that you can remotely view and interact with the computer output.

Use the following procedure to run a serial over LAN connection to a computer so that you can remotely view and modify BIOS settings.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To configure BIOS settings of a computer by using out of band management

  1. Connect to the resource by using the out of band management console.

  2. If you need to change the default terminal emulation type from PC ANSI to VT-100 to match the terminal emulation settings in the target computer's BIOS, click Tools, click Options, select VT-100, and then click OK.

  3. Click Power Control, and from the displayed list of options for Boot Option, select the option that refers to BIOS setup.

  4. Click Power On if the power state of the computer is off, or click Restart Computer if the power state of the computer is on.

  5. Click Serial Connection, and wait for the BIOS setup menu to display.

  6. Click inside the blank window to activate the remote display session.

  7. View or change and then save BIOS settings as required. When you have completed BIOS setup, selecting the option to save the settings will automatically restart the computer.

    Note
    Refer to your computer manufacturer's documentation for more information about configuring the BIOS settings.

  8. If you have finished managing the computer, choose one of the following options:

    1. To disconnect from the computer and close the out of band management console, click File and then click Exit.
    2. To disconnect from the computer but leave the out of band management console running so that you can reconnect to it later, click File and then click Disconnect.

See Also

Other Resources

Tasks for Out of Band Management


How to Update the Firmware for a Computer Using Out of Band Management

Topic last updated—May 2008

You might be able to remotely update the firmware for a computer in Configuration Manager 2007 SP1 if the computer has been provisioned for AMT, and the firmware or BIOS update supports installation from a character-based operating system.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Before installing firmware or BIOS upgrades on computers, consult the manufacturer's installation instructions and ensure that remote installation will be supported. For example, if the instructions for upgrading the firmware include disabling AMT, installation by using out of band management with AMT management controllers will not be possible.

This procedure also requires both of the following:

  • A file to run the firmware update, which can be located from either a network share or is locally available to the computer (for example, has been installed onto the local hard drive using Configuration Manager software distribution).
  • A boot image that runs a character-based operating system.
    Note
    To use this option, the out of band management component must be configured with the option Enable serial over LAN and IDE redirection in the following location: Out of Band Management Properties: AMT Settings Tab.

This out of band management option uses serial-over-LAN technology and runs a terminal emulation session within the out of band management console so that you can remotely view and interact with the computer output.

Use the following procedure to run a serial over LAN connection to a computer so that you can remotely update the firmware for a computer.

To update the firmware for a computer by using out of band management

  1. Connect to the resource by using the out of band management console.

  2. If you need to change the default terminal emulation type from PC ANSI to VT-100 to match the terminal emulation settings in the target computer's BIOS, click Tools, click Options, select VT-100, and then click OK.

  3. Click Power Control, and from the displayed list of options for Boot Option, select the option that refers to IDE redirection.

  4. Click Boot from local drive or Boot from file, and ensure that the default value associated with the specified option is correct for the computer. If you want to use another value, click the drop-down menu for the local drive, or click Browse to select the path and file name that contains the image file that you want to use.

  5. Click Power On if the power state of the computer is off, or click Restart Computer if the power state of the computer is on.

  6. Click Serial Connection and wait for the computer to complete startup, such that the command prompt is displayed.

  7. Click inside the blank window to activate the remote display session.

  8. Run the firmware file.

  9. When the update is complete, click Power Control, and then choose one of the following options:

    1. To restart the computer, select the option that refers to normal boot from the displayed list of options for Boot Option, and then click Restart Computer.
    2. To power down the computer, click Power Off.

  10. If you have finished managing the computer, choose one of the following options:

    • To disconnect from the computer and close the out of band management console, click File and then click Exit.
    • To disconnect from the computer but leave the out of band management console running so that you can reconnect to it later, click File and then click Disconnect.

See Also

Other Resources

Tasks for Out of Band Management


How to Run Commands, Repair Utilities, and Diagnostic Applications for a Computer Using Out of Band Management

Topic last updated—May 2008

You can remotely run commands, repair utilities, and diagnostic applications for a computer in Configuration Manager 2007 SP1 if the computer has been provisioned for AMT. This procedure also requires both of the following:

  • The files or commands to run character-based utilities or applications, which can be located from a network share or are locally available to the computer. (For example, they have been installed onto the local hard drive using Configuration Manager software distribution.)
  • A boot image that runs a character-based operating system.
    Note
    To use this option, the out of band management component must be configured with the option Enable serial over LAN and IDE redirection in the following location: Out of Band Management Properties: AMT Settings Tab.

This out of band management option uses serial-over-LAN technology and runs a terminal emulation session from within the out of band management console so that you can remotely view and interact with the computer output.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Although it is possible to remotely run graphics-based applications, the output will not be visible in the out of band management console. Run graphics-based applications only if you can run them completely automated. For example, you can reinstall an operating system if you also specify an unattended setup file so that no interaction is required for completion.

Use the following procedure to remotely run commands, repair utilities, or diagnostic applications on a computer.

To remotely run commands, repair utilities, or diagnostic applications on a computer

  1. Connect to the resource by using the out of band management console.

  2. If you need to change the default terminal emulation type from PC ANSI to VT-100 to match the terminal emulation settings in the target computer's BIOS, click Tools, click Options, select VT-100, and then click OK.

  3. Click Power Control, and from the displayed list of options for Boot option, select the option that refers to IDE redirection.

  4. Click Boot from file, and if required, change the default value for the IDE redirection file path so that it specifies the path and file that will run the character-based operating system.

  5. Click Power On if the power state of the computer is off, or click Restart Computer if the power state of the computer is on.

  6. Click Serial Connection and wait for the computer to complete startup, such that the command prompt is displayed.

  7. Click inside the blank window to activate the remote display session.

  8. Run the commands, repair utilities, or diagnostic applications.

  9. Click Power Control, and then choose one of the following options:

    • To restart the computer, select the option that refers to normal boot from the displayed list of options for Boot option, and then click Restart Computer.
    • To power down the computer, click Power Off.

  10. If you have finished managing the computer, choose one of the following options:

    • To disconnect from the computer and close the out of band management console, click File and then click Exit.
    • To disconnect from the computer but leave the out of band management console running so that you can reconnect to it later, click File and then click Disconnect.

See Also

Tasks

How to Run the Out of Band Management Console

Other Resources

Tasks for Out of Band Management


How to Manage Computers Using the AMT Web Console

Topic last updated—May 2008

You can use the Intel AMT Web console as an alternative to running the out of band management console in Configuration Manager 2007 SP1 to manage AMT-based computers. Refer to the Intel documentation for more information about this Web console.

Note
To support the AMT Web console, computers must be configured with the option Enable Web interface in the following location: Out of Band Management Properties: AMT Settings Tab.

If you are running Internet Explorer 6, you will need the hotfix to use the Kerberos authentication protocol to connect to a Web site that uses a nonstandard port. For more information about this hotfix, see http://go.microsoft.com/fwlink/?LinkId=112179. After installing the hotfix, follow the post-hotfix installation instructions to modify the registry. If you do not need to install the hotfix because you have the file versions listed in the hotfix documentation, you must still follow the instructions to modify the registry.

Use the following procedure to manage computers using the Intel AMT Web console.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To manage computers using the AMT Web console

  1. From a Web browser, type https://<FQDN_of_computer>:16993.

    Note
    If your Web browser uses a proxy Web server, you might have to configure the computer's FQDN as an exception in your Web browser so that the connection does not use the proxy Web server for this connection on the intranet.

  2. Click Log On, and supply an AMT User Account and credentials.

  3. When you have finished using the AMT Web console, close the Web browser.

See Also

Tasks

How to Run the Out of Band Management Console

Concepts

About the AMT User Accounts

Other Resources

Tasks for Out of Band Management


How to Monitor Out of Band Management

Topic last updated—March 2008

You can monitor out of band management activity in Configuration Manager 2007 SP1 by using the following procedures:

  • Run reports related to out of band management.
  • Use the out of band management performance counter for SMS AMT Operations Manager.
  • Identify status messages related to out of band management.
  • Read log files related to out of band management.
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

To monitor out of band management by running reports

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Reporting / Reports.

  2. In the results pane, type out of band in the Look for field so that you can more easily find the reports relating to out of band management.

  3. Right-click one of the following reports, and then click Run:

    • Clients with out of band management controllers
    • Status of client out of band management provisioning
    • Out of band management console activity
      Note
      For more information about each report, see About Reports for Out of Band Management.

  4. If you see the Report Information window, specify any required or optional values, and then click Display.

To monitor out of band management by using the out of band management performance counter

  1. In the Performance utility, ensure that the site server is selected as the target computer and from the Performance object drop-down menu, select SMS AMT Operations Manager.

  2. Select either All counters or select Select counters from list, and then click one or more of the following options:

    • Number of packets per second
    • Total number of packets failed
    • Total number of packets sent
    • Total number of requests pending

  3. Click Add for each out of band management performance counter you require.

  4. Click Close.

To monitor out of band management by using status messages

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. Right-click the query All Status Messages, and then click Show Messages.

  3. In the All Status Messages dialog box, you are prompted for the time period for which you want to check status messages. Enter the time period or date and time, and then click OK.

  4. All status messages are displayed in the Status Message Viewer. Click the Component column, and locate the status messages with a component named SMS_AMT_OPERATION_MANAGER.

  5. Identify any status messages related to out of band management. These have a status number that falls within the following ranges:

    • 7200–7299
    • 7600–7699
    • 30300–30400

  6. For more information about any of the status messages, right-click a status message, and then select Detail.

  7. View the information in the Status Message Details dialog box, and then click OK to close this dialog box, or click Previous or Next to view the details of other status messages.

  8. Click OK to close the Status Message Details dialog box, and close the Status Message Viewer.

To monitor out of band management by using log files

  • For a list and description of log files related to out of band management, see Log Files for Out of Band Management.

See Also

Reference

Status Message Details Dialog Box

Concepts

About Configuration Manager Reports
List of Log Files in Configuration Manager 2007
Using Status Messages for Configuration Manager Troubleshooting

Other Resources

Tasks for Out of Band Management
Troubleshooting Out of Band Management


Out of Band Management Security Best Practices and Privacy Information

Topic last updated—May 2008

Out of band management in Microsoft System Center Configuration Manager 2007 SP1 provides a convenient way to control computers that have the Intel vPro chip set and Intel Active Management Technology (Intel AMT) firmware versions 3.2.1 or later. However, it is important to restrict access so that unauthorized users do not have a convenient way to attack those AMT-based computers.

Security Best Practices

Use in-band provisioning instead of out of band provisioning With out of band provisioning, it is possible for attackers to create rogue provisioning servers with certificates and impersonate valid provisioning servers. Using in-band provisioning, especially in native mode, allows the client to use the trust relationship already established between the client and the Configuration Manager infrastructure. To disable out of band provisioning by using the BIOS extensions for AMT, configure the IP address of the provisioning server as 0.0.0.0 and set the provisioning port to 0.

Control the request and installation of the provisioning certificate Request the provisioning certificate directly from the provisioning server by using the computer security context so that the certificate is installed directly into the local computer store. If you must request the certificate from another computer, you will have to export the private key and then use additional security controls while transferring and importing the certificate into a certificate store with restricted access.

Ensure that you request a new provisioning certificate before the existing certificate expires An expired AMT provisioning certificate will result in provisioning failure. If you are using an external Certification Authority (CA) for your provisioning certificate, allow additional time to complete the renewal process and reconfigure the out of band management point.

Note
To help you identify when the AMT provisioning certificate is about to expire, Configuration Manager generates a warning status message with ID 7210 when the provisioning certificate in use is 40 days or less from expiration. This status message will be repeated once a day until the certificate is replaced with a validity period greater than 40 days or until the validity period is less than 15 days. When the validity period is less than 15 days, an error status message with ID 7211 is generated until the certificate is replaced with a validity period greater than 15 days.

If the provisioning certificate is revoked, delete it from the certificate store on the out of band service point site system server, and remove it from the out of band management component configuration properties If you know that the AMT provisioning certificate is revoked, you must take manual steps to prevent it from being used to provision AMT-based computers by Configuration Manager because AMT-based computers do not check the CRL for the provisioning certificate. Delete the certificate from the certificate store on the out of band service point site system server. Then deploy a new provisioning certificate, and configure it in the out of band management component properties. If you cannot immediately deploy a valid AMT provisioning certificate, remove the out of band service point role until you have a replacement certificate.

If you must revoke a provisioning certificate supplied by an internal CA, revoke the certificate in the Certification Authority console There is no functionality to revoke the provisioning certificate in Configuration Manager 2007 SP1.

Use out of band management instead of Wake On LAN Although both solutions support waking up computers for software updates and advertisements, out of band management is a more secure solution than Wake On LAN because it provides authentication and encryption using standard industry security protocols. It can also integrate with an existing public key infrastructure (PKI) deployment, and the security controls can be managed independently from the product. For more information, see Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN.

Change the default provisioning server By default, the BIOS extensions for AMT-based computers look for a provisioning server named ProvisionServer. Although changing the default name is not a simple process, using the default name of ProvisionServer could present a security risk if a record with this name is configured to resolve to an IP address of the wrong computer or a rogue computer. Configuring the provisioning server value with an IP address is more secure than using a well-known name. If you configure a name, you must configure DNS to perform name resolution. If you are using name resolution for either ProvisionServer or a custom name, ensure that you secure the DNS record to safeguard against the record being modified in such a way that it no longer resolves to the out of band service point site system computer. For more information, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.

Configure an alternate port for server provisioning The port used for server provisioning can be set in the custom AMT firmware image. Using a custom port is more secure than using the default port. You can also use the Management Engine BIOS Extensions (MEBx) to manually configure these values on each AMT-based computer. Configure your alternative port number on the Out of Band Management Properties: General tab.

Restrict who has the Media Redirection right Granting someone the Media Redirection right is almost equivalent to granting someone physical access to the computer. While attackers still require physical access to open the computer, someone with the Media Redirection right could load an alternate operating system and use it to remotely attack data on the hard drive.

Privacy Information

The out of band management console in Microsoft System Center Configuration Manager 2007 SP1 manages computers that have the Intel vPro chip set and Intel Active Management Technology (Intel AMT) firmware versions 3.2 or later. Configuration Manager 2007 SP1 temporarily collects information about the computer configuration and settings, such as the computer name, IP address, and MAC address. Information is transferred between the managed computer and the out of band management console by using an encrypted channel. The information is not retained after the management session is ended. This feature is not enabled by default.

You have the option to enable Configuration Manager 2007 SP1 to discover computers with management controllers that can be managed by the out of band management console. Discovery creates records for the manageable computers and stores them in the database. Data discovery records contain computer information, such as the IP address, operating system, and computer name. Discovery of management controllers is not enabled by default. For more information, see How to Discover Computers with Management Controllers. Discovery information is not sent back to Microsoft. Discovery information is stored in the site database. Information is retained in the database until deleted by the site maintenance task Delete Aged Discovery Data every 90 days. You can configure the deletion interval.

See Also

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features


Troubleshooting Out of Band Management

Topic last updated—March 2008

This section provides troubleshooting information for out of band management in Configuration Manager 2007 SP1.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Log Files for Out of Band Management

Lists and describes the function of log files used with the out of band management feature.

AMT Provisioning Issues for Out of Band Management

Lists possible problems and solutions that relate to AMT provisioning in out of band management.

Out of Band Management Console Issues

Lists possible problems and solutions that relate to managing AMT-based computers using the out of band management console.

See Also

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Log Files for Out of Band Management

Topic last updated—May 2008

Use the log files described in this topic to help you troubleshoot out of band management in Configuration Manager 2007 SP1.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Log Files Specific to Out of Band Management

The Configuration Manager 2007 SP1 log files listed in the tables in this section are specific to out of band management.

Out of Band Service Point Site System Server Log Files

The Configuration Manager 2007 SP1 log files listed in the following table are located in the folder <ConfigMgrInstallationPath>\Logs on the site system server selected to host the out of band service point role.

Log File Name More Information

AMTSPSetup.log

Shows the success or failure (with failure reason) of installing the out of band service point.

Amtopmgr.log

Shows the activities of the out of band service point relating to discovery of management controllers, provisioning, and power control commands.

Amtproxymgr.log

Shows the activities of the site server relating to provisioning, which include the following:

  • Publishing provisioned computers to Active Directory Domain Services.
  • Registering the service principal name of provisioned computers in Active Directory Domain Services.
  • Requesting the Web server certificate from the issuing certification authority.

Shows the activities of sending instruction files to the out of band service point, which include the following:

  • Discovery of management controllers.
  • Provisioning.
  • Power control commands.

Shows the activities related to out of band management site replication.

Configuration Manager Console Log Files

The Configuration Manager 2007 SP1 log file listed in the following table is located in the folder <ConfigMgrInstallationPath>\AdminUI\AdminUILog on any computer that runs the out of band management console from the Configuration Manager console.

Log File Name | More Information
Oobconsole.log | Shows activities related to running the out of band management console.

Client Computer Log Files

The Configuration Manager 2007 SP1 log file listed in the following table is located in the folder %windir%\System32\CCM\Logs on 32-bit workstation computers and in the folder %windir%\SysWOW64\CCM\Logs on 64-bit workstation computers that are running the Configuration Manager 2007 SP1 client and that are managed out of band.

Log File Name | More Information
Oobmgmt.log | Shows out of band management activities performed on workstation computers, including the provisioning state of the management controller.

Log Files Shared with Other Configuration Manager Features and Components

The log files listed in the following table are also used by out of band management and shared with other Configuration Manager features and components. These are all located in the folder <ConfigMgrInstallationPath>\Logs on the site server.

For more information about these log files, see List of Log Files in Configuration Manager 2007.

Log File Name | More Information
Netdisc.log | Shows the activities relating to network discovery of management controllers.
Sitecomp.log | Shows when the out of band service point is installed.
Wolmgr.log | Shows the activities related to sending scheduled power-on commands to the out of band management component.

See Also

Other Resources

Troubleshooting Out of Band Management


AMT Provisioning Issues for Out of Band Management

Topic Last Updated—August 2008

This topic provides troubleshooting information to help you resolve issues when out of band management in Configuration Manager 2007 SP1 fails to provision AMT-based computers.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

If you need help with deploying the PKI certificates for out of band management, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

For issues related to using the out of band management console after computers are successfully provisioned for AMT, see Out of Band Management Console Issues.

Configuration Manager Fails to Provision Computers for AMT Because One or More Prerequisites Are Missing

Out of band management has a number of prerequisites that must be met before Configuration Manager can successfully provision computers for AMT. Before investigating specific errors, make sure that all these prerequisites have been met.

Solution

To verify that you have met all the prerequisites, see Prerequisites for Out of Band Management.

Configuration Manager Fails to Provision Computers for AMT Because Files Installed with Hotfix 42841 Are Overwritten

Installing the hotfix 42841 is one of the prerequisites for out of band management when the out of band service point role is installed on Windows Server 2003 Service Pack 2.

The files installed with this hotfix might be overwritten by another software installation, which results in AMT provisioning failure.

If the correct files are missing, this could be one of the reasons for the following error in the file <ConfigMgrInstallationPath>\Logs\ Amtopmgr.log:

Error: Device internal error. Check Schannel, provision certificate, network configuration, device.

Solution

Check that the file version listed for the hotfix matches the file information on the out of band service point site system server. If it does not match or if you are in doubt about the files being overwritten, reinstall the hotfix.

For more information about this hotfix, see http://go.microsoft.com/fwlink/?LinkId=106107.

Configuration Manager Fails to Provision Computers Using Out of Band Provisioning Because Infrastructure Servers (DNS and DHCP) Are Configured Incorrectly

When you are provisioning AMT-based computers by using the out of band provisioning method (the Configuration Manager 2007 SP1 client is not installed), some configuration of infrastructure servers, such as DNS and DHCP, is usually required. This configuration is required so that the AMT-based computers can locate their provisioning server and be configured with their DNS domain suffix. If either of these procedures fails, AMT provisioning will fail.

If infrastructure servers are not configured correctly, the following error in the file <ConfigMgrInstallationPath>\Logs\ Amtopmgr.log could occur:

Error: Device internal error. Check Schannel, provision certificate, network configuration, device.

Solution

Unless you are using a customized firmware image for your AMT-based computers, out of band provisioning might require that you register an alias in DNS for the out of band service point and that you configure an active DHCP scope with options for DNS servers (006) and Domain name (015). The DHCP server must also dynamically update DNS with the computer resource record.

For more information about whether you need to register an alias in DNS, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS.

For more information about using a customized firmware image, see Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer.

Cannot Configure the AMT Provisioning Certificate Because the Option Is Disabled in the Out of Band Management Component Configuration Properties: General Tab

If you run the Configuration Manager console from a primary site and connect to a child primary site, the option to configure the AMT provisioning certificate for the child site is disabled.

Configuration Manager prevents you from configuring the AMT provisioning certificate for a child primary site from a parent primary site because this would result in overwriting the AMT provisioning certificate in the parent site.

Solution

Configure the AMT provisioning certificate directly from the child site.

Configuration Manager Fails to Provision Computers Because They Are Not Running AMT Version 3.2.1 or Higher

Configuration Manager cannot natively provision AMT-based computers that have a version of AMT that is lower than 3.2.1.

This scenario requires that you install and configure the Intel WS-MAN translator and then configure Configuration Manager to enable support for the translator. These computers must then be provisioned using the out of band provisioning method.

Solution

For more information about the Intel translator, see http://go.microsoft.com/fwlink/?LinkId=108363.

You can confirm the AMT version information in a number of ways, including viewing the value in the AMT Version column in the Configuration Manager console and by running the report Status of out of band management provisioning.

To enable the option to support the Intel translator, use the following procedure.

To enable support for the Intel WS-MAN translator

  1. Navigate to System Center Configuration Manager / Site Database / Site Management / <site code> – <site name> / Site Settings / Component Configuration.

  2. Right-click Out of band management component, and then click Properties.

  3. Click the AMT Settings tab, select Enable support for Intel WS-MAN translator, and then click OK.

Configuration Manager Fails to Provision Computers Because Permissions Are Not Configured Correctly for the AMT Certificate Template

The site server computer requires the Windows security permissions of Read and Enroll on the certificate template that you are using for the AMT Web server certificate. If these permissions are not set correctly, you will see the following error logged in the file <ConfigMgrInstallationPath>\Logs\ Amtopmgr.log:

Error: Missed device certificate. To provision device with TLS server or Mutual authentication mode, device certificate is required.

The issuing certification authority will list the rejected certificate requests in the Failed Requests node in the Certification Authority console.

Note
If you are using the default Web Server certificate template without modification, the site server computer will be unable to use it for provisioning AMT-based computers.

Solution

Either configure the certificate template you are using so that the site server has Read and Enroll permissions or use another certificate template for this nondefault configuration.

If you need procedural steps for configuring the AMT certificate template correctly, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

Configuration Manager Fails to Provision Computers Because the AMT-Based Computers Do Not Have the Correct Certificate Thumbprint

Configuration Manager cannot provision AMT-based computers unless they have configured in their BIOS extensions the certificate thumbprint (also referred to as the certificate hash) of the root certification authority (CA) that issued the AMT provisioning certificate.

If the certificate thumbprint does not match during out of band provisioning, you will see the following error logged in the file <ConfigMgrInstallationPath>\Logs\ Amtopmgr.log on the site system server running the out of band service point role:

Error: Hash list of AMT device <UUID> doesn’t contain our provision server certificate hash.

If the certificate thumbprint does not match during in-band provisioning, you will see the following error logged in the file Oobmgmt.log, which is located in the folder %windir%\System32\CCM\Logs on 32-bit workstation computers and in the folder %windir%\SysWOW64\CCM\Logs on 64-bit workstation computers that are running the Configuration Manager 2007 SP1 client:

None certificate is valid between device and server certificate hash.

For more information about this requirement, see the section "The AMT Provisioning Certificate" in the topic About Certificates for Out of Band Management.

Solution

Ensure that the certificate thumbprint of the root CA that issued the AMT provisioning certificate is specified correctly in the BIOS extensions of the AMT-based computers.

If you are using your own internal CA to issue the AMT provisioning certificate and you want to confirm the certificate thumbprint, see How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning.

Refer to your manufacturer instructions if you need procedural information for locating or entering the certificate thumbprint in the BIOS extensions.

Computers Fail to Provision In-Band Because They Are Not Configured for Automatic AMT Provisioning

When the Configuration Manager 2007 SP1 client is installed, you can use in-band provisioning to automatically provision these computers for AMT. Computers will fail to provision if either of the following configurations apply:

  • The computers are not in a collection that is configured for automatic AMT provisioning.
  • The computers are in a collection that is configured for automatic AMT provisioning, but they are configured with the option to disable automatic AMT provisioning. This scenario can occur if you have removed provisioning information from the AMT-based computer or if you imported the computer from another AMT management solution by using an export utility.

You can check whether an AMT-based computer is eligible for automatic in-band provisioning by using the Configuration Manager column Automatic AMT Provisioning, which will display either Enabled or Disabled.

Solution

Use the following procedure to configure a collection for automatic in-band provisioning and to change the disabled status for an individual computer so that it is enabled for automatic in-band provisioning.

To configure a collection for automatic in-band AMT provisioning

  1. Right-click a collection that contains computers to be provisioned in-band, click Modify Collection Settings, and then click the Out of Band tab.

  2. Select Enable automatic out of band management controller provisioning, and then click OK.

To change the disabled status for an individual computer so that it is enabled for automatic in-band provisioning

  • Right-click the computer in a collection, click Out of band management, and then click Enable automatic provisioning.

Computers Fail to Provision Out of Band Because the Alias for the Out of Band Service Point Did Not Register in DNS

If you are automatically registering an alias of ProvisionServer in DNS so that AMT-based computers can provision for AMT out of band, you must enable the option Register ProvisionServer as an alias in DNS after the out of band service point is installed. If you enable this option before the out of band service point is installed, the site server will not register the alias. As a result, computers that attempt to provision out of band will be unable to find their provisioning server.

If out of band provisioning fails because the site server could not register the alias of ProvisionServer in DNS, this could be one of the reasons for the following error in the log file <ConfigMgrInstallationPath>\Logs\Amtopmgr.log, after the instruction Send request to AMT proxy component to add the alias ProvisionServer.<domain_suffix> in the DNS. The machine’s FQDN is <out_of_band_service_point_FQDN>.domain_suffix>:

Unable to create instruction file for AMT Proxy task: <ConfigMgrInstallationPath>\MP\OUTBOXES\amtproxy.box

Solution

Ensure that the out of band service point is installed. Disable the option Register ProvisionServer as an alias in DNS, and then re-enable it.

For more information about registering an alias of ProvisionServer, see Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS and How to Register an Alias in DNS for the Out of Band Service Point.

For more information about installing the out of band service point, see How to Install the Out of Band Service Point.

Configuration Manager Fails to Provision Computers for AMT Because They Are Provisioned for Another AMT Management Solution

Configuration Manager cannot automatically manage AMT-based computers that have been provisioned by another AMT management solution.

Solution

Decide on a migration strategy to provision these computers with Configuration Manager. You have the following choices:

  • Use in-band provisioning with Configuration Manager.
  • Use out of band provisioning with Configuration Manager, with an export utility.
  • Use out of band provisioning with Configuration Manager, without using an export utility.

For more information, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

The Site Server Cannot Revoke Certificates for AMT-Based Computers

If the primary site server does not have the Issue and Manage Certificates permission on the issuing certification authority, certificate revocation will fail for certificates that have been issued to AMT-based computers. An entry will be added to the Failed Requests node of the certification authority.

To identify this condition, on the site server computer, look for either of the following entries in the log file <ConfigMgrInstallationPath>\Logs\Amtproxymgr.log:

Error: CCAUtils::RevokeCertificate revoke certificate <certificate_ID> failed with 0x80070005 SMS_AMT_PROXY_COMPONENT <date> <time> 2632 (0x0A48)

Error: CCAUtils::RevokeExistedCertificate revoke certificate <certificate_ID> failed. SMS_AMT_PROXY_COMPONENT <date> <time> 2632 (0x0A48)

Solution

On the issuing certification authority, grant the primary site server the permission Issue and Manage Certificates.

For more information about certificate revocation in out of band management, see About Certificates for Out of Band Management.

Configuration Manager Fails to Provision Computers for AMT Because the Root Certification Authority Certificate Has a Key Length of Greater Than 2048 Bits

As listed in Prerequisites for Out of Band Management and documented in Certificate Requirements for Out of Band Management, AMT-based computers cannot support a root certification authority certificate that has a key length of greater than 2048 bits. In this scenario, provisioning will fail with the following errors in the log file <ConfigMgrInstallationPath>\Logs\Amtproxymgr.log:

Error 0x80090304 returned by InitializeSecurityContext during follow up TLS handshaking with server.

**** Error 0x193b95c returned by ApplyControlToken

Fail to connect and get core version of machine <IP address of computer to provision>

Solution

Use a certification authority that has a root certificate with a key length of 2048 bits or less.

See Also

Concepts

Log Files for Out of Band Management

Other Resources

Troubleshooting Out of Band Management


Out of Band Management Console Issues

Topic last updated—May 2008

This topic provides troubleshooting information to help you resolve issues related to using the out of band management console in Configuration Manager 2007 SP1.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

For issues related to provisioning a computer for AMT, see AMT Provisioning Issues for Out of Band Management.

Out of Band Management Console Failure Because One or More Prerequisites Are Missing

Out of band management has a number of prerequisites that must be met before the out of band management console can successfully manage AMT-based computers. Before investigating specific errors, make sure that all these prerequisites have been met.

Solution

To verify that you have met all the prerequisites, see Prerequisites for Out of Band Management.

The Out of Band Management Console Fails to Connect to AMT-Based Computers

If the out of band management console cannot connect to the selected AMT-based computer, it will display Connecting until you disconnect or exit the console.

Solution

Refer to the following log file for the connection failure reason: <ConfigMgrInstallationPath>\AdminUI\AdminUILog\Oobconsole.log.

The Out of Band Management Console Fails to Connect to AMT-Based Computers and Unloads

If no AMT User Accounts are specified, the out of band management console might unload when you try to connect to AMT-based computers.

Solution

Specify at least one AMT User Account that contains a Windows user account or security group to be used to connect to computers by using the out of band management console. For more information, see How to Configure AMT Settings and AMT User Accounts.

The Out of Band Management Console Connects to AMT-Based Computers but Does Not Display Information

If the out of band management console connects to the selected AMT-based computer but displays information about the power status only, this could be a configuration issue in the AMT-based computer's BIOS extensions for serial over LAN and IDE redirection.

Solution

Check the settings in the BIOS extensions for serial over LAN and IDE redirection. This capability must be enabled with the setting to disable the user name and password, which forces Kerberos authentication.

Because the out of band management console requires Kerberos authentication, the option to disable the user name and password for the serial over LAN and IDE redirection is required so that Kerberos authentication can succeed.

Refer to your computer manufacturer documentation if you need help with configuring the BIOS extensions.

The Out of Band Management Console Connects to AMT-Based Computers, Displays Information, but Some Functions Fail

If the out of band management console connects to the selected AMT-based computer but fails to restart the computer or cannot establish a serial connection, another out of band management console might already be connected to the AMT-based computer. Out of band management supports running multiple out of band management consoles but not to the same AMT-based computer at the same time.

The second and subsequent consoles will be able to retrieve status, auditing, and configuration information and will be able restart the computer. But when the actions to start a serial connection or power off the computer are initiated from the second console, these will fail until the first console has disconnected from the computer. Before the first console is disconnected, attempting to start a serial connection will result in a pop-up error message indicating that another serial over LAN connection has already been established.

To help identify this scenario, look for the error code 0x80004005 in the log file <ConfigMgrInstallationPath>\AdminUI\AdminUILog\Oobconsole.log.

Solution

Do not connect more than one out of band management console to the same AMT-based computer. If you have connected another console to the same AMT-based computer, disconnect the first console and retry the functions that failed.

The Power On Password Is Not Accepted by AMT-Based Computers When Entered Using the Out of Band Management Console

If you power on an AMT-based computer using the out of band management console and you are prompted for a power-on password, it might not be accepted if the password contains uppercase letters or symbol characters.

There is a known problem with some AMT-based computers that fail to correctly accept uppercase letters and symbol characters for the power-on password.

Solution

Contact the computer manufacturer to confirm whether this is a known problem for your computer and to obtain instructions to resolve the problem.

A less-secure alternative is to specify a password that does not use uppercase letters or symbol characters.

IDE Redirection and Serial over LAN Does Not Work in the Out of Band Management Console

If IDE redirection and serial over LAN does not work in the out of band management console when successfully connected to an AMT-based computer, these options might be configured as disabled in the BIOS extensions or they might not be enabled by the computer manufacturer.

To help identify this scenario, on the site server computer, look for the following entries in the log file <ConfigMgrInstallationPath>\Logs\Amtopmgr.log:

Error: cannot put change to AMT_RedirectionService instance. SMS_AMT_OPERATION_MANAGER <date> <time> 3120 (0x0C30)

Error: CSMSAMTProvTask::StartProvision Fail to call AMTWSManUtilities::EnableRedirectionService SMS_AMT_OPERATION_MANAGER <date> <time> 3120 (0x0C30)

Solution

If these options are disabled in the BIOS extensions, you can enable them. Before doing so, check that enabling them does not conflict with your company security policy because these functions enable highly privileged management options. Refer to your computer manufacturer documentation if you need help with configuring the BIOS extensions.

Because these functions enable highly privileged management options, it is possible that they have been intentionally not enabled by the manufacturer. Contact your manufacturer for more information, and also see the following topic: Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer.

The Latest AMT Settings Are Not Applied to AMT-Based Computers

If you change any of the AMT settings, such as adding a new AMT User Account or enabling ping responses, these changes do not automatically update for computers that are already provisioned for AMT.

Solution

Use the procedure in How to Update AMT Settings in Provisioned Computers Using Out of Band Management.

The Out of Band Management Console No Longer Connects to AMT-Based Computers After a Computer Name Change or Domain Move

If an AMT-based computer is provisioned and then has its computer name changed or is moved to a different domain without first deleting the provisioning information and reprovisioning, the out of band management console no longer connects to the computer. In this scenario, when the Configuration Manager 2007 SP1 client is installed, the connection will fail because the certificate subject value on the AMT-based computer does not contain the new fully qualified domain name (FQDN). When the Configuration Manager 2007 SP1 client is not installed in this scenario, the connection will fail because the out of band management console still attempts to connect by using the original FQDN.

You can identify Configuration Manager 2007 SP1 client computers that are in this situation by using the following query: select disc.* from SMS_R_System disc INNER JOIN SMS_AMTMachineInfo info on disc.ResourceId = info.MachineID where disc.ResourceNames <> info.FQDN.

Solution

For computers running the Configuration Manager 2007 SP1 client, remove the provisioning information from the AMT-based computer, and then reprovision the computer.

For computers that have been imported and are not running the Configuration Manager 2007 SP1 client, import these computers again and specify their new FQDN. Then remove the provisioning information for them, and reprovision them.

For more information, see the following topics:

  • About AMT Provisioning for Out of Band Management
  • How to Remove Provisioning Information for AMT-Based Computers
  • How to Provision Computers for AMT

See Also

Tasks

AMT Provisioning Issues for Out of Band Management

Concepts

Log Files for Out of Band Management

Other Resources

Troubleshooting Out of Band Management


Technical Reference for Out of Band Management

Topic last updated—May 2008

This section provides example scenarios and procedures for out of band management in Configuration Manager 2007 SP1.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Example Scenarios for Implementing Out of Band Management

Provides example scenarios of how out of band management can be implemented in Configuration Manager 2007 SP1 to address specific business requirements.

Example Scenarios for Using Out of Band Management

Provides example scenarios of how out of band management can be used in Configuration Manager 2007 SP1 to address specific business requirements.

Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management

Lists example configuration steps for the certificates required for out of band management in Configuration Manager 2007 SP1, using a Microsoft enterprise certification authority and modified certificate templates.

How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning

Provides a procedure for locating the certificate thumbprint of your internal root certificate so that this can be configured in the BIOS extensions of AMT-based computers.

Configuration Manager AMT Provisioning Process for Out of Band Management

Describes the process flow in Configuration Manager 2007 SP1 for out of band provisioning and in-band provisioning for AMT-based computers.

See Also

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Example Scenarios for Implementing Out of Band Management

Topic last updated—May 2008

The following sections in this topic provide example scenarios for implementing out of band management in Configuration Manager 2007 SP1:

  • AMT Provisioning Out of Band for New Computers
  • AMT Provisioning In-Band for Configuration Manager Client Computers
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In both scenarios, the company already has an existing public key infrastructure (PKI) infrastructure, using Windows Server 2003 Certificate Services, and has an enterprise certification authority running Windows Server 2003, Enterprise Edition.

AMT Provisioning Out of Band for New Computers

This scenario demonstrates how you can use out of band provisioning for AMT-based computers for new computers that do not have an operating system installed.

A. Datum Corporation receives a batch of new computers that are AMT-based and meet all the prerequisites for out of band management in Configuration Manager 2007. This company has recently updated their central site to Configuration Manager 2007 SP1, but other sites are still running Configuration Manager 2007, and all the clients are also running Configuration Manager 2007.

Until the clients are upgraded to Configuration Manager 2007 SP1, out of band provisioning for AMT is the only method available in this scenario. Because these AMT-based computers are new from the manufacturer, they are suitable for out of band provisioning.

Tommy Hartono is the configuration manager administrator responsible for provisioning these computers in the central site. The computers will all be joined to the company's single domain, and they meet all the requirements to support out of band management in Configuration Manager 2007 SP1.

The AMT-based computers do not have a customized firmware image, and Tommy has an agreement from his manager to purchase an AMT provisioning certificate from one of the external certification authorities (CAs) that are configured in the firmware of these computers.

To provision these new ATM-based computers out of band, Tommy takes the course of action outlined in the following table.

Process Reference

Tommy checks the prerequisites for out of band management and makes the following changes for his Configuration Manager site:

  • He designates a site system server on which he will install the out of band service point. This computer has the fully qualified domain name (FQDN) of server15.adatum.com. This server is running Windows Server 2003 SP2, so he installs the required hotfix 942841.
  • He installs the latest version of Windows Remote Management (WinRM) on the site system server.

For more information about the hotfix, see http://go.microsoft.com/fwlink/?LinkId=106107.

To download the latest version of WinRM and for more information, see http://go.microsoft.com/fwlink/?LinkId=105682.

Tommy then works with his Active Directory service administrators to create an OU in the adatum.com domain for the published AMT-based computer objects and to configure the OU so that the site server has full control for this OU and of all its child objects.

The following Windows security groups are also created in preparation for the PKI certificates:

  • A group named ConfigMgr Out Band Service Points that contains server15.
  • A group named ConfigMgr Primary Site Servers that contains the primary site server in the central site.

For more information, see the following topics:

  • How to Prepare Active Directory Domain Services for Out of Band Management
  • Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management

Tommy also works with his infrastructure services team with the following results:

  • He confirms that routers and firewalls do not need to be reconfigured for out of band communication.
  • He confirms that their DNS servers accept dynamic updates so that the new site system server on which he will install the out of band service point can automatically register an alias record in DNS.
  • He confirms that the DHCP server is already configured appropriately with the following settings:
    1. There is an active scope with available addresses.
    2. The scope is configured with option 006 for domain servers and with option 015 for the domain name.
    3. The DHCP server is automatically updating DNS with computer resource records.

For more information about the ports used with out of band management communication, see the port information as an external dependency in Prerequisites for Out of Band Management.

For more information about the DNS and DHCP settings, see the following topics:

  • Prerequisites for Out of Band Management
  • Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS

Tommy works with the PKI team with the following results:

  • A custom template is created to request the AMT provisioning certificate from an external CA.
  • The certificate request for the AMT provisioning certificate is issued from server15 and saved to a file so that it can be sent to the external CA.
  • The certificate request file is sent to the external CA with a purchase order, and Tommy receives the certificate response in e-mail the following day. He installs the certificate on server15.
  • The installed AMT provisioning certificate is exported to a .PFX file and stored securely on the server.
  • The Web server certificate template is duplicated and configured so that it is appropriate for out of band management.

For guidance on how to deploy the PKI certificates required for out of band management, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

For more information about the certificate requirements, see Certificate Requirements for Out of Band Management.

For more information about how the certificates are used in out of band management, see About Certificates for Out of Band Management.

Tommy then configures the central site and makes the following changes in the primary site:

  • He installs a new site system server on server15, configures it with the intranet FQDN of server15.adatum.com, and installs the out of band service point.
  • On the Out of Band Component Properties dialog box, he configures the out of band management component with the following:
    • On the General tab, he specifies the OU created in adatum.com; enables the option Register ProvisionServer as an alias in DNS; configures a strong password for the MEBx Account; browses to the exported AMT certificate file and supplies the password that was used during the export process; selects the issuing CA and the AMT certificate template to use.
    • On the AMT Settings tab, he specifies as an AMT User Account a Windows domain global security group that contains help desk engineers who will be using the out of band management console. He selects all the available AMT features for this AMT User Account. He also selects the option Enable serial over LAN and IDE redirection.

For more information, see the following topics:

  • How to Install the Out of Band Service Point
  • How to Configure AMT Provisioning
  • How to Configure AMT Settings and AMT User Accounts

Tommy then makes the final steps required to provision the computers out of band for AMT by performing the following actions:

  • He creates a new collection that will contain the AMT-based computers.
  • He prepares a comma-separated values (CSV) file with the computer details, including their FQDN and UUID.
  • He runs the Import Computer for Out of Band Management Wizard and specifies the CSV file and the collection he created.
  • He updates the collection to view and confirm the computers that he has just imported.

For more information, see the following topics:

  • How to Provision Computers for AMT
  • Import Computer for Out of Band Management Wizard

Tommy provides instructions stating that, when the computers are delivered, the power cable and network adapter be connected but that there is no requirement to turn them on.

He monitors the provisioning process.

For more information, see How to Identify Computers That Are Provisioned for AMT.

As a result of this course of action, the new computers are provisioned for AMT and can then be managed out of band, even though they do not yet have an operating system deployed.

Out of band management supports installing an operating system and applications in a number of ways, including booting to PXE, using IDE redirection to install an image located on the network, and initiating an unattended installation. For example scenarios of using of band management, see Example Scenarios for Using Out of Band Management.

AMT Provisioning In-Band for Configuration Manager Client Computers

This scenario demonstrates how you can use in-band provisioning for AMT-based computers that are running the Configuration Manager 2007 SP1 client.

Trey Research has a Configuration Manager 2007 SP1 hierarchy and is interested in using out of band management to manage computers that are located in remote offices. The company purchases all their computers from the same supplier. Because these computers are delivered directly to the remote offices, they are installed with a build image specific to Trey Research that includes the Windows operating system, standard applications and settings, and the Configuration Manager 2007 SP1 client.

In addition to this custom computer build, Trey Research requests a customized firmware image that includes the certificate thumbprint of their internal root CA so that they do not need to purchase an AMT provisioning certificate from an external CA. The certificate thumbprint is referred to as the root CA hash by the supplier, and this value is located by using the following procedure: How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning.

Terry Adams is the Configuration Manager administrator responsible for provisioning these computers in the Configuration Manager site. The computers will all be joined to the company's child domain of testnet.treyresearch.net, and the site system servers reside in treyresearch.net. When the Configuration Manager client installs with auto-site assignment, they will reside within the boundaries of multiple secondary sites that all belong to the central site.

To provision these new ATM-based computers in-band, Terry takes the course of action outlined in the following table.

Process Reference

Terry checks the prerequisites for out of band management and makes the following changes for his Configuration Manager site:

  • He designates a site system server on which he will install the out of band service point. This computer has the fully qualified domain name (FQDN) of server15.treyresearch.net. This server is running Windows Server 2003 SP2, so he installs the required hotfix 942841.
  • He installs the latest version of Windows Remote Management (WinRM) on the site system server.

For more information about the hotfix, see http://go.microsoft.com/fwlink/?LinkId=106107.

To download the latest version of WinRM and for more information, see http://go.microsoft.com/fwlink/?LinkId=105682.

Terry then works with his Active Directory service administrators to create an OU in the testnet.treyresearch.net domain for the published AMT-based computer objects and to configure the site server to have full control for this OU and of all its child objects.

The following Windows security groups are also created in preparation for the PKI certificates:

  • A group named ConfigMgr Out Band Service Points that contains server15.
  • A group named ConfigMgr Primary Site Servers that contains the primary site server in the central site.

For more information, see the following topics:

  • How to Prepare Active Directory Domain Services for Out of Band Management
  • Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management

Terry knows that there is a firewall between his site and the remote offices, so he identifies the ports that will need to be open to allow out of band communication between the site systems and the AMT-based computers. He submits a change request for the required firewall changes.

For more information about the ports used with out of band management communication, see the port information as an external dependency in Prerequisites for Out of Band Management.

Terry works with the PKI team with the following results:

  • A custom template is created to request the AMT provisioning certificate for their internal CA.
  • The certificate request for the AMT provisioning certificate is issued from server15 and is automatically approved and installed.
  • The installed AMT provisioning certificate is exported to a .PFX file and stored securely on the server.
  • The Web server certificate template is duplicated and configured so that it is appropriate for out of band management.

For guidance on how to deploy the PKI certificates required for out of band management, see Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management.

For more information about the certificate requirements, see Certificate Requirements for Out of Band Management.

For more information about how the certificates are used in out of band management, see About Certificates for Out of Band Management.

Terry then configures the Configuration Manager primary site and makes the following changes:

  • He installs a new site system server on server15, configures it with the intranet FQDN of server15.treyresearch.net, and then installs the out of band service point.
  • On the Out of Band Management Properties dialog box, he configures the out of band management component with the following:
    • On the General tab, he specifies the OU created in testnet.treyresearch.net; configures a strong password for the MEBx Account; browses to the exported AMT certificate file and supplies the password that was used during the export process; selects the issuing CA and the AMT certificate template to use.
    • On the AMT Settings tab, he specifies as an AMT User Account a Windows global domain security group that contains help desk engineers who will use the out of band management console. He selects all the available AMT features for this AMT User Account. He also selects the options Enable serial over LAN and IDE redirection, Allow ping responses, and Enable BIOS password bypass for power on and restart commands.

For more information, see the following topics:

  • How to Install the Out of Band Service Point
  • How to Configure AMT Provisioning
  • How to Configure AMT Settings and AMT User Accounts

Terry wants to use Wake on LAN to install critical software updates on computers. He has tried this feature in the past and discovered that subnet-directed broadcasts consumed too much network bandwidth over the remote links and that few of their network adapters worked with unicast transmissions.

He enables Wake on LAN and decides to keep the default option of Use power on commands if the computer supports this technology; otherwise, use wake-up packets.

For more information, see the following topics:

  • Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN
  • How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management

To enable automatic in-band provisioning for AMT, Terry then performs the final steps:

  • Enables discovery for management controllers.
  • Creates a query-based collection that dynamically adds computers that have management controllers that can be provisioned for AMT by Configuration Manager.
  • Configures the collection with the collection setting to enable automatic out of band management controller provisioning.

For more information, see the following topics:

  • How to Discover Computers with Management Controllers
  • How to Provision Computers for AMT

Terry monitors the collection and the provisioning process of the new computers when they are installed and join the site.

For more information, see How to Identify Computers That Are Provisioned for AMT.

As a result of this course of action, the computers running the Configuration Manager 2007 SP1 client are provisioned for AMT and can then be managed out of band, even if they later fail to boot, the operating system stops responding, they require powering on for routine maintenance, or their BIOS settings need reconfiguration.

For example scenarios of using of band management, see Example Scenarios for Using Out of Band Management.

See Also

Concepts

About AMT Provisioning for Out of Band Management
Administrator Checklist: Enabling Out of Band Management
Certificate Requirements for Out of Band Management
Determine Administrator Roles and Processes for Out of Band Management
Overview of Out of Band Management

Other Resources

Configuring Out of Band Management
Technical Reference for Out of Band Management


Example Scenarios for Using Out of Band Management

Topic last updated—May 2008

The following sections in this topic provide example scenarios of how out of band management in Configuration Manager 2007 SP1 can be used:

  • Deploying New Computers
  • Powering On Computers to Install Applications
  • Powering Off Computers to Help Protect Against a Security Attack
  • Re-imaging a Nonfunctioning Computer
  • Configuring BIOS Settings
  • Troubleshooting a Nonfunctioning Computer
  • Achieving Compliance for Software Updates by Using Wake on LAN and Power On Commands
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In all these scenarios for Woodgrove Bank, Mary North, the Configuration Manager administrator, has implemented out of band management throughout the Configuration Manager hierarchy. The desktop computers are AMT-based and meet all the prerequisites for out of band management.

Deploying New Computers

The following scenario demonstrates how you can use out of band management to install an operating system and applications on bare metal computers.

Woodgrove Bank receives a batch of new computers that are delivered to various branch locations. The company's security policy does not allow these computers to use PXE installation, and it would be very time-consuming for an engineer to travel to each location and manually install the operating system and required applications. However, there is an image file located on the network that contains the required operating system, custom applications and settings, and the Configuration Manager client.

To ensure that the computers are up and running in an efficient manner that also complies with the company's security policies, Mary North decides on the course of action outlined in the following table.

Process Reference

The AMT-based computers have a customized firmware image that includes the following settings:

  • The certificate thumbprint of their internal root certification authority.
  • The domain suffix for these computers.
  • The provisioning server is configured for the IP address of the out of band service point site system server.
  • Serial over LAN and IDE redirection are enabled.

Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer

Mary has a list of the new computer details, including the MAC address and UUID.

She creates a comma-separated values (CSV) file with the computer details, one line for each computer, by using an entry similar to the following:

NEWCOMP1,NEWCOMP1.woodgrovebank.com,55555555-5555-5555-5555-555555555555,05:06:07:08:09:0A

She creates a new collection that has no members.

She right-clicks Collections, and then clicks Import Computer for Out of Band Management Wizard. When running the wizard, she specifies the following:

  • Import computers using a file.
  • The CSV file that she has prepared.
  • The collection that she created.

For more information, see the following topics:

  • How to Create a Collection
  • Import Computer for Out of Band Management Wizard
  • How to Provision Computers for AMT

Mary monitors the provisioning status of these computers by adding the AMT Status column to the Configuration Manager console and refreshing the display.

How to Identify Computers That Are Provisioned for AMT

As each computer displays that it is provisioned for AMT, Mary connects to it using the out of band management console and then performs the following actions:

  • She clicks Power Control, selects the boot option for IDE redirection, and enters the network path to the image to install the operating system, custom applications and settings, and the Configuration Manager client. Then she clicks Power On.
  • She clicks System Status and refreshes the console to confirm the change in power state, and then she closes the console.

For more information, see the following topics:

How to Run the Out of Band Management Console

How to Power On or Restart a Computer Using Out of Band Management

As a result of the preceding course of action, the new computers are deployed in a way that meets the company's security requirements, without requiring local access to the computers.

Powering On Computers to Install Applications

The following scenario demonstrates how you can use out of band management to power on computers to install applications (or perform routine maintenance) without using traditional wake-up packets.

The marketing department at Woodgrove Bank has been approved a request to install a nonstandard application on five computers. Mary North has already created a collection for these five computers and an advertisement to install the application as soon as possible. After establishing a time period when no users will have their computers turned on and will not be unduly inconvenienced, she performs the actions in the following table to power on the computers so that the application can be installed.

Process Reference

Mary locates the computers in the Configuration Manager console and then performs the following actions:

  • Multi-selects and right-clicks the five computers.
  • Clicks Out of Band Management, and then clicks Power Control.
  • Selects Power on.
  • Confirms the action by clicking OK.

She then monitors the progress of the application installation.

How to Power On or Restart a Computer Using Out of Band Management

If required, after the installation is complete, she can shut down each computer individually by using the Configuration Manager remote control tools and selecting the shutdown option from within Windows.

Note
The out of band management power-off command is not appropriate here because this does not perform a graceful shutdown of the operating system.

How to Remotely Administer a Client Computer

As a result of the preceding course of action, the application is installed outside business hours without sending wake-up packets over the network, without requiring that the computers are left on, or without requiring local access to the computers.

Powering Off Computers to Protect Against a Security Attack

The following scenario demonstrates how you can use out of band management to power off computers when it is imperative that they do not remain running and cannot be shut down by normal means. Powering off computers should always be considered a last resort because it has the same effect as removing the power cable from the computer: the operating system does not shut down properly, unsaved work is lost, and logged-in users are given no notice of the power-off action.

Woodgrove Bank has an intrusion detection system that monitors suspicious activity on servers and the network. In the early hours of the morning, an alert is generated that indicates a security attack has occurred on one of the servers. Although the desktop computers are usually turned off at night, some users leave their computers on. These computers need to be turned off immediately to safeguard them against the security threat.

To help protect the desktop computers from the security threat, a security administrator performs the actions in the following table.

Process Reference

The security administrator identifies the desktop computers that are turned on and at risk and locates them in the Configuration Manager console.

She performs the following actions:

  • Multi-selects and right-clicks the computers.
  • Clicks Out of Band Management, and then clicks Power Control.
  • Selects Power off.
  • Confirms the action by clicking OK.

How to Power Off a Computer Using Out of Band Management

As a result of the preceding course of action, the risk of these computers being vulnerable to the security attack is greatly reduced.

Re-imaging a Nonfunctioning Computer

The following scenario demonstrates how you can use out of band management to re-image a nonfunctioning computer when other troubleshooting steps have failed.

Woodgrove Bank has a help desk policy that computer desktop issues that prevent business continuity must be resolved within a set period. There is no data stored locally on the computers, so re-imaging these computers is the most efficient way to resolve these types of reported problems. However, in the past this has meant that a help desk engineer must visit the site or the computer must be transported to and from the help desk location.

To more efficiently re-image a nonfunctioning computer, the help desk engineer proceeds with the course of action outlined in the following table.

Process Reference

The help desk engineer locates the computer in question in the Configuration Manager console and confirms that she cannot use Configuration Manager Remote Tools to connect to the client computer.

She connects to it using the out of band management console.

How to Run the Out of Band Management Console

The help desk engineer then performs the following actions:

  • She clicks Power Control, selects the boot option for IDE redirection, and enters the network path to the image to reinstall the operating system, custom applications and settings, and the Configuration Manager client. Then she clicks Restart Computer.

How to Power On or Restart a Computer Using Out of Band Management

Later that day, the engineer checks the status of the computer and confirms that it is working again as required. She closes the help desk ticket within the specified time limit.

Company-specific process.

As a result of the preceding course of action, the computer is efficiently re-imaged without requiring local access, even though the operating system was not responding. This level of control helps to resolve critical issues in a timely manner, ensuring higher levels of business continuity for the company.

Configuring BIOS Settings

The following scenario demonstrates how you can use out of band management to configure BIOS settings for a desktop computer without requiring local access to the computer.

The help desk at Woodgrove Bank receives notification that two newly deployed computers do not boot successfully. This is a custom build, and the engineer suspects that the BIOS settings are not correctly configured.

To check the BIOS settings without local access to the computer, the help desk engineer proceeds with the course of action outlined in the following table.

Process Reference

The help desk engineer locates the computer in question in the Configuration Manager console and connects to it using the out of band management console.

How to Run the Out of Band Management Console

The help desk engineer then performs the following actions for each computer in turn:

  • She clicks Power Control, selects the boot option for BIOS setup, and then clicks Power On.
  • She clicks Serial Connection and waits for the BIOS settings to display. When they do, she discovers that the wrong disk is configured for booting the computer. She makes the required change and then saves the new BIOS settings.

The computer automatically reboots and successfully loads the operating system from the correct disk.

How to Configure BIOS Settings for a Computer Using Out of Band Management

The engineer confirms that the two computers are now operational and closes the help desk ticket.

Company-specific process.

As a result of the preceding course of action, the time-to-resolution for these computers is dramatically reduced because local access to the computers is not required.

Troubleshooting a Nonfunctional Computer

The following scenario demonstrates how you can use out of band management to run diagnostic commands and utilities for a desktop computer that is not functioning (for example, the operating system stops responding or will not load) without requiring local access to the computer.

The help desk at Woodgrove Bank receives notification that a computer has stopped responding. To troubleshoot the computer, the help desk engineer proceeds with the course of action outlined in the following table.

Process Reference

The help desk engineer locates the computer in question in the Configuration Manager console and connects to it using the out of band management console.

How to Run the Out of Band Management Console

The help desk engineer then performs the following actions:

  • She clicks Power Control, selects the boot option for IDE redirection, specifies the path and file for a diagnostic utility in the IDE redirection path, and then clicks Restart Computer.
  • She clicks Serial Connection and waits for the computer to boot from the image that contains the diagnostic utility. Using the diagnostics, she discovers that the disk has a number of bad sectors. She selects the option to repair the bad sectors and then exits the utility.
  • She clicks Power Control, clicks Restart Computer, and closes the out of band management console.

How to Run Commands, Repair Utilities, and Diagnostic Applications for a Computer Using Out of Band Management

The engineer confirms that the computer reboots and loads the operating system successfully.

Because the computer is operational again, she closes the ticket, but she puts in a request to replace the hard drive to safeguard against the same problem in the future.

Company-specific process.

As a result of the preceding course of action, the time-to-resolution for this computer is dramatically reduced because local access to the computer is not required.

Achieving Compliance for Software Updates by Using Wake On LAN and Power On Commands

The following scenario demonstrates how you can use out of band management with software updates in Configuration Manager to help achieve higher success rates for installing software updates within a specified time frame.

Woodgrove Bank has a security policy that requires that all computers on the network running Windows have critical security software updates installed within two weeks of release. The installation of these software updates on servers has a 100% success rate, but the success rate on desktops is only 80%, despite the Configuration Manager administrator deploying them within one week after release. On investigation, the computers that do not have the software updates installed are turned off for various reasons—for example, because users are on vacation or sick leave or because the computers are not in everyday use and are turned on only when needed for a specific application or process.

The security policy also prohibits sending wake-up packets over the network, but there is often not enough time to track down each computer, turn it on, and install the required software updates to meet the compliance deadline.

To help achieve the compliance levels in a timely and efficient fashion, Mary North decides on the course of action outlined in the following table.

Process | Reference
Mary enables Wake on LAN for the primary sites in the hierarchy and selects the following option: Use power on commands only. | How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management
She checks the packet transmission settings in the out of band service point properties and makes some minor changes. | How to Configure Power On Transmissions for Scheduled Wake-Up Activities
She reads the information in the documentation about the additional time that might be required to power on multiple computers and plans accordingly by creating different collections of computers so that software update deployments can be configured in batches. | Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN
Mary closely monitors the installation of the critical software updates. For the computers that haven't yet installed them, she creates a new deployment that contains the software updates, but this time it is also configured for Wake on LAN. She targets this software update deployment in batches to the collections that she created. | How to Configure a Software Update Deployment for Wake On LAN

As a result of the preceding course of action, critical software updates are installed on the majority of computers within one week. This leaves a comfortable margin of one more week to track down and correct the few desktop computers that still require the software update, perhaps because the computer went into sleep mode before it received the software update deployment or because there was no power to the computer.

Using the combination of software updates with a deadline for the majority of computers, Wake On LAN with power-on commands for the few computers that are turned off, and manual intervention for the minority of computers that remain noncompliant, Woodgrove Bank can now meet its compliance levels every month.

See Also

Reference

Out of Band Management Console

Concepts

Overview of Out of Band Management

Other Resources

Tasks for Out of Band Management
Technical Reference for Out of Band Management


Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management

Topic last updated—May 2008

This step-by-step example contains procedures that guide you through the process of creating and deploying the public key infrastructure (PKI) certificates that Configuration Manager 2007 SP1 requires for out of band management and AMT. For more information about out of band management in Configuration Manager, see Overview of Out of Band Management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The procedures in this example use Microsoft Certificate Services, using Windows Server 2003, Enterprise Edition with an enterprise certification authority (CA) and certificate templates. The steps are appropriate for a test network only, as a proof of concept.

Because there is no single method of deployment for the required certificates, you will need to consult your particular PKI deployment documentation for the necessary procedures and best practices to deploy the required certificates for a production environment. For more information about the certificate requirements for AMT and out of band management in Configuration Manager 2007 SP1, see Certificate Requirements for Out of Band Management.

Important
AMT provisioning in Configuration Manager 2007 SP1 requires Microsoft Certificate Services, using an enterprise CA and certificate templates. For more information about the certificate deployment requirements and usage, see About Certificates for Out of Band Management.

In This Section

The following sections of this example cover creating and deploying the certificates that are required for a Configuration Manager 2007 SP1 site to manage computers out of band:

Test Network Requirements

Overview

Creating a Windows Security Group for the Out of Band Service Point Site System Servers

Requesting, Installing and Preparing the AMT Provisioning Certificate

Preparing the Web Server Certificates for AMT Computers

Test Network Requirements

The example has the following requirements:

  • The test network is running Active Directory Domain Services with Microsoft Windows Server 2003, and it is installed as a single domain, single forest.
  • You have a domain controller running Windows Server 2003 Enterprise Edition, Service Pack 1, which has the following items installed on it:
    • Internet Information Services (IIS).
    • Certificate Services installed as an enterprise root CA.
      Note
      Ensure that IIS is installed before installing Certificate Services so that Web enrollment is configured.

  • You have one computer that has Windows Server 2003 (Standard Edition or Enterprise Edition) Service Pack 1 installed on it and designated as a member server.
  • You can log in with a root domain administrator account or an enterprise domain administrator account and use this account for all the procedures in this example deployment.

Overview

PKI certificates must be prepared and installed prior to managing computers out of band in Configuration Manager 2007 SP1. This example does not include installing and configuring Configuration Manager 2007 SP1 or provisioning computers for AMT, but it provides the steps to deploy the certificates required for provisioning computers for AMT so that they can be managed out of band. For more information about configuration of Configuration Manager 2007 SP1 for out of band management, see Configuring Out of Band Management.

The following table lists the PKI certificates that are required for managing AMT computers out of band and describes how they are used in a Configuration Manager 2007 SP1 site.

Certificate Requirement Certificate Description

AMT provisioning certificate

This certificate is used to prepare AMT-based computers for out of band management by Configuration Manager 2007 SP1.

For more information about AMT provisioning, see About AMT Provisioning for Out of Band Management.

Web server certificate

This certificate is requested by the primary site server on behalf of AMT-based computers and then installed in the AMT firmware in the computers.

After this certificate is installed, it is used to authenticate the AMT-based computer to the computer running the out of band management console before establishing an out of band management session and then encrypting all data between them.

For more information about the certificates, see Certificate Requirements for Out of Band Management.

Follow the steps in this example to achieve the following goals:

  • Create Windows security groups to be used with the certificate templates.
  • Request, install, and prepare the AMT provisioning certificate.
  • Prepare Web server certificates by configuring a certificate template on the issuing CA.

Creating Windows Security Groups for the Site System Servers

Use the following procedure to create Windows security groups for the site system servers. These security groups will be used to help ensure that only the required servers can use the two certificate templates required for AMT provisioning.

To create Windows security groups for the site system servers

  1. On the domain controller, click Start, Programs, Administrative Tools, Active Directory Users and Computers.

  2. Right-click the domain, click New, and then click Group.

  3. In the New Object – Group dialog box, enter ConfigMgr Primary Site Servers as the Group name, and then click OK.

  4. In Directory Users and Computers, right-click the group you have just created, and then click Properties.

  5. Click the Members tab, and then click Add to select the member server.

  6. Click OK, and then click OK again to close the group properties dialog box.

  7. Repeat steps 2 through 6, this time naming the group ConfigMgr Out of Band Service Points.

  8. Restart your member server (if running) so that it can pick up the new group membership.

    Note
    In the test environment, there is only one server to add, which will be used for both the primary site server and the out of band service point. However, in a production environment, it is likely that you will have multiple primary sites that will support out of band management and that you will install the out of band service point on a different server than the site server. It is therefore good practice to assign permissions to two groups and add all your primary site servers to one group and all your out of band service point site systems to the other group.

    Creating security groups for these servers enables you to assign permissions so that only these servers can request these certificates.

Requesting, Installing, and Preparing the AMT Provisioning Certificate

This step has the following procedures:

  • Requesting and installing the AMT provisioning certificate using only one of the following procedures, depending on your requirements:
    • Requesting and Installing the AMT Provisioning Certificate from an External Certification Authority
    • Requesting and Installing the AMT Provisioning Certificate from an Internal Certification Authority
  • Preparing the AMT Provisioning Certificate for the Out of Band Management Component

Request the provisioning certificate from your internal certification authority only if the AMT-based computers are configured with the certificate thumbprint of your internal root certification authority. For more information about choosing between an external certification authority and using your internal certification authority, see About Certificates for Out of Band Management. For help with locating your internal root certificate thumbprint, see How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning.

Requesting and Installing the AMT Provisioning Certificate from an External Certification Authority

If you have alternative instructions from the company issuing the AMT provisioning certificate, use their instructions in preference to the steps in the following procedure.

To request and install the AMT provisioning certificate from an external certification authority

  1. On the domain controller running the Windows Server 2003 console, click Start, Programs, Administrative Tools, Certification Authority.

  2. Expand the name of your CA, and then click Certificate Templates.

  3. Right-click Certificate Templates, and click Manage to load the Certificates Templates management console.

  4. In the results pane, right-click the entry that displays Web Server in the Template Display Name column, and then click Duplicate Template.

  5. In the Properties of New Template dialog box, on the General tab, enter a template name for the AMT provisioning certificate template, such as ConfigMgr AMT Provisioning.

  6. Click the Request Handling tab, and select Allow private key to be exported.

  7. Click the Extensions tab, make sure Application Policies is selected, and then click Edit.

  8. In the Edit Application Policies Extension dialog box, click Add.

  9. In the Add Application Policy dialog box, click New.

  10. In the New Application Policy dialog box, type AMT Provisioning in the Name field, and then type the following number for the Object identifier: 2.16.840.1.113741.1.2.3.

  11. Click OK, and then click OK in the Add Application Policy dialog box.

  12. Click OK in the Edit Application Policies Extension dialog box.

  13. In the Properties of New Template dialog box, you should now see the following listed as the Application Policies description: Server Authentication and AMT Provisioning.

  14. Click the Security tab, and remove the Enroll permission from the security groups Domain Admins and Enterprise Admins.

  15. Click Add, enter ConfigMgr Out of Band Service Points in the text box, and then click OK.

  16. Select the following Allow permissions for this group: Read and Enroll.

  17. Click OK, and close the Certificate Templates administrator console, certtmpl – [Certificate Templates].

  18. In Certification Authority, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  19. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr AMT Provisioning, and then click OK.

    Note
    If you cannot complete steps 18 or 19, check that you are using the Enterprise Edition of Windows Server 2003. Although you can configure templates with Windows Server Standard Edition and Certificate Services, you cannot deploy certificates using modified certificate templates unless you are using the Enterprise Edition of Windows Server 2003.

  20. Do not close Certification Authority.

  21. On the member server, load Internet Explorer and connect to the Web enrollment service with the address http://<server>/certsrv, where <server> is the name or IP address of the Enterprise CA.

  22. On the Welcome page, select Request a certificate.

  23. On the Request a Certificate page, select advanced certificate request.

  24. On the Advanced Certificate Request page, select Create and submit a request to this CA.

  25. On the Advanced Certificate Request page, specify the following:

    1. Select ConfigMgr AMT Provisioning for the Certificate Template.
      Note
      If you cannot see this certificate template displayed, check that you restarted the member server (if it was running) after you configured the security group in the earlier procedure.

    2. Type the fully qualified domain name (FQDN) of the out of band service point in the Name field.
    3. Type a contact e-mail address for your company in the E-Mail field.
    4. Type the name of your company in the Company field.
    5. Type the name of your company's department in the Department field.
    6. Type your company's city name in the City field.
    7. Type your company's state (full name or abbreviation) in the State field.
    8. Type your company's country code and region in the Country/Region field.
    9. Under the section Key Options, enable Store certificate in the local computer certificate store.
    10. Under the section Additional Options, click PKC10, click Save request to file, and then type in the full path and name for the offline certificate request file, such as C:\certreq_amt_<servername>.txt, where <servername> is the host name of the out of band service point.
    11. Type your choice of name for Friendly Name, such as ConfigMgr AMT Provisioning Certificate for <FQDN>, where <FQDN> is the fully qualified name of the out of band service point.

  26. Click Save.

  27. Click Yes when prompted in the Potential Scripting Violation dialog box.

  28. Click Yes when prompted in the Certificate Enrollment dialog box.

  29. Click OK to confirm that the request was saved to file.

  30. Exit Internet Explorer.

  31. Send the file to the external CA using any instructions that they provide.

  32. When you receive the AMT provisioning certificate from the CA, it is likely to be in an e-mail format. Copy the text and paste it into Notepad, saving the file with a .p7b extension. Make sure that you can access the file from the member server.

  33. On the member server, click Start, click Run, type MMC in the Run dialog box, and then click OK.

  34. In the empty console, click File, and then click Add/Remove Snap-in.

  35. In the Add or Remove Snap-ins dialog box, click Add.

  36. Select Certificates from Available snap-ins, and then click Add.

  37. In the Certificates snap-in dialog box, click Computer account, and then click Next.

  38. In the Select Computer dialog box, ensure that the option Local computer: (the computer this console is running on) is selected, and then click Finish.

  39. In the Add Standalone Snap-in dialog box, click Close.

  40. In the Add or Remove Snap-ins dialog box, click OK.

  41. In the console, expand Certificates (Local Computer).

  42. Expand Personal, and then right-click Certificates.

  43. Click All Tasks, and click Import.

  44. In the Welcome to the Certificate Import Wizard page, click Next,

  45. On the File to Import page, click Browse to navigate to the saved file with the .p7b extension, and then click Next.

  46. Select Place all certificates in the following store, click Next, and then click Finish.

  47. Press F5 to refresh, and you should now see the provisioning certificate displayed.

  48. Do not close Certificates (Local Computer).

The AMT provisioning certificate from an external CA is now installed and is ready to be prepared for the out of band management component.

Requesting and Installing the AMT Provisioning Certificate from an Internal Certification Authority

To request and install the AMT provisioning certificate from an internal certification authority

  1. On the domain controller running the Windows Server 2003 console, click Start, Programs, Administrative Tools, Certification Authority.

  2. Expand the name of your CA, and then click Certificate Templates.

  3. Right-click Certificate Templates, and click Manage to load the Certificates Templates management console.

  4. In the results pane, right-click the entry that displays Web Server in the Template Display Name column, and then click Duplicate Template.

  5. In the Properties of New Template dialog box, on the General tab, enter a template name for the AMT provisioning certificate template, such as ConfigMgr AMT Provisioning.

  6. Click the Request Handling tab, and select Allow private key to be exported.

  7. Click the Subject Name tab, select Build from this Active Directory information, and then select Common name.

  8. Click the Extensions tab, make sure Application Policies is selected, and then click Edit.

  9. In the Edit Application Policies Extension dialog box, click Add.

  10. In the Add Application Policy dialog box, click New.

  11. In the New Application Policy dialog box, type AMT Provisioning in the Name field, and then type the following number for the Object identifier: 2.16.840.1.113741.1.2.3.

  12. Click OK, and then click OK in the Add Application Policy dialog box.

  13. Click OK in the Edit Application Policies Extension dialog box.

  14. In the Properties of New Template dialog box, you should now see the following listed as the Application Policies description: Server Authentication and AMT Provisioning.

  15. Click the Security tab, and remove the Enroll permission from the security groups Domain Admins and Enterprise Admins.

  16. Click Add, enter ConfigMgr Out of Band Service Points in the text box, and then click OK.

  17. Select the following Allow permissions for this group: Read and Enroll.

  18. Click OK, and close the Certificate Templates administrator console, certtmpl – [Certificate Templates].

  19. In Certification Authority, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  20. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr AMT Provisioning, and then click OK.

    Note
    If you cannot complete steps 19 or 20, check that you are using the Enterprise Edition of Windows Server 2003. Although you can configure templates with Windows Server Standard Edition and Certificate Services, you cannot deploy certificates using modified certificate templates unless you are using the Enterprise Edition of Windows Server 2003.

  21. Do not close Certification Authority.

  22. On the member server, click Start, click Run, and type mmc.exe. In the empty console, click File, and then click Add/Remove Snap-in.

  23. In the Add/Remove Snap-in dialog box, click Add, click Certificates, and then click Add.

  24. In the Certificate snap-in dialog box, select Computer account, and then click Next.

  25. In the Select Computer dialog box, ensure Local computer: (the computer this console is running on) is selected, and then click Finish.

  26. In the Add Standalone Snap-in dialog box, click Close.

  27. In the Add/Remove Snap-in dialog box, click OK.

  28. In the console that now displays Certificates (Local Computer), expand Certificates (Local Computer), and then click Personal.

  29. Right-click Certificates, click All Tasks, and then click Request New Certificate.

  30. On the Welcome to the Certificate Request Wizard page, click Next.

  31. On the Certificates Type page, select ConfigMgr AMT Provisioning from the list of displayed certificates, and then click Next.

    Note
    If you cannot see this certificate template displayed, check that you restarted the member server (if it was running) after you configured the security group in the earlier procedure.

  32. On the Certificate Friendly Name and Description page, optionally enter a friendly name and description to help you identify this certificate, and then click Next.

  33. On the Completing the Certificate Request Wizard page, click Finish.

  34. You should see the Certificate Request Wizard dialog box informing you that the certificate request was successful. Click OK.

  35. You should now see the provisioning certificate displayed.

  36. Do not close Certificates (Local Computer).

The AMT provisioning certificate from your internal CA is now installed and is ready to be prepared for the out of band management component.

Preparing the AMT Provisioning Certificate for the Out of Band Management Component

To prepare the AMT provisioning certificate for the out of band management component

  1. In Certificates (Local Computer) running on the member server, right-click the provisioning certificate, click All Tasks, and then click Export.

  2. In the Certificate Export Wizard, click Next.

  3. On the Export Private Key page, select Yes, export the private key, and then click Next.

  4. On the Export File Format page, ensure that Personal Information Exchange - PKCS #12 (.PFX) is selected, and then select Include all certificates in the certificate path if possible.

  5. On the Password page, specify a strong password to protect the exported certificate with its private key, and then click Next.

  6. Click Next, and on the File to Export page, specify the path and name of the file that you want to export, and then click Next.

  7. Click Finish in the Completing the Certificate Export Wizard page, and then click OK in the Certificate Export Wizard dialog box.

  8. Store the file securely, and ensure that you can access it from the Configuration Manager console.

The AMT provisioning certificate is now ready to be configured for the out of band management component. For more information, see How to Configure AMT Provisioning.

Preparing the Web Server Certificates for AMT-Based Computers

Use the following procedure to prepare the Web server certificates for AMT-based computers.

To create and issue the Web server certificate template on the certification authority

  1. On the domain controller running the Certification Authority management console, right-click Certificate Templates, and click Manage to load the Certificate Templates management console.

  2. In the results pane, right-click the entry that displays Web Server in the column Template Display Name, and then click Duplicate Template.

  3. In the Properties of New Template dialog box, on the General tab, enter a template name to generate the Web certificates that will be used for out of band management on AMT computers, such as ConfigMgr AMT Web Server Certificate.

  4. Click the Security tab, and remove the Enroll permission from the security groups Domain Admins and Enterprise Admins.

  5. Click Add, enter ConfigMgr Primary Site Servers in the text box, and then click OK.

  6. Select the following Allow permissions for this group: Read, Enroll, and Autoenroll.

  7. Click OK, and close the Certificate Templates management console, certtmpl – [Certificate Templates].

  8. In the Certification Authority management console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

  9. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr AMT Web Server Certificate, and then click OK.

  10. Close Certification Authority.

The AMT Web server template is now ready to provision AMT computers with Web server certificates.

See Also

Tasks

How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Configuring Out of Band Management
Out of Band Management in Configuration Manager 2007 SP1


How to Locate the Certificate Thumbprint of Your Internal Root Certificate for AMT Provisioning

Topic last updated—May 2008

If you will use your internal certification authority to supply the AMT provisioning certificate for out of band management in Configuration Manager 2007 SP1, you will need the certificate thumbprint of your internal root certificate.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Your root certificate thumbprint can be added manually in the BIOS extensions as the certificate hash option, or it can be given to your computer supplier to be included in a customized firmware image. For more information about using a customized firmware image with AMT-based computers, see Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer. For more information about the certificate requirements for out of band management, see Certificate Requirements for Out of Band Management.

Use the following procedure to locate the certificate thumbprint of your internal root certificate.

To locate the certificate thumbprint of your internal root certificate

  1. On the computer running Certificate Services and configured as the root CA, click Start, Programs, Administrative Tools, Certification Authority.

  2. Right-click the name of your CA, and then click Properties.

  3. Click View Certificate.

  4. Click the Details tab.

  5. Scroll and select Thumbprint.

  6. Copy the string of hexadecimal numbers to the clipboard.

  7. Open Notepad or another text editor, and paste the string of hexadecimal numbers into the file.

  8. Save the file, and store it securely for later reference—for example, to provide it to your computer supplier or if you need to type the string to configure the AMT certificate hash value.

  9. In the Certificate dialog box, click OK.

  10. Click OK, and exit Certification Authority.

See Also

Concepts

About AMT Provisioning for Out of Band Management
About Certificates for Out of Band Management
Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management

Other Resources

Technical Reference for Out of Band Management


Configuration Manager AMT Provisioning Process for Out of Band Management

Topic last updated—May 2008

The sections in this topic list the AMT provisioning events that occur during the AMT provisioning process in Configuration Manager 2007 SP1, for out of band provisioning (no Configuration Manager 2007 SP1 client installed) and in-band provisioning (Configuration Manager 2007 SP1 client installed). These sections do not include the configuration actions that the Configuration Manager administrator must perform to support these processes. For configuration information, see Administrator Checklist: Enabling Out of Band Management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The provisioning events listed are performed for every AMT-based computer that Configuration Manager provisions for AMT, irrespective of whether the computer has never been provisioned or has previously been provisioned and its provisioning information was removed (either partially or fully removed).

AMT Provisioning Process for Out of Band Provisioning in Configuration Manager

The following flow of events occurs when an AMT-based computer is provisioned out of band by Configuration Manager:

  1. On first startup from the manufacturer, the AMT-based computer sends a “Hello” message to the out of band service point (once every minute for 5 minutes, then once every 5 minutes for an hour, then once an hour for 23 hours).
  2. The out of band service point inspects the UUID and the list of certificate thumbprints in the “Hello” message. If the UUID is unknown to Configuration Manager (it has not been imported with the Import Computer for Out of Band Management Wizard), the “Hello” message is discarded.
  3. When one of the certificate thumbprints sent in the “Hello” message matches the root certificate thumbprint for the AMT provisioning certificate in its own computer store, the out of band service point creates an outbound TLS connection using the Secure Channel (Schannel) Security Support Provider (SSP). In this connection, the AMT-based computer is the server, and the out of band service point is the client. This transport layer session is established by using TLS handshaking:
    1. The out of band service point sends a client “Hello” message to the AMT-based computer with a request to use SHA1.
    2. The AMT-based computer sends a server “Hello” message to the out of band service point and sends its public key with a self-signed certificate.
    3. The Microsoft Security Support Provider Interface (SSPI) is used to create the TLS channel.
    4. The out of band service point sends its AMT provisioning certificate and its full certificate chain to the AMT-based computer, with the specific AMT provisioning OID.
    5. The AMT-based computer checks the following for the AMT provisioning certificate and, if these successfully match, establishes the TLS session: the subject name (CN) against its own DNS namespace; the OID against the OID for AMT provisioning; and the certificate thumbprint of the root certificate from the certificate chain against the certificate thumbprint that it has stored in AMT firmware memory.
  4. The out of band service point establishes an application layer connection with the AMT-based computer, using HTTP Digest authentication:
    1. A SOAP request is sent from the out of band service point to the AMT-based computer, without any user name and password.
    2. The AMT-based computer responds to the out of band service point with an "authentication needed" response, which results in HTTP Digest authentication.
    3. The out of band service point resends the SOAP request with the same payload to AMT-based computer, this time using HTTP Digest authentication.
    4. The AMT-based computer completes the authentication challenge and sends a success or failure response to the out of band service point.
  5. If the HTTP Digest authentication failed during the application layer connection, the out of band service point retries using another user name and password that has been configured in Configuration Manager. All user names and passwords are tried sequentially until authentication succeeds or there are no more user names and passwords.
  6. The out of band service point sends an instruction to the site server to create an Active Directory object in the configured Active Directory container (or OU) and to set the SPN for the AMT-based computer.
  7. The AMT-based computer undergoes first-stage provisioning, initiated by a SOAP request from the out of band service point:
    1. The AMT time is synchronized with the Windows time from the out of band service point.
    2. The AMT host name and domain is configured with the computer’s host name and domain that has been provided with the Import Computer for Out of Band Management Wizard.
    3. The requested and retrieved certificate is saved to the AMT firmware memory, and TLS authentication is enabled.
    4. Configuration Manager creates a random and strong password for the AMT Remote Admin Account and stores this value in AMT.
    5. If the MEBx password in AMT has not been changed from the factory default, Configuration Manager reconfigures this password with the strong password configured in the Configuration Manager console.
    6. The settings are saved in AMT firmware, and the AMT firmware state is set to the operational mode of post provisioning.
  8. The AMT-based computer undergoes second-stage provisioning, initiated by a Windows Remote Management (WinRM) request from the out of band service point:
    1. The AMT ACLs are deleted and configured according to the AMT User Accounts and rights.
    2. The following AMT settings are enabled if they are enabled in Configuration Manager: Ping responses; Web console; serial over LAN; IDE redirection.
    3. The following additional AMT settings are configured: Kerberos is enabled; the power scheme is set to 5 (if the default of 5 is not already configured), which means that the AMT firmware will have a power state of always on except for power loss.
  9. The out of band service point sends the results of the provisioning process to the site server, which then updates the Configuration Manager database with the following information about the AMT-based computer: the AMT status; the MEBx password, the AMT Remote Admin Password.

AMT Provisioning Process for In-Band Provisioning in Configuration Manager

The following flow of events occurs when an AMT-based computer is provisioned in-band by Configuration Manager, which requires the Configuration Manager 2007 SP1 client:

  1. The Configuration Manager 2007 SP1 client downloads its client policy with instructions to initiate AMT provisioning and performs the follow checks:
    1. The Intel HECI driver is installed.
    2. The thumbprint of the AMT provisioning certificate’s root CA matches one of the root CA certificate thumbprints in the AMT memory.
  2. The AMT client agent on the Configuration Manager 2007 SP1 client generates a random one-time password (OTP), hashes it, sends the hash to the site server, and then activates the AMT network interface so that the AMT-based computer is ready for provisioning.
  3. The site server receives the OTP hash and sends an instruction to the out of band service point to start provisioning for the Configuration Manager 2007 SP1 client.
  4. The out of band service point retrieves the OTP hash for this AMT-based computer from the site server and compares it with the OTP hash reported by the AMT client agent to verify the identity of the AMT-based computer to be provisioned.
  5. The AMT-based computer sends a “Hello” message to the out of band service point once every minute for 5 minutes, then once every 5 minutes for an hour, and then once an hour for 23 hours. However, these packets are discarded by the out of band service point because the Configuration Manager 2007 SP1 client is installed.
  6. The out of band service point creates an outbound TLS connection by using the AMT provisioning certificate and the Secure Channel (Schannel) Security Support Provider (SSP). In this connection, the AMT-based computer is the server, and the out of band service point is the client. This transport layer session is established by using TLS handshaking:
    1. The out of band service point sends a client “Hello” message to the AMT-based computer with a request to use SHA1.
    2. The AMT-based computer sends a server “Hello” message to the out of band service point and sends its public key with a self-signed certificate.
    3. The Microsoft Security Support Provider Interface (SSPI) is used to create the TLS channel.
    4. The out of band service point sends its AMT provisioning certificate and its full certificate chain to the AMT-based computer, with the specific AMT provisioning OID.
    5. The AMT-based computer checks the following for the AMT provisioning certificate and, if these successfully match, establishes the TLS session: the subject name (CN) against its own DNS namespace; the OID against the OID for AMT provisioning; and the certificate thumbprint of the root certificate from the certificate chain against the certificate thumbprint that it has stored in AMT firmware memory.
  7. The out of band service point establishes an application layer connection with the AMT-based computer, using HTTP Digest authentication:
    1. A SOAP request is sent from the out of band service point to the AMT-based computer, without any user name and password.
    2. The AMT-based computer responds to the out of band service point with an "authentication needed" response, which results in HTTP Digest authentication.
    3. The out of band service point resends the SOAP request with the same payload to AMT-based computer, this time using HTTP Digest authentication.
    4. The AMT-based computer completes the authentication challenge and sends a success or failure response to the out of band service point.
  8. If the HTTP Digest authentication failed during the application layer connection, the out of band service point retries using another user name and password that has been configured in Configuration Manager. All user names and passwords are tried sequentially until authentication succeeds or there are no more user names and passwords.
  9. The out of band service point sends an instruction to the site server to create an Active Directory object in the configured Active Directory container (or OU) and to set the SPN for the AMT-based computer.
  10. The AMT-based computer undergoes first-stage provisioning, initiated by a SOAP request from the out of band service point:
    1. The AMT time is synchronized with the Windows time from the out of band service point.
    2. The AMT host name and domain is configured with the computer’s host name and domain. The computer’s host and domain name might be retrieved from system discovery or from client registration when the client is assigned to the site.
    3. The requested and retrieved certificate is saved to the AMT firmware memory, and TLS authentication is enabled.
    4. Configuration Manager creates a random and strong password for the AMT Remote Admin Account and stores this value in AMT.
    5. If the MEBx password in AMT has not been changed from the factory default, Configuration Manager reconfigures this password this with the strong password configured in the Configuration Manager console.
    6. The settings are saved in AMT firmware, and the AMT firmware state is set to the operational mode of post provisioning.
  11. The AMT-based computer undergoes second-stage provisioning, initiated by a Windows Remote Management (WinRM) request from the out of band service point:
    1. The AMT ACLs are deleted and configured according to the AMT User Accounts and rights.
    2. The following additional AMT settings are configured: Kerberos is enabled; the power scheme is set to 5 (if the default of 5 is not already configured), which means that the AMT firmware will have a power state of always on except for power loss.
  12. The out of band service point sends the results of the provisioning process to the site server, which then updates the Configuration Manager database with the following information about the AMT-based computer: the AMT status; the MEBx password, the AMT Remote Admin Password.

See Also

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Technical Reference for Out of Band Management


Client Status Reporting in Configuration Manager 2007 R2

Topic Last Updated—August 2008

Client status reporting in Configuration Manager 2007 R2 provides up-to-date information on the status of client computers in a Configuration Manager 2007 hierarchy. Full documentation for the client status reporting feature is located in a separate help file, which is available when you install the feature.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

Overview of Client Status Reporting

Provides an overview of client status reporting in Configuration Manager 2007 R2.

Comparison of the SMS 2003 Client Health Monitoring Tool and Configuration Manager 2007 Client Status Reporting

Compares the differences between the client health tool in SMS 2003 and client status reporting in Configuration Manager 2007 R2.

Prerequisites for Client Status Reporting

Lists the prerequisites for using client status reporting in Configuration Manager 2007 R2.

Planning for Client Status Reporting

Provides information about planning for client status reporting in Configuration Manager 2007 R2.

How to Install Client Status Reporting

Provides details about how to install the client status reporting feature in Configuration Manager 2007 R2.

See Also

Other Resources

Planning and Deploying Clients for Configuration Manager 2007


Overview of Client Status Reporting

Topic Last Updated—August 2008

A number of methods exist in Configuration Manager 2007 R2 that can assist you in monitoring the status of client computers on your Configuration Manager 2007 R2 site. These methods are largely based on the date of the latest discovery and inventory data received from the client. The following Configuration Manager 2007 reports can help you to examine this data:

  • Clients that have not responded recently (in a specified number of days).
  • Computers not discovered recently (in a specified number of days).
  • Computers not inventoried recently (in a specified number of days).

Although these reports can assist you in the diagnosis of potential problems, the reasons why an active client might not have reported discovery or inventory data include the following:

  • Data might be queued on a Configuration Manager 2007 site system that is backlogged.
  • Data might be queued on a Configuration Manager 2007 site system that is offline.
  • Network problems might be preventing the discovery or inventory data from reaching the site database.
  • The client computer might be offline (for example, when a user is on vacation).

Using Client Status Reporting to Monitor Client Status

Client status reporting in Configuration Manager 2007 R2 provides up-to-date information on the manageability of clients in a Configuration Manager 2007 hierarchy. This information can be used by the site administrator to identify individual client problems and to maintain a more accurate site database. It can also help to increase software distribution success rates.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Client status reporting in Configuration Manager 2007 R2 provides the following improvements over existing methods for diagnosing the status of Configuration Manager 2007 clients:

  • Identifies clients that are online but are not requesting policy.
  • Provides a number of reports that detail the status of clients on your site.
  • Identifies clients that are online but have nonfunctioning client components.
  • Identifies clients that are online but do not have up-to-date discovery or inventory records.
  • Identifies clients that are offline.
  • Is not dependent on Configuration Manager 2007 site systems. For example, client status reporting will not be affected by problems with backlogged site systems which could cause traditional reporting mechanisms to generate inaccurate results.
  • Uses a number of data sources for its analysis, including data from the Configuration Manager 2007 site database, such as inventory, discovery, and heartbeat data. Additionally, client status reporting components gather and analyze policy request log files from management points, and can also check the status and activity of Configuration Manager 2007 client components.
    Important
    Client status reporting can help you to effectively monitor and report the status of Configuration Manager 2007 clients in your site. However, be aware that this feature could impact the privacy of users in your organization. Client status reporting gathers data on your client computers, including NetBIOS names and IP addresses, that might raise privacy concerns. This information is reported only to your Configuration Manager 2007 site server, and no information is sent to Microsoft. You should consider these privacy issues before installing client status reporting.

  • Retrieves data from the Configuration Manager 2007 database, such as inventory and heartbeat discovery data records for clients. It compares the dates of these records to specified client status reporting periods. Clients that have records within these client status reporting periods are categorized as active clients. Clients that have their obsolete bit set to 1 are specified as obsolete clients.
    Clients that do not have records within the client status reporting periods are categorized as inactive clients.
  • Uses client pulse and client ping to retrieve information about the status of the client. Clients that are categorized as inactive are then further examined. Client ping then returns further information from the client computer such as whether a client component might be malfunctioning, or whether the client is offline.

Limitations of Client Status Reporting

Client status reporting has the following limitations:

  • Client status reporting is a reporting tool only; it cannot repair problems found with the Configuration Manager 2007 client.
  • Client status reporting cannot always determine the exact cause for a problem.
  • The client status diagnosis is based on the assumption that all Configuration Manager 2007 site systems are working correctly. If a server is offline, an otherwise active client might be incorrectly diagnosed as inactive.

After installing client status reporting, full documentation is supplied in a separate help file for this feature.

See Also

Tasks

How to Install Client Status Reporting

Concepts

Planning for Client Status Reporting
Prerequisites for Client Status Reporting

Other Resources

Client Status Reporting in Configuration Manager 2007 R2


Comparison of the SMS 2003 Client Health Monitoring Tool and Configuration Manager 2007 Client Status Reporting

Topic Last Updated—August 2008

The SMS 2003 client health monitoring tool was published as an add-on for SMS 2003 Service Pack 1. This tool and its objectives are similar to client status reporting in Configuration Manager 2007 R2. However, a number of improvements to the SMS 2003 client health monitoring tool have been made in Configuration Manager 2007 R2 client status reporting.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

The following table shows the key differences between the SMS 2003 client health monitoring tool and Configuration Manager 2007 R2 client status reporting.

SMS 2003 Client Health Monitoring Tool | Configuration Manager 2007 R2 Client Status Reporting
Uses a separate SQL database to store client health data. | Stores client status data in the Configuration Manager 2007 site database.
Uses Microsoft Excel to display client health reports. | Uses standard Configuration Manager 2007 reports which can also display trending data collected by the feature.
Contains checks for heartbeat discovery and software and hardware inventory. | Contains additional checks for status messages.

See Also

Other Resources

Client Status Reporting in Configuration Manager 2007 R2


Prerequisites for Client Status Reporting

Topic Last Updated—August 2008

Client status reporting in Configuration Manager 2007 R2 has external dependencies and dependencies within the product.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Dependencies External to Configuration Manager 2007

External dependencies for client status reporting are described in the following table.

Dependency | More Information
The client status reporting host system must be running Microsoft .NET Framework 2.0. | The client status reporting host system is the computer on which the client status reporting feature is installed.
The client status reporting host system must be running a supported operating system. | Client status reporting will run on any platform supported by the Configuration Manager 2007 R2 client. For a list of supported operating systems, see Configuration Manager 2007 R2 Supported Configurations.
To view charts in reports, the Configuration Manager 2007 reporting point site system must have Office Web Components installed. | Some reports for client status reporting are designed to be viewed as a chart. To use charts in reports, Office Web Components (Microsoft Office 2000 SP2, Microsoft Office XP, or Microsoft Office 2003) must be installed on the Configuration Manager 2007 site reporting point. Office Web Components are not supported on 64-bit operating systems. If you want to use charts in reports, use 32-bit operating systems for your reporting points.

Configuration Manager 2007 Dependencies

Dependencies specific to Configuration Manager 2007 for client status reporting are described in the following table.

Dependency | More Information
The site must be running Configuration Manager 2007 R2. | Client status reporting is not compatible with Configuration Manager 2007 releases before R2.
Reporting point site system. | The reporting point site system role must be installed before reports for client status reporting can be displayed. For more information about creating a reporting point, see How to Create a Reporting Point.
The site must contain clients. | Client status reporting requires at least one Configuration Manager 2007 client in the site database.

See Also

Tasks

How to Create a Reporting Point
How to Install Client Status Reporting

Concepts

Configuration Manager 2007 R2 Supported Configurations
Overview of Client Status Reporting
Planning for Client Status Reporting

Other Resources

Client Status Reporting in Configuration Manager 2007 R2


Planning for Client Status Reporting

Topic Last Updated—August 2008

The following considerations should be taken into account when installing the Configuration Manager 2007 R2 client status reporting feature:

  • Deployment scope
  • Client status reporting host system
  • Network Bandwidth
Note
The information in this topic applies only to Configuration Manager 2007 R2.

Deployment Scope

Only one SQL server and one Configuration Manager 2007 site database can be specified for each installed instance of client status reporting. Only one instance of client status reporting can be installed on a computer.

Client Status Reporting Host System

The client status reporting host system is the computer on which you install client status reporting. Consider the following when designating the client status reporting host computer:

  • You can install client status reporting on any Configuration Manager 2007 site system. However, this is not a requirement. You can also install client status reporting on any server or workstation with network connectivity to your Configuration Manager 2007 site.
    Note
    For performance reasons, Microsoft recommends installing client status reporting on a server other than the server hosting the Configuration Manager 2007 site database.

  • It is recommended that the client status reporting host system be located in close proximity on the network to the site server of the monitored site.
  • If you want to monitor the status of client computers in a Configuration Manager 2007 secondary site, you must configure client status reporting to report to the database of the parent site.
  • Client status reporting might use considerable computer resources on the client status reporting host system. For this reason, it is recommended that you do not install client status reporting on a computer that is running other resource intensive applications.
  • The Client Status Reporting Service Account requires administrator privileges and the "logon as a service" right on the client status reporting host system computer.
  • To be able to query the Configuration Manager 2007 client service on client computers by using client ping, the Client Status Reporting Service Account must have administrator permissions on the client computers.

Network Bandwidth

If you have slow network connections between Configuration Manager 2007 sites in your hierarchy, the available bandwidth might not be sufficient to support using client ping and collecting policy request log files. In this case, consider installing an instance of client status reporting at each primary site in your hierarchy.

Note
Client status reporting does not consolidate reports for multiple instances of the feature.

See Also

Tasks

How to Install Client Status Reporting

Concepts

Planning for Client Status Reporting
Prerequisites for Client Status Reporting

Other Resources

Client Status Reporting in Configuration Manager 2007 R2


How to Install Client Status Reporting

Topic Last Updated—August 2008

Client status reporting is not automatically installed when you install Configuration Manager 2007 R2. Client status reporting can be installed on any Windows server or workstation that meets the necessary prerequisites. This computer is designated as the client status reporting host system. For information about choosing a computer to act as the client status reporting host system, see Planning for Client Status Reporting.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Use the following procedure to install client status reporting on a designated client status reporting host system.

Important
After completing setup for client status reporting, refer to the documentation installed with the feature for details on how to configure client status reporting for your site.

To install client status reporting

  1. Before installing client status reporting, ensure that you have read the topics Prerequisites for Client Status Reporting and Planning for Client Status Reporting.

  2. On the designated client status reporting host system, access the Configuration Manager 2007 R2 installation media, open the folder Client Status Reporting, and run the install program ClientStatusReporting.msi.

  3. Click Next on the Welcome page.

  4. Accept the license agreement on the License agreement page, and then click Next.

  5. On the Destination Folder page, either use the default destination folder or click Browse to specify a new destination folder. Click Next to continue.

  6. Click Next on the Installation page.

  7. After installation is complete, click Finish to exit.

  8. To configure client status reporting, from the Windows start menu, navigate to Microsoft Configuration Manager 2007 R2 Client Status Reporting and then click Configure Client Status Reporting.

  9. Refer to the documentation supplied with client status reporting for detailed help about configuring the feature.

See Also

Concepts

Overview of Client Status Reporting
Planning for Client Status Reporting
Prerequisites for Client Status Reporting

Other Resources

Client Status Reporting in Configuration Manager 2007 R2


Security and Privacy for Configuration Manager 2007

Before you read this guide, be sure you understand the basic concepts of Microsoft System Center Configuration Manager 2007 . At a minimum, read Fundamentals of Configuration Manager 2007. If you already have Configuration Manager 2007 installed, read your organization’s Configuration Manager 2007 documentation and be familiar with the features and design decisions in your implementation. You might find the Configuration Manager 2007 planning and deployment content to be helpful. For more information, see Planning and Deploying the Server Infrastructure for Configuration Manager 2007. This guide also assumes you understand basic security principles.

Important
Management software brings great benefits to your environment. Well-managed networks are usually more secure networks. However, failure to adequately secure management software can leave your network vulnerable. If Configuration Manager 2007 or any other management tool is compromised, an attacker could potentially take control of every managed node. Before deviating from the recommendations in this document, evaluate the potential risks exposed by these changes and plan appropriate mitigations.

In This Section

Overview of Configuration Manager Security and Privacy

Conceptual information about Configuration Manager 2007 privacy, certificates, and object security.

Accounts and Groups in Configuration Manager

A description of all of the accounts and groups used in Configuration Manager 2007.

Configuration Manager Security and Privacy Planning

A discussion of major planning requirements for Configuration Manager 2007 security.

Security Best Practices for Configuration Manager

A description of security issues, best practices, and privacy concerns in Configuration Manager 2007.

Security Best Practices and Privacy Information for Configuration Manager Features

A description of security best practices and private issues for Configuration Manager features.

Security Checklists for Configuration Manager

Checklists that summarize Configuration Manager 2007 security.

Tasks for Configuration Manager Security

Tasks that relate to Configuration Manager 2007 security. Some of these tasks might appear in other sections, but are grouped here for convenience.

Technical Reference for Configuration Manager Security

Descriptions for classes and instance rights, implementing IPsec, and accounts that need to be deleted after upgrading.

See Also

Concepts

Configuration Manager Documentation Library


Overview of Configuration Manager Security and Privacy

The following sections provide brief overviews of the major security concepts in Microsoft System Center Configuration Manager 2007 .

In This Section

Overview of Configuration Manager Security

A description of the basic structure of Configuration Manager 2007 security.

Overview of Configuration Manager Privacy

A description of the basic issues relating to Configuration Manager 2007 privacy.

Overview of Configuration Manager Cryptographic Controls

A description of how Configuration Manager 2007 uses certificates.

Overview of Configuration Manager Object Security and WMI

A description of how Configuration Manager 2007 uses Windows Management Instrumentation (WMI) and object security.

See Also

Other Resources

Security and Privacy for Configuration Manager 2007


Overview of Configuration Manager Security

Topic last updated -- November 2007

Security for Microsoft System Center Configuration Manager 2007 consists of several layers. To begin with, Windows provides security features for both the operating system and the network. For example, Windows provides the following:

  • File sharing to transfer files between Configuration Manager 2007 components
  • Access Control Lists to secure files and registry keys
  • IPsec for securing communications
  • Group Policy for setting security policy
  • DCOM permissions for distributed applications
  • Active Directory Domain Services to store security principals
  • Windows account security, including some groups that are created during Configuration Manager 2007 installation

Additional security components, such as firewalls and intrusion detection, help provide in-depth defense for the entire environment. Certificates issued by industry standard PKI implementations help provide authentication of Configuration Manager 2007 components.

Configuration Manager 2007 controls access to the Configuration Manager 2007 console in several ways. By default, only administrators have rights to the files and registry keys needed to run the Configuration Manager 2007 console on computers where it is installed. Non-administrators on the computer must first run MMC and then add Configuration Manager 2007 as a snap-in to have rights to run the Configuration Manager 2007 console.

The next layer of security is access through Windows Management Instrumentation (WMI), specifically the SMS Provider. The SMS Provider is restricted by default to members of the local SMS Admins group. This group initially contains only the user who installed Configuration Manager 2007. To grant other accounts permission to the Common Information Model (CIM) repository and the SMS Provider, add the other accounts to the SMS Admins group.

The final layer of security is permissions to objects in the site database granted by the WMI provider. By default, the Local System account and the user account that you used to install Configuration Manager 2007 have access to administer all objects in the site database. You can grant permissions to additional users in the Configuration Manager 2007 console.

Note
You must set Configuration Manager 2007 object permissions at each site individually. Rights never flow down a site hierarchy.

See Also

Other Resources

Overview of Configuration Manager Security and Privacy


Overview of Configuration Manager Privacy

While network management products let you effectively manage large numbers of clients, you must also be aware of ways that this software could impact the privacy of users in your organization. Microsoft System Center Configuration Manager 2007 includes many tools to gather data and monitor client computers, some of which could raise privacy concerns. For example, the following features might have potential privacy considerations:

  • The Configuration Manager console
  • Discovery
  • Inventory
  • Software distribution
  • Software updates
  • Software metering
  • Mobile device management
  • Operating system deployment
  • Desired configuration management
  • Remote tools

These features have a section in this guide with information about what type of information is collected, how it is transferred, how it is stored, and how long it is retained.

Important
When you deploy the Configuration Manager 2007 client, you enable client agents so that you can use Configuration Manager 2007 features. The settings you use to configure the features apply to all clients in the site, regardless of whether they are directly connected to the corporate network, connected through a remote session, or connected to the Internet but assigned to the site. Client information is stored in the database and is not sent back to Microsoft. Before configuring the Configuration Manager 2007 client, consider your privacy requirements.

See Also

Concepts

Configuration Manager Console Security Best Practices and Privacy Information
Discovery Privacy Information
Inventory Security Best Practices and Privacy Information
Software Distribution Security Best Practices and Privacy Information
Software Updates Security Best Practices and Privacy Information
Software Metering Privacy Information
Mobile Device Clients Security Best Practices and Privacy Information
Operating System Deployment Security Best Practices and Privacy Information
Desired Configuration Management Security Best Practices and Privacy Information
Remote Tools Security Best Practices and Privacy Information


Overview of Configuration Manager Cryptographic Controls

Topic last updated—March 2008

To protect data on the network, you can sign the data so that if it has been altered in transit, the data will be discarded. You can also encrypt data to prevent an attacker from reading it through a network protocol analyzer like Network Monitor. Microsoft System Center Configuration Manager 2007 uses both signing and encryption in both mixed and native modes, as described in the following sections.

Cryptographic Controls in All Site Modes

Certain information in Configuration Manager 2007 can be signed and encrypted, regardless of the site mode.

Hashing Content

The distribution manager service on the site server hashes the content files for all packages. The policy provider includes the hash in the software distribution policy. If an advertisement is set to Download content from distribution point and run locally, when the client downloads the content, it regenerates the hash locally and compares it to the one supplied in the policy. If the hashes match, the content has not been altered and the client can install it. If a single byte of the software has been altered, the hashes will not match and the software will not be installed. Additionally, this check helps ensure that the correct software is installed because the actual content is crosschecked with the policy. However, if the advertisement is set to Run program from distribution point, the client does not verify the hash.

Hashing Policy

When Configuration Manager 2007 clients request policy, they first get a policy assignment so that they know which policies apply to them, and then request only those policy bodies. Each policy assignment contains the calculated hash for the corresponding policy body. The client retrieves the applicable policy bodies and then calculates the hash on that body. If the hash on the downloaded policy body does not match the hash in the policy assignment, the policy body is discarded.

Signing Desired Configuration Management Data

Before Configuration Manager 2007 imports configuration data, it verifies the file's digital signature. If the files have not been signed, or if the digital signature verification check fails, you will be warned and prompted to continue with the import. Continue importing the configuration data only if you explicitly trust the publisher and the integrity of the files.

Site-to-Site Signing and Encryption

The site control file contains all the configuration properties for a site and any child sites. When an administrator changes the configuration for a child site, the parent sends the changes in a site control file to the child site server. If the administrator in a child site changes the configuration, the changes are sent in a site control file to the parent site. Child sites also send data such as inventory and status to the parent site, while parent sites send data such as packages and collection definitions to the child sites.

Before sending any data between sites, the sending site server generates a hash and signs it with its private key. The receiving site server checks the signature by using the public key and compares the hash with a locally generated value. If they match, the receiving site accepts the site control file. If the values do not match, the site control file is rejected.

A related configuration allows Configuration Manager 2007 to automatically distribute the site-to-site communication keys to the parent or child site, even if the communication channel is not secure. If you do a fresh installation, Require secure key exchange is enabled by default, however if you are upgrading the current setting is preserved.

After Require secure key exchange is enabled, the site-to-site communication public key can be exchanged in one of two ways:

  • If the Active Directory Domain Services schema has been extended for Configuration Manager 2007 and Configuration Manager 2007 has permissions to publish to Active Directory, the site server will automatically publish its site-to-site communication public key to its site object in the System Management container.
  • If the Active Directory schema has not been enabled, or if Configuration Manager 2007 does not have permissions to publish to Active Directory, the Configuration Manager 2007 administrator must dump the public key using the Preinst command, and then manually copy the public key to the destination site.
    Important
    Automatic key exchange does not work between forests. If the site hierarchy spans forest boundaries, the administrator must manually exchange the keys even if both forests have extended the schema and Configuration Manager 2007 is publishing to Active Directory.

Some information within the site control file is encrypted; however the site control file itself is not encrypted when transferred between sites. You should use IPsec to enable encryption for site-to-site communication. For more information, see Implementing IPsec in Configuration Manager 2007.

Inventory Signing and Encryption

Inventory is always signed for computers, regardless of the mode, however inventory for mobile devices is signed only in native mode. In mixed mode, encryption is optional, but recommended. For more information, see How to Encrypt Client Inventory Reports.

State Migration Encryption

Data stored on state migration points for operating system deployment is always encrypted.

Signing in Software Updates

All software updates must be signed by a trusted publisher to protect against tampering. On client computers, the Windows Update Agent (WUA) will scan for the updates from the catalog, but will fail to install the update unless it can locate the digital certificate in the Trusted Publishers store on the local computer. If a self-signed certificate was used when publishing the updates catalog, such as WSUS Publishers Self-signed, the certificate must also be in the Trusted Root Certification Authorities certificate store on the local computer to verify the validity of the certificate. WUA also checks whether the Allow signed content from intranet Microsoft update service location Group Policy setting is enabled on the local computer. This policy setting must be enabled for WUA to scan for the updates that were created and published with Updates Publisher.

When software updates are published in System Center Updates Publisher, a digital certificate signs the software updates when they are published to an update server. You can either specify a PKI certificate or have Updates Publisher generate a self-signed certificate to sign the update.

Certificates in Mobile Device Management

If the mobile device has not been locked by the mobile operator, Configuration Manager 2007 can help install certificates needed for signature verification of mobile applications by sending certificates as configuration items or by installing the certificates along with the client software. If your mobile device is locked, you cannot use Configuration Manager 2007 to deploy certificates. For more information, see Deploying Certificates to Mobile Device Clients.

If you enable hardware inventory for mobile devices, Configuration Manager 2007 also inventories the certificates installed on the mobile device.

Certificates in Out of Band Management (Configuration Manager 2007 SP1)

Out of band management uses two types of PKI-issued certificates.

The out of band service point uses an AMT provisioning certificate to prepare computers for out of band management. The AMT-based computers that will be provisioned must trust the certificate presented by the out of band management point. By default, AMT-based computers are configured by the computer manufacturer to use external certification authorities (CAs), such as VeriSign, Go Daddy, Comodo, and Starfield. If you purchase a provisioning certificate from one of the external CAs and configure Configuration Manager to use this provisioning certificate, AMT-based computers will trust the CA of the provisioning certificate and provisioning can succeed. It is also possible to use your own in-house CA.

The AMT-based computers run a Web server component within their firmware and that Web server component encrypts the communication channel with the out of band service point using Transport Layer Security (TLS). There is no user interface into the AMT BIOS to manually configure a certificate, so you must have a Microsoft enterprise certification authority that automatically approves certificate requests from the primary site server and installs the certificates on the AMT-based computers. The request uses PKCS#10 for the request format, which in turn, uses PKCS#7 for transmitting the certificate information to the AMT-based computer.

Although the AMT-based computer is authenticated to the computer managing it, there is no corresponding client PKI certificate on the computer managing it. Instead, these communications use either Kerberos or HTTP Digest authentication. When HTTP Digest is used, it is encrypted using TLS.

For more information, see About Certificates for Out of Band Management.

Encryption for Multicast Packages (Configuration Manager 2007 R2)

For every operating system deployment package, you have the option to enable encryption when transferring the package using multicast. If you enable encryption, no additional certificate configuration is required. The multicast-enabled distribution point automatically generates symmetric keys for encrypting the package. Each package has a different encryption key. The key is stored on the multicast-enabled distribution point using standard Windows APIs. When the client connects to the multicast session, the key exchange occurs over a channel encrypted with either the PKI-issued client authentication certificate (native mode) or the self-signed certificate (mixed mode). The client stores the key in memory only for the duration of the multicast session.

Certificate for Asset Intelligence Synchronization Point (Configuration Manager 2007 SP1)

Before installing an Asset Intelligence synchronization point, you must have a System Center Online authentication certificate. This certificate can be obtained only by Software Assurance (SA) license customers. For more information, see How to Connect to System Center Online.

Cryptographic Controls in Native Mode

Native mode is the recommended mode because it offers a higher level of security by integrating with a public key infrastructure (PKI) to help protect client-to-server communication. However, implementing native mode without a thorough understanding of PKI planning, deployment, and operations could still leave you vulnerable. For example, if you do not properly secure your root CA, attackers could compromise the trust of your entire PKI infrastructure. Also, if you do not properly deploy and manage the necessary native mode certificates, you could leave all of your clients in an unmanaged state such that they cannot receive critical software updates or packages

Important
Native mode helps protect only communication between the client and some site systems. Native mode does nothing to protect the communication channel between the site server and site systems or between site servers.

Native Mode Certificates

Native mode requires several types of certificates:

Site systems that require IIS require Web server certificates to encrypt communications with clients over SSL. The following site systems require Web server certificates.

  • Management point
  • Proxy management point
  • Distribution point
  • Software update point
  • State migration point

All clients, both client computers and mobile device clients, require client authentication certificates. You must also deploy a client authentication certificate to the management point and state migration point, even if they do not have a Configuration Manager 2007 client installed on them. If your clients already have client authentication certificates, Configuration Manager 2007 might be able to use your existing certificates.

The site server requires a custom site server signing certificate to sign policy sent to clients. This certificate must have document signing capability and have a specific text string as the subject name. All clients must have a copy of the site server signing certificate, so they can verify the signature on the policy.

For more information, see Certificate Requirements for Native Mode.

If all the computers in your Configuration Manager 2007 hierarchy use certificates from the same certification authority, you need to deploy only a single trusted root certification authority. However, there is no requirement to use the same certification authority, so you might have to install multiple root CAs on your clients and servers. If you are not using a Microsoft PKI solution, you might also need to install intermediate CA certificates on your site systems.

For more information, see Deploying the PKI Certificates Required for Native Mode.

Note
All Configuration Manager 2007 certificates must contain only single-byte characters in the subject name or subject alternative name. For more information, see Native Mode Certificates and Double-Byte Character Sets.

Internet-based Client Management Certificates

Internet-based client management requires native mode and all of the native mode certificate infrastructure. In addition, if the site supports Internet-based client management and you are using a proxy server with SSL termination (bridging) for incoming Internet connections, you must configure a certificate for Server authentication and client authentication on the proxy server. If you are using a proxy server without SSL termination (tunneling), no additional certificates are required on the proxy server. For more information, see Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management.

Mobile Device Client Certificates in Native Mode

If you have mobile devices assigned to a native mode site, they require certificates to support native mode. Native mode mobile device clients require a copy of the site server signing certificate, a copy of the Web server certificate for management points and distribution points that support mobile devices, and copies of the intermediate CAs and root CAs. Mobile devices require a certificate in the Personal store with client authentication capabilities. For more information, see About Native Mode Certificates for Mobile Device Clients.

Unlike client computers, which require a certificate for computer authentication, mobile devices require user authentication certificates to authenticate to native mode site systems.

Operating System Deployment Certificates in Native Mode

When you use Configuration Manager 2007 to deploy operating systems in native mode, a client computer must also have a certificate to communicate with the management point, even if the computer is in a transitional phase like booting from task sequence media or a PXE service point. To support this scenario, a PKI client authentication certificate must be created and exported with the private key and the certificate for the trusted root CA for the management point must be configured in the site server properties.

If you are creating bootable media, you import the client authentication certificate when you create the bootable media. You should set a password on the bootable media to help protect the private key and other sensitive data configured in the task sequence. Every computer that boots from the bootable media will present the same certificate to the management point as needed for client functions such as requesting policy.

If you use PXE boot, you import the client authentication certificate to the PXE service point and it loans the same certificate to every client booting from that PXE service point. You should require users connecting to the PXE service point to supply a password to help protect the private key and other sensitive data in the task sequences.

If either of these client authentications certificates is compromised, you should block the certificates in the site properties in the Certificates node. Managing these certificates requires the Manage operating system deployment certificate right.

After the operating system is deployed and the Configuration Manager 2007 is installed, the client will need its own PKI client authentication certificate for native mode communication, as described earlier in this section.

For more information, see How to Manage Native Mode Certificates and Operating System Deployment.

Support for Extending Configuration Manager in Native Mode

Independent Software Vendors (ISVs) can create applications that extend Configuration Manager 2007. For example, an ISV could create extensions to support non-Windows client platforms such as Macintosh or UNIX computers. However, if the site is in native mode, even extended clients must use certificates to communicate with the Configuration Manager 2007 management point. Configuration Manager 2007 includes the ability to assign a certificate to the ISV proxy that enables communications between the ISV proxy clients and the management point. If you use extensions that require ISV proxy certificates, consult the documentation for that product. If you need to create ISV proxy certificates, see the Configuration Manager 2007 Software Developer Kit (SDK) for more information.

If the ISV certificate is compromised you should block the certificate in the site properties in the Certificates node.

Communication That Is Unencrypted in Native Mode

In native mode, communications are usually encrypted over SSL. However, in the following situations, native mode clients communicate with site systems without using encryption:

  • Advertisements are configured for the option Run program from distribution point
  • Client fails to make an HTTPS connection to the distribution point
  • Client is communicating with the following site systems:
    • Fallback status point
    • Server locator point
    • PXE service point
    • System Health Validator point
  • In native mode, client computers are configured for HTTP communication for roaming and site assignment to communicate with a server locator point
  • Branch distribution points, which always use the server message block (SMB) protocol, even in native mode
  • Distribution points not configured to Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS. Without this setting, clients always use SMB, even in native mode.

Reporting points are configured to use HTTP or HTTPS independently of the site mode.

For more information, see Client Communication in Mixed Mode and Native Mode.

Signing in Native Mode

In native mode, client policy assignments are signed by the site server signing certificate to help prevent the security risk of a compromised management point sending policies that have been tampered with. This safeguard is particularly relevant if you are using Internet-based client management because this environment requires a management point that is exposed to Internet communication. Also, client communication between clients and servers is signed, except as described in the section "Communication That Is Unencrypted in Native Mode".

CRL Checking

Certificate revocation list (CRL) checking is enabled by default in IIS, so if you are using a CRL with your PKI deployment, there is nothing additional to configure on most Configuration Manager site systems. The exception is for software updates, which requires a manual step to enable CRL checking to verify the signatures on software update files. For more information, see How to Enable CRL Checking for Software Updates.

CRL checking is enabled by default for client computers in native mode. Enabling CRL checking increases administrative and processing overhead, but is more secure. However, if CRL checking is enabled but the client cannot access the CRL, the client cannot communicate with the site. For more information, see Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode).

Cryptographic Controls in Mixed Mode

In mixed mode, some certificates are still used but they are self-signed and require no PKI infrastructure. In most cases, the self-signed certificates require no administrator action.

Policy Signing

When clients request policy in mixed mode, the policy assignment sent back is signed by the management point's self-signed certificate. One of the reasons native mode is more secure is the policy is signed by the central site server signing certificate in addition to the management point PKI-issued certificate. In mixed mode, an attacker who compromises a management point can create and sign arbitrary policy. If the client cannot verify the signature on the policy assignment, the client discards the policy assignment.

Operating System Deployment Certificates

When you use Configuration Manager 2007 to deploy operating systems in mixed mode, a client computer must also have a certificate to communicate with the management point, even if the computer is in a transitional phase like booting from task sequence media or a PXE service point. To support this scenario in mixed mode, Configuration Manager 2007 generates self-signed certificates. If the self-signed certificates are compromised, you should block the certificates in the site properties in the Certificates node to prevent attackers from using them to impersonate trusted clients.

Client and Server Authentication

In mixed mode, clients authenticate their management points using either Active Directory Domain Services or by using the Configuration Manager 2007 trusted root key, as described in About the Trusted Root Key. Clients do not authenticate other server roles, such state migration points or software update points. Clients in mixed mode generate self-signed certificates and management points use them to authenticate the clients. Because any client can generate a self-signed certificate that will be accepted by the management point, mixed mode provides minimal security. However, only clients that are approved are trusted enough to receive any policy containing sensitive information.

Cryptographic Algorithms Used in Configuration Manager

The primary hashing algorithm used in Configuration Manager 2007 is SHA-1. When two Configuration Manager 2007 sites communicate with each other, they sign their communications using SHA-2. The primary encryption algorithm implemented in Configuration Manager 2007 is 3DES. Also, if native mode is implemented, you can configure your PKI to use RSA certificates with the maximum key lengths documented in Certificate Requirements for Native Mode.

Note
If you have SMS 2003 sites in the site hierarchy, Configuration Manager 2007 uses MD5 hashes to sign communication with the SMS 2003 child sites. Packages created in SMS 2003 (no service pack) are hashed with MD5 until they are updated using the Update Distribution Points Wizard in SMS 2003 (with any service pack) or in Configuration Manager 2007, after which the packages are hashed with SHA-1.

See Also

Other Resources

Overview of Configuration Manager Security and Privacy


About the Trusted Root Key

Topic last updated—March 2008

Regardless of the site mode, clients need to authenticate their management point prior to establishing communications to prevent attackers from inserting rogue management points and redirecting clients to them. When a management point is created, it creates a certificate to be used for signing. The certificate is self-signed and is valid for 99 years. It is created and stored in the certificate store on the management point. The management point always creates this self-signed certificate, even if the site is running in native mode and has a certificate issued by a PKI.

When the Configuration Manager client receives a message from the management point, the client has a few options to verify that the message came from a valid management point. If clients can query Active Directory Domain Services in the site server's forest, they can verify that the management point is a trusted management point. If the clients cannot query Active Directory Domain Services to verify trusted management points, the clients use the trusted root key.

What is the trusted root key?

The trusted root key provides a mechanism for clients to verify the authenticity of the management point and its certificate if they cannot query Active Directory Domain Services. Every primary site server generates a trusted root key, even if the site is running in native mode and even if Active Directory Domain Services publishing is enabled. If the primary site is joined to a parent site, the child site eliminates its own trusted root key and instead trusts the trusted root key of the parent site. The function of the trusted root key is somewhat like a root certificate in a public key infrastructure in that anything signed by the private key of the trusted root key is trusted further down the hierarchy. By signing the management point certificate with the private key of the trusted root key pair, and by making a copy of the public key of the trusted root key pair available to the clients, clients can differentiate between valid management points and rogue management points. Clients require the trusted root key only if they cannot query the Global Catalog for Configuration Manager 2007 information, either because they are in a workgroup or remote forest, or because the Active Directory Domain Services schema is not extended for Configuration Manager 2007. The trusted root key is stored in WMI in the root\ccm\locationservices namespace.

How do management points obtain the trusted root key?

When a new management point is created, regardless of the site mode, it creates a self-signed certificate in the certificate store. In mixed mode, the self-signed certificate is then saved to a location in the registry. In native mode, the management point certificate issued by the PKI is saved to the registry location. Site component manager collects the certificate from the registry and sends its certificate to its site server. If its site server is not the central site, the certificate is passed up through the hierarchy until it arrives at the central site where the trusted root key is kept. The central site server signs the management point’s certificate with the private trusted root key and sends it back down through the hierarchy to the management point, along with a copy of the public trusted root key. When the management point receives the copy of the public trusted root key, it signs the trusted root key with its own private key. This aids in recoverability, as discussed later in this section. At this point, the management point has several keys used in the trusted root key process:

  • The management point’s certificate (either self-signed for mixed mode or PKI-issued for native mode)
  • The management point’s certificate signed by the trusted root key
  • A copy of the public trusted root key from the central site
  • A copy of the public trusted root key signed by the management point’s private key

How do clients authenticate the management point?

The client stores the following key and certificate information in classes in WMI:

  • Information about each management point in the management point list, including the management point’s certificate
  • The copy of the public trusted root key
  • The list of management points the client communicates with
    Note
    If the management point is in an NLB cluster, the list of management points the client trusts will contain all of the site systems in the cluster. If there is no NLB cluster in the site, the list will contain just the default management point.

When the client makes a request to the management point, it attempts to verify the response. The client looks to see if the management point for the site code is in the management point list in WMI. If it is, the client attempts to retrieve a copy of the management point certificate from WMI. Assuming it finds the certificate, it verifies the message. Every message must be verified, otherwise it is discarded.

If the client does not have the management point certificate stored in WMI, it checks to see when the management point list was last updated. If the last updated time is greater than five minutes, the client retrieves a new management point list. Also, if there was no management point list in WMI, the client must retrieve a management point. Where the client retrieves the list of management points depends on the client mode and whether you have extended the Active Directory Domain Services schema for Configuration Manager 2007.

The client can be configured in one of three modes by running client setup with the installation property SMSDIRECTORYLOOKUP=<switch>. The following table describes each mode and its associated management point authentication process.

Mode | Switch | Management Point Authentication Process
Active Directory Only | NOWINS | In this mode, the client cannot retrieve the management point list from WINS. If the client is unable to retrieve the list from the Global Catalog Server or from DNS, the lookup fails and the client will be unable to communicate with a management point.
Secure WINS | WINSSECURE | In this mode, the client first attempts to retrieve the list of management points from Active Directory Domain Services. If that attempt fails, the client locates the default management point for the site using WINS and then asks the default management point for the list of management points. The client also asks the default management point for its certificate and then verifies that the certificate has been signed by the trusted root key by checking its copy of the trusted root key in WMI. If the certificate is valid, the client trusts it and can use it to verify messages from that management point. If the signature on the management point certificate does not match the client’s copy of the trusted root key, it discards the messages from that management point.
Any WINS | WINSPROMISCUOUS | In Any WINS mode, the client first attempts to retrieve the list of management points from Active Directory Domain Services. If that attempt fails, the client locates the default management point for the site using WINS and then asks the default management point for the list of management points. The client trusts the management point without any certificate checking.

If no switch is specified, the client installs in Secure WINS mode. Active Directory Only mode is the most secure, relying on the underlying security of the Active Directory Domain Services querying process, but can be used only if your clients can query the Global catalog so it should not be used for clients in remote forests or workgroups. The Any WINS mode is not secure and is not recommended.

How do clients obtain the trusted root key?

If you have extended Active Directory Domain Services and enabled publishing for Configuration Manager, clients in the same forest as the site server can retrieve the public copy of the trusted root key by querying the Global Catalog server. If the client is unable to retrieve an initial copy of the trusted root key from Active Directory Domain Services, you can pre-provision the trusted root key on the client during client installation.

What if clients do not have the trusted root key?

If clients do not have the trusted root key, they will trust the trusted root key presented by the first management point they communicate with, meaning a client might be misdirected to an attacker’s management point where it would receive policy from the rogue management point. This would likely be the action of a sophisticated attacker and could occur only within a limited time before the client retrieves the trusted root key from a valid management point. To reduce the risk of an attacker misdirecting clients to a rogue management point, you can pre-provision the clients with the trusted root key. For more information, see How to Pre-provision the Trusted Root Key on Clients.

Note
If you assign a client to a new site, Configuration Manager 2007 deletes the trusted root key. To reduce the risk of clients being misdirected to a rogue management point, you should pre-provision the client with the new trusted root key if it cannot query Active Directory Domain Services.

How do clients refresh the trusted root key?

After the client has obtained a copy of the trusted root key, it keeps that copy in the registry. If the client encounters a failure to authenticate a message from a management point, the client refreshes the trusted root key, discards the current management point certificate, and obtains a new copy of the management point certificate signed by the trusted root key.

How do clients recover from a central site failure?

If the central site server needs to be recovered, it will generate a new trusted root key. Certificates from all management points in the hierarchy will be collected, sent to the central site, signed by the trusted root key, and eventually returned to each management point. Because the client trusts the management point, it will accept the new trusted root key. If the client contacts a management point that it does not yet trust, and cannot verify the management point by querying Active Directory Domain Services, it will not accept information from the management point. The client will be unmanaged until it can verify the management point.

If there is no trusted management point for the client to contact, problems can arise. For example, clients might report to a central site server that also functions as the management point for the site and that site server is down. This often occurs in small deployments where there is only one site and the site server performs all roles for the site. In the case of a system failure on the site server, a new trusted root key is created during site server recovery and the management point receives a new certificate, either by creating a self-signed certificate for mixed mode or by getting a new PKI-issued certificate for native mode. The client has neither the current copy of the management certificate nor the copy of the trusted root key and has no automatic mechanism to get either. If the client cannot query Active Directory Domain Services to verify the management point, the client cannot communicate with the site until the administrator removes the old trusted root key from the client and then either pre-provisions the new trusted root key or allows the client to obtain the key from the first management point it contacts.

What should you do if your trusted root key is compromised?

If clients can query Active Directory Domain Services, they do not rely on the trusted root key so compromise does not pose serious risk. Running in native mode requires a PKI-issued certificate for the management point, so trusted root key compromise is less risky in native mode than in mixed mode.

If you suspect that your trusted root key is compromised, you should monitor the site audit client status messages for indications of unauthorized site activity such as unrecognized packages running.

If you reinstall and restore the central site server, you will generate a new trusted root key. If you restructure your site hierarchy so that a child site is promoted to be the new central site, Configuration Manager 2007 creates a new trusted root key for the hierarchy. You can pre-provision the clients to use the new trusted root key as described earlier, however you still leave your network exposed to the risk that an attacker has established back doors in your systems. To truly recover from a trusted root key compromise, you should consider reinstalling all site servers, management points, and client computers.

About the Trusted Root Key in Operating System Deployment

After a distribution point is enabled to support multicast, the distribution point creates a self-signed certificate in the local certificate store and places the certificate signature in the registry. Site component manager locates the signature in the registry, notices that it has not been signed by the trusted root key, and then forwards it to the hierarchy manager to sign it with the site's trusted root key. After the certificate signature has been signed with the trusted root key, the signature is stored back in the registry. After the signing process is complete, the distribution point is ready to support multicast clients. If the self-signed certificate expires, the distribution point creates a new one and starts the signing process again.

See Also

Tasks

How to Pre-provision the Trusted Root Key on Clients
How to Remove the Trusted Root Key
How to Verify the Trusted Root Key


Overview of Configuration Manager Object Security and WMI

WMI Security

Microsoft System Center Configuration Manager 2007 relies completely on Windows Management Instrumentation (WMI). WMI is the Microsoft implementation of Web Based Enterprise Management (WBEM), which is a unifying architecture that allows access to data from a variety of underlying technologies, including Win32, WMI, the Desktop Management Interface (DMI), and the Simple Network Management Protocol. WBEM is based upon the Common Information Model (CIM) schema, which is an industry standard driven by the Desktop Management Task Force. WMI uses Managed Object Format (MOF) files to determine what information to load into the CIM repository. WMI also uses providers to access the CIM repository.

Essentially, WBEM provides a standard way to define information that a system should collect (the MOF), a standard way to represent that information (the CIM), and a standard way to access that collected information. For example, WMI in a Windows operating system can collect performance information (using the Performance Monitor Provider), from the registry (using the Registry Provider), and from Configuration Manager 2007 hardware inventory (using the SMS Provider), and store them all in the CIM repository. Then you can view the information in the Configuration Manager 2007 console (using the SMS Provider).

However, access to the CIM repository is controlled by WMI permissions. By default, the local administrator account and the local Administrators group have rights to all operations, including remote access. You can use WMI to control global permissions on namespace operations, such as limiting the access of some users to read-only operations. You can use the WMI Control, available in the Computer Management administrative tools, to manage WMI security. When you install Configuration Manager 2007, you designate the computer where the SMS Provider will run and Configuration Manager 2007 creates the SMS Admins group on that computer and on the site server if the SMS Provider is on a remote computer. The SMS Admins group has the necessary permissions to access the SMS Provider. For more information, see About the SMS Admins Group.

Configuration Manager Object Security

The only way that Configuration Manager 2007 itself enforces security is when you access a Configuration Manager 2007 object through the SMS Provider. If a user has been granted direct rights to tables in the site database by the SQL administrator, for example, the user could perform any action within those rights, regardless of the Configuration Manager 2007 object security that has been assigned.

Important
Directly accessing the site database is not supported and could lead to changes that could stop your site from functioning.

Object access is granted through user or group accounts. Group membership is enumerated when the group member attempts to access the object. You can grant rights to an entire class of objects (all packages, all sites, all collections) or to an instance of an object (the "Office 2007 package," the "NYC" child site, the "Computers in Building 44" collection). Not all classes allow you to grant rights to an instance. For example, there are too many status messages to be practical to grant instance permissions to each individual status messages, so Status Message has only a class right. For a complete list of all of the class and instance permissions in Configuration Manager 2007, see Classes and Instances for Object Security in Configuration Manager in the Technical Reference section of the Configuration Manager Documentation Library.

Default Object Security

By default, the only users with rights to all objects in the Configuration Manager 2007 console are the user account that was used to run Configuration Manager 2007 setup (the Configuration Manager Installation account) and the Local System account. You must explicitly add other accounts and grant them permissions to Configuration Manager 2007 objects. Also, if they are not already a member of SMS Admins, you must grant them WMI permissions. Without WMI permissions, users cannot run the Configuration Manager 2007 console at all. Without any object rights, users who can start the Configuration Manager 2007 console can only see the high-level nodes, along with the Security Rights and Tools. Users cannot see any data other than the Security Rights, and they cannot manipulate the Security Rights.

Note
If you upgraded the site from a previous version, the account that had full rights to all objects will not have rights to new object types until you explicitly grant them. For example, even though the software updates administrator had full rights to all Configuration Manager 2007 objects, if the software updates administrator was not the user who performed the upgrade, the software updates administrator will not have any rights to the new deployment objects in Configuration Manager 2007.

For each object type, there must always be at least one account with the class-level Administer right. This prevents administrators from being locked out of the Configuration Manager 2007 system. As a result, it is not possible to delete the final user on an object type with the Administer right. Also, you cannot delete your own Administer rights on an object.

Users who create an instance of an object are automatically assigned Read, Modify, and Delete rights for that instance.

How Rights Accumulate

Configuration Manager 2007 object rights are cumulative. For example, if a user has the Read right on one collection (for example, “All Systems”) and the Use Remote Tools right on another collection (“Collection A”), then the user has the Read and Use Remote Tools rights on all systems that are members of both collections. The user can view a resource in the “All Systems” collection and use Remote Tools with that resource if that resource is also in the “Collection A” collection. If the resource is not in the “Collection A” collection, then the user cannot use Remote Tools with that resource. The fact that the user does not have the Remote Tools right in the “All Systems” collection does not mean that they are denied use of Remote Tools to all computers in the “All Systems” collection. The user is only denied use of Remote Tools to computers in the “All Systems” collection that do not have the Use Remote Tools right in any other collection that includes that computer.

Because Configuration Manager 2007 rights are cumulative, if you grant a user class security rights to a security object and conflicting instance security rights to a specific security object, Configuration Manager 2007 reconciles the class and instance security rights to grant the highest level of permissions. For example, if you grant the user all rights to all packages at the class level and Read to a specific package at the instance level, the user’s effective rights are full rights to all packages, including the specific package set with Read.

Implementing Role-Based Security Using Object Security

You can grant permissions to objects by granting rights to user groups in your organization to address their specific needs. For example, if your help desk technicians have a user group, you can grant that group Use Remote Tools rights for Collections. If users who are not Configuration Manager 2007 administrators want to view and query inventory collected from clients, you can grant those users Read rights to Collections and Queries, along with Read Resource rights to Collections.

Administer vs. Delegate

When creating an object (such as a collection or advertisement), the user might want to allow other users (or groups) to use or manage the object. This is possible if the user has the class-level Administer right, but that also allows them to do anything they want to with any instance of that object type. A better solution is to give the user the class-level Delegate right, which allows them to grant rights to users and groups for objects they create. However, users can only grant rights that they are explicitly granted at the instance level; they cannot grant rights that they are granted through group membership or at the class level.

For example, a user might have the class-level Create and Delegate rights for Collections. The user also has instance-level Read, Read Resource, and Advertise rights for the “All Windows XP Systems” collection. The user can then create a new collection based on the membership of the “All Windows XP Systems” collection. The user can then grant the Read and Read Resource rights to the new collection—but not Create or Delegate rights—to another group so that the members of that group can view members of the new collection.

Note
Grant permissions to each administrator carefully at the instance level, unless they require permissions at the class level. Create a collection of the resources that each administrator manages and grant permissions only to that collection. As a result, each administrator sees only those security objects to which access is granted.

Viewing Resources in Collections and Queries

Often, the rights you set on collections affect your ability to perform tasks in other nodes in the Configuration Manager 2007 console. For example, granting the Read object security right on a collection not only gives the user the right to see that collection but also to see resources within that collection. The user can view the properties of the resource and can invoke the Resource Explorer, but they cannot see the values of the Resource Explorer groups. For that level of detail, the user also requires the Read Resource right. To further manage computer resources, give the user the Use Remote Tools or View Collected Files rights. To remove the resource from Configuration Manager 2007 altogether (as opposed to just removing the collection rule that makes that resource a member of the collection), the user must have the Delete Resource right.

You can manage resources through queries, but the Read right on queries gives you the privilege only to see and run the queries. The right to view resources in a query result window and to manage those resources is granted by the rights set for collections that those resources are in.

Site Maintenance Rights

To manage the site database, site maintenance Microsoft SQL Server commands can be created in the Configuration Manager 2007 console, under the Site Settings node for each site. These commands have complete rights in the site database and can manipulate the data and database in any way. To prevent malicious use of this powerful facility, you should limit the Manage SQL Commands instance of the Site class to only those senior administrators that require this right.

Note
To add, delete, or modify SQL commands, you must also have the Modify right on the Site object.

Software Metering Rights

One of the primary software metering tasks is to create software metering rules. Software metering rules can apply not only to the site they are created for but also to the child sites of that site. To manage software metering rules, the Configuration Manager 2007 administrator must have appropriate software metering rule object security rights. For those rules to apply to a site, the administrator must also have the Site class Meter instance right, or the class-level site Meter right, in which case the rules apply to all sites the rule is distributed to. The Meter rights that are relevant are the rights at the site where the rule originates, not the rights at the sites the rule is distributed to.

Software Updates

To add software updates to a template or to a deployment, either by dragging and dropping or by using the Action menu, you must have the following rights.

 | Read | Distribute | Create | Advertise
Configuration items | X | X |  |
Collection | X |  |  | X
Deployment package | X | X |  |
Deployment template | X |  |  |
Deployment | X |  | X |
Site | x |  |  |

Software Distribution Rights

Because advertisements involve the package and the collection, you must have the following rights to create an advertisement:

  • Read rights on the collection receiving the advertisement
  • Advertise rights on the collection receiving the advertisement
  • Read rights on the package containing the advertised program

You must have the following rights to delete an advertisement:

  • Delete rights on the advertisement
  • Advertise rights on the collection receiving the advertisement
  • Read rights on the package containing the advertised program

Operating System Deployment

Some operating system deployment tasks require access to packages, collections, advertisements, and site objects.

Object | Rights to create | Rights to modify | Rights to delete | Rights to distribute
Boot Images | Create\Boot image package, Read\Boot image package | Modify\Boot image package, Read\Boot image package | Delete\Boot image package, Read\Boot image package | Read\Boot image package, Modify\Boot image package, Distribute\Boot image package, Read\Site
Computer Association | Create\Computer association, Read\Computer association, Read\Collection | Modify\Computer association, Read\Computer association | Delete\Computer association, Read\Computer association | Not applicable
Operating System Images | Create\OS image, Read\OS image | Modify\OS image, Read\OS image | Delete\OS image, Read\OS image | Modify\OS image, Read\OS image, Distribute\OS image, Read\Site
Operating System Install Pacakges | Create\OS install package, Read\OS install package | Modify\OS install package, Read\OS install package | Delete\OS install package, Read\OS install package | Modify\OS install package, Read\OS install package, Distribute\OS install package, Read\Site
Task Sequences | Create\Task sequence package, Read\Task sequence package, Modify\Task sequence package | Modify\Task sequence package, Read\Task sequence package | Delete\Task sequence package, Read\Task sequence package | Modify\Task sequence package, Read\Task sequence package, Distribute\Task sequence package, Read\Site
Advertisement (for task sequence) | Read\Task sequence package, Read\Collection, Advertise\Collection, Read\Package, Create\Advertisement | Modify\Advertisement, Read\Advertisement | Delete\Advertisement, Read\Advertisement | Not applicable
Task sequence bootable media | Read\Task sequence package, Create Task sequence media\Task sequence package, Read\Site, Manage OSD and ISV Proxy Certificates\Site, Read\Boot image | Modify\Task sequence package, Read\Task sequence package | Delete\Task sequence package, Read\Task sequence package | Not applicable
Drivers | Create\Device driver, Read\Device driver | Modify\Device driver, Read\Device driver | Delete\Device driver, Read\Device driver | Not applicable
Driver package | Create\Driver package, Read\Device driver | Modify\Driver package, Read\Driver package, Distribute\Driver packages | Delete\Driver package, Read\Driver package | Not applicable
Note
If a task sequence requires a software distribution package or an OS image, Configuration Manager 2007 must have Read to the Package class, not just the instance of the package to be distributed.

Some actions might appear to work even if the user does not have sufficient rights. For example, even with no rights to create objects in the Boot image package class, a user can start the import process, but the wizard will fail due to insufficient rights.

Service Manager

In Configuration Manager 2007 Service Manager, you must have the Administer right on the primary site object to perform the following tasks:

  • Query a service
  • Stop a service
  • Start a service
  • Configure service logging

On a secondary site, you must be a member of the local Administrators group to perform these tasks.


Security Best Practices for Configuration Manager

The following sections contain information about the best practices recommended by Microsoft for running Microsoft System Center Configuration Manager 2007 in the most secure configuration possible.

In This Section

Best Practices for Security Fundamentals

Describes basic security practices such as least permission and how they apply to Configuration Manager 2007.

Best Practices for Hierarchy Security

Describes best practices to follow when using more than one Configuration Manager 2007 site in a hierarchy.

Best Practices for Service Continuity

Gives a brief overview of maintaining Configuration Manager 2007 data availability.

Best Practices for Securing Communications

Describes best practices to follow to help secure communication channels between site systems, including IPsec recommendations.

Best Practices for Securing Site Systems

Describes best practices to follow to help protect site system roles, including the site database server and Internet-based site systems.

Best Practices for Securing Clients

Describes best practices to follow to help protect Configuration Manager 2007 client computers.

Best Practices for Securing Internet-Based Clients

Describes best practices to follow to help protect Configuration Manager 2007 client computers that are not inside your corporate network.

Best Practices for Securing Name Resolution

Describes best practices to follow to help secure name resolution methods used by Configuration Manager 2007.

Best Practices for Certificate Management

Describes best practices to follow to help secure the aspects of your certificate infrastructure used by Configuration Manager 2007.

Best Practices for Maintaining Configuration Manager Security

Describes best practices to follow to help maintain Configuration Manager 2007 security.

See Also

Other Resources

Security and Privacy for Configuration Manager 2007


Best Practices for Security Fundamentals

The most serious risk from Microsoft System Center Configuration Manager 2007 is that its functionality could be hijacked by an unauthorized user who could then distribute software to all Configuration Manager 2007 clients. Because Configuration Manager 2007 has the ability to install software using administrative rights, an attacker could take control of every Configuration Manager 2007 client, both computers and devices. Configuration Manager 2007 also has the ability to retrieve any file from any client computer, which could have serious consequences to security and privacy, depending on the nature of the document.

In contrast, the nature of the data that Configuration Manager 2007 collects (hardware inventory, software inventory, metering, desired configurations) is not generally considered confidential. Similarly, the loss of Configuration Manager 2007 functionality for a short period of time due to a denial-of-service attack does not generally have a catastrophic impact, unlike, for example, e-mail, network communications, light, and power. The most serious impact from lack of availability usually comes from the inability to deploy new software updates in response to a zero-day exploit. Loss of Configuration Manager 2007 infrastructure could also impact the clients' ability to remediate if they are in restriction due to Network Access Protection evaluation, which could potentially restrict their access to the entire network.

Best Practices

Physically secure your computers There is no security without physical security. An attacker who gets physical access to a Configuration Manager 2007 site system could potentially use Configuration Manager 2007 to attack the entire client base. All potential physical attacks must be considered high risk and mitigated appropriately. The site server and all site systems must be stored in a secure server room with controlled access. Ideally, keep computers that run the Configuration Manager 2007 consoles in a locked room to protect them from unauthorized access. However, if this is not possible, for example, with a branch distribution point, secure these computers when administrators are not physically present by having the operating system lock the workstation, or by using a secured screen saver. To enforce the principle of least privilege, create policies to require Configuration Manager 2007 to log in to remote administration consoles using a low-rights user account, and then use Run As to start the Configuration Manager 2007 console.

It is more difficult to physically secure the Configuration Manager 2007 client computers because they usually must be accessible to end users. To mitigate the threat, restrict access to your business offices to authorized employees and guests. If you have client computers at high risk of compromise, store them in locked offices and use additional security measures like locked cases and antitheft cables. Configuration Manager 2007 clients can be mobile computers and devices. Educate users about good security practices, such as attaching a lock to laptop computers and applying passwords to devices. If a laptop or device is lost or stolen, have established procedures in your organization for preventing that computer from accessing the company network and immediately block the computer in the Configuration Manager 2007 console and, if you use native mode, revoke the client certificate..

Apply the most recent security updates to all computers You can use the Configuration Manager 2007 software update feature to deploy updates to Configuration Manager 2007 client computers. Stay informed about new updates for operating systems, Microsoft SQL Server, and Configuration Manager 2007 by subscribing to the Security Notification service (http://go.microsoft.com/fwlink/?LinkId=28819).

Protect against unauthorized administrators Configuration Manager 2007 has no defense against an authorized Configuration Manager 2007 administrator who uses Configuration Manager 2007 to attack the network. Unauthorized administrators are a high security risk. An unauthorized administrator could launch numerous attacks, including but not limited to the following:

  • Using software distribution to automatically install and run malicious software on every Configuration Manager 2007 client computer in the enterprise.
  • Configuring remote control to take remote control of a Configuration Manager 2007 client without client permission.
  • Configuring rapid polling intervals and extreme amounts of inventory to create denial-of-service attacks against the clients and servers.
  • Using one site in the hierarchy to write data to another site's Active Directory data.

You cannot remove all administrative access to the Configuration Manager 2007 console and the Configuration Manager 2007 site systems because Configuration Manager 2007 would become unusable. Audit all administrative activity and routinely review the audit logs. Require all Configuration Manager 2007 administrators to undergo a background check before hiring and periodic rechecks as a condition of employment. High-security jobs routinely involve enforced vacations because it can be easier to discover unauthorized administrative activity while the administrator is away.

Enforce role separation to limit administrative exposure Not all administrators need full administrative access to Configuration Manager 2007. Use collection security to limit the administrative scope to as few administrators as possible. Use role separation; for example, allowing one person to create package objects and a different person to distribute them so that no single person can use Configuration Manager 2007 to deploy malicious software. For more information about assigning rights to Configuration Manager 2007 objects, see Overview of Configuration Manager Object Security and WMI.

Consider designing your sites to limit administrative scope; for example, creating different sites or site hierarchies for clients and servers.

Important
The site hierarchy is the management boundary. After sites are joined together in a hierarchy, Configuration Manager 2007 design allows the parent site to send software packages, collections, and configurations to child sites, even if object permissions are not granted explicitly at the child site. Attack vectors exist that allow malicious administrators at child sites to control parent sites. To mitigate the risk, limit the number of sites in the hierarchy and carefully screen administrators of all sites in the hierarchy.

Design for defense in depth Because Configuration Manager 2007 can interact with so many systems, it is important to think about the layers of security in your network and how those layers will interact with Configuration Manager 2007. Security around the perimeter is important, but relying solely on perimeter security like firewalls increases your risk if the firewall is compromised. Designing networks to isolate less-secure clients from more-secure clients provides another layer of defense. Adding personal firewalls to client computers adds an additional layer. Running intrusion detection software and host-based intrusion detection software helps filter out suspicious activity. Running antivirus software is essential, and Configuration Manager 2007 might also be used to deploy and maintain the antivirus software. Educating users about computer security is a critical component of a network security strategy.

Create and maintain secure baselines for all systems A secure baseline is a detailed description of how to configure and administer a computer. It describes all relevant configuration settings for secure computing. Part of creating a secure baseline is using the most secure operating system possible. The more recent the operating system, the more likely it is to be designed with security in mind and the more likely it is to contain features to make it more secure. Keep the operating system and applications up-to-date by applying security updates as they become available. You can use the Configuration Manager 2007 software update feature to deploy software updates to Configuration Manager 2007 clients. Always use NTFS instead of FAT partitions so that you can set access controls. Audit for changes to your secure baseline. You can use the Configuration Manager 2007 desired configuration management feature to monitor for changes to the secure baseline.

Use strong passwords or pass phrases Always use strong passwords with 15 or more characters for all Configuration Manager 2007 accounts and Configuration Manager 2007 administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (http://go.microsoft.com/fwlink/?LinkId=30009). Configuration Manager 2007 automatically creates certain accounts and generates strong passwords for them.

Control access to exported files Configuration Manager 2007 gives you the ability to export several objects to text files, for example, task sequences, collections, packages, site settings, and reports, and then import them later. Implement access control procedures to ensure that all exported files are stored securely so that attackers cannot modify the contents prior to import or search for information in the file content.

Secure package source files Many Configuration Manager 2007 packages, for example, operating system deployment, software distribution, and software updates, require source files from a directory or shared folder, but Configuration Manager 2007 does not control the source location. Implement access control procedures to prevent attackers from tampering with the source files before they are processed into Configuration Manager 2007 packages.

See Also

Other Resources

Security Best Practices for Configuration Manager


Best Practices for Hierarchy Security

Security considerations might influence your need for and placement of Microsoft System Center Configuration Manager 2007 sites or site systems in the design of your hierarchy. Security considerations can be important when deploying clients. Incorporate security efforts as early as possible in your deployment plan so that your Configuration Manager 2007 implementation is functional and secure. If you have already deployed Configuration Manager 2007, revisit your design decisions and analyze them from a security perspective.

Best Practices

Isolate sites in high security environments When you join two or more sites together in a hierarchy, the parent site by design has the ability to modify any child or grand child site. However, any site could potentially be used to attack any other site in the hierarchy and could potentially gain control of parent, child, or sibling sites. Also, if you are publishing to Active Directory Domain Services, any site can potentially write to any other site's objects in the same forest, including sites that are not in the same hierarchy. The only way to prevent one site from writing to another site is to put the sites in separate forests.

Use the fewest sites possible Having a large number of sites represents a fairly low risk, but reducing the number of sites reduces the attack surface and should be considered when designing deployments. Reducing the number of sites for security must be weighed carefully against other design considerations, like bandwidth, performance, and client configuration. A single site is the most secure option because there is no need to do the following:

  • Transfer data between sites
  • Manage sender accounts between sites
  • Trust administrators at other sites

Performance enhancements in Configuration Manager 2007 allow a single site to support more clients, making it possible to consolidate sites that were divided for performance reasons. You might be able to replace smaller sites with protected distribution points and thus reduce the number of sites, if this is consistent with your other design goals.

Avoid having sites span forests Forests are the administrative boundary of Active Directory. Allowing a site to span a forest compromises this boundary by allowing administration from a different forest. The following site systems are supported if they are installed in a forest remote to the site server's forest, but it is not the security best practice.

  • Server locator point
  • Fallback status point
  • Distribution point, configured to support Internet-based clients
  • Management point, configured to support Internet-based clients
  • Software update point, configured to support Internet-based clients
  • For network access protection, if you must have a System Health Validator point in a remote forest because the Network Policy Server (NPS) is not in the same forest as the site server.
  • For operating system deployment, when using PXE service points
  • For Internet-based clients, if you must have site system roles installed in a perimeter network to support Internet-based clients.

It is supported to have a primary site in one forest and a child primary site in a remote forest. It is not supported to have a secondary site in a different forest than the parent site. It is supported to have clients in forests remote to the site server.

Require secure key exchange between all sites in the hierarchy Secure key exchange is enabled by default for new installations but not for upgrades. Any site in the hierarchy that is accepting unsecured key exchange could potentially replicate the unsecured site data throughout the hierarchy. Always require secure key exchange on all sites, including SMS 2003 sites in the hierarchy. For more information, see How to Manually Exchange Public Keys Between Sites.

In mixed mode, upgrade all clients to Configuration Manager 2007 and configure the site to contain only ConfigMgr 2007 clients While it is best to use native mode, which requires all clients to run Configuration Manager 2007, if you must use mixed mode you should still upgrade all clients in the hierarchy to Configuration Manager 2007. After all clients are upgraded, for every site in the hierarchy, you should enable the setting This site contains only ConfigMgr 2007 clients on the Site Mode tab of the site properties to prevent policies containing sensitive data being sent to any client.

Upgrade all sites to Configuration Manager 2007 If you have any SMS 2003 sites in the site hierarchy, Configuration Manager 2007 uses MD5 to hash data sent to the SMS 2003 sites.


Best Practices for Service Continuity

Security personnel are usually required to design for the confidentiality, integrity, and availability of computer systems. In order to keep the Configuration Manager 2007 hierarchy available, it is important to have a plan to provide service continuity and test it often.

Best Practices

Design a fault tolerant site An offline site is usually low risk unless there is an urgent need to deploy a critical update or a need to create Configuration Manager 2007 Network Access Protection policies to restrict network access. If the Configuration Manager 2007 site server is offline, it does not necessarily stop all Configuration Manager 2007 operations. For example, clients can still process existing advertisements if content is available on distribution points. Configuration Manager 2007 supports clustering the site database. You can also replicate the site database information, which is usually done for performance reasons, but would also allow a site system to access replicated data, even if the site database is offline.

Create a backup and recovery plan Recovering a failed Configuration Manager 2007 site is a complex task. For more information, see Maintaining Configuration Manager 2007.

Test your backup and recovery procedures Backup procedures are worthless unless they are periodically tested. Configuration Manager 2007 backup and recovery are complex procedures and should be routinely tested to ensure service continuity in the event of site failure.

Secure your backup media The Configuration Manager 2007 backup task makes copies of the registry, the file structure, and the Configuration Manager 2007 site database. Attackers who gain access to the backup media could gain valuable information about the network, such as IP addresses, Active Directory site names, and the state of all client computers. Attacks involving backup media are potentially as serious as physical attacks against servers. As with all backups, store Configuration Manager 2007 backup media in a secure location, consider encrypting the backup files, and institute a controlled procedure to check out and restore the media.

Use role separation to increase recoverability It is common in small sites for all roles to be installed on the site server. This increases the risk that if the site server is unavailable, all Configuration Manager 2007 functionality is disabled. If possible, configure a management point that is not on the site server to increase availability to the clients. Configure multiple reporting points and distribution points. You cannot create more than one default management point for the site, but you can use a computer with RAID, or other fault tolerant features. Alternately, you can keep a spare management point running, and configure it as the default if the first management point goes offline.

The following table describes the effect of various site systems being offline.

Site Server Site Database Management Point Distribution Point Result

Off

Online

Online

Online

No site administration will be possible, including creation of new advertisements.

The management point will collect client information and cache it until the site server is back online.

Existing advertisements will run and clients can find distribution points.

Online

Off

Online

Online

No site administration will be possible, including creation of new advertisements.

If the client already has a policy assignment with new policies and if the management point has cached the policy body, the client can make a policy body request and receive the policy body reply. No new policy assignment requests can be serviced.

Clients will be able to run programs only if they have already been detected and the associated source files are already cached locally at the client.

Online

Online

Off

Online

Although new advertisements can be created, the clients will not receive them until a management point is online again.

Clients will still collect inventory, software metering, and status information and store them locally until the management point is available.

Clients will be able to run programs only if they have already been detected and the associated source files are already cached locally at the client.

Online

Online

Online

Off

Clients will be able to run advertisements only if the associated source files have already been downloaded locally.

See Also

Other Resources

Maintaining Configuration Manager 2007
Security Best Practices for Configuration Manager


Best Practices for Securing Communications

Microsoft System Center Configuration Manager 2007 activity is never confined to a single computer. Examples include the following:

  • Clients communicate with management points.
  • The site server communicates with all site systems, which can be installed on remote computers.
  • All domain members communicate with the domain controllers for authentication and authorization.
  • Site hierarchies can be installed spanning wide area network (WAN)links with firewalls and virtual private networks (VPNs).

If you fail to secure Configuration Manager 2007 communications between sites, clients could be hijacked by unauthorized servers, high-rights credentials could be exposed, or bogus data could be inserted into Configuration Manager 2007 site database.

Best Practices

Use native mode Native mode automatically provides mutual authentication and encryption for most communication between Configuration Manager 2007 clients and servers.

Require Secure Key Exchange By default, Require secure key exchange is enabled for new installations; the existing key exchange setting is preserved on upgrade but you should enable it, even if you have only one site in your hierarchy, to reduce the risk of an attacker sending a bogus site control file. If you have extended your Active Directory schema and configured publishing, Configuration Manager 2007 exchanges the keys through Active Directory, which helps secure the key exchange process. If you have not extended your Active Directory schema or if you have not properly configured publishing, the administrator must exchange the keys through the manual process. For more information, see How to Require Secure Key Exchange Between Sites.

Consider using nondefault port numbers for client communication Using nondefault ports for protocols such as HTTP and HTTPS might slow down an attacker. For example, many organizations block TCP port 80 and use a different HTTP port. You configure ports on a site-by-site basis. However, if you do not configure the same ports throughout the hierarchy, the Configuration Manager 2007 clients can experience problems when roaming. For more information, see How to Configure Request Ports for the Configuration Manager Client.

If clients cannot query Active Directory, manage the trusted root key provisioning process If clients cannot query the Global Catalog, either because Active Directory publishing is not enabled or because clients are workgroup or remote forest clients, they must rely on the trusted root key to authenticate valid management points. The trusted root key is stored in the client registry and can be set using Group Policy or configured manually. If the client does not have a copy of the trusted root key before contacting the management point for the first time, it trusts the first management point it communicates with. To reduce the risk of an attacker misdirecting clients to an unauthorized management point, you can preprovision the clients with the trusted root key. For more information, see How to Pre-provision the Trusted Root Key on Clients.

Use IPsec to secure communications between site systems While Configuration Manager 2007 native mode protects the communication channel between the Configuration Manager 2007 clients and the Configuration Manager 2007 site systems, Configuration Manager 2007 does not protect the communication channel between any site systems, whether in the same site or a different site, whether in the internal network or the perimeter network, regardless of the site mode. You should implement IPsec between all site systems to encrypt and authenticate their communications. For more information, see Implementing IPsec in Configuration Manager 2007. If you cannot enable IPsec, you should at least enable SMB signing between all site systems.

Configure your firewalls to permit required configuration manager traffic Security best practice dictates that you deny all ports in your firewall, except those explicitly configured. Configuration Manager 2007 is a complicated product requiring many ports for proper communication. Port usage can vary depending on configuration choices, such as using native mode or mixed mode. For more information, see Ports Used by Configuration Manager.

Secure the communication channel between the site server and package source server Configuration Manager 2007 does not secure the communication channel between the site server computer and the computer that stores sources files used to create packaging. Use IPsec to secure the SMB channel that Configuration Manager 2007 uses when retrieving package source files to help prevent attackers from tampering with the files.

Secure the communication channel between the Setup media and the site server If you run Setup from a network location, make sure you use IPsec between the source location of the Setup files and the site server to help prevent an attacker from tampering with the files.

See Also

Other Resources

Security Best Practices for Configuration Manager


Best Practices for Securing Site Systems

Topic last updated—November 2007

Microsoft System Center Configuration Manager 2007 uses a variety of site systems with specialized functions. Configuration Manager 2007 clients interact with management points. Management points interact with the site server and the Configuration Manager 2007 site database server. Clients might need a server locator point to find a management point. Additionally, the features you chose to implement might require additional site system roles, including site system roles in the perimeter network to support Internet-based client management. This variety of site systems unavoidably increases the attack surface of Configuration Manager 2007 across the enterprise. Failure to secure site servers, management points, and site database servers could allow an attacker to spoof site systems and distribute unauthorized software to clients. Improperly secured site systems could also lead to a compromise of the site server. To mitigate these threats, each site system must be as secure as possible.

Best Practices for All Site Systems

Use role separation on site systems It is possible to install all of the site system roles on a single computer, but this practice is usually not advisable because it creates a single point of failure. However, there are a few exceptions to the concept of role separation. It is usually preferable to install a dedicated version of SQL Server on the same computer as the site server and use that as the site database server. This configuration allows Configuration Manager 2007 the greatest control of the database configuration and simplifies the security configuration for SQL Server.

Reduce the attack profile Isolating each site server role on a different server reduces the chance that an attack against vulnerabilities in one site system can be used against a different site system. Many site system roles require the installation of Internet Information Services (IIS) on the site system. For more information, see Prerequisites for Installing Configuration Manager. Installing IIS increases the attack surface. If you must combine site system roles to reduce hardware expenditures, combine roles requiring IIS only with other roles requiring IIS.

Important
The exception to the suggestion to combine site system roles requiring IIS is the fallback status point. The fallback status point role should never be assigned to any other Configuration Manager 2007 site system role because it accepts unauthenticated data from clients, even in native mode.

Run the Security Configuration Wizard on all site systems The Security Configuration Wizard (SCW) helps you create a security policy that you can apply to any server on your network. After installing the Configuration Manager 2007 template, SCW recognizes Configuration Manager 2007 server roles, services, ports, and applications and permits necessary traffic while blocking communications determined to be unnecessary. The Configuration Manager 2007 template for SCW is scheduled to ship in the Configuration Manager 2007 Toolkit (http://go.microsoft.com/fwlink/?LinkId=93071).

Use NTFS for all site systems While some site systems allow the use of FAT32 partitions, you should always use NTFS to allow file level access control.

Do not remove the admin$ share on site systems The Admin$ share on site systems is required by Configuration Manager 2007 and should not be disabled or removed. The Configuration Manager 2007 site server uses the Admin$ share to connect to and perform service operations on site systems.

Closely monitor Internet-based site settings on site systems The Configuration Manager 2007 console does not prevent you from configuring a site role to support Internet-based clients, even though it is not supported as an Internet-based site role. For example, after a branch distribution point is created, you could configure the site system properties for that role to use an Internet FQDN and to allow Internet connections, even though branch distribution points are not allowed to support Internet-based clients. Periodically monitor the Internet configurations of your site systems.

Configure static IP addresses for site systems Static IP addresses aid in configuring IPSec between site systems, which is a recommended best practice. Static IP addresses are easier to protect from name resolution attacks.

Use FQDN server names Even though FQDN server names are required only in certain scenarios, such as when supporting Internet-based client management or using IPv6, you should configure FQDN server names for all site systems because the FQDN configuration uses DNS instead of WINS for name resolution, and DNS can be more securely managed than WINS. For more information, see Determine If You Will Use FQDN Server Names.

Do not install other services that use the Local System account Minimize the use of the Local System account on the site servers and site systems by not installing other services that use the Local System account. This ensures that other processes cannot take advantage of the enhanced privileges of the system’s computer account, accessing Configuration Manager 2007 files and data through those other systems. Configure SQL Server to run under a domain user account instead of Local System.

Note
IIS requires Local System, but you cannot avoid installing IIS on site systems because many site system roles require it. To reduce the risk of an attacker compromising IIS and then using Local System to compromise Configuration Manager 2007 servers, do not run non-Configuration Manager 2007 Web applications and use role separation for site system roles requiring IIS, as described later in this section.

Best Practices for Site Server

Install Configuration Manager 2007 on a member server instead of a domain controller The Configuration Manager 2007 site server and site systems do not require installation on a domain controller. Domain controllers do not have a local Security Accounts Management (SAM) database other than the domain database. Installing Configuration Manager 2007 on a member server allows you to maintain Configuration Manager 2007 accounts in the local SAM database instead of in the domain database. It also lowers the attack surface on your domain controllers.

Install secondary sites at the secondary site server instead of using push installation It is theoretically possible for an attacker to hijack the secondary site installation package and tamper with the files prior to installation, although timing this attack would be difficult. An attack can be mitigated by using IPSec to mutually authenticate the primary and secondary site server before transferring the files. Also, if you use push installation, the primary site’s computer account must be a member of the local Administrators group of the secondary site server, which is excessive privilege for normal operations.

Best Practices for SQL Server

Configuration Manager 2007 uses SQL Server as the back-end database. If the database is compromised, attackers could bypass the Configuration Manager 2007 console and access SQL Server directly to launch attacks through Configuration Manager 2007. Attacks against the SQL Server must be considered very high risk and mitigated appropriately.

Use a dedicated SQL Server for each site Although multiple sites can share a single computer running SQL Server to store data, this is not a recommended configuration. If one Configuration Manager 2007 site database is compromised on one SQL Server, the attacker has easier access to another Configuration Manager 2007 site database on the same SQL Server. Sharing a SQL Server between sites can make it more difficult to recover your site, which could delay Configuration Manager 2007 from functioning at a critical time. If a site was sharing a SQL Server with another site and it failed, you must ensure that the recovery process of the failed site does not affect the other healthy sites. The recovery process becomes more complicated in this situation because you must isolate the recovery procedures to only the failed site.

Do not use the Configuration Manager site database server to run other SQL Server applications Increasing access to the Configuration Manager 2007 site database server increases the risk to your Configuration Manager 2007 data. Also, if the Configuration Manager 2007 site database is compromised, other applications on the same SQL Server computer are at risk.

Configure SQL Server to use Windows authentication Configuration Manager 2007 will always access the site database using a Windows account and Windows authentication, but it is still possible to configure SQL Server to use SQL Server mixed mode. SQL Server mixed mode allows for configuring additional SQL logins to access the database, which is not required and increases the attack surface.

Install Configuration Manager and SQL Server on the same computer Installing SQL Server and Configuration Manager 2007 on the same computer might seem to violate the idea of role separation to increase availability, but it is not a significant security concern. If either the Configuration Manager 2007 site database or the site server go offline, the other server is virtually useless. Installing Configuration Manager 2007 and SQL Server on the same computer simplifies SQL Server configuration and thus reduces the risk of making security-related mistakes.

Follow security best practices for SQL Server Follow the best practices for SQL Server 2005 http://go.microsoft.com/fwlink/?LinkId=95071, with the following additional considerations:

  • The site server computer account must be a member of the Administrators group on the computer running SQL Server. If you follow the recommendation "Provision admin principals explicitly," the account used to run Setup on the site server must be a member of the SQL Users group.
  • If you install SQL Server using a domain user account, you must ensure that a Service Principal Name (SPN) is populated to Active Directory Domain Services or Kerberos authentication will fail and Configuration Manager 2007 Setup will fail. For more information, see How to Configure an SPN for SQL Server Site Database Servers.

Best Practices for Site Systems Requiring IIS

Several server roles require IIS. Securing IIS properly allows Configuration Manager 2007 to function while reducing risk. Where practical, minimize the use of servers requiring IIS. For example, consolidate management points into the smallest number possible. Use only a single server locator point for your environment.

Disable IIS functions that you do not require Install only the minimum IIS features for the server role you are supporting. For more information, see Prerequisites for Installing Configuration Manager.

Do not put the site server on a computer with IIS Role separation helps reduce the attack profile and improve recoverability. Also, the site server’s computer account usually has administrative privileges on all site system roles (and possibly on Configuration Manager 2007 clients, if using Client Push Installation). IIS and Configuration Manager 2007 both run by using the Local System account, so an attacker who can compromise IIS running on the site server could gain Local System access to all Configuration Manager 2007 functions.

Use dedicated IIS servers for Configuration Manager While it is possible to host multiple Web-based applications on the IIS servers used by Configuration Manager 2007, this can significantly increase your attack surface. A poorly configured application could allow an attacker to gain control of the co-located site systems, which could allow an attacker to gain control of the entire site. If you must run other Web-based applications on Configuration Manager 2007 site systems, you should always create a custom Web site for Configuration Manager 2007 site systems. For more information, see How to Configure Custom Web Sites for Configuration Manager Sites.

Best Practices for Management Points

In a single site hierarchy that requires trusted root key authentication, always use a separate management point If the Active Directory schema has not been extended and if Configuration Manager 2007 does not have permissions to publish to Active Directory Domain Services, Configuration Manager 2007 clients use the trusted root key to authenticate management points before communicating. The trusted root key at the central site server is used to sign the certificate of the management point. If the central site has to be recovered, clients will continue to trust the management points until a new trusted root key is generated at the rebuilt central site server. Also, if a management point has to be recovered, clients will trust the new management point as soon as the management point certificates are signed by the trusted root key. However, if clients are reporting to a central site server that also functions as the management point for the site, and that computer is recovered, clients will not trust that management point until you delete the current trusted root key on the clients and reprovision them with the new trusted root key. To avoid this situation, extend the Active Directory schema and enable publishing for the site. If this is not possible, do not assign the management point role to the central site server if there are clients reporting to the central site. For more information about the trusted root key, see About the Trusted Root Key.

If this site system role is configured in a perimeter network, configure the site server to retrieve the data from the site system By default, site systems push their data back to the site server. A site system can be configured to require the site server to pull the data instead, which allows great control of the ports and permissions required for the data transfer. The setting Allow only site server initiated data transfers from this site system applies to the entire site system and all site system roles configured on it.

Use the fewest management points possible Having a management point at every primary site does not constitute a high security risk, but reducing the number of management points does reduce the attack surface. Management points require IIS. To reduce the attack surface of their networks, some companies have policies about reducing the number of IIS servers. If this is a strong concern for you, it is possible to install the fewest management points possible by assigning all clients to a single site and treating them as roaming clients at their resident site.

Best Practices for Fallback Status Point

Do not co-locate any other site system roles with the fallback status point The fallback status point is designed to accept unauthenticated communication from any computer. Co-locating the fallback status point with any other site role greatly increases the risk to that site role.

Do not install the fallback status point on a domain controller

In native mode, deploy the fallback status point prior to deploying clients A native mode site without a fallback status point could cause a situation where you are unaware that high numbers of clients are unmanaged because of PKI-related certificate issues. For example, if there is a problem with a native mode client certificate, the native mode management point will refuse all communication with the client, and the client will be unmanaged. However, if the client is assigned to a fallback status point, it will successfully report its native mode communication failure with the fallback status point because the fallback status point does not use PKI certificates. Fallback status points are beneficial in both native and mixed modes, but high numbers of mixed mode clients are less likely to be unmanaged because they do not have a dependency on PKI certificates that are managed externally to Configuration Manager.

Avoid using the fallback status point in the perimeter network By design, the fallback status point accepts data from any client. Placing the fallback status point in the perimeter network could aid in troubleshooting Internet-based clients, but you must balance the troubleshooting benefits with the risk of having a site system accepting unauthenticated data in a publicly accessible network. If you must place the fallback status point in the perimeter network or any untrusted network, configure the site server to pull data from the site system instead of allowing the fallback status point to connect to the site server and initiate data transfers. To configure the site server to pull data, set Allow only site server initiated data transfers from this site system on the properties of the site system.

Best Practice for Server Locator Point

Do not put a server locator point in the perimeter network If you need to have client computers in the perimeter network locate Configuration Manager 2007 resources, manually configure those clients with the name of their server locator point.

Additional Resources for Security-Related Best Practices

For information about securing the Configuration Manager 2007 console computers, see Configuration Manager Console Security Best Practices and Privacy Information

For information about securing distribution points and branch distribution points, see Software Distribution Security Best Practices and Privacy Information.

For information about securing the PXE service point and state migration point, which are used for operating system deployment, see Operating System Deployment Security Best Practices and Privacy Information.

For information about securing reporting points, see Reporting Security Best Practices.

See Also

Other Resources

Security Best Practices for Configuration Manager


Best Practices for Securing Internet-Based Clients

Microsoft System Center Configuration Manager 2007 allows you to manage clients that do not connect into your internal network with dial-up or VPN technology. While managing these clients can help make them more secure, you must configure your Configuration Manager 2007 infrastructure in such a way as to expose some of your site systems to Internet communications. You must use Configuration Manager 2007 native mode if you plan to support Internet-based clients because it helps mitigate some of the risk of being exposed to the Internet.

Use SSL bridging to SSL, using termination with authentication The benefit of SSL termination at the proxy Web server is that packets from the Internet are subject to inspection before they are forwarded to the internal network. The proxy Web server authenticates the connection from the client, terminates it, and then opens a new authenticated connection to the Internet-based site systems. When Configuration Manager clients use a proxy Web server, the client identity (client GUID) is securely contained within the packet payload so that the management point does not consider the proxy Web server to be the client. If your proxy Web server cannot support the requirements for SSL bridging, SSL tunneling is also supported. This is a less secure option because the SSL packets from the Internet are forwarded to the site systems without termination, so they cannot be inspected for malicious content.

Use Active Directory to deploy the site server signing certificate There are three options for the client to receive the site server signing certificate: being installed with it using the SMSSIGNCERT parameter, querying Active Directory Domain Services, or automatically obtaining it from the management point. Of the three solutions, automatically deploying it with the management point is the least secure solution and should not be used if you have any doubts about the security of your management point. For example, a management point that resides in a perimeter network to accept connections from the Internet for Internet-based client management is considered less secure than a management point within your intranet that accepts only connections from intranet clients. However, automatically deploying a copy of the site server signing certificate through the management point might be an appropriate solution if the management point accepts only connections from intranet clients and you do not want the administrative overhead of manual deployment. For more information, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode).

Do not create distribution point shares or branch distribution points on Internet-based clients While the Configuration Manager 2007 might not block you from doing so, creating any type of distribution point on an Internet-based client greatly increases your attack surface and should be avoided. Create distribution points only on site systems that can be managed within the intranet or the perimeter network.

Do not use site systems that bridge the perimeter network and intranet While it is possible to configure your server placement for Internet-based clients such that all necessary site systems are multi-homed and connected to both the perimeter network and the intranet, this configuration is not recommended because there is no security boundary between the perimeter network and the intranet. There are several other options available that are more secure than bridging the perimeter boundary. For more information, see Determine Server Placement for Internet-Based Client Management.

Privacy Information

When you deploy the Configuration Manager 2007 client, you enable client agents so you can use Configuration Manager 2007 features. The settings you use to configure the features apply to all clients in the site, including clients connected to the Internet that never attach directly to the organization network. For example, you could configure inventory for the site, which would also inventory an Internet-based home office computer that belongs to an employee. Client information is stored in the database and is not sent back to Microsoft. Before configuring the Configuration Manager 2007 client, consider your privacy requirements.

See Also

Concepts

Overview of Internet-Based Client Management

Other Resources

Security Best Practices for Configuration Manager


Best Practices for Securing Name Resolution

Microsoft System Center Configuration Manager 2007 relies on name resolution to locate Configuration Manager 2007 services. For more information about service location, see Configuration Manager and Service Location (Site Information and Management Points).

Do not rely on WINS for name resolution WINS is not considered a secure method of name resolution because there are no mitigations to prevent attackers from modifying the WINS database, spoofing WINS traffic on the network, or reading the WINS data as it traverses the network. Extend the Active Directory schema for Configuration Manager 2007 to provide more secure lookup for Configuration Manager 2007 services and site systems, and use Active Directory-integrated Domain Name Service (DNS) to provide more secure name resolution.

Specify FQDNs for all site systems and senders If you specify only a short name when configuring site systems and sender addresses, either NetBIOS or host name, Configuration Manager 2007 will attempt to locate the resource using the DNS search suffixes and using NetBIOS name resolution. Specifying the fully qualified domain name (FQDN) reduces the likelihood that an attacker can impersonate the destination site server by spoofing the name or using a WINS attack. For more information, see Determine If You Will Use FQDN Server Names.

See Also

Concepts

Configuration Manager and Service Location (Site Information and Management Points)

Other Resources

Security Best Practices for Configuration Manager


Best Practices for Certificate Management

Topic last updated—November 2007

If you use Microsoft System Center Configuration Manager 2007 native mode, you are using certificates created by a PKI. You might also be using PKI certificates if you are using mobile devices or managing custom software updates.

Carefully plan for and secure your PKI If you have an existing PKI, Configuration Manager 2007 should be able to use certificates issued by it. However, if you do not have an existing PKI and you want to implement a PKI to support Configuration Manager 2007, you must plan your PKI implementation very carefully. For example, failure to adequately plan for a secure root CA in your PKI hierarchy could compromise every certificate issued by your CA. Also, designing a PKI to support one application without considering possible future PKI requirements could force you to tear down and redeploy your PKI, which could compromise Configuration Manager 2007 security and availability. For information about planning for and securing your PKI, consult the documentation from your PKI vendor.

Follow industry and organizational best practices for certificate management Configuration Manager 2007 does not have specific requirements for certificate management. For example, Configuration Manager 2007 does not recommend a minimum key length, maximum certificate expiration date, or issuance policy.

Enable CRL checking on native mode clients Certificates can be revoked by a certification authority administrator—for example, if an issued certificate is known or suspected to be compromised. Enabling Certificate Revocation Checking (CRL) on clients is more secure, although it introduces additional performance and administrative overhead. For more information, see Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)

Note
CRL checking is enabled by default in IIS, so no additional action is required for Configuration Manager 2007 site systems in native mode.

Protect the integrity of your client authentication certificates Configuration Manager 2007 can use client authentication certificates from any certification store. If the permissions on the certification store allow access to a low-rights user, that low-rights user could use the certificate to access Configuration Manager 2007 policy and obtain credential information for the Network Access account and the Task Sequence Editor Domain Joining Account. The low-rights user could also tamper with the state, status, and inventory information sent by that client computer.

Use a certificate trust list to define the trusted root certification authorities A certificate trust list (CTL) is a defined list of trusted root certification authorities. By default, the Windows operating systems are configured to trust some well-known certification authority certificates, such as VeriSign and Thawte, because the certification authority certificates are preinstalled in the operating system. If you do not explicitly define the CTL, all clients that have client authentication certificates issued by these preinstalled certification authorities are accepted as valid Configuration Manager clients. If you configure the CTL, only the trusted root certification authorities specified in the CTL will be trusted by Configuration Manager. For more information, see Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode).

Use Active Directory Domain Services to deploy the site server signing certificate For the client to receive the site server signing certificate, the following options are available:

  • Being installed with it by using the SMSSIGNCERT parameter
  • Querying Active Directory Domain Services
  • Automatically obtaining it from the management point

Automatically deploying the certificate with the management point is the least secure solution and should not be used if you have any doubts about the security of your management point. For example, a management point that resides in a perimeter network to accept connections from the Internet for Internet-based client management is considered less secure than a management point within your intranet that accepts only connections from intranet clients. However, automatically deploying a copy of the site server signing certificate through the management point might be an appropriate solution if the management point accepts only connections from intranet clients and you do not want the administrative overhead of manual deployment. For more information, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode).

Guard the security of the site server signing certificate If the site server signing certificate is compromised, all policy in the hierarchy is suspect. Even in native mode, attackers could create the policy of their choice and have it run with high rights on all Configuration Manager 2007 clients. Verify that the site server signing certificate is securely backed up. Follow PKI security best practices for managing critical certificates. For example, consider the appropriate issuance policy for your environment and create a plan for securely deploying the certificate.

Use a new key pair when renewing the site server signing certificate Keeping the original key pair reduces administrative overhead and does not disrupt Configuration Manager 2007 site functions, but it allows attackers more time to attempt to decrypt the keys. If the new site server signing certificate chains to the same trusted root authority as the previous site server signing certificate, Configuration Manager 2007 clients will automatically download a copy of the new site server signing certificate from either Active Directory Domain Services or from the management point. They then validate their policy signed by the new site server signing certificate and continue to function. This might delay clients from receiving new policies, especially if large numbers of clients need to retrieve the new certificate. For more information, see Renewing or Changing the Site Server Signing Certificate.

Note
When the site server signing certificate is due to expire in 10 days time, Configuration Manager 2007 sends status message 5112 one time per day. You can create a status filter rule to trigger an action when you receive 5112. For example, you might configure a status filter rule to send a text message notifying you that the certificate is about to expire.

Verify that all certificates are stored in secure certificate stores By default, Configuration Manager 2007 looks for its client authentication certificates in the local computer Personal store, which is restricted to administrator access. However, it is possible to use client certificates from any computer certificate store. Failure to adequately secure the store where the client authentication certificate is stored could allow a low-rights user to gain control of the certificate.

See Also

Other Resources

Security Best Practices for Configuration Manager


Best Practices for Maintaining Configuration Manager Security

Securing your Microsoft System Center Configuration Manager 2007 environment is not a task you can complete once and forget about. Every day, new attacks are being developed to exploit newly discovered vulnerabilities. A merger or new product line might completely change your organization’s tolerance for security risk. Periodically review every aspect of your Configuration Manager 2007 security implementation, including design, implementation, policies, and maintenance.

Best Practices

Create security policies and adhere to them Documented policies and procedures are beneficial for any system, and should be implemented for Configuration Manager 2007 security. Security policies are statements about standards and behavior. Security procedures are detailed instructions of how each organization implements the security policies. For example, your security policy might state when it is acceptable to use Remote Tools. Your security procedures would include the steps for verifying that remote tool status messages are being collected, how frequently the reports should be reviewed, and what to do if a violation is suspected. In order to be effective, policies must be reviewed periodically and revised as needed.

For more information about policies and procedures, see http://go.microsoft.com/fwlink/?LinkId=50941 in the TechNet Security Center.

Use a test lab to test future change configurations for security concerns Do not install Configuration Manager 2007 on any of your production servers before you install it and work with it in your test lab. Installing Configuration Manager 2007 in a production environment without first testing it on an isolated network can cause undesirable and potentially damaging results. Before introducing new security measures in your production environment, test them in your lab. Verify that you can implement the security procedures without introducing new vulnerabilities in your network. Verify that the new measures do not interfere with mission critical business activity. For example, implementing IPsec is an important security measure for data transmission security, but implementing it incorrectly could totally stop all network communications.

Secure your test lab Test labs require as much security as the production environment. Unsecured test labs could allow attackers to study vulnerabilities that could be reproduced in the production environment. Often password security is lax in a lab environment. Passwords might be taped to lab computers or changed very infrequently so as not to interfere with testing. An attacker might gain access to the scripts and packages that are developed in the lab and introduce vulnerabilities that could be exploited in production.

Physically secure the lab environment. Enforce the same password standards for the lab as you do for your production environment. Audit the lab environment for signs of intrusion.

Test your backup and recovery procedures Backup procedures are worthless unless they are periodically tested. Configuration Manager 2007 backup and recovery are complex procedures and should be routinely tested. For more information about developing and implementing your backup and recovery procedures, see Overview of Backup and Recovery.

Secure your backup media The Configuration Manager 2007 backup task makes copies of the registry, the file structure, and the Configuration Manager 2007 site database. Attackers who gain access to the backup media could gain valuable information about the network, such as IP addresses, Active Directory site names, and the state of all client computers. Attacks involving backup media are potentially as serious as physical attacks against servers. As with all backups, store Configuration Manager 2007 backup media in a secure location, consider encrypting the back up files, and institute a controlled procedure to check out and restore the media.

Review Configuration Manager settings Good change and configuration management facilitates good security. Ideally no change should happen in production without proper planning, testing, authorization, and change tracking. Even if you have the best possible change controls, you should still periodically review your Configuration Manager 2007 configuration to verify that there have not been any unauthorized changes. Use desired configuration management to monitor for changes to authorized baseline configurations.

Note
When you decommission site systems and user accounts, verify that all corresponding rights and permissions are also removed.

Review audit logs You can monitor operating system security by using the auditing facility of the operating system. After you have enabled security auditing, watch the security event log for Configuration Manager 2007 -related events. Check closely for any failures that involve Configuration Manager 2007 accounts or resources. Windows event logs can get full, and by default, new items will start to overwrite older items. To diagnose problems, and for other reasons, it might be necessary to refer to an older event log. It is recommended that you back up Windows event logs, and store the backups in a safe and accessible location. If necessary, increase default log file size to accommodate larger amounts of data.

Monitor Configuration Manager operations Watch Configuration Manager 2007 operational activities to ensure that only authorized activities are occurring. For example, watch for the creation of large or suspicious collections, the creation of advertisements, the addition of links from large collections to collections that are being advertised to, or package updates.

The Configuration Manager 2007 status subsystem provides audit events to watch for such activities. All audit events are maintained for 180 days by default. Other server status messages are kept for 30 days by default. Configuration Manager 2007 provides several default status message queries that you can use to audit for security-related activity. The following is a partial list of status message queries that you might find useful when monitoring for unauthorized activity:

  • Security rights created, modified, or deleted
  • Advertisements created, modified, or deleted
  • Packages created, modified, or deleted
  • Programs created, modified, or deleted
  • Clients that (failed to run) (failed to start) a specific advertised program
  • Server component configuration changes
  • Client component configuration changes
  • Remote tools activity (all)
  • Site addresses created, modified or deleted
  • Site boundaries created, modified or deleted
  • SQL commands created, modified or deleted
  • SQL tasks created, modified, or deleted
  • All audit status messages (for a specific user) (from a specific site)

Periodically test Configuration Manager security Test Configuration Manager 2007 security when you are putting it in place and test it periodically thereafter. Try to access all types of Configuration Manager 2007 resources using accounts you have created and delegated tasks to in order to verify that Configuration Manager 2007 objects and data are protected. Attempt to access resources using unauthorized accounts.

Develop an incident response plan Designing an incident response plan could be as crude as “unplug affected computers from the network, reformat, and reinstall” or it might be a sophisticated endeavor with trained forensics experts who know precise techniques for gathering evidence that can be used in prosecution. Decide what your appropriate level of response is and practice your plan periodically. For more information about disaster recovery and incident response, see "Disaster Recovery and Incident Response" (http://go.microsoft.com/fwlink/?LinkId=28825) on the Microsoft TechNet site.

Secure your internal Configuration Manager documentation Your network documentation can provide everything someone needs to know to implement a successful attack. Even your list of internal Configuration Manager 2007 contacts could be used in a social engineering attack. Store your Configuration Manager 2007 documentation in a secure location. Dispose of Configuration Manager 2007 documentation in a shredder or by using a secure document removal service. If you keep backup copies of Configuration Manager 2007 documentation for disaster recovery, secure the backup copies.

Train your organization to follow security best practices Develop a comprehensive user education program for your end users to train them that security is everybody’s responsibility. Train your network administrators on proper security procedures and enforce strict adherence to security policy. Configuration Manager 2007 administrators who do not lock their Configuration Manager 2007 consoles are inviting attacks from disgruntled employees. Receptionists who are trying to be helpful can inadvertently give attackers everything they need to compromise valuable trade secrets.

Privacy Information

Backup media contains all of your site information, including sensitive information such as computer names and IP addresses collected by Configuration Manager 2007 features. You should protect the personally identifiable information in backup files in accordance with your local privacy regulations.


Security Best Practices and Privacy Information for Configuration Manager Features

Topic Last Updated—August 2008

Each feature in Microsoft System Center Configuration Manager 2007 has different security issues and privacy information. Before deploying any features in Configuration Manager 2007, consider the security and privacy implications of that feature. This content is repeated within each feature section as applicable.

In This Section

Configuration Manager Console Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to the Configuration Manager 2007 console.

Software Distribution Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 software distribution.

Software Updates Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 software updates.

Operating System Deployment Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 operating system deployment.

Asset Intelligence Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices that relate to Configuration Manager 2007 SP1 Asset Intelligence.

Software Metering Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 software metering.

Reporting Security Best Practices

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 reporting.

Desired Configuration Management Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 desired configuration management.

Mobile Device Clients Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 mobile device clients.

Network Access Protection Security Best Practices

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 Network Access Protection (NAP).

Discovery Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 discovery.

Inventory Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 inventory.

Remote Tools Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 remote tools.

Wake On LAN Security Best Practices

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 Wake On LAN.

Application Compatibility Toolkit Connector Privacy Information

Describes the security issues, privacy information, and security best practices relating to Configuration Manager 2007 Application Compatibility Toolkit Connector.

Out of Band Management Security Best Practices and Privacy Information

Describes the security issues, privacy information, and security best practices that relate to Configuration Manager 2007 SP1 out of band management.

See Also

Other Resources

Security and Privacy for Configuration Manager 2007


Accounts and Groups in Configuration Manager

Microsoft System Center Configuration Manager 2007 uses many accounts, groups, and SQL Server database roles to perform management functions on the site server, site systems, site database server, and client computers. Configuration Manager 2007 can perform many management functions using the Local System account, which simplifies management because the operating system manages the account and password. Some functions, however, require an actual user account, group, or database role. The following section describes all of the accounts used by Configuration Manager 2007, their required permissions, and the account creation and maintenance, along with any recommended best practices for using the account.

In This Section

Accounts Configured in the Configuration Manager Console

Describes accounts created in either the local or Active Directory Domain Services database and configured in the Configuration Manager console.

About the Client Status Reporting Service Account

Describes the account configured on the client status reporting host system for Configuration Manager 2007 R2

About the Database Roles for Configuration Manager

Describes database roles created in the SQL Server database and used to manage access to Configuration Manager database resources.

About the Proxy Account for Internet-Based Clients

Describes the account configured on the Configuration Manager client computers in the Control Panel.

Configuration Manager Groups

Describes groups created in either the local or Active Directory Domain Services database and used by Configuration Manager.

Windows Accounts Used by Configuration Manager

Describes accounts used by Configuration Manager but not actually configured in the Configuration Manager console.


Accounts Configured in the Configuration Manager Console

Many accounts are configured in the Microsoft System Center Configuration Manager 2007 console to perform Configuration Manager 2007 functions.

In This Section

About the AMT Provisioning and Discovery Account

Describes the function, creation, maintenance, and security best practices for the AMT Provisioning and Discovery Account.

About the AMT Remote Admin Account

Describes the function, creation, maintenance, and security best practices for the AMT Remote Admin Account.

About the AMT User Accounts

Describes the function, creation, maintenance, and security best practices for the AMT User Accounts.

About the Capture Operating System Image Account

Describes the function, creation, maintenance, and security best practices for the Capture Operating System Image account.

About the Client Push Installation Account

Describes the function, creation, maintenance, and security best practices for the Client Push Installation account.

About the Health State Reference Publishing account

Describes the function, creation, maintenance, and security best practices for the Health State Reference Publishing account.

About the Health State Reference Querying account

Describes the function, creation, maintenance, and security best practices for the Health State Reference Querying account.

About the Management Point Database Connection Account

Describes the function, creation, maintenance, and security best practices for the Management Point Database Connection account.

About the MEBx Account

Describes the function, creation, maintenance, and security best practices for the MEBx Account.

About the Multicast Service Point Connection Account

Describes the function, creation, maintenance, and security best practices for the Multicast Database Connection account.

About the Network Access Account

Describes the function, creation, maintenance, and security best practices for the Network Access account.

About the Package Access Account

Describes the function, creation, maintenance, and security best practices for the Package Access account.

About the PXE Service Point Database Connection Account

Describes the function, creation, maintenance, and security best practices for the PXE Service Point Database Connection account.

About the RAS Sender Phone Book Account

Describes the function, creation, maintenance, and security best practices for the RAS Sender Phone Book account.

About the Remote Tools Permitted Viewer Accounts

Describes the function, creation, maintenance, and security best practices for the Remote Tools Permitted Viewer accounts.

About the Server Locator Point Database Connection Account

Describes the function, creation, maintenance, and security best practices for the Server Locator Point Database Connection account.

About the Site Address Account

Describes the function, creation, maintenance, and security best practices for the Site Address account.

About the Site System Installation Account

Describes the function, creation, maintenance, and security best practices for the Site System Installation account.

About the Software Update Point Connection Account

Describes the function, creation, maintenance, and security best practices for the Software Update Point Connection account.

About the Software Update Point Proxy Server Account

Describes the function, creation, maintenance, and security best practices for the Software Update Point Proxy Server account.

About the Task Sequence Editor Domain Joining Account

Describes the function, creation, maintenance, and security best practices for the Task Sequence Editor Domain Joining account.

About the Task Sequence Editor Network Folder Connection Account

Describes the function, creation, maintenance, and security best practices for the Task Sequence Editor Network Folder Connection account.

About the Task Sequence Run As Account

Describes the function, creation, maintenance, and security best practices for the Task Sequence Run As account.

See Also

Other Resources

Accounts and Groups in Configuration Manager
How to Configure Configuration Manager 2007 Accounts


About the AMT Provisioning and Discovery Account

Topic last updated—May 2008

The AMT Provisioning and Discovery Account is functionally equivalent to the AMT Remote Admin Account and resides in the Management Engine BIOS extension (MEBx) of AMT-based computers. This account is used by the server running the out of band service point role to manage some network interface features of AMT in Configuration Manager 2007 SP1, by using the out of band management feature. The AMT Provisioning and Discovery Account specified in Configuration Manager must match the AMT Remote Admin Account name and password specified in the BIOS extensions in the AMT-based computers.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

You must specify an AMT Provisioning and Discovery Account in either of the following migration scenarios:

  • The AMT Remote Admin account has been specified by another AMT management solution, the AMT-based computer has had its provisioning information removed, and you want to provision it with Configuration Manager, using in-band AMT provisioning by using the Configuration Manager 2007 SP1 client.
  • The AMT Remote Admin account has been specified by another AMT management solution, the AMT-based computer has had its provisioning information removed, and you want to provision it with Configuration Manager, using out of band AMT provisioning by using the Import Computer for Out of Band Management Wizard and you will not specify the AMT Remote Admin Account in the wizard for each computer.

Specify the account name and password on the Provisioning Settings tab of the Out of Band Management component properties. During the AMT provisioning and discovery process, each AMT Provisioning and Discovery account specified will be tried in turn.

Required Rights and Permissions

There are no required rights and permissions for this account.

Account and Password Creation

The AMT Provisioning and Discovery Account refers to the AMT Remote Admin Account, which cannot be manually created; it is created in the AMT firmware. The associated password can be created by AMT or by an AMT management solution during the provisioning process.

Account Location

The account is stored in the Management Engine BIOS extensions of the AMT-based computer. This account does not correspond to any account in Windows.

Account Maintenance

There is no associated account maintenance in Configuration Manager for the AMT Provisioning and Discovery Account.

Security Best Practices

There are no security best practices in Configuration Manager for the AMT Provisioning and Discovery Account.

See Also

Tasks

How to Add an AMT Provisioning and Discovery Account

Concepts

About the AMT Remote Admin Account


About the AMT Remote Admin Account

Topic last updated—May 2008

The AMT Remote Admin Account is the account in the Management Engine BIOS extension (MEBx) of AMT-based computers that is used by the server running the out of band service point role to manage some network interface features of AMT in Configuration Manager 2007 SP1, by using the out of band management feature. Configuration Manager automatically sets the remote admin account password for computers that it provisions for AMT, and this is then used for subsequent authenticated access to the AMT firmware. This account is functionally equivalent to the Configuration Manager AMT Provisioning and Discovery Account.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Required Rights and Permissions

There are no required rights and permissions for this account.

Account and Password Creation

The AMT Remote Admin Account cannot be manually created; it is created in the AMT firmware. The AMT Remote Admin Account is named admin and by default, the password is set to admin. The password for the AMT Remote Admin Account can be reconfigured by using the following methods:

  • If the MEBx password has been changed by locally configuring the MEBx and if the AMT-based computer has not yet been provisioned, the password for the AMT Remote Admin Account will be automatically configured with the same value as the MEBx Account password.
  • If the AMT-based computer is provisioned by Configuration Manager, the password for the AMT Remote Admin Account will be automatically configured with a random, strong password.
  • If the AMT-based computer has been provisioned by another AMT management solution, the password for the AMT Remote Admin Account will have been automatically configured by the other management solution. For more information about the AMT Remote Admin Account in a migration scenario, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

Account Location

The account is stored in the Management Engine BIOS extensions of the AMT-based computer. This account does not correspond to any account in Windows.

Account Maintenance

There is no account maintenance in Configuration Manager for the AMT Remote Admin Account.

Security Best Practices

If you specify the password for the AMT Remote Admin Account in the comma-separated values (CSV) file when migrating computers with the Import Computer for Out of Band Management Wizard, ensure that you store the file securely and can access it securely from the Configuration Manager console.

See Also

Concepts

About the MEBx Account
Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager
Import Computer for Out of Band Management Wizard - Choose Mapping Page
Import Computer for Out of Band Management Wizard - Single Computer Page


About the AMT User Accounts

Topic last updated—May 2008

AMT user accounts control which users or groups can run management functions in the out of band management console in Microsoft System Center Configuration Manager 2007. When you are configuring the AMT user accounts, instead of supplying a set of credentials that will be validated, you are creating something like an access control list (ACL) that specifies which of the AMT features are allowed for the specified Windows domain global security group or domain user. When the logged on user attempts to perform an action, AMT uses Kerberos to authenticate the account and then, based on the AMT user account configuration, authorizes the access to the feature.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Required Rights and Permissions

Use the AMT User Account Setting dialog box to specify the specific AMT features that are allowed for the specified AMT user account. For example, you can create a security group for tier one support to allow Hardware Information, General Information, and Remote Control, and you can create a different security group for tier three support to allow PT Administration. These management activities are specific to AMT. For more information, see the manufacturer's documentation.

Account and Password Creation

The AMT user accounts or security groups are created and maintained by the Configuration Manager 2007 administrator. You can configure up to eight different entries.

Account Location

Because Kerberos authentication is used, the user accounts and security groups must exist in an Active Directory domain.

Account Maintenance

If you change the account in the Configuration Manager 2007 console, computers will not receive the change unless they are re-provisioned.

Security Best Practices

Use security groups instead of individual user accounts, and then manage access through the security groups.

Create role-based groups to permit access. For example, looking at hardware information is usually a lower risk behavior with a threat of information disclosure, while allowing media redirection could allow a user to boot from the network and then reformat the computer. Therefore, you might want to create a separate group for lower risk behaviors.

Configure the AMT user accounts before provisioning the AMT-based computers. If you configure AMT user accounts after computers are provisioned for AMT, you must manually update the AMT memory for these computers so that they are reconfigured with the new settings.

See Also

Tasks

How to Configure AMT Settings and AMT User Accounts


About the Capture Operating System Image Account

The Capture Operating System Image Account is used by Microsoft System Center Configuration Manager 2007 to access the folder where captured images are stored when using the operating system deployment feature. This account is required if you add the step Capture Operating System Image to a task sequence.

Required Permissions

The account must have Read and Write permissions on the network share where the captured image is to be stored.

Account and Password Creation

The Configuration Manager 2007 administrator creates the account and manages the password.

Account Location

For ease of administration, this account is usually a domain user account, though it can be any account having the required permissions.

Account Maintenance

The Configuration Manager 2007 administrator performs all necessary account maintenance. If the account is modified or the password is changed in the account database, the account properties must also be modified in the Task Sequence Editor.

If the administrator changes the password for the account and updates the task sequence with the new password, the client will pick up the new password on the next policy refresh.

Security Best Practices

If you need accounts for your task sequences, you can create one domain user account with minimal permissions to access the required network resources and use it for all task sequence accounts.

Do not assign this account interactive logon permissions.

Do not use the Network Access account for this account.

See Also

Concepts

About the Task Sequence Editor Domain Joining Account
About the Task Sequence Editor Network Folder Connection Account

Other Resources

Accounts and Groups in Configuration Manager
Accounts Configured in the Configuration Manager Console
Operating System Deployment in Configuration Manager


About the Client Push Installation Account

This account is used to connect to computers and install the Microsoft System Center Configuration Manager 2007 client software if you deploy clients using Client Push Installation.

If the Client Push Installation account is not specified, the site server account is used to try to install the Configuration Manager 2007 client software.

Required Rights and Permissions

The Client Push Installation account must be in the local administrators built-in group on the computers where the Configuration Manager 2007 client software is to be installed.

This account does not require Domain Admin rights.

Account and Password Creation

The Client Push Installation account is not automatically created. The Configuration Manager 2007 administrator owns creation and management of one or more Client Push accounts. The administrator can create multiple Client Push Installation accounts or can use a single account across multiple sites.

Account Location

This account can be created in the domain or local accounts database of every client computer.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures Configuration Manager 2007 to use the new account or password.

The Client Configuration Manager checks for changes to the Client Push Installation account once every hour. Changes to this account do not become effective immediately.

To more effectively coordinate account updates in large Active Directory deployments, create a new account with a different name, and then add the new account to the list of accounts in the Client Push Installation properties. After allowing adequate time for Active Directory to replicate the new account, remove the old account from the Client Push Installation properties and Active Directory.

Security Best Practices

To mitigate the risk of the Client Push Installation account being compromised, use an alternative method of client installation like Software Update Point Client Installation, Group Policy-based installation, or imaging. If you must use Client Push Installation, never make the account a domain admin. Instead, create a global group and add that global group to the local administrators group on your client computers. For additional security, create multiple Client Push Installation accounts, each with administrative access to a limited number of computers so that if one account is compromised, only the client computers to which that account has access are compromised.

Do not grant this account the right to log on locally.

If the Client Push Installation account is a domain member, do not configure Client Push Installation or other methods that require the account until the account has had time to replicate throughout the domain.

Instead of adding the Client Push Installation account to Domain Admins, you can create a Group Policy object to add a Restricted Group setting to add the Client Push Installation account to the local Administrators group.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push

Other Resources

Accounts and Groups in Configuration Manager
Accounts Configured in the Configuration Manager Console


About the Health State Reference Publishing account

If your site servers and Microsoft System Center Configuration Manager 2007 System Health Validator points are not in the same Active Directory forest, you must designate the Active Directory forest and domain that will store the health state references, and you must specify an account to use when publishing the health state references to Active Directory Domain Services.

If no account is configured, Configuration Manager attempts to use the site server computer account to publish the health state references.

Required rights and permissions

This account requires Read, Write and Create permissions to the Active Directory forest holding the health state reference.

Account and password creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates one account per site and manages the passwords.

Account location

The account should be created in the forest designated to store the health state references.

Account maintenance

The administrator changes the account or password in the operating system, then configures Configuration Manager 2007 to use the new account or password. The account changes take place immediately within the forest designated to store the health state reference. The administrator should change the password within the Configuration Manager console immediately.

Security best practices

Assign the least possible permissions to this account. Do not use the same account for the Health State Reference Publishing account and the Health State Reference Querying Account because the Querying account requires only Read permissions.

See Also

Concepts

About the Health State Reference Querying account

Other Resources

Accounts Configured in the Configuration Manager Console
Network Access Protection in Configuration Manager


About the Health State Reference Querying account

If your Microsoft System Center Configuration Manager 2007 site servers and System Health Validator points are not in the same Active Directory Domain Services forest, you must designate the Active Directory forest and domain that will store the health state references, and you must specify an account to use when System Health Validator points read health state references from Active Directory Domain Services.

If no account is configured, Configuration Manager attempts to use the System Health Validator Point Computer account to read health state references.

Required Rights and Permissions

This account must be a domain user account with Read access to the Configuration Manager 2007 Systems Management container in the Global Catalog server.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 administrator creates one account per site and manages the passwords.

Account Location

The account should be created in the forest designated to store the health state references.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures Configuration Manager 2007 to use the new account or password. Changes take effect during the next Active Directory query interval, which is configured in the System Health Validator Point Component properties, under Component Configuration.

Security Best Practices

Do not grant this account interactive logon rights.

Do not use the same account for both publishing and querying because the publishing account needs more privileges.


About the Management Point Database Connection Account

By default, the Microsoft System Center Configuration Manager 2007 management point uses its computer$ account when reading information from the site database, but you can configure a user account instead. You need this account if the management point needs to access a site database in a domain different than the site server domain, whether or not the domain is in the same forest.

Required Rights and Permissions

If you configure this account, you must manually add it to the smsdbrole_MP role in the Configuration Manager site database so that the management point obtains the required rights and permissions. If you do not configure this account, the management point's computer$ account is assumed to be in a trusted forest and Configuration Manager 2007 attempts to add it automatically to the smsdbrole_MP.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates one account per management point and manages the passwords.

Account Location

The account can be created anywhere it can be added to the smsdbrole_MP role in the Configuration Manager site database.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures Configuration Manager 2007 to use the new account or password. The changes take effect immediately. If the existing account is replaced with another account, the administrator must manually add it to the smsdbrole_MP role in the Configuration Manager site database.

Security Best Practices

Do not configure this account unless the site database and the management point are in different domains.

If you use this account, create it as a low-rights, local account on the computer running SQL Server.

Do not grant this account interactive logon rights.

See Also

Tasks

How to Configure the Management Point Database Connection Account


About the MEBx Account

Topic last updated—May 2008

The MEBx Account is the account in the Management Engine BIOS extension (MEBx) on AMT-based computers and is used for initial authenticated access to the AMT firmware on AMT-based computers in Configuration Manager 2007 SP1. If you enable the out of band management feature in Configuration Manager 2007 SP1, you must configure the password to use for the MEBx Account in the Configuration Manager 2007 console and when migrating computers to Configuration Manager that have been provisioned for AMT by using another management solution.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Required Rights and Permissions

There are no required rights and permissions for this account.

Account and Password Creation

The MEBx account is named admin, and by default, the password is admin. Your manufacturer might provide a customized password, or you might have specified your choice of password in AMT. If the MEBx password is other than admin, specify an AMT Provisioning and Discovery Account on the Out of Band Management Configuration Properties: Provisioning Settings Tab. For more information, see How to Add an AMT Provisioning and Discovery Account.

Configuration Manager will change the MEBx password during the provisioning process only if it has not been changed previously on the AMT-based computer. Specify your choice for an alternative MEBx password on the Out of Band Management Properties: General Tab. If you import AMT-based computers that have already been provisioned, specify the MEBx password by using the Import Computer for Out of Band Management Wizard.

Account Location

The account is stored in the Management Engine BIOS extensions of the AMT-based computer. This account does not correspond to any account in Windows.

Account Maintenance

If the default MEBx password has not been changed before Configuration Manager provisions the computer for AMT, Configuration Manager will set the password that you configure on the Out of Band Management Properties: General Tab as the MEBx password in AMT during the provisioning process.

Security Best Practices

If you specify the MEBx password in the comma-separated values (CSV) file for importing computers with the Import Computer for Out of Band Management Wizard, ensure that you store the file securely and can access it securely from the Configuration Manager console.

See Also

Reference

Out of Band Management Properties: General Tab

Concepts

About the AMT Remote Admin Account
Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager
Import Computer for Out of Band Management Wizard - Choose Mapping Page
Import Computer for Out of Band Management Wizard - Single Computer Page


About the Multicast Service Point Connection Account

Topic last updated—March 2008

By default, the Microsoft System Center Configuration Manager 2007 multicast-enabled distribution points use the computer$ account when reading information from the site database, but you can configure a user account instead. Typically, you would need this account if the multicast-enabled distribution points need to access a site database in a remote, untrusted forest. For example, if your data center has a perimeter network in a forest other than the site server and site database, you can use this account to read the multicast information from the site database.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Required Rights and Permissions

If you configure this account, you must manually add it to the smsdbrole_MCS role in the Configuration Manager site database so that the multicast-enabled distribution point obtains the required rights and permissions. If you do not configure this account, the multicast-enabled distribution point's computer$ account is assumed to be in a trusted forest and Configuration Manager 2007 attempts to add it automatically to the smsdbrole_MCS.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates one or more accounts for the multicast-enabled distribution points and manages the passwords.

Account Location

The account can be created anywhere it can be added to the smsdbrole_MCS role in the Configuration Manager site database.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures Configuration Manager 2007 to use the new account or password. The changes take effect immediately. If the existing account is replaced with another account, the administrator must manually add it to the smsdbrole_MCS role in the Configuration Manager site database.

Security Best Practices

Do not configure this account unless you need it to access a site database in an untrusted forest.

If you use this account, create it as a low-rights, local account on the computer running Microsoft SQL Server.

Do not grant this account interactive logon rights.


About the Network Access Account

Microsoft System Center Configuration Manager 2007 client computers use the Local System account to perform most Configuration Manager 2007 client operations on the computer, but Local System cannot access network resources. When the client computer accesses a distribution point to run a package, including operating system deployment packages, it uses the computername$ account to access resources in a trusted Active Directory domain. The Network Access account is provided for times when Configuration Manager 2007 clients from workgroups or non-trusted domains require access resources in the site server's domain. This account might also be needed during operating system deployment, because the computer receiving the operating system does not have a security context it can use to access content on the network.

Important
The Network Access account is never used as the security context for running programs, installing software updates, or running task sequences, only for accessing resources on the network.

Required rights and permissions

This account should have the minimum appropriate permissions on the software distribution or operating system deployment content it needs to access. The account must have Access this computer from the network on the distribution point or other server that holds the package content.

Because you can create only one Network Access account per site, this account must function for all packages and task sequences for which it is required.

Scenarios for Software Distribution

The account used to connect to the content and the account used to run the program vary depending on the configuration of the program and advertisement.

Note
The program is always run in the context specified by administrator in the program properties. The Network Access account is never used to run the program, even if it was used to access the distribution point shared folder.

Advertisement Is Configured To Download from Distribution Point

Program is advertised to: Program Initiation Sequence of accounts used to access distribution point shared folder

User or group

Initiated by user or initiated on schedule
  1. Logged on user
  2. Network Access account
  3. Computername$
  4. Network Access account*

Computer

Initiated by user
  1. Logged on user
  2. Network Access account
  3. Computername$
  4. Network Access account*

Computer

Initiated on schedule
  1. Computername$
  2. Network Access account

* When Configuration Manager tries to use the computername$ context to download the content and it fails, it automatically tries the Network Access account again, even if it has previously tried and failed.

Advertisement Is Configured To Run from Distribution Point

Program configuration Sequence of accounts used to access distribution point shared folder

Run with user rights

1. Logged on user

2. Network Access account

Run with administrative rights

1. Computername$

2. Network Access account

Windows Installer file, configured to run with user rights

Configuration Manager 2007 client attempts to access the distribution point to run the Windows Installer application using the following account sequence:

1. Logged on user

2. Network Access account

Configuration Manager 2007 client attempts to access the distribution point to elevate the Windows Installer rights for the user using the following account sequence:

1. Computername$

2. Network Access account

In many cases, when a Windows Installer file is installed in a user’s context there are components within the file that require an administrative context to install; the Configuration Manager 2007 client is able to take advantage of Windows Installer elevation to ensure that the application installs correctly. The client does not know if elevation is required, so it always attempts to elevate Windows Installer installations, whether or not the program requires it, whether or not the logged on user is an administrator. In order for elevation to succeed the Computername$ account or the Network Access account must be able to access the resource. If neither the Computername$ account nor the Network Access account has permission to access the shared folder on the distribution point, the program will still run in the user’s context but the elevation will fail. you will receive status message 10046 to indicate a failure to elevate the Windows Installer package. If any actions within the Windows Installer file require administrator access to the system then the installation will fail

After a connection to the distribution point shared folder has been established, if the program was configured to run with user rights, the program runs in the context of the logged on user, regardless of the account used to access the share. If the program was configured to run with administrative rights, it runs in the context of the Local System account.

Scenarios for Operating System Deployment

While Configuration Manager 2007 can use the Network Access account to access task sequences stored on distribution points, the Network Access account is used only for accessing the content and not for running the task sequence. Task sequences run only in the context of the Local System account.

Unlike packages, task sequences can be advertised only to computers, not to users and groups.

When using boot images for operating system deployment, Configuration Manager 2007 uses Windows Preinstallation Environment (Windows PE), which is not a full operating system. While running Windows PE, the computer uses an automatically generated, random name and is not a member of any domain. Security restrictions might prevent the computer from accessing the distribution point during the Windows PE phase of the task sequence.

Advertisement Configuration Sequence of accounts used to access distribution point shared folder – Windows PE Sequence of accounts used to access distribution point shared folder – operating system

Optional
  1. Network Access account
  2. Computername$
  1. Network Access account
  2. Computername$
  3. Network Access account*

Mandatory
  1. Network Access account
  2. Computername$
  1. Computername$
  2. Network Access account

* When Configuration Manager tries to use the computername$ context to download the content and it fails, it automatically tries the Network Access account again, even if it has previously tried and failed.

Account and password creation

The administrator creates the account and password in the Active Directory Domain Services database and then configures Configuration Manager 2007 to use the account in the Configuration Manager 2007 console.

Account location

This account can be created in any domain that will provide the necessary access to resources. The Network Access account must always include a domain name. Pass-through security is not supported for this account. If there are multiple domains, create the account in a trusted domain.

Account maintenance

The Configuration Manager 2007 Administrator creates and maintains the account and password.

To avoid account lockouts, do not change the password on an existing Network Access account. You should create a new account and set Configuration Manager 2007 to use that account. When sufficient time has passed for all clients to have received the new account details, the old account should be removed from the network shared folders and deleted.

Security best practices

Do not grant this account interactive logon rights.

Do not grant this account the right to join computers to the domain. If you must join computers to the domain during a task sequence, use the Task Sequence Editor Domain Joining Account.

Avoid using the Client Network Access account because it is a common account and can be used to grant access to multiple packages, including packages not appropriate for all users. If you must use the account, due to roaming or workgroup environments, assign only the least possible permission and never assign domain admin rights.

As with all accounts, never use blank passwords. If you do not specify a password when you are configuring this account in Configuration Manager 2007 console, the account is not saved.

There is no need to add the Network Access Account as a Package Access Account because it is a member of Users and thus included by default. Also, restricting the ACLs of a package to only the Network Access Account does not prevent any client from accessing the package because Configuration Manager 2007 clients can request use of the Network Access Account when necessary. If you want to protect the package content from unauthorized users, add users or groups to the package access accounts instead of adding the Users group.


About the Package Access Account

Package Access Accounts are not actually accounts; they enable you to set NTFS permissions to specify the users and user groups that can access a package folder. By default, Microsoft System Center Configuration Manager 2007 grants access only to the generic access accounts Users and Administrators, but the administrator can control access for client computers by using additional Windows accounts or groups.

Note
Although an Access Accounts node is under Mobile Device Management, devices retrieve all package content anonymously so the access accounts are not used by the device.

Required Rights and Permissions

By default, when Configuration Manager 2007 creates the package share on a distribution point, it grants Read access to the local Users group and Full Control to the Administrators group. The actual permissions required will depend on the package.

If you have clients in workgroups or in untrusted forests, those clients will use the Network Access Account to attempt to reach the package content. Make sure that the Network Access Account has permissions to the package using the defined Package Access Accounts.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates the accounts or groups, or uses existing accounts or groups.

Account Location

The account must be created in a domain where it can access the distribution points.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures Configuration Manager 2007 to use the new account or password. After changing the access account, the administrator must refresh the package. Updating the package does not change the NTFS permissions on the package.

Security Best Practices

Configure the package access permissions so that only authorized installers of the software have access to the files on the distribution points.

When the clients have joined the site, they can receive any software distributions that are available at that site and where the computer or user meets the qualifications of the relevant collections. For this reason, software that should be limited to specific users should be secured at the package access level to those users, rather than being limited by site availability or collection criteria.

Important
In some cases, removing the Users group as a package access account might cause software distribution to fail. If the distribution point is in a native mode site, you must add IUSR_<computername> as a package access account with the permissions required to access to the package. If a distribution point is configured to allow anonymous access for mobile device clients, you must also add the Internet Guest account as a package access account.

Changes to the access accounts on the package files (as opposed to the distribution point shared folders) become effective only when you refresh the package. Therefore, you should set the package access permissions carefully when you first create the package, especially if the package is large, if you are distributing the package to many distribution points, or if your network capacity for package distributions is limited.

There is no need to add the Network Access Account as a Package Access Account because it is a member of Users and thus included by default. Also, restricting the Package Access Account to only the Network Access Account does not prevent any client from accessing the package because Configuration Manager 2007 clients can request use of the Network Access Account when necessary.

See Also

Concepts

About the Network Access Account


About the PXE Service Point Database Connection Account

By default, the Microsoft System Center Configuration Manager 2007 PXE service point uses its computer$ account when reading information from the site database, but you can configure a user account instead. Typically, you would need this account if the PXE service point needs to access a site database in a remote, untrusted forest. For example, if your data center has a secure perimeter network in a forest other than the site server and site database, you can use this account to read the PXE boot information from the site database.

Required Rights and Permissions

If you configure this account, you must manually add it to the smsdbrole_PSP role in the Configuration Manager site database so that the PXE service point obtains the required rights and permissions. If you do not configure this account, the PXE service point's computer$ account is assumed to be in a trusted forest and Configuration Manager 2007 attempts to add it automatically to the smsdbrole_PSP.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 administrator creates one account per PXE service point and manages the passwords.

Account Location

The account can be created anywhere it can be added to the smsdbrole_PSP role in the Configuration Manager site database.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures Configuration Manager 2007 to use the new account or password. The changes take effect immediately. If the existing account is replaced with another account, the administrator must manually add it to the smsdbrole_PSP role in the Configuration Manager site database.

Security Best Practices

Do not configure this account unless you need it to access a site database in an untrusted forest.

If you use this account, create it as a low-rights, local account on the computer running SQL Server.

Do not grant this account interactive logon rights.


About the RAS Sender Phone Book Account

If the Microsoft System Center Configuration Manager 2007 site requires a RAS sender instead of the standard sender, you must configure an account with permissions to initiate a remote access connection.

The RAS sender account could be the same account as the Site Address account, if it has sufficient permissions; however, you cannot use the site server computer account because you must specify the password in the Configuration Manager 2007 console.

Required Rights and Permissions

This account must have rights to initiate a remote access connection.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 administrator creates as many accounts as needed for the RAS sender addresses and manages the passwords.

Account Location

The account can be created anywhere as long as it has permissions to initiate a remote access connection for the site server.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures Configuration Manager 2007 to use the new account or password. The changes will take effect the next time the RAS sender polls for new send requests.

Security Best Practices

Use the same account for the RAS Sender Phone Book account as for the Site Address account.


About the Remote Tools Permitted Viewer Accounts

The permitted viewers are not really accounts that are configured with names and passwords, but a list of users who are allowed to use Microsoft System Center Configuration Manager 2007 Remote Tools functionality on clients. For example, you can specify the users who staff the help desk.

Required rights and permissions

The accounts on the Permitted Viewers list should also have the Use remote tools right for the collections they will control.

When you add users to the Permitted Viewers list, they are automatically added to the ConfigMgr Remote Control Users group, which grants them necessary rights to use remote control on computers running Windows XP, Windows Server 2003, and Windows Vista. The permitted viewers do not require additional rights on Windows 2000 clients. The permitted viewers do not require administrative access to any computers they will control.

Account and password creation

Usually the accounts already exist and are added to the list if they require remote control functionality on the client computers.

Account location

The accounts can be created anywhere.

Account maintenance

No maintenance is required. Configuration Manager 2007 does not store the password information for this account.

Security best practices

Bypassing the Use remote tools right for the collection is easy for knowledgeable or determined attackers. They could set up a Configuration Manager 2007 site that is not part of your hierarchy and create resource records for clients they want to control, and then grant themselves Use remote tools right on those resources. Alternately, they could use the Remote.exe command to create a remote tools session because Remote.exe does not check the database for permitted viewers unless specified in the command line.

Important
You should think of collection security for Remote Tools as an organizational convenience, not a security tool.

Members of global groups that are members of local groups listed in the Permitted Viewers list are not enumerated, and thus members of global groups are not granted access permissions when they are nested in local groups. To avoid confusion, explicitly specify all global groups on the Permitted Viewers list.

The Permitted Viewers list is intentionally ambiguous because a user is authenticated against the list at the client, and the site server might not have access to the same domains as the client. Consequently, you can enter an account name in the Permitted Viewers list without specifying a domain for the account. However, the list must be clear at the client. Therefore, it is recommended that you enter an account name in the Permitted Viewers list by using the domain\account format to remove any ambiguity that might occur at the client.


About the Server Locator Point Database Connection Account

By default, the Microsoft System Center Configuration Manager 2007 server locator point uses its computer$ account when connecting to the site database, but you can configure an alternate account. If configured, the Server Locator Point Connection Account is used by server locator points to read information from the site database.

Required rights and permissions

If you configure this account, you must manually add it to the smsdbrole_SLP role in the Configuration Manager site database so that the server locator point obtains the required rights and permissions. If you do not configure this account, the server locator point's computer$ account is automatically added to smsdbrole_SLP.

Account and password creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates the account and manages the password.

Account location

The account can be created anywhere where it can be added to the smsdbrole_SLP role in the Configuration Manager site database.

Account maintenance

The administrator changes the account or password in the operating system, then configures Configuration Manager 2007 to use the new account or password. If the existing account is replaced with another account, the administrator must manually add it to the smsdbrole_SLP role in the Configuration Manager site database.

Security best practices

Use the computer account instead of creating a connection account.

If you use this account, create it as a local account on the computer running SQL Server.

Do not grant this account interactive logon rights.


About the Site Address Account

This account establishes communications and transfers data between Microsoft System Center Configuration Manager 2007 parent and child sites, including grandchild sites. Parent sites use this account to transfer administrative data (such as package or collection data) to the child or grandchild site. Child sites use this account to transfer data (such as inventory data, discovery records, or status messages) to the parent site.

A Site Address Account is not always required. Within the same forest, you should use the site server's computer account as the Site Address Account. If you must connect to a site in a different forest, you must configure a Site Address Account because even with a trust between the forests, the computer account cannot access the site server across the forest boundary.

Note
Secondary sites must be in the same forest as the parent site, so you cannot configure a Site Address Account between a secondary child and a primary parent.

Required Rights and Permissions

This account must have Read, Write, Execute, and Delete permissions on the SMS\Inboxes\Despoolr.box\Receive folder on the destination site server.

Add the Site Address Account to the Site to Site Connection group on the destination site server, which has the appropriate permissions on the SMS_Site shared folder. The Site Address Account does not have to be granted permissions to the SMS_Site shared folder directly.

Also, your security policy must allow the Site Address Account Access this computer from the network permissions on the destination site server. For more information about setting the Microsoft Windows security policy, see Windows Help.

Account and Password Creation

The administrator creates the account and password, and then configures Configuration Manager 2007 to use the account when creating an address between sites. The account must be verifiable on the destination site server. It does not have to be verified on the originating site server where the address is defined.

Account Location

This account can be created wherever the administrator wants to create it. A single account can be used for multiple sites and domains if it has the required permissions.

Account Maintenance

The administrator performs all account and password maintenance. If you modify the account in the account database, you must also update the configuration in the Configuration Manager 2007 console.

Important
If you specify a Site Address Account for an address and then later decide you want to use the computer account as the Site Address Account, you must either delete the address and re-create it, or use the Manage Site Accounts tool (MSAC.exe). Changing the account name is not sufficient when switching from a user account to the computername$ account.

Security Best Practices

Use the site server's computer account unless you must access a remote forest so that the password is managed by the operating system and is less vulnerable to discovery and misuse.

If you have many domain controllers and this account will be used across domains, verify that the account has replicated before configuring it in Configuration Manager 2007.

See Also

Tasks

How to Configure the Site Address Account

Concepts

How to Manage Accounts from the Command-Line


About the Site System Installation Account

The Site System Installation Accounts are used by the Microsoft System Center Configuration Manager 2007 Site Component Manager service to install, reinstall, uninstall, and configure site systems. If you configure the site system to Allow only site system initiated data transfers from this site system, Configuration Manager 2007 also uses this account to pull data from the site system.

If you do not configure a Site System Installation Account for a site system, Configuration Manager 2007 tries to use the site server's computer account to install and configure that site system and retrieve data. If the site system is in a remote, untrusted forest, the site server computer account will not have access, and you will have to configure this account to use instead.

Each site system can have a different Site System Installation Account, but you can configure only one Site System Installation Account to manage all roles on that site system.

Required Rights and Permissions

Site System Installation Accounts must have Administrative rights on the site systems they will install and configure. Additionally, the Site System Installation Accounts must have Access this computer from the network in the security policy on the site systems they will install and configure.

Account Location

You can create these accounts anywhere, provided they have the required rights and permissions on the site systems they will install and configure. This account is provided to support site systems that can be configured in a forest other than the site server, for example, a management point that is configured to support Internet-based clients or a System Health Validator point that belongs to an untrusted forest.

The following site systems are supported if they are installed in a forest different than the site server's forest.

  • Server locator point
  • PXE service point
  • Fallback status point
  • Distribution point, configured to support Internet-based clients
  • Management point, configured to support Internet-based clients
  • Software update point, configured to support Internet-based clients
  • For network access protection, if you must have a System Health Validator point in a remote forest because the Network Policy Server (NPS) is not in the same forest as the site server.

Account Password and Creation

The Site System Installation Accounts are created and maintained by the Configuration Manager 2007 administrator. If you change the password on the account, you must reconfigure the account in the Configuration Manager 2007 console to provide Configuration Manager 2007 with the current credentials.

Security Best Practices

If the site system is in the same forest as the site server, or in a domain trusted by the site server, either through a cross-forest trust or an explicit trust, use the site server computer account to install and configure the site system. The site server computer account password is managed by the operating system and is less vulnerable to discovery and misuse.

If you have many domain controllers and these accounts will be used across domains, verify that the accounts have replicated before configuring the site system.

Creating local accounts on each site system to be managed is the most secure because it limits the damage that attackers can do if the account is compromised. However, creating domain accounts is easier to manage, so consider the trade-off between security and effective administration.


About the Software Update Point Connection Account

The Software Update Point Connection Account is used by two Microsoft System Center Configuration Manager 2007 services for software updates. The Configuration Manager 2007 Windows Server Update Services (WSUS) Configuration Manager service uses the account to configure settings such as product definitions, classifications, and upstream settings. This account is also used by the Configuration Manager 2007 WSUS Synchronization Manager service to request synchronization.

If the account is not specified, the site server computer account is used for the connection.

Important
The Site System Installation account can install the components, but cannot actually perform software updates-specific functions on the software update point. If you cannot use the site server computer account because the software update point is in an untrusted forest, you must use this account in addition to the Site System Installation account.

Required rights and permissions

This account must be a local administrator on the computer where WSUS is installed, and be part of the local WSUS Administrators group.

Account and password creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates the account and manages the passwords. If using a software update point to support Internet-based clients, it is possible to create one account for the intranet software update point and a different account to support software update point in the perimeter network.

Account location

The account must be created in an account database that has rights to access the software update point in the remote forest.

Account maintenance

The administrator changes the account or password in the operating system, then configures Configuration Manager 2007 to use the new account or password.

Security best practices

Use the site server computer account whenever possible. If the software update point is in a different forest, which is supported for Internet-based client management, then you must configure this account and also use the Site System Installation account to install the site role.

See Also

Other Resources

Accounts and Groups in Configuration Manager
Accounts Configured in the Configuration Manager Console
Software Updates in Configuration Manager


About the Software Update Point Proxy Server Account

You must configure these credentials only when the Microsoft System Center Configuration Manager 2007 software update point must access the Internet via a proxy server or firewall that requires authenticated access.

Required rights and permissions

This account requires permission to use the proxy server or firewall for Internet access.

Account and password creation

Depending on the type of firewall or proxy server, this might be a set of credentials instead of an actual account. The firewall or proxy server administrator might create or designate the credentials to be used.

Account location

This account can exist anywhere it can access the proxy server or firewall.

Account maintenance

The administrator changes the account or password, then configures Configuration Manager 2007 to use the new account or password.

Security best practices

Use an account with the least possible permissions.


About the Task Sequence Editor Domain Joining Account

This account is used in a Microsoft System Center Configuration Manager 2007 task sequence to join a newly imaged computer to the desired domain. This account is required if you add the step Join Domain or Workgroup to a task sequence, and then select Join a domain. This account can also be configured if you add the step Apply Network Settings to a task sequence, but it is not required.

Required Rights and Permissions

This account requires domain join rights in the domain that the computer will be joining.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates one account per site and manages the passwords.

Account Location

This account must be a domain account.

Account Maintenance

The administrator changes the account or password in the operating system, and then configures the task sequence to use the new account or password.

Security Best Practices

If you need accounts for your task sequences, you can create one domain user account with minimal permissions to access the required network resources and use it for all task sequence accounts.

Do not assign this account interactive logon permissions.

Do not use the Network Access account for this account.

See Also

Concepts

About the Capture Operating System Image Account
About the Task Sequence Editor Network Folder Connection Account


About the Task Sequence Editor Network Folder Connection Account

This account is used in a Microsoft System Center Configuration Manager 2007 task sequence to connect to a shared folder on the network. This account is required if you add the step Connect to Network Folder to a task sequence.

Required Rights and Permissions

This account requires permissions to access the specified shared folder.

Account and Password Creation

The account is not automatically created. The Configuration Manager 2007 Administrator creates one account per site and manages the passwords.

Account Location

This account must be a domain account.

Account Maintenance

The administrator changes the account or password in the operating system, then configures the task sequence to use the new account or password.

Security Best Practices

If you need accounts for your task sequences, you can create one domain user account with minimal permissions to access the required network resources and use it for all task sequence accounts.

Do not assign this account interactive logon permissions.

Do not use the Network Access account for this account.

See Also

Concepts

About the Capture Operating System Image Account
About the Task Sequence Editor Domain Joining Account


About the Task Sequence Run As Account

Topic last updated—March 2008

The Task Sequence Run As Account is used by Microsoft System Center Configuration Manager 2007 to run command lines in task sequences with credentials other than the local system account. This account is required if you add the step Run Command Line to a task sequence but do not want the task sequence to run with Local System account permissions on the managed computer.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Required Permissions

The account must have the minimum permissions to run the command line specified in the task sequence. The account requires interactive login rights, and it usually requires the ability to install software and access network resources.

Account and Password Creation

The Configuration Manager 2007 administrator creates the account and manages the password.

Account Location

The account can be a local or domain account, as long as it has the necessary permissions to run the command line.

Account Maintenance

The Configuration Manager 2007 administrator performs all necessary account maintenance. If the account is modified or the password is changed in the account database, the account properties must also be modified in the Task Sequence Editor.

If the administrator changes the password for the account and updates the task sequence with the new password, the client will pick up the new password on the next policy refresh.

Security Best Practices

Use an account with the least possible permissions.

Do not use the Network Access account for this account.

Never make the account a domain administrator.

Never configure roaming profiles for this account. When the task sequence runs, it will download the roaming profile for the account, leaving it vulnerable to access on the local computer.

Limit the scope of the account. For example, create different Task Sequence Run As accounts for each task sequence so that if one account is compromised, only the client computers to which that account has access are compromised.

If the command line requires administrative access on the computer, consider creating a local administrator account solely for the Task Sequence Run As account on all computers that will run the task sequence, and delete the account as soon as it is no longer needed.


About the Client Status Reporting Service Account

Topic last updated—March 2008

The Client Status Reporting Service Account provides the security context to run the Configuration Manager Client Status Reporting account. In Microsoft System Center Configuration Manager 2007, the Configuration Manager Client Status Reporting account performs the following functions:

  • Adds data from client status reporting into the Configuration Manager 2007 database.
  • Controls the activity of client ping and client pulse according to the specified settings.
  • Processes, analyzes, and collates client status data and sends this to the Configuration Manager 2007 site database.
Note
The information in this topic applies only to Configuration Manager 2007 R2.

You can use either the local system account, or you can configure a user account.

Required Rights and Permissions

The client status reporting service account requires the following rights and permissions:

  • Local administrative rights on the client status reporting host system.
  • Logon as a service rights on the client status reporting host system.
  • Membership in the smsdbrole_CH role in the site database.
  • Read permissions to the share on the management point containing the policy request log files. For more information, see the topic How to Configure Policy Request Logging on Management Points in the client status reporting documentation.

Account and Password Creation

The administrator creates the account and password, and then configures it in the Configuration Manager 2007 Client Status Reporting console. For more information, see the topic "How to Configure the Client Status Reporting Service Account" in the help; for the Configuration Manager 2007 Client Status Reporting console.

Account Location

The account can be created anywhere that it has the required rights and permissions.

Account Maintenance

The administrator performs all account and password maintenance. If you modify the account in the account database, you must also update the configuration in the Configuration Manager 2007 Client Status Reporting console.

Security Best Practices

Creating a user account with limited rights is more secure than using the Local System account. Create a user account with the required rights but remove the log on locally right from the account.

You have two options for configuring policy request logging. Granting the Client Status Reporting Service Account administrator rights on the management point is not recommended. While it introduces more configuration overhead, the more secure method is to manually enable policy logging on the management point and manually configure the log folder so that the Client Status Reporting Service Account has read access.

Do not assign any additional rights or permissions to this account, or use this account for anything except running the service on one or more client status reporting host systems.

See Also

Concepts

Overview of Client Status Reporting


About the Database Roles for Configuration Manager

Topic last updated—March 2008

Microsoft System Center Configuration Manager 2007 uses SQL roles to control how site systems and Configuration Manager 2007 users interact with the site database. All the necessary SQL roles are created automatically during Setup and assigned the necessary permissions.

Important
Modifying the roles created by Configuration Manager 2007 and the permissions assigned to those roles is not supported.

The following database roles for Configuration Manager 2007 site roles are created to allow site system roles write access to the site database:

  • SMS Site Server role (smsdbrole_siteserver)
  • SMS Site Provider role (smsdbrole_siteprovider)

The following database roles for Configuration Manager 2007 site roles are created to allow site system roles read-only access to the site database:

  • SMS Management Point role (smsdbrole_MP)
  • SMS Server Locator Point role (smsdbrole_SLP)
  • SMS PXE Service Point roles (smsdbrole_PSP)
  • SMS Device Management Point role (smsdbrole_DMP)
  • SMS Reporting Point role (smsdbrole_RP)
  • SMS State Migration Point role (smsdbrole_SMP)
  • Web Report Application role (Webreport_approle)

The following database roles for Configuration Manager 2007 SP1 site roles are created to allow site system roles read-only access to the site database:

  • Asset Intelligence Synchronization Point role (smsdbrole_AIUS)
  • Out of Band Management Point role (smsdbrole_AMTSP)

The following database roles for Configuration Manager 2007 R2 site roles are created to allow site system roles access to the site database:

  • Client Status Reporting Host role (smsdbrole_CH)
  • Multicast-Enabled Distribution Point role (smsdbrole_MCS)

The Client Status Reporting Host role has read permissions to the site database and execute permissions to stored procedures. The Multicast-Enabled Distribution Point role has read-only access to the site database.

Database Connection Accounts

The management point, PXE service point, and server locator point can connect to the database using the computer$ account or using a database connection account (Management Point Database Connection account, Server Locator Point connection account, or PXE Service Point Database Connection account). If you use the computer$ account, Configuration Manager 2007 automatically attempts to add the account to the database role. If you use a database connection account, you must manually add the user account to the database role.

SMS Schema Users Role (Smsschm_users)

The database schema for Configuration Manager 2007 is not published. Microsoft reserves the right to alter the database schema to improve performance or add functionality. A published schema would lend itself to static assumptions for access to Configuration Manager 2007 data. If the schema is changed, those assumptions are no longer valid.

Because the schema is not available, Microsoft strongly recommends that you not query directly against the site database. Instead, you should perform queries for information from the database in one of the following two ways:

  • Query internally through the Configuration Manager 2007 console.
  • Query externally by using Microsoft Office Excel, Microsoft Office Access, Microsoft SQL Server, Crystal Reports, or similar programs, and then only through the views generated by Configuration Manager 2007 SQL View Generator.

To grant users access to the Configuration Manager 2007 views, add them to the SMS Schema Users role.

See Also

Other Resources

Accounts and Groups in Configuration Manager


About the Proxy Account for Internet-Based Clients

These credentials are needed only if Microsoft System Center Configuration Manager 2007 clients need to connect to the Internet via a proxy server or firewall requires authenticated access.

Required Rights and Permissions

This account requires permission to use the proxy server or firewall for Internet access.

Account and Password Creation

Depending on the type of firewall or proxy server, this might be a set of credentials instead of an actual account. The firewall or proxy server administrator might create or designate the credentials to be used.

Account Location

This account exist anywhere it can access the proxy server or firewall.

Account Maintenance

The administrator configures the Configuration Manager 2007 client to use the new account or password.

Security Best Practices

Use an account with the least possible permissions.

See Also

Tasks

How to Configure Configuration Manager Client Computers to Access Their Internet-Based Management Point with a Proxy Server

Other Resources

Accounts and Groups in Configuration Manager


Configuration Manager Groups

Microsoft System Center Configuration Manager 2007 creates groups to support Configuration Manager 2007 operations and relies on an IIS group for IIS application pools.

In This Section

About the ConfigMgr Remote Control Users Group

Describes the function, creation, permissions, and group membership for the ConfigMgr Remote Control Users Group.

About the IIS Worker Process Group in Configuration Manager

Describes the function, creation, permissions, and group membership for the IIS Worker Process group Configuration Manager 2007.

About the Reporting Users Group

Describes the function, creation, permissions, and group membership for the Reporting Users group.

About the Site System to Site Server Connection Group

Describes the function, creation, permissions, and group membership for the Site System to Site Server Connection Group.

About the Site to Site Connection Group

Describes the function, creation, permissions, and group membership for the Site to Site Connection Group.

About the SMS Admins Group

Describes the function, creation, permissions, and group membership for the SMS Admins group.

See Also

Other Resources

Accounts and Groups in Configuration Manager


About the ConfigMgr Remote Control Users Group

This group is used by Microsoft System Center Configuration Manager 2007 remote tools to store the permitted viewers configured in the permitted viewers list. This group is created only for computers running Windows XP, Windows Server 2003, and Windows Vista, not for Windows 2000 clients.

Required Rights and Permissions

This group must have the following DCOM permissions on the Remote Tools Agent component:

  • Local Launch
  • Local Activation
  • Local Access

This group must have the following DCOM permissions on the Remote Tools Launcher component:

  • Local Launch
  • Local Activation
  • Local Access

This group must have the following DCOM permissions on the Remote Tools Server component:

  • Remote Launch
  • Remote Activation
  • Local Access
  • Remote Access on Remote Tools Server

This group also requires Remote Launch and Remote Activation on the Configuration Manager 2007 client computer.

Important
By default, Remote Activation is granted only to the members of built-in Administrators group. Allowing the ConfigMgr Remote Control Users group Remote Activation permission would allow any member of that group to attempt DCOM attacks against the client computer, and increases attack surface of the computer. You can mitigate this threat by carefully monitoring who is a member of the ConfigMgr Remote Control Users group. For more information regarding risk associated with allowing remote activation, see http://go.microsoft.com/fwlink/?LinkId=86101.

It will also be given rights to control the computer via Remote Desktop if Configuration Manager 2007 is configured to manage the Remote Desktop settings on the Remote Tools Client Agent settings on the Remote Desktop tab.

Group Location

This group is created on the supported Configuration Manager 2007 client computers when the client receives a policy enabling remote tools.

Important
If remote tools is disabled at a later time, this group is not removed. If you disable remote tools, you should always manually delete the ConfigMgr Remote Control Users group.

Type of Group

This group is a local group. If the client is a domain controller, this group is a domain local group that is shared among all domain controllers in the domain.

Membership

By default, there are no members in this group. As you add users to the Permitted Viewers list, they are automatically added to this group. You should always add users to the Permitted Viewers list instead of adding them directly to this group.


About the IIS Worker Process Group in Configuration Manager

This group is necessary to install and operate Microsoft System Center Configuration Manager 2007 site system roles that require Internet Information Services (IIS). The IIS_WPG group account has the minimum permissions and user privileges that are necessary to start and run a worker process on a Web server. Application pool identities must be members of this group so the application pool can register with Http.sys.

Required Rights and Permissions

When you install IIS 6.0, the setup process adds an ACL to the wwwroot directory of the default Web site. This ACL gives the IIS_WPG group permission to access that directory, which means that all worker process identities in the IIS_WPG group can access the contents of this directory on the default Web site.

For more information about default permissions assigned to the IIS_WPG group, see Access Control Lists (IIS 6.0) at http://go.microsoft.com/fwlink/?LinkId=93060.

Account and Password Creation

The group is automatically created on any computer running IIS.

Account Location

If the server running IIS is a member server, IIS_WPG is a local group. If the server running IIS is a domain controller, IIS_WPG is a domain local group and shared by other IIS servers, which are also domain controllers in the same domain.

Group Membership

The IWAM_<computername> account should be a member of this group.

Security Best Practices

Do not modify the default permissions granted to this group because it could stop Configuration Manager 2007 site system roles that require IIS from functioning properly.

See Also

Other Resources

Accounts and Groups in Configuration Manager
Configuration Manager Groups


About the Reporting Users Group

Also called SMS Reporting Users group, this group controls access to the Microsoft System Center Configuration Manager 2007 Reports Web site.

Required Rights and Permissions

The reporting point folders are located under the directory where Internet Information Services is installed, by default, <windir>\inetpub under wwwroot. Configuration Manager 2007 requires the following permissions on both the SMSComponent folder and on the folder you specified when you created the reporting point, by default, SMSReporting_<sitecode>.

  • Read & Execute
  • List Folder Contents
  • Read

The Reporting Users group also requires the following DCOM permissions on the reporting point:

  • Local launch
  • Remote launch
  • Local activation
  • Remote activation

Creation

The group is automatically created on any computer running the reporting point role.

Location

If the reporting point is a member server, it is a local group. If the reporting point is a domain controller, it is a domain local group.

Membership

By default, the Reporting Users group does not have any members.

Any non-administrator user who needs to access reports at that reporting point should be a member of this group. Members of the Administrators group automatically have the required permissions to view the reports and do not need to be added to this group.

For a user or a group to access one or more reporting point servers, that user or group must be a member of the SMS Reporting Users group on the desired reporting point servers.

See Also

Concepts

Reporting in Configuration Manager

Other Resources

Accounts and Groups in Configuration Manager
Configuration Manager Groups


About the Site System to Site Server Connection Group

Topic last updated—March 2008

The Site System to Site Server Connection (SMS_SiteSystemToSiteServerConnection_sitecode) group grants the necessary permissions for Microsoft System Center Configuration Manager 2007 services running on remote site systems (such as management points) to connect to the site server to access the Configuration Manager 2007 registry keys and directories on the site server.

Important
Members of this group have privileged access to site management data. If attackers can take control of any member of this group, it is equivalent to taking control of the site server. Use in-depth defense to protect members of this group. Promptly remove servers from this group when they no longer host server roles that require membership; Configuration Manager 2007 does not remove them.

Required Rights and Permissions

This group requires Read and Write access to the server inboxes.

Creation

The group is created on the Configuration Manager 2007 site server.

Type of Group

If the site server is a member server, it is a local group. If the site server is a domain controller, it is a domain local group.

Membership

Servers hosting the following site system roles should be members of this group, unless they are in a remote, untrusted forest:

  • Management points
  • System Health Validator points
  • State migration points
  • Fallback status points
  • Software update points
  • PXE service points
  • SMS Provider computers
  • Asset Intelligence synchronization point (Configuration Manager 2007 R2)
  • Out of band management point (Configuration Manager 2007 SP1)

Configuration Manager 2007 automatically tries to add these site system computer accounts to the group. If the site system is in a remote, untrusted forest, the site system computer account cannot send data back to the site server. In this case, instead of adding the site system to this group, you must configure the site system properties with the setting Allow only site server initiated data transfers from this site system and then the site server will pull all data from the site system.

Servers hosting reporting points, server locator points, and distribution points are not members by default, and they should not be added to this group because they do not require the privileged access granted to this group.

See Also

Concepts

Checklist for Configuration Manager Account Security
How to Configure Site Systems

Other Resources

Accounts and Groups in Configuration Manager
Configuration Manager Groups


About the Site to Site Connection Group

This group has the necessary permissions for a sender to connect from one Microsoft System Center Configuration Manager 2007 site to another.

Required rights and permissions

This group must have all permissions except Take Ownership and Change Permissions on the SMS\Inboxes\Despoolr.box\Receive folder on the destination site server, which could be a parent site, child site, or grandchild site server.

Group Location

The group is created on the Configuration Manager 2007 site server.

Type of Group

If the site server is a member server, it is a local group. If the site server is a domain controller, it is a domain local group.

Group Membership

Any site address accounts you configure should be members of this group instead of granting those accounts direct permissions.

If you are using the site server computer$ account instead of a site address account, add the computer account of the computer initiating the connection to the Site to Site Connection group on the computer receiving the connection. This means that all child site servers should be added to the Site to Site Connection group on the parent site. Parent site server computer accounts should be added to the Site to Site Connection group on all direct children. If you plan to specify addresses to connect from a site to a grandchild site, add the grandparent site server computer account to the Site to Site Connection group on the grandchild site.

During installation of a secondary site, Configuration Manager 2007 automatically adds the computer account of the parent site to the Site to Site Connection group on the secondary site. If you initiate the installation of the secondary site from the parent site, Configuration Manager 2007 also adds the computer account of the secondary site to the Site to Site Connection group on the parent site.


About the SMS Admins Group

Topic last updated -- November 2007

SMS Admins provides its members with access to the SMS Provider, through WMI. Access to the SMS Provider is required for viewing and modifying Microsoft System Center Configuration Manager 2007 security objects and data in the Configuration Manager 2007 console.

Note
Service Manager uses the security context of the logged on user instead of the SMS Admins group when making a connection.

Required rights and permissions

SMS Admins rights and permissions are set in the WMI Control MMC snap-in. By default, Everyone has Execute Methods, Provider Write, and Enable Account permissions. After the user connects to the SMS Provider, the user is granted access based on the object security rights defined in the Configuration Manager 2007 console. The SMS Admins group is explicitly granted Enable Account and Remote Enable on the Root\SMS namespace.

Note
Any administrators who will use a remote Configuration Manager console require Remote Activation DCOM permissions on both the site server computer and SMS Provider computer. While you can grant these rights to any user or group, you should grant them to SMS Admins to simplify administration. Any user added to SMS Admins should be trusted enough to allow Remote Activation. For more information, see How to Configure DCOM Permissions for Configuration Manager Console Connections.

Group Location

The group is created on the site server and on the computer running the SMS Provider.

Type of Group

If the SMS Provider computer is a member server, SMS Admins is a local group. If the SMS Provider computer is a domain controller, SMS Admins is a domain local group.

Membership

Anyone who needs to access the Configuration Manager 2007 Administrator console should be added to this group.

When granting rights to objects in the Configuration Manager 2007 console, you can assign permissions to users, local groups, global groups, universal groups, and nested global groups. When you use the Manage ConfigMgr Users wizard to add security rights to users or groups, if the SMS Provider is installed on the site server, Configuration Manager 2007 attempts to add the user or group to the SMS Admins group. However, if you assign rights to a local group, Configuration Manager 2007 cannot add a local group to the local group SMS Admins and you get an error message. If you create your own local group or domain local group to provide access to the Configuration Manager 2007 console, you must also assign that local or domain local group the same WMI permission as the SMS Admins group.

Important
If you assign Configuration Manager 2007 Object permissions using the Clone ConfigMgr User Wizard, Configuration Manager 2007 does not automatically add the cloned user to the SMS Admins group. If you change the class and instance rights directly on an object in the Configuration Manager 2007 console, Configuration Manager 2007 does not automatically add the user to the SMS Admins group.

See Also

Tasks

How to Configure DCOM Permissions for Configuration Manager Console Connections


Windows Accounts Used by Configuration Manager

Microsoft System Center Configuration Manager 2007 relies on several accounts that are created and maintained by the operating system but are never actually configured in the Configuration Manager 2007 console, for example the Local System account which is the security principal for the operating system. When you install Configuration Manager 2007, you must use an existing Windows account that will gain full rights to the Configuration Manager 2007 console after installation is complete.

In This Section

About the Account Used To Install Configuration Manager

Describes the requirements for the account used to install Configuration Manager 2007.

About the Accounts Used to Run the Configuration Manager Console

Describes the requirements for the accounts used to run the Configuration Manager 2007 console.

About the Internet Guest Account in Configuration Manager

Describes the Internet Guest Account (IUSR_<computername>)and how it is used by Configuration Manager 2007.

About the Local System Account/Computer$ in Configuration Manager

Describes the Windows Local System Account (Computer$) and how it is used by Configuration Manager 2007.

About the Local Service Account in Configuration Manager

Describes the Windows Local Service Account and how it is used by Configuration Manager 2007.

About the Network Service Account in Configuration Manager

Describes the Windows Network Service Account and how it is used by Configuration Manager 2007.

See Also

Other Resources

Accounts and Groups in Configuration Manager


About the Account Used To Install Configuration Manager

You must have a Windows account to log in and run Microsoft System Center Configuration Manager 2007 Setup.

Required rights and permissions

The account logged on when Configuration Manager 2007 is installed must be a domain user. If Configuration Manager is installed on a computer where the logged-on user account is a local account and not part of a domain, Setup might appear to succeed, but access to the Configuration Manager console fails and you will need to reinstall.

This account must have administrative rights on the site server and be a member of Sysadmins on SQL Server.

During Setup, the account is automatically added to the SMS Admins group.

After a fresh installation, the account will be the only user account with rights to the Configuration Manager 2007 console. If you are upgrading from a previous version, other administrators retain their existing rights to the console but are not automatically granted new rights to new objects.

Note
This is true even for software updates objects. Users who had full rights to all SMS 2003 software updates objects will have full rights to the same objects in Configuration Manager 2007 but will not have any rights to new object types such as templates.

Account and password creation

The account must exist prior to running Configuration Manager 2007 Setup.

Important
Configuring this account to use a roaming profile is not supported when Group Policy is configured to Delete cached copies of roaming profiles on the site server computer.

Account location

The account must be created in the Active Directory Domain Services database. The account must have administrator rights on the following computers.

  • The site server computer
  • The computer running SQL Server, if it is remote from the site server
  • The SMS Provider computer, if it is not installed on the site server or site database server

Account maintenance

The account is created and maintained in Active Directory Domain Services by a domain administrator.

Security best practices

Use a complex password.

After Setup, if you need to remove Configuration Manager 2007 rights from the account, add those rights to another account first.

See Also

Other Resources

Accounts and Groups in Configuration Manager
Configuration Manager Tasks for Deploying a Single Site
Windows Accounts Used by Configuration Manager


About the Accounts Used to Run the Configuration Manager Console

Topic last updated—March 2008

Microsoft System Center Configuration Manager 2007 administrators can use the Configuration Manager 2007 console to manage Configuration Manager 2007 sites. By default, the only Configuration Manager console user is the user who ran Setup, but most organizations will have more than one user who needs access to the Configuration Manager 2007 console.

Required Rights and Permissions

Console users must be members of the SMS Admins group or of a group with equivalent rights and permissions. Also, any administrators who will use a remote Configuration Manager console require Remote Activation DCOM permissions on both the site server computer and the SMS Provider computer. For more information, see How to Configure DCOM Permissions for Configuration Manager Console Connections.

Simply adding a user to the SMS Admins group is not enough to access objects in the Configuration Manager 2007 console. These users must also be granted Configuration Manager 2007 security rights to all objects that the administrators will manage. For more information, see How to Assign Rights for Objects to Users and Groups.

Users of the Configuration Manager 2007 console do not require administrative rights to the Configuration Manager 2007 console computer. However, if the user does not have local administrator rights, the user must first run Microsoft Management Console (MMC) and then add the Configuration Manager 2007 snap-in to create a new console session. The user can then save the console session and run the new session without administrator rights on the local computer.

However, when you try to create task sequence media, if you are not an administrator on the computer where you are running the Configuration Manager 2007 console, you will get the error "The hash value is not correct" when trying to create task sequence media.

In Configuration Manager 2007 SP1, your account must be configured as an AMT user account if you want to run the out of band management console.

Account and password creation

The accounts are created and maintained by the network account administrator.

Account location

The accounts are typically domain accounts.

Account maintenance

The accounts are created and maintained in Active Directory Domain Services by a domain admininistrator.

Security best practices

Use complex passwords for these accounts.

Closely monitor the users who have access to the Configuration Manager 2007 console because there is no defense against a trusted administrator. Conduct background checks before hiring Configuration Manager 2007 administrators. Conduct security audits of their administrative activity.

Always have at least one user who has full rights to all Configuration Manager 2007 objects.

Assign the minimum Configuration Manager 2007 security rights for the user to perform Configuration Manager 2007 administration. Use role separation whenever possible.

See Also

Concepts

About the AMT User Accounts

Other Resources

Accounts and Groups in Configuration Manager
Using the Configuration Manager Console
Windows Accounts Used by Configuration Manager


About the Internet Guest Account in Configuration Manager

Topic last updated—November 2007

The Internet Guest account IUSR_<computername> is used by Microsoft System Center Configuration Manager 2007 clients for anonymous access to BITS-enabled distribution points when accessing content without using Windows authentication. For example, in native mode, Configuration Manager 2007 client computers are authenticated by their PKI certificates. Because the PKI certificate is not mapped to a user or computer account, Configuration Manager 2007 native mode clients that access the content over HTTP use anonymous access from the Internet Guest account. (If the distribution point is not BITS-enabled or if the client cannot access the content over HTTP, the client can fall back to using server message blocks (SMBs), in which case clients use Windows authentication.) Also, when mobile device clients need to access content on distribution points, the mobile devices have no security context, so Configuration Manager 2007 has to give them anonymous access using the virtual directory configuration.

Required Rights and Permissions

If the distribution point is configured to allow anonymous access for mobile device clients, IUSR_<computername> must have access to the package or the advertisement will fail to run on mobile device clients.

If you support Internet-based clients, the package will fail if the IUSR account does not have NTFS permissions. In most cases, this is the desired result. For example, a user who works out of a home office and does not have an account in the organization's domain cannot be added to security groups. If security groups are used to restrict package access, the user is not a member and does not have NTFS permissions to the package. If you want the user to access the package, the package access must happen anonymously. The client will be allowed anonymous access only if it first presents a valid client authentication certificate.

Important
Internet-based clients must use certificates to authenticate and then download the package using anonymous access, so Package Access Accounts cannot be used to restrict access based on user or group accounts.

If you remove the Internet Guest account from the Users group or if you remove the Users group as a Package Access Account, you can add the Internet Guest account explicitly to the package as a package access account with whatever permissions are required to access the package. Before doing so, verify that this will produce the desired results and is consistent with your security policy and your package access policy.

Important
By default, the Internet Guest account is granted rights to Internet Information Services (IIS) resources, such as virtual directories. Removing the default permissions from the Internet Guest account to IIS resources used by Configuration Manager 2007 might cause Configuration Manager 2007 operations to fail and is not supported.

Account and Password Creation

The account is created automatically when IIS is installed. The password is created by the server and is set to never expire.

Account Location

The account is created on any server with IIS installed.

Account Maintenance

If the IUSR account becomes out of sync because of an attempted manual removal of IIS or a failed attempt to reset the password, it is possible to perform a manual reset. The password is stored in the IIS metabase and in the accounts database (Active Directory Domain Services if IIS is on a domain controller or the local account database on a member server). If you change the password in the user interface, you should use Metabase Explorer to reset the IUSR password in the metabase.xml or metabase.bin file. For more information, see http://go.microsoft.com/fwlink/?LinkId=102502.

See Also

Concepts

Example Package Access Scenarios

Other Resources

Windows Accounts Used by Configuration Manager


About the Local System Account/Computer$ in Configuration Manager

The Local System account is a powerful account that has full access to the computer. In Microsoft System Center Configuration Manager 2007 it is used to start services and provide security context for those services, and to perform many Configuration Manager 2007 operations on the site server, site systems, and client computers.

The actual name of the account is NT AUTHORITY\System.

The Local System account does not have any rights to access the network. When network access is necessary, Local System uses the account Domain\computername$.

With the release of Windows Server 2003, two new built-in account types similar to Local System were added: the Network Service account and the Local Service account. For more information about how Configuration Manager 2007 uses these accounts, see About the Local Service Account in Configuration Manager and About the Network Service Account in Configuration Manager. For more information about these accounts, see http://go.microsoft.com/fwlink/?LinkId=93067.

Local System Functions

Local System inherently has all required rights and permissions on the local computer. Removing any of those rights or permissions can cause Configuration Manager 2007 or the operating system to stop functioning.

The following Configuration Manager 2007 services, if used, are configured to log on as LocalSystem:

  • CCMSetup.exe
  • SMS Agent Host
  • SMS Task Sequence Agent
  • SMS_EXECUTIVE
  • SMS_REPORTING_POINT
  • SMS_SERVER_LOCATOR_POINT
  • SMS_SITE_BACKUP
  • SMS_SITE_VSS_WRITER
  • SMS_SITE_COMPONENT_MANAGER
  • SMS_SERVER_BOOTSTRAP_<servername>
Important
If you change the default service settings, you might prevent key services from running correctly. Changing the Startup type and Log on as settings for Configuration Manager 2007 services is not supported.

In addition to providing the security context for Configuration Manager 2007 services, the Local System account performs the following functions:

  • Creates files, directories, and services on the site systems.
  • Provides the security account for the application pools required by site systems that use IIS

Site Server Computer (computername$) Functions

Function Required rights and permissions Notes

Accesses Active Directory Domain Services containers during any type of Active Directory discovery

Read access to the containers that you specify for discovery. When computer account is used in domains other than the domains in which the site server is located, the account must have user rights on those domains.

The account must be a member of at least the Domain Users group or local Users group on the domains.

Access the DHCP server for DHCP Network Discovery

Must be a member of DHCP users on the DHCP server.

Creates and populates the System Management container in Active Directory.

If you extend the schema, enable publishing, and grant the computername$ account Full Control on the System container and all child objects, it can automatically create the System Management container underneath.

To follow the principle of least privilege, manually create the System Management container under the System container, instead of letting Configuration Manager create it. Then grant the site server computer account full rights to the System Management container and all child objects.

Accesses source files when creating packages for software distribution.

Read and List Folder Contents permissions on all source files and directories

Communicates with parent and child sites.

Read, Write, Execute, and Delete permissions on the SMS\Inboxes\Despoolr.box\Receive folder on the destination site server

Add the Site Address Account to the Site to Site Connection group on the destination site server, which has the appropriate permissions on the SMS_Site shared folder.

You can create and use a Site Address account, but then you will have to maintain the account and password.

Installs secondary sites when site creation is initiated from the Configuration Manager console.

Local administrator rights on the secondary site server

If you run Setup on the secondary site server, this account does not need local administrator rights on the secondary site server.

Installs remote site systems

Local administrator rights on the remote site system

If you are configuring site systems in remote untrusted forests, you must use the Site System Installation account instead. For more information, see Site System Installation Account.

Retrieves data from site systems, if configured

Local administrator rights on the remote site system

If you check Allow only site server initiated data transfers from this site system on the site system General tab, Configuration Manager pulls the data from the site system instead of waiting for the site system to push the data. If a Site System Installation account is configured, Configuration Manager uses that account instead.

Creates and configures the site database

Membership in Sysadmins on the SQL Server, if the site database is on a remote computer.

You must create a SQL Server login for the site server computer account and add it to the Sysadmins role.

Site System Computer (computer$) Functions

Function Required rights and permissions Notes

Provides access to the site database for the following site roles:

  • Management points (including device management point)
  • Reporting points
  • Server locator points
  • PXE service points
  • State migration points

The site system computer account is automatically added to the corresponding database role. The database role has all required rights and permissions.

The management point, PXE service point, and server locator point can be configured to use a Database Connection account instead of Local System. For more information, see About the Management Point Database Connection Account, About the Server Locator Point Database Connection Account, or About the PXE Service Point Database Connection Account.

The following site roles use the site system computer$ account to push data back to the site server:

  • Management points
  • Device management points
  • PXE service points
  • State migration points
  • System Health Validator points
  • Software update points
  • Fallback status point

Membership in the Site System to Site Server Connection group

If you are configuring site systems in remote untrusted forests, you cannot add the site system computer$ account to the Site System to Site Server Connection group, so you must check Allow only site server initiated data transfers from this site system on the site system General tab.

Creation and Password

The account is created automatically and the password is managed by the operating system.

Account Location

Local System is a local account. If the computer is a domain member, the computer$ account is created in the domain that the computer belongs to.

Account Maintenance

The operating system maintains its own accounts and passwords. Occasionally, however, the computer$ account password can become unsynchronized with the domain controller and the secure communication channel must be reset between the member computer and the domain controller. For more information about resetting computer accounts, see the Microsoft Knowledge Base http://go.microsoft.com/fwlink/?LinkId=93062.

Security Best Practices

Configuration Manager 2007 does not require that any computer accounts be added to the Domain Admins group. When a computer account requires administrative rights, for example on a remote site server, add the account to the appropriate local group.

Do not remove rights and permissions from Local System. Changing the default rights and permissions could prevent the operating system and applications from functioning.

Minimize the use of the Local System account on the site servers and site systems by not installing other services that use the Local System account. This ensures that other processes cannot take advantage of the enhanced privileges of the system’s computer account, accessing Configuration Manager 2007 files and data through those other systems.

Configure SQL Server to run under a domain user account instead of Local System.

See Also

Concepts

About the Site System Installation Account

Other Resources

Accounts and Groups in Configuration Manager
Windows Accounts Used by Configuration Manager


About the Local Service Account in Configuration Manager

Microsoft System Center Configuration Manager 2007 uses the Local Service account to run several application pools used by site systems that require Internet Information Services (IIS). The Local Service account is a special built-in account that has reduced privileges similar to an authenticated local user account. This limited access helps safeguard the computer if an attacker compromises individual services or processes.

Required Rights and Permissions

Local Service requires the following rights and permissions on virtual directories in the Web site used by Configuration Manager 2007, either the default Web sit or a custom Web site.

Virtual Directory | Permissions
CCM_Client | Read
CCM_Incoming | Local Service requires the following permissions on the virtual directory folder: Traverse Folder/Execute File List Folder/Read Data Read Attributes Read Extended Attributes Create Files/Write Data Create Folders/Append Data Delete Subfolders and Files Read Permissions Local Service also requires full control on all subfolders and files of the virtual directory folder.
CCM_Outgoing | Read
CCM_System | List Folder Contents
CCM_System_WindowsAuth | List Folder Contents
SMS_MP | List Folder Contents
SMS_SLP | List Folder Contents
SMS_FSP | List Folder Contents

Account and Password Creation

The account is automatically created as NT AUTHORITY\LocalService, and it does not have a password that an administrator needs to manage.

Account Location

This account is automatically created as a local account on Microsoft Windows Server 2003 and Windows XP operating systems.

Account Maintenance

No maintenance is required for this system account.


About the Network Service Account in Configuration Manager

Microsoft System Center Configuration Manager 2007 uses the Network Service account to run the SMS_System_Health_Validator service on the Network Policy Server when it is configured as the Configuration Manager 2007 System Health Validator point. The Network Service account is a special built-in account that has reduced privileges similar to an authenticated user account. This limited access helps safeguard the computer if an attacker compromises individual services or processes.

Configuration Manager 2007 also uses this security context to connect to Active Directory Domain Services resources in trusted domains, although the connection is made using the Domain\computer$ account. If the System Health Validator point needs to connect to Active Directory Domain Resources in domains with no trust relationships, you must configure the System Health Validator Publishing account or the System Health Validator Querying account.

Required Rights and Permissions

The Network Service account uses the computer's credentials when it authenticates remotely, but it has a greatly reduced privilege level on the server itself and, therefore, does not have local administrator privileges. Configuration Manager 2007 does not require the Network Service account to have any rights or permissions except the default permissions assigned by the operating system. Removing the default rights or permissions from the Network Service account might cause Configuration Manager 2007 to stop functioning properly.

This account requires Read access to the Configuration Manager 2007 Systems Management container in the Global Catalog server.

Account and Password Creation

The account is automatically created as NT AUTHORITY\NetworkService, and it does not have a password that an administrator needs to manage.

Account Location

This account is automatically created as a local account on Microsoft Windows Server 2003 and Windows XP operating systems.

Account Maintenance

No maintenance is required for this system account.


Security Checklists for Configuration Manager

If you are experienced with Microsoft System Center Configuration Manager 2007 concepts and security procedures, you might be able to work directly from the following checklists and use this guide as reference information.

In This Section

Checklist for Security Best Practices

A checklist that summarizes the best practices described in Security Best Practices for Configuration Manager

Checklist for Configuration Manager Feature Security Best Practices

A checklist that summarizes the best practices described in Security Best Practices and Privacy Information for Configuration Manager Features

Checklist for Configuration Manager Account Security

A checklist to help verify that all of the necessary accounts and groups are configured for Configuration Manager 2007

See Also

Other Resources

Security and Privacy for Configuration Manager 2007


Checklist for Security Best Practices

Topic last updated -- August 2007

Use this checklist to verify that your Microsoft System Center Configuration Manager 2007 environment conforms to the recommended security best practices. This topic supports and summarizes content in the Security and Privacy for Configuration Manager 2007 section of the Configuration Manager Documentation Library. Before implementing these best practices in your environment, test them thoroughly.

If you are experienced with Configuration Manager 2007 concepts and security procedures, you might be able to work directly from this checklist and use this guide as reference information.

Recommended Security Configuration

Configuration Manager Security and Privacy Planning

□ | Use native mode throughout the hierarchy
□ | Extend the Active Directory schema for Configuration Manager 2007 and enable Active Directory publishing
□ | Do not use workgroup clients or clients in other forests because they cannot query Active Directory
□ | Use IPsec to secure communications between site systems.

Best Practices for Security Fundamentals

Best Practices for Security Fundamentals

□ | Physically secure your computers
□ | Apply the most recent security updates to all computers
□ | Protect against unauthorized administrators
□ | Enforce role separation to limit administrative exposure
□ | Design for defense in depth
□ | Create and maintain secure baselines for all systems
□ | Use strong passwords or pass phrases
□ | Control access to exported files
□ | Secure package source files

Best Practices for Hierarchy Security

Best Practices for Hierarchy Security

□ | Isolate sites in high security environments
□ | Use the fewest sites possible
□ | Avoid having sites span forests
□ | Require secure key exchange between all sites in the hierarchy
□ | In mixed mode, upgrade all clients to Configuration Manager 2007 and configure the site to contain only ConfigMgr 2007 clients
□ | Upgrade all sites to Configuration Manager 2007

Best Practices for Service Continuity

Best Practices for Service Continuity

□ | Design a fault tolerant site
□ | Create a backup and recovery plan
□ | Secure your backup media
□ | Use role separation to increase recoverability

Best Practices for Securing Communications

Best Practices for Securing Communications

□ | Use native mode
□ | Require Secure Key Exchange
□ | Consider using nondefault port numbers for client communication
□ | If clients cannot query Active Directory, manage the trusted root key provisioning process
□ | Use IPsec to secure communications between site systems
□ | Configure your firewalls to permit required Configuration Manager traffic
□ | Secure the communication channel between the site server and package source server
□ | Secure the communication channel between the Setup media and the site server

Best Practices for Securing Site Systems

Best Practices for Securing Site Systems

□ | Use role separation on site systems
□ | Reduce the attack profile
□ | Run the Security Configuration Wizard on all site systems, using the Configuration Manager 2007 template
□ | Use NTFS for all site systems
□ | Do not remove the admin$ share on site systems
□ | Closely monitor Internet-based site settings on site systems
□ | Configure static IP addresses for site systems
□ | Use FQDN server names
□ | Do not install other services that use the local system account

Best Practices for Site Server

□ | Install Configuration Manager 2007 on a member server instead of a domain controller
□ | Install secondary sites at the secondary site server instead of using push installation

Best Practices for SQL Server

□

Use a dedicated SQL Server for each site

□

Do not use the Configuration Manager site database server to run other SQL Server applications

□

Configure SQL Server to use Windows authentication

□

Install Configuration Manager and SQL Server on the same computer

□

Follow security best practices for SQL Server, noting the following issues:

  • The site server computer account must be a member of the Administrators group on the computer running SQL Server
  • If you install SQL Server using a domain user account, you must ensure that a Service Principal Name (SPN) is populated to Active Directory Domain Services

Best Practices for Site Systems Requiring IIS

□ | Disable IIS functions that you do not require
□ | Do not put the site server on a computer with IIS
□ | Use dedicated IIS servers for Configuration Manager

Best Practices for Management Points

□ | In a single site hierarchy that requires trusted root key authentication, always use a separate management point
□ | If this site system role is configured in a perimeter network, configure the site server to retrieve the data from the site system
□ | Use the fewest management points possible

Best Practices for Fallback Status Point

□ | Do not co-locate any other site system roles with the fallback status point
□ | Do not install the fallback status point on a domain controller
□ | In native mode, deploy the fallback status point prior to deploying clients
□ | Avoid using the fallback status point in the perimeter network

Best Practices for Server Locator Point

□

Do not put a server locator point in the perimeter network

Best Practices for Securing Clients

The following section applies only to client computers. For information about mobile device clients, see Mobile Device Clients Security Best Practices and Privacy Information. For details about this checklist, see Best Practices for Securing Clients.

Best Practices for Mixed Mode

□ | Automatically approve clients from trusted domains
□ | Do not rely on blocking to prevent clients from accessing the site
□ | Upgrade all clients to Configuration Manager 2007 and select This site contains only ConfigMgr 2007 clients

Best Practices for Native Mode

□ | Use native mode whenever possible
□ | Configure all distribution points to use BITS
□ | Do not enable "HTTP communication for roaming and site assignment"
□ | Follow the recommended best practices for certificate management

Best Practices for All Client Computers

□ | Choose a client installation method that fits your risk profile
□ | Remove certificates prior to imaging clients
□ | Configure client computers to use Active Directory Only mode
□ | Ensure maintenance windows are large enough to deploy critical software updates

Best Practices for Securing Internet-Based Clients

Best Practices for Securing Internet-Based Clients

□ | Use SSL bridging to SSL, using termination with authentication
□ | Use Active Directory to deploy the site server signing certificate
□ | Do not create distribution point shares or branch distribution points on Internet-based clients
□ | Do not use site systems that bridge the perimeter network and intranet

Best Practices for Securing Name Resolution

Best Practices for Securing Name Resolution

□ | Do not rely on WINS for name resolution
□ | Specify FQDNs for all site systems and senders

Best Practices for Certificate Management

Best Practices for Certificate Management

□ | Carefully plan for and secure your PKI
□ | Follow industry and organizational best practices for certificate management
□ | Enable CRL checking on native mode clients
□ | Protect the integrity of your client authentication certificates
□ | Use a certificate trust list to define the trusted root certification authorities
□ | Use Active Directory to deploy the site server signing certificate
□ | Guard the security of the site server signing certificate
□ | Use a new key pair when renewing the site server signing certificate
□ | Verify that all certificates are stored in secure certificate stores

Best Practices for Maintaining Configuration Manager Security

Best Practices for Maintaining Configuration Manager Security

□

Create security policies and adhere to them

□

Use a test lab to test future change configurations for security concerns

□

Secure your test lab

□

Test your backup and recovery procedures

□

Secure your backup media

□

Review your Configuration Manager settings

□

Review audit logs

□

Periodically test Configuration Manager security

□

Develop an incident response plan

□

Secure your internal Configuration Manager documentation

□

Train your organization to follow security best practices

□

Monitor Configuration Manager operations:

  • Security rights created, modified, or deleted
  • Advertisements created, modified, or deleted
  • Packages created, modified, or deleted
  • Programs created, modified, or deleted
  • Clients that (failed to run) (failed to start) a specific advertised program
  • Server component configuration changes
  • Client component configuration changes
  • Remote tools activity (all)
  • Site addresses created, modified or deleted
  • Site boundaries created, modified or deleted
  • SQL commands created, modified or deleted
  • SQL tasks created, modified, or deleted
  • All audit status messages (for a specific user) (from a specific site)

See Also

Other Resources

How to Manage the Trusted Root Key in Configuration Manager
Security Best Practices for Configuration Manager
Security Checklists for Configuration Manager
Tasks for Configuration Manager Security


Checklist for Configuration Manager Feature Security Best Practices

Topic last updated—March 2008

Use this checklist to verify that your Microsoft System Center Configuration Manager 2007 environment conforms to the recommended security best practices for Configuration Manager 2007 features. This topic supports and summarizes content in the Security and Privacy for Configuration Manager 2007 section of the Configuration Manager Documentation Library. Before implementing these best practices in your environment, test them thoroughly.

If you are experienced with Configuration Manager 2007 concepts and security procedures, you might be able to work directly from this checklist and use this guide as reference information.

Configuration Manager Console Security Best Practices

Configuration Manager Console Security Best Practices and Privacy Information

□ | Always use an account with least permissions when running the Configuration Manager console
□ | Do not allow users who are not administrators to use the Configuration Manager console on the site server
□ | Limit Web browsing from the Configuration Manager console
□ | Do not allow low rights Terminal Service users to establish connections with site system roles
□ | Protect the XML output from the Transfer Site Settings wizard
□ | Do not allow users who are not administrators to access the site server via Remote Desktop or Terminal Services

Software Distribution Security Best Practices

Software Distribution Security Best Practices and Privacy Information

□ | Always configure advertisements to download content
□ | Do not allow users to interact with programs if run with administrative rights is required
□ | Do not create subcollections if you need to restrict software distribution on them
□ | Set package access permissions at package creation
□ | Secure software at the package access level
□ | After upgrading, if you had packages in SMS 2003, update all packages

Best Practices for Distribution Points

□ | Remove the distribution point role from the site server
□ | Do not create distribution point shares or branch distribution points on Internet-based clients
□ | After switching to a custom Web site, remove the default virtual directories
□ | Implement access controls to protect branch distribution points
□ | Enable the encrypted mode for Application Virtualization Streaming enabled distribution points

Software Updates Security Best Practices

Software Updates Security Best Practices and Privacy Information

□ | Do not change the default permissions on software update packages
□ | Control access to the download location for software updates
□ | Use UTC for evaluating deployment times
□ | Follow best practices for securing WSUS
□ | Enable CRL checking
□ | If the software update point is configured in a perimeter network, configure the site server to retrieve the data from the site system
□ | If you must deploy software updates to SMS 2003 clients, run the Inventory Tool for Microsoft Updates on a primary site server that is highest in the hierarchy
□ | Configure WSUS to use a custom web site
□ | Enable BITS 2.5 for the site and the distribution points

Operating System Deployment Security Best Practices

Operating System Deployment Security Best Practices and Privacy Information

□ | Implement access controls to protect bootable media
□ | If the client certificate is compromised, block the certificate
□ | Secure the communication channel between the site server and the PXE service point
□ | Use PXE service points only on secure network segments
□ | Configure the PXE service point to respond to PXE requests only on specified network interfaces
□ | Require a password to PXE boot
□ | Manually delete state migration point folders when they are decommissioned
□ | Do not configure the deletion policy to delete user state immediately
□ | Control physical access to computers using USB flash drives for task sequences
□ | Implement access controls to protect the reference computer imaging process
□ | Always install the most recent security updates on the reference computer
□ | Monitor for unauthorized multicast-enabled distribution points
□ | If you must deploy operating systems to unknown computer, implement access controls to prevent unauthorized computers from connecting to the network
□ | Always configure task sequence advertisements to download content
□ | Enable encryption for multicast packages

Asset Intelligence Security Best Practices

Asset Intelligence Security Best Practices and Privacy Information

□ | Protect the registration certificate
□ |

Reporting Security Best Practices

Reporting Security Best Practices

□ | Restrict queries and reports to authorized viewers
□ | Use the reporting users group to control access to the reporting point
□ | Manage security for users who connect directly to the SQL Server computer
□ | Enable HTTPS access for reporting points

Desired Configuration Management Security Best Practices

Desired Configuration Management Security Best Practices and Privacy Information

□

Sign configuration data to verify the integrity of your configuration items

Mobile Device Clients Security Best Practices

Mobile Device Clients Security Best Practices and Privacy Information

□ | Use native mode whenever possible
□ | Require mobile device clients to use passwords

Network Access Protection Security Best Practices

Network Access Protection Security Best Practices

□ | Do not rely on NAP to secure a network from malicious users
□ | Use consistent NAP policies throughout the site hierarchy to minimize confusion
□ | Do not enable the Network Access Protection client agent immediately on new Configuration Manager sites
□ | Do not rely on NAP as an instantaneous or real-time enforcement mechanism

Inventory Security Best Practices

Inventory Security Best Practices and Privacy Information

□ | Enable inventory encryption
□ | Disable IDMIF and NOIDMIF collection
□ | Do not use file collection to collect critical files or sensitive information
□ | Do not use file collection to collect critical files or sensitive information

Remote Tools Security Best Practices

Remote Tools Security Best Practices and Privacy Information

□ | Use either Group Policy or Configuration Manager to configure Remote Assistance settings, but not both
□ | Do not consider the “Ask for permission” setting to be adequate security for remote tools for Windows 2000 clients
□ | Enable "Ask for permission" setting
□ | Enable notification
□ | Prevent users from changing policy or notification settings
□ | Limit the Permitted Viewers list
□ | Specify required global groups
□ | Specify the domain context for user accounts
□ | Do not rely on collection security to control remote tools access
□ | Do not enter passwords for privileged accounts when remotely administering Windows 2000 computers

Wake On LAN Security Best Practices

Wake On LAN Security Best Practices

□ | Use unicast for sending wake-up packets
□ | If you must use subnet-directed broadcasts, configure routers to allow IP-directed broadcasts only from the site server and only on a non-default port number

Out of Band Management Security Best Practices

Out of Band Management Security Best Practices and Privacy Information

□ | Use in-band provisioning instead of out of band provisioning
□ | Control the request and installation of the provisioning certificate
□ | Ensure that you request a new provisioning certificate before the existing certificate expires
□ | If the AMT provisioning certificate is revoked, delete it from the certificate store on the out of band service point site system server and reconfigure the out of band management component with a valid AMT provisioning certificate
□ | Use out of band management instead of Wake On LAN
□ | Change the default provisioning server
□ | Configure an alternate port for server provisioning
□ | Restrict who has the Media Redirection right

See Also

Other Resources

Security Best Practices and Privacy Information for Configuration Manager Features
Security Checklists for Configuration Manager


Checklist for Configuration Manager Account Security

Topic last updated—November 2007

If you are experiencing errors in Microsoft System Center Configuration Manager 2007, a common cause is improperly configured security access. The following checklist can help you verify that you have the correct account and group configuration for Configuration Manager 2007.

Account Checklist

Check Details

Verify that the computer accounts for the following site roles are added to Site System to Site Server Connection group.

  • Fallback status points
  • Management points
  • PXE service points
  • Site database server (if on a remote computer)
  • SMS Provider computer
  • Software update points
  • State migration points
  • System Health Validator points

If no trust relationship exists between the site system role domain and the site server domain, you will not be able to add these accounts to the Site System to Site Server Connection group. In this case, you must configure the site system setting Allow only site server initiated data transfers from this site system on the General tab of the site system properties, which configures the site server to pull data from the site role instead of having the site system role push data back to the site server. For more information, see About the Site System to Site Server Connection Group.

Verify that all sites have accounts configured for site-to-site communications (if there are multiple sites in the hierarchy)

If your site servers are in the same forest, you should use the site server computer$ account for site-to-site communications.

If the site servers are in different forests, even if there is a trust relationship, use the Site Address account.

Whichever account you use, verify that it is a member of the Site to Site Connection group.

A child site sends only to the parent site, but a parent site might initiate site-to-site communications with a child or grandchild site and require membership in the Site to Site Connection group on grandchild sites.

If you specify a domain user account as the Site Address account and then later decide you want to use the computer account as the Site Address account, you must delete the address and recreate it. Changing the account name is not sufficient when switching from a user account to the computername$ account.

For more information, see About the Site Address Account.

Verify that the computer account for the site server is added to the local Administrators group for the following site system roles:

  • Distribution points
  • Fallback status points
  • Management points
  • PXE service points
  • Reporting points
  • Server locator points
  • Site database server
  • SMS Provider computer
  • Software update points
  • State migration points
  • System Health Validator points

If all computers are in the same forest, you must manually add the site server computer$ account to each local Administrators group. You should complete this step before configuring the computer as a site system.

If the site system is in a different forest than the site server, configure a Site System Installation Account on the site system properties and add the Site System Installation Account to each local Administrators group. For more information, see About the Site System Installation Account.

If you must use database connection accounts, manually add them to the SQL role.

  • Management points: smsdbrole_MP
  • Server locator points: smsdbrole_SLP
  • PXE service point: smsdbrole_PSP

By default, Configuration Manager 2007 uses the site system computer$ account to connect to the site database and automatically adds that computer$ account to the matching SQL Server role on the database. If you create a connection account, the accounts are not automatically added to the corresponding role.

For more information, see About the Management Point Database Connection Account, About the PXE Service Point Database Connection Account, and About the Server Locator Point Database Connection Account.

If you have extended your Active Directory schema, grant the site server computer account permissions to publish in Active Directory Domain Services

For more information, see How to Set Security on the System Management Container in Active Directory Domain Services.

Verify that the required IIS accounts are enabled and have default permissions on all site systems that require IIS.

Configuration Manager 2007 requires the Internet Guest Account and the IIS Worker Process Group. If these groups have been disabled or have had their default rights and permissions restricted, Configuration Manager 2007 site roles might not function properly. For more information, see About the Internet Guest Account in Configuration Manager and About the IIS Worker Process Group in Configuration Manager.

Verify that appropriate users are added to the SMS Admins group.

Restrict access to the SMS Admins group to as few members as possible. However, if a user must access the Configuration Manager 2007 console, they must be members of this group to have the rights to access objects in the console. If you grant a user the rights to manage an object and they are not in the SMS Admins group, they cannot access the object. For more information, see About the SMS Admins Group.

Add users to reporting users if they need to access only reports and not the Configuration Manager 2007 console

Reporting Users controls access to the Configuration Manager 2007 Reports Web site. Because Reporting Users is a local group, you must add users to each reporting point individually if they require access to more than one. For more information, see About the Reporting Users Group.

If you remove the Internet Guest account from the Users group or if you remove the Users group as a package access account, add the Internet Guest account explicitly to the package as a package access account with whatever permissions are required to access to the package.

The Internet Guest account IUSR_<computername> is used by Microsoft System Center Configuration Manager 2007 clients for anonymous access to BITS-enabled distribution points when accessing content without using Windows authentication. For more information, see About the Internet Guest Account in Configuration Manager.

If you upgraded from SMS 2003, verify that administrators have rights to objects new to Configuration Manager 2007.

After a fresh installation, the account will be the only user account with rights to the Configuration Manager 2007 console. If you are upgrading from a previous version, other administrators retain their existing rights to the console but are not automatically granted new rights to new objects. For more information, see How to Assign Rights for Objects to Users and Groups.

Verify that administrators who will use a remote Configuration Manager console have Remote Activation DCOM permissions on both the site server computer and SMS Provider computer.

For more information, see How to Configure DCOM Permissions for Configuration Manager Console Connections.

Verify that each account is using the least possible permissions.

For more information, see Accounts and Groups in Configuration Manager.

Security Best Practices for Accounts

□

Add users to the Permitted Viewers list instead of adding them directly to the ConfigMgr Remote Control Users Group

□

After Setup, if you need to remove Configuration Manager 2007 rights from the account used to install Configuration Manager, add those rights to another account first

□

Always have at least one user who has full rights to all Configuration Manager 2007 objects

□

Assign the minimum Configuration Manager 2007 security rights for the user to perform Configuration Manager 2007 administration. Use role separation whenever possible.

□

Closely monitor the users who have access to the Configuration Manager 2007 console because there is no defense against a trusted administrator.

□

Configure SQL Server to run under a domain user account instead of Local System

□

Configure the package access permissions so that only authorized installers of the software have access to the files on the distribution points.

□

Do not add any Configuration Manager 2007 user or computer accounts to the Domain Admins group

□

Do not add servers hosting the following server roles to the Site System to Site Server Connection Group:

  • Reporting points
  • Server locator points
  • Distribution points

□

Do not change the Startup type and Log on as settings for Configuration Manager 2007 services

□

Do not grant the Client Push Installation account the right to log on locally.

□

Do not grant the following accounts interactive logon rights:

  • Health State Reference Querying account
  • PXE Service Point Database Connection Account
  • Management Point Database Connection Account
  • Server Locator Point Database Connection Account
  • Network Access Account
  • Capture Operating System Image Account
  • Task Sequence Editor Domain Joining Account
  • Task Sequence Editor Network Folder Connection Account

□

Do not grant the Network Access Account rights to join a computer to the domain.

□

Do not modify the SQL Server roles and permissions created by Configuration Manager 2007

□

Do not remove rights and permissions from Local System, Local Service, and Network Service

□

Do not remove the default permissions used by the Internet Guest account and the IIS Worker Process Group to access Configuration Manager 2007 resources

□

Do not use the Network Access account as any of the following accounts:

  • Package Access Account
  • Task Sequence Editor Domain Joining Account
  • Capture Operating System Image Account
  • Task Sequence Editor Network Folder Connection Account

□

Do not use the same account for the Health State Reference Publishing account and the Health State Reference Querying Account because the Querying account requires only Read permissions.

□

Enter an account name in the Permitted Viewers list by using the domain\account format to remove any ambiguity that might occur at the client

□

Explicitly specify all global groups on the Permitted Viewers list

□

If possible, use the site server computer$ account instead of creating these accounts:

  • Server Locator Point Database Connection Account
  • PXE Service Point Database Connection Account
  • Management Point Database Connection Account
  • Site Address Account
  • Site System Installation Account
  • Software Update Point Connection Account

□

If you create the following accounts, create them as local accounts on the computer running SQL Server

  • Server Locator Point Database Connection Account
  • PXE Service Point Database Connection Account
  • Management Point Database Connection Account

□

If you disable remote tools, manually delete the ConfigMgr Remote Control Users group.

□

If you have many domain controllers and have accounts that will be used across domains, verify that the accounts have replicated before configuring them in the Configuration Manager 2007 console.

□

If you need accounts for your task sequences, you create one domain user account with minimal permissions to access the required network resources and use it for all task sequence accounts

□

If you use the Client Push Installation account, create a Group Policy object to add it to the local Administrators group

□

Minimize the use of the Local System account on the site servers and site systems by not installing other services that use the Local System account

□

Promptly remove servers from the Site System to Site Server Connection Group when they no longer host server roles that require membership

□

Set the package access permissions when you first create the package

□

To mitigate the risk of the Client Push Installation account being compromised, use an alternative method of client installation like Software Update Point Client Installation, Group Policy-based installation, or imaging

□

Use complex password for all user accounts

□

Use the same account for the RAS Sender Phone Book account as for the Site Address account.

See Also

Other Resources

Accounts and Groups in Configuration Manager
Security Checklists for Configuration Manager


Tasks for Configuration Manager Security

The following Microsoft System Center Configuration Manager 2007 tasks are security related, though they may also be operational tasks required for site function and configuration.

In This Section

Security Planning Tasks

A group of planning tasks with security implications

How to Assign Rights for Objects to Users and Groups

Describes how to assign rights for objects to users and groups

How to Delete a Security Right

Describes how to delete a security right

How to Change the Filtering on the Security Node

Describes how to change the filtering on the security node

How to Require Secure Key Exchange Between Sites

Describes how to require secure key exchange between sites

How to Manually Exchange Public Keys Between Sites

Describes how to manually exchange public keys between sites

How to Configure Windows SCW for Configuration Manager

Describes how to configure Windows SCW for Configuration Manager

How to Pre-provision the Trusted Root Key on Clients

Describes how to preprovision the trusted root key on clients

How to Verify the Trusted Root Key

Describes how to verify the trusted root key

How to Remove the Trusted Root Key

Describes how to remove the trusted root key

How to Enable CRL Checking for Software Updates

Describes how to enable CRL checking for software updates

How to Encrypt Client Inventory Reports

Describes how to enable encryption for inventory (mixed mode only)

How to Configure Request Ports for the Configuration Manager Client

Describes how to configure request ports for the Configuration Manager client

How to Configure an SPN for SQL Server Site Database Servers

Describes how to configure an SPN for SQL Server site database servers

How to Configure Internet-Based Site Systems to Allow Only Site Server Initiated Data Transfers

Describes how to configure Internet-based site systems to allow only site server initiated data transfers

How to Approve Configuration Manager Clients

Describes how to approve Configuration Manager clients

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

Describes how to configure a distribution point to transfer content using BITS, HTTP, and HTTPS

How to Block Configuration Manager Clients

Describes how to block configuration Manager Clients

How to Configure Configuration Manager 2007 Accounts

Describes how to configure Configuration Manager 2007 accounts

See Also

Other Resources

Security and Privacy for Configuration Manager 2007


Security Planning Tasks

The following Microsoft System Center Configuration Manager 2007 tasks are security-related. They appear elsewhere in the documentation library but are also collected here to facilitate the work of the security administrator.

In This Section

Choose between Native Mode and Mixed Mode

Choose Which Method to Use to Install a Secondary Site

Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)

Determine If You Need to Configure a Certificate Trust List (CTL) with IIS (Native Mode)

Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)

Determine If You Will Use FQDN Server Names

Determine If You Need to Block Configuration Manager Clients

Renewing or Changing the Site Server Signing Certificate


How to Assign Rights for Objects to Users and Groups

Topic last updated -- November 2007

You can assign Microsoft System Center Configuration Manager 2007 security rights to users in several different ways.

  • You can create an object and then assign rights to that object on the object properties or in the object creation wizard.
  • You can use the New Class Security Right Wizard or the New Instance Security Right Wizard to assign rights to existing object classes and instances.
  • You can copy rights from a user or group that has been assigned Configuration Manager 2007 security rights.
  • You can use the Manage ConfigMgr Users Wizard to assign multiple rights or copy rights from an existing user.

However, before the assigned rights can take effect, the user must be a member of the SMS Admins local group on the computer running the SMS Provider. If you use the Manage ConfigMgr Users Wizard, and if the SMS Provider is installed on the site server, then the wizard automatically adds the users to the SMS Admins group. If you use any other method to grant user rights, or if the SMS Provider is not installed on the site server, then you must manually add the user to the group.

Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

Note
Read is required for all other rights. If you do not select Read, Configuration Manager 2007 enables it by default. Removing Read removes all other rights.

Note
The console might not refresh automatically. If you do not see the right or user you added, on the Action menu, click Refresh.

To assign a security right to an existing object

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Security Rights / Rights.

  2. Right-click Rights, click New, and then click either Class Security Right or Instance Security Right.

  3. In the New Class Security Right Wizard or the New Instance Security Right Wizard, specify a user or group name and then select the rights you want the user to have.

  4. Verify that the user is a member of the SMS Admins group.

To copy rights from an existing user or group

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Security Rights / Users.

  2. In the details pane, right-click the user you want to copy from and then click Clone ConfigMgr User.

  3. In the Clone ConfigMgr User box, enter a new user or group and select Class security rights, Instance security rights, or both.

  4. Click OK.

To manage multiple rights with the Manage ConfigMgr Users Wizard

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Security Rights.

  2. .Right-click Security Rights and then click Manage ConfigMgr Users.

  3. On the Welcome to the ConfigMgr User Wizard page, click Next.

  4. On the User Name page, select Modify an existing user to change the Configuration Manager 2007 rights that have already been assigned to a user or group, or enter a new user or group name in the Add a new user box. Click Next.

    Note
    After adding the new rights to the user or group, if the SMS Provider is installed on the site server, then the ConfigMgr User Wizard attempts to add the user or group to the SMS Admins group. SMS Admins is a local group and is subject to the rules for Windows groups. For example, a local group cannot be added to a local group. If you specify a local group in the ConfigMgr User Wizard, you must find an alternate way to ensure membership in the SMS Admins group for all users who need rights to the Configuration Manager 2007 console, or grant permissions equivalent to the SMS Admins group.

  5. On the User Rights page, select either Add another right or modify an existing one, or Copy rights from an existing ConfigMgr user or user group. Click Next.

  6. If you selected Add another right or modify an existing one, on the Add a Right page, select the class for you want to assign rights. If you want to restrict the user or group to a specific instance of the class, select an instance. The Rights box will change depending on the Class and Instance you select. The default is to assign rights to All Instances. Click Next and the proceed to step 8.

  7. If you selected Copy rights from an existing ConfigMgr user or user group, on the Copy Rights page, select the Source User you want to copy from and then click Next.

    Note
    The rights of the user or group you are copying from will replace all of the rights currently assigned to the user or group you are copying to.

  8. On the User Rights page, select The listed rights are sufficient, or continue to add or copy rights as described in step 5. Click Next.

    Note
    To delete a right, select it in the Rights list and then click the delete button.

  9. On the Summary page, verify that the rights to be modified and then click Next to apply the modifications or Previous to change the settings.

  10. On the Confirmation page, verify that the wizard completed successfully and then click Close.

To verify the security rights for a user

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Security Rights / Users.

  2. In the details pane, right-click the user you want to verify and then click User Security Rights.

  3. In the User Security Rights dialog box, click the Rights arrow to see the rights By Class, By Instance, or by Both Class and Instance.

  4. To modify an existing class or instance, click Modify and then modify the rights.

  5. To add a new class or instance, click and then select one of the following:

    • Class to start the New Class Security Right Wizard
    • Instance to start the New Instance Security Right Wizard
    • Manage ConfigMgr Users Wizard to start the Manage ConfigMgr Users Wizard

  6. Click Close.

  7. You can also navigate to System Center Configuration Manager / Site Database / Security Rights / Rights and then locate the user

To verify the security rights assigned to a class or instance

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Security Rights / Rights.

  2. In the details pane, locate the class or instance.

Note
You can sort the columns by clicking the column headings. You can search the columns by typing text in the Look for: box, and clicking Find Now. You can restrict your search to specific columns by clicking the in arrow.

See Also

Concepts

Overview of Configuration Manager Object Security and WMI

Other Resources

Tasks for Configuration Manager Security


How to Delete a Security Right

You can remove security rights from users in several different ways. If you remove a user from the Microsoft System Center Configuration Manager 2007 rights list, you remove all assigned rights, and if you remove all assigned rights, you remove the user from the Configuration Manager 2007 rights list. You can also remove only select classes or instances but leave the user on the Configuration Manager 2007 rights list.

  • You can use the Security tab of the object properties to delete class or instance security rights.
  • You can Delete the user from Security Rights / Users to remove the user from the Configuration Manager 2007 rights list.
  • You can Delete the class or instance from Security Rights / Rights to remove select classes or instances.
  • You can use the Manage ConfigMgr Users Wizard to remove select rights from or to remove a user from the Configuration Manager 2007 rights list.
Note
You must have Modify permission for the Site security object class or instance to perform this procedure.

Caution
You should not remove or modify the Configuration Manager 2007 rights for the NT Authority\SYSTEM group.

Caution
If you remove the class security right, you also delete all instance security rights that the user has on that type of object.

To delete a security right on the object properties

  1. Right click the object you want to modify and then click Properties.

  2. On the Security tab, select the Class Security Rights or Instance Security Rights and then click the delete button.

  3. Click OK.

To delete a user from the security rights users list

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Security Rights / Users.

  2. Right-click the user and then click Delete.

  3. In the Confirm Object Delete box, click Yes.

To delete the class or instance from the rights list

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Security Rights / Rights.

  2. Right-click the class or instance and then click Delete.

  3. In the Confirm Object Delete box, click Yes.

See Also

Concepts

Overview of Configuration Manager Object Security and WMI

Other Resources

Tasks for Configuration Manager Security


How to Change the Filtering on the Security Node

By default, all classes of Microsoft System Center Configuration Manager 2007 objects are displayed in the Rights node under Security Rights. To see fewer classes, you can change the filtering on the rights node.

Important
The permissions filter is effective until you change it and there is no visual indication in the Configuration Manager 2007 console that a filter is active on the Rights node. To avoid confusion, reset the filter to display all after you have configured security rights.

To change the security rights filtering

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Security Rights / Rights.

  2. Right-click Rights and then click Properties.

  3. In the Rights Properties dialog box, select the classes you want to display.

  4. Click OK.

See Also

Reference

Rights Properties: Security Tab


How to Require Secure Key Exchange Between Sites

Secure key exchange is enabled by default for fresh installations of Microsoft System Center Configuration Manager 2007. If you upgrade a site, the current setting is maintained but you should enable secure key exchange to help prevent attackers from tampering with the key exchange.

Important
If the Require secure key exchange between sites check box is enabled and the site is not publishing site data to Active Directory Domain Services, you must use the hierarchy maintenance tool (Preinst.exe) to manually copy the child site's public key to the parent site.

To require secure key exchange between sites

  1. In the Configuration Manager console navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name>.

  2. Right-click <site code> - <site name>, and then click Properties.

  3. In the Site Properties dialog box, click the Advanced tab, and then select Require secure key exchange between sites.

  4. Click OK.

See Also

Reference

Site Properties: Advanced Tab

Other Resources

Tasks for Configuration Manager Security


How to Configure Windows SCW for Configuration Manager

Topic Last Updated—August 2008

Windows Server 2008 and Windows Server 2003 give you the option to run the Security Configuration Wizard (SCW) to harden your server and reduce your attack surface. Some of the critical services needed to install or run a Microsoft System Center Configuration Manager 2007 site system will be disabled unless you run SCW with the Configuration Manager 2007 template in place. If you have already run SCW on the server, install the Configuration Manager 2007 template and then run SCW again to allow SCW to detect and enable the ports and services required by Configuration Manager 2007 server roles.

To add Configuration Manager settings to SCW

  • For Windows Server 2008, see the Configuration Manager 2007 Toolkit information at http://go.microsoft.com/fwlink/?LinkId=115020.

  • For Windows Server 2003, see the Configuration Manager 2007 Toolkit information at http://go.microsoft.com/fwlink/?LinkId=93071.

See Also

Other Resources

Tasks for Configuration Manager Security


How to Configure Configuration Manager 2007 Accounts

In This Section

How to Add a Computer Account to a Group

Describes how to add a computer account to a group

How to Manage Accounts from the Command-Line

Describes how to manage accounts from the command-line

How to Configure the Configuration Manager Client Push Installation Account

Describes how to configure the Client Push Installation account

How to Configure the Health State Reference Publishing Account

Describes how to configure the Health State Reference Publishing account

How to Configure the Health State Reference Querying Account

Describes how to configure the Health State Reference Querying account

How to Configure the Management Point Database Connection Account

Describes how to configure the Management Point Database Connection account

How to Configure the Network Access Account

Describes how to configure the Network Access account

How to Specify a Package Access Account

Describes how to specify a Package Access account

How to Configure the PXE Service Point Database Connection Account

Describes how to configure the PXE Service Point Database Connection account

How to Configure the RAS Sender Phone Book Account

Describes how to configure the RAS Sender Phone Book account

How to Configure the Server Locator Point Database Connection Account

Describes how to configure the Server Locator Point Database Connection account

How to Configure the Site Address Account

Describes how to configure the Site Address account

How to Configure the Site System Installation Account

Describes how to configure the Site System Installation account

How to Configure the Software Update Point Connection Account

Describes how to configure the Software Update Point Connection account

How to Configure the Software Update Point Proxy Server Account

Describes how to configure the Software Update Point Proxy Server account

How to Modify the Remote Tools Permitted Viewer Accounts

Describes how to configure the Permitted Viewers list for Remote Tools.

See Also

Other Resources

Accounts and Groups in Configuration Manager
Tasks for Configuration Manager Security


How to Add a Computer Account to a Group

If you need to add a computer account (computername$) to a local group or domain local group in Windows Server 2003, you can modify the object picker to select computer accounts or you can use the net localgroup command-line utility. If you need to add a computer account to a local group or domain local group in Windows 2000 Server, you can use only the command prompt.

Procedure

To add a computer account to a group by using the Windows interface

  1. In Computer Management (member server) or Active Directory Users and Computers (domain controller), in the results pane, right-click the group, and then click Properties.

  2. Click the General tab (member server) or Members tab (domain controller), and then click Add.

  3. In the Select Users, Computers, or Groups dialog box, click Object Types.

  4. In the Object Types dialog box, select Computers, and then click OK.

  5. In the Select Users, Computers, or Groups dialog box, in the Enter the object names to select box, type computername$, where computername is the name of the computer you want to add to the group.

  6. Click OK.

  7. The Select Users, Computers, or Groups dialog box closes. Verify that your computer appears in the list.

    Note
    When you set the computer as an object type to select, it does not persist the next time you add an account. If you need to add another computer account, repeat these steps to select the correct object type.

To add a computer account to a group by using the command prompt

  • You can add computer accounts to a domain group or local group of another computer by typing the following command:

Net localgroup <group> <domain name>\<computer name>$ /ADD

For example, to add a computer named Dublin that is a member of the NWTRADERS domain to the Site System to Site Server Connection group in the ABC domain, you would type the following command:

Net localgroup SMS_SiteSystemToSiteServerConnection_ABC NWTRADERS\DUBLIN$ /ADD

See Also

Other Resources

How to Configure Configuration Manager 2007 Accounts


How to Manage Accounts from the Command-Line

Topic last updated -- November 2007

You can use the Manage Site Accounts tool (MSAC.exe) through the command-line interface to quickly and easily create, change, verify, delete, and list user-defined Windows accounts for your Microsoft System Center Configuration Manager 2007 sites.

Note
This version of the Manage Site Accounts tool is supported for Configuration Manager 2007 sites only. If you need to manage accounts at an SMS 2003 site, you must use the SMS 2003 version of the tool. The SMS 2003 Manage Site Accounts Tool cannot change the Client Push Installation account. There is no supported way to change this account for an SMS 2003 secondary site.

You can modify more account types than you can add because most account types allow only a single account to be used. You can add as many Client Push Installation accounts as you want, but adding an additional Network Access Account could only replace the existing account.

Listing all of the accounts is useful for security auditing.

List of Accounts That Can Be Managed

The following accounts can be managed by the Manage Site Accounts tool.

Account Name Actions

Client Push Installation Account [ClientPushAccount]

Add, Change*, Delete, Verify, List

Network Access Account [NetworkAccessAccount]

Change, Delete, Verify, List

Site Address Account [SiteAddressAccount}

Change, Verify, List

Health State Reference Querying Account [SHVToADReaderAccount]

Change, Verify, List

Health State Reference Publishing Account [SHVToADWriterAccount]

Change, Verify, List

Software Update Point Proxy Server account

[SoftwareUpdatePointProxyServerAccount]

Change, Verify, List

Note
The tool can manage the Software Update Point Proxy Server account only if the software update point is installed on the site server.

* The -Set command cannot actually change the password on the Client Push Installation account. To change the Client Push Installation account, use the -Delete option to remove the account and then use the -Add option to create the account.

Note
Although the command line help shows that you can manage the Site System Installation Account [SiteSystemInstallationAccount], it does not work.

Manage Site Accounts Tool Syntax

The Manage Site Accounts tool (Msac.exe) has the following command-line syntax and command-line parameters that you can use to manage all Windows accounts that Configuration Manager 2007 uses.

Copy Code
msac.exe -[ ADD | SET | DELETE | VERIFY | LIST | ? ] [arguments]

Command-line parameter | Description
-ADD | Adds a given account in the specified server.
-SET | Changes an existing account to a new account.
-DELETE | Deletes a given account in the specified server.
-VERIFY | Verifies a given account in the specified server.
-LIST | Lists existing accounts to the screen or to a file for all or a specified account category on the specified server.
? | Displays command-line help.

Add a New Account

Use the following command-line syntax and parameters to create a new account.

Important
The Manage Site Accounts tool configures the account in the Configuration Manager 2007 console but does not actually create the account in Active Directory Domain Services. You must still create the account in the domain and set the password.

Copy Code
msac.exe -ADD <server> <Domain\account> <accountCategory>
             [ -S <SiteCode1> [, <SiteCode2> [ ... ] ] ]
             [ -PA <Password | -G]
             [ -R ] [ -I ] [ -T ] [ -V ] [ -P ] [ -? ] [ /? ]

Command-line parameter Description

<server>

Indicates the name of the site server.

<domain\account>

Indicates the domain to be used and account to be added. You can add only one account at a time.

If the –P parameter is not specified, this property will require the <domain\account> format. If you use -P, specify only the account name.

<accountCategory>

Indicates the account category to which the new account will belong.

The only possible value for this property is:

ClientPushAccount (Client Push Installation Account)

You cannot configure accounts that are used on site systems such as the Management Point Database Connection account.

-S

Indicates the site code to process, if not using the current site.

For example, this could be the site code for a child site.

-PA

Specifies a password for the new user account.

Do not use this parameter if you intend to specify automatic strong password creation. Instead, use the -G parameter.

-G

Creates a strong password for the new account.

This parameter causes a strong password to be automatically generated, using a strong algorithm.

Important
The Manage Site Accounts tool generates a strong password and configures it for the account in the Configuration Manager 2007 console but does not actually set the password in Active Directory Domain Services. Until you configure the domain account to use the generated password, the account will fail. Protect the password as you transfer it from the console output to configure the account in Active Directory.

-R

Adds the new account to all the child sites belonging to the site server specified as <server>.

Note
Due to a known issue, the G R combination does not properly generate the same strong password for all child sites. WORKAROUND: If you must generate a strong password for all child sites, use MSAC -add -G at the parent site, note the resulting strong password, then use MSAC -add -PA <strong password> -G to configure that same password throughout the hierarchy.

-I

Indicates that you want to ignore any errors that occur while the account is being added to child sites, and to continue the process of adding the account.

If you use this parameter, you can still view the ignored errors in the console output.

-T

Specifies that the changes that you requested should run in test mode, without actually affecting your system.

-V

Specifies that a log showing the details of the new account creation should be displayed as output in the console.

-P

Specifies that the new account should use the domain of existing accounts.

Some account types, might be in use in several domains, but use the same name and same password in each domain. When such an account requires an update, each copy of the account will be changed and updated with the same new password. For this reason, if you use the -P parameter, this tool will examine the domain name and reuse it, without you having to specify it.

-? or /?

Displays the command-line Help and usage.

Change an Account

Use the following command-line syntax and parameters to change the current account to a new account.

Important
The Manage Site Accounts tool configures the account in the Configuration Manager 2007 console but does not actually create the account in Active Directory Domain Services. You must still create the account in the domain and set the password.

Copy Code
msac.exe -SET <server> <Domain\account> <Domain\Newaccount | ComputerAccount> <AccountCategory>
             [ <AddressType> <Destination> ] [ -PA <password> | -G ]
             [ -S <SiteCode1> [, <SiteCode2> [ ... ] ] ]
             [ -R ] [ -I ] [ -T ]
             [ -V ] [ -P ] [ -? ] [ /? ]

Command-line parameter Description

<server>

Indicates the name of the site server.

<domain\account>

Indicates the domain to be used and the user account to be modified.

If the –P parameter is not specified, this property will require the <domain\account> format. If you use -P, specify only the account name.

<Domain\NewAccount>

Specifies the new user account that will replace the existing account.

Note

You can use ComputerAccount instead of <Domain\NewAccount> for SiteAddressAccount.

<AccountCategory>

Indicates the account category to which the modified account will belong.

  • Valid values: NetworkAccessAccount (Network Access account)
  • SiteAddressAccount (Site Address account)
  • SHVToADReaderAccount (Health State Reference Querying account)
  • SHVToADWriterAccount (Health State Reference Publishing account)
  • SoftwareUpdatePointProxyServerAccount (Software Update Point Proxy Server account)
    Note
    The -Set command cannot actually change the password on the Client Push Installation account. To change the Client Push Installation account, use the -Delete option to remove the account and then use the -Add option to create the account.

<AddressType>

Indicates the address type of the sender address account you are modifying.

Possible values for this property are:

MS_LAN.

MS_X25_RAS.

MS_ISDN_RAS.

MS_ASYNC_RAS.

MS_SNA_RAS.

Note

The addresstype property is required for the SiteAddressAccount category.

ComputerAccount

Replaces a sender address account (Site Address account) with the computer account of the site system. The ComputerAccount parameter is used only with the set parameter and SiteAddressAccount category. This parameter is used instead of <domain/newuser>.

<Destination>

Indicates the destination site code for the modified account.

-PA

Specifies a password for the modified user account.

Do not use this parameter if you intend to specify automatic strong password creation. Instead, use the -G parameter.

-G

Specifies a strong password for the modified account.

This parameter causes a strong password to be automatically generated using a strong algorithm.

Important
The Manage Site Accounts tool generates a strong password and configures it for the account in the Configuration Manager 2007 console but does not actually set the password in Active Directory Domain Services. Until you configure the domain account to use the generated password, the account will fail. Protect the password as you transfer it from the console output to configure the account in Active Directory.

-S

Indicates the site code to process, if not using the current site.

For example, this could be the site code for a child site.

-R

Adds the modified account to all the child sites belonging to the site server specified as <server>.

Note
Due to a known issue, the G R combination does not properly generate the same strong password for all child sites. WORKAROUND: If you must generate a strong password for all child sites, use MSAC -set -G at the parent site, note the resulting strong password, then use MSAC -set -PA <strong password> -G to configure that same password throughout the hierarchy.

-I

Indicates that you want to ignore any errors that occur while the modified account is being added to child sites, and to continue the process of adding the account.

If you use this parameter, you will still be able to view the ignored errors in the console output.

-T

Specifies that the changes that you requested should run in test mode, without actually affecting your system.

-V

Specifies that a log showing the details of the account modification should be displayed as output in the console.

-P

Use this parameter to specify that the modified account should use the domain of existing accounts.

Some account types might be in use in several domains, using same name and same password in each domain. When such an account requires an update, each copy of the account will be changed and updated with the same new password. For this reason, if you use the -P parameter, this tool will examine the domain name, and reuse it, without you having to specify it each time.

-? or /?

Displays the command-line Help and usage.

Delete an Account

Use the following command-line syntax and parameters to delete an existing account:

msac.exe -DELETE <server> <Domain\Account> <AccountCategory>

[ -S <SiteCode1> [, <SiteCode2> [ ... ] ] ]

[ -R ] [ -I ] [ -T ]

[ -V ] [ -P ] [ -? ] [ /? ]

Command-line parameter Description

<server>

Indicates the name of the site server.

<domain\account>

Indicates the domain to be used, and account to be deleted.

If the –P parameter is not specified, this property will require the <domain\account> format. If you use -P, specify only the account name.

<accountCategory>

Indicates the account category to which the account you are deleting belongs.

Possible values for this property are:

  • NetworkAccessAccount (Network Access Account)
  • ClientPushAccount (Client Push Installation account)

-S

Indicates the site code to process, if not using the current site.

For example, this could be the site code for a child site to which the account belongs.

-R

Removes the account from all the child sites belonging to the site server specified as <server>.

-I

Indicates that you want to ignore any errors that occur while the account is being removed from child sites, and to continue the process of deleting the account.

If you use this parameter, you can still view the ignored errors in the console output.

-T

Specifies that the changes that you requested should run in test mode, without actually affecting your system.

-V

Specifies that a log showing the details of the account deletion should be displayed as output in the console.

-P

Indicates that account to be deleted uses the domain of existing accounts.

Some account types might be in use in several domains, using the same name and same password in each domain. When such an account requires an update, each copy of the account will be changed and updated with the same new password. For this reason, if you use the -P parameter, this tool will examine the domain name and reuse it, without you having to specify it each time.

-?

Displays the command-line Help and usage.

Verify an Account

Use the following command-line syntax and parameters to verify an existing account:

msac.exe -VERIFY <server> <Domain\account> <AccountCategory>

[ <AddressType> <Destination> ]

[ -S <SiteCode1> [, <SiteCode2> [ ... ] ] ]

[ -R ] [ -I ]

[ -V ] [ -P ] [ -? ] [ /? ]

Command-line parameter Description

<server>

Indicates the name of the site server.

<domain\account>

Indicates the domain to be used and account to be verified.

If the –P parameter is not specified, this property will require the <domain\account> format. If you use -P, specify only the account name.

<AccountCategory>

Indicates the account category to which the account you are verifying belongs.

  • Valid values: NetworkAccessAccount (Network Access account)
  • ClientPushAccount (Client Push Installation account)
  • SiteAddressAccount (Site Address account)
  • SHVToADReaderAccount (Health State Reference Querying account)
  • SHVToADWriterAccount (Health State Reference Publishing account)
  • SoftwareUpdatePointProxyServerAccount (Software Update Point Proxy Server account)
  • Note: Secondary sites do not have Health State Reference Querying accounts and Health State Reference Publishing accounts; these accounts can be verified only at primary sites.

<AddressType>

Indicates the address type of the account you are verifying.

Possible values for this property are:

MS_LAN.

MS_X25_RAS.

MS_ISDN_RAS.

MS_ASYNC_RAS.

MS_SNA_RAS.

The AddressType property is required for the category SiteAddressAccounts.

<Destination>

Indicates the destination site code for the account you are verifying.

-S

Indicates the site code to process, if not using the current site.

For example, this could be the site code for a child site to which the account belongs.

-R

Verifies the account on all the child sites belonging to the site server specified as <server>.

-I

Indicates that you want to ignore any errors that occur while the account is being verified on child sites, and to continue the process of verifying the account.

If you use this parameter, you can still view the ignored errors in the console output.

-V

Specifies that a log showing the details of the account verification should be displayed as output in the console.

-P

Indicates that the account you are verifying uses the domain of existing accounts.

Some account types might be in use in several domains, using the same name and same password in each domain. When such an account requires an update, each copy of the account will be changed and updated with the same new password. For this reason, if you use the -P parameter, this tool will examine the domain name and reuse it, without you having to specify it each time.

-? or /?

Displays the command-line Help and usage.

List Accounts

Use the following command-line syntax and parameters to list existing accounts:

Copy Code
msac.exe -LIST <server> <AccountCategory>
             [ -S <SiteCode1> [, <SiteCode2> [ ... ] ] ]
             [ -R ]
             [-FILE <path and filename>] [ ? ] [ /? ]

Command-line parameter Description

<server>

Indicates the name of the site server.

<AccountCategory>

Indicates the account category to which the account you are listing belongs.

The AllAccount category is used to list all account categories.

Valid values:

  • NetworkAccessAccount (Network Access account)
  • ClientPushAccount (Client Push Installation account)
  • SiteAddressAccount (Site Address account)
  • SHVToADReaderAccount (Health State Reference Querying account)
  • SHVToADWriterAccount (Health State Reference Publishing account)
  • SoftwareUpdatePointProxyServerAccount (Software Update Point Proxy Server account)
  • AllAccount (lists all accounts)

-S

Indicates the site code to process, if not using the current site.

For example, this could be the site code for a child site.

-R

Lists account details for all of the child sites.

-FILE

Specifies a file as output for the list parameter. A full output path and file name is required when using this parameter.

-? or /?

Displays the command-line Help and usage.

See Also

Other Resources

Accounts and Groups in Configuration Manager
How to Configure Configuration Manager 2007 Accounts


How to Configure the Health State Reference Publishing Account

If your Microsoft System Center Configuration Manager 2007 site servers and System Health Validator points are not in the same Active Directory forest, you must designate the Active Directory forest and domain that will store the health state references, and you must specify an account to use when publishing the health state references to Active Directory Domain Services.

If no account is configured, Configuration Manager attempts to use the site server computer account to publish the health state references.

To specify the Health State Reference Publishing account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. In the results pane, double-click System Health Validator Point Component.

  3. In the System Health Validator Point Component Properties dialog box, click the Health State Reference tab, and then click Designate an Active Directory forest.

  4. For the Health state reference publishing account, click Set.

  5. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

See Also

Concepts

About the Health State Reference Publishing account


How to Configure the Health State Reference Querying Account

If your Microsoft System Center Configuration Manager 2007 site servers and System Health Validator points are not in the same Active Directory forest, you must designate the Active Directory forest and domain that will store the health state references, and you must specify an account to use when System Health Validator points read health state references from Active Directory Domain Services.

If no account is configured, Configuration Manager attempts to use the System Health Validator point computer account to read health state references.

To specify the Health State Reference Querying account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. In the results pane, double-click System Health Validator Point Component.

  3. In the System Health Validator Point Component Properties dialog box, click the Health State Reference tab, and then click Designate an Active Directory forest.

  4. For the Health State Reference Querying account, click Set.

  5. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

See Also

Concepts

About the Health State Reference Querying account


How to Configure the Management Point Database Connection Account

By default, the Microsoft System Center Configuration Manager 2007 management point uses its computer$ account when reading information from the site database, but you can configure a user account instead. You need this account if the management point needs to access a site database in a domain different than the site server domain, whether or not the domain is in the same forest.

To specify the Management Point Database Connection Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <management point name>.

  2. In the results pane, double-click ConfigMgr management point.

  3. In the ConfigMgr management point Component Properties dialog box, on the General tab, for the Management Point Database Connection Account, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

  5. Click OK.

See Also

Concepts

About the Management Point Database Connection Account


How to Configure the Network Access Account

Microsoft System Center Configuration Manager 2007 client computers use the Local System account to perform most Configuration Manager 2007 client operations on the computer, but LocalSystem cannot access network resources.

To specify the Network Access Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. In the results pane, double-click Computer Client Agent.

  3. In the Computer Client Agent Properties dialog box, on the General tab, for the Network Access Account, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

  5. Click OK.

See Also

Concepts

About the Network Access Account


How to Configure the PXE Service Point Database Connection Account

By default, the Microsoft System Center Configuration Manager 2007 PXE service point uses its computer$ account when reading information from the site database, but you can configure a user account instead. Typically, you would need this account if the PXE service point needs to access a site database in a remote, untrusted forest. For example, if your data center has a secure perimeter network in a forest other than the site server and site database, you can use this account to read the PXE boot information from the site database.

To specify the PXE Service Point Database Connection Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <PXE service point name>.

  2. In the results pane, double-click ConfigMgr PXE service point.

  3. In the ConfigMgr PXE service point Component Properties dialog box, on the Database tab, for the PXE Service Point Database Connection Account, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

  5. Click OK.

See Also

Concepts

About the PXE Service Point Database Connection Account


How to Configure the RAS Sender Phone Book Account

If the Microsoft System Center Configuration Manager 2007 site requires a RAS sender instead of the standard sender, you must configure an account with permissions to initiate a remote access connection.

To specify the RAS Sender Phone Book Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, double-click the name of the sender address.

  3. In the <site code> - <site name> Properties dialog box, on the General tab, for the Phone book account, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

  5. Click OK.

See Also

Concepts

About the RAS Sender Phone Book Account


How to Configure the Server Locator Point Database Connection Account

By default, the Microsoft System Center Configuration Manager 2007 server locator point uses its computer$ account when connecting to the site database, but you can configure an alternate account. If configured, the Server Locator Point Database Connection account is used by server locator points to read information from the site database.

To specify the Server Locator Point Database Connection Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <server locator point name>.

  2. In the results pane, double-click ConfigMgr server locator point.

  3. In the ConfigMgr server locator point Properties dialog box, on the General tab, for the Server Locator Point Database Connection Account, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

  5. Click OK.

See Also

Concepts

About the Server Locator Point Database Connection Account


How to Configure the Site Address Account

A Microsoft System Center Configuration Manager 2007 Site Address Account is not always required. If trust relationships exist between the site domains, you should use the site server's computer account as the Site Address Account. If you must connect to a site in a different forest, you must configure a Site Address Account.

Important
If you specify a Site Address Account for an address and then later decide you want to use the computer account as the Site Address Account, you must delete the address and re-create it. Changing the account name is not sufficient when switching from a user account to the computername$ account.

To specify a new Site Address Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / Site Database / Site Settings / Addresses.

  2. Right-click the address whose Site Address Account you want to change, and then click Properties.

  3. In the Address Properties dialog box, click the General tab, and then click Set.

  4. In the Windows User Account dialog box, specify an existing user account.

  5. Click OK to close the dialog box, and then click OK to close the Address Properties dialog box.

See Also

Concepts

About the Site Address Account


How to Configure the Site System Installation Account

The Site System Installation Accounts are used by the Microsoft System Center Configuration Manager 2007 Site Component Manager service to install, reinstall, uninstall, and configure site systems. If you configure the site system to Allow only site system initiated data transfers from this site system, Configuration Manager 2007 also uses this account to pull data from the site system.

Each site system can have a different Site System Installation Account, but you can configure only one Site System Installation Account to manage all roles on that site system.

To specify the Site System Installation Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Site Systems / <site server name>.

  2. In the results pane, double-click ConfigMgr site system.

  3. In the ConfigMgr Site System Properties dialog box, on the General tab, for the Site System Installation Account, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

  5. Click OK.

See Also

Concepts

About the Site System Installation Account


How to Configure the Software Update Point Connection Account

If you must configure a Microsoft System Center Configuration Manager 2007 software update point in a different forest with no trust relationship, you must configure a software update point connection account.

To specify the Software Update Point Connection Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. In the results pane, double-click Software Update Point Component.

  3. In the Software Update Point Component Properties dialog box, on the General tab, with either Active software update point on remote server or Use Network Load Balancing cluster for active software update point selected, in the Software Update Point Connection Account group, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password, and then click OK.

  5. Click OK.

See Also

Concepts

About the Software Update Point Connection Account


How to Configure the Software Update Point Proxy Server Account

This account is needed only when the Microsoft System Center Configuration Manager 2007 software update point must access the Internet via a proxy server or firewall that requires authenticated access.

How to specify the Software Update Point Proxy Server Account

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. In the results pane, double click Software Update Point Component.

  3. In the Software Update Point Component Properties dialog box, on the General tab, with either Active software update point on remote server or Use Network Load Balancing cluster for active software update point selected, in the Software Update Point Connection Account group, click Set.

  4. In the Windows User Account dialog box, specify an existing Windows domain user account and password and then click OK.

  5. Click OK.

See Also

Concepts

About the Software Update Point Proxy Server Account


Technical Reference for Configuration Manager Security

The following topics provide additional information about Microsoft System Center Configuration Manager 2007 security.

In This Section

Classes and Instances for Object Security in Configuration Manager

Describes the class and instance object security rights

Implementing IPsec in Configuration Manager 2007

Provides an overview of how to configure IPsec to support Configuration Manager 2007

Ports Used by Configuration Manager

Provides a list of the ports used by Configuration Manager 2007 and the direction of the communication, to facilitate configuring firewalls and IPsec policies

Accounts to Delete after Upgrading from SMS 2003

Provides a list of accounts that can be safely deleted after upgrading from SMS 2003.


Classes and Instances for Object Security in Configuration Manager

The following section contains a description of the class and instance rights available in the Microsoft System Center Configuration Manager 2007 console.

Classes

Right Applies to Grants the ability to

Administer

All secured object classes, applicable updates summary instances

Assign or remove any user security rights for a class of objects or for individual object types in that class to yourself or to any other user.

You must explicitly grant other rights appropriate to the object type. Granting the Administer right to a user does not automatically give the user Create, Modify, or Delete rights for that object type.

Advertise

Collection object classes and instances

Advertise to a collection. Subcollections to the collection are also advertised to, even if the administrator does not have the Advertise right on the subcollections.

This right does not grant the ability to create advertisements — that requires Create right on the advertisement object type.

Create

All secured object classes, applicable updates summary instances

Create an instance of an object type.

Create task sequence media

Task sequence package class

Create stand-alone and capture CD task sequence media.

Delegate

All classes except Status, applicable updates summary instances

Grant rights for any instances created by the user. The only rights that can be granted are rights the user has directly (not through group membership or at the class level).

Delete

All secured object classes and instances (except status message instances)

Delete an instance of an object type. (Deleting an advertisement requires Advertise rights on the collection receiving the advertisement and Read rights on the package containing the advertised program, in addition to Delete rights on the advertisement.)

Delete Resource

Collection object class and instances

Delete a resource from a collection.

Distribute

The following collection objects:

  • Boot image Package
  • Configuration items
  • Device setting Package
  • Driver package
  • OS image
  • OS Install package
  • Package
  • And deployment package instances

Send objects to distribution points. You must also have Modify and Read on a package to add the package to a distribution point.

Import computer entry

Site object class

Run the Import Computer Information wizard to specify client computers that are permitted to use the PXE boot process for operating system deployment.

Manage folders

The following class objects:

advertisement

computer association

configuration items

Deployment package

device driver

device setting package

driver package

OS image

OS Install package

Package

query

report

software metering rule

task sequence package

Create, modify, and delete folders under the node

Manage OSD and ISV Proxy certificates

Site object class

Create or import a user authentication certificate, including the private key, so the following deployment methods can temporarily loan the client a certificate to communicate with the management point.

  • Bootable media
  • PXE service point

Manage the certificates required for clients supported by Independent Software Vendors (ISVs) to communicate with management points in native mode.

Manage SQL Commands

Site object class and instances

Create, modify, and delete site maintenance SQL commands.

Note
To add, delete, or modify a SQL command, you must have the Modify right to the site object. To delete SQL commands, you must also have the Administer right to the site object.

Manage Status Filters

Site object class and instances

Create, modify, and delete status filter rules.

Note
To add, delete, or modify a status filter, you must have the Modify right to the site object.

Meter

Site object class and instances

Apply software metering rules to the site.

Modify

All secured object classes and instances (except status message class and instances, and computer association class and instances which cannot be modified)

Modify an instance of an object type.

Modify collection setting

Collection object class and instances

Create and modify maintenance windows, collection variables, collection-specific restart settings, and collection-specific policy polling intervals on collection objects.

Modify Resource

Collection object class and instances

Modify a resource in a collection. You must also have Modify Resource on any collection containing a conflicting record to reconcile the conflicting records that appear in the Conflicting Records node.

Network access

Configuration item object class and instances

Define network access protection (NAP) policy on the configuration item.

Read

All secured object classes and instances (except status message instances)

View an instance and its properties.

Read Resource

Collection object class and instances.

Read a resource in a collection. Resource Explorer can be used on the resource to view hardware inventory and software inventory data. If the administrator does not have this right at the class level, all the collections he creates must be collection limited to collections he already has rights to.

Use Remote Tools

Collection object class and instances

Use Remote Tools on a resource.

View Collected Files

Collection object class and instances

View the files collected from a client. Resource Explorer can be used on the resource to view collected files.

View recovery information

Computer association instance objects

View the recovery key and state location for user state data that is managed by a computer association.

See Also

Concepts

Overview of Configuration Manager Object Security and WMI

Other Resources

Technical Reference for Configuration Manager Security


Implementing IPsec in Configuration Manager 2007

Topic last updated—March 2008

Microsoft System Center Configuration Manager 2007 provides a solid foundation for securely managing client to server communication on the intranet and over the Internet. However, there are many different methods by which attackers can attempt to penetrate your network. The use of IPsec is a common mitigation against many different types of attacks. Configuration Manager 2007 will work in an IPsec environment, and should be used when you are concerned about the risk of attackers intercepting, monitoring, or tampering with network communications.

IPsec allows you to maintain a high level of control over communications security. However, to effectively configure, manage, and troubleshoot IPsec policies, you must have an advanced knowledge of IP networking, experience with administering firewalls and filtering routers, and experience using network tools. This document assumes a working knowledge of general IPsec design and implementation.

For more information about server and domain isolation using IPsec and Group Policy, see http://go.microsoft.com/fwlink/?LinkId=93073 on the Microsoft Download site. Additionally, see a case study in IPsec deployment as well as lessons learned in the technical whitepaper at http://go.microsoft.com/fwlink/?LinkId=93074.

Interaction between IPsec and the Supporting Infrastructure

Configuration Manager 2007 requires the use of many standard services provided by the Windows operating systems. These services include name resolution, DHCP, RRAS, Volume Shadow Services, and other basic services required to operate in a secure networked environment. Carefully consider these services and their use within the Configuration Manager environment as you establish your IPsec policies.

Communication Paths

There are three primary Configuration Manager communication paths you should consider protecting with the help of IPsec.

  • Site-to-site communication
  • Site-to-site system communication
  • Client-to-site-system communication

Site to Site Communication

Site to site communication occurs for two different scenarios:

  • Site to site data replication
  • Secondary site push installation

Site to site data replication occurs when data is exchanged between sites that are configured in a hierarchy as parent/child sites. Status messages, inventory data, and state messages flow up from child site to parent site. Software distribution packages, software updates, network access policies, operating system deployment images, task sequences, configuration baseline assignments flow down from parent site to child site. While these communications are signed by Configuration Manager 2007, they are not encrypted unless you enable IPsec.

If you install a secondary site from the Configuration Manager 2007 console of the parent primary site, the files are not encrypted unless you enable IPsec. IPsec between a primary site and a secondary site that is being installed helps secure the initial bootstrap communication process, including any configuration data sent from the primary site to the secondary site.

Site Server to Site System Communication

Site to site system communication encompasses three major functions:

  • Initial provisioning of the site system role
  • Configuration of the services
  • Transfer of configuration, status and operations data

Initial provisioning of site systems services occurs using remote procedure calls (RPC) and transfers data using server message block (SMB). Although native mode signs policy using the site server signing certificate, mitigating some attacks against site server to site system communication, these communications are not secured in either mixed or native mode. You should enable IPsec to help protect site server to site system communications, especially if your site systems are placed across a security boundary, such as between Active Directory forests, or between a perimeter network and your intranet.

IPsec helps protect against attacks where an unauthorized site system impersonates a valid site system and uses the trusted connection to gain control of the site server or the site system database.

Client to Site System Communication

If your Configuration Manager 2007 site is operating in native mode, Configuration Manager 2007 uses Internet Information Services (IIS) to establish a secure connection over SSL between the client and some site systems, including the management point, but other communication is not encrypted, such as connections to the fallback status point. When your site is operating in mixed mode, only some communications are encrypted. The only way to be sure all client communication to site systems is signed and encrypted in all modes is to use IPsec.

For more information about how mixed and native modes use HTTP and HTTPS, see Client Communication in Mixed Mode and Native Mode.

Note
Do not configure IPsec policies for the AMT communication between the out of band service point site system server and computers that will be managed out of band.

IPsec Policy Configuration

It is recommended that you create an IPsec policy that requires ESP/3DES between the specified end points (site servers, site systems, clients). Packet layer encryption adds CPU load to these systems, so it is also recommended that you ensure proper lab performance testing of the configuration before deployment. Limit access to the specified site systems by limiting the computers that can be authenticated by IPsec Internet Key Exchange (IKE) with the Configuration Manager IPsec policy. You can also limit access to systems by using certificate authentication from a Certification Authority (CA) that is dedicated only to the purpose of issuing certificates for use with Configuration Manager IPsec.

Use the port information provided in the topic Ports Used by Configuration Manager to construct network traffic maps depending on the server role configuration on each computer participating in your site. Client roles are also shown in case you plan to use IPsec for encrypting client communication to site systems, or in case you are running the Configuration Manager 2007 client on site systems and need to permit the necessary traffic.

Note
An update to Windows Server 2003 and Windows XP is available to help simplify the creation and maintenance of IPsec filters. For more information, see http://go.microsoft.com/fwlink/?LinkId=93076.

IPsec to Domain Controllers

There are additional considerations with configuring IPsec on domain controllers, which could impact your Configuration Manager 2007-related IPsec policies if you host your site roles on domain controllers. For more information about configuring IPsec between Windows Server 2003 member servers and Windows Server 2003 domain controllers, see http://go.microsoft.com/fwlink/?LinkId=93078.

Site Servers with Client Components Installed

In configurations where the site systems configured for IPsec also have the Configuration Manager 2007 client agent installed and configured for native mode, you can modify the filter to permit HTTP and HTTPS traffic for Configuration Manager 2007 communications, and ICMP traffic for diagnostics. The recommended way to implement this configuration is to use a Group Policy that contains the IPsec policy.

Common Deployment Network Diagram for Internet-Based Servers

This scenario represents a Configuration Manager 2007 site that doesn't support intranet clients and spans the perimeter network and intranet. All the Internet-based site systems are in the perimeter network, and accept connections for clients connecting over the Internet. The site server and site database server are the intranet. The management point that supports Internet-based client communicates with a replica of the site database in the perimeter network.

Internet-based diagram: Scenario 1b

This common scenario follows a standard server isolation configuration. In this configuration, the connection between the site server and site systems, as well as the connection between the site database and the management point, should be configured with subnet based IPsec filters. If you use subnet-based filters and do not require the ability to support inbound sessions that are not encrypted with IPsec, you can use an “Any <-> subnet” IPsec policy design. You can use either Kerberos or computer certificate authentication. Computer certificate authentication is recommended, but the deployment of the computer certificates requires additional administrative overhead and is not managed by Configuration Manager 2007. Firewalls between sites and site systems should be configured to allow ISAKMP traffic (UDP Port 500) and UDP Port 4500 if you are using NAT traversal through the firewall.

The recommended IPsec policy for this configuration is:

  • IP filter list:
    • Source Address <any IP address>
    • Destination Address <your subnet>
  • Filter Action: - set to Do not allow unsecured communication
  • Authentication Methods: set to Use a certificate from this certification authority (CA)

Other settings in the policy should be set according to your company standards.

See Also

Concepts

Best Practices for Securing Communications

Other Resources

Technical Reference for Configuration Manager Security


Ports Used by Configuration Manager

Topic Last Updated—August 2008

Microsoft System Center Configuration Manager 2007 is a distributed client/server system. The distributed nature of Configuration Manager 2007 means that connections can be established between site servers, site systems, and clients. Some connections use ports that are not configurable, and some use ports that can be customized. You must verify that the required ports are available if you use any port filtering technology such as firewalls, routers, proxy servers, and IPsec.

Note
To plan your firewall configuration, if you are supporting Internet-based clients, use the following port information in conjunction with the information in Supported Scenarios for Internet-Based Client Management. In addition to port requirements, if you have Internet-based clients, you must also allow certain HTTP verbs and headers to traverse your firewall. For more information, see Prerequisites for Internet-Based Client Management.

Configurable Ports

Configuration Manager 2007 allows you to configure the ports for the following types of communication:

  • Client to site system
  • Client to Internet (as proxy server settings)
  • Software update point to Internet (as proxy server settings)
  • Software update point to WSUS server
  • Client to reporting point

By default, the HTTP port used for client to site system communication is port 80 and the default HTTPS port is 443. Ports for client-to-site system communication over HTTP or HTTPS can be changed during Setup or in the Site Properties for your Configuration Manager site.

Reporting point site system roles have configurable port settings for HTTP and HTTPS communication defined on the reporting point site system role property page. By default, users connect to the reporting point using the HTTP port 80 and HTTPS port 443. These ports are defined during installation only. To redefine the reporting point communication port, the reporting point site system must be deleted and reinstalled.

Non-Configurable Ports

Configuration Manager does not allow you to configure ports for the following types of communication:

  • Site to site (primary-to-primary or primary-to-secondary)
  • Site server to site system
  • Site server to site database server
  • Site system to site database server
  • Configuration Manager 2007 console to SMS Provider
  • Configuration Manager 2007 console to the Internet

Port Details

The port listings that follow are used by Configuration Manager 2007 and do not include information for standard Windows services, such as Active Directory group policy and Kerberos authentication. For information about Windows Server services and ports, see http://go.microsoft.com/fwlink/?LinkID=123652.

The following diagram indicates connections between Configuration Manager 2007 computers. The number for the link corresponds to the table that lists the ports for that link. The arrows between the computers represent the direction of the communication.

  • -- > indicates one computer initiates and the other computer always responds
  • < -- > indicates that either computer can initiate
Configuration Manager Port Diagram

1. Site Server < -- > Site Server

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
Point to Point Tunneling Protocol (PPTP) | -- | 1723 (See note 3, RAS Sender)

2. Primary Site Server -- > Domain Controller

Description | UDP | TCP
Lightweight Directory Access Protocol (LDAP) | -- | 389
LDAP (Secure Sockets Layer [SSL] connection) | 636 | 636
Global Catalog LDAP | -- | 3268
Global Catalog LDAP SSL | -- | 3269
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

3. Site Server < -- > Software Update Point

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
Hypertext Transfer Protocol (HTTP) | -- | 80 or 8530 (See note 4, Windows Server Update Services)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 or 8531 (See note 4, Windows Server Update Services)

4. Software Update Point -- > Internet

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 1, Proxy Server port)

5. Site Server < -- > State Migration Point

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135

6. Client -- > Software Update Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 or 8530 (See note 4, Windows Server Update Services)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 or 8531 (See note 4, Windows Server Update Services)

7. Client -- > State Migration Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 (See note 2, Alternate Port Available)
Server Message Block (SMB) | -- | 445

8. Client -- > PXE Service Point

Description | UDP | TCP
Dynamic Host Configuration Protocol (DHCP) | 67 and 68 | --
Trivial File Transfer Protocol (TFTP) | 69 (See note 5, Trivial FTP (TFTP) Daemon) | --
Boot Information Negotiation Layer (BINL) | 4011 | --

9. Site Server < -- > PXE Service Point

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

10. Site Server < -- > System Health Validator

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

11. Client -- > System Health Validator

The client requires the ports established by the Windows Network Access Protection client, which is dependent upon the enforcement client being used. For example, DHCP enforcement will use ports UDP 67 and 68. IPSec enforcement will use ports TCP 80 or 443 to the Health Registration Authority, port UDP 500 for IPsec negotiation and the additional ports needed for the IPsec filters. For more information, see the Windows Network Access Protection documentation. For help with configuring firewalls for IPsec, see http://go.microsoft.com/fwlink/?LinkId=109499.

12. Site Server < -- > Fallback Status Point

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

13. Client -- > Fallback Status Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)

14. Site Server -- > Distribution Point

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

15. Client -- > Distribution Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 (See note 2, Alternate Port Available)
Server Message Block (SMB) | -- | 445
Multicast Protocol | 63000-64000 | --

16. Client -- > Branch Distribution Point

Description | UDP | TCP
Server Message Block (SMB) | -- | 445

17. Client -- > Management Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 (See note 2, Alternate Port Available)

18. Client -- > Server Locator Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)

19. Branch Distribution Point -- > Distribution Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 (See note 2, Alternate Port Available)

20. Site Server -- > Provider

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

21. Server Locator Point -- > Microsoft SQL Server

Description | UDP | TCP
SQL over TCP | -- | 1433

22. Management Point -- > Microsoft SQL Server

Description | UDP | TCP
SQL over TCP | -- | 1433

23. Provider -- > SQL Server

Description | UDP | TCP
SQL over TCP | -- | 1433

24. Reporting Point -- > SQL Server / Reporting Services Point -- > SQL Server

The reporting point and the Reporting Services point use the same ports. The Reporting Services point is applicable to Configuration Manager 2007 R2 only.

Description | UDP | TCP
SQL over TCP | -- | 1433

25. Configuration Manager Console -- > Reporting Point

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 (See note 2, Alternate Port Available)

26. Configuration Manager Console -- > Provider

Description | UDP | TCP
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

27. Configuration Manager Console -- > Internet

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80

28. Primary Site Server -- > Microsoft SQL Server

Description | UDP | TCP
SQL over TCP | -- | 1433

29. Management Point -- > Domain Controller

Description | UDP | TCP
Lightweight Directory Access Protocol (LDAP) | -- | 389
LDAP (Secure Sockets Layer [SSL] connection) | 636 | 636
Global Catalog LDAP | -- | 3268
Global Catalog LDAP SSL | -- | 3269
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

30. Site Server -- > Reporting Point / Site Server -- > Reporting Services Point

The reporting point and the Reporting Services point use the same ports. The Reporting Services point is in Configuration Manager 2007 R2 only.

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

31. Site Server -- > Server Locator Point

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

32. Configuration Manager Console -- > Site Server

Description | UDP | TCP
RPC (initial connection to WMI to locate provider system) | -- | 135

33. Software Update Point -- > WSUS Synchronization Server

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 or 8530 (See note 4, Windows Server Update Services)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 or 8531 (See note 4, Windows Server Update Services)

34. Configuration Manager Console -- > Client

Description | UDP | TCP
Remote Control (control) | 2701 | 2701
Remote Control (data) | 2702 | 2702
Remote Control (RPC Endpoint Mapper) | -- | 135
Remote Assistance (RDP and RTC) | -- | 3389

35. Management Point < -- > Site Server

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
RPC Endpoint mapper | -- | 135
RPC | -- | DYNAMIC
Server Message Block (SMB) | -- | 445

36. Site Server -- > Client

Description | UDP | TCP
Wake on LAN | 9 (See note 2, Alternate Port Available) | --

37. Configuration Manager client -- > Global Catalog Domain Controller

A Configuration Manager client does not contact a global catalog server when it is a workgroup computer or when it is configured for Internet-only communication.

Description | UDP | TCP
Global Catalog LDAP | -- | 3268
Global Catalog LDAP SSL | -- | 3269

38. PXE Service Point -- > Microsoft SQL Server

Description | UDP | TCP
SQL over TCP | -- | 1433

39. Site Server < -- > Asset Intelligence Synchronization Point (Configuration Manager 2007 SP1)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

40. Asset Intelligence Synchronization Point < -- > System Center Online (Configuration Manager 2007 SP1)

Description | UDP | TCP
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443

41. Multicast Distribution Point -- > Microsoft SQL Server(Configuration Manager 2007 R2)

Description | UDP | TCP
SQL over TCP | -- | 1433

42. Client status reporting host --> Client (Configuration Manager 2007 R2)

Description | UDP | TCP
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC
ICMPv4 Type 8 (Echo) or ICMPv6 Type 128 (Echo Request) | n/a | n/a

43. Client status reporting host --> Management Point (Configuration Manager 2007 R2)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
NetBIOS Session Service | -- | 139

44. Client status reporting host --> Microsoft SQL Server (Configuration Manager 2007 R2)

Description | UDP | TCP
SQL over TCP | -- | 1433

45. Site Server < -- > Reporting Services Point (Configuration Manager 2007 R2)

(See note 6, Communication between the site server and site systems)

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

46. Configuration Manager Console -- > Reporting Services Point (Configuration Manager 2007 R2)

Description | UDP | TCP
Hypertext Transfer Protocol (HTTP) | -- | 80 (See note 2, Alternate Port Available)
Secure Hypertext Transfer Protocol (HTTPS) | -- | 443 (See note 2, Alternate Port Available)

47. Reporting Services Point -- > Microsoft SQL Server (Configuration Manager 2007 R2)

Description | UDP | TCP
SQL over TCP | -- | 1433

Notes

1 Proxy Server port This port cannot be configured but can be routed through a configured proxy server.

2 Alternate Port Available An alternate port can be defined within Configuration Manager for this value. If a custom port has been defined, substitute that custom port when defining the IP filter information for the IPsec policies.

3 RAS Sender Configuration Manager 2007 can also use the RAS Sender with Point to Point Tunneling Protocol (PPTP) to send and receive Configuration Manager 2007 site, client, and administrative information through a firewall. Under these circumstances, the PPTP TCP 1723 port is used.

4 Windows Server Update Services WSUS can be installed either on the default Web site (port 80) or a custom Web site (port 8530).

After installation, the port can be changed.

If the HTTP port is 80, the HTTPS port must be 443.

If the HTTP port is anything else, the HTTPS port must be 1 higher—for example 8530 and 8531.

5 Trivial FTP (TFTP) Daemon The Trivial FTP (TFTP) Daemon system service does not require a user name or password and is an integral part of the Windows Deployment Services (WDS). The Trivial FTP Daemon service implements support for the TFTP protocol defined by the following RFCs:

  • • RFC 350—TFTP
  • • RFC 2347—Option extension
  • • RFC 2348—Block size option
  • • RFC 2349—Time-out interval, and transfer size options

Trivial File Transfer Protocol is designed to support diskless boot environments. TFTP Daemons listen on UDP port 69 but respond from a dynamically allocated high port. Therefore, enabling this port will allow the TFTP service to receive incoming TFTP requests but will not allow the selected server to respond to those requests. Allowing the selected server to respond to inbound TFTP requests cannot be accomplished unless the TFTP server is configured to respond from port 69.

6 Communication between the site server and site systems By default, communication between the site server and site systems is bi-directional. The site server initiates communication to configure the site system, and then most site systems connect back to the site server to send back status information. Reporting points and distribution points do not send back status information. If you select Allow only site server initiated data transfers from this site system on the site system properties, the site system will never initiate communication back to the site server.

7 Ports used by distribution points for application virtualization streaming A distribution point enabled to support application virtualization can be configured to use either HTTP or HTTPS. This feature is available in Configuration Manager 2007 R2 only.

Configuration Manager Remote Control Ports

When you use NetBIOS over TCP/IP for Configuration Manager 2007 Remote Control, the ports described in the following table are used.

Description | UDP | TCP
RPC Endpoint Mapping | -- | 135
Name resolution | 137 | --
Messaging | 138 | --
Client Sessions | -- | 139

AMT Out of Band Management Ports (Configuration Manager 2007 SP1)

When you use the out of band management feature in Configuration Manager 2007 SP1, the following ports are used.

A. Site Server <--> Out of Band Service Point

Description | UDP | TCP
Server Message Block (SMB) | -- | 445
RPC Endpoint Mapper | 135 | 135
RPC | -- | DYNAMIC

B. AMT Management Controller --> Out of Band Service Point

Description | UDP | TCP
Provisioning | -- | 9971 (configurable)

C. Out of Band Service Point --> AMT Management Controller

Description | UDP | TCP
Discovery | -- | 16992
Power control, provisioning, and discovery | -- | 16993

D. Out of Band Management Console --> AMT Management Controller

Description | UDP | TCP
General management tasks | -- | 16993
Serial over LAN and IDE redirection | -- | 16995

Ports Used by Windows Servers

The following table lists some of the key ports that Windows Server uses and their respective functions. For a more complete list of Windows Server services and network ports requirements, see http://go.microsoft.com/fwlink/?LinkID=123652.

Description | UDP | TCP
Domain Name System (DNS) | 53 | --
Dynamic Host Configuration Protocol (DHCP) | 67 and 68 | --
Windows Internet Name Service (WINS) | 138 | --
NetBIOS datagrams | 138 | --
NetBIOS datagrams | -- | 139

Connecting with Microsoft SQL Server

If you use the TCP/IP Net-Library, enable port 1433 on the firewall. Use the Hosts file or an advanced connection string for host name resolution.

If you use named pipes over TCP/IP, enable port 139 for NetBIOS functions. NetBIOS should be used only for troubleshooting Kerberos issues.

Note
TCP/IP is required for network communications to allow Kerberos authentication. Named pipes communication is not required for Configuration Manager 2007 site database operations and should be used only to troubleshoot Kerberos authentication issues.

By default, SQL Server uses TCP (not UDP) port 1433 to listen on TCP/IP. To change the port, run SQL Server Setup on the server, and then click Change Network Support. If SQL Server uses port 1433, the client Net-Library works. If SQL Server uses a custom port number, the client must specify that port in the Data Source Name (DSN).

Microsoft does not recommend that you enable UDP ports 137 and 138 for NetBIOS name resolution by using B-node broadcasts. Instead, you can use a WINS server or an LMHOSTS file for name resolution.

Installation Requirements for Internet-Based Site Systems

The Internet-based management point, software update point, and fallback status point use the following ports for installation and repair:

  • Site server --> site system: RPC endpoint mapper using UDP and TCP port 135.
  • Site server --> site system: RPC dynamic TCP ports.
  • Site server < --> site system: Server message blocks (SMB) using TCP port 445.

Distribution points do not install until the first package is targeted to them. Package installations on distribution points require the following RPC ports:

  • Site server --> distribution point: RPC endpoint mapper using UDP and TCP port 135.
  • Site server --> distribution point: RPC dynamic TCP ports.
Important
Before installing these site systems, ensure that the remote registry service is running on the site system server and that you have specified a site system installation account if the site system is in a different Active Directory forest without a trust relationship. For more information, see How to Configure the Site System Installation Account.

See Also

Other Resources

Technical Reference for Configuration Manager Security


Accounts to Delete after Upgrading from SMS 2003

Before you can upgrade to Microsoft System Center Configuration Manager 2007, you must migrate from Systems Management Server 2003 standard security to advanced security and remove all Legacy Clients from the site. After the migration, but before you complete the upgrade, you should delete accounts that are no longer needed for legacy site and client operations.

Always Delete

The following accounts should always be deleted because they are never used for Configuration Manager 2007.

  • SMS Service account
  • CCM Boot Loader (DC) (SMS#_dc)
  • CCM Boot Loader (Non-DC)( SMSCCMBootAcct&)
  • Client Services (DC) (SMS&_dc)
  • Client Services (Non-DC) (SMSCliSvcAcct&)
  • Client User Token (DC) (SMSCliToknAcct&)
  • Client User Token (Non-DC) (SMSCliToknLocalAcct&)
  • Client Connection (SMSClient_sitecode)
  • Legacy Client Software Installation
  • Internal client group (SMSInternalCliGrp)
  • Site System Database (SMS_SQL_RX_sitecode)
  • Server Connection (SMSServer_sitecode)

The Site System to SQL Server Connection (SMS_SiteSystemToSQLConnection_sitecode) group is not used after upgrade and can be deleted for Configuration Manager 2007 sites, but is still used for SMS 2003 site servers and site systems to connect to their site database servers.

Do Not Delete

Do not delete the following groups; even though they have SMS in their names, they are still used for Configuration Manager 2007.

  • SMS Administrators (SMS Admins)
  • Reporting Users (SMS Reporting Users)
  • Site System to Site Server Connection (SMS_SiteSystemToSiteServerConnection_sitecode)
  • Site to Site Connection (SMS_SiteToSiteConnection_sitecode)

Do not delete the Client Push Installation account or the Site Address account, if used in your environment. These accounts are still used in Configuration Manager 2007. The Advanced Client Network Access account can still be used in Configuration Manager 2007, but is called simply the Network Access account.

See Also

Concepts

Checklist for Configuration Manager Account Security

Other Resources

Technical Reference for Configuration Manager Security


Maintaining Configuration Manager 2007

After you deploying Configuration Manager 2007 sites routine maintenance should be performed to maintain site performance at optimal levels. Use the information provided in this section to help maintain Configuration Manager sites.

In This Section

Planning for Site Maintenance

Overview of Site Maintenance

Configuring Site Maintenance

Tasks For Maintaining Sites

Planning for Backup and Recovery

Overview of Backup and Recovery

Tasks for Backing Up a Site

Tasks for Recovering a Site

Troubleshooting Site Maintenance

Troubleshooting Backup and Recovery Issues

See Also

Concepts

Configuration Manager Documentation Library

Other Resources

Planning and Deploying the Server Infrastructure for Configuration Manager 2007


Planning for Site Maintenance

In addition to performing regular system maintenance for the server computers hosting Configuration Manager 2007 site systems and clients, regular site database maintenance is also important for the Configuration Manager site operations.

Many predefined maintenance tasks are provided in the Configuration Manager console to maintain the site database, but not all are enabled by default. Depending on the site configuration and features enabled or in use, the maintenance tasks and their schedules will vary. Additional maintenance tasks can also be created for custom site database maintenance requirements.

For best Configuration Manager site performance, regular site system and site database maintenance must be performed. For more information about maintaining Configuration Manager 2007 sites, see Configuring Site Maintenance.

In this Section

Predefined Maintenance Task Planning

Custom Maintenance Task Planning

See Also

Other Resources

Maintaining Configuration Manager 2007


Predefined Maintenance Task Planning

There are many predefined site database maintenance tasks that you can configure to maintain Configuration Manager 2007 sites. Some predefined maintenance tasks are applicable for all site installations, and others may only be applicable depending on how the site has been configured.

Predefined maintenance tasks may impact site performance if they are enabled and scheduled to run when site system or site database server system resources are in high demand.

Predefined Maintenance Task Schedules

The following table displays the predefined maintenance tasks and their default schedules.

Maintenance Task | Enabled by default | Default schedule
Backup ConfigMgr Site Server | No | None.
Clear Install Flag | No | Sunday between midnight and 5:00 A.M.
Delete Aged Client Access License Data | No | Saturday between midnight and 5:00 A.M.
Delete Aged Collected Files | Yes | Saturday between midnight and 5:00 A.M.
Delete Aged Computer Association Data | Yes | Saturday, between midnight and 5:00 A.M.
Delete Aged Configuration Management Data | Yes | Saturday, between midnight and 5:00 A.M.
Delete Aged Discovery Data | Yes | Saturday, between midnight and 5:00 A.M.
Delete Aged Inventory History | Yes | Saturday, between midnight and 5:00 A.M.
Delete Aged Software Metering Data | Yes | Daily, between midnight and 5:00 A.M.
Delete Aged Software Metering Summary Data | Yes | Sunday between midnight and 5:00 A.M.
Delete Aged Status Messages | Yes | Daily, between midnight and 5:00 A.M.
Delete Inactive Client Discovery | No | Saturday between midnight and 5:00 A.M.
Delete Obsolete Client Discovery Data | No | Saturday between midnight and 5:00 A.M.
Monitor Keys | Yes | Sunday, between midnight and 5:00 A.M.
Rebuild Indexes | Yes | Sunday, between midnight and 5:00 A.M.
Summarize Client Access License Weekly Usage Data | No | Saturday between midnight and 5:00 A.M.
Summarize Software Metering File Usage Data | Yes | Daily, between midnight and 5:00 A.M.
Summarize Software Metering Monthly Usage Data | Yes | Daily, between midnight and 5:00 A.M.

See Also

Concepts

Planning for Site Maintenance

Other Resources

Predefined Maintenance Tasks


Custom Maintenance Task Planning

You can create custom maintenance tasks that run valid SQL commands directly against the Configuration Manager 2007 site database. You can specify a single SQL command up to 255 characters long or the name of an existing stored procedure.

When planning for custom site maintenance tasks, ensure that you verify the impact of the task on site database operations and schedule the custom maintenance task to run when the site database operations will not be affected.

See Also

Concepts

Planning for Site Maintenance


Overview of Site Maintenance

Configuration Manager 2007 sites require regular maintenance and monitoring to provide services effectively and continuously. Regular maintenance ensures that the hardware, software, and the Configuration Manager 2007 site database continue to function properly and efficiently. When site performance is optimal, the risk of site failure is greatly reduced.

Configuration Manager 2007 provides several predefined maintenance tasks that you can use to regularly maintain the health of the Configuration Manager 2007 site database. You can also develop maintenance tasks customized to your organization by using custom maintenance tasks. Custom maintenance tasks are SQL commands that are configured in the Configuration Manager console and run directly against the site database.

After setting up your Configuration Manager 2007 site, you should immediately begin to implement a site maintenance and monitoring plan.

When monitoring sites, look for signs that indicate problems that require intervention. For example:

  • File backlog on site servers and site systems.
  • Status messages that indicate an error or a problem.
  • Failing intrasite communication.
  • Error and warning messages in the system’s event log on the most important servers.
Note
When Configuration Manager 2007 is configured to write status messages to the system’s event log, error status messages are written as information events rather than error events.

  • Error and warning messages in the Microsoft SQL Server error log.
  • Sites or clients that have not reported in a long time.
  • Signs of hardware failure.

To minimize the risk of a site failure, if monitoring tasks reveal any signs of problems, investigate the source of the problem and repair it as soon as possible.

In This Section

Predefined Maintenance Tasks

Custom Maintenance Tasks

See Also

Other Resources

Maintaining Configuration Manager 2007


Predefined Maintenance Tasks

As your Configuration Manager 2007 site performs the tasks that you schedule and configure, site components continually add data to the site's database. As the amount of data grows, database performance declines.

Predefined maintenance tasks target the Configuration Manager 2007 site database and continually remove out-of-date data. Reducing the size of the database by removing unnecessary data improves the performance and the integrity of the database, which increases the efficiency of the site.

Primary sites have all of the predefined maintenance tasks available as listed below. The only predefined maintenance task available for secondary sites however, is the Backup Site Server maintenance task.

Note
Predefined maintenance tasks log their activity to the SMS_SQL_Monitor log file (SMSdbmon.log).

In This Section

Backup ConfigMgr Site Server Task Overview

Backs up a Configuration Manager 2007 site, including the site database, files, registry keys, and system configuration information

Clear Install Flag Task Overview

Flags uninstalled clients as uninstalled in the site database to allow them to be reinstalled by the client push installation method.

When enabling this task, set the client rediscovery period to an interval longer than the heartbeat discovery schedule.

Important
Because this task relies on heartbeat discovery, you should disable this task if heartbeat discovery has not been enabled.

Delete Aged Client Access License Data Task Overview

Deletes aged Client Access License (CAL) data from the site database.

Delete Aged Collected Files Task Overview

Deletes aged collected files data from the site database.

Delete Aged Computer Association Data Task Overview

Deletes Operating System Deployment computer association data from the site database after it has been deleted as part of user state restore.

Delete Aged Configuration Management Data Task Overview

Deletes outdated configuration item definitions and any associated configuration item compliance history data from the site database.

Delete Aged Discovery Data Task Overview

Deletes aged client discovery data from the site database.

Delete Aged Inventory History Task Overview

Deletes all client hardware inventory history data older than the number of days specified from the site database.

Delete Aged Software Metering Data Task Overview

Deletes all client software usage data older than the number of days specified from the site database.

Delete Aged Software Metering Summary Data Overview

Deletes all software metering summary data older than the number of days specified from the site database.

Delete Aged Status Messages Task Overview

Deletes aged status messages from the site database.

Delete Inactive Client Discovery Data Task Overview

Deletes inactive client records from the site database.

Delete Obsolete Client Discovery Data Task Overview

Deletes obsolete client records from the site database.

Monitor Keys Task Overview

Monitors the integrity of site database primary keys.

Rebuild Indexes Task Overview

Rebuilds indexes used by the site database.

Summarize Client Access License Weekly Usage Data Task Overview

Summarizes CAL usage and creates a weekly data point for long term trending.

Summarize Software Metering File Usage Data Task Overview

Summarizes software metering file usage data from multiple records into one general record to compress the amount of data stored in the site database.

Summarize Software Metering Monthly Usage Data Task Overview

Summarizes detailed software metering usage data from multiple records into one general record to compress the amount of data stored in the site database.

This task can be used with the summarize software metering file usage data maintenance task to summarize software metering data and to conserve space in the site database.

See Also

Tasks

How To Schedule a Site Maintenance Task


Backup ConfigMgr Site Server Task Overview

The Backup ConfigMgr Site Server maintenance task backs up a Configuration Manager 2007 site, including the Configuration Manager 2007 site database, Configuration Manager 2007 files, registry keys, and system configuration information. Backing up your site is an essential step when preparing the site for recovery in case of site failure. When recovering a failed site, having a comprehensive site backup snapshot greatly helps in restoring the site to its original state as quickly as possible.

Important
Using a third-party backup tool to back up your Configuration Manager 2007 site is not supported by the Configuration Manager Site Repair Wizard. Only site backups created by the Backup ConfigMgr Site Server task can be used to recover a site by the Configuration Manager Site Repair Wizard.

Specify the backup destination folder in local format (for example, C:\Sitebackups) or in UNC format (for example, \\server\share). If the path entered does not exist, it is created by the maintenance task.

Note
The backup task will fail if you specify any backup destination within the Configuration Manager 2007 installation folder.

Defaults Backs up the Configuration Manager 2007 site database, Configuration Manager 2007 files, registry keys, and system configuration information; not enabled.

See Also

Tasks

How To Schedule a Site Maintenance Task

Concepts

Backing up Configuration Manager Sites
About the Site Repair Wizard

Other Resources

Predefined Maintenance Tasks


Clear Install Flag Task Overview

When Configuration Manager 2007 client software is installed on a computer, the client record in the site database is flagged with an installed status. The client record in the database maintains the installed status even if the Configuration Manager 2007 client software is later uninstalled. The Clear Install Flag task clears the installed flag on the client record in the site database if the client is not rediscovered by Heartbeat Discovery.

Use the Clear Install Flag task to flag uninstalled clients as uninstalled, thus allowing them to be reinstalled by the Client Push Installation method.

When enabling this task, set the Client Rediscovery period to an interval longer than the Heartbeat Discovery schedule.

Important
Because this task relies on Heartbeat Discovery, you should disable this task if Heartbeat Discovery has not been enabled.

Defaults This task is not enabled by default. When enabled, this task will clear the client install flag for clients not discovered by heartbeat discovery within the last 21 days. The default schedule for this task to run is every 7 days on Sunday between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Concepts

About Heartbeat Discovery

Other Resources

Predefined Maintenance Tasks


Delete Aged Client Access License Data Task Overview

If the Delete Aged Client Access License Data Task is enabled, it deletes aged Client Access License (CAL) data from the Configuration Manager 2007 site database at the selected site only. Databases at other sites are not affected.

The age of data to be deleted can be set in the task properties. This task is disabled by default. For more information about enabling and adjusting the schedule for this task, see How To Schedule a Site Maintenance Task.

Defaults Not enabled. Delete CAL data older than 180 days. Runs on Saturday between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Concepts

How to Enable Asset Intelligence

Other Resources

Predefined Maintenance Tasks


Delete Aged Collected Files Task Overview

The Delete Aged Collected Files task is used to delete aged collected files data from the Configuration Manager 2007 site database and from the site server folder structure at the selected site only. Databases at other sites are not affected.

Once collected, files specified to be collected will only be collected during subsequent inventories if they have changed since the previous inventory. By default, the five most recent copies of collected files are stored on the site server in the inboxes\sinv.box\FileCol directory.

Defaults Delete collected files data older than 90 days; runs on Saturday between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task
How to Collect Files from Clients

Other Resources

Predefined Maintenance Tasks


Delete Aged Computer Association Data Task Overview

The Delete Aged Computer Association Data maintenance task deletes all Operating System Deployment computer association record data that has been deleted as part of completing user state restores.

Defaults Deletes aged operating system deployment computer association record data older than 30 days; runs on Saturday between 12 A.M. and 5 A.M. This task is enabled by default.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Delete Aged Configuration Management Data Task Overview

When changes are made to configuration items created when using desired configuration management, software updates management, or operating system deployment, the site database is updated with the new configuration item definition. The original configuration item definition is also stored in the site database. When clients have stopped reporting the original configuration item definition, the definition and any configuration item compliance history associated with that version is removed from the database according to the schedule you have specified.

Defaults Deletes aged configuration management data over 90 days old. Runs every 7 days, on Saturday, between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Delete Aged Discovery Data Task Overview

The Delete Aged Discovery Data task deletes aged client discovery data from the Configuration Manager 2007 site database. This data can include records resulting from heartbeat discovery, network discovery, and Active Directory Domain Services discovery methods (System, User, and System Group).

Databases at other sites are affected when you enable this task.

You can specify the age of the discovery data to be deleted. This command deletes everything relevant to those discovery items from the Configuration Manager 2007 site database.

Defaults Delete discovery data older than 90 days; runs on Saturday between midnight and 5:00 A.M..

See Also

Tasks

How To Schedule a Site Maintenance Task

Concepts

About Configuration Manager Discovery

Other Resources

Predefined Maintenance Tasks


Delete Aged Inventory History Task Overview

If the hardware inventory client agent is enabled at a site, or at any of its child sites, the Delete Aged Inventory History task deletes all client hardware inventory history data older than the number of days specified. The inventory history data is deleted from the Configuration Manager 2007 site database at the selected site only. After this task runs, only the current inventory data is left in the Configuration Manager 2007 site database. Site databases at other sites are not affected.

Defaults Deletes hardware inventory data older than 90 days; runs on Saturday between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task
How to Configure Hardware Inventory for a Site

Other Resources

Predefined Maintenance Tasks


Delete Aged Software Metering Data Task Overview

The Delete Aged Software Metering Data task deletes all client software usage data older than the number of days specified from the Configuration Manager 2007 site database. Configuration Manager 2007 site databases at other sites are not affected.

Note
The minimum number of days that you can set to delete all software usage data is two. The maximum number is 255.

Defaults Deletes software usage data older than five days; runs daily.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Delete Aged Software Metering Summary Data Overview

The Delete Aged Software Metering Summary Data task deletes all software metering summary data older than the number of days specified. Only the most current summarized data is left in the Configuration Manager 2007 database. Configuration Manager 2007 site databases at other sites are not affected.

Defaults Deletes software usage summary data older than 270 days; runs on Sunday between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Delete Aged Status Messages Task Overview

The Delete Aged Status Messages task deletes aged status messages from the Configuration Manager 2007 site database at the selected site only. Databases at other sites are not affected.

Note
Status messages can be very numerous. Running this command less often is not recommended.

The Delete Aged Status Messages Task properties dialog box does not allow you to specify an age for the messages to delete. Instead, you must configure the age of messages to delete by using status filter rules in the Configuration Manager console. The default status filter rules keep audit messages for 180 days and all other messages for 30 days. To change these intervals, modify existing status filter rules or create new ones specifying how long messages are kept in the site database.

Caution
Status messages might be required to diagnose the status of the Configuration Manager 2007 system. Do not delete status messages until you have reviewed them and are sure that you do not need them.

Defaults Deletes status messages older than seven days; runs daily between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Delete Inactive Client Discovery Data Task Overview

The Delete Inactive Client Discovery Data task deletes inactive client records from the Configuration Manager 2007 site database.

Clients are marked inactive in two ways:

  • When a client is flagged as obsolete it is also marked as inactive.
  • Clients can be marked inactive by the client health tool if the tool is configured to mark clients as inactive.
Note
The client health tool is not included in Configuration Manager Setup and must be downloaded and installed separately.

The Delete Inactive Client Discovery Data task is similar to the Delete Aged Discovery Data task. However, this task operates only on resources that are Configuration Manager 2007 clients. The Delete Aged Discovery Data task operates on all discovered resources.

When enabling this task, you should configure the schedule to run at an interval greater than the Heartbeat Discovery schedule. This allows active clients to send a Heartbeat Discovery record to mark their client record as active so that this task does not delete them.

Defaults Delete inactive client discovery data older than 90 days; Runs on Saturday between midnight and 5:00 A.M.. Not enabled by default.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Delete Obsolete Client Discovery Data Task Overview

The Delete Obsolete Client Discovery Data task deletes obsolete client records from the Configuration Manager 2007 site database. A record that is marked obsolete typically was superseded by a newer record for the same client. The newer record becomes the client's current record, and the older record becomes obsolete.

When you enable this task, you should configure the schedule to run at an interval greater than the heartbeat discovery schedule. This allows clients to send Discovery Data Records (DDRs) so that the obsolete bit is set correctly.

Defaults Deletes obsolete client discovery data older than seven days; runs on Saturday. This task is not enabled by default.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Monitor Keys Task Overview

The Monitor Keys task monitors the integrity of site database primary keys. A primary key is a column or combination of columns that uniquely identify one row and distinguish it from any other row in a Microsoft SQL Server database table.

Defaults Runs every Sunday, between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Rebuild Indexes Task Overview

The Rebuild Indexes task rebuilds indexes used by the Configuration Manager 2007 site database. An index is a database structure created on a database table to speed up data retrieval. For example, searching an indexed column is often much faster than searching a column that is not indexed.

To improve performance, the Configuration Manager 2007 site database indexes are frequently updated to remain synchronized with the constantly changing data stored in the database. This task creates indexes on database columns that are at least 50 percent unique, drops indexes on columns that are less than 50 percent unique, and rebuilds all existing indexes that meet the data uniqueness criteria.

Defaults Runs every Sunday, between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Other Resources

Predefined Maintenance Tasks


Summarize Client Access License Weekly Usage Data Task Overview

If the Summarize Client Access License Weekly Usage Data Task is enabled, it gathers user Client Access License (CAL) data and device CAL data from the Configuration Manager 2007 site database and creates weekly summary data points. These data points are used for CAL trending and are necessary for several license management reports. Furthermore, by gathering this data into periodic data points, a historical reference is maintained long after the raw data has been purged.

This task is disabled by default. For more information about enabling and adjusting the schedule for this task, see How To Schedule a Site Maintenance Task.

Defaults Not enabled. Runs on Saturday between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Concepts

How to Enable Asset Intelligence

Other Resources

Predefined Maintenance Tasks


Summarize Software Metering File Usage Data Task Overview

If the Software Metering Client Agent is enabled at a site, or at any of its child sites, the Summarize Software Metering File Usage Data task summarizes software metering file usage data from multiple records into one general record. This record provides summarized information about the application name, version, language, number of concurrent users, and hourly usage over a specified length of time. Data summarization helps compress the amount of data stored in the Configuration Manager 2007 site database.

This task can be used with the Summarize Software Metering Monthly Usage Data task to summarize software metering data, and to conserve space in the Configuration Manager 2007 site database.

Defaults Runs daily, between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Reference

Summarize Software Metering Monthly Usage Data Task Overview

Other Resources

Predefined Maintenance Tasks


Summarize Software Metering Monthly Usage Data Task Overview

If the Software Metering Client Agent is enabled at a site, or at any of its child sites, the Summarize Software Metering Monthly Usage Data task condenses detailed software metering usage data from multiple records into one general record. This record provides information about application start and stop times, user name, computer name, program name, version, and language. Data summarization helps compress the amount of data in the site database. Monthly software usage data is sent to the central site.

This task can be used with the Summarize Software Metering File Usage Data task to summarize software metering data and to conserve space in the Configuration Manager 2007 site database.

Defaults Summarizes messages older than one month; runs daily, between midnight and 5:00 A.M.

See Also

Tasks

How To Schedule a Site Maintenance Task

Reference

Summarize Software Metering File Usage Data Task Overview

Other Resources

Predefined Maintenance Tasks


Custom Maintenance Tasks

You can create custom maintenance tasks that run valid SQL commands directly against the Configuration Manager 2007 site database.

You can specify a single SQL command up to 255 characters long or the name of an existing stored procedure. For example, you can use the following SQL commands to create helpful custom maintenance tasks:

  • The SQL Server 2005 DBCC CHECKDB (Database Consistency Check) stored procedure can be used to check the logical and physical integrity of all the objects in the site database. The DBCC CHECKDB stored procedure, performs the following operations:
    • Runs DBCC CHECKALLOC on the database.
    • Runs DBCC CHECKTABLE on every table and view in the database.
    • Runs DBCC CHECKCATALOG on the database.
    • Validates the contents of every indexed view in the database.
    • Validates the Service Broker data in the database.
  • The SQL xp_sqlmaint command runs database maintenance tasks.
  • The SQL sp_who command determines the number of SQL Server connections currently in use by Microsoft System Center Configuration Manager 2007, or by any other process.
  • The SQL sp_spaceused command displays the number of rows, disk space reserved, and disk space used by a table in the current database, or displays the disk space reserved and used by the entire database.
  • The SQL sp_monitor command displays SQL Server activities and statistics.

See Also

Tasks

How To Create a Custom Maintenance Task


Configuring Site Maintenance

You can use the recommended maintenance task schedules in this section to help you configure site maintenance tasks.

In This Section

Daily Maintenance Tasks

Common daily maintenance tasks.

Weekly Maintenance Tasks

Common weekly maintenance tasks.

Periodic Maintenance Tasks

Common periodic maintenance tasks.

See Also

Other Resources

Overview of Site Maintenance
Maintaining Configuration Manager 2007


Daily Maintenance Tasks

Performing daily maintenance is important to ensure proper site operations. A daily maintenance log should be maintained to document dates that maintenance was conducted, by whom, and any maintenance-related comments about the task conducted.

Common Daily Maintenance Tasks

Some common daily maintenance tasks are listed below. Add any other maintenance tasks as needed to your daily maintenance log:

  • Verify that predefined maintenance tasks scheduled to run daily are running successfully.
  • Check Configuration Manager 2007 site database status.
  • Check site server status.
  • Check Configuration Manager 2007 site system inboxes for backlogs.
  • Check site systems status.
  • Check client status.
  • Check the operating system event logs on site systems.
  • Check the SQL Server error log.
  • Check system performance.

See Also

Concepts

Configuring Site Maintenance


Weekly Maintenance Tasks

Performing weekly maintenance is important to ensure proper site operations. A weekly maintenance log should be maintained to document dates that maintenance was conducted, by whom, and any maintenance related comments about the task conducted.

Common Weekly Maintenance Tasks

Some common weekly maintenance tasks are listed below. Add any other maintenance tasks as needed to your weekly maintenance log:

  • Verify that predefined maintenance tasks scheduled to run weekly are running successfully.
  • Delete unnecessary files from site systems.
  • Produce and distribute end-user reports if required.
  • Back up application, security, and system event logs and clear them.
  • Check the site database size and verify that there is enough available disk space on the site database server to allow the site database to grow.
  • Perform SQL Server database maintenance on the site database according to your SQL Server maintenance plan.
  • Check available disk space on all site systems.
  • Run disk defragmentation tools on all site systems.

See Also

Concepts

Configuring Site Maintenance


Periodic Maintenance Tasks

Performing periodic maintenance is important to ensure proper site operations. Some tasks do not need to be performed during daily or weekly maintenance, but are important to ensure overall site health and security and disaster recovery plans are up to date. A periodic maintenance log should be maintained to document dates that maintenance was conducted, by whom, and any maintenance related comments about the task conducted.

Common Periodic Maintenance Tasks

Some common periodic maintenance tasks are listed below. Add any other maintenance tasks as needed to your periodic maintenance log:

  • Review the security plan for any needed changes.
  • Change accounts and passwords if necessary according to your security plan.
  • Review the maintenance plan to verify that scheduled maintenance tasks are scheduled properly and effectively depending on configured site settings.
  • Review the Configuration Manager 2007 hierarchy design for any needed changes.
  • Check network performance to ensure changes have not been made that affect site operations.
  • Verify Active Directory settings affecting site operations have not changed. For example, you should ensure that subnets assigned to Active Directory sites used as boundaries for a Configuration Manager 2007 site have not changed.
  • Review the disaster recovery plan for any needed changes.
  • Perform a site recovery according to the disaster recovery plan in a test lab using a backup copy of the most recent backup snapshot created by the Backup ConfigMgr Site Server maintenance task.
  • Check hardware for any errors or hardware updates available.
  • Check overall health of site.

See Also

Concepts

Configuring Site Maintenance


Tasks For Maintaining Sites

There are many tasks associated with maintaining a Configuration Manager 2007 site and site database.

In This Section

How To Schedule a Site Maintenance Task

How To Create a Custom Maintenance Task

How to Change Site Configurations

How to Change Site Server Software

How to Change Site Server Hardware

See Also

Other Resources

Maintaining Configuration Manager 2007


How To Schedule a Site Maintenance Task
Note
You must have Read or Modify permission for the site security object class or instance to perform this procedure.

To schedule a site maintenance task

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Site Maintenance / Tasks.

  2. In the results pane, right-click the task that you want to schedule and click Properties.

  3. In the task properties dialog box, enable and configure the task. To minimize interference with the site operation, set the time period to off-peak hours of the site. The time period is the time interval in which the task can run. It is defined by the Start after and Latest start time specified in the task properties dialog box.

  4. Click OK to save your settings. The task will now run according to its schedule.

    Note
    If a task fails to run on the first attempt, the SMS_SQL_Monitor service attempts to rerun the task until either the task runs successfully or until the time period in which the task can run has passed.

See Also

Other Resources

Tasks For Maintaining Sites


How To Create a Custom Maintenance Task

You can create custom maintenance tasks that run valid SQL commands directly against the Configuration Manager 2007 site database.

Custom SQL commands are very powerful because they directly manipulate the Configuration Manager 2007 site database. Improper SQL commands can corrupt the Configuration Manager 2007 site database. You should secure the Configuration Manager 2007 site database by limiting the Manage SQL Commands Configuration Manager 2007 object security right to the appropriate administrators.

For more information about creating stored procedures, see How to: Create a Stored Procedure (SQL Server Management Studio) at http://go.microsoft.com/fwlink/?LinkId=73758.

To create a custom maintenance task

  1. In the Configuration Manager 2007 console, navigate to SQL Commands.
    In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Site Maintenance / SQL Commands.

  2. Right-click SQL Commands, and select New SQL Command.

  3. In the New SQL Command Properties dialog box, enter a name and configure the task:

    • Specify a SQL command. You can specify a single SQL command up to 255 characters or the name of a stored procedure that contains multiple SQL commands.
    • Specify a path and log file name if you want to review the results after the SQL command runs.
    • Specify a schedule for the SQL command.
Important
SQL commands are not validated by Configuration Manager 2007 for syntax. Before you schedule a custom maintenance task, ensure that the SQL command is valid by testing it in SQL Server Management Studio.

See Also

Concepts

Custom Maintenance Tasks


How to Change Site Configurations

Configuration Manager 2007 site configuration changes can be made by running Configuration Manager Setup after the site has been successfully installed.

In This Section

How to Move the Site Database

Describes how to move the Site Database.

How to Move the SMS Provider

Describes how to move the SMS Provider.

See Also

Other Resources

Tasks For Maintaining Sites


How to Move the Site Database

Topic last updated—January 2008

You can move the SQL Server site database after setup has completed to a different SQL Server computer system by starting Configuration Manager Setup from the Start menu or from the Configuration Manager installation media.

Note
Configuration Manager 2007 does support moving the site database from a remote SQL Server to the local site server computer (if SQL Server 2005 SP2 is installed).

To move the site database

  1. Back up the site database on the current site database server and restore it on the new site database server computer using the SQL Server Management Studio.

    Note
    Ensure that the database access permissions are the same on the new site database as they are on the original site database.

  2. Ensure the primary site server computer account has administrative privileges over the new site database server computer.

  3. Close any open Configuration Manager console connections to the site server.

  4. On the primary site server computer, use the hierarchy maintenance tool (Preinst.exe) to stop all site services with the following command: Preinst /stopsite.

  5. On the primary site server computer, click Start, click All Programs, click Microsoft System Center, click Configuration Manager 2007, and click ConfigMgr Setup, or navigate to the .\bin\i386 directory of the Configuration Manager 2007 installation media and double-click Setup.exe.

  6. Click Next on the Configuration Manager Setup Wizard Welcome page.

  7. Click Perform site maintenance or reset this site on the Configuration Manager Setup Wizard Setup Options page.

  8. Select Modify SQL Server configuration on the Configuration Manager Setup Wizard Site Maintenance page.

  9. Enter the appropriate SQL Server name and instance (if applicable) for the new site database server as well as the site database name on the Configuration Manager Setup Wizard SQL Server Configuration page.

  10. Configuration Manager Setup performs the SQL Server configuration process.

  11. Restart the primary site server computer, and verify the site is functioning normally.

See Also

Other Resources

How to Change Site Configurations


How to Move the SMS Provider

The SMS Provider is a component of Configuration Manager 2007 primary sites and is used by Configuration Manager consoles to access site database information from the SQL Server hosting the site database.

The SMS Provider is a dynamic-link library file (smsprov.dll) and is installed or moved by running Configuration Manager 2007 Setup. You can install the SMS Provider on the primary site server computer, the computer hosting the site database server, or another computer not hosting the primary site or site database. A server class operating system is required to install the SMS Provider on a computer other than the site server or site database server computers.

Important
Installing the SMS Provider on a virtual SQL Server cluster instance is not supported.

You can move the SMS Provider after setup has completed to a different server computer system by starting Configuration Manager Setup from the Start menu (if the SMS Provider is installed on the primary site server) or from the Configuration Manager installation media.

To move the SMS Provider using the Start menu

  1. Close any open Configuration Manager console connections to the site server.

  2. On the primary site server computer, click Start, click All Programs, click Microsoft System Center, click Configuration Manager 2007, and click ConfigMgr Setup, or navigate to the .\bin\i386 directory of the Configuration Manager 2007 installation media and double-click Setup.exe.

  3. Click Next on the Configuration Manager Setup Wizard Welcome page.

  4. Click Perform site maintenance or reset this site on the Configuration Manager Setup Wizard Setup Options page.

  5. Select Modify SMS Provider configuration on the Configuration Manager Setup Wizard Site Maintenance page.

  6. Enter the appropriate installation location for the SMS Provider on the Configuration Manager Setup Wizard SMS Provider Settings Modification page.

  7. Configuration Manager Setup performs the SMS Provider reinstallation process.

See Also

Other Resources

How to Change Site Configurations


How to Change Site Server Software

Before changing site system software, all Configuration Manager 2007 services in use must be stopped. For example, this procedure can be followed when upgrading the operating system or service pack level of site system operating system software.

To change site system software

  1. Ensure that the site is properly backed up, and perform a test recovery in a test lab according to your disaster recovery plan.

  2. Use the hierarchy maintenance tool (Preinst.exe) to stop all Configuration Manager services by using the Preinst /stopsite command.

    Note
    Using the Preinst /stopsite command will cause a partial site reset and cause site services to be reinstalled when the site is restarted.

  3. Change the software of the computer hosting the Configuration Manager site system components according to the relevant software documentation.

  4. After the software has been changed, restart the computer and verify that the site is operating normally after site services are reinstalled by site component manager.

See Also

Concepts

Hierarchy Maintenance Tool Syntax

Other Resources

Tasks For Maintaining Sites


How to Change Site Server Hardware

Before changing hardware on site systems, all Configuration Manager 2007 services in use must be stopped.

To change site server hardware

  1. Ensure that the site is properly backed up, and perform a test recovery in a test lab according to your disaster recovery plan.

  2. Properly shut down the site server computer.

  3. Change the hardware of the computer hosting the Configuration Manager site system components according to the hardware component documentation.

  4. After the hardware has been changed, restart the computer and verify that the site is operating normally after site services are reinstalled by site component manager.

See Also

Concepts

Hierarchy Maintenance Tool Syntax

Other Resources

Tasks For Maintaining Sites


Planning for Backup and Recovery

Consider the information in this section when planning for Configuration Manager 2007 backup and recovery operations.

Planning for Backup

Volume Shadow Copy Service

The Configuration Manager 2007 backup task utilizes the Volume Shadow copy Service (VSS) to create the backup snapshot. VSS is essentially a framework which facilitates communication between applications, storage subsystems, and storage management applications (including backup applications) in order to define point-in-time copies of storage data. These point-in-time copies, or shadow copies, of site server and site database information are used to backup and restore Configuration Manager sites. By using VSS shadow copies, the Backup ConfigMgr Site Server maintenance task is able to minimize off-line times for site servers.

What Gets Backed Up

In order to completely back up a Configuration Manager 2007 site server, the following data needs to be included in the backup:

  • The Configuration Manager site database (SQL Server database)
  • Configuration Manager installation directory on the site server
  • Master site control file (.\Inboxes\Sitectrl.box\Sitectrl.ct0)
  • SMS and NAL registry keys on the site server

What Does Not Get Backed Up

Some Configuration Manager 2007 site systems contain site data that is easily recreated if the site fails and are not backed up during the site backup process. For example, there is no need to backup data from site systems such as standard and branch distribution points, management points, reporting points, and server locator points. These site systems can easily be reinstalled by the site server if they fail.

The Backup ConfigMgr Site Server maintenance task backs up logs located in the Configuration Manager logs directory, but some Configuration Manager 2007 site systems write logs in other locations and are not backed up by the Backup ConfigMgr Site Server maintenance task. You should plan an alternative method to back up these logs if required.

It is not necessary to back up the SQL Server master database when backing up the Configuration Manager site database. The Backup ConfigMgr Site Server maintenance task backs up all of the required information for restoring the site from the SQL Server hosting the site database as part of the backup process. The original SQL Server master database is not required for restoring the site database on a new SQL database server.

Backing up Configuration Manager 2007 clients are not backed up as part of the site backup process for the following reasons:

  • To properly back up a Configuration Manager client, the client services must be stopped. However, there is no reliable way to stop and start the client services. Stopping and starting the client services can potentially corrupt the data on the client’s disk or in the backup snapshot.
  • Clients are too numerous. It is neither practical nor beneficial to backup and restore the clients assigned to a site.
  • The effect of losing client data is relatively small.

Maintenance Mode Support

When the Backup ConfigMgr Site Server maintenance task performs a site backup, critical site services must be stopped including:

  • SMS Executive service (SMS_Executive)
  • SMS Site Component Manager service (SMS_Site_Component_Manager)

If the site server or site database server is being monitored by the Microsoft Operations Manager 2005 or System Center Operations Manager 2007 client monitoring agent, the backup process may generate false stop service alerts when critical Configuration Manager 2007 services are stopped for backup. To avoid this problem, the entire backup process is monitored as a single transaction and managed utilizing Microsoft Operations Manager maintenance mode state management.

See Also

Other Resources

Maintaining Configuration Manager 2007


Overview of Backup and Recovery

Preparing for loss of critical data by planning for both backup and recovery operations is a necessity for enterprise solutions such as Configuration Manager 2007. For Configuration Manager 2007 sites, this preparation ensures that sites and hierarchies are recovered with the least data loss and in the quickest possible time.

A Configuration Manager 2007 site contains a large amount of data, which is mostly stored in the site server computer's registry, system files, and the Microsoft SQL Server site database. A Configuration Manager 2007 site operates properly only when the data in all of these data stores is synchronized. Backing up only one data store, such as the Configuration Manager 2007 site database, is not sufficient as a backup strategy. You will not be able to recover a site by using only a partial site backup because the site’s data will be out of synchronization.

To ensure that you are properly backing up your sites, you should schedule the Backup ConfigMgr Site Server maintenance task for each primary and secondary site in your hierarchy. The Backup ConfigMgr Site Server maintenance task creates a complete backup snapshot of your site containing all the data necessary to perform recovery operations using the Site Repair Wizard.

A complete backup snapshot, created by the Backup ConfigMgr Site Server maintenance task, is required to properly perform a site repair operation using the Configuration Manager 2007 Site Repair Wizard. Attempting to recover a site without a complete backup snapshot, or without using the Site Repair Wizard, will result in data that is out of synchronization, and you might corrupt the site’s data.

See Also

Concepts

Backing up Configuration Manager Sites
Recovering Configuration Manager Sites

Other Resources

Tasks for Recovering a Site


Backing up Configuration Manager Sites

Backing up Configuration Manager 2007 sites can be automated by scheduling the predefined Backup ConfigMgr Site Server maintenance task. For more information about the Backup ConfigMgr Site Server maintenance task, see Backup ConfigMgr Site Server Task Overview.

When the Configuration Manager 2007 backup service (SMS_SITE_BACKUP) runs, it follows the instructions defined in the backup control file (.\Inboxes\smsbkup.box\smsbkup.ctl). You can modify the backup control file to change the behavior of the SMS_SITE_BACKUP backup service.

Site backup information is written to the smsbkup.log log file. This file is created in the backup files destination directory specified in the Backup ConfigMgr Site Server maintenance task properties when the backup task runs.

Important
Only site backups created using the Backup ConfigMgr Site Server maintenance task are supported for recovering sites using the Configuration Manager 2007 Site Repair Wizard. For more information about the Site Repair Wizard, see About the Site Repair Wizard.

In This Section

About Backing up Central Sites

Describes unique considerations for backing up central sites.

About Archiving the Backup Snapshot

Describes the process of archiving the backup snapshot using the Afterbackup.bat file.

About Windows Event Log Entries Created by the Backup Process

Describes the Windows event log entries created during the backup process.

See Also

Reference

Backup ConfigMgr Site Server Task Overview

Concepts

Overview of Backup and Recovery


About Backing up Central Sites

While the process of backing up and recovering a central site is similar to backing up and restoring any primary site, there are requirements to consider when backing up and restoring central sites that make them unique to central sites.

Backing up the central site is unique in the following ways:

  • It is the busiest site in the hierarchy, leaving less time available to back it up.
  • It has the largest amount of data that needs to be backed up, which increases the length of the backup operation.

As a result, you might attempt to reduce the risk of backlogs resulting from backup operations on the central site by planning to back up your central site less often. Because the central site is the most critical site in the hierarchy, this is not recommended.

See Also

Concepts

Backing up Configuration Manager Sites


About Archiving the Backup Snapshot

The first time the Backup ConfigMgr Site Server maintenance task runs, it produces a backup snapshot, which you can use to recover your system in the event of a failure. When the backup task runs again during subsequent cycles, it creates a new backup snapshot that overwrites the previous snapshot. As a result, the site has only a single backup snapshot. This can be risky because an earlier backup snapshot won’t be available if you need it.

It is therefore recommended to archive the backup snapshot. As a best practice, there should be multiple archives of backup snapshots for the following reasons:

  • It is common for backup media to fail, get misplaced, or have only a partial backup stored on it. Recovering a failed site from an older backup is better than recovering with no backup at all.
  • A corruption in the site can go undetected for several backup cycles. You may need to go back several cycles and use the backup snapshot from before the site became corrupted.
  • The site might have no backup snapshot at all if, for example, the Backup ConfigMgr Site Server maintenance task fails. Because the backup task removes the previous backup snapshot before it starts to back up the current data, there will not be a valid backup snapshot.

Using the AfterBackup.bat File

After successfully backing up the site, the Backup Site Server task automatically attempts to run a file named AfterBackup.bat. The AfterBackup.bat file is not installed during site installation and must be created manually by the administrator. If an AfterBackup.bat file exists, and is stored in the correct directory, the file will automatically run after the backup task has completed. The AfterBackup.bat file allows you to archive the backup snapshot at the end of every backup operation, and automatically perform other post-backup tasks if desired. The AfterBackup.bat file integrates the archive and the backup operations, thus ensuring that every new backup snapshot is archived. If an AfterBackup.bat file does not exist it has no effect on the backup operation, but in order to archive the backup snapshot, another method must be used.

Although the intended use of the AfterBackup.bat is to archive backup snapshots, you can create an AfterBackup.bat file to perform additional tasks at the end of every back up operation, such as:

  • Run a SQL Server DBCC test to verify that there are no integrity problems with the site database.
  • Run a site health tool, or other health tools.

See Also

Tasks

How to Archive the Backup Snapshot (AfterBackup.bat)


About Windows Event Log Entries Created by the Backup Process

The Backup ConfigMgr Site Server maintenance task writes backup status to Windows Server Application. event log.

The following table lists the events written to the Application event log during site backups:

Event Log ID | Message
Event ID 5505 | SMS Site Backup task is starting. This task will interact with the windows VSS services and the appropriate writers to create a volume snapshot and then back up the required files to the specified destination.
Event ID 6829 | SMS Writer is about to stop the SMS Services as part of the preparation of the SMS Site backup
Event ID 3197 | I/O is frozen on database SMS_<site code>. No user action is required. However, if I/O is not resumed promptly, you could cancel backup.
Event ID 3198 | I/O was resumed on database SMS_<site code>. No user action is required.
Event ID 18264 | Database backed up.
Event ID 6830 | Component SMS_SITE_VSS_WRITER on computer <site server> reported: the snapshots of the volumes required for the SMS backup have been successfully created.
Event ID6831 | SMS Writer has started the SMS Services successfully
Event ID 5056 | SMS Site Backup is starting to copy the files from the snapshot.
Event ID 5057 | SMS Site Backup has successfully completed copying the files from the snapshot.
Event ID 6833 | SMS backup task has completed successfully

See Also

Concepts

Backing up Configuration Manager Sites


Recovering Configuration Manager Sites

A Configuration Manager 2007 site recovery is required whenever a Configuration Manager 2007 site is installed with a site code or site server name that was previously used in the hierarchy. Repairing and re-synchronizing data are the core tasks of a site recovery, and are required to prevent interruption of operations and corruption of data.

Configuration Manager 2007 provides several recovery and repair tools to help you quickly and reliably complete tasks essential to restoring regular site operations.

The recovery and repair tools allow you to carry out certain commands to override existing configuration settings without having to directly access low-level data. Used correctly, these tools can greatly simplify certain site repair and recovery tasks, reduce the risks involved in editing low-level data, and enable operations that are not available through other methods.

In This Section

Understanding the Effects of a Site Failure

Before you start to evaluate recovery options for your site you must understand the impact of a site failure.

About the Site Repair Wizard

The Configuration Manager Repair Wizard automates the steps required for a recovery process and provides relief from error-prone, repetitive, or technically complex recovery tasks.

Hierarchy Maintenance Tool (Preinst.exe)

The Hierarchy Maintenance tool (preinst.exe) is a command-line tool that you can use to pass commands to the Hierarchy Manager while the Hierarchy Manager is running. It can help you diagnose problems in a site, repair a site, or stop all site services.

About Recovering Central Sites

Describes unique considerations for recovering central sites.

Caution
The tasks associated with site recovery and repair are complex. Failure to use the recovery tools appropriately can significantly interrupt site operations or cause an unrecoverable loss of data.

See Also

Concepts

Overview of Backup and Recovery


Understanding the Effects of a Site Failure

A Configuration Manager 2007 site consists of various site systems and clients. Each site has one site system that is the site server. The site server monitors and manages the site. Each site has one site system that is the Configuration Manager 2007 site database server, and each site can have at least one (possibly more) site system that is a management point. The management point is the site system that allows the site server and the site's clients to communicate.

In addition to these essential site systems, a site can have any number of additional site systems that perform different roles in the site. For example, to distribute software, a site must have at least one distribution point. Configuration Manager 2007 supports site systems that are set up either on the same computer as the site server or on a separate computer.

The site server and any of the other site systems can fail and thus not provide the services they regularly provide. If multiple site systems are installed on the same computer, and that computer fails, all services regularly provided by those site systems are no longer available.

Because each site system in the site provides different functionality, the impact of a failure on the site is different, depending on the role of the site system that failed. The following table contains information that can assist you in evaluating the impact of failure in your site.

The Impact of a Site Failure

The following table describes the results if various site systems are offline.

Site Server

Site Database

Management Point

Distribution Point

Result

Offline

Online

Online

Online

No site administration will be possible, including creation of new advertisements.

The management point will collect client information and cache it until the site server is back online.

Existing advertisements will run and clients can find distribution points.

Online

Offline

Online

Online

No site administration will be possible, including creation of new advertisements.

If the Configuration Manager 2007 client already has a policy assignment with new policies and if the management point has cached the policy body, the client can make a policy body request and receive the policy body reply. No new policy assignments requests can be serviced.

Clients will be able to run programs only if they have already been detected and the associated source files are already cached locally at the client.

Online

Online

Offline

Online

Although new advertisements can be created, the clients will not receive them until a management point is online again.

Clients will still collect inventory, software metering, and status information and store them locally until the management point is available.

Clients will be able to run programs only if they have already been detected and the associated source files are already cached locally at the client.

Online

Online

Online

Offline

Configuration Manager 2007 clients will be able to run advertisements only if the associated source files have already been downloaded locally.

See Also

Concepts

Recovering Configuration Manager Sites


Hierarchy Maintenance Tool (Preinst.exe)

The Hierarchy Maintenance tool (Preinst.exe) is a tool that passes commands to the Configuration Manager 2007 Hierarchy Manager while the Hierarchy Manager service is running.

The Hierarchy Maintenance tool is automatically installed when Configuration Manager 2007 is installed. The Preinst.exe tool can be found in the \SMS_<sitecode>\bin\i386\<language code> share directory on the site server, and also in the \SMSSETUP\BIN\I386\<language code> directory of the Configuration Manager 2007 installation files.

You can use the Hierarchy Maintenance tool to diagnose problems in a site, repair a site, or stop all Configuration Manager 2007 services at a site. For example, suppose that you remove an Configuration Manager 2007 site incorrectly by disconnecting a child site from its parent site without first removing the child site from the parent site database. This causes problems because the parent site still tries to send information to and receive information from the disconnected child site. To resolve this situation, you can use the Hierarchy Maintenance tool to bypass the Configuration Manager console and delete the incorrectly removed child site from the parent site database.

To run the Hierarchy Maintenance tool, the logged-on user must have administrative privileges on the computer itself. Also, the logged-on user must explicitly have the Site - Administer security right; it is not sufficient that the logged-on user inherits this right by being a member of a group that has that permission.

See Also

Concepts

Recovering Configuration Manager Sites
About the Secure Key Exchange Parameters
How to Use the Hierarchy Maintenance Tool (Preinst.exe)


Hierarchy Maintenance Tool Syntax

The Hierarchy Maintenance tool (Preinst.exe) must run locally on the primary or secondary site server computer.

Because secondary sites do not have a site database, the Hierarchy Maintenance tool can be used at secondary sites with only the /stopsite, /keyforparent, and /childkeys options.

Note
Because you cannot use the /syncparent command-line option at a secondary site, you can stop and restart the SMS Executive service instead. This forces the current site control file to be forwarded to the parent site.

Use the command-line parameters in Table 1 to work with the Hierarchy Maintenance tool (Preinst.exe) using the preinst <options> syntax.

Table 1. Preinst Command-Line Parameters

Command-Line Parameter Description

/cdupgrade <secondary site code>

This command, which you run from the parent site, upgrades a secondary site by using installation source files that are local to the secondary site (on a hard disk, network drive, or CD-ROM drive). It does not cause the parent site to send files to the secondary site because it assumes that the necessary files are available at the secondary site.

Use this option to upgrade failed sites if a global upgrade fails to upgrade all secondary sites. If a secondary site upgrade has failed, use the /deljob option (described later in this table) to prevent the parent site from trying to upgrade it.

/deinstall <secondary site code>

This command, which you run from the parent site, removes the specified secondary site from a site hierarchy.

If you want to remove a secondary site from a site hierarchy, first try to remove it by using the Configuration Manager console.

/deljob <site code>

This command, which you run from the source site, deletes all outbound traffic that is targeted to the destination site. This includes the deletion of all jobs, or commands, that are targeted to the specified site.

/delsite <removed child site code> <parent site code>

This command, which you run from the parent site, deletes incorrectly removed child sites from the site database of the parent site.

Use this option if you removed a site before you detached it from its parent. This transaction does not propagate up the site hierarchy to all parent sites of the current site.

Note
The /delsite command does not uninstall the site referred to by <removed child site code>. It merely removes the site information from the local Configuration Manager 2007 site database.

/dump <site code>

This command, which you run from the local site server, writes site control images to the root folder of the drive on which the site is installed.

/dump <site code> writes the site control image only for the specified site.

/dump writes the site control files for all sites.

An image is a binary representation of the site control file, which is stored in the Configuration Manager 2007 site database. The dumped site control file image is a sum of the base image plus the pending delta images.

After dumping a site control file image with the Hierarchy Maintenance tool, the file name is in the format sitectrl_<sitecode>.ct0.

/stopsite

This command, which you run from the local site server, initiates a shutdown cycle for the Configuration Manager 2007 Site Component Manager service, which partially resets the site.

When this shutdown cycle is run, some Configuration Manager 2007 services on a site server and its remote site systems are stopped. These services are flagged for reinstallation.

As a result of this shutdown cycle, some passwords are automatically changed when the services are reinstalled.

Note
If you want to see a record of shutdown, reinstallation, and password changes for Site Component Manager, enable logging for this component before using this command-line option.

After the shutdown cycle is started, it proceeds automatically, skipping any nonresponding components or computers. However, if the Site Component Manager service cannot access a remote site system during the shutdown cycle, the components that are installed on the remote site system are reinstalled when the Site Component Manager service is restarted.

When it is restarted, the Site Component Manager service repeatedly attempts reinstallation of all services that are flagged for reinstallation until it is successful.

You can restart the Site Component Manager service using Service Manager. After it is restarted, all affected services are uninstalled, reinstalled, and restarted. After you use the /stopsite option to initiate the shutdown cycle, you cannot avoid the reinstallation cycles after the Site Component Manager service is restarted.

/syncchild <site code>

This command, which you run from the parent site, synchronizes a child site with its parent site.

This command simulates a child site attachment so that all the components at the current site are triggered by a site attachment notification for the specified child site, thereby updating the child site.

For example, under this command, the Collection Evaluator sends all collection information and package definitions to the child site.

/syncparent

This command, which you run from the child site, forces all site control images in the site database to simultaneously propagate up to the parent site of the current site. This propagation includes the site control images of all child sites stored in the site database of the current site.

Use this option when sites are out of synchronization due to time lags or other failures. Because secondary sites have no site database on which the Hierarchy Maintenance tool can operate, stop and restart the SMS Executive service instead of using the /syncparent command for a secondary site. This forces the current site control image for the secondary site to be forwarded to the parent site.

/upgrade <secondary site code>

This command, which you run from the parent site, upgrades a secondary site. Use this option to upgrade failed sites if a global upgrade fails to upgrade all secondary sites.

If a secondary site upgrade has failed, use the /deljob option to prevent the parent site from trying to upgrade it.

/keyforparent

This command, which you run on the recovering site, is used to distribute the new public key to a parent site of the failed site.

The /keyforparent command places the public key of the failed site in the file <site code>.CT4 at the root of the program files drive.

After you run this command, manually copy the <site code>.CT4 file to the parent site's hman.box inbox (not hman.box\pubkey).

/keyforchild

This command, which you run on the recovering site, is used to distribute the new public key to a child site of the failed site.

The /keyforchild command places the public key of the failed site in the file <site code>.CT5 at the root of the program files drive.

After you run this command, manually copy the <sitecode>.CT5 file to the child site's hman.box inbox (not hman.box\pubkey).

/childkeys

This command, which you run on the recovering site's child sites, is used to distribute public keys from all child sites to the recovering site.

The /childkeys command places this and all child site public keys into the file <site code>.CT6.

After you run this command, manually copy the <site code>.CT6 file to the parent site's "hman.box" inbox (not hman.box\pubkey).

/parentkeys

This command, which you run on the recovering site's parent site, is used to distribute public keys from all parent sites to the recovering site.

The /parentkeys command places this and all parent site public keys into the file <site code>.CT7.

After you run this command, manually copy the <site code>.CT7 file to the child site's "hman.box" inbox (not hman.box\pubkey).

See Also

Concepts

Hierarchy Maintenance Tool (Preinst.exe)


About the Secure Key Exchange Parameters

By default, servers running Configuration Manager 2007 use signed communications when communicating with other sites. The receiving site has a copy of the public key of the sender site. Before it accepts the communication, it tests the authenticity of the source by using the public key of the sender.

When a site fails, it loses its private/public keys and new keys are created when the site is recovered. Before communications from the failed site will be accepted by other sites, the new public key of the failed site needs to be propagated to the other Configuration Manager 2007 sites.

The failed site will also lose its stored copies of the public keys of any other sites. Thus, it will not accept communications from other sites until it has new copies of the public keys for the other sites.

You can use the following command-line parameters to perform a secure key exchange between parent and child sites during recovery:

  • /keyforparent is used to distribute the new public key to a parent site of the failed site.
  • /keyforchild is used to distribute the new public key to a child site of the failed site.
  • /childkeys is used to distribute public keys from all child sites to the recovering site.
  • /parentkeys is used to distribute public keys from all parent sites to the recovering site.
Note
If the recovering site is publishing in Active Directory® Domain Services, it will publish its new public key to the Configuration Manager 2007 site object.

Any site that receives communications from the failed site will test the authenticity, using the old public key. If its current copy of the key cannot validate the signature, it will query the Active Directory Global Catalog to see whether it has the latest copy of the public key. If it does not have the latest copy, it will get the latest public key from the Global Catalog and you do not have to perform this task. Similarly, the failed site will get copies of the public keys of the other sites from the Global Catalog.

See Also

Concepts

Hierarchy Maintenance Tool Syntax


About the Site Repair Wizard

The Configuration Manager 2007 Site Repair Wizard performs complex recovery tasks that are difficult or impossible to perform by administrators manually. It is automatically installed during setup on all computers that have the Configuration Manager console installed and can be accessed from the Start menu or from the Configuration Manager console by right-clicking on a site name and selecting Repair Site from the context menu.

When it is run, the Site Repair Wizard logs site repair information is written to the RepairWizard.log log file. This file is created in the <Configuration Manager 2007 program files>\AdminUI\AdminUILog directory when the Site Repair Wizard is started.

Important
When recovering a site you should use the site repair tool shipped with the product version that you are repairing. The Configuration Manager 2007 Site Repair Wizard does not support repairing SMS 2003 (or lower) version sites and should not be used to attempt to recover objects from SMS 2003 (or lower) version child sites.

Main Functions of the Site Repair Wizard

The Site Repair Wizard is meant to make the task of recovering a Configuration Manager 2007 site as simple as possible, while minimizing the off-line time associated with recovering a site. The main functions of the Site Repair Wizard are:

  • Shut down the site and site systems associated with the site
  • Restore the site database, registry, and site server files from backups created using the Backup ConfigMgr Site Server maintenance task
  • Synchronize and reset transaction serial numbers
  • When possible, recover changes made since the site backup used for recovery was made
  • Prompt the administrator for certain changes made since backup
  • Restart the site

Site Recovery Process

The Configuration Manager 2007 Site Repair Wizard uses a two-phase process to recover a site. Site recovery is divided into the restore phase and the repair phase:

  • In the restore phase, the Site Repair Wizard first stops the WMI service and all Configuration Manager 2007 services running on the site server. The site backup snapshot created by the Backup ConfigMgr Site Server maintenance task is then restored to the site server. During this phase, you can choose to restore the site manually (for example, if you have no backup or if an earlier automatic recovery process was unsuccessful) or have the wizard perform the restoration tasks automatically for you.
  • In the repair phase, the Site Repair Wizard repairs the recovered Configuration Manager 2007 hierarchy, recovers objects that were created after the site was backed up (such as collections, packages, and advertisements), and restarts site services.

You can run the Site Repair Wizard more than once on the restored site, which allows the completion of failed repair attempts and also allows you to start over if you need to.

Important
While the Site Repair Wizard supports restoring a 32-bit Operating System backup onto a site server running a 64-bit Operating System; it does not support restoring a 64-bit Operating System backup onto a site system running a 32-bit Operating System.

The Site Repair Wizard maintains a record of the last time it was run on a Configuration Manager 2007 site. The previous run record is used to determine how the Site Repair Wizard is started the next time it is run:

  • If the site repair succeeded on the previous attempt, you are notified and given the option to run the Site Repair Wizard again from the beginning.
  • If the Site Repair Wizard failed, or was cancelled during the repair phase of the previous attempt, you are notified and given the option to resume the repair where the wizard was interrupted.
  • If the Site Repair Wizard failed, or was cancelled during the restore phase, the Site Repair Wizard will start again from the beginning the next time it is run.

See Also

Concepts

Overview of Backup and Recovery
Recovering Configuration Manager Sites


About Recovering Central Sites

While the process of backing up and recovering a central site is similar to backing up and restoring any primary site, there are requirements to consider when backing up and restoring central sites that make them unique to central sites.

Recovering the central site is unique in the following ways:

  • On the central site, many configuration changes can be constantly made, and it might be impossible to repeat all of them.
  • The central site does not have a parent site from which to obtain a copy of the site control file.

To resolve these issues, and to ensure that it is possible to recover all the data of the central site, follow these recommendations:

  • Back up the central site frequently.
  • Have a reference site for the central site, so that recovery tools can recover packages and advertisements created after the site is backed up.
  • Have a copy of the central site control file that is as recent as possible.
    • Between site backup cycles, back up the central site control file frequently. You can use system tools or batch files to automatically back up the site control file frequently. To back up site control files, you can use the Hierarchy Maintenance tool (PreInst.exe). For more information about PreInst.exe, see Hierarchy Maintenance Tool (Preinst.exe).
    • Store the site control file backup at the designated reference site.
    • Store the site control file with a *.CT0 format so that during recovery it is sufficient to rename the file, and drop it on the recovering central site.

If you follow these recommendations, then you will be able to recover most of the configuration when recovering the central site. You will be able to recover configuration data and software distribution objects definition from the reference site. The administrative data that is lost if the central site fails is less critical, and is regenerated after the central site regains functionality.

See Also

Concepts

Recovering Configuration Manager Sites


About Performing a Site Reset

Performing a site reset re-applies default file and registry permissions on the site server and site components are reinstalled. If there has been a change to the accounts used by Configuration Manager components, a site reset ensures the account details used by the components are correct and resets the access control lists used by remote site systems to access the site server.

Note
A site reset does not reset access permissions to non-Configuration Manager 2007 objects.

Important
If you installed a new Configuration Manager 2007 site server, a site reset sets the access control lists (ACLs) back to the original settings. If you upgrade an existing Systems Management Server (SMS) 2003 site, Setup does not change the permissions on the upgraded directories. Also, if you do a site reset of a site that was upgraded from SMS 2003, the site reset does not reset the ACLs on the upgraded directories.

When a site reset is performed, Setup stops and restarts the SMS_SITE_COMPONENT_MANAGER service and the thread components of the SMS_EXECUTIVE service. Additionally, Setup removes, and then re-creates, the site system share folder and the SMS Executive component on the local computer and on remote site system computers. After Setup reinstalls the SMS_SITE_COMPONENT_MANAGER service, this service installs the SMS_EXECUTIVE and the SMS_SQL_MONITOR services.

In addition, a site reset restores the following objects:

  • The SMS or NAL registry keys, or any subkeys under them
  • The Configuration Manager directory tree, or any files or subdirectories under it
Important
You must perform a site reset after using the Site Repair Wizard to repair a Configuration Manager site

If you experience a problem during the site reset operation, view the contents of the ConfigMgrSetup.log file to help troubleshoot the problem.

See Also

Tasks

How to Perform a Site Reset

Concepts

Recovering Configuration Manager Sites


Tasks for Backing Up a Site

You should perform the tasks described in the following table to ensure that the sites in your Configuration Manager 2007 site hierarchy are properly backed up:

In This Section

How to Back Up a Primary Site

How to Determine if a Site Backup is Successful

How to Archive the Backup Snapshot (AfterBackup.bat)

How to Back Up a Secondary Site

How to Troubleshoot Site Backup


How to Back Up a Primary Site
Note
You must have Read or Modify permission for the site security object class or instance to perform this procedure.

How to back up a primary site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Site Maintenance / Tasks.

  2. Right-click the Backup Site Server task, and click Properties.

  3. Specify the backup task properties, and click OK. Ensure that you schedule the backup task to run at an appropriate time.

See Also

Concepts

Tasks for Backing Up a Site


How to Determine if a Site Backup is Successful

You should verify that the Backup Site Server maintenance task is running successfully after you schedule it to ensure that you are prepared to recover the site if it fails, and also to help plan for disaster recovery. To do so, you should ensure that the time stamps on the files in the backup destination folder created by the Backup Site Server maintenance task match the last time that the maintenance task should have run.

If the time stamps on the files in the backup destination folder do not match the last time that the Backup Site Server maintenance task was scheduled to run, you should review the SMS_SITE_BACKUP component for warnings and errors.

To determine if a site backup is successful by reviewing status messages

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Site Status / <site name> / Component Status.

  2. In the results pane, right-click SMS_SITE_BACKUP, click Show Messages, and then click Error. Review any status messages returned for errors. If SMS_SITE_BACKUP does not appear in the details pane, ensure that site backup is enabled.

  3. In the results pane, right-click SMS_SITE_BACKUP, click Show Messages, and then click Warning. Review any status messages returned for warnings. If SMS_SITE_BACKUP does not appear in the results pane, ensure that site backup is enabled.

    Note
    If no warning or error status messages are displayed, the backup service is running successfully; otherwise, try to determine the cause of the error or warning message.

See Also

Tasks

How to Back Up a Primary Site

Concepts

Tasks for Backing Up a Site


How to Archive the Backup Snapshot (AfterBackup.bat)

The AfterBackup.bat file is used to perform post-backup actions automatically after the Backup Site Server maintenance task runs successfully. By default, the AfterBackup.bat batch file does not exist. To use it, you must create the file and add commands.

The AfterBackup.bat file is used most commonly to archive the backup snapshot to a secure location.

To create the AfterBackup.bat batch file

  1. Prepare an ASCII file with commands that archive your backup snapshot, run a third-party archive tool, or perform any other post-backup tasks your site requires.

  2. Name the file AfterBackup.bat, and save it in the <ConfigMgrInstallPath>\inboxes\smsbkup.box folder.

See Also

Concepts

Tasks for Backing Up a Site


How to Back Up a Secondary Site

Because secondary sites can also fail, it is just as important to back up secondary sites as primary sites. You back up a secondary site in the same manner that you back up a primary site, by using the Backup Secondary Site Server maintenance task.

The main difference between backing up a secondary site and a primary site is the lack of a Configuration Manager 2007 site database at the secondary site.

When you back up a secondary site, the following differences apply:

  • The backup task ignores the following entries in the backup control file when backing up a secondary site:
    • Database-related commands: smssqlinfo and sitedbdump.
    • All backup commands in the [Tasks] section, in which the <source> is a database server.
    If you customize the backup control file, you do not need to remove the unnecessary database-related commands. When the backup task runs on a secondary site, it ignores these entries.
  • When the backup task runs on a secondary site, it does not stop the SMS_SQL_MONITOR service because it does not exist on a secondary site.

To back up a secondary site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / <secondary site name> / Site Settings / Site Maintenance / Tasks.

  2. Right-click the Backup Secondary Site Server task, and click Properties.

  3. Specify the backup task properties, and click OK. Ensure that you schedule the backup task to run at an appropriate time.

See Also

Concepts

Tasks for Backing Up a Site


How to Troubleshoot Site Backup

Follow this procedure if site backup is not functioning as you expect.

How to troubleshoot site backup

  1. Check for error or warning messages from the SMS Backup service (SMS_SITE_BACKUP).

  2. Look in the Event Viewer for account and access violations.

  3. SMS_SITE_BACKUP runs under the local system account. Verify that this account can access any remote locations specified in the SMS Backup control file, and that this account has the privileges to perform the tasks in the SMS Backup control file's [Tasks] section.

  4. If the SMS_SITE_BACKUP log file is enabled, look in the log file for SMS_SITE_BACKUP on the site server: <Configuration Manager installation directory>\Logs\smsbkup.log.

See Also

Concepts

Tasks for Backing Up a Site


Tasks for Recovering a Site

A site recovery occurs whenever a Configuration Manager 2007 site is installed with a site code or site server name that was previously used in the hierarchy. Repairing and resynchronizing data are the core tasks of a site recovery, and they are required to prevent interruption of operations and corruption of data.

In This Section

How to Use the Site Repair Wizard

How to Use the Hierarchy Maintenance Tool (Preinst.exe)

How to Perform a Site Reset

How to Perform Post Site Repair Tasks

See Also

Other Resources

Maintaining Configuration Manager 2007


How to Use the Site Repair Wizard

Many of the tasks for repairing a site can be automatically performed for you by the Site Repair Wizard. Using the wizard can save time and prevent errors during recovery.

Important
After a site server has been repaired with the Site Repair Wizard, optional site roles on the site server will not be reinstalled until a site reset is completed. For more information about how to perform a site reset, see How to Perform a Site Reset.

In This Section

How to Repair a Central Site

How to Repair a Primary Site

See Also

Concepts

About the Site Repair Wizard

Other Resources

Tasks for Recovering a Site


How to Repair a Central Site

The procedures in this section can be used to repair a Configuration Manager 2007 central site using the Site Repair Wizard.

To start the Site Repair Wizard from the Configuration Manager console

  1. Navigate to System Center Configuration Manager \ Site Database \ Site Management \ <site name>.

  2. Right click <site name> and click Repair Site.

  3. Close the Configuration Manager console.

    Note
    The Site Repair Wizard can only be started from the Configuration Manager console installed on the site server to be repaired. The option to start the Site Repair Wizard is not available on remote Configuration Manager console installations.

To start the Site Repair Wizard from the start menu

  • Click Start, click Microsoft System Center, click Configuration Manager 2007, and then click ConfigMgr Site Repair Wizard.

To restore a central site from backup files

  1. On the Site Repair Wizard Welcome page, ensure Site server to be repaired displays the site server name that you need to repair and click Next.

  2. On the Backup File Location page, click Browse to open the Browse for Folder dialog box, and browse to the location of the most recent site backup snapshot files (the backup destination specified in the Backup ConfigMgr Site Server maintenance task) and click OK to close the Browse for Folder dialog box.

    Note
    If the purpose of the site repair is to only recover lost site settings and the site database does not need to be restored, you can enable the Do not restore database option.

  3. On the Progress page, review the steps the Site Repair Wizard takes to begin the repair process to ensure that they have completed successfully and click Next.

  4. On the Parent Site Settings page, ensure that This is a central site is selected.

  5. On the Verify Site Hierarchy page, verify that the displayed site hierarchy information to be restored from backup is correct. If child site or child site address information has changed since the last backup snapshot was created. You can view the properties of child site and child site sender address information stored in the backup snapshot by clicking Properties with the child site or child site sender address selected. If child site was attached to, or detached from, the site to be recovered after the last backup snapshot was created, you can click Add to add the site to the repair information or Remove to remove the site from the site repair information. For new or deleted site sender addresses, you can click New or Delete in Addresses for selected site:.

  6. (Optional). On the Reference Connection page, select a site that was active and accessible to the site to be recovered from the time the last backup snapshot was created and the time the Site Repair Wizard was started. The reference site will be used to recover any objects created at the primary site after the site was last backed up. For example, if a new collection was created at the site to be repaired after it was last backed up, the new collection can be recovered from the child reference site selected in Recover data from reference site.

  7. On the Reference Site Data Recovery page, review the steps the Site Repair Wizard takes to recover reference site data to ensure they have completed successfully and click Next.

  8. On the Object Pad page, specify and approximate number of Collections, Packages, and Advertisements that were created at this site since it was last backed up. This is to ensure that future collections, advertisements and collections created at the site after it is repaired do not contain duplicate IDs to those previously created. If there is non-zero data displayed in Collections, Packages, and Advertisements, it is based on the data recovered from a reference site.

  9. On the Package Recovery page, you can verify that software distribution source files are accessible to the site server and that the local distribution point is up to date. To ensure that the local distribution point is updated with the most recent version of software distribution source files for packages, you can click Update the distribution point on this site server. If a distribution point is not installed locally on the site server to be repaired, this step can be skipped by clicking Skip package verification.

  10. On the Summary page, review the summary of site repair actions that you have selected. To change any of the displayed settings, click Back. To begin the repair process, click Next.

    Important
    After clicking Next on the Summary page, the site repair process will begin, you cannot go back to previous steps.

  11. On the Final Progress page, review the steps the Site Repair Wizard takes to repair the site to ensure they have completed successfully and click Next.

  12. On the Finish page, review the information displayed and click Close to finish the site repair process and close the Site Repair Wizard.

See Also

Other Resources

How to Use the Site Repair Wizard


How to Repair a Primary Site

The procedures in this section can be used to repair a Configuration Manager 2007 primary site using the Site Repair Wizard.

To start the Site Repair Wizard from the Configuration Manager console

  1. Navigate to System Center Configuration Manager \ Site Database \ Site Management \ <site name>.

  2. Right click <site name> and click Repair Site.

  3. Close the Configuration Manager console.

    Note
    The Site Repair Wizard can only be started from the Configuration Manager console installed on the site server to be repaired. The option to start the Site Repair Wizard is not available on remote Configuration Manager console installations.

To start the Site Repair Wizard from the start menu

  • Click Start, click Microsoft System Center, click Configuration Manager 2007, and then click ConfigMgr Site Repair Wizard.

To restore a primary site from backup files

  1. On the Site Repair Wizard Welcome Page, ensure Site server to be repaired displays the site server name that you need to repair and click Next.

  2. On the Backup File Location page, click Browse to open the Browse for Folder dialog box, and browse to the location of the most recent site backup snapshot files (the backup destination specified in the Backup ConfigMgr Site Server maintenance task) and click OK to close the Browse for Folder dialog box.

    Note
    If the purpose of the site repair is to only recover lost site settings and the site database does not need to be restored, you can enable the Do not restore database option.

  3. On the Progress page, review the steps the Site Repair Wizard takes to begin the repair process to ensure that they have completed successfully and click Next.

  4. On the Parent Site Settings page, review the parent site settings to ensure that they have not changed since the site was last backed up.

  5. On the Verify Site Hierarchy page, verify that the displayed site hierarchy information to be restored from backup is correct. If parent site, child site, or any site address information has changed since the last backup snapshot was created. You can view the site and site sender address properties information stored in the backup snapshot by clicking Properties. If child site was attached to, or detached from, the site to be recovered after the last backup snapshot was created, you can click Add to add the site to the repair information or Remove to remove the site from the site repair information. For new or deleted site sender addresses, you can click New or Delete in Addresses for selected site:.

  6. (Optional). On the Reference Connection page, select a site that was active and accessible to the site to be recovered from the time the last backup snapshot was created and the time the Site Repair Wizard was started. The reference site will be used to recover any objects created at the primary site after the site was last backed up. For example, if a new collection was created at the site to be repaired after it was last backed up, the new collection can be recovered from the child reference site selected in Recover data from reference site.

  7. On the Reference Site Data Recovery page, review the steps the Site Repair Wizard takes to recover reference site data to ensure they have completed successfully and click Next.

  8. On the Object Pad page, specify and approximate number of Collections, Packages, and Advertisements that were created at this site since it was last backed up. This is to ensure that future collections, advertisements and collections created at the site after it is repaired do not contain duplicate IDs to those previously created. If there is non-zero data displayed in Collections, Packages, and Advertisements, it is based on the data recovered from the reference site.

  9. On the Package Recovery page, you can verify that software distribution source files are accessible to the site server and that the local distribution point is up to date. To ensure that the local distribution point is updated with the most recent version of software distribution source files for packages, you can click Update the distribution point on this site server. If a distribution point is not installed locally on the site server to be repaired, this step can be skipped by clicking Skip package verification.

  10. On the Summary page, review the summary of site repair actions that you have selected. To change any of the displayed settings, click Back. To begin the repair process, click Next.

    Important
    After clicking Next on the Summary page, the site repair process will begin, you cannot go back to previous steps.

  11. On the Final Progress page, review the steps the Site Repair Wizard takes to repair the site to ensure they have completed successfully and click Next.

    • On the Finish page, review the information displayed and click Close to finish the site repair process and close the Site Repair Wizard.

See Also

Other Resources

How to Use the Site Repair Wizard


How to Use the Hierarchy Maintenance Tool (Preinst.exe)

The Hierarchy Maintenance tool (Preinst.exe) is a command-line tool that must run locally on the primary or secondary site server computer. You can use the Hierarchy Maintenance tool to diagnose problems in a site, repair a site, or stop all Configuration Manager 2007 services at a site.

To use the Hierarchy Maintenance tool

  1. On the Start menu, click Run and then enter cmd to open the command prompt interface.

  2. Navigate to the location of the Hierarchy Maintenance tool (by default, SMS\bin\i386\<language code>).

  3. Run the Hierarchy Maintenance tool by using the appropriate command-line syntax and parameters.

See Also

Concepts

Hierarchy Maintenance Tool Syntax


How to Perform a Site Reset

You can perform a site reset of a Configuration Manager 2007 site server by starting Configuration Manager Setup from the site server computer's Start menu or from the Configuration Manager installation media.

To perform a site reset

  1. Close any open Configuration Manager console connections to the site server.

  2. On the primary site server computer, click Start, click All Programs, click Microsoft System Center, click Configuration Manager 2007, and click ConfigMgr Setup, or navigate to the .\bin\i386 directory of the Configuration Manager 2007 installation media and double-click Setup.exe.

  3. Click Next on the Configuration Manager Setup Wizard Welcome page.

  4. Click Perform site maintenance or reset this site on the Configuration Manager Setup Wizard Setup Options page.

  5. Select Re-apply default file and registry permissions on this site server on the Configuration Manager Setup Wizard Site Maintenance page.

  6. Click Yes in the site reset confirmation dialog box.

  7. Configuration Manager Setup performs the site reset process.

See Also

Other Resources

How to Change Site Configurations


How to Perform Post Site Repair Tasks

After repairing a site using the Configuration Manager 2007 Site Repair Wizard, you should perform the following tasks to ensure that the site has been properly repaired and is functioning as expected:

  • Check site addresses
  • Monitor site processes
  • Configure site settings
Important
After repairing a site using the Site Repair Wizard, a site reset must be performed to complete the repair process and reinstall optional site system roles. For more information about performing a site reset, see How to Perform a Site Reset.

To check site addresses

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Addresses.

  2. In the results pane, right-click each address and verify that addresses to other sites are configured properly.

To monitor site processes

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Site Status / <side code> - <site name>.

  2. Expand Component Status and review the Status column to ensure that each site component displays OK. If a site component status is not OK, right click the component name, click Show Messages, and then click All to review site component status messages.

  3. Expand Site System Status and review the Status column to ensure that each site system displays OK. If a site system status is not OK, right click the site system name, click Show Messages, and then click All to review site system status messages.

To configure site settings

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / <side code> - <site name> / Site Settings.

  2. Review site settings configured for the site to ensure that the site has been repaired successfully.

See Also

Other Resources

Tasks for Recovering a Site


Troubleshooting Site Maintenance

Click any link in the following section for troubleshooting information for Configuration Manager 2007 site maintenance.

In This Section

Troubleshooting Backup and Recovery Issues

Provides troubleshooting information for backing up or restoring Configuration Manager 2007 sites.

See Also

Other Resources

Maintaining Configuration Manager 2007


Troubleshooting Backup and Recovery Issues

This section provides troubleshooting information for when you encounter unexpected behavior when backing up or restoring Configuration Manager 2007 sites.

Not Enough Free Space to Create the Backup Snapshot

Configuration Manager 2007 does not consider the Volume Shadow Copy (VSS) storage associations for volumes containing site data or the SQL Server site database during the site backup process. The VSS service may not have sufficient disk space to create the shadow copy of the site backup snapshot information and will fail when the volume does not have enough storage to create the snapshot.

Solution

Check the Volume Shadow Copy (VSS) storage associations for the drives containing Configuration Manager data and ensure that they are configured to use a volume with free space equivalent to at least 50% of the size of the Configuration Manager data to be backed up. The backup destination specified in the Backup ConfigMgr Site Server maintenance task should not be on the source volume, and the storage association should refer to a different volume than the source volume.

Backup Process Terminates Unexpectedly

The Microsoft System Center Configuration Manager 2007 Backup process might terminate unexpectedly when attempting to make a connection with the site database.

During the Configuration Manager 2007 Backup process, a connection to the site database might fail to complete, resulting in an early termination of the ConfigMgr Backup process. Because the Configuration Manager 2007 backup process shuts down all site services, the site cannot automatically come back online without manual intervention.

Solution

To resolve this issue, you can install the Microsoft Windows Server 2003 Post-Service Pack 1 COM+ 1.5 Hotfix Rollup Package 6 available at http://go.microsoft.com/fwlink/?LinkID=60539.

After the hotfix rollup package is installed, you might need to restart the SMS Executive service and the SMS Site Component Manager service using the Configuration Manager 2007 Service Control Manager.

See Also

Concepts

Troubleshooting Site Maintenance


Troubleshooting Configuration Manager 2007

Topic last updated -- August 2007

If you experience problems in your Microsoft System Center Configuration Manager 2007 deployment, you should first see if your problem might be caused by security, disk space, dependent technologies, network connectivity, or time synchronization.

Security Configuration Manager 2007 uses services to connect clients to servers and servers to servers. Some connections use the computer account and some connections require user accounts to be created and configured in the Configuration Manager 2007 console. If Configuration Manager 2007 does not have the correct permissions to make the connections, the Configuration Manager 2007 operations will fail. Also, users running the Configuration Manager 2007 console must have appropriate rights and permissions granted through WMI, DCOM, NTFS, and Configuration Manager 2007. For more information, see Accounts and Groups in Configuration Manager and Overview of Configuration Manager Object Security and WMI

Disk space Packages, software updates, inventory, and collected files can use significant amounts of disk space. Verify that the site database has sufficient disk space to expand. Verify that the site server and site systems have sufficient disk space to store the required data.

Dependent technologies Configuration Manager 2007 has many dependencies on technologies such as Microsoft SQL Server, Internet Information Services (IIS), Windows Installer, and Internet Information Services (IIS). Problems that manifest in Configuration Manager 2007 might actually be the result of incorrectly configured or missing prerequisite technologies. Search the Configuration Manager Documentation Library for "prerequisite" or consult the documentation for the dependent technology.

Network connectivity Verify that the client and server computers can connect to each other and perform name resolution.

Time synchronization Members of Active Directory domains should automatically synchronize to a domain controller, but workgroup clients or clients in domains with significant time drift might have issues with anything requiring a schedule, such as a mandatory advertisement, a certificate expiration date, or a maintenance window. Verify that daylight savings time issues are not affecting time synchronization.

Troubleshooting content will be updated as more information is available. Troubleshooting information for specific features is repeated here.

In This Section

Troubleshooting Tools

Troubleshooting Secure Key Exchange

Troubleshooting SQL Replication Issues

Troubleshooting Configuration Manager Client Deployment

Troubleshooting the Configuration Manager Console

Troubleshooting Collection Issues

Troubleshooting Software Distribution

Troubleshooting Software Updates

Troubleshooting Operating System Deployment

Troubleshooting Reporting

Troubleshooting SQL Reporting Services

Troubleshooting Desired Configuration Management

Troubleshooting Mobile Device Management

Troubleshooting Network Access Protection

Troubleshooting Inventory

Troubleshooting Remote Tools Using Custom Error Codes

Troubleshooting Wake On LAN

Troubleshooting the Application Compatibility Toolkit Connector


Troubleshooting Tools

This section provides information on the tools used to troubleshoot Microsoft System Center Configuration Manager 2007. This content might have been updated. For the most recent information about troubleshooting tools, see http://go.microsoft.com/fwlink/?LinkId=93059

Click the related link for detailed information on the following troubleshooting tools. .

In This Section

Using Configuration Manager Service Manager

Using Status Messages for Configuration Manager Troubleshooting


Using Configuration Manager Service Manager

You use Service Manager to control Microsoft System Center Configuration Manager 2007 services. In Service Manager, you can view the status of any Configuration Manager 2007 services or threads (referred to collectively as Configuration Manager 2007 components) that are running on any site system. Components are managed the same way you manage services in Windows; you can start, stop, pause, resume, or query Configuration Manager 2007 components.

Services run as soon as there is something for them to do (typically, when a configuration file is written to a component's inbox).

In This Section

About ConfigMgr Service Manager Actions

About Configuration Manager Components

Connect to Site Dialog Box

How to Clear All Status Values

How to Connect to a Site

How to Disconnect a Site

How to Open ConfigMgr Service Manager

How to Select All Components

How to Enable Logging for a Component

How to Pause a Component

How to Query a Component

How to Resume a Component

How to Start a Component

How to Stop a Component

See Also

Tasks

How to Open ConfigMgr Service Manager
How to Disconnect a Site
How to Select All Components
How to Query a Component
How to Stop a Component
How to Start a Component
How to Pause a Component
How to Resume a Component
How to Enable Logging for a Component

Concepts

How to Connect to a Site
How to Clear All Status Values
About ConfigMgr Service Manager Actions


About ConfigMgr Service Manager Actions

You can use Microsoft System Center Configuration Manager 2007 Service Manager to troubleshoot Configuration Manager 2007 and to learn how its components work. Service Manager enables you to manipulate various Configuration Manager 2007 services and threads and then view the resulting change in the behavior of Configuration Manager 2007. For example, you can perform the following actions:

  • Stop services one at a time until a particular response is eliminated. Doing so will enable you to determine which service causes the behavior.
  • Use the Configuration Manager 2007 system flowcharts to understand Configuration Manager 2007 processes. Reviewing these flowcharts will help you better understand various components, so that you can intercept component transaction files and examine their contents.

Service Manager can perform the following actions on components (you can access these commands from the Components menu):

Start

Runs a stopped component. Stopping and restarting a component clears the log files and other files so that you can start a new query.

Stop

Stops a running component. Stopping a component shuts down its run-time environment. To preserve a component's run-time environment, use Pause.

Pause

Pauses a running component. Pausing preserves the component's run-time environment. You can pause a component, observe system behavioral changes, or copy transaction or log files and then continue running the component. Not all components can be paused, however.

Resume

Resumes a paused component.

Query

Updates the status of any selected components.

See Also

Tasks

How to Query a Component
How to Stop a Component
How to Start a Component
How to Pause a Component
How to Resume a Component
How to Enable Logging for a Component

Concepts

Using Configuration Manager Service Manager


About Configuration Manager Components

In Microsoft System Center Configuration Manager 2007, components are threads, services, and applications that run on both server and client computers and provide Configuration Manager 2007 functionality. Service and thread components perform tasks such as communication for intersite and intrasite connectivity, configuration, resource discovery, client installation, site maintenance, status, site system installation, and reporting.

Service components are Configuration Manager 2007 server programs that run as services. You can stop or start service components in Control Panel by clicking Administrative Tools and then clicking Services.

The number of active service components on each server depends on which Configuration Manager 2007 features you install.

Thread components are Configuration Manager 2007 server components that function as part of the SMS Executive service; they are not services.

Client components process Configuration Manager 2007 client operations. SMS Client Service, which you can start and stop through Control Panel, is the main client service component. Several other client components, such as the Software Inventory Agent, run as their own processes.

Note
If you set up a site hierarchy in which you move one or more components to site systems, the service and thread components that are necessary for those servers will be the only ones installed and started.

See Also

Concepts

Using Configuration Manager Service Manager


Service Manager Tasks

In This Section

How to Clear All Status Values

How to Connect to a Site

How to Disconnect a Site

How to Open ConfigMgr Service Manager

How to Select All Components

How to Enable Logging for a Component

How to Pause a Component

How to Query a Component

How to Resume a Component

How to Start a Component

How to Stop a Component

See Also

Concepts

Using Configuration Manager Service Manager


How to Clear All Status Values

Use this procedure to clear all Microsoft System Center Configuration Manager 2007 status values from the Status column in the ConfigMgr Service Manager window. Because clearing all values empties the Status column, doing so before selecting a few components and querying them makes it easy to find the new status of those components.

How to clear all status values

  1. Open ConfigMgr Service Manager.

  2. On the Component menu, click Clear Status.

See Also

Tasks

How to Open ConfigMgr Service Manager

Concepts

Using Configuration Manager Service Manager


How to Connect to a Site

Topic last updated -- November 2007

You can connect Microsoft System Center Configuration Manager 2007 Service Manager to a site so that you can manage the components running on that site. You can be connected to more than one site at a time.

To connect to a site, you must be a member of the SMS Admins local group on the computer where the SMS Provider is installed.

How to connect to a site

  1. Open ConfigMgr Service Manager.

  2. Click Site, and then click Connect.

  3. In the Connect to Site dialog box, specify the NetBIOS name of the site server to which you want to connect ConfigMgr Service Manager.

See Also

Tasks

How to Open ConfigMgr Service Manager
How to Disconnect a Site
How to Open ConfigMgr Service Manager

Concepts

Connect to Site Dialog Box
Using Configuration Manager Service Manager


How to Disconnect a Site

Use this procedure to disconnect a site from Microsoft System Center Configuration Manager 2007 Service Manager so that the site and its components no longer appear in Service Manager.

How to disconnect a site

  1. Open ConfigMgr Service Manager.

  2. Click Site, and then click Disconnect.

  3. In the Disconnect from Sites dialog box, select the sites from which you want to disconnect, and then click OK.

See Also

Tasks

How to Open ConfigMgr Service Manager

Concepts

How to Connect to a Site
Using Configuration Manager Service Manager


How to Open ConfigMgr Service Manager

How to open ConfigMgr Service Manager

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Tools / ConfigMgr Service Manager.

  2. Right-click ConfigMgr Service Manager, point to All Tasks, and then click Start ConfigMgr Service Manager.

See Also

Concepts

Using Configuration Manager Service Manager

Other Resources

Service Manager Tasks


How to Select All Components

If you are going to work with all the components that are currently displayed in ConfigMgr Service Manager, you can use the Select All command instead of selecting each component.

How to select all components

  1. Open ConfigMgr Service Manager.

  2. On the Component menu, click Select All.

See Also

Tasks

How to Open ConfigMgr Service Manager

Concepts

Using Configuration Manager Service Manager


How to Enable Logging for a Component

When you enable logging for a component, Configuration Manager logs the activities of that component.

Note
If you selected multiple components, you can select the Use same file for all selected components check box and specify a single log file name for all components.

How to enable logging for a component

  1. Open ConfigMgr Service Manager.

  2. Navigate to the components that you want to log.

  3. In the right pane, select one or more components.

  4. On the Component menu, click Logging.

  5. In the ConfigMgr Component Logging Control dialog box, select the Logging enabled check box.

See Also

Tasks

How to Query a Component
How to Stop a Component
How to Start a Component
How to Open ConfigMgr Service Manager
How to Pause a Component
How to Resume a Component
How to Select Items

Concepts

Component Logging Control Dialog Box
Using Configuration Manager Service Manager


How to Pause a Component

You can use ConfigMgr Service Manager to pause a component and still preserve its run-time environment.

How to pause a component

  1. Open ConfigMgr Service Manager.

  2. Select one or more running components.

  3. On the Component menu, click Pause.

See Also

Tasks

How to Query a Component
How to Stop a Component
How to Start a Component
How to Resume a Component
How to Enable Logging for a Component
How to Open ConfigMgr Service Manager

Concepts

Using Configuration Manager Service Manager


How to Query a Component

You query a component to view its updated status. Before querying selected components, you might want to clear the Status column to make it easier to view the latest status of the components.

How to query a component

  1. How to Open ConfigMgr Service Manager.

  2. Select one or more components.

  3. On the Component menu, click Query.

See Also

Tasks

How to Stop a Component
How to Start a Component
How to Pause a Component
How to Resume a Component
How to Enable Logging for a Component

Concepts

Using Configuration Manager Service Manager


How to Resume a Component

When you resume a paused Microsoft System Center Configuration Manager 2007 component, it begins running from the point where it paused.

How to resume a component

  1. Open ConfigMgr Service Manager.

  2. Select one or more paused components.

  3. On the Component menu, click Resume.

See Also

Tasks

How to Query a Component
How to Open ConfigMgr Service Manager
How to Stop a Component
How to Start a Component
How to Pause a Component
How to Enable Logging for a Component

Concepts

Using Configuration Manager Service Manager


How to Start a Component

You can use ConfigMgr Service Manager to restart a stopped component. Stopping and then restarting a component clears log files.

How to start a component

  1. Open ConfigMgr Service Manager.

  2. Select one or more stopped components.

  3. On the Component menu, click Start.

See Also

Tasks

How to Query a Component
How to Stop a Component
How to Pause a Component
How to Resume a Component
How to Enable Logging for a Component
How to Open ConfigMgr Service Manager

Concepts

Using Configuration Manager Service Manager


How to Stop a Component

You can use ConfigMgr Service Manager to stop a running component. Stopping a component clears log files and other files.

How to stop a component

  1. Open ConfigMgr Service Manager.

  2. Select one or more running components.

  3. On the Component menu, click Stop.

See Also

Tasks

How to Query a Component
How to Start a Component
How to Pause a Component
How to Resume a Component
How to Enable Logging for a Component
How to Open ConfigMgr Service Manager


Using Status Messages for Configuration Manager Troubleshooting

Topic last updated—November 2007

Microsoft System Center Configuration Manager 2007 status messages report information about Configuration Manager 2007 component behavior and data flow. Configuration Manager 2007 status messages are categorized by severity and type.

Configuration Manager 2007 provides a number of tools to help you manage the large numbers of status messages that might be generated on a typical site. These include queries, which allow you to perform searches on all status messages stored in the site database; status filter rules, which allow you to initiate actions when a specified status message is generated, such as reporting to the Windows Event Log; and filters, which allow you to limit the results shown in the Configuration Manager 2007 ConfigMgr Status Message Viewer.

Important
The status of a Configuration Manager 2007 site reported in the Configuration Manager console is not a real-time indicator of the health of the site. If you correct a problem indicated by the site status, it might take some time for the status summarizers to collect new status messages and show the new site status. If you want to monitor the health of your Configuration Manager 2007 site in real time, you should use a tool such as Microsoft System Center Operations Manager.

The topics in this section provide detailed information about using status messages to help manage and troubleshoot a Configuration Manager 2007 site.

In This Section

ConfigMgr Status Message Viewer Overview

Provides an overview of the Configuration Manager 2007 ConfigMgr Status Message Viewer.

About the System Status Node

Provides information about the System Status node in the Configuration Manager 2007 console.

About the Advertisement Status Node

Provides information about the Advertisement Status node in the Configuration Manager 2007 console.

About the Package Status Node

Provides information about the Package Status node in the Configuration Manager 2007 console.

About the Site Status Node

Provides information about the Site Status node in the Configuration Manager 2007 console.

About the Component Status Node

Provides information about the Component Status node in the Configuration Manager 2007 console.

About the Site System Status Node

Provides information about the Site System Status node in the Configuration Manager 2007 console.

About Status Message Queries

Provides an overview of status message queries in Configuration Manager 2007.

About the Difference Between Filters and Queries

Provides information about the difference between filters and status message queries in Configuration Manager 2007.

About Messages Returned by a Query

Provides information about managing the results generated by a status message query.

About the smsmsgs Folder

Provides information about the folder used by Configuration Manager 2007 to report to the Windows Event Log.

Status Message Tasks

Provides procedures for completing tasks related to system status in Configuration Manager 2007.

See Also

Other Resources

Troubleshooting Configuration Manager 2007


ConfigMgr Status Message Viewer Overview

Topic last updated—November 2007

The Microsoft System Center Configuration Manager 2007 ConfigMgr Status Message Viewer is the primary tool for viewing status messages stored in a Configuration Manager 2007 site database. ConfigMgr Status Message Viewer is similar to the Windows Event Viewer, but it has additional capabilities that allow you to perform the following actions:

  • Export and print status messages.
  • Start multiple viewers to compare messages for troubleshooting.
  • Select multiple rows of messages to create your own grouping.
  • Copy messages to the Windows clipboard (with tab-delimited columns) to support pasting to applications such as Microsoft Office Excel and Microsoft Office Word.
  • Delete status messages (if you have permission to do so).
  • Find, filter, or sort on each column.
  • Specify which columns are displayed and in which order.
  • Select ConfigMgr Status Message Viewer's font.
  • Select additional startup and refresh options. (Options are automatically saved when you exit ConfigMgr Status Message Viewer.)

See Also

Tasks

How to Delete Status Messages
How to Export Status Messages
How to Filter Status Messages
How to Find Status Messages
How to Open ConfigMgr Status Message Viewer
How to Query Status Messages
How to Refresh Status Messages
How to Set ConfigMgr Status Message Viewer Options
How to View Status Message Details

Concepts

About Messages Returned by a Query


About the System Status Node

Topic last updated—November 2007

The Microsoft System Center Configuration Manager 2007 status system monitors and reports on the health of sites in the Configuration Manager 2007 hierarchy. In the Configuration Manager console, System Status node, the following items are displayed:

  • Advertisement Status
  • Package Status
  • Site Status
  • Status Message Queries

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


About the Advertisement Status Node

Topic last updated—November 2007

In the Configuration Manager console, the Advertisement Status node displays information about each advertisement on your Microsoft System Center Configuration Manager 2007 site.

For more details about the information shown in this node, see Advertisement Status Home Page.

See Also

Tasks

How to View the Status of a Single Advertisement

Concepts

Advertisement Status Home Page
Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to Manage Advertisements


About the Package Status Node

Topic last updated—November 2007

In the Configuration Manager console, the Package Status node displays information about each package on your Microsoft System Center Configuration Manager 2007 site.

For more details about the information shown in this node, see Package Status Home Page.

See Also

Tasks

How to View the Status of a Package to a Destination Site
How to View the Status of a Single Package

Concepts

Package Status Home Page
Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to Manage Packages


About the Site Status Node

Topic last updated—November 2007

In the Configuration Manager console, the Site Status node displays a status summarizer for each site in the hierarchy.

For more details about the information shown in this node, see Site Status Home Page.

See Also

Concepts

Site Status Home Page
Using Status Messages for Configuration Manager Troubleshooting


About the Component Status Node

Topic last updated—November 2007

In the Microsoft System Center Configuration Manager 2007 console, Component Status contains status information for each Configuration Manager 2007 component. For more details about the information shown in this node, see Component Status Home Page.

See Also

Tasks

How to Configure the Status Message Display Interval
How to Reset Status Message Counts
How to View the Status of a Component

Concepts

Component Status Home Page
Using Status Messages for Configuration Manager Troubleshooting


About the Site System Status Node

Topic last updated—November 2007

In the Configuration Manager console, the site system status node displays a status summarizer for each site system in your Configuration Manager 2007 hierarchy.

For more details about the information shown in this node, see Site System Status Home Page.

See Also

Concepts

Site System Status Home Page
Using Status Messages for Configuration Manager Troubleshooting


About Status Message Queries

Topic last updated—November 2007

Status message queries in Microsoft System Center Configuration Manager 2007 return status messages from the site database and display these in ConfigMgr Status Message Viewer according to criteria you specify. The Status Message Queries node in the Configuration Manager console contains a list of all status message queries created on the site.

To create new status message queries, see How to Create a Status Message Query.

Important
Because a Configuration Manager 2007 site database can store a high number of status messages, it is recommended that you restrict the number of messages you view at one time.

See Also

Tasks

How to Create a Status Message Query
How to Delete a Status Message Query
How to Modify a Status Message Query
How to Run a Status Message Query
How to View a Status Message Query's Properties

Concepts

Using Status Messages for Configuration Manager Troubleshooting


About the Difference Between Filters and Queries

Topic last updated—November 2007

Queries and filters both refine a group of messages into a subset, but queries yield a subset of all the messages in the Microsoft System Center Configuration Manager 2007 site database, while filtering yields a subset of the messages currently displayed in ConfigMgr Status Message Viewer. For example, if there are 1,000 messages in the Configuration Manager 2007 site database, you could define a query that returns 541 of those messages to ConfigMgr Status Message Viewer. You could then filter these messages so that only 17 are displayed.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


About Messages Returned by a Query

Topic last updated—November 2007

When messages are displayed by Microsoft System Center Configuration Manager 2007 ConfigMgr Status Message Viewer, they are read from a file (%temp%\SVRxxxxx.tmp) on the site server that is written when the query runs. If the query returns a high number of results, it is possible that this file could exceed the amount of available disk space on the site server. If your Configuration Manager 2007 site server is low on disk space, consider specifying status message queries carefully to limit the results returned.

Another method of limiting the results returned by a query is to select the option Limit messages returned from query on the General tab of the Status Viewer Options dialog box. You can find a suitable limit by examining the size of the file %temp%\SVRxxxxx.tmp using different values in this field.

Messages are returned from the Configuration Manager 2007 site database asynchronously. Therefore, if a query returns 10,000 messages but the limit is set to 5,000, the 5,000 messages displayed are a random sample of the 10,000 returned.

See Also

Tasks

How to Set ConfigMgr Status Message Viewer Options

Reference

Status Viewer Options Properties: General Tab

Concepts

ConfigMgr Status Message Viewer Overview


About the smsmsgs Folder

Topic last updated—November 2007

The %systemroot%\system32\smsmsgs folder on the Microsoft System Center Configuration Manager 2007 site server contains the following items, which allow Configuration Manager 2007 to report status messages as events to the Windows event log. (This is accomplished by using status filter rules.)

  • The resource libraries required for Windows Event Viewer to display events reported by Configuration Manager 2007.
  • The command files required to set up the Event Log service so that it is aware of the Configuration Manager 2007 events.

Even if Configuration Manager is removed, the %systemroot%\system32\smsmsgs folder is never deleted. As a result, the Windows Event Viewer can continue to display the events that were previously reported by Configuration Manager 2007.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Status Message Tasks

Topic last updated—November 2007

The topics in this section provide information about completing tasks related to system status in Configuration Manager 2007.

In This Section

How to Export Status Messages

How to View Status Message Details

How to Delete Status Messages

How to Open ConfigMgr Status Message Viewer

How to Refresh Status Messages

How to Query Status Messages

How to Set ConfigMgr Status Message Viewer Options

How to Find Status Messages

How to Filter Status Messages

How to View Status

How to Manage Status Message Queries

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


How to Export Status Messages

Topic last updated—November 2007

You can use the following procedure to export Configuration Manager 2007 status messages from ConfigMgr Status Message Viewer to a file, which you can then use in other software such as Microsoft Office Excel.

To export status messages

  1. In ConfigMgr Status Message Viewer, click View, and then click Options.

  2. In the Export tab of the Status Viewer Options dialog box, specify the options you want to use for exporting status messages. Click OK when you are finished.

  3. In ConfigMgr Status Message Viewer, click File, and then click Save As.

    Note
    If you do not want to export all displayed status messages, select the messages you want to export before exporting the items.

See Also

Tasks

How to Open ConfigMgr Status Message Viewer

Concepts

ConfigMgr Status Message Viewer Overview


How to View Status Message Details

Topic last updated—November 2007

When the Configuration Manager 2007 ConfigMgr Status Message Viewer is open, you can use the following procedure to view further details about any displayed status message.

To view status message details

  1. In ConfigMgr Status Message Viewer, double-click a status message to open the Status Message Details dialog box, which displays detailed information about the selected status message.

  2. To view information about adjacent status messages, click Previous or Next.

  3. Click OK to close the Status Message Details dialog box.

See Also

Tasks

How to Open ConfigMgr Status Message Viewer

Concepts

ConfigMgr Status Message Viewer Overview


How to Delete Status Messages

Topic last updated—November 2007

To delete status messages from the Configuration Manager 2007 database, use the following procedure.

Note
You must have Delete rights for the Status Message security object class to perform this procedure.

To delete status messages

  1. In ConfigMgr Status Message Viewer, select the status messages that you want to delete.

  2. Click Edit, and then click Delete. The selected messages are deleted from the Configuration Manager site database.

See Also

Tasks

How to Open ConfigMgr Status Message Viewer

Concepts

ConfigMgr Status Message Viewer Overview


How to Open ConfigMgr Status Message Viewer

Topic last updated—November 2007

When ConfigMgr Status Message Viewer opens, it runs a query related to the node from which it was opened and then it displays messages that meet the criteria for that query. For example, if you navigate to Component Status, right-click a component in the results pane, right-click Show Messages, and then click Warnings, Status Message Viewer displays only the warning messages that are generated by the specified component.

Note
No security rights are needed to open ConfigMgr Status Message Viewer, but you must have Read rights for the Status Message security object class to see any messages.

To open ConfigMgr Status Message Viewer

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status.

  2. Under System Status, click the status summarizer whose messages you want to view. This can be one of the following:

    • Advertisement Status
    • Package Status
    • Site Status
    • Component Status (under Site Status)
    • Site System Status (under Site Status)

  3. In the results pane, right-click an item, click Show Messages, and then click the required severity. Only status messages of the specified severity will be displayed. Only messages pertinent to the item you right-clicked will be displayed. For example, if you right-clicked a package, only messages about that package are displayed.

    Note
    If the Configuration Manager 2007 database contains a high number of applicable status messages, specifying a severity of All might cause the display to take a long time to complete.

See Also

Concepts

ConfigMgr Status Message Viewer Overview

Other Resources

How to View Status


How to Refresh Status Messages

Topic last updated—November 2007

Use the following procedure to refresh the display in ConfigMgr Status Message Viewer and update the display with any new results from the Configuration Manager 2007 database.

To refresh status messages

  1. In ConfigMgr Status Message Viewer, click View, and then click Refresh.

  2. The status messages will be reloaded from the Configuration Manager 2007 site database and displayed in ConfigMgr Status Message Viewer.

See Also

Concepts

ConfigMgr Status Message Viewer Overview


How to Query Status Messages

Topic last updated—November 2007

Use the following procedure to change the query results displayed in ConfigMgr Status Message Viewer.

Note
No permission is needed to run a query, but query results are limited to the security objects that you have Read rights for.

How to query status messages

  1. Open ConfigMgr Status Message Viewer.

  2. In the queries list on the ConfigMgr Status Message Viewer toolbar, click a status message query. (The default is Original Query.)

See Also

Tasks

How to Create a Status Message Query
How to Open ConfigMgr Status Message Viewer

Concepts

About the Difference Between Filters and Queries
ConfigMgr Status Message Viewer Overview


How to Set ConfigMgr Status Message Viewer Options

Topic last updated—November 2007

When the Configuration Manager 2007 ConfigMgr Status Message Viewer window is open, you can configure a number of options to specify how the results are displayed and how they can be exported for use outside of Configuration Manager 2007.

To set Status Message Viewer options

  1. In ConfigMgr Status Message Viewer, click View, and then click Options.

  2. In the Status Viewer Options dialog box, configure the following options as appropriate:

    • On the General tab, specify whether the status message display will automatically refresh, the number of messages to display in the status message viewer window, and the time zone in which to display status message time stamps.
    • On the Columns tab, specify the columns that will appear in the status message viewer window.
    • On the Export tab, specify options to control how status messages are exported to files and printed.
    • On the Font tab, specify the font type and size that will be used to display results in the Status Message Viewer window.

  3. Click OK to close the Status Viewer Options dialog box.

See Also

Tasks

How to Export Status Messages
How to Open ConfigMgr Status Message Viewer

Concepts

ConfigMgr Status Message Viewer Overview


How to Find Status Messages

Topic last updated—November 2007

Use the following procedure to find status messages in the Configuration Manager 2007 ConfigMgr Status Message Viewer.

To find status messages

  1. In ConfigMgr Status Message Viewer, click the find button to open the Find Status Message dialog box.

  2. In the Find Status Message dialog box, specify the required search values and then click Find Next.

  3. Click OK to close the Find Status Message dialog box.

See Also

Tasks

How to Open ConfigMgr Status Message Viewer

Reference

Find Status Message Dialog Box
Status Message Viewer Window


How to Filter Status Messages

Topic last updated—November 2007

The Microsoft System Center Configuration Manager 2007 ConfigMgr Status Message Viewer allows you to filter the display of status messages to reduce the results shown on screen. Filtering affects only results currently shown in ConfigMgr Status Message Viewer; it does not cause the site database to be searched for new results.

Note
You must have Configuration Manager 2007 Modify permission for the Site security object class or instance and Manage permission for the Manage Status Filters Site security object class or instance to perform this procedure.

How to filter status messages

  1. In ConfigMgr Status Message Viewer, click the filter button to open the Filter Status Messages dialog box.

  2. In the Filter Status Messages dialog box, specify the filter options you want to use.

  3. Click OK to close the Filter Status Messages dialog box.

See Also

Tasks

How to Find Status Messages
How to Open ConfigMgr Status Message Viewer

Concepts

ConfigMgr Status Message Viewer Overview

Other Resources

How to View Status


How to View Status

Topic last updated—November 2007

The topics in this section provided detailed information about how to view status messages for various items in your Configuration Manager 2007 site.

In This Section

How to View the Status of Storage Objects

How to View the Status of Site Systems

How to View the Status of a Package to a Destination Site

How to View the Status of a Single Package

How to View the Status of a Component

How to View the Status of a Single Advertisement

See Also

Concepts

ConfigMgr Status Message Viewer Overview

Other Resources

Status Message Tasks


How to View the Status of Storage Objects

Topic last updated—November 2007

Use the following procedure to view the status of Configuration Manager 2007 storage objects.

To view the status of storage objects

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Site Status / Site System Status.

  2. In the results pane, view the status information.

    Note
    To view more detailed information about any storage object, right-click the storage object, click Show Messages, and then click All.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to View Status


How to View the Status of Site Systems

Topic last updated—November 2007

Use the following procedure to view the status of Configuration Manager 2007 site systems.

To view the status of site systems

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Site Status / Site System Status.

  2. In the results pane, view the status information.

    Note
    To view more detailed information about any site system, right-click the site system, click Show Messages, and then click All.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to View Status


How to View the Status of a Package to a Destination Site

Topic last updated—November 2007

If your Microsoft System Center Configuration Manager 2007 site has child sites and you have copied packages to these sites, you can use the Package Status node to view the status of these packages at the child site.

To view the status of a package at a destination site

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Package Status.

  2. In the Package Status node, expand any package to see a list of sites where the package resides.

  3. Click the required site and package name.

  4. In the results pane, view the status information.

    Note
    To view more detailed information about any package, right-click the package, click Show Messages, and then click All.

See Also

Tasks

How to View the Status of A Package
How to View the Status of a Single Package

Concepts

About the Package Status Node
Using Status Messages for Configuration Manager Troubleshooting


How to View the Status of a Single Package

Topic last updated—November 2007

Use the following procedure to view the status of a single Configuration Manager 2007 package.

To view the status of a single package

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Package Status.

  2. In the results pane, view the status information.

    Note
    To view more detailed information about any package, right-click the package, click Show Messages, and then click All.

See Also

Tasks

How to View the Status of A Package
How to View the Status of a Package to a Destination Site

Concepts

Using Status Messages for Configuration Manager Troubleshooting


How to View the Status of a Component

Topic last updated—November 2007

Use the following procedure to view the status of an individual component of a Configuration Manager 2007 site.

To view the status of a component

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Site Status / Component Status.

  2. In the results pane, scroll to a component and view its status information.

    Note
    To view more detailed information about a component, right-click the component, click Show Messages, and then click All.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to View Status


How to View the Status of a Single Advertisement

Topic last updated—November 2007

Use the following procedure to view the status of an advertisement from the Configuration Manager console.

To view the status of a single advertisement

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Advertisement Status.

  2. In the results pane, view the advertisement status information.

    Note
    To view more detailed information about any advertisement, select the advertisement under the Advertisement Status node. In the results pane, right-click the advertisement, click Show Messages, and then click All.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting
How to View the Status of an Advertisement


How to Manage Status Message Queries

Topic last updated—November 2007

Status message queries in Configuration Manager 2007 allow you to search the site database for status messages using specified search parameters.

The topics in this section provide the necessary steps to accomplish the tasks that relate to status message queries in Configuration Manager 2007.

In This Section

How to View a Status Message Query's Properties

How to Run a Status Message Query

How to Delete a Status Message Query

How to Modify a Status Message Query

How to Create a Status Message Query

See Also

Concepts

ConfigMgr Status Message Viewer Overview

Other Resources

Status Message Tasks


How to View a Status Message Query's Properties

Topic last updated—November 2007

Use the following procedure to view the properties of a status message query in Microsoft System Center Configuration Manager 2007.

Note
You must have Read rights for the Query security object class or instance to perform this procedure.

To view a status message query's properties

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. In the results pane, right-click the status message query you want to view properties for, and then click Properties.

  3. Review the properties of the status message query on the General tab of the Status Message Query Properties dialog box.

  4. Click OK to close the Status Message Query Properties dialog box.

See Also

Tasks

How to Create a Status Message Query
How to Delete a Status Message Query
How to Modify a Status Message Query
How to Run a Status Message Query
How to View a Status Message Query's Properties

Concepts

About Status Message Queries


How to Run a Status Message Query

Topic last updated—November 2007

Use the following procedure to run a status message query in Microsoft System Center Configuration Manager 2007.

Note
No security rights are needed to run a query, but query results are limited to the security objects you have Read permission for.

To run a status message query

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. In the results pane, right-click the status message query you want to run and then click Show Messages.

  3. In the Prompted Status Message Query dialog box, specify the required options for the status message query. Click OK to display the results in ConfigMgr Status Message Viewer.

See Also

Tasks

How to Create a Status Message Query
How to Delete a Status Message Query
How to Modify a Status Message Query
How to Run a Status Message Query
How to View a Status Message Query's Properties

Concepts

About Status Message Queries


How to Delete a Status Message Query

Topic last updated—November 2007

Use the following procedure to delete a status message query in Microsoft System Center Configuration Manager 2007.

Note
You must have Delete rights for the Query security object class or instance to perform this procedure.

To delete a status message query

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. In the results pane, right-click the status message query you want to delete, and then click Delete.

See Also

Tasks

How to Create a Status Message Query
How to Delete a Status Message Query
How to Modify a Status Message Query
How to Run a Status Message Query
How to View a Status Message Query's Properties

Concepts

About Status Message Queries


How to Modify a Status Message Query

Topic last updated—November 2007

Use the following procedure to modify a status message query in Microsoft System Center Configuration Manager 2007.

Note
You must have Modify permission for the Query security object class or instance to perform this procedure.

To modify a status message query

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status / Status Message Queries.

  2. In the results pane, right-click the status message query you want to modify, and then click Properties.

  3. In the Status Message Query Properties dialog box, modify the name and comments for the status message query as needed.

  4. Click Edit Query Statement to open the Query Statement Properties dialog box.

  5. Modify the query as required and then click OK to close the Query Statement Properties dialog box.

  6. Click OK to close the Status Message Query Properties dialog box.

See Also

Tasks

How to Create a Status Message Query
How to Delete a Status Message Query
How to Run a Status Message Query
How to Modify a Status Message Query
How to View a Status Message Query's Properties

Concepts

About Status Message Queries


How to Create a Status Message Query

Topic last updated—November 2007

Use the following procedure to create a status message query in Microsoft System Center Configuration Manager 2007.

Note
You must have Create rights for the Query security object class to perform this procedure.

To create a status message query

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / System Status.

  2. Right-click Status Message Queries and then click New Status Message Query, which opens the New Status Message Query Wizard.

  3. On the General page of the New Status Message Query Wizard, specify the following:

    • Name Specify a unique and descriptive name for the status message query.
    • Comment Specify a description for the status message query.
    • Import Query Statement Import a saved status message query (if desired).
    • Edit Query Statement Opens the Query Statement Properties dialog box, where you can specify the criteria used to return results from the status message query.

  4. Click Finish to create the status message query and close the New Status Message Query Wizard.

    Note
    Site database queries are different from status message queries. Do not paste text from a standard Configuration Manager 2007 query into a status message query.

See Also

Tasks

How to Create a Status Message Query
How to Delete a Status Message Query
How to Modify a Status Message Query
How to Run a Status Message Query
How to View a Status Message Query's Properties

Concepts

About Status Message Queries


About State Messages

Topic last updated—November 2007

State messages are sent by Configuration Manager 2007 clients, using a new messaging system that is built into the product and that allows clients to send messages to site systems based on important changes of state. State messages are not the same as status messages; status messages provide information about component behavior and data flow, whereas state messages provide a snapshot of the state of a process at a specific time.

State messages can be helpful when troubleshooting, to identify at which stage a process failed or stopped. For example, the state messages "Waiting for another installation to complete" or "Restart required before installing" can provide information about a process at that specific point in time. State messages can also be used to verify that processes are working correctly. For example, for information about using state message changes in client logs, see How to Verify Clients are Successfully Remediated with Network Access Protection.

The fallback status point exclusively uses state messages for reporting the different states of client deployment and monitoring client communication. For example, these state messages can report whether a client installed successfully, installed successfully but requires a restart, failed to assign to a site, switched to native mode communication, or cannot communicate with its management point because of certificate-related issues. For more information about which reports use the fallback status point to relay state messages from clients, see About Reports for Configuration Manager Clients. For more information about the fallback status point, see About the Fallback Status Point in Configuration Manager.

State messages sent to the fallback status point are then forwarded to the management point. However, some state messages are sent directly from clients to the management point. For example, clients send compliance information from assigned configuration baselines to the management point using state messages. For more information about the state messages used with desired configuration management, see Compliance Sent As State Messages and Status Messages in Desired Configuration Management.

By default, clients consolidate and send their state messages to their site every 15 minutes. This frequency can be modified by configuring the State message reporting cycle (minutes) value. (For more information about configuring this value, see Computer Client Agent Properties: General Tab.)

In some scenarios, a high number of clients that are all sending state messages can cause the state message system to backlog, and state messages cannot be processed in a timely fashion. This can result in a delay in displaying the latest client information in the reports, and even missing information. For more information about this issue and how to prevent it, see Troubleshooting State Message Backlogs.

State messages are used with software updates, Network Access Protection (NAP), desired configuration management, client deployment, and client communication. For the most part, administrators will not directly see or use state messages. Unlike for status messages there is no state message viewer. Instead, the information state messages provide is made available to the administrator in reports, and client log files.

For a list of state messages, see State Messages in Configuration Manager 2007.

See Also

Concepts

Troubleshooting Tools


Troubleshooting the Configuration Manager Server Infrastructure

The topics in this section provide information that can be used to troubleshoot the Microsoft System Center Configuration Manager 2007 server infrastructure.

In This Section

Troubleshooting Configuration Manager Setup

Troubleshooting Active Directory Schema Extensions During Upgrades

Troubleshooting Secure Key Exchange

Troubleshooting SQL Replication Issues

Troubleshooting Management Point Communication

Troubleshooting State Message Backlogs

See Also

Other Resources

Troubleshooting Configuration Manager 2007


Troubleshooting Configuration Manager Setup

The following troubleshooting information can be used to help troubleshoot Configuration Manager 2007 Setup issues.

The Stand-Alone Setup Prerequisite Checker Fails to Verify Installation Prerequisites on SQL Server Named Instances

When running the Setup Prerequisite Checker from the Configuration Manager 2007 installation splash screen (splash.hta) to verify installation prerequisites for SQL Server named instances, you receive the following error:

There was an error with the specified hostname. You must specify a valid NetBIOS hostname.

Solution

This is a known issue. To verify installation prerequisites before beginning Configuration Manager Setup, you must do so manually or use the /Prereq Setup command-line option. To use the /Prereq Setup command-line option to verify installation prerequisites for SQL Server named instances, use the following command:

Setup /Prereq /Pri /SQL <SQL Server Name\Instance Name>.

Note
During site installation, the Setup Prerequisite Checker, run as part of the Configuration Manager Setup Wizard, is capable of verifying required Setup prerequisites on SQL Server named instances.

Setup Fails to Install SMS Provider Components

When using the Configuration Manager Setup Wizard to install a Configuration Manager 2007 primary site, setup might fail when attempting to install SMS Provider components and display an error dialog. When the SMS Provider installation error dialog is closed, the Configuration Manager Setup Wizard exits automatically. The ConfigMgrSetup.log file may also record an entry similar to the following:

Copy Code
<date time>CompileMOFFile: Failed to compile MOF <install dir\i386\smsRprt.mof, error -2147217407

Solution

This error usually occurs when attempting to install the site database on a remote SQL Server named instance configured to use a domain user account to run the SQL Server service.

This error results from incorrect Active Directory Service Principal Name (SPN) registration of the SQL Server service account for the SQL Server named instance.

To resolve this error, use the following procedure.

To resolve Configuration Manager Setup SMS Provider installation failure

  1. Start the Configuration Manager Setup Wizard, and select the Uninstall a Configuration Manager site server option to uninstall Configuration Manager components that were installed as part of the failed setup.

  2. Register a Service Principal Name (SPN) for the domain user account configured to run the SQL Server service for the remote SQL Server named instance. For more information about registering an SPN for the SQL Server service account, see How to Configure an SPN for SQL Server Site Database Servers.

    Note
    Both the NetBIOS name and the FQDN name for the SQL Server computer must be registered during SQL Server service account SPN registration.

  3. Restart Configuration Manager Setup, and continue with Configuration Manager primary site installation.

Setup Fails to Communicate with a Remotely Installed SQL Server Named Instance

When installing Configuration Manager, you might receive the following error: Could not connect or execute SQL query. This issue can occur for several reasons, including the following:

  • The remote SQL Server computer specified to host the site database is not online.
  • The user account running Configuration Manager Setup is not a member of the SQL Server instance sysadmin database role.
    Note
    By default, local administrators are automatically added to the sysadmin database role of the SQL Server instance. However, a SQL Server best practice is to remove the Builtin\Administrators group from the SQL Server sysadmin database role.

  • The remote SQL Server SQL Server Browser service is not started.

Solution

This issue can usually be resolved by taking one of the following actions:

  • Ensure the remote SQL Server is online and accessible over the network.
  • Add the domain user account configured to run the SQL Server service for the SQL Server instance to the local administrators group on the remote SQL Server computer, or add the account to the sysadmin database role of the SQL Server instance if the Builtin\Administrators group has been removed from the sysadmin database role of the SQL Server instance specified to install the site database.
  • Enable the SQL Server Browser service on the remote SQL Server computer. The SQL Server browser service is required to enumerate installed SQL Server instances remotely.

See Also

Concepts

Troubleshooting the Configuration Manager Server Infrastructure


Troubleshooting Active Directory Schema Extensions During Upgrades

Topic last updated—November 2007

The information in this topic can be used to troubleshoot upgrading Active Directory schema extensions for Configuration Manager when using a Lightweight Directory Interchange Format (LDIF) file if the Active Directory schema was previously extended for Systems Management Server (SMS) 2003.

When Using an LDIF File to Extend the Active Directory Schema, All Required Management Point Object Attributes Might Not Be Created

If the Active Directory schema has already been extended for SMS 2003 and you use the default ConfigMgr_ad_schema.ldf file to extend the schema for Configuration Manager, all of the required attributes for the management point object in Active Directory Domain Services are not added. Specifically, the following three attributes are not added:

  • mSSMSCapabilities
  • mSSMSVersion
  • mSSMSSourceForest

Without these attributes present in the Active Directory schema, Configuration Manager 2007 client assignment will fail unless a server locator point is available and has been specified during client installation.

Solution

To ensure that all required management point object attributes are properly added when using an LDIF file to extend the Active Directory schema, follow the "To upgrade existing SMS 2003 schema extensions" procedure in the topic How to Extend the Active Directory Schema Using an LDIF File.

See Also

Concepts

Troubleshooting the Configuration Manager Server Infrastructure

Other Resources

How to Extend the Active Directory Schema for Configuration Manager


Troubleshooting Secure Key Exchange

If the Active Directory schema has not been extended for Configuration Manager 2007 or site information is not being published to Active Directory, the site’s public key will not be available to other sites in Active Directory. Sites located in different Active Directory forests are unable to query for site information published for sites in different forests.

In any of these situations, the destination server will check in its <install directory>\inboxes\hman.box directory for a public key for the sending site (not in the <install dir>\inboxes\hman.box\pubkey directory).

If the sending site’s public key cannot be found in Active Directory or the <install directory>\inboxes\hman.box directory, the received data will be rejected and the sites will be unable to communicate.

When installing a new secondary site for a primary site configured for secure key exchange, if you do not manually transfer the public key to the parent site, the secondary site installs successfully but is unable to properly establish a connection to the parent site. The primary site will continue to attempt to find a public key for the secondary site to allow it to connect about every five minutes, one hundred times. Secondary site communications will be rejected by the parent site until the keys are manually exchanged.

Until the public keys are manually exchanged, the following behaviors should be expected:

Parent Site Despooler Inbox

The <install directory>\inboxes\despoolr.box\receive directory (which stores data that is received from other sites) on the primary site will begin to fill with secondary site communication files. The files are typically processed and moved as soon as the site server receives the instruction files (.ins files), but they will remain until they are rejected and deleted by the receiving site in this situation.

Parent Site Despool.log Log File

The Despool.log file on the receiving site (which records incoming site-to-site communication transfers) will have entries similar to the following:

  • "Cannot find a public key for instruction <install directory>\inboxes\despoolr.box\receive incoming from site <secondary site code>, retry it later."
  • "Cannot find valid public key for key exchange instruction coming from site <secondary site code>."

Receiving Site SMS_Despooler Component Status Messages

You will receive the following status messages for the SMS_DESPOOLER component on the receiving site:

  • Status message 4404, stating that the despooler component received an instruction and package file from a site that will not be processed because the site does not allow unsigned key exchange between sites.
  • Status message 4405, stating that the site has received an instruction file containing inter-site replication data that will not be processed and retired because a valid public key cannot be located for the sending site.

See Also

Tasks

How to Manually Exchange Public Keys Between Sites

Concepts

Troubleshooting the Configuration Manager Server Infrastructure


Troubleshooting SQL Replication Issues

Use the information in this section to help troubleshoot SQL Server site database replication issues.

Replicated Objects are Out of Date on the SQL Server Replica

Configuring site database data for replication changes the objects to be replicated and may cause them to be out of date when the database tables are replicated. If this happens, you may see errors in the ddm.log and dataldr.log files similar to:

Microsoft SQL Server reported SQL message 2801, severity 16: [42000][2801][Microsoft][ODBC SQL Server Driver][SQL Server]The definition of object 'sp_GetPublicKeyForSMSID' has changed since it was compiled. : sp_GetPublicKeyForSMSID

Solution

After creating a SQL publication, the following stored procedure should be run on the SQL Server site database server computer (publisher) to ensure that objects to be replicated have been updated to the most current information.

Note
This procedure uses the sp_GetPublicKeyForSMSID object referenced in the issue log example. This procedure can be used for any replication article experiencing this error and referenced in ddm.log or dataldr.log files.

To update objects to be replicated on the SQL Server publisher computer

  1. In the SQL Server 2005 SQL Server Management Studio console connected to the SQL Server hosting the site database replica, expand Databases, right click the site database name and click New Query.

  2. In the query results pane, enter the following commands:

    EXEC sp_recompile GetPublicKeyForSMSID

  3. Click Execute to begin reconfiguration.

  4. Verify that the object to be replicated has been successfully marked for recompilation in the Messages pane.

SMS_MP_CONTROL_MANAGER reports error 500

When a management point is configured to access site data from a replicated SQL Server site database, and the replicated site database is not functioning properly, management point control manager (SMS_MP_CONTROL_MANAGER) will report error 500. Because management point control manager attempts to access management point information the same way clients do, it returns the same error that a client would when it fails to access management point information.

Solution

Before troubleshooting Internet Information Services (IIS) for possible errors, ensure that SQL Server database replication is functioning properly.

See Also

Concepts

Troubleshooting the Configuration Manager Server Infrastructure


Troubleshooting Management Point Communication

Topic last updated—March 2008

The following are potential issues with Configuration Manager 2007 Management point site systems which provide client computers with installation prerequisites, client installation source files, configuration details, advertisements, and software distribution package source file locations. Additionally, management points receive inventory data, software metering information, and status and state messages from clients. If clients cannot access or communicate properly with a management point, they will be unmanaged.

Note
Regardless of the number of management point site system roles installed on site systems within a site, clients will only communicate with either the default management point (intranet clients) or their assigned management point (Internet-based clients).

Important
You must download, install, and configure WebDAV manually on management points running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

Clients Cannot Access the Default or Assigned Internet-Based Management Point

For successful client computer installation and management, clients must be able to connect to the default or assigned management point computer.

Solution

To verify that a client can access the management point, use the Web browser installed on the client to connect to the management point list intranet address and verify that the list of installed management points for the site is displayed.

  • For mixed mode clients, use the following: http://<ServerName>/sms_mp/.sms_aut?mplist, where <ServerName> is the NetBIOS name for the management point computer.
  • For intranet-based, native mode clients, use the following: https://<ServerName>/sms_mp/.sms_aut?mplist, where <ServerName> is the FQDN for the management point computer if one has been specified in the site system properties or the short name if an FQDN has not been specified.
  • For Internet-based clients, use the following: https://<ServerName>/sms_mp/.sms_aut?mplist, where <ServerName> is the FQDN for the Internet-based management point computer.
    Important
    If a site is configured to use a custom Web site, the custom port must also be used, as in the following example: http://<ServerName>:<port>/sms_mp/.sms_aut?mplist.

Clients Cannot Communicate with the Default or Assigned Internet-Based Management Point

For successful client computer installation and management, Configuration Manager 2007 clients must trust the management point computer. When clients communicate with a management point, the management point certificate is verified by clients to establish the trustworthiness of data sent by the site system to clients.

Note
In mixed mode sites, a management point signing certificate is created and signed by the site's trusted root key to enable clients to trust the management point site system. In native mode sites, the Web server signing certificate installed on the management point and signed by a Certificate Authority trusted by clients is used.

Solution

To verify that a client can view the management point certificate, connect to the management point certificate address and verify that the management point certificate information (a long list of numbers and letters) is displayed.

  • For mixed mode clients, use the following: http://<ServerName>/sms_mp/.sms_aut?mpcert, where <ServerName> is the NetBIOS name for the management point computer.
  • For intranet-based, native mode clients, use the following: https://<ServerName>/sms_mp/.sms_aut?mpcert, where <ServerName> is the FQDN for the management point computer if one has been specified in the site system properties or the short name if an FQDN has not been specified.
  • For Internet-based clients, use the following: https://<ServerName>/sms_mp/.sms_aut?mpcert, where <ServerName> is the FQDN for the Internet-based management point computer.
    Important
    If a site is configured to use a custom Web site, the custom port must also be used, as in the following example: http://<ServerName>:<port>/sms_mp/.sms_aut?mpcert.

An Internet Explorer Error Occurs When Troubleshooting Management Point Communication for Sites Configured to Operate in Native Mode

When troubleshooting management point connectivity for sites configured to operate in native mode using the MPLIST and MPCERT management point communication troubleshooting Web addresses, you receive a Microsoft Internet Explorer error similar to the following:

  • Internet Explorer cannot download .sms_aut?/mplist from <management point name>
  • Internet Explorer was not able to open this Internet site. The requested site is either unavailable or cannot be found. Please try again later

Solution

Native mode client-to-server communication must be authenticated using computer PKI certificates. Therefore, a computer certificate trusted by the management point computer must be configured in the client's Web browser to authenticate communication with the management point when troubleshooting management point communication using the MPLIST and MPCERT management point communication troubleshooting Web addresses.

The following procedures can be used to import a computer certificate into the client computer Web browser if it is using Internet Explorer:

  • Export the client certificate.
  • Import the client certificate into the client computer's Internet Explorer personal certificate store.

To export the native mode client certificate from computers running Windows Vista

  1. Log in to the Windows Vista native mode client computer used to test management point communication as a local administrator, click Start, type MMC into the Search box, and then press Enter.

  2. In the empty console, click File, and then click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, select Certificates, and then click Add.

  4. On the Certificates snap-in page, select Computer account, and then click Next.

  5. On the Select Computer dialog box, ensure the option Local computer: (the computer this console is running on) is selected, and then click Finish.

  6. Click OK to close the Add Standalone Snap-in dialog box.

  7. In the console, double-click Certificates (Local Computer) and then expand Personal.

  8. Right-click the native mode computer certificate, click All Tasks, and then click Export to launch the Certificate Export Wizard.

  9. On the Certificate Export Wizard Welcome page, click Next.

  10. On the Export Private Key page, select Yes, export the private key, and then click Next.

    Note
    If this option is not available, the certificate has been created without the option to export the private key. In this scenario, you cannot export the certificate in the required format.

  11. On the Password page, specify a strong password to protect the exported certificate with its private key, and then click Next.

  12. On the Export File Format page, ensure that the following option is selected: Personal Information Exchange - PKCS #12 (.PFX).

  13. On the File to Export page, specify the name of the file that you want to export, and then click Next.

  14. Click Finish in the Certificate Export Wizard dialog box to close the wizard.

To export the native mode client certificate from computers running Windows XP Professional, or Windows Server 2003

  1. Log in to the Windows XP Professional or Windows Server 2003 native mode client computer used to test management point communication as a local administrator, click Start, click Run, type MMC in the Run dialog box, and then click OK.

  2. In the empty console, click File, and then click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, click Add.

  4. Select Certificates from Available snap-ins, and then click Add.

  5. In the Certificates snap-in dialog box, click Computer account, and then click Next.

  6. In the Select Computer dialog box, ensure that the option Local computer: (the computer this console is running on) is selected, and then click Finish.

  7. In the Add or Remove Snap-ins dialog box, click OK.

  8. In the console, expand Certificates (Local Computer), expand Personal, and then click Certificates.

  9. Right-click the native mode computer certificate, click All Tasks, and then click Export to launch the Certificate Export Wizard.

  10. In the Certificate Export Wizard, click Next.

  11. On the Export Private Key page, select Yes, export the private key, and then click Next.

    Note
    If this option is not available, the certificate has been created without the option to export the private key. In this scenario, you cannot export the certificate in the required format.

  12. On the Password page, specify a strong password to protect the exported certificate with its private key, and then click Next.

  13. On the Export File Format page, ensure that the following option is selected: Personal Information Exchange - PKCS #12 (.PFX).

  14. On the File to Export page, specify the name of the file you want to export, and then click Next.

  15. Click OK in the Certificate Export Wizard dialog box to close the wizard.

To import the client computer certificate into the Internet Explorer personal Certificate Store

  1. On the native mode client computer that you will use to test management point communication using the exported certificate, open a new Internet Explorer browser window.

  2. On the Internet Explorer toolbar, click Tools, click Internet Options, and then click the Content tab.

  3. On the Content tab, click Certificates.

  4. With the Personal tab of the Certificates dialog selected, click Import.

  5. Click Next on the Certificate Import Wizard Welcome page.

  6. On the File to Import page, click Browse and select the certificate exported in the preceding procedure. and then click Next.

    Note
    To display the exported certificate, click the file extension drop-down list and select Personal Information Exchange (*.pfx,*.p12).

  7. Enter the password specified for the certificate when it was exported, and then click Next.

  8. On the Certificate Store page, accept the default location to store the certificate (Personal certificate store), and then click Next.

  9. Click Finish to close the Certificate Import Wizard.

  10. Click OK on the import confirmation dialog.

  11. Close all open dialog boxes and the Internet Explorer browser window.

See Also

Concepts

Best Practices for Certificate Management
Troubleshooting the Configuration Manager Server Infrastructure


Troubleshooting State Message Backlogs

Topic last updated—November 2007

Configuration Manager 2007 clients send state messages to report important changes of state for some Configuration Manager 2007 features, including client deployment and other client communication, software updates, Network Access Protection (NAP), asset intelligence, and desired configuration management.

Some state messages sent by clients are sent to the fallback status point, where they are processed and forwarded to the management point site system, while others are sent directly to the management point. The amount of state message traffic being sent from the fallback status point to the management point site system computer can be throttled to control the number of state messages processed at the same location. For more information about state message throttle settings, see Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager.

State messages processed by the fallback status point, as well as state messages sent directly from Configuration Manager 2007 clients to management point site systems, are forwarded to the state system inbox (Statsys.box\incoming) on the site server computer for a site. You can monitor the files in the state system inbox or use the Configuration Manager 2007 Management Pack for Operations Manager 2007 to monitor the SMS Inboxes counter. If you have child sites sending state messages, you can monitor the site server's Replmgr.box\incoming inbox for backlogs of state messages.

State Message Processing Can Become Backlogged

While it is normal to have some state message processing backlog, it is important to plan for the impact of site server state message processing when performing activities that generate large numbers of state messages. For example, because clients send multiple state messages during client installation, it is important to restrict the number of client upgrades during periods of high software update activities. When Configuration Manager 2007 clients install multiple software updates, each client sends multiple state messages for each individual software update installation. The impact of both software update and client installation activities can quickly cause a state message processing backlog on the site server computer.

Important
The only way to view consolidated client state message information is through Configuration Manager 2007 state message reports generated by the reporting point site system. A large or persistent state message processing backlog can prevent Configuration Manager 2007 from reporting critical information. For more information about which reports use the fallback status point to relay state messages from clients, see About Reports for Configuration Manager Clients.

The following activities generate significant numbers of state messages:

  • Client deployment
  • Initial software update scans after client installation
  • Software update scans during the regular security update release on the second Tuesday of the month
  • Asset Intelligence Client Access License (CAL) data collection
  • Client resynchronization
  • Desired configuration management processes

Solution

To reduce the chances of developing a large backlog, follow these guidelines:

  • If you are using the Configuration Manager 2007 software updates feature, do not deploy clients during major software update deployments.
  • Limit the number of clients deployed at any one time. For example, use the Client Push Installation Wizard instead of enabling the site-wide client push installation method.
  • Do not configure the Asset Intelligence CALCollectionFrequencyDays more frequently than the default (once per week), and set the CALCollectionType to only the minimum data required. For more information, see How to Enable Asset Intelligence.
  • If using the desired configuration management feature, limit the number of baselines per client and the number of configuration items per baseline.

If a significant state message backlog develops, it can be difficult for Configuration Manager 2007 to recover. If you determine that you have a significant backlog and it does not resolve itself over time, take action to reduce the number of state messages generated. For example, disable the Software Updates Client Agent or the Desired Configuration Management Client Agent until the backlog subsides, or disable Asset Intelligence CAL data collection, or temporarily stop client deployment.

State Message Resynchronization Requests Can Become Backlogged

Each state message sent by clients is identified by a serial number as it is sent by the client. The site server keeps track of the next expected state message serial number for each client. State system resynchronization requests are sent by the site server to clients when missing state messages are detected or state messages are processed out of order. State messages can be missing for a variety of reasons, including recovery of a failed site from backup, migration of a client (or an entire site) from one part of the hierarchy to another, unprocessed state messages that were rejected during a migration from mixed mode to native mode, clients being offline longer than the message send time-out period, and other miscellaneous communication failures.

If a site has become heavily backlogged, the site server might not have processed the client state message resynchronization complete state message when the next state message resynchronization check cycle occurs. If the resynchronization completion state message is not processed after three days, a state message resynchronization request will be reissued to the client—even if the client’s resynchronization complete message has already been sent but not processed yet.

Note
The state message serial number tracking is performed at every site in the hierarchy. If a client is assigned to a child site of the site that discovers the missing state message serial number, the resynchronization request is replicated to the child site and acted upon by the child site. If the client is assigned to the current site, the resynchronization request policy is generated immediately.

When a client receives the resynchronization policy, it resends all the items in its cache (which represents the latest message for each topic type and topic ID) in a single file sent to the server. These messages are renumbered according to the current serial number so that they represent new messages and not replacement messages. Along with the messages from the client cache, a resynchronization complete state message (TopicType=700, StateID=2) is sent. At this point, the resynchronization is complete, the client should not have any missing state messages, and the current client state in the database should be complete.

Solution

Either of the following Microsoft SQL Server queries can be used to check for outstanding resynchronization requests issued by the current site or any of its child sites.

Note
Times are in UTC.

  • select count(*) from SR_ClientMessageStats where LastResyncIssuedTime is not null and (LastResyncIssuedTime > LastResyncClientCompletedTime)
  • select count(*) from SR_ClientMessageStats where LastResyncIssuedTime is not null and LastResyncClientCompletedTime is null

See Also

Concepts

About State Messages
About the Fallback Status Point in Configuration Manager
Troubleshooting the Configuration Manager Server Infrastructure


Troubleshooting Configuration Manager 2007 SP1 Setup

Topic Last Updated—August 2008

The following troubleshooting information can be used to help troubleshoot Configuration Manager 2007 SP1 Setup issues.

Configuration Manager 2007 SP1 Setup May Cause Unexpected Restarts

If a PXE service point has been installed for the site to be upgraded, the Windows AIK should be manually uninstalled from the SMS Provider computer for the site before beginning service pack installation. If the site server being upgraded has the Windows Deployment Services (WDS) Server service running and if the wimgapi.dll file is in use, an unexpected restart can occur because Windows AIK 1.1 installation requires a system restart to replace this file. Additionally, after the computer restarts, the SMS Executive Configuration Manager Service might fail repeatedly.

Solution

The following procedure can be used to prevent further unexpected restarts during the SP1 upgrade and troubleshoot SMS Executive service failures.

To prevent further unexpected restarts during the SP1 upgrade and troubleshoot SMS Executive service failures

  1. Manually uninstall the failed Windows AIK 1.1 installation from Add or Remove programs, and restart the computer.

  2. Stop the Windows Deployment Services (WDS) Server service. At a command prompt, enter the following command to stop the service: net stop WDSServer.

  3. Determine whether the SMS Executive service is failing by reviewing the contents of the .\<Configuration Manager Installation Directory>\Logs directory for the presence of a CrashDumps folder. If this folder exists, check for subfolders created after the unexpected restart.

  4. If subfolders were created in the CrashDumps directory after the unexepected system restart, navigate to the .\ <Configuration Manager Installation Folder>\inboxes\hman.box directory and delete any files that have a .ct2 file extension.

  5. Run Configuration Manager 2007 SP1 Setup to upgrade the site and allow Windows AIK 1.1 to be installed.

  6. After the site has been successfully upgraded, restart the Windows Deployment Services (WDS) Server service on the SMS Provider computer. At a command prompt, enter the following command to start the service: net start WDSServer.

Configuration Manager 2007 SP1 Select Setup Might Not Remove Unneeded Services When Upgrading from SMS 2003 SP2 or SP3

When upgrading from SMS 2003 SP2 or SP3 using the Select version of Configuration Manager 2007 SP1, the SMS SQL Monitor service (SMS_SQL_MONITOR) is not completely removed. This service is not required for Configuration Manager 2007 sites, and because the service is not successfully removed during the upgrade process, the service will attempt to start and generate site status warning messages when the site server computer starts up.

Solution

The following procedure can be used to remove the SMS_SQL_Monitor service after upgrading from SMS 2003 SP2 or SP3 to the Select version of Configuration Manager 2007 SP1.

To remove the SMS SQL Monitor (SMS_SQL_Monitor) service from the command line

  1. In a new command prompt instance, enter the following command to delete the SMS_SQL_Monitor service: sc delete SMS_SQL_MONITOR. Then press Enter.

  2. After the SMS_SQL_Monitor service is successfully deleted, enter the following commands to delete service-related registry keys:

    • REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\COMPONENTS\SMS_SITE_COMPONENT_MANAGER\Component Servers\<site server computer name> \Components\SMS_SQL_MONITOR
    • REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Tracing\SMS_SQL_MONITOR

  3. Close the command prompt instance, and restart the site server computer.

See Also

Concepts

Troubleshooting the Configuration Manager Server Infrastructure


Technical Reference for Configuration Manager 2007

Get the resources to help you use and troubleshoot Microsoft System Center Configuration Manager 2007.

In This Section

Property Pages

Wizard Pages

Dialog Pages

Home Pages

Client Help

Appendixes

See Also

Concepts

Configuration Manager Documentation Library


Property Pages

In This Section

Site Settings Property Pages

Conflicting Records

Collections Property Pages

Packages Property Pages

Advertisements Property Pages

Software Updates Property Pages

Operating System Deployment Property Pages

Software Metering Property Pages

Reporting Property Pages

Desired Configuration Management Property Pages

Queries Property Pages

Mobile Device Management Property Pages

Network Access Protection Property Pages

Application Compatibility Toolkit Connector Property Pages

System Status Property Pages

Security Rights Property Pages

Tools Property Pages


Site Settings Property Pages

Microsoft System Center Configuration Manager 2007 site settings are used to configure primary and secondary sites. For secondary sites, some options are not available (for example, any settings for connecting to the site database and configuring the site mode). Most settings in the Site Settings node are onetime configurations.

In This Section

Accounts Properties

Allows you to view all the accounts configured in the Configuration Manager 2007 console and configure the passwords Configuration Manager 2007 should use when accessing the account.

Active Directory System Discovery Properties

Configures options for discovering computer names in Active Directory.

Active Directory Security Group Discovery Properties

Configures options for discovering security groups in Active Directory.

Active Directory System Group Discovery Properties

Configures options for discovering computer system groups in Active Directory.

Active Directory User Discovery Properties

Configures options for discovering user accounts in Active Directory.

Address Properties

Configures options for how Configuration Manager 2007 transfers data between two sites in a site hierarchy, such as how much bandwidth to use, when to use the sender address for Configuration Manager 2007 data, and which accounts to use when connecting to the other site.

Advertised Programs Client Agent Properties

Configures the software distribution components on the Configuration Manager 2007 client computers.

Advertisement Status Summarizer Properties: General Tab

Configures how Configuration Manager 2007 sends advertisement status messages to the parent site (for example, which type and priority of message to replicate).

Boundary Properties

Configures the IP subnets, IP address ranges, and Active Directory sites used by Configuration Manager 2007 to determine which computers can be managed by this Configuration Manager 2007 site.

Certificates Properties

Allows you to view and block the certificates used by operating system deployment PXE service points and boot media, and to manage the certificates used by ISV proxy management points.

Client Agents Properties

Configures which Configuration Manager 2007 components are enabled on client computers and how the components are configured.

Client Push Installation Properties

Configures how Configuration Manager 2007 will push the client components to computers in the site (for example, which types of computers to push to and which accounts to use).

Component Configuration Properties

Configures site-wide settings for Configuration Manager 2007 components (for example, settings that affect all site systems).

Component Status Summarizer Properties

Configures settings for summarizing and replicating status messages from Configuration Manager 2007 components.

Computer Client Agent Properties: General Tab

Configures the settings that apply to general client computer operation, such as how often clients should check for policy.

Desired Configuration Management Client Agent Properties

Configures the desired configuration management components on the Configuration Manager 2007 client computers.

Mobile Device Client Agent Properties

Configures the settings that apply to device client operation, such as how often device clients should check for policy and take inventory.

Discovery Methods Properties

Configures options for discovering resources on your network.

Distribution Point Group Properties: General Tab

Configures site-wide settings for all distribution points.

Free Space Threshold Properties: General Tab

Configures warning and critical thresholds when a storage object (path or database) falls below the specified minimum free space.

Hardware Inventory Client Agent Properties

Configures the hardware inventory components on the Configuration Manager 2007 client computers.

Heartbeat Discovery Properties: General Tab

Configures options for rediscovering computers that are already Configuration Manager 2007 clients.

Management Point Component Properties: General Tab

Configures site-wide settings for all management points.

Network Access Protection Client Agent Properties

Configures the Configuration Manager 2007 Network Access Protection components on the Configuration Manager 2007 client computers.

Network Discovery Properties

Configures options for discovering network resources using Dynamic Host Configuration Protocol (DHCP), Simple Network Management Protocol (SNMP), subnets, and domains.

Site Properties

Configures settings that affect the entire site, such as the site mode and the ports used to communicate with client computers.

Site System Properties

Configures the computers hosting site roles in this site.

Site System Status Summarizer Properties

Configures how Configuration Manager 2007 sends site system status messages to the parent site (for example, which type and priority of message to replicate).

ConfigMgr Component Server Properties

Serves as a placeholder for all site systems hosting the ConfigMgr Executive service. Configuration Manager 2007 performs all configuration for this site role, including removal. There are no configurable settings in this dialog box.

ConfigMgr Device Management Point Properties: General Tab

Serves as a placeholder for all management points configured to support device clients. There are no configurable settings in this dialog box. This site role is managed from the ConfigMgr Management Point Properties: General Tab.

ConfigMgr Distribution Point Properties: General Tab

Configures properties for the Configuration Manager 2007 servers distributing software to client computers.

ConfigMgr Distribution Point Server Share Properties: General Tab

Configures properties for the Configuration Manager 2007 servers distributing software to client computers but using a named shared folder instead of all available hardware space.

ConfigMgr Fallback Status Point Properties: General Tab

Configures properties for the Configuration Manager 2007 servers accepting unauthenticated status messages from clients that cannot communicate with their assigned management points.

ConfigMgr Management Point Properties: General Tab

Configures properties for the Configuration Manager 2007 servers used as the primary point of contact for Configuration Manager 2007 client computers and Configuration Manager 2007 device clients.

ConfigMgr PXE Service Point Properties

Configures properties for the Configuration Manager 2007 servers hosting boot images and responding to PXE requests from Configuration Manager 2007 client computers.

ConfigMgr Reporting Point Properties: General Tab

Configures properties for the Configuration Manager 2007 servers hosting Configuration Manager 2007 reports.

ConfigMgr Server Locator Point Properties: General Tab

Configures properties for the Configuration Manager 2007 servers hosting Configuration Manager 2007 reports.

ConfigMgr Site Server Properties: General Tab

Serves as a placeholder for the computer hosting the Configuration Manager 2007 site server role. There are no configurable settings in this dialog box. The only way to remove this role is to run Setup and uninstall the site.

Site System Properties: General Tab

Configures the properties that are common for all Configuration Manager 2007 server roles.

Site System Server Share Properties: General Tab

Configures the properties that are common for all Configuration Manager 2007 servers using a named shared folder instead of all available hardware space.

ConfigMgr Site Database Server Properties: General Tab

Serves as a placeholder for the computer hosting the Configuration Manager 2007 site database. There are no configurable settings in this dialog box. The only way to remove this role is to move the site database to a different server.

State Migration Point Properties: General Tab

Configures properties for the Configuration Manager 2007 servers storing client computer configuration information when using operating system deployment to migrate a user profile to a new computer.

ConfigMgr System Health Validator Point Properties: General Tab

Configures properties for the Configuration Manager 2007 servers hosting the Windows Network Policy Server role.

Software Distribution Properties

Configures site-wide properties for software distribution.

Software Inventory Client Agent Properties

Configures the software inventory components on the Configuration Manager 2007 client computers.

Software Metering Client Agent Properties

Configures the software metering components on the Configuration Manager 2007 client computers.

Software Update Point Client Installation Properties

Configures whether to enable client installation as a software update.

Software Updates Client Agent Properties

Configures the software updates components on the Configuration Manager 2007 client computers.

Status Summary Properties

Configures how Configuration Manager 2007 summarizes status messages to the parent site.

Status Filter Rules Properties

Configures rules for which Configuration Manager 2007 status messages Configuration Manager 2007 keeps, discards, forwards, or takes any other action on.

Status Threshold Properties: General Tab

Specifies how many messages of the specified type cause Configuration Manager 2007 to generate a warning message and how many total messages cause Configuration Manager 2007 to generate a critical message.

Status Reporting Properties: General Tab

Specifies the types of status messages Configuration Manager 2007 clients and servers report.

System Health Validator Point Component Properties

Configures site-wide properties for Configuration Manager 2007 Network Access Protection.

See Also

Other Resources

How to Configure Configuration Manager 2007


Accounts Properties

The Accounts window displays some of the accounts configured in the Microsoft System Center Configuration Manager 2007 console. The Accounts node displays the following accounts, if they are configured:

  • Client Push Installation Accounts
  • Site Address Accounts
  • Site System Installation Accounts
  • Software Update Point Connection Account
  • Health State Reference Publishing Accounts
  • Health State Reference Querying Accounts
  • Management Point Database Connect Accounts
  • Network Access Account
  • Package Access Accounts
  • PXE Service Point Database Connection Accounts
  • RAS Sender Phone Book Accounts
  • Server Locator Point Database Connection Accounts
  • Software Update Point Proxy Server Account

You can modify the passwords, but not the names, of these accounts. If you need to modify the name or change the account used, you must go to the location where the account is configured. For more information, see How to Configure Configuration Manager 2007 Accounts.

Note
If you change an account to use a different user account, the account is not removed from the list in the Accounts node but it will show up as "Not configured" because the user account might still be in use for some other Configuration Manager 2007 account role.

See Also

Concepts

Windows User Account Dialog Box

Other Resources

Accounts Configured in the Configuration Manager Console


Account Name Properties: General Tab

Use the General tab of the Microsoft System Center Configuration Manager 2007 <account name> Properties dialog box to change the passwords for the following types of accounts:

  • Client Push Installation Accounts
  • Site Address Accounts
  • Site System Installation Accounts

You can change only the password for these accounts, not the name of the accounts. If you want to change the name of the account, or if you want to change the configuration of any other Configuration Manager 2007 accounts, you must go to the place in the Configuration Manager 2007 console where the account is configured.

Important
The Configuration Manager 2007 console does not indicate which account type you are changing. The only information you see is the domain and name of the account. Changing the password on the wrong account could cause Configuration Manager 2007 operations to fail.

The General tab contains the following elements:

Set

Displays the Windows User Account dialog box, which allows you to change the password.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Concepts

Windows User Account Dialog Box


Active Directory System Discovery Properties

The Active Directory System Discovery Properties dialog box displays configuration information about this discovery method within Configuration Manager 2007. All configuration of this method is made through the individual tabs in this dialog box.

To display this information, click the Discovery Methods node within Site Settings, right-click Active Directory System Discovery, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Active Directory System Discovery Properties: General Tab

Specifies whether the Active Directory System Discovery method is enabled and what Active Directory containers are being searched during discovery.

Active Directory System Discovery Properties: Polling Schedule Tab

Specifies the schedule that Configuration Manager uses to poll the specified Active Directory containers for system resources.

Active Directory System Discovery Properties: Active Directory Attribute Tab

Specifies which extended Active Directory attributes are discovered by this method.

See Also

Tasks

How to Configure Active Directory System Discovery

Concepts

About Active Directory System Discovery
About Configuration Manager Discovery


Active Directory System Discovery Properties: General Tab

Use the General tab of the Microsoft System Center Configuration Manager 2007 Active Directory System Discovery Properties dialog box to enable Active Directory System Discovery and specify which Active Directory containers to search during that discovery.

The General tab contains the following elements:

Enable Active Directory System Discovery

Enables the Active Directory System Discovery method for this site.

Active Directory containers

Specifies the containers that are processed by this discovery method, and the scope of that discovery.

The following options are available for managing the Active Directory containers associated with this method:

  • New icon: Opens the New Active Directory Container dialog box to add an Active Directory container to the discovery polling list.
  • Property icon: Opens the New Active Directory Container dialog box to view or modify an Active Directory container in the discovery polling list.
  • Delete icon: Removes the selected container from the discovery polling list.
The following columns are displayed for each Active Directory container in the discovery polling list:

  • Distinguished Name: Specifies the LDAP distinguished name of the Active Directory container.
  • Recursive: Specifies whether or not the discovery method searches child containers of this specific Active Directory container.
  • Group: Specifies whether or not the discovery method includes or excludes objects within groups within its search of this specific Active Directory container.
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory System Discovery

Concepts

About Active Directory System Discovery


Active Directory System Discovery Properties: Polling Schedule Tab

Use the Polling Schedule tab of the Configuration Manager 2007 Active Directory System Discovery Properties dialog box to specify when the selected Active Directory containers are polled to determine whether new systems have been added.

The Polling Schedule tab contains the following elements:

Polling Schedule

Displays the scheduled discovery poll.

By default, polling occurs once every 24 hours. To customize a discovery schedule, click the Schedule button.

Note
Configuration Manager polls the closest Active Directory resource to discover systems in the containers specified on the General tab. Because this process can cause significant network traffic, you should plan accordingly.

Run discovery as soon as possible

Specifies that this Active Directory discovery poll should start as soon as possible.

Note
This option is only available after Active Directory containers have been specified on the General tab. This check box is cleared after the discovery request has been sent to the site server.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory System Discovery

Concepts

About Active Directory System Discovery


Active Directory System Discovery Properties: Active Directory Attribute Tab

Use the Active Directory Attribute tab of the Microsoft System Center Configuration Manager 2007 Active Directory System Discover Properties dialog box to specify the extended Active Directory object attributes for this discovery method.

The Active Directory Attribute tab contains the following elements:

Select extended Active Directory object attributes to discover

Signifies specific extended Active Directory attributes to discover while polling.

The following options are available for managing the extended Active Directory attributes associated with this method:

  • New icon: Opens the Specify Attribute Name dialog box to add an attribute to the discovery polling list.
  • Delete icon: Removes the selected attribute from the discovery polling list.
The following columns are displayed for each Active Directory attribute in the discovery polling list:

  • Attribute Name: Specifies the name of the attribute.
  • System Required: Specifies whether or not discovery of the attribute is required by this discovery method.
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory System Discovery

Concepts

About Active Directory System Discovery


Active Directory Security Group Discovery Properties

The Active Directory Security Group Discovery Properties dialog box displays configuration information about this discovery method within Configuration Manager 2007. All configuration of this method is made through the individual tabs in this dialog box.

To display this information, click the Discovery Methods node within Site Settings, right-click Active Directory Security Group Discovery, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Active Directory Security Group Discovery Properties: General Tab

Specifies whether the Active Directory Security Group Discovery method is enabled and what Active Directory containers are being searched during discovery.

Active Directory Security Group Discovery Properties: Polling Schedule Tab

Specifies the schedule that Configuration Manager uses to poll the specified Active Directory containers for security group resources.

See Also

Tasks

How to Configure Active Directory Security Group Discovery

Concepts

About Active Directory Security Group Discovery
About Configuration Manager Discovery


Active Directory Security Group Discovery Properties: General Tab

Use the General tab of the Configuration Manager 2007 Active Directory Security Group Discovery Properties dialog box to enable the Active Directory Security Group Discovery method and to specify which Active Directory containers to search during that discovery.

The General tab contains the following elements:

Enable Active Directory Security Group Discovery

Enables the Active Directory Security Group Discovery method for this site.

Active Directory containers

Specifies the containers that are processed by this discovery method, and the scope of that discovery.

The following options are available for managing the Active Directory containers associated with this method:

  • New icon: Opens the New Active Directory Container dialog box to add an Active Directory container to the discovery polling list.
  • Property icon: Opens the New Active Directory Container dialog box to view or modify a container in the discovery polling list.
  • Delete icon: Removes the selected container from the discovery polling list.
The following columns are displayed for each Active Directory container in the discovery polling list:

  • Distinguished Name: Specifies the LDAP distinguished name of the Active Directory container.
  • Recursive: Specifies whether or not the discovery method searches child containers of this specific Active Directory container.
  • Group: Specifies whether or not the discovery method includes or excludes objects within groups within its search of this specific Active Directory container.
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory Security Group Discovery

Concepts

About Active Directory Security Group Discovery


Active Directory Security Group Discovery Properties: Polling Schedule Tab

Use the Polling Schedule tab of the Microsoft System Center Configuration Manager 2007 Active Directory Security Group Discovery Properties dialog box to specify when the selected Active Directory containers are polled to determine whether new security groups have been added.

The Polling Schedule tab contains the following elements:

Polling Schedule

Displays the scheduled discovery poll.

By default, polling occurs once every 24 hours. To customize a discovery schedule, click the Schedule button.

Note
Configuration Manager polls the closest Active Directory resource to discover security groups in the containers specified on the General tab. Because this process can cause significant network traffic, you should plan accordingly.

Run discovery as soon as possible

Specifies that this Active Directory discovery poll should start as soon as possible.

Note
This option is only available after Active Directory containers have been specified on the General tab. This check box is cleared after the discovery request has been sent to the site server.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory Security Group Discovery

Concepts

About Active Directory Security Group Discovery


Active Directory System Group Discovery Properties

The Active Directory System Group Discovery Properties dialog box displays configuration information about this discovery method within Configuration Manager 2007. All configuration of this method is made through the individual tabs in this dialog box.

To display this information, click the Discovery Methods node within Site Settings, right-click Active Directory System Group Discovery, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Active Directory System Group Discovery Properties: General Tab

Specifies whether the Active Directory System Group Discovery method is enabled and what Active Directory containers are being searched during discovery.

Active Directory System Group Discovery Properties: Polling Schedule Tab

Specifies the schedule that Configuration Manager uses to poll the specified Active Directory containers for system group resources.

See Also

Tasks

How to Configure Active Directory System Group Discovery

Concepts

About Active Directory System Group Discovery
About Configuration Manager Discovery


Active Directory System Group Discovery Properties: General Tab

Use the General tab of the Microsoft System Center Configuration Manager 2007 Active Directory System Group Discovery Properties dialog box to enable Active Directory System Group Discovery and specify which Active Directory containers to search.

The General tab contains the following elements:

Enable Active Directory System Group Discovery

Enables the Active Directory System Group Discovery method for this site.

Active Directory containers

Specifies the containers that are processed by this discovery method, and the scope of that discovery.

The following options are available for managing the Active Directory containers associated with this method:

  • New icon: Opens the New Active Directory Container dialog box to add an Active Directory container to the discovery polling list.
  • Property icon: Opens the New Active Directory Container dialog box to view or modify an Active Directory container in the discovery polling list.
  • Delete icon: Removes the selected container from the discovery polling list.
The following columns are displayed for each Active Directory container in the discovery polling list:

  • Distinguished Name: Specifies the LDAP distinguished name of the Active Directory container.
  • Recursive: Specifies whether or not the discovery method searches child containers of this specific Active Directory container.
  • Group: Specifies whether or not the discovery method includes or excludes objects within groups within its search of this specific Active Directory container.
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory System Group Discovery

Concepts

About Active Directory System Group Discovery


Active Directory System Group Discovery Properties: Polling Schedule Tab

Use the Polling Schedule tab of the Configuration Manager 2007 Active Directory System Group Discovery Properties dialog box to specify when the selected Active Directory containers are polled to determine whether new system groups have been added.

The Polling Schedule tab contains the following elements:

Polling Schedule

Displays the scheduled discovery poll.

By default, polling occurs once every 24 hours. To customize a discovery schedule, click the Schedule button.

Note
Configuration Manager polls the closest Active Directory resource to discover system groups in the containers specified on the General tab. Because this process can cause significant network traffic, you should plan accordingly.

Run discovery as soon as possible

Specifies that this Active Directory discovery poll should start as soon as possible.

Note
This option is only available after Active Directory containers have been specified on the General tab. This check box is cleared after the discovery request has been sent to the site server.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory System Group Discovery

Concepts

About Active Directory System Group Discovery


Active Directory User Discovery Properties

The Active Directory User Discovery Properties dialog box displays configuration information about this discovery method within Configuration Manager 2007. All configuration of this method is made through the individual tabs in this dialog box.

To display this information, click the Discovery Methods node within Site Settings, right-click Active Directory User Discovery, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Active Directory User Discovery Properties: General Tab

Specifies whether the Active Directory User Discovery method is enabled and what Active Directory containers are being searched during discovery.

Active Directory User Discovery Properties: Polling Schedule Tab

Specifies the schedule that Configuration Manager uses to poll the specified Active Directory containers for users.

Active Directory User Discovery Properties: Active Directory Attribute Tab

Specifies which extended Active Directory attributes are discovered by this method.

See Also

Tasks

How to Configure Active Directory User Discovery

Concepts

About Active Directory User Discovery
About Configuration Manager Discovery


Active Directory User Discovery Properties: General Tab

Use the General tab of the Configuration Manager 2007 Active Directory User Discovery Properties dialog box to enable the Active Directory User Discovery method and specify which Active Directory containers to search during that discovery.

The General tab contains the following elements:

Enable Active Directory User Discovery

Enables the Active Directory User Discovery method for this site.

Active Directory containers

Specifies the containers that are processed by this discovery method, and the scope of that discovery.

The following options are available for managing the Active Directory containers associated with this method:

  • New icon: Opens the New Active Directory Container dialog box to add a container to the discovery polling list.
  • Property icon: Opens the New Active Directory Container dialog box to view or modify a container from the discovery polling list.
  • Delete icon: Removes the selected container from the discovery polling list.
The following columns are displayed for each Active Directory container in the discovery polling list:

  • Distinguished Name: Specifies the LDAP distinguished name of the Active Directory container.
  • Recursive: Specifies whether or not the discovery method searches child containers of this specific Active Directory container.
  • Group: Specifies whether or not the discovery method includes or excludes objects within groups within its search of this specific Active Directory container.
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory User Discovery

Concepts

About Active Directory User Discovery


Active Directory User Discovery Properties: Polling Schedule Tab

Use the Polling Schedule tab of the Microsoft System Center Configuration Manager 2007 Active Directory User Discovery Properties dialog box to specify when the selected Active Directory containers are polled to determine whether new users have been added.

The Polling Schedule tab contains the following elements:

Polling Schedule

Displays the scheduled discovery poll.

By default, polling occurs once every 24 hours. To customize a discovery schedule, click the Schedule button.

Note
Configuration Manager polls the closest Active Directory resource to discover users in the containers specified on the General tab. Because this process can cause significant network traffic, you should plan accordingly.

Run discovery as soon as possible

Specifies that this Active Directory discovery poll should start as soon as possible.

Note
This option is only available after Active Directory containers have been specified on the General tab. This check box is cleared after the discovery request has been sent to the site server.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory User Discovery

Concepts

About Active Directory User Discovery


Active Directory User Discovery Properties: Active Directory Attribute Tab

Use the Active Directory Attribute tab of the Microsoft System Center Configuration Manager 2007 Active Directory User Discover Properties dialog box to specify the extended Active Directory object attributes for this discovery method.

The Active Directory Attribute tab contains the following elements:

Select extended Active Directory object attributes to discover

Signifies specific extended Active Directory attributes to discover while polling.

The following options are available for managing the extended Active Directory attributes associated with this method:

  • New icon: Opens the Specify Attribute Name dialog box to add an attribute to the discovery polling list.
  • Delete icon: Removes the selected attribute from the discovery polling list.
The following columns are displayed for each Active Directory attribute in the discovery polling list:

  • Attribute Name: Specifies the name of the attribute.
  • System Required: Specifies whether or not discovery of the attribute is required by this discovery method.
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Active Directory User Discovery

Concepts

About Active Directory User Discovery


Address Properties

This section contains the properties of the different types of addresses that can be configured to use Configuration Manager 2007 senders between sites.

In This Section

Standard Sender Address Properties: General Tab

Asynchronous RAS Sender Address Properties: General Tab

Courier Sender Address Properties: General Tab

ISDN RAS Sender Address Properties: General Tab

SNA RAS Sender Address Properties: General Tab

X25 RAS Sender Address Properties: General Tab

Sender Address Properties: Schedule Tab

Sender Address Properties: Rate Limits Tab

See Also

Other Resources

Site Settings Property Pages


Standard Sender Address Properties: General Tab

The standard sender general properties are used to specify the destination site of the sender address, the sender address's priority relative to other sender addresses to the same site, and information needed to access the destination site.

Destination site code

The site code for the site associated with this sender address. If this sender address already exists, this field is unavailable. If you are creating a new sender address, select a site from the list (which contains all known sites) or type a site code. Do not type a site name; it will be ignored.

Relative address priority

A priority to this sender address that is compared to any other sender addresses (such as for Courier Sender or Standard Sender) to the same site. A value of 1 is the highest priority.

The highest priority sender address is tried first when the current site communicates with this destination site. If this communication fails, the next-highest priority sender address is used.

When you create a new sender address, the default priority is the lowest available. For example, if there are two other sender addresses to the destination site on the current site, the default for this field is 3. Priority values cannot be shared; only one sender address can exist for each priority number.

Destination Access

The controls located within the Destination access group are used by the new address to define the destination site server and the account used to connect to it.

  • Site server name: Enter the site server name that this address will be used to connect to (can be either FQDN or shortname).
  • Site address account: By default, the originating site server computer account is used to connect to the destination site. If you prefer to use a domain user account for the address to use as the Site Address account to connect to the destination site server, you can click Set. However, after you enter a user account, you cannot change back to using the site server computer account without deleting the sender address and recreating it.
  • Set. Click to open the Windows User Account dialog box, which enables you to specify the destination access account.

See Also

Concepts

Configuration Manager Site to Site Communications
About the Site Address Account

Other Resources

Address Properties


Asynchronous RAS Sender Address Properties: General Tab

The asynchronous RAS sender address general properties are used to specify the destination site of the sender address, the sender address's priority relative to other sender addresses to the same site, and the information needed to access the destination site.

Destination site code

The site code for the site associated with this sender address. If this sender address already exists, this field is unavailable. If you are creating a new sender address, select a site from the list (which contains all known sites) or type a site code. Do not type a site name; it will be ignored.

Relative address priority

A priority to this sender address that is compared to any other sender addresses (such as for Courier Sender or Standard Sender) to the same site. A value of 1 is the highest priority.

The highest priority sender address is tried first when the current site communicates with this destination site. If this communication fails, the next-highest priority sender address is used.

When you create a new sender address, the default priority is the lowest available. For example, if there are two other sender addresses to the destination site on the current site, the default for this field is 3. Priority values cannot be shared; only one sender address can exist for each priority number.

RAS access

The controls located within the RAS access group are used to define RAS-specific access information.

  • Phone book entry: The RAS phone book entry for the address.
    Note
    If you have a virtual private network (VPN) server, you can substitute a VPN phone book entry for the RAS phone book entry.

  • Phone book account: The RAS user name for the address (required). This RAS-specific account connects to the destination site system that has RAS installed. To set or change the account, click Set.
Set. Click to open the Windows User Account dialog box, which enables you to specify the RAS user account.

Destination access

The controls located within the Destination access group are used to specify destination access information.

  • Server name: The destination site server's name. The maximum server name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Domain: The domain containing the destination site server. The maximum domain name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Account: The Windows User account used to log on to the domain of the destination site system that has RAS installed. To set or change the account, click Set.
  • Set. Click to open the Windows User Account dialog box, which enables you to specify the destination access account.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Address Properties


Courier Sender Address Properties: General Tab

The courier sender address general properties are used to specify the destination site of the sender address, and the sender address's priority relative to other sender addresses to the same site.

Destination site code

The site code for the site associated with this sender address. If this sender address already exists, this field is unavailable. If you are creating a new sender address, select a site from the list (which contains all known sites).

Relative address priority

Courier Sender is disabled by default. To distribute packages using Courier Sender, you must select it as the preferred sender on the Distribution Settings tab of the Package Properties dialog box.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Address Properties


ISDN RAS Sender Address Properties: General Tab

The ISDN RAS sender address general properties are used to specify the destination site of the sender address, the sender address's priority relative to other sender addresses to the same site, and information needed to access the destination site.

Destination site code

The site code for the site associated with this sender address. If this sender address already exists, this field is unavailable. If you are creating a new sender address, select a site from the list (which contains all known sites) or type a site code. Do not type a site name; it will be ignored.

Relative address priority

A priority to this sender address that is compared to any other sender addresses (such as for Courier Sender or Standard Sender) to the same site. A value of 1 is the highest priority.

The highest priority sender address is tried first when the current site communicates with this destination site. If this communication fails, the next-highest priority sender address is used.

When you create a new sender address, the default priority is the lowest available. For example, if there are two other sender addresses to the destination site on the current site, the default for this field is 3. Priority values cannot be shared; only one sender address can exist for each priority number.

RAS access

The controls located within the RAS access group are used to define RAS specific access information.

  • Phone book entry: The RAS phone book entry for the address.
    Note
    If you have a virtual private network (VPN) server, you can substitute a VPN phone book entry for the RAS phone book entry

  • Phone book account: The RAS user name for the address (required). This RAS-specific account connects to the destination site system that has RAS installed. To set or change the account, click Set.
Set. Click to open the Windows User Account dialog box, which enables you to specify the RAS user account.

Destination access

The controls located within the Destination access group are used to specify destination access information.

  • Server name: The destination site server's name. The maximum server name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Domain: The domain containing the destination site server. The maximum domain name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Account: The Windows User account used to log on to the domain of the destination site system that has RAS installed. To set or change the account, click Set.
  • Set. Click to open the Windows User Account dialog box, which enables you to specify the destination access account.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Address Properties


SNA RAS Sender Address Properties: General Tab

The SNA RAS sender address general properties are used to specify the destination site of the sender address, the sender address's priority relative to other sender addresses to the same site, and information needed to access the destination site.

Destination site code

The site code for the site associated with this sender address. If this sender address already exists, this field is unavailable. If you are creating a new sender address, select a site from the list (which contains all known sites) or type a site code. Do not type a site name; it will be ignored.

Relative address priority

A priority to this sender address that is compared to any other sender addresses (such as for Courier Sender or Standard Sender) to the same site. A value of 1 is the highest priority.

The highest priority sender address is tried first when the current site communicates with this destination site. If this communication fails, the next-highest priority sender address is used.

When you create a new sender address, the default priority is the lowest available. For example, if there are two other sender addresses to the destination site on the current site, the default for this field is 3. Priority values cannot be shared; only one sender address can exist for each priority number.

RAS access

The controls located within the RAS access group are used to define RAS specific access information.

  • Phone book entry: The RAS phone book entry for the address.
    Note
    If you have a virtual private network (VPN) server, you can substitute a VPN phone book entry for the RAS phone book entry

  • Phone book account: The RAS user name for the address (required). This RAS-specific account connects to the destination site system that has RAS installed. To set or change the account, click Set.
Set. Click to open the Windows User Account dialog box, which enables you to specify the RAS user account.

Destination access

The controls located within the Destination access group are used to specify destination access information.

  • Server name: The destination site server's name. The maximum server name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Domain: The domain containing the destination site server. The maximum domain name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Account: The Windows User account used to log on to the domain of the destination site system that has RAS installed. To set or change the account, click Set.
  • Set. Click to open the Windows User Account dialog box, which enables you to specify the destination access account.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Address Properties


X25 RAS Sender Address Properties: General Tab

The X25 RAS sender address general properties are used to specify the destination site of the sender address, the sender address's priority relative to other sender addresses to the same site, and the information that is needed to access the destination site.

Destination site code

The site code for the site associated with this sender address. If this sender address already exists, this field is unavailable. If you are creating a new sender address, select a site from the list (which contains all known sites) or type a site code. Do not type a site name; it will be ignored.

Relative address priority

A priority to this sender address that is compared to any other sender addresses (such as for Courier Sender or Standard Sender) to the same site. A value of 1 is the highest priority.

The highest-priority sender address is tried first when the current site communicates with this destination site. If this communication fails, the next-highest-priority sender address is used.

When you create a new sender address, the default priority is the lowest available. For example, if there are two other sender addresses to the destination site on the current site, the default for this field is 3. Priority values cannot be shared; only one sender address can exist for each priority number.

RAS access

The controls located within the RAS access group are used to define RAS specific access information.

  • Phone book entry: The RAS phone book entry for the address.
    Note
    If you have a virtual private network (VPN) server, you can substitute a VPN phone book entry for the RAS phone book entry.

  • Phone book account: The RAS user name for the address (required). This RAS-specific account connects to the destination site system that has RAS installed. To set or change the account, click Set.
Set: Click to open the Windows User Account dialog box, which enables you to specify the RAS user account.

Destination access

The controls located within the Destination access group are used to specify destination access information.

  • Server name: The destination site server's name. The maximum server name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Domain: The domain containing the destination site server. The maximum domain name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Account: The Windows User account used to log on to the domain of the destination site system that has RAS installed. To set or change the account, click Set.
  • Set: Click to open the Windows User Account dialog box, which enables you to specify the destination access account.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Address Properties


Sender Address Properties: Schedule Tab

The address rate limits properties are used to configure the communications network load between sites by day, time, and priority of data to be transferred. You can specify more than one time period to schedule for varying priorities of data to be sent using this page of the wizard.

Important
By default, new sender addresses are open for all priorities of traffic between sites seven days a week, 24 hours a day.

Day time picker control

Use this control to select an inclusive day and time period to control network load for the sender address.

Scheduled availability for selected time period

Displays the day and time period selected for scheduling sender address communications. For example, Monday through Friday, 8 A.M. to 5 P.M.

Availability

Use this control to select a scheduling availability for sender address communications based on the priority of data being sent. The following options are available:

  • Open for all priorities
  • Allow medium and high priority
  • Allow high priority only
  • Closed
Unavailable to substitute for inoperative addresses

Use this control to enable the site to use this address as a substitute if another address to the destination site fails. To prevent this address from being used as a substitute during the selected time period, select Unavailable to substitute for inoperative addresses.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Address Properties


Sender Address Properties: Rate Limits Tab

The address rate limits properties are used to set maximum data transfer rates, by hour, from the current site to the destination site.

Unlimited when sending to this address

Selecting this option will allow an unlimited data transfer rate when the current site sends data to this address.

Pulse Mode

When pulse mode is selected, you can limit the amount of data sent between sites, allowing you to specify the size of the data blocks sent in kilobytes that the data is subdivided into, and also to specify a time delay between the sending of each data block in seconds.

  • Size of data block (KB): Specify the size of the data block that Configuration Manager 2007 sends to the address.
  • Delay between data blocks (seconds): The amount of time after Configuration Manager 2007 sends data to the address before it sends the next data block.
Limited to specified maximum transfer rates by hour

The hours of the day and the percentage of maximum transfer rate allowed for each hour. If no number appears beneath an hour, 100 percent of the maximum transfer rate is allowed for that hour. Click and drag to select multiple hours.

When this option is selected, you can also specify the maximum transfer rate for the selected time period:

  • Time period: The time period selected in the day chart above.
  • Limit (% of connection bandwidth): The percentage of the maximum transfer rate allowed for the selected time period. You can choose a percentage or Unlimited.

See Also

Concepts

Configuration Manager Site to Site Communications

Other Resources

Address Properties


Advertised Programs Client Agent Properties

The Configuration Manager 2007 Advertised Programs Client Agent Properties dialog box displays information about the configuration of the agent and allows agent configuration settings to be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Advertised Programs Client Agent Properties: General Tab

Enables software distribution to clients, and specifies how frequently the client computer should check for new policies.

Advertised Programs Client Agent Properties: Notification Tab

Specifies the way the agent notifies clients that advertised programs are available.

See Also

Tasks

How to Configure the Advertised Programs Client Agent

Concepts

About Advertisements
About the Advertised Programs Client Agent


Advertised Programs Client Agent Properties: General Tab

Use the General tab of the Configuration Manager 2007 Advertised Programs Client Agent Properties dialog box to enable software distribution to clients and specify how frequently the client computer should check for new policy.

The General tab contains the following elements:

Enable software distribution to clients

Specifies whether the Advertised Programs Client Agent is enabled and software distribution is available on clients.

If this option is not selected, clients cannot use Configuration Manager 2007 to install or run software.

Allow user targeted advertisement requests

Specifies whether user-targeted advertisement requests are permitted.

This saves network bandwidth by reducing the total amount of policy data transmitted between the client and the management point. If this check box is cleared, clients will not check for new user targeted advertisements although existing user targeted advertisements will run.

Note
To prevent clients from running all user targeted advertisements, delete the advertisements before clearing this check box.

New program notification icon opens Add or Remove Programs

Select to display advertised programs in Add or Remove Programs in Control Panel when New program notification icon is clicked on the client computer.

Allow virtual application package advertisement

In Configuration Manager 2007 R2, select to enable Configuration Manager 2007 clients to run virtual application package advertisements.

Note
When you enable the advertised programs client agent to run virtual application packages all Configuration Manager 2007 client computers in the site will be configured to run virtual applications. It is not possible to enable a single computer or collection to run virtual application packages.

See Also

Tasks

How to Configure the Advertised Programs Client Agent

Concepts

About the Advertised Programs Client Agent

Other Resources

Advertised Programs Client Agent Properties


Advertised Programs Client Agent Properties: Notification Tab

Topic last updated -- November 2007

Use the Notification tab of the Microsoft System Center Configuration Manager 2007 Advertised Programs Client Agent Properties dialog box to configure the way the agent notifies clients that advertised programs are available.

The Notification tab contains the following elements:

When new advertised programs are available

Specifies how to notify clients when new advertised programs are available.

The following notification options are available:

  • Display a notification message: Specifies that a visual cue will be displayed on the client desktop when new advertised programs are available.
  • Play a sound: Specifies that an audible cue will be played on the client computer when new advertised programs are available.
When a scheduled program is about to run

Specifies how to notify users when a scheduled program is about to run.

Provide a countdown specifies whether to display a countdown on the client desktop to the start of the scheduled program.

If a countdown is selected, the following options can be set:

  • Countdown length (minutes): Specifies the length of the countdown. The default value is five minutes. Valid entries range from one minute through 1,440 minutes (one day).

See Also

Tasks

How to Configure the Advertised Programs Client Agent

Concepts

About the Advertised Programs Client Agent

Other Resources

Advertised Programs Client Agent Properties


Advertisement Status Summarizer Properties: General Tab

Use the General tab of the Configuration Manager 2007 Advertisement Status Summarizer Properties dialog box to enable and configure advertisement status summarization in the Configuration Manager 2007 site. Status summarizers count data and events from status messages and display this data in the System Status node of the Configuration Manager console.

This tab contains the following elements:

Enable status summarization

Enables summarization of advertisement status messages on this Configuration Manager 2007 site.

Replicate to parent site

Enables the passing of summarization data from this site to the parent site.

Replication priority

Specifies the sending priority to use when replicating summarization data from the drop-down menu. You can choose from the following:

  • Low
  • Medium
  • High
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

How to View the Status of an Advertisement
Using Status Messages for Configuration Manager Troubleshooting
About Data Priorities


Boundary Properties

Configuration Manager 2007 clients are assigned to Configuration Manager 2007 sites based on the boundaries defined for the site. Boundaries are defined by IP subnets, Active Directory site names, IPv6 prefixes, IP ranges or a combination of these.

The boundaries node of the Configuration Manager console displays all boundaries defined for every site in the Configuration Manager 2007 hierarchy beneath the current site. Boundaries defined for SMS 2003 child sites before joining a Configuration Manager 2007 site hierarchy are not editable. To change the boundaries of an SMS 2003 child site, the pre-defined SMS 2003 boundary must be deleted and a new one created from within the Configuration Manager console.

In This Section

Boundary Properties: General Tab

The boundary properties general tab is used to configure site boundary settings.

Boundary Properties: Protected Tab

The boundary properties protected tab is used to display all Configuration Manager protected site systems within the site boundary.

See Also

Concepts

Planning Configuration Manager Boundaries

Other Resources

Site Settings Property Pages


Boundary Properties: General Tab

The boundary properties general tab is used to configure boundary settings depending on the type of boundary.

Important
If the boundary is a predefined SMS 2003 child boundary it is not editable. In order to change SMS 2003 child boundaries, you must first delete the pre-existing boundary and then create a new boundary for the site from within the Configuration Manager console

Description

Displays the boundary description and allows you to modify it.

Site Code

Displays the site code that the selected boundary applies to.

Type

Displays the current boundary type and allows you to change it to one of the following options: IP Subnet, Active Directory Site, IP v6 Prefix, or IP Address Range.

  • IP Subnet.
    • Network:
    • Subnet mask:
    • Subnet ID:

  • Active Directory Site. Maximum 63 characters.
    • Site name:
    • Browse button.

  • IP v6 Prefix
    • Prefix:
      Note
      When configuring IPv6 prefixes as boundaries for Configuration Manager sites, prefixes entered using IPv6 zero compression are converted to the full IPv6 subnet format. For example, an IPv6 prefix entered as "aa::bb" would need to be translated into "00AA:0000:0000:00BB".

  • IP Address Range
    • Starting address:
    • Ending address:
Network Connection

You must specify whether clients located within this boundary will communicate with the site using a network that is one of the following options:

  • Slow or unreliable.
  • Fast (LAN).
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Boundary Properties


Boundary Properties: Protected Tab

The Boundary Properties Protected tab displays any protected Configuration Manager site systems located within the selected boundary.

Site System Name

Displays the protected Configuration Manager site systems located within the selected boundary.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Boundary Properties


Certificates Properties

The Certificates node displays the Boot Media, PXE, and ISV Proxy certificates that are used in the Configuration Manager 2007 site.

This node contains the following sub-nodes:

Boot Media

Selecting the Boot Media node displays a list of public key infrastructure (PKI) certificates that have been imported and self-signed certificates that have been created. The certificates that have been added to boot media are displayed in a list in the Boot Media results pane. The following columns are displayed by default:

  • Issued to: Displays the subject name associated with the selected certificate.
  • Start Date: Displays the date and time the certificate is valid and will function with the Configuration Manager 2007 site.
  • Expiration Date: Displays the date and time the certificate will expire and will not have access to the Configuration Manager 2007 site resources.
  • Status: Displays if the certificate is blocked from accessing Configuration Manager 2007 site resources.

Boot Media UI Element List

Look For

Enter all or part of a certificate name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific Boot Media certificate is selected in the Boot Media pane, you can select the following default actions grouped under Boot Media in the Actions pane. You can collapse the default actions by clicking the up arrow in the Boot Media section header.

View

Select this action to add or remove columns in the certificates pane, to export the list of certificates to a tab-delimited or comma-delimited text or unicode text file, and to hide the search bar in the certificates results pane.

New Window from Here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Open

Displays the properties of the selected certificate. The General tab displays the computer that the certificate has been issued to and what certification authority issued the certificate. The certificate validity date range is also displayed. Click Install Certificate to open the Certificate Import wizard. Use this wizard to copy certificates, certificate trust lists and certificate revocation lists from your hard disk to a certificate store.

The Details tab displays the current list of X.509 fields or extensions associated with the selected certificate. Select the field or extension you want to review and the associated information is displayed. Use the drop down to filter the list by category.

The Certification Path tab displays the certification path for the selected certificate. The status of the selected certificate is also displayed in the Certificate status window.

Block

Select this option to block the selected certificate from access to the Configuration Manager 2007 site. You can unblock a blocked certificate by selecting the blocked certificate and clicking Unblock in the Actions pane. For more information about blocking clients see: Determine If You Need to Block Configuration Manager Clients

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Help

Select this action to display Configuration Manager 2007 product help for this node.

PXE

Selecting the PXE node displays a list of public key infrastructure (PKI) certificates that have been imported and self-signed certificates that have been created for use on Configuration Manager 2007 PXE service points. The certificates that have been imported or created are displayed in a list in the Certificates results pane. The following columns are displayed by default:

  • Issued To: Displays the subject name associated with the selected certificate.
  • PXE Server Name: Displays the name of the PXE service point server that the certificate is assigned to.
  • Expiration Date: Displays the date and time the certificate will expire and will not have access to the Configuration Manager 2007 site resources.
  • Status: Displays if the certificate is blocked from accessing Configuration Manager 2007 site resources.

PXE Node UI Element List

Look For

Enter all or part of a certificate name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific PXE certificate is selected in the PXE pane, you can select the following default actions grouped under PXE in the Actions pane. You can collapse the default actions by clicking the up arrow in the PXE section header.

View

Select this action to add or remove columns in the certificates pane, to export the list of certificates to a tab-delimited or comma-delimited text or unicode text file, and to hide the search bar in the certificates results pane.

New Window from Here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Open

Displays the properties of the selected certificate. The General tab displays the computer that the certificate has been issued to and what certification authority issued the certificate. The certificate validity date range is also displayed. Click Install Certificate to open the Certificate Import wizard. Use this wizard to copy certificates, certificate trust lists and certificate revocation lists from your hard disk to a certificate store.

The Details tab displays the current list of X.509 fields or extensions associated with the selected certificate. Select the field or extension you want to review and the associated information is displayed. Use the drop down to filter the list by category.

The Certification Path tab displays the certification path for the selected certificate. The status of the selected certificate is also displayed in the Certificate status window.

Block

Select this option to block the selected certificate from access to the Configuration Manager 2007 site. You can unblock a blocked certificate by selecting the blocked certificate and clicking Unblock in the Actions pane. For more information about blocking clients see: Determine If You Need to Block Configuration Manager Clients

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Help

Select this action to display Configuration Manager 2007 product help for this node.

ISV Proxy

Selecting the ISV Proxy node displays a list of public key infrastructure (PKI) certificates that have been imported and self-signed certificates that have been created for use with an ISV Proxy. The ISV Proxy certificate and the related Configuration Manager 2007 infrastructure allow an ISV to develop solutions for client platforms that are not directly supported by Configuration Manager 2007. Detailed information regarding the ISV Proxy certificate and its use in client communications can be found in the System Center Configuration Manager 2007 Software Development Kit (SDK). The following columns are displayed by default:

  • Issued To: Displays the subject name associated with the selected certificate.
  • Start Date: Displays the date and time the certificate is valid and will be allowed access to the Configuration Manager 2007 site.
  • Expiration Date: Displays the date and time the certificate will expire and will not have access to the Configuration Manager 2007 site resources.
  • Status: Displays if the certificate is blocked from accessing Configuration Manager 2007 site resources.
  • Cert GUID: Displays the GUID that is associated with the selected certificate.

ISV Proxy Node UI Element List

Look For

Enter all or part of a certificate name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific ISV Proxy certificate is selected in the ISV Proxy pane, you can select the following default actions grouped under ISV Proxy in the Actions pane. You can collapse the default actions by clicking the up arrow in the ISV Proxy section header.

Register or Renew ISV Proxy

Opens the ISV Proxy Certificate Registration Or Renewal dialog box. You can register a new certificate ISV Proxy or renew an existing certificate for an ISV Proxy.

View

Select this action to add or remove columns in the certificates pane, to export the list of certificates to a tab-delimited or comma-delimited text or unicode text file, and to hide the search bar in the certificates results pane.

New Window from Here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Open

Displays the properties of the selected certificate. The General tab displays the computer that the certificate has been issued to and what certification authority issued the certificate. The certificate validity date range is also displayed. Click Install Certificate to open the Certificate Import wizard. Use this wizard to copy certificates, certificate trust lists and certificate revocation lists from your hard disk to a certificate store.

The Details tab displays the current list of X.509 fields or extensions associated with the selected certificate. Select the field or extension you want to review and the associated information is displayed. Use the drop down to filter the list by category.

The Certification Path tab displays the certification path for the selected certificate. The status of the selected certificate is also displayed in the Certificate status window.

Block

Select this option to block the selected ISV Proxy certificate from access to the Configuration Manager 2007 site. You can unblock a blocked certificate by selecting the blocked certificate and clicking Unblock in the Actions pane. For more information about blocking clients see: Determine If You Need to Block Configuration Manager Clients

Renew Certificate

Opens the ISV Proxy Certificate Registration Or Renewal dialog box. You can use this dialog box to renew the associated ISV Proxy certificate.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Help

Select this action to display Configuration Manager 2007 product help for this node.

See Also

Tasks

How to Configure the PXE Service Point
How to Create Task Sequence Bootable Media

Reference

Task Sequence Media Wizard - Bootable Media Security Page

Concepts

About Native Mode Certificates and Operating System Deployment
Operating System Deployment Security Best Practices and Privacy Information


Client Agents Properties

As Microsoft System Center Configuration Manager 2007 discovers resources and assigns them to sites for management, you can configure client agents to run on these resources. Client agents determine whether clients can be controlled remotely, receive advertised programs, monitor software use, and report hardware and software inventory. Located in the Configuration Manager 2007 console tree, Client Agents enables you to configure which Configuration Manager 2007 client agents are installed on clients and how these agents are configured and maintained.

See Also

Reference

Computer Client Agent Properties: General Tab
Desired Configuration Management Client Agent Properties
Mobile Device Client Agent Properties
Network Access Protection Client Agent Properties

Other Resources

Advertised Programs Client Agent Properties
Hardware Inventory Client Agent Properties
Remote Tools Client Agent Properties
Software Inventory Client Agent Properties
Software Metering Client Agent Properties
Software Updates Client Agent Properties


Client Installation Methods Properties

Select the Client Installation Methods node to configure the Software Update Point and Client Push Installation properties. You can configure these methods by right-clicking the method and selecting Properties from the context menu. Alternatively you can select Properties from the Actions pane.

After you have made your configuration updates to the installation configurations, you can right-click the configuration and select Refresh from the context menu or by clicking Refresh in the Actions pane.

See Also

Tasks

How to Install Configuration Manager Clients Using Software Update Point Based Installation
How to Install Configuration Manager Clients Using Client Push

Concepts

Choose a Configuration Manager Client Installation Method
Client Installation Planning Worksheet


Client Push Installation Properties

The Configuration Manager 2007 Client Push Installation Properties dialog box allows you to enable client push installation on your Configuration Manager 2007 site. You can also specify a list of Windows user accounts that can be used to install the client and specify installation properties to use during installation.

Click any link in the following section for detailed information about its associated tab in the Client Push Installation Properties dialog box:

In This Section

Client Push Installation Properties: General Tab

Specifies whether to enable client push installation and the types of system on which to install the Configuration Manager 2007 client.

Client Push Installation Properties: Accounts Tab

Specifies a list of accounts that can be used to install the Configuration Manager 2007 client.

Client Push Installation Properties: Client Tab

Specifies installation properties to use when installing the Configuration Manager 2007 client.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties


Client Push Installation Properties: General Tab

Topic Last Updated—August 2008

Use the General tab of the Configuration Manager 2007 Client Push Installation Properties dialog box to enable site-wide client push installation and to specify the types of computers on which the Configuration Manager 2007 client software can be installed.

This tab contains the following elements:

Enable Client Push Installation to assigned resources

Enables site-wide client push installation on this Configuration Manager 2007 site. This automatically initiates client installation on computers discovered within configured boundaries and operates independently from the Client Push Installation Wizard. For example, if you enable this option, the client software will attempt to install on all the discovered domain computers that meet the selection criteria below (system types and site systems) without having to use the Client Push Installation Wizard. You can also install the client software by using the Client Push Installation Wizard without first enabling this option.

For more information about how to install clients by using the two different client push methods, see How to Install Configuration Manager Clients Using Client Push.

Note
For client push installation to work, a discovery method must have been run on the Configuration Manager 2007 site.

System types

Specify the types of computers on which to install the Configuration Manager client. The following roles are available:

  • Servers
  • Workstations
  • Domain controllers
Note
This option is unavailable if Enable Client Push Installation to assigned resources is not checked.

Enable Client Push Installation to site systems

Specifies that the client can be installed to computers hosting Configuration Manager 2007 site systems.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Configuration Manager Client Installation and Upgrade Issues
How to Configure the Configuration Manager Client Push Installation Account
How to Install Configuration Manager Clients Using Client Push

Concepts

About Configuration Manager Discovery
Determine the Configuration Manager Client Installation Method to Use
Overview of Configuration Manager Client Deployment

Other Resources

Configuration Manager Supported Configurations


Client Push Installation Properties: Accounts Tab

Use the Accounts tab of the Configuration Manager 2007 Client Push Installation Properties dialog box to specify a list of Windows user accounts which can be used to install the Configuration Manager 2007 client on computers in your site.

To successfully install the Configuration Manager 2007 client, the Windows user account used must have administrative rights on the destination computer. If the install fails with all accounts in the list then the installation will be attempted using the computer account from the Configuration Manager 2007 site server.

This tab contains the following elements:

Client Push Installation accounts:

Displays a list of the currently specified client push connection accounts. Client installation will attempt to use each of these accounts in order, until it finds an account with sufficient rights.

New

Click to open the Windows User Account dialog box, which allows you to specify a new client push installation account.

Delete

Click to delete the selected Windows user account from the list.

Move up

Moves the selected client push installation account up one place in the accounts list.

Move down

Moves the selected client push installation account up one place in the accounts list.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push

Concepts

Overview of Configuration Manager Client Deployment


Client Push Installation Properties: Client Tab

Use the Client tab of the Configuration Manager 2007 Client Push Installation Properties dialog box to specify additional properties to configure during client push installation.

Note
When client push installation is enabled on a Configuration Manager 2007 site, certain installation properties will automatically be applied to computers. These include the management point to which the client should assign and the fallback status point if this has been configured for the site.

This tab contains the following elements:

Installation properties

Specifies additional installation properties to apply to the Configuration Manager 2007 client installation. You can specify any properties that modify the behavior of the client.msi installation package. To enter multiple installation properties, separate them with spaces.

Client installation properties specified in this tab are published to Active Directory if the schema is extended for Configuration Manager 2007 and read by client installations where CCMSetup is run with no installation properties.

You can view a full list of client.msi installation properties in the topic About Configuration Manager Client Installation Properties

Note
Do not enter installation properties for CCMSetup.exe in this tab.

Use Default

Click this button to reset properties in the Installation properties list to the default value of SMSSITECODE=<site name>

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Configuration Manager Client Installation Properties Published to Active Directory Domain Services


Component Configuration Properties

Component configuration allows you to set configuration options that affect the entire Microsoft System Center Configuration Manager 2007 site. For example, instead of configuring properties that apply to System Health Validator points individually, the System Health Validator component properties allow you to configure options that affect all System Health Validator points.

See Also

Reference

Management Point Component Properties: General Tab
Status Reporting Properties: General Tab

Other Resources

Software Distribution Properties
Software Update Point Component Properties
System Health Validator Point Component Properties


Component Status Summarizer Properties

The Configuration Manager 2007 Component Status Summarizer Properties dialog box allows you to enable and configure status summarization for components in the Configuration Manager 2007 site.

In This Section

Component Status Summarizer Properties: General Tab

Enables or disables component status summarization and configure replication settings.

Component Status Summarizer Properties: Thresholds Tab

Displays the message thresholds that are used to specify the status of each Configuration Manager 2007 component.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Component Status Summarizer Properties: General Tab

Use the General tab of the Configuration Manager 2007 Component Status Summarizer Properties dialog box to enable and configure status summarization in the Configuration Manager 2007 site. Status Summarizers count data and events from status messages and display this data in the System Status node of the Configuration Manager console.

This tab contains the following elements:

Enable status summarization

Enables summarization of component status messages on this Configuration Manager 2007 site.

Replicate to parent site

Enables the passing of summarization data from this site to the parent site.

Replication priority

Specifies the sending priority to use when replicating summarization data from the drop-down menu. You can choose from the following:

  • Low
  • Medium
  • High
Threshold period

Specifies how often status message counts are reset to zero from the drop-down list.

See Also

Tasks

How to View the Status of a Component

Concepts

Using Status Messages for Configuration Manager Troubleshooting
About Data Priorities
About Threshold Periods


Component Status Summarizer Properties: Thresholds Tab

Use the Thresholds tab of the Configuration Manager 2007 Component Status Summarizer Properties dialog box to view the thresholds that are used to specify the status of each Configuration Manager 2007 component.

This tab contains the following elements:

Message type

Specifies the severity of the status messages for which you want to view threshold information. The following values in the drop-down list are available:

  • Informational status messages
  • Warning status messages
  • Error status messages
Thresholds

Displays Warning and Critical status threshold information for each Configuration Manager 2007 component and for the severity specified in the Message type drop-down list.

Component

Displays the name of each Configuration Manager 2007 component.

Warning

Displays the number of status messages that must be generated by this component to change its status to Warning in the Component Status Summarizer. The default value is 2000.

Critical

Displays the number of status messages that must be generated by this component to change its status to Critical in the Component Status Summarizer. The default value is 5000.

New

Opens the Status Threshold Properties dialog box, which you can use to configure how many messages must be generated by a specific component to change its status.

See Also

Tasks

How to View the Status of a Component

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Computer Client Agent Properties

The Configuration Manager 2007 Computer Client Agent Properties dialog box allows you to configure settings that client computers use to communicate with Configuration Manager 2007 site systems, notification options for users of client computers and the behavior of client computers which require a restart.

Click any link in the following section for detailed information about its associated tab in the Computer Client Agent Properties dialog box:

In This Section

Computer Client Agent Properties: General Tab

Specifies the network access account that can be used by client computers when an advertised program requires access to network resources. You can also specify the polling interval that client computers should use when checking for new policy from the Configuration Manager 2007 site.

Computer Client Agent Properties: Customization Tab

Specifies the text displayed to the users of client computers when deploying software packages, software updates or operating systems.

Computer Client Agent: Reminders Tab

Specifies the reminder behavior for deadlines and mandatory assignment schedules.

Computer Client Agent: BITS Tab

Specifies bandwidth throttling settings to control network traffic between client computers and Configuration Manager 2007 site systems.

Computer Client Agent Properties: Restart Tab

Specifies site-wide notification settings to be used when a program requires the client computer to restart.

See Also

Concepts

Overview of Configuration Manager Client Deployment


Computer Client Agent Properties: General Tab

Topic last updated -- November 2007

Use the General tab of the Microsoft System Center Configuration Manager 2007 Computer Client Agent Properties dialog box to configure the network access account and policy polling interval for clients on this Configuration Manager 2007 site.

This tab contains the following elements:

Network Access Account

Specifies the network access account that should be used by Configuration Manager 2007 client computers to communicate with network resources.

Set

Opens the Windows User Account dialog box which allows you to specify a Windows user name and password for the network access account.

Clear

Removes the existing network access account if this has been specified.

Policy polling interval (minutes)

Specifies in minutes the interval that should be used by Configuration Manager 2007 clients when checking for new policy. The default value is 60 minutes.

State message reporting cycle (minutes)

Specifies how often in minutes the client agent sends consolidated state messages to the management point. A smaller interval allows more timely state message reporting, but increases the load on the state message system. A larger interval has less impact on performance and might reduce the number of transitory state messages displaying in reports. The default value is 15 minutes.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Computer Client Agent Properties


Computer Client Agent Properties: Customization Tab

Use the Customization tab of the Configuration Manager 2007 Computer Client Agent Properties dialog box to display organization-specific text that will be displayed to the users of Configuration Manager 2007 client computers when they receive software packages from Configuration Manager 2007.

This tab contains the following elements:

Organization Name

Specifies the name of your organization.

Note
If you change the organization name, you must also update the boot images in your site so that the correct organization name will appear while associated task sequences are running on the target computer.

Software updates

Specifies the unique text to display in the Configuration Manager 2007 client user interface when deploying software updates.

Software distribution

Specifies the unique text to display in the Configuration Manager 2007 client user interface when deploying software packages.

Operating system deployments

Specifies the unique text to display in the Configuration Manager 2007 client user interface when deploying operating systems.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Computer Client Agent Properties


Computer Client Agent: Reminders Tab

Use the Reminders tab of the Configuration Manager 2007 Computer Client Agent Properties dialog box to specify how often users of client computers are notified of approaching deadlines and mandatory assignment schedules.

Reminders are shown for mandatory software distribution advertisements, task sequence advertisements and software updates deployments.

This tab contains the following elements:

Deadline greater than 24 hours, remind user every (hours)

Specifies in hours how often the user is reminded about upcoming deadlines or deployments when they are more than 24 hours away. The default value is every 3 hours.

Deadline less than 24 hours, remind user every (hours)

Specifies in hours how often the user is reminded about upcoming deadlines or deployments when they are less than 24 hours away. The default value is every 1 hour.

Deadline less than 1 hour, remind user every (minutes)

Specifies in minutes how often the user is reminded about upcoming deadlines or deployments when they are less than 1 hour away. The default value is every 15 minutes.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Computer Client Agent Properties


Computer Client Agent: BITS Tab

Topic last updated -- January 2008

Use the BITS tab of the Configuration Manager 2007 Computer Client Agent Properties dialog box to configure Background Intelligent Transfer Service (BITS) bandwidth throttling settings to control network traffic between Configuration Manager 2007 clients or branch distribution points, and site systems.

You can specify a time window in which network traffic will be throttled and also specify separate throttling settings which will be used outside of the throttling window.

Note
This tab does not appear on Configuration Manager 2007 secondary sites because client computers cannot be assigned to these sites.

Important
When you specify BITS settings using the Configuration Manager 2007 console, they are stored in the local policy of the client computer. These settings might override BITS settings configured by another application. Additionally, if you use Windows Group Policy to configure BITS settings, the settings specified in the Group Policy will override those configured by Configuration Manager 2007.

This tab contains the following elements:

Not Configured

Select this option to disable BITS bandwidth throttling. If you select this option, no bandwidth throttling will be used by Configuration Manager 2007 clients or by any branch distribution points.

Apply to branch distribution points only

Select this option to apply BITS bandwidth throttling to branch distribution points only. If you select this option, branch distribution points will download new content using the BITS settings specified.

Apply to branch distribution points and all clients

Select this option to apply BITS throttling to all branch distribution points and Configuration Manager 2007 clients. If this option is selected, all Configuration Manager 2007 clients and branch distribution points will use the BITS settings specified.

Throttling window start time

Specify the start time that the BITS throttling window should begin.

Throttling window end time

Specify the end time that the BITS throttling window should end.

Maximum transfer rate during of throttling window (Kbps)

Specify the maximum transfer rate in (Kbps) that can be used by Configuration Manager 2007 clients during the specified BITS throttling window.

Allow BITS downloads outside of the throttling window

Select this option to allow BITS downloads outside of the throttling window. This option will allow Configuration Manager 2007 clients to use separate BITS settings outside of the specified window.

Maximum transfer rate outside of throttling window (Kbps)

Specify the maximum transfer rate in (Kbps) that will be used by Configuration Manager 2007 clients when outside of the specified BITS throttling window. This option can be configured only when you have selected to allow BITS throttling outside of the specified window.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Standard and Branch Distribution Points

Other Resources

Computer Client Agent Properties


Computer Client Agent Properties: Restart Tab

Use the Restart tab of the Configuration Manager 2007 Computer Client Agent Properties dialog box to specify site-wide notification settings to be used when a program requires a restart of the client computer.

Note
You can override these settings for specific collections in the Advanced tab of the Collection Name Settings dialog box.

This tab contains the following elements:

Restart countdown (minutes):

Specifies the length of the client restart notification (in minutes) for computers in this site. The default setting is 5 minutes.

Restart final notification (minutes):

Specifies the length of time before restart (in minutes) that a final client notification is displayed for computers in this site. The default setting is 1 minute. Restart final notification must be less than the Restart countdown.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Computer Client Agent Properties
Collection Name Settings


ConfigMgr Out of Band Service Point Properties: General Tab

Topic last updated—May 2008

Use the ConfigMgr Out of Band Service Point Properties dialog box to help you control the CPU utilization for the out of band service point and the network bandwidth when targeted computers are configured for scheduled wake-up activities and they are sent power on commands.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Power on commands are used for scheduled wake-up activities according to the setting selected for Enable Wake On LAN for this site. For more information about this configuration setting, see How to Configure the Site to Send Power-On Commands for Scheduled Wake-Up Activities Using Out of Band Management.

To configure the out of band service point for provisioning and AMT-related settings, configure the out of band service point component properties. For more information, see the following topics:

  • How to Configure AMT Provisioning
  • How to Configure AMT Settings and AMT User Accounts

This dialog box contains the following elements.

Retries

The number of times a power on command will be sent to a target computer.

After a power on command is sent to all targeted computers, the transmission is paused for the Delay period. If this retry value is greater than 1, a second power on command is sent to the same computers and the process is repeated until the retry value is reached. The second and subsequent power on commands are sent only if the target computer failed to respond.

Unlike wake-up packets, power on commands create an established session with the target computer, so retries are less likely to be necessary. However, retries might be necessary if the site is transmitting a high number of packets (for example, also sending wake-up packets) and the power on commands fail to reach a target computer because of the high network bandwidth consumption.

The default setting is 3 retries. Values can range from 0–5.

Delay

The amount of time in minutes that power on commands pause between retries.

The default setting is 2 minutes. Values can range from 1–30 minutes.

Maximum

The maximum number of power on commands to be transmitted by the out of band service point to the target computers before pausing for the Wait period.

The pause avoids potentially saturating the network for an extended period of time. At the end of the configured Wait period, the transmission of power on commands resumes for the remaining targeted computers until the maximum value is reached again, and the process is repeated.

The default setting is 100 power on commands. Values can range from 1–10,000 maximum power on commands.

Wait

The length of time, in seconds, between sending batches of power on commands to target computers.

The default setting is 5 seconds. Values can range from 1–1,000 seconds.

Transmission Threads

The number of threads the out of band service point uses when sending power on commands.

Increasing the number of threads increases the likelihood of making full use of available network bandwidth, particularly when the out of band service point site system server computer has multiple cores or processors. Increasing the number of threads might also produce a significant increase in CPU utilization.

The default setting is 3 transmission threads. Values can range from 1–60 threads.

Transmission Offset

The amount of time in minutes that a power on command will be sent prior to a scheduled activity that is enabled for Wake On LAN.

Set a value that is sufficiently in advance of the scheduled activity so that computers have completed startup, but not so far in advance that the computer returns to a sleep state before the scheduled activity.

The default setting is 10 minutes. Values can range from 1–480 minutes.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Power On or Restart a Computer Using Out of Band Management

Concepts

Overview of Out of Band Management


ConfigMgr Component Server Properties

A component server in Microsoft System Center Configuration Manager 2007 is any server that is running some sort of Configuration Manager 2007 site system role requiring a Configuration Manager 2007 service to be installed. If there are any Configuration Manager 2007 services running on the site system, you must delete all of the site system roles to remove the services before you can remove the site system.

The General tab contains the following elements:

OK

Exits the dialog box.

Cancel

Exits the dialog box.

Apply

Saves the changes, and remains in the dialog box

Note
Because there are no editable settings available for this role, the Apply button is not enabled.

See Also

Tasks

How to Delete a Site System
How to Delete Site System Roles From Site Systems

Other Resources

Site System Properties


ConfigMgr Site Database Server Properties: General Tab

Use this tab to view the site database server properties. A site database server is a server that hosts the Configuration Manager 2007 site database. The site database server can be the same computer as the site server if Microsoft SQL Server has also been installed to host the site database, a stand-alone SQL Server computer, or a clustered virtual SQL Server instance.

The site database server can perform one or more roles unless the site database is hosted by a clustered virtual SQL Server instance. In this situation, no other site system roles can be assigned to the computer.

This page contains the following elements:

SQL Server Name

The name of the SQL Server hosting the site database. If a SQL Server named instance is used to host the site database, the server name and instance name is displayed in the following format: <SQL Server name>\<instance name>.

SQL Database Name

The name of the site database.


ConfigMgr Device Management Point Properties: General Tab

The Device Management Point is an Configuration Manager 2007 site system that communicates with device management clients.

This tab contains the following elements:

There are no items available on the General tab.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Other Resources

Site System Properties


ConfigMgr Distribution Point Properties

Topic last updated—January 2008

The distribution point site role is used to store package source files. Configuration Manager 2007 clients contact distribution points to obtain source files when they require content, such as software distribution packages and software update packages. The site role is also used to configure multicast settings for Operating System Deployment and to configure the Virtual Application Server.

In This Section

ConfigMgr Distribution Point Properties: General Tab

ConfigMgr Distribution Point Properties: Multicast Tab

ConfigMgr Distribution Point Properties: Virtual Applications Tab

See Also

Other Resources

Site Settings Property Pages


ConfigMgr Distribution Point Properties: General Tab

Topic last updated—March 2008

Use the General tab of the Configuration Manager 2007 ConfigMgr distribution point Properties dialog box to specify the settings for a distribution point in the Configuration Manager site. This tab can also be used to add the distribution role to a new or existing distribution point group, as well as to designate the distribution point as a branch distribution point.

Note
Communication settings options are available only if the site system is enabled as a standard distribution point.

The General tab contains the following elements:

Enable as a standard distribution point

Enables this site system as a standard distribution point. This option is available only on server site systems.

Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS

Specifies whether clients connecting to this distribution point can transfer contents using Background Intelligent Transfer Service (BITS), HTTP, or HTTPS. This option must be selected for device clients and Internet-based clients.

You can specify exactly which client type this applies to by selecting the appropriate option from the drop-down list.

Important
You must download, install, and configure WebDAV manually on BITS-enabled distribution points running Windows Server 2008. For more information, see How to Configure Windows Server 2008 for Site Systems.

Allow clients to connect anonymously (Required for mobile device clients)

Mobile devices require this option to be configured when the site is in mixed mode. This option is not configurable when the site is in native mode. For more information about mixed and native modes in Configuration Manager 2007, see Configuration Manager Site Modes.

Enable as branch distribution point

Enables this site system as a branch distribution point. This option is available only on server site systems that are Configuration Manager clients. If this option is not enabled, you should check the branch distribution prerequisites to ensure that all prerequisites have been met. For more information, see Prerequisites for Software Distribution.

A branch distribution point can be enabled on a Configuration Manager client that is either a server-class or a workstation-class computer, but some limitations might be imposed on the latter depending on the operating system being used. For more information, see About Standard and Branch Distribution Points.

Note
If you convert this site from a standard distribution point to a branch distribution point, it cannot be changed back to a standard distribution point without first removing the branch distribution point role.

Disk partition

Specifies the partition information that will be used for storing packages on the branch distribution point. This option is available only on server site systems.

The following configuration options are available for setting disk partitioning:

  • Use specific partition: This option allows you to specify whether a specific partition on the client computer hosting the branch distribution point will be used for storing packages. If this option is selected, you must also select the partition from the drop-down list. The package directory name will be SMSPKG<drive letter>$.
    Note
    If no specific partition is selected, packages will be downloaded and installed on the partition with the largest amount of free space by default.

  • Space reserved for operating system (MB): Specifies how much of the selected partition should be reserved on the client computer for the operating system and other files. All other space on the partition could be used for storing packages. If no specific partition is selected, the space reserved value will apply to the default partition used.
Group Membership

Specifies the distribution point groups in the Configuration Manager site and indicates whether the current site system is currently a member of each group.

The following options are available for managing these distribution point groups:

  • New icon: Opens the Distribution Point Group dialog box to add a new distribution point group for the Configuration Manager site. When a new group is created, the current site system will be added to that group by default.
  • Properties icon: Opens the Distribution Point Group dialog box for the selected group to view or modify this distribution point's membership in the group.
  • Delete icon: Deletes a specific group from the Configuration Manager site. If this option is selected, a confirmation dialog box will appear before the distribution point group is actually deleted.
  • Membership icon: Includes or excludes this site system from the selected distribution point group.
The following columns are displayed for each distribution point displayed:

  • Member: Specifies whether the current site system is included in the selected distribution point group.
  • Group: Specifies the name of the selected distribution point group.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

See Also

Concepts

About Distribution Points
About Standard and Branch Distribution Points

Other Resources

Site System Properties


ConfigMgr Distribution Point Properties: Multicast Tab

Topic last updated—March 2008

Use the Multicast tab of the Configuration Manager 2007 Distribution Point Properties dialog box to specify the settings for a distribution point in the Configuration Manager site.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

The Multicast tab contains the following elements.

Enable as a multicast distribution point

Enables this site system as a multicast distribution point for operating system deployment. This option is available only on server site systems.

Specify the account to connect to the database

Specifies the Windows user account to be used when making Configuration Manager 2007 database connections for multicast configuration.

  • Use Multicast service point's computer account—Specifies that the multicast service point's computer account should be used for database connection account settings.
  • Use another account—Specifies that the Windows user account specified using the Set button should be used for database connection account settings.
Multicast address

Specifies the IP address for communication between the multicast server site system and clients. The range of multicast IP addresses between 224.0.0.0 and 224.0.0.255. The settings for multicast might require configuration of firewalls and routers to ensure that multicast traffic is not blocked.

  • Obtain IP address from DHCP—Specifies that the IP address for multicast communication should be obtained from a DHCP server.
  • Use IP address from the following range—Specifies that the IP addresses should be assigned from a specified range.
    • From—Specifies the first IP address to be used for the multicast IP address range.
    • To—Specifies the last IP address to be used for the multicast IP address range.
UDP Port Range

Specifies the user datagram protocol (UDP) port range that the multicast site server will use for communication with clients.

  • From—Specifies the first UDP port number to be used for multicast communication.
  • To—Specifies the last UDP port number to be used for multicast communication.
  • The UDP port number range is inclusive.
Note
The UDP ports specified in the UDP port range must be open on firewalls between the distribution point and clients attempting operating system deployment via multicast.

Enable scheduled multicast

Enables a multicast schedule and specifies the multicast schedule settings. If scheduled multicast is enabled, the multicast will begin when either the delay time from the first request is exceeded or the minimum number of session requests is received by the distribution point.

  • Session start delay—Specifies the number of minutes that the multicast is delayed before starting.
  • Minimum session size—Specifies the minimum number of clients in a session required for a scheduled multicast session to begin.
A scheduled multicast requires that clients wait until the Session start delay value or the Minimum number of clients value is reached to begin downloading the package. Distribution without waiting for a new multicast to form, known as auto cast, allows clients to begin downloading immediately. If a multicast is already in progress, the client joins the multicast and downloads the package and then downloads any missing portion of the package. Deploying operating system packages via auto cast might require more bandwidth, but it does not require that clients wait to begin the deployment.

Network profile

Specifies the profile of the network used for multicast. Each profile contains settings to optimize performance for the specified speed, such as the maximum transport window size, the transport cache size, and the block size.

Select Custom if you want to customize the settings by editing the registry. Even if you want to change only one setting, you should create a custom profile by first copying the needed profile into the custom profile. Registry settings can be viewed at HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WDSServer \ Providers \ Multicast \ Profiles. Do not modify the other profiles that are provided.

Maximum clients

Specifies the maximum number of clients a multicast-enabled distribution point can serve at one time in all multicast sessions. Clients requesting deployment in excess of the maximum will not receive multicast distribution from this server and will try other distribution points or protocols.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Enable Multicast for Operating System Deployment

Concepts

About Configurations for Multicast for Operating System Deployment
Prerequisites for Multicast for Operating System Deployment


ConfigMgr Distribution Point Properties: Virtual Applications Tab

Topic Last Updated—August 2008

Use the Virtual Applications tab of the Configuration Manager 2007 ConfigMgr distribution point Properties dialog box to enable the distribution point for streaming virtual applications to target computers. Streaming enables computers to run a virtual application package directly from a distribution point. Streaming virtual application packages to Configuration Manager 2007 workgroup clients is not supported.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

The Virtual Applications tab contains the following elements:

Enable virtual application streaming

Enables the distribution point for streaming virtual application packages to target computers. If you plan to run virtual application packages from a distribution point, you must select this option. For this option to be available on the General tab, you must select Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients).. Configuration Manager 2007 clients assigned to a branch distribution point will connect and run virtual application packages using server message block SMB.

Apply

Saves the changes without closing the dialog box.

See Also

Concepts

About Distribution Points


ConfigMgr Distribution Point Server Share Properties: General Tab

Use the General tab of the Configuration Manager 2007 ConfigMgr Distribution Point Server Share Properties dialog box to specify the settings for a server share distribution point in the Configuration Manager site. This tab can also be used to add the distribution role to a new or existing distribution point group.

The General tab contains the following elements:

Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS

Specifies whether clients connecting to this distribution point can transfer contents using Background Intelligent Transfer Service (BITS), HTTP, or HTTPS. This option must be selected to enable BITS network throttling on this distribution point.

Because Internet-based client management does not support distribution points that are site system shares, the option Allow intranet-only client connections is not configurable. For more information about Internet-based client management, see Prerequisites for Internet-Based Client Management and Deploying Configuration Manager Sites to Support Internet-Based Clients.

Allow clients to connect anonymously (Required for mobile device clients)

Mobile devices require this option to be configured when the site is in mixed mode. This option is not configurable when the site is in native mode. For more information about mixed and native modes in Configuration Manager 2007, see Configuration Manager Site Modes.

Group Membership

Specifies the distribution point groups present in the Configuration Manager site and indicates whether the current site system is currently a member of each group.

The following options are available for managing these distribution point groups:

  • New icon: Opens the Distribution Point Group dialog box to add a new distribution point group for the Configuration Manager site. When a new group is created, the current site system will be added to that group by default.
  • Properties icon: Opens the Distribution Point Group dialog box for the selected group to view or modify this distribution point's membership in the group.
  • Delete icon: Deletes a specific group from the Configuration Manager site. If this option is selected, a confirmation dialog will appear before the distribution point group is actually deleted.
  • Membership icon: Includes or excludes this site system from the selected distribution point group.
The following columns are displayed for each distribution point displayed:

  • Member: Specifies whether the current site system is included in the selected distribution point group.
  • Group: Specifies the name of the selected distribution point group.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Concepts

About Distribution Points
Prerequisites for Internet-Based Client Management

Other Resources

Site System Properties


ConfigMgr Fallback Status Point Properties: General Tab

Use the General tab of the Configuration Manager 2007 ConfigMgr Fallback Status Properties dialog box to verify the client connections allowed and configure throttling for processing state messages from clients.

This tab contains the following elements:

Allowed client connections

Displays which client computers can send messages to this fallback status point. This setting is automatically configured and is displayed for information only.

The available options are the following:

  • Allow intranet-only connections
    When the site is in mixed mode, this setting is automatically configured to indicate that the fallback status point can receive state messages from clients on the intranet.
    This option is also automatically configured when the site is in native mode and the site system that is configured with the fallback status point role is not configured with an Internet fully qualified domain name (FQDN). To specify an Internet FQDN, see How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management.
  • Allow both Internet and intranet client connections
    This setting is automatically configured when the site is in native mode, and the site system that is configured with the fallback status point role is configured with an Internet fully qualified domain name (FQDN).
    Unlike the other site systems that support Internet-based client management, you cannot control client connections from the Internet or intranet with the Allowed client connection setting because the fallback status point uses unauthenticated client connections. Instead, it is the server placement and client configuration of assigning the fallback status point that determines whether clients on the intranet or the Internet can connect to the fallback status point.
    For more information, see Determine Server Placement for Internet-Based Client Management and How to Assign the Fallback Status Point to Configuration Manager Client Computers.
Number of messages:

Specify the number of state messages that the fallback status point is permitted to send to the Configuration Manager 2007 site server within the specified throttle interval. The default value is 10000.

Throttle interval (in seconds)

Specify the throttle interval for state message processing. Only the number of state messages specified in Number of messages will be sent to the Configuration Manager 2007 site server during this interval. The default value is 3600 seconds.

See Also

Tasks

How to Create a Fallback Status Point in Configuration Manager

Concepts

Overview of Configuration Manager Client Deployment
About the Fallback Status Point in Configuration Manager
Administrator Workflow: Configuring a Site for Internet-Based Client Management
Determine If You Will Use FQDN Server Names
Determine If You Need to Configure Throttle Settings for the Fallback Status Point in Configuration Manager

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients


ConfigMgr Management Point Properties: General Tab

Use the General tab to specify whether this site system will provide a location where Configuration Manager computer and device clients can exchange data with the Configuration Manager site services.

This tab contains the following elements:

Allow devices to use this management point

When a management point is configured to allow devices to use it, the management point provides data for Configuration Manager device management functions.

Allow client connections

You can allow clients to connect to the management point from the intranet, Internet, or both.

Note
You must enter a fully qualified domain name (FQDN) in the management point properties to be able to allow Internet-based clients to use this management point.

Specify the database that this management point uses

The management point can be configured to use the site database or a database replica by selecting one of the following options:

  • Use the site database (default).
  • Use a database replica. If this option is selected, you must enter the SQL server name (or SQL server and named instance) and database name that the management point will use.
Specify the account used by the management point to connect with the database

The management point can be configured to use the management point's computer account or a domain user account to connect to the site database.

Important
The management point connection account must be configured to use a domain user account if the management point needs to access a site database in a different domain, whether or not the domain is in the same Active Directory forest as the site database server.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.


ConfigMgr PXE Service Point Properties

The PXE service point site role is used to initiate the operating system deployment process for Configuration Manager 2007 PXE clients. The PXE service point must be configured to respond to PXE boot requests made by Configuration Manager 2007 clients on the network and then interact with Configuration Manager 2007 infrastructure to determine the appropriate installation actions to take. .

In This Section

ConfigMgr PXE Service Point Properties: General Tab

ConfigMgr PXE Service Point Properties: Database


ConfigMgr PXE Service Point Properties: General Tab

Topic last updated—January 2008

The PXE service point hosts boot images and responds to incoming PXE requests from Configuration Manager 2007 clients.

You can use this tab to specify whether this PXE service point should respond to PXE requests on all installed network interfaces or on a specific network interface.

This page contains the following elements.

Allow this PXE Service Point to respond to incoming PXE requests

Enables the PXE service point to respond to computer requests. By not selecting or clearing this option, you can temporarily disable a PXE service point. This option is helpful if there are multiple PXE servers on the network or if you want to temporarily suspend responding to Configuration Manager 2007 PXE requests.

Important
If you enable unknown computer support, any unknown computers that use PXE-initiated operating system deployments will attempt to run mandatory task sequences. Mandatory task sequences that include operations such as Apply Operating System Image or Format and Partition disk will destroy all data on those unknown systems.

Enable unknown system support

Applies only to Configuration Manager 2007 R2.

Enables the PXE service point to respond to requests from unknown systems. If this option is not selected, only managed machines will be supported by this PXE service point.

Require a password for computers that boot to PXE

Specifies a password for computers that boot to this PXE service point. If you specify a password, a user must be present at the target computer to enter the password or the PXE initiated installation will fail.

Delay (seconds)

Specifies, in seconds, how long the delay should be for this PXE service point before it responds to computer requests when multiple PXE service points are used. By default, the Configuration Manager 2007 PXE service point will respond first to network PXE requests.

See Also

Other Resources

ConfigMgr PXE Service Point Properties


ConfigMgr PXE Service Point Properties: Database

You can specify the PXE service points computer account to connect with the Configuration Manager 2007 database by selecting Use the PXE service point's computer account. If your network security model is designed to use a different account to communicate with the Configuration Manager 2007 database you can also specify a different account. To specify a different account, select Use another account and enter the network account that should be used or click Set button to open the Windows User Account dialog box. Specify the network account and network password that should be used for the connection. You must manually add the specified account to the SMS PXE Service Point Role (msdbrole_PSP) on the site database. For more information, see About the PXE Service Point Database Connection Account

Specify whether the PXE service point will create a self-signed certificate or if the certificate will be imported by the user. If you are in an environment that requires the PXE service point to create a self-signed certificate, you must set the expiration date in the space provided. In native mode environments the self signed certificate option is not available and you must import a certificate from a trusted root certification authority.

To import a certificate, select Import certificate and then locate the certificate by clicking Browse, and then enter the password associated with the certificate.

See Also

Other Resources

ConfigMgr PXE Service Point Properties


ConfigMgr Reporting Point Properties: General Tab

Use the Reporting Point page in the Configuration Manager 2007 New Site Role Wizard and New Site System Server Wizard to create and configure a reporting point, and use the General tab in the ConfigMgr reporting point Properties dialog box to modify the reporting point properties.

The Reporting Point page and General tab contain the following elements:

Report folder

Specifies the name of the folder created on this site system. You can enter up to 256 characters. Configuration Manager creates the folder under \Inetpub\wwwroot beneath the site server root. The name of the folder is also used as the name of the virtual folder, as displayed in Internet Information Services (IIS). The following characters are not allowed: / \ [ ] : ; | = , + " * ? < >

URL

Displays the reporting point URL determined by the Report folder setting. This URL is used to access Configuration Manager reports.

Transfer protocol

Specifies whether the Configuration Manager console opens the Report Viewer Web page using hypertext transfer protocol (http) or secure hypertext transfer protocol (https), and what port number is used. This setting does not configure IIS, which must be configured independently. The following options are available:

  • Use http: Specifies that http is used when opening the Configuration Manager Report Viewer. When this option is selected, Use https is not available. The http port number must be specified in the Port text box. The default http port is 80.
  • Use https: Specifies that https (SSL) is used when opening the Configuration Manager Report Viewer. When this option is selected, Use http is not available. The https port number must be specified in the Port text box. The default https port is 443.

See Also

Tasks

How to Display the Properties for a Reporting Point
How to Create a Reporting Point

Reference

New Site System Wizard: System Role Selection Page

Concepts

About Configuration Manager Reports
About Reporting Points
Configuring Reporting

Other Resources

New Site Role Wizard


ConfigMgr Reporting Services Reporting Point Properties: General Tab

The information in this topic applies only to Configuration Manager 2007 R2.

Use the Reporting Services Point page in the Configuration Manager 2007 New Site Role Wizard and New Site System Server Wizard to create and configure a Reporting Services point, and use the General tab in the ConfigMgr Reporting Services Point Properties dialog box to display the report folder for the Reporting Services point.

The Reporting Services Point page and General tab contain the following element:

Report folder

Specifies the name of the folder created on the Reporting Services point site system server. This folder will contain the Reporting Services reports that can be accessed from the Configuration Manager console. The default name is ConfigMgr_<sitecode>, but you can create a custom folder name that is up to 256 characters. The following characters are not allowed: / \ [ ] : ; | = , + " * ? < >

See Also

Reference

New Site System Wizard: System Role Selection Page

Concepts

About Configuration Manager Reports
Configuring Reporting

Other Resources

New Site Role Wizard


ConfigMgr Site Server Properties: General Tab

The ConfigMgr site server role is added to a site server by the site component manager during site server installation. There are no editable settings available for this role.


ConfigMgr Server Locator Point Properties: General Tab

Use the General tab of the Configuration Manager 2007 ConfigMgr server locator point Properties dialog box to specify the Configuration Manager 2007 database that the server locator point should use and the Windows user account details to be used to connect to the database.

This tab contains the following elements:

Use the site database

Specifies that the server locator point should communicate directly with the Configuration Manager 2007 site database.

Use a database replica

Specifies that the server locator point should communicate with a replica of the Configuration Manager 2007 site database.

SQL Server name:

If Use a database replica is selected, specify the name of the SQL server containing the database replica which the server locator point should communicate with.

Database name:

If Use a database replica is selected, specify the name of the database which the server locator point should communicate with.

Use the server locator point's computer account

Specifies that the computer account on the server locator point site system computer will be used to connect to the SQL database.

Use another account

Specifies that an account other than the computer account on the server locator point site system computer will be used to connect to the SQL database.

Server Locator Point Connection Account

Displays the name of the server locator point connection account if this has been specified.

Set

Opens the Windows User Account dialog box which allows you to specify a Windows user name and password for the server locator point connection account.

Note
This button is not available if Use the server locator point's computer account is selected.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment
About Client Site Assignment in Configuration Manager
Determine If You Need a Server Locator Point for Configuration Manager Clients
About the Server Locator Point Database Connection Account


ConfigMgr Software Update Point Properties

Use the General tab in the Configuration Manager 2007 ConfigMgr software update point Properties to specify whether to use a proxy server when connecting to the upstream server or Microsoft Update during the synchronization process.

The General tab contains the following elements:

Use a proxy server when synchronizing

Specifies whether to use a proxy server when connecting to the upstream server or Microsoft Update to synchronize software updates.

Server name

Specifies the name or IP address of the proxy server.

Port

Specifies the HTTP port used by the proxy server. By default, HTTP port 80 is selected.

Use credentials to connect to the proxy server

Specifies whether to use specific security credentials when connecting to the proxy server.

Software update point proxy server account

Specifies the software update point proxy server account used when connecting to the proxy server.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Software Updates Synchronization
How to Create and Configure an Active Software Update Point

Concepts

About the Software Update Point
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Desired Configuration Management Client Agent Properties

Use the General tab of the Configuration Manager 2007 Desired Configuration Management Client Agent Properties dialog box to enable the desired configuration management client agent and to configure the default schedule for compliance evaluation.

Note
The Configuration tab on Configuration Manager 2007 client computers is not visible unless the desired configuration management client agent is enabled.

This tab contains the following elements:

Enable desired configuration management on computers

Specifies that clients will evaluate their compliance with any configuration baselines that are assigned to them. When enabled, Configuration Manager 2007 client computers will display the Configurations tab in Systems Management Properties. The default value is enabled.

Simple schedule

Specifies the default value for client computers to evaluate assigned configuration baselines on a simple schedule, when the configuration baseline does not have its own schedule. An example of a simple schedule is every 7 days (the default).

Run every

When the Simple schedule is specified, specifies the setting of the simple schedule.

Custom schedule

Specifies the default value for clients to evaluate assigned configuration baselines on a custom schedule when the configuration baseline does not have its own schedule. An example of a custom schedule includes the start date and time and the recurrence, such as every 12 hours. Use the Customize button to define the custom schedule.

Customize

Opens the Custom Schedule dialog box to specify the default custom schedule for assigned configuration baselines.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management


Mobile Device Client Agent Properties

The device client agent allows you to enable and configure software inventory, hardware inventory, and software distribution on device clients.

The Device Client Agent Properties dialog box contains five tabs:

Mobile Device Client Agent Properties: General Tab

Specifies mobile device poll properties.

Mobile Device Client Agent Properties: Software Distribution Tab

Specifies mobile device software distribution properties.

Mobile Device Client Agent Properties: Software Inventory Tab

Specifies mobile device software inventory properties.

Mobile Device Client Agent Properties: Hardware Inventory

Specifies mobile device hardware inventory properties.

Mobile Device Client Agent Properties: File Collection

Specifies mobile device file collection properties.


Mobile Device Client Agent Properties: General Tab

Use the General tab of the Microsoft System Center Configuration Manager 2007 Mobile Device Client Agent properties dialog box to specify how frequently the mobile device client polls the management point for new configuration settings and advertisements. This is called the poll interval. If the client fails to contact the device management point, it retries the connection.

The management point collects information about the mobile device including:

  • Software inventory
  • Hardware inventory
  • Files on the mobile device

To conserve network bandwidth, you can increase the poll interval time as more devices are added to the Configuration Manager 2007 site.

This tab contains the following elements:

Poll interval

Specifies how frequently the device client polls the device management point for new configuration settings and advertisements. You can specify 1 to 59 minutes or 1 to 23 hours. By default, this interval is set to 30 minutes. A six hour polling interval provides adequate frequency for most environments.

Retry delay

Specifies the interval between retries if the client fails to connect to the device management point. You can specify 1 to 59 minutes or 1 to 23 hours. By default, this interval is set to 3 minutes.

Note
The polling interval must be less than the retry delay multiplied by the number of retries.

Number of retries

Specifies the number of retries if the client fails to contact the device management point. You can specify 0 to 99 retries. By default, this interval is set to 3 retries.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Reference

Mobile Device Client Agent Properties


Mobile Device Client Agent Properties: Software Distribution Tab

Use the Software Distribution tab of the Microsoft System Center Configuration Manager 2007 Mobile Device Client Agent properties dialog box to enable software distribution to mobile devices.

Note
If software distribution is disabled and then re-enabled, all current advertisements will be offered to device clients even if the advertisements have previously been run on the device.

This tab contains the following elements:

Enable software distribution to Device Clients

Enables software distribution for all device clients belonging to the site. When you select this check box, software distribution is enabled on the device clients.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Reference

Mobile Device Client Agent Properties


Mobile Device Client Agent Properties: Software Inventory Tab

Use the Software Inventory tab of the Microsoft System Center Configuration Manager 2007 Mobile Device Client Agent properties dialog box to enable and configure software inventory on device clients.

This tab contains the following elements:

Enable software collection on Device Clients

Enables software inventory for all device clients belonging to the site. When you select this check box, software inventory is enabled on the device clients and runs according to the schedule specified.

Software inventory schedule

Runs software inventory at a single, specific interval.

Run every

Specifies the number and type of time units (minutes, hours, days, weeks, months) in the schedule. You can specify 1 to 59 minutes, 1 to 23 hours, one to 30 days, 1 to 4 weeks or 1 to 12 months. By default, this interval is set to 1 week. By periodically reporting inventory the administrator can monitor software installed on the mobile device.

New button

Click to open the Inventoried File Properties dialog box so that you can add a new entry to the files to be inventoried list.

Note
User wild card characters to specify file names to be inventoried.

Properties button

Click to open the Inventoried File Properties dialog box, so that you can edit an entry in the files to be inventoried list.

Delete button

Click to delete the selected file name.

Inventoried files

Specifies the properties of the inventoried file.

  • Name: The files or file types that are inventoried on clients. By default, no files or file types are listed.
Note
To collect groups of files, use a wild card character. For example, a*.exe will collect all executable files starting with the letter a.

  • Path: The full file path or system environment variable is searched.
  • Subdirectories: Indicates whether Path subdirectories are searched.
  • Exclude: Indicates whether encrypted and compressed files are excluded from collection. You can change this value in the Inventoried File Properties dialog box.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Inventorying a large numbers of files, for example using *.* from the root folder, may impact the performance of the mobile device during file collection as the software inventory operation consumes resources on the mobile device.

Note
Setting Run every to frequently report inventory may detrimentally effect mobile device performance.

See Also

Reference

Mobile Device Client Agent Properties

Concepts

How to View Software Inventory and Collected Files From Mobile Devices

Other Resources

How to View Mobile Device Client Information


Mobile Device Client Agent Properties: Hardware Inventory

Use the Hardware Inventory tab of the Microsoft System Center Configuration Manager 2007 Mobile Device Client Agent properties dialog box to enable and configure hardware inventory on device clients.

This tab contains the following elements:

Enable hardware inventory on Device Clients

Enables hardware inventory for all mobile device clients belonging to the site. When you select this check box, hardware inventory is enabled on the mobile device and runs according to the schedule specified.

Hardware inventory schedule

Runs the hardware inventory at a single, specific interval.

Run every:

Specifies the number and type of time units (minutes, hours, days, weeks, months) in the schedule. You can specify 1 to 59 minutes, 1 to 23 hours, 1 to 30 days, 1 to 4 weeks, or 1 to 12 months. By default, this interval is set to 1 day.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Certificate expiration dates that fall beyond 2038 are rejected and left blank by the hardware inventory.

Note
Setting Run every to frequently report inventory may effect mobile device performance.

Collected Hardware Inventory

The following data are collected:

  • Phone Identification
  • Phone Number
  • Owner Information:
    • Owner Name
    • Owner Telephone
    • Owner E-mail
    • Owner Notes
  • User Information:
    • User Name
    • User Locale
  • Certificate Information:
    • Enrolled Certificate Hash Code
    • Enrolled Certificate Subject Name
    • Enrolled Certificate Expiration Date
    • Registered Certificate Hash Code
    • Registered Certificate Subject Name
    • Registered Certificate Expiration Date
  • System Default Locale
  • IMEI Number
  • Device power (battery status)
  • Device computer system
  • Device display
  • Device file system
  • Device memory
  • Device network
  • Device operating system
  • System
  • Workstation status

See Also

Reference

Mobile Device Client Agent Properties

Concepts

How to Distribute Inventory Extension to Client Desktop Computers for Mobile Device Management
How to View Hardware Inventory From Mobile Devices

Other Resources

How to View Mobile Device Client Information


Mobile Device Client Agent Properties: File Collection

Last updated: November 2007

Use the File Collection tab of the Microsoft System Center Configuration Manager 2007 Mobile Device Client Agent properties dialog box to enable and configure file collection on device clients. File collection of an empty file, 0kb, will cause an error. Files greater than 6 MB cannot be file collected. File collection does not collect system files.

This tab contains the following elements:

Enable file collection on Device Clients

Enables file collection for all device clients belonging to the site. When you select this check box, file collection is enabled on the device clients and runs according to the schedule specified.

Note
User wild card characters to specify file names to be collected.

Run every

Specifies the number and time units (minutes, hours, days, weeks, months) in the schedule. You can specify 1 to 59 minutes, 1 to 23 hours, 1 to 30 days, 1 to 4 weeks, or 1 to 12 months. By default, this interval is set to 1 week. By periodically reporting inventory, the administrator can review the files on the mobile device.

New collected file button

Click to open the Collected File Properties dialog box so that you can add a new Files to the Collected files list.

Collected file properties button

Click to open the Collected File Properties dialog box so that you can edit the selected entry in the Collected files list.

Delete button

Click to delete the selected file in the Collected file list.

Collected files

Specifies the properties of the collected files.

  • Name: The files or file types that are collected from clients. By default, no files or file types are listed.
Note
To collect groups of files, use a wild card character. For example, a*.exe will collect all executable files starting with the letter a.

  • Path: The full file path or system environment variable searched.
  • Subdirectories: Indicates whether Path subdirectories are searched.
  • Exclude: Indicates whether encrypted and compressed files are excluded from collection. You can change this value in the Collected File Properties dialog box.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Collecting a large numbers of files may impact the performance of older mobile device such as Windows Mobile Pocket PC 2003 during file collection. Files larger than 15Kb may not be collected. To ensure log files are not affected, change log settings on mobile devices to reduce the size of the log files. For more information about restricting the size of log files, see How to Configure Logging for Windows Mobile and Windows CE Devices.

Note
Setting Run every to frequently collect files may detrimentally effect mobile device performance.

See Also

Reference

Mobile Device Client Agent Properties

Concepts

How to Configure Logging for Windows Mobile and Windows CE Devices
How to View Software Inventory and Collected Files From Mobile Devices


Discovery Methods Properties

Discovery is a Microsoft System Center Configuration Manager 2007 process that allows Configuration Manager 2007 to search various places on your network for computers that can be managed as Configuration Manager 2007 clients. Discovery can also locate resources that cannot be clients, such as printers and routers.

See Also

Reference

Heartbeat Discovery Properties: General Tab

Other Resources

Active Directory System Discovery Properties
Active Directory Security Group Discovery Properties
Active Directory System Group Discovery Properties
Active Directory User Discovery Properties
Network Discovery Properties


Distribution Point Group Properties: General Tab

Use the General tab in the Configuration Manager 2007 Distribution Point Group Properties dialog box to create a new distribution point group or view the properties of an existing group.

The General tab contains the following elements:

Name

Specifies the name of the distribution point group. This field can only be modified when creating a new group.

Include this site system in this distribution point group

Specifies whether to include the site system being viewed within the distribution group being created or viewed.

Members

Specifies the current members of the distribution point group.

The following columns are displayed for members of the distribution point group:

  • Name: Specifies the name of the site system in the distribution point group.
  • Type: Specifies the type of site system supporting the distribution point role.
  • Site: Specifies the site code representing the distribution point site system.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Distribution Points
Browse Distribution Point Group Dialog Box


Free Space Threshold Properties: General Tab

Use the General tab of the Configuration Manager 2007 Free Space Threshold Properties dialog box to specify the free space thresholds for the selected Configuration Manager 2007 site system storage object.

This tab contains the following elements:

Storage object

Specifies a storage object in the current site.

Free space thresholds

Specifies the free space thresholds for the storage object. If the free disk space falls below these thresholds, the status of the site system changes to Warning or Critical. The default values are 512,000 KB (Warning) and 256,000 KB (Critical).

Warning

Specifies the threshold that, when crossed, changes the status of a site system to Warning in the Site System Status Summarizer.

Critical

Specifies the threshold that, when crossed, changes the status of a site system to Critical in the Site System Status Summarizer.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Hardware Inventory Client Agent Properties

The hardware inventory client agent allows you to enable and configure hardware inventory settings for clients.

The hardware inventory client agent properties dialog box contains two tabs:

In This Section

Hardware Inventory Client Agent Properties: General Tab

Enables and schedules hardware inventory client agent settings.

Hardware Inventory Client Agent Properties: MIF Collection Tab

Specifies whether to collect Management Information Format (MIF) files from clients during hardware inventory.

See Also

Tasks

How to Configure Hardware Inventory for a Site


Hardware Inventory Client Agent Properties: General Tab

Use this tab to configure and schedule hardware inventory client agent settings.

Enable hardware inventory on clients

Enables hardware inventory for the site. When you select this check box, the hardware inventory agent is enabled on clients and hardware inventory runs according to the schedule specified.

Inventory schedule

Specifies when hardware inventory runs on clients in the site.

Simple schedule

Schedules hardware inventory to run at a single, specific interval for all clients in the site. By default, this option is selected. Although it allows less flexibility in scheduling, this method usually causes less network traffic than using a custom schedule because the time each client's inventory data file is sent is based on the client's install time. When you choose full schedule, all your clients run inventory at exactly the same time.

Run every

The number and type of time units (minutes, hours, or days) in the simple schedule. You can specify 1 to 60 minutes, 1 to 24 hours, or 1 to 31 days. By default, this interval is set to one week.

Custom schedule

Click Customize to open the Custom Schedule Dialog Box dialog box and set the hardware inventory schedule. Custom inventory schedules allow you the ability to schedule the first start date and time for inventory to run on clients. Once the initial start time for inventory to begin has passed, future hardware inventories will recur on the schedule that you specify. Hardware inventory custom schedules can be set to run weekly, monthly, or at a custom interval.

  • Custom weekly inventory schedules can run from 1 to 4 weeks on the day of the week specified.
  • Custom monthly inventory schedules can run from 1 to 12 months on either a specific day of the week from 1 to 31, the last day of each month, or the first, second, third, fourth, or last selected day of the week for each month.
  • Custom inventory schedules can also be set to run on a custom interval of either 1 to 31 days, 1 to 23 hours, or 1 to 31 days. This option differs from the simple schedule in that you can specify a start time for all clients to begin the inventory process.
This method allows greater control over when clients will conduct inventory, but also increases network traffic caused by all clients running inventory at the same time.

Note
If today is Wednesday and you set the inventory schedule to run every two weeks on Mondays, the next inventory collection will occur on the next Monday and alternate Mondays after that. The start date must match the day selected.

Maximum custom MIF file size (kb)

The maximum size, in KB, allowed for each custom MIF file that will be collected from a client during a hardware inventory cycle. You can specify a size between 1 and 5,000 KB. By default, this value is set to 250 KB.

Use this field to restrict the maximum size of each IDMIF file that is appended to the hardware inventory for each client. This setting does not affect the size of the normal hardware inventory data file.

Note
If a custom MIF file is larger than the maximum size allowed, the hardware inventory client agent will move the IDMIF file to the \Badmifs folder. In this case, the custom MIF file is not sent to the site server for processing.

See Also

Reference

Hardware Inventory Client Agent Properties: MIF Collection Tab


Hardware Inventory Client Agent Properties: MIF Collection Tab

Use this tab to specify whether to collect Management Information Format (MIF) files from Configuration Manager 2007 clients during hardware inventory.

In order for a MIF file to be collected by hardware inventory, it must be located in the correct location on the client system. By default, the files should be located as follows:

  • IDMIF files should be located in the Windows\System32\CCM\Inventory\idmif directory.
  • NOIDMIF files should be located in the Windows\System32\CCM\Inventory\noidmif directory.
Collect IDMIF files

Adds a new architecture—and attributes and classes—to the Configuration Manager 2007 site database.

IDMIF files are used to add information to the site database for objects other than Configuration Manager 2007 clients.

Collect NOIDMIF files

Extends the hardware inventory by adding attributes and classes to existing architectures on a client.

NOIDMIF files are used to extend, or add, new information about existing Configuration Manager 2007 clients to the site database.

See Also

Tasks

How to Change the Default MIF Storage Location

Other Resources

Hardware Inventory Client Agent Properties


Heartbeat Discovery Properties: General Tab

Use the General tab of the Configuration Manager 2007 Heartbeat Discovery Properties dialog box to enable Heartbeat Discovery for the site and to set the schedule for clients to send updated discovery data records (DDRs).

The General tab contains the following elements:

Enable Heartbeat Discovery

Enables Heartbeat Discovery for the site. This check box is selected by default.

Heartbeat schedule

Specifies how often clients send updated DDRs to management points.

By default, the heartbeat schedule is set to once every week. To change this, use the Send every drop-down list boxes to set a custom interval.

OK

Saves any changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Heartbeat Discovery

Concepts

About Heartbeat Discovery


Management Point Component Properties: General Tab

Topic last updated -- August 2007

Use this tab to specify the default management point for the site. You can specify whether the default management point is a physical management point or a network load balancing cluster virtual server.

Default management point

View or select a default management point for the site.

None

Indicates there is no default management point. Without a default management point for the site, clients assigned to the site will be unmanaged.

Management point

Indicates that a default management point for the site is established on the specified server name.

Server Name

Select a computer name among the site systems that have the management point role assigned.

Network Load Balancing cluster virtual server

Indicates that a network load balancing cluster virtual server serves as the default management point.

Important
When using a network load balancing (NLB) cluster virtual server as the default management point for Configuration Manager 2007 sites configured to operate in mixed mode, a Service Principal Name (SPN) must be configured for the NLB virtual server before configuring it as the default management point. For more information about configuring an SPN for NLB management point site systems, see How to Configure an SPN for NLB Management Point Site Systems.

IP Address

Select the type of IP address (either IPv4 or IPv6 format), and then enter the virtual IP address of the network load balancing cluster server.

Important
This option is not supported if the site is configured for native mode. Instead, specify a fully qualified domain name (FQDN).

FQDN

Type the fully qualified domain name (FQDN) of the network load balancing (NLB) cluster on the intranet if the NLB management points accept client connections on the intranet. This is a requirement for native mode sites.

Type the fully qualified domain name (FQDN) of the Internet-based network load balancing (NLB) cluster if the NLB management point accepts client connections from the Internet.

Note
Only sites in native mode can support Internet-based client management.

Additional configuration steps are required for NLB management points in mixed mode if the site is using automatic approval:

  • Locate the configuration steps provided in the Microsoft Windows Server 2003 article that explains how to configure Kerberos authentication for load balanced Web sites: http://go.microsoft.com/fwlink/?LinkId=92667 and follow the instructions in the article with the following two exceptions:
    • At the end of Phase 1: Administration of Domain Controller, add the domain user account to the local Administrators account on each server in the NLB cluster.
    • During Phase 2: Administration of Servers, add the domain user account to the application pool named CCM Windows Auth Server Framework Pool, rather than to the example application pool named DefaultAppPool.

See Also

Tasks

How to Configure the Default Management Point for a Site

Concepts

Configuration Manager Site Modes
Determine If You Will Use FQDN Server Names

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients


Network Access Protection Client Agent Properties

The Network Access Protection client agent in Configuration Manager 2007 allows you to enable and configure Network Access Protection (NAP) settings for clients that are NAP-capable.

The Network Access Protection client agent properties dialog box contains two tabs, which are described in the following section.

In This Section

Network Access Protection Client Agent Properties: General Tab

Enables the Network Access Protection client agent for the Configuration Manager 2007 site.

Network Access Protection Client Agent Properties: Evaluation Tab

Specifies how NAP-capable clients evaluate their compliance to produce a statement of health (SoH), and includes settings for tasks such as using local time or coordinated universal time, forcing a fresh scan for each evaluation, and setting the evaluation schedule.

See Also

Other Resources

Network Access Protection in Configuration Manager
How to Configure the Network Access Protection Client Agent


Network Access Protection Client Agent Properties: General Tab

Enabling or disabling Configuration Manager 2007 Network Access Protection (NAP) on clients is a site-wide setting. Once it is enabled, Configuration Manager 2007 can monitor NAP-capable computers on this site.

After enabling the Network Access Protection client agent, any information related to Network Access Protection will be reported in the Network Access Protection node under the sections NAP Remediation Statistics and Error Summary. For more information, see Network Access Protection Home Page.

Additionally, the following options will become available:

  • The Policies node under Network Access Protection in the Configuration Manager console, so that you can create, modify, and delete Configuration Manager NAP policies. If you have the Configuration Manager console open when you enable the Network Access Protection client agent, refresh the Network Access Protection node to display the Policies node.
    For more information about Configuration Manager NAP policies, see How to Configure Configuration Manager NAP Policies for Network Access Protection.
  • The Network Access Protection tab for a packaged software update under the Software Updates node.
  • The Network Access Protection page on the Distribute Software Updates Wizard.
Important
Do not enable the Network Access Protection client agent immediately on newly created Configuration Manager 2007 sites; instead, wait until the Configuration Manager site publication has fully replicated to the global catalog servers used by the System Health Validator points. This is particularly important if your Windows Network Policy Server will restrict clients with a compliance status of "Unknown," which maps to the Configuration Manager System Health Validator property of Vendor specific error code received.

This tab contains the following elements:

Enable Network Access Protection on clients

Select to enable Network Access Protection (NAP) for all NAP-capable clients assigned to this Configuration Manager 2007 site. Deselect to disable Network Access Protection for all NAP-capable clients assigned to this Configuration Manager 2007 site.

For more information about this option, see About Enabling and Disabling Network Access Protection.

For more information about NAP-capable clients, see About the NAP Client Status in Network Access Protection.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Install the System Health Validator Point

Concepts

About the Network Access Protection Process
About Configuration Manager NAP Policies in Network Access Protection
About Network Access Protection Remediation
About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection
Prerequisites for Network Access Protection

Other Resources

Planning for Network Access Protection


Network Access Protection Client Agent Properties: Evaluation Tab

These settings define how clients that support Network Access Protection (NAP) in Configuration Manager 2007 evaluate their compliance to produce a statement of health (SoH). NAP evaluation occurs by default when the client attempts to connect to the network, and on a recurring schedule.

For more information about the statement of health, see About the Statement of Health (SoH) in Network Access Protection.

Important
If you change the default evaluation schedule in this dialog box, ensure that you configure a value that is lower than the configured statement of health validity period on the System Health Validator point. If the compliance evaluation on the client occurs less frequently than the validity period, clients will be found non-compliant by the System Health Validator point.

In this scenario, remediation will instruct clients to re-evaluate their compliance and produce a current statement of health. This process might take a few minutes to complete, so if you are enforcing compliance with limited network access, computers will not be able to access network resources during this re-evaluation time.

This tab contains the following elements:

UTC (Coordinated Universal Time)

This setting defines whether clients evaluate their compliance with Configuration Manager 2007 NAP policies according to coordinated universal time (the default) or local time. Select this option if you want all clients in the site to use coordinated universal time. Cancel this selection if you want all clients in the site to use their configured local time.

The default setting is UTC (Coordinated Universal Time).

Force a fresh scan for each evaluation

Selecting this setting is the most secure configuration, but will result in a delay for connecting clients as they wait for their NAP evaluation to complete.

If this option is not selected, clients will return the cached results from their most recent NAP evaluation. How current that cached information is depends on the schedule configured in this dialog box.

The default setting is to not force a fresh scan for each evaluation.

Simple schedule

By default, NAP-capable clients reevaluate their statement of health with a simple schedule of every day, but this can be modified by changing the frequency and interval. Alternatively, you can select to configure a custom schedule.

Make sure that this setting is lower than the configured validity period on the System Health Validator point, or clients will more frequently go into remediation to produce a new statement of health. For more information about configuring the validity period, see How to Specify the Validity Period for the Statement of Health.

Custom schedule

This allows you to configure a start date and time for NAP reevaluation, with recurrence settings. To configure the custom schedule, click Customize.

Customize

When the Custom schedule is selected, this allows you to configure a start date and time with a recurrence pattern.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Tasks

How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection
How to Create a Configuration Manager NAP Policy for Network Access Protection

Concepts

About the NAP Client Status in Network Access Protection
About Compliance for Network Access Protection in Configuration Manager
About NAP Evaluation in Network Access Protection
About System Health Validator Points in Network Access Protection


Network Discovery Properties

The Network Discovery Properties dialog box displays configuration information about this discovery method within Configuration Manager 2007. All configuration of this method is made through the individual tabs in this dialog box.

To display this information, click the Discovery Methods node within Site Settings, right-click Network Discovery, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Network Discovery Properties: General Tab

Specifies whether the Network Discovery method is enabled, which type of discovery to conduct, and whether or not to compensate for a slow network.

Network Discovery Properties: Subnets Tab

Specifies the subnets for Configuration Manager to search during discovery.

Network Discovery Properties: Domains Tab

Specifies the domains for Configuration Manager to search during discovery.

Network Discovery Properties: SNMP Tab

Specifies the SNMP communities for Configuration Manager to search during discovery, as well as the maximum number of router hops that Network Discovery will make.

Network Discovery Properties: SNMP Devices Tab

Specifies SNMP devices that Configuration Manager will use to discover resources during Network Discovery.

Network Discovery Properties: DHCP Tab

Specifies DHCP servers that Configuration Manager will use to discover DHCP clients during Network Discovery.

Network Discovery Properties: Schedule Tab

Specifies the schedule that Configuration Manager uses to poll the specified Active Directory containers for system resources.

See Also

Concepts

About Configuration Manager Discovery
About Network Discovery

Other Resources

How to Manage Network Discovery


Network Discovery Properties: General Tab

Topic last updated—May 2008

Use the General tab of the Configuration Manager 2007 Network Discovery Properties dialog box to enable Network Discovery and specify what type of Network Discovery to run.

The General tab contains the following elements.

Enable Network Discovery

Enables this Network Discovery method for this site.

Type of discovery

Specifies what type of discovery you want the Network Discovery method to run.

The following options are available for selecting a discovery type:

  • Topology: Determines the topology of your network only, discovering IP subnets and routers. The extent of how much of your network is discovered will depend on the number of router hops selected on the SNMP tab. By default, this option is selected.
    For more information, see Topology-Only Network Discovery.
  • Topology and client: Determines the topology of your network, as well as potential client computers using an IP address. If a Microsoft DHCP server is specified on the DHCP tab, potential clients leasing an IP address from that DHCP server will be included here.
    If you have a large network, you might want to limit the number of router hops searched to reduce your network traffic. A maximum of 5000 potential clients per discovery is recommended.
    For more information, see Topology and Client-only Network Discovery.
  • Topology, client, and client operating system: Determines the topology of your network, as well as potential client computers and their operating systems and versions.
    For more information, see Topology, Client, and Operating System Network Discovery.
Enable discovery of out of band management controllers

Applies only to Configuration Manager 2007 SP1.

Specifies whether to include management controllers in the network discovery.

Important
Before management controllers can be discovered, you must install the out of band service point and configure a provisioning account. For more information, see How to Install the Out of Band Service Point and How to Add an AMT Provisioning and Discovery Account.

Management controllers are required for out of band management and must be provisioned. For more information about AMT provisioning, see How to Provision Computers for AMT.

Management controllers can also be discovered independently from network discovery. For more information, see the following topics:

  • How to Discover Computers with Management Controllers
  • How to Identify Computers That Can Support Out of Band Management
Network speed

Specifies whether you are on a slow network and whether Network Discovery should make allowances for network speed. If this option is selected, SNMP timeouts will be doubled and the number of SNMP sessions will be reduced. By default, this check box is cleared.

See Also

Tasks

How to Determine Your Network's Topology

Concepts

About Network Discovery

Other Resources

Network Discovery Properties
How to Manage Network Discovery


Network Discovery Properties: Subnets Tab

Use the Subnets tab of the Configuration Manager 2007 Network Discovery Properties dialog box to specify the subnets for Configuration Manager to search during discovery.

The Subnets tab contains the following elements:

Subnets to search

Specifies the subnets that you want to search during Network Discovery.

The following options are available for managing the subnets searched during a Network Discovery run:

  • New icon: Opens the New Subnet Properties dialog box to add subnet information to the discovery polling list and to initially enable the specific subnet search.
    Note
    Specifying a subnet does not guarantee that it will be searched, as this is influenced by the number of router hops selected. For more information, see About Router Hops in Network Discovery.

  • Property icon: Opens the <Name> Subnet Properties dialog box to view or modify subnet information for a specific subnet from the discovery polling list.
  • Delete icon: Removes the selected subnet from the discovery polling list. If Network Discovery has discovered resources in the subnet, it cannot be deleted.
    Note
    If a subnet was found by Network Discovery rather than being added by the administrator, it will reappear in the displayed list when this dialog box is reopened.

  • Enable/Disable icon: Enables or disables the selected subnet for Network Discovery.
The following columns are displayed for each subnet in the discovery polling list:

  • Subnet: Specifies a subnet number in IP format (for example: 131.24.10.0). This number can contain wildcards.
    Note
    When Network Discovery discovers resources in a subnet, that subnet is designated with a lock icon. These subnets cannot be deleted, but they can be disabled so that they will not be searched.

  • Mask: Specifies the subnet mask for the subnet number (for example, 255.255.255.0).
  • Name: Specifies the subnet name if it has one.
    Note
    Not all subnets have names, and a name is not needed for Network Discovery to work.

  • Search: Specifies whether the subnet will be searched the next time Network Discovery runs. Available options are Enabled and Disabled.
Search local subnets

Specifies whether subnets containing the server running Network Discovery will be searched. This option will be enabled by default.

See Also

Tasks

How to Search a Specific Subnet Using Network Discovery

Concepts

About Network Discovery

Other Resources

Network Discovery Properties
How to Manage Network Discovery


Network Discovery Properties: Domains Tab

Use the Domains tab of the Configuration Manager 2007 Network Discovery Properties dialog box to designate the specific domains for Configuration Manager to search during discovery.

The Domains tab contains the following elements:

Domains

Specifies the domains that you want to search during Network Discovery.

The following options are available for managing the displayed list of domains searched during the Network Discovery run:

  • New icon: Opens the Display Properties dialog box to add the name of a domain to add to the discovery polling list and to initially enable the specific domain search.
  • Properties icon: Opens the <Name> Domain Properties dialog box to edit the name of a specific domain on the discovery polling list.
  • Delete icon: Deletes a specific domain from the discovery polling list.
  • Enable/Disable icon: Enables or disables a specific domain for Network Discovery.
The following columns are displayed for each domain in the discovery polling list:

  • Name: Specifies the domain name.
  • Search: Specifies whether the domain will be searched the next time Network Discovery runs. Available options are Enabled and Disabled.
Search local domain

Specifies whether the domain containing the server running Network Discovery will be searched. This option is enabled by default.

See Also

Tasks

How to Search a Specific Domain Using Network Discovery

Concepts

About Network Discovery

Other Resources

Network Discovery Properties
How to Manage Network Discovery


Network Discovery Properties: SNMP Tab

Use the SNMP tab of the Configuration Manager 2007 Network Discovery Properties dialog box to designate the specific SNMP communities for Configuration Manager to search during discovery, as well as the maximum number of router hops that Network Discovery will make.

If possible, you should specify all the community names used in your network so that Network Discovery can more effectively search as many routers as possible. When Network Discovery encounters a new router, it uses the router's hardware cache (its net-to-media tables) to find additional subnets and other SNMP devices.

The SNMP tab contains the following elements:

SNMP community names

Specifies the names of SNMP community names that are processed by the Network Discovery method. Only the community name is displayed.

In processing these SNMP communities, Network Discovery tries names starting at the top of the displayed list and works down the list. Each community is retried once if it fails. Successful names are then remembered, and Network Discovery will try them first the next time it communicates with the routers that use that community name.

Note
Community names are case-sensitive.

The following options are available for managing the SNMP community associated with this method:

  • New icon: Opens the New SNMP Community Name dialog box to add a community name to the discovery polling list.
  • Delete icon: Deletes the selected community name from the discovery polling list.
  • Move Up icon: Moves the selected community name up one position on the displayed discovery polling list.
  • Move Down icon: Moves the selected community name down one position on the displayed discovery polling list.
Maximum hops

Specifies how many router hops to make beyond the server from which Network Discovery is launched. You can specify as many as 10 router hops using the drop-down list. The default value of 0 causes only the local subnet to be searched to discover resources.

For more information on router hops and their impact on Network Discovery, see About Router Hops in Network Discovery.

See Also

Tasks

How to Search a Specific SNMP Community Using Network Discovery

Concepts

About Network Discovery

Other Resources

Network Discovery Properties
How to Manage Network Discovery


Network Discovery Properties: SNMP Devices Tab

Use the SNMP Devices tab of the Configuration Manager 2007 Network Discovery Properties dialog box to designate specific SNMP devices that Configuration Manager will use to discovery resources by Network Discovery. These can be routers (the site server's default gateway is automatically included) or other SNMP-capable devices such as hubs and token ring media access units.

The SNMP Devices tab contains the following elements:

SNMP devices

Specifies the SNMP devices that you want to search during Network Discovery.

The following options are available for managing the SNMP Devices searched during a Network Discovery run:

  • New icon: Opens the New SNMP Device dialog box to add an SNMP device to the discovery polling list.
    Note
    You can use either an IP address or a device name to designate the specific device. However, if you use a device name, it must resolve to a valid IP address.

  • Delete icon: Removes the selected SNMP device from the discovery polling list.
The following columns are displayed for each subnet in the discovery polling list:

  • IP address: Specifies the IP address of an SNMP device on the network.
  • Name: Specifies the name of the SNMP device, if the SNMP device has a name.

See Also

Tasks

How to Search a Specific SNMP Community Using Network Discovery

Concepts

About Network Discovery

Other Resources

Network Discovery Properties
How to Manage Network Discovery


Network Discovery Properties: DHCP Tab

Use the DHCP tab of the Configuration Manager 2007 Network Discovery Properties dialog box to designate specific DHCP servers that Configuration Manager will use to discover DHCP clients during Network Discovery. Network Discovery reads the databases of Microsoft DHCP servers to find DHCP subnet scopes and resources that have an active IP address lease from the DHCP server.

For more information on the limitations of using DHCP servers for Network Discovery, see About DHCP Servers and Network Discovery.

The DHCP tab contains the following elements:

DHCP servers

Specifies the DHCP servers that you want to search during Network Discovery.

The following options are available for managing the DHCP servers searched during a Network Discovery run:

  • New icon: Opens the New DHCP Server dialog box to add an DHCP server to the discovery polling list.
    Note
    You can use either an IP address or a server name to designate the specific server. However, if you use a server name, it must resolve to a valid IP address.

  • Delete icon: Removes the selected DHCP server from the discovery polling list.
The following columns are displayed for each subnet in the discovery polling list:

  • IP address: Specifies the IP address of a DHCP server on the network.
  • Name: Specifies the name of the DHCP server.
Always use the site server's DHCP server

Specifies whether Network Discovery will always use the site server's DHCP server to discovery DHCP clients, even if it is not specified in the DHCP Servers polling list.

See Also

Tasks

How to Search a Specific DHCP Server Using Network Discovery

Concepts

About Network Discovery
About DHCP Servers and Network Discovery

Other Resources

Network Discovery Properties
How to Manage Network Discovery


Network Discovery Properties: Schedule Tab

Use the Schedule tab of the Configuration Manager 2007 Network Discovery Properties dialog box to set the schedule that Configuration Manager uses to poll the specified Active Directory containers for system resources.

New schedules and schedule changes go into effect as soon as they are written to the site control file. The delay in writing to the site control file will be very brief (often only a minute or so) when the site database is on the computer running Network Discovery. The delay will be longer if you are setting Network Discovery for a child site from the parent site because the update to the child's site control file depends on the schedule for the child site's address.

Note
If the scheduled time has already passed by the time the data is written to the site control file, the Network Discovery run will not begin until the next scheduled time. For example, if you set Network Discovery to run every Monday at 5:00 P.M., but the schedule is not written to the site control file until Monday at 5:01 P.M., then Network Discovery will not run until the following Monday at 5:00 P.M. To begin a Network Discovery run as soon as possible, allow sufficient time for the schedule to be written to the site control file before the scheduled start time

Each schedule runs Network Discovery as currently configured. Although you can have multiple schedules, it is not possible to assign different configurations of Network Discovery to different schedules.

The Schedule tab contains the following elements:

Schedule

Specifies the schedules currently set to run Network Discovery as currently configured.

The following options are available to manage your Network Discovery schedules:

  • New icon: Opens the Custom Schedule dialog box to add a new schedule to the schedule list. This schedule may be for a one-time only run, or be a recurring schedule.
  • Properties icon: Opens the Custom Schedule dialog box to modify a selected schedule from the schedule list as needed.
  • Delete icon: Deletes the selected schedule from the schedule list.

See Also

Tasks

How to Schedule Network Discovery

Concepts

About Network Discovery

Other Resources

Network Discovery Properties
How to Manage Network Discovery


Out of Band Management Properties

Topic last updated—March 2008

The Out of Band Management Properties dialog box displays information about how the out of band management component is configured.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Out of Band Management Properties: General Tab

Out of Band Management Properties: AMT Settings Tab

Out of Band Management Configuration Properties: Provisioning Settings Tab

See Also

Tasks

How to Install the Out of Band Service Point

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Out of Band Management Properties: General Tab

Topic last updated—May 2008

Use the General tab of the Out of Band Management Properties dialog box to configure information such as the Active Directory container in which to publish, the MEBx password, the option to automatically register an alias of ProvisionServer in DNS, the AMT provisioning certificate, and the issuing certification authority (CA) and certificate template to use when the out of band service point requests a Web server certificate for each computer that it provisions.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This dialog box contains the following elements.

Active Directory container

Displays the selected container name and path for publishing AMT-based computers during the Configuration Manager provisioning process.

Important
If the site will publish AMT-based computers from more than one domain, the same container path and name will be used for each domain, even though it is not displayed here.

The container must be created outside Configuration Manager, and the site server computer must have appropriate permissions to publish AMT-based computers to it. For more information, see How to Prepare Active Directory Domain Services for Out of Band Management.

There is no default for this setting.

Use Browse to navigate the Active Directory forest and select the container.

MEBx Account

Specifies the account in the Management Engine BIOS extension (MEBx) that is used for the initial authenticated access to manage AMT-based computers. For more information, see About the MEBx Account.

Specify your choice of password for the MEBx Account that Configuration Manager will configure in AMT during provisioning.

Click Set to specify the password. The password is case sensitive and must be at least 8 characters, with a maximum of 32 characters, together with at least one each of an uppercase, a lowercase, a numeric, and a symbol character. Symbol characters include ! @ # $ % ^ & * and exclude : (colon) “ ” (double quotes) _ (underscore).

AMT provisioning port (TCP)

Specifies the TCP port number used when the out of band service point communicates with AMT-based computers for provisioning. This number must match the value that is configured in the BIOS extensions of the AMT-based computers. Consult your computer manufacturer for more information.

The default TCP port number is 9971. Values can range from 1–65535.

Register ProvisionServer as an alias in DNS

Selecting this option results in the site server registering an alias (CNAME) DNS record of ProvisionServer for the out of band service point. This option might be appropriate if you are provisioning new computers out of band. For more information, see the following topics:

  • Decide Whether You Should Register an Alias for the Out of Band Service Point in DNS
  • How to Provision Computers for AMT
Important
Do not enable this option if the out of band service point is not yet installed.

This option is not selected by default.

Provisioning certificate

Displays the file that contains the exported AMT provisioning certificate that the out of band management component automatically installs in the site database and on the out of band service point and that will be used to provision computers for AMT.

Click Browse to select the exported provisioning certificate, and specify the password that was configured during the certificate export process. If you see an error indicating that the certificate is not a valid AMT provisioning certificate, verify that it has a .pfx extension and that the exported certificate has all the requirements listed in the topic Certificate Requirements for Out of Band Management.

Note
If Browse is disabled, check that you are running the Configuration Manager console directly from the site and not connected to it from a parent site. Configuration Manager prevents you from configuring the AMT provisioning certificate for a child primary site from a parent site because this would result in overwriting the AMT provisioning certificate in the parent site.

The certificate will be installed in the out of band service point's local certificate store when this site system role is installed. If the out of band service point is already installed, it periodically checks the certificate configured in the out of band management component and installs it if it is not already installed.

For more information about creating and preparing the AMT provisioning certificate, see the following topics:

  • How to Configure AMT Provisioning
  • Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management
There is no default for this setting.

Certificate template

Displays the Microsoft enterprise CA certificate template that the site server uses when requesting Web server certificates on behalf of AMT-based computers.

Click Select to choose the template to use.

For more information about creating the Web server certificate template for AMT provisioning, see the following topics:

  • How to Configure AMT Provisioning
  • Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management
For more information about certificate usage with out of band management, see About Certificates for Out of Band Management.

There is no default for this setting.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Concepts

About AMT Provisioning for Out of Band Management
About the MEBx Account
Certificate Requirements for Out of Band Management


Out of Band Management Properties: AMT Settings Tab

Topic last updated—May 2008

Use the AMT Settings tab of the Configuration Manager 2007 SP1 Out of Band Management Properties dialog box to specify configuration options related to AMT management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The AMT Settings tab contains the following elements.

AMT User Accounts

Specifies the administrative accounts that can manage AMT-based computers by using the out of band management console and specifies the administrative rights that each account has. For more information, see About the AMT User Accounts.

Important
Specify at least one AMT User Account if you will use the out of band management console.

Use the New icon to specify the Windows user account or security group, and then select the administrative permissions.

Use the Properties icon to modify a selected user account or security group.

Use the Delete icon to remove a selected user account or security group.

There are no accounts specified by default.

Default IDE-redirect image

Specifies the default value for the image file (with an .iso or .img file extension) to be used when an AMT-based computer is configured to restart using a boot image file located on the network or a device locally connected to the computer running the out of band management console. An alternative path and name can be supplied by the AMT user running the out of band management console.

AMT users who restart an AMT-based computer by using an image require the following security permissions to the IDE redirection path: Read, Read & Execute, Write, List Folder Contents.

Click Browse to specify a file on the network, or type it in using a UNC path and file name for a network location, or specify a local drive letter for a storage device that is attached to the computer running the out of band management console. If you select a local drive letter, the AMT user running the out of band management console must select the local file name before restarting a computer and using the IDE redirection option.

There is no default for this setting.

Enable Web interface

Enables or disables the ability for the AMT-based computer to display firmware information in the AMT Web browser. For more information, see How to Manage Computers Using the AMT Web Console.

This setting is not enabled by default.

Enable serial over LAN and IDE redirection

Enables or disables the options for serial over LAN and IDE redirection on the AMT-based computer.

This setting is not enabled by default.

Allow ping responses

Enables or disables the AMT management controller to respond to network ping requests when it is sent ICMP datagrams.

This setting is not enabled by default.

Enable BIOS password bypass for power on and restart commands

Enables or disables the ability to bypass a BIOS prompt for a configured password when powering on an AMT-based computer or restarting it.

This setting is enabled by default.

Enable support for Intel WS-MAN translator

Specifies that the Intel WS-MAN translator is installed on the out of band service point site system server and configured with default settings.

This setting is not enabled by default.

Kerberos clock tolerance (minutes)

Specifies the allowed clock tolerance between the management controller and the timestamp in received messages. Having a shorter value helps to eliminate replay attacks, but too short a value might result in valid connections being rejected.

The default setting is 5 minutes.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Update AMT Settings in Provisioned Computers Using Out of Band Management

Reference

AMT User Account Settings Dialog Box

Concepts

Overview of Out of Band Management

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Out of Band Management Configuration Properties: Provisioning Settings Tab

Topic last updated—May 2008

Use the Provisioning Settings tab of the Out of Band Management Properties dialog box to configure AMT Provisioning and Discovery Accounts. There are several circumstances in which you will need to configure an account before Configuration Manager can provision a computer for out of band management, or before Configuration Manager can discover whether the computer has a management controller that will support AMT provisioning. For more information, see Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This dialog box contains the following elements.

AMT Provisioning and Discovery Accounts

Specifies the name of the Remote Admin Accounts (by default, these are named admin) and the password as specified in the firmware for AMT-based computers. You can optionally specify a description for each account to help you identify the account.

These accounts are also used to discover AMT management controllers. For more information, see How to Discover Computers with Management Controllers.

Use the New icon to specify a new account for provisioning and discovery.

Use the Properties icon to modify a selected account.

Use the Delete icon to remove a selected account.

There are no default AMT Provisioning and Discovery Accounts.

Note
A strong password is enforced for these accounts. The password is case sensitive and must be at least 8 characters, with a maximum of 32 characters, together with at least one each of an uppercase, a lowercase, a numeric, and a symbol character. Symbol characters include ! @ # $ % ^ & * and exclude : (colon) “ ” (double quotes) _ (underscore).

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Concepts

About AMT Provisioning for Out of Band Management
About the AMT Provisioning and Discovery Account
Determine Whether to Configure an AMT Provisioning and Discovery Account for Out of Band Management


Remote Tools Client Agent Properties

Use the Configuration Manager 2007 Remote Tools Client Agent Properties dialog box to enable the remote tools client agent and to configure settings for access, security, notification and remote assistance.

Note
Remote Control in the control panel of Configuration Manager 2007 client computers is not visible unless the remote tools client agent is enabled.

In This Section

Remote Tools Client Agent Properties: General Tab

Specifies whether Configuration Manager 2007 remote tools are enabled, policy and notification settings and access levels.

Remote Tools Client Agent Properties: Security Tab

Specifies the Windows user and group names permitted to view and control client computers with Configuration Manager 2007 remote tools and remote assistance.

Remote Tools Client Agent Properties: Notification Tab

Specifies the default settings for client computers to indicate that a Configuration Manager 2007 remote control session is active.

Remote Tools Client Agent Properties: Remote Assistance Tab

Specifies settings for remote assistance and levels of access allowed.


Remote Tools Client Agent Properties: General Tab

Use this tab to specify whether the Remote Tools Client Agent is installed and started on client computers in the Configuration Manager 2007 site, and to specify access and notification settings to use when connecting to client computers.

The settings specified in this tab are downloaded to client computers according the Policy Polling Interval in the Computer Client Agent Properties (by default, every 60 minutes).

This tab contains the following elements:

Enable Remote Tools on clients

Specifies that the remote tools client agent will be installed on all client computers in the site. If you clear the check box, the remote tools client agent will not be installed on client computers, and you cannot use Configuration Manager 2007 for remote tools sessions.

Users cannot change Policy or Notification settings in the Remote Control Panel

Indicates that these settings cannot be changed on client computers. If this check box is selected, the values you set in the General and Notification tabs are enforced on all client computers in the Configuration Manager 2007 site. If this check box is cleared, client computers still receive these settings by default, but users can change the settings.

Ask for permission when an administrator tries to access clients

If this check box is selected, the client computer will display a message asking for the user's permission before allowing the remote tools session to take place.

Clients running Windows 2000: Level of access allowed

Specifies the level of access which will be granted to remote tools sessions running on Windows 2000 client computers. Available settings are:

  • No Access
  • Full Control
The default setting is Full Control.

Clients running Windows XP or later: Level of access allowed

Specifies the level of access which will be granted to remote tools sessions running on Windows XP or later client computers. Available settings are:

  • No Access
  • View Only
  • Full Control
The default setting is View Only.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Remote Tools
Tasks for Remote Tools


Remote Tools Client Agent Properties: Security Tab

Use this tab to specify the Windows user names and user group names permitted to view and control client computers using Configuration Manager 2007 remote tools, remote assistance and remote desktop.

Note
Changes made to remote desktop and remote assistance settings are only valid for sessions launched from the Configuration Manager console.

Permitted viewers

The list of Windows user names and user group names that may remotely access client computers.

New

Click to open the New Permitted Viewer dialog box, where you can add Windows user names or user group name to the Permitted viewers table.

Delete

Click to delete a selected user or user group from the Permitted viewers table. Deleting names from the table denies the selected user or group access to remote tools sessions, remote assistance and remote desktop.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Remote Tools
Tasks for Remote Tools
Remote Tools Security Best Practices and Privacy Information


Remote Tools Client Agent Properties: Notification Tab

Use this tab to configure how users are notified when their computer is being accessed remotely. You can specify whether users can change these notification settings in the Remote Tools Client Agent Properties: General Tab.

The settings specified in this tab are downloaded to client computers according the Policy Polling Interval in the Computer Client Agent Properties (by default, every 60 minutes).

Note
These settings apply only to Configuration Manager 2007 remote tools. They do not apply to remote assistance or remote desktop sessions initiated from the Configuration Manager console.

Display a visual indicator

Displays a visual indicator on the client computer to indicate that a remote tools session is in progress.

Show status icon on taskbar

The visual indicator is a remote tools icon which appears in the taskbar of the client computer.

Show indicator on desktop

The visual indicator is a small remote tools indicator window on the desktop of the client computer.

Play a sound

Plays an audible indicator that sounds on the client computer during a remote tools session at the times you specify.

When session begins and ends

Plays a sound on the client computer only when a Remote Tools session begins or ends.

Repeatedly during session

Plays a sound repeatedly on the client computer during the remote tools session.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Remote Tools
Tasks for Remote Tools
Remote Tools Security Best Practices and Privacy Information


Remote Tools Client Agent Properties: Remote Assistance Tab

You can use Configuration Manager 2007 to manage settings for remote assistance sessions where these are initiated from the Configuration Manager console.

This tab contains the following elements:

Configure unsolicited Remote Assistance settings

Selecting this check box allows Configuration Manager 2007 to manage unsolicited remote assistance sessions.

Unsolicited remote assistance sessions are those where the user at the client computer does not request assistance in order to initiate a session.

Configure solicited Remote Assistance settings

Selecting this check box allows Configuration Manager 2007 to manage solicited remote assistance sessions.

Solicited remote assistance sessions are those where the user at the client computer sends a request to the administrator for remote assistance.

Level of access allowed

Specifies the level of access which will be granted to remote assistance sessions initiated from the Configuration Manager console.

Available settings are:

  • Full Control
  • Remote Viewing
  • None
The default setting is None.

Note
The user at the client computer must always give permission for a remote assistance session to take place.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Remote Tools
Tasks for Remote Tools
Remote Tools Security Best Practices and Privacy Information


Remote Tools Client Agent Properties: Remote Desktop Tab

You can use Configuration Manager 2007 to manage settings for remote desktop sessions where these are initiated from the Configuration Manager console.

This tab contains the following elements:

Configure Remote Desktop Settings

Selecting this check box allows Configuration Manager 2007 to manage remote desktop sessions where these are initiated from the Configuration Manager console.

Allow permitted viewers to connect using Remote Desktop Connection

If selected, this option allows administrators in the remote tools Permitted viewers list to initiate remote desktop connections from the Configuration Manager console.

Require Network Level Authentication on computers running Windows Vista

Select this more secure option when you are running the Configuration Manager 2007 console on a computer running Windows Vista or you have upgraded the Remote Desktop Protocol (RDP) to a version that supports network level authentication. For more information about using RDP and network level authentication use the following link: http://go.microsoft.com/fwlink/?LinkId=90949

Disable Remote Desktop Connection

If selected, this option disables use of remote desktop from the Configuration Manager console.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Remote Tools
Tasks for Remote Tools
Remote Tools Security Best Practices and Privacy Information


Senders Properties

In This Section

Sender Properties: General Tab

Sender Properties: Advanced Tab


Sender Properties: General Tab

There are no editable properties on this tab.

Site server name | The server name that the sender is installed on.

See Also

Concepts

Configuration Manager Senders


Sender Properties: Advanced Tab

Topic last updated—November 2007

Use this tab to specify how many concurrent communications the Microsoft System Center Configuration Manager 2007 sender can make, and how often the sender should retry a failed communication.

Important
When configuring the total number of concurrent sending threads to be used when communicating with other sites, the total number of sending threads should be configured as a greater number than the threads configured for the per site setting. If the total number of sending threads is equal to the number configured to be used per site, and a receiving site is unavailable, it could cause all sending threads to become used when attempting to communicate with the unavailable site and prevent site-to-site communication to other sites.

Term | Definition
Maximum concurrent sendings | Specify the maximum number of simultaneous communications allowed for this sender and for each destination site. Keep in mind that higher numbers potentially allow more throughput, but at the expense of available network bandwidth. If your network becomes too busy, lower these numbers.
All sites | The maximum number of simultaneous communications allowed for this sender. The default value is 5. These communications can be destined for different sites, or all for the same site, except as restricted by the maximum value specified in Per site.
Per site | The maximum number of simultaneous communications allowed to any single destination site. The default value is 3. For RAS Senders, this field is disabled and set to 1.
Retry settings | Specify the action taken by the sender if the first communication fails.
Number of retries | The number of times that a failed communication is retried. The default value is 2.
Delay before retrying | The number of minutes to wait between retries of a failed communication. The default value is 1.

See Also

Concepts

Configuring Site Communications


Site Maintenance Properties

Configuration Manager 2007 sites require regular maintenance to provide services effectively and continuously.

You can create maintenance tasks customized to your organization by creating new SQL commands. Configuration Manager 2007 also provides several predefined site maintenance tasks that you can use to regularly maintain the Configuration Manager 2007 site database to ensure that it stays healthy.

In This Section

Site Maintenance: SQL Commands

Custom maintenance tasks which run directly against the Configuration Manager 2007 site database.

Site Maintenance: Tasks

Predefined maintenance tasks which continually remove out-of-date data from the Configuration Manager 2007 site database.

See Also

Other Resources

Site Settings Property Pages


Site Maintenance: SQL Commands

Valid SQL commands can be used to create custom maintenance tasks which run directly against the Configuration Manager 2007 site database.

Custom maintenance tasks can be created by entering either a single SQL command or the name of an existing SQL stored procedure that contains multiple SQL commands.

Important
SQL commands are not validated by Configuration Manager 2007 for syntax. Before you schedule a custom maintenance task, ensure that the SQL command is valid by testing it in SQL Server Management Studio.

Name

Specifies the name of the selected command. You must enter the command exactly as you want it to be passed to SQL Server (no syntax checking is performed). For example, to run the stored procedure that displays the overall space usage of the database, enter sp_spaceused.

Enable SQL Command

Enables the selected command. You must enable the command to schedule it.

SQL command

Enables you to type in the SQL command you want to run.

Note
To move to the next line when entering SQL commands, press CTRL+ENTER.

Log status to

Specifies the logging file and path for status generated when the command is run. The path can be any valid network path (for example, \\<myserver>\logs\command1.log). The logs can be viewed with any basic text editor, such as Notepad.

Note
If you do not supply the log path, status will not be logged for the command.

Schedule

Specifies the schedule to run the selected task.

Start after

Specifies the earliest time that the selected task can begin.

Latest start time

Specifies the latest time that the selected task can begin.

Monday through Sunday

Specifies the days to run the task. You can specify each day independently. For example, you could schedule a task to run only on Sunday, or on Monday, Wednesday, and Friday.

See Also

Tasks

How To Create a Custom Maintenance Task

Concepts

Custom Maintenance Tasks


Site Maintenance: Tasks

Use this tab to enable and schedule a site maintenance task.

UI Element List

Name

The name of the selected task.

Enable this task

Enables the selected site maintenance task. You must enable the task to schedule it.

Delete data older than

Number of days that data will remain in the database before it is deleted.*

Client rediscovery period

Number of days.

Backup destination

Backup folder location for backup task.

Schedule

The task runs recurrently on the days and time you specify.

Start after

The earliest time that the selected task can begin. This time must be before Latest start time; otherwise, the task will never run.

Latest start time

The latest time that the selected task can begin. This time must be after Start after; otherwise, the task will never run.

Monday through Sunday

The days to run the task. You can specify each day independently. For example, you can schedule a task to run only on Sunday, or on Monday, Wednesday, and Friday.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for the general tab.

Note
Not all maintenance tasks will have the same configurable options.

See Also

Other Resources

Predefined Maintenance Tasks
Site Maintenance Properties


Site Management Properties

In This Section

Site Management Properties: General Tab


Site Management Properties: General Tab

This Microsoft System Center Configuration Manager 2007 dialog box has no configurable properties. The General tab contains the following elements:

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Other Resources

Site Management Properties


Site Properties

The site properties tabs are used to configure Microsoft System Center Configuration Manager 2007 site properties.

In This Section

Site Properties: General Tab

Used to view the selected Configuration Manager 2007 site's properties and to add, change, or remove its parent site, which reconfigures your site hierarchy.

Site Properties: Wake On LAN Tab

Allows you to enable or disable Wake On LAN for the site and specify whether wake-up packets will be transmitted using unicast or subnet-directed broadcast.

Site Properties: Ports Tab

Used to specify the communication ports that Configuration Manager 2007 clients use in this site.

Site Properties: Site Mode Tab

Used to specify whether the site will operate in native mode or mixed mode, and the site mode related settings

Site Properties: Advanced Tab

Used to specify Configuration Manager 2007 publishing to Active Directory Domain Services, publishing to DNS, and child site connection security requirements


Site Properties: General Tab

Use this tab to view the selected Microsoft System Center Configuration Manager 2007 site's properties and to add, change, or remove its parent site, which reconfigures your site hierarchy.

Comment

Optional comments that describe the site.

Type

Either Primary or Secondary, indicating whether the current site is a primary site or a secondary site.

Version

The version of Configuration Manager 2007 that is running. The format is <major version number>.<minor version number>.<build number>.<hotfix number>

Build number

The build number of Configuration Manager 2007 that is running. The build number can be helpful in diagnosing problems and creating workarounds.

Site server

The name of the computer running the Configuration Manager 2007 site software.

SQL Server

The name of the computer running SQL Server 2005 and hosting the site database.

SMS Provider location

The name of the computer that the SMS Provider is installed on.

Installation directory

The folder that contains Configuration Manager 2007 files on the site server.

Parent site

The current site's parent site. If the current site is a central site, this field contains None.

If this site has no parent site, it is considered a central site, even if it has no child sites, which is also called a standalone site.

Set Parent Site

Opens the Set Parent Site dialog box, which enables you to add, change, or remove the parent site of the current.

When you change a site's parent, you reconfigure the site hierarchy.

See Also

Reference

Site Properties: Advanced Tab
Site Properties: Ports Tab
Properties - Security Tab
Site Properties: Site Mode Tab
Site Properties: Wake On LAN Tab

Other Resources

Site Properties


Site Properties: Wake On LAN Tab

Topic last updated—May 2008

The Wake On LAN tab in the site properties allows you to enable or disable Wake On LAN for the Configuration Manager 2007 site for scheduled activities such as a software update deployment with a deadline, and a mandatory advertisement. You can also configure whether wake-up packets are sent using subnet-directed broadcast or unicast transmissions.

If you have Configuration Manager 2007 SP1 and you are using out of band management, you can additionally enable or disable power on commands that are sent from the out of band service point. To help you choose between using wake-up packets and power on commands, see Choose Between Power On Commands with Out of Band Management and Wake-Up Packets for Wake On LAN.

For more information about Wake On LAN in Configuration Manager 2007, see Overview of Wake On LAN.

For more information about out of band management in Configuration Manager 2007 SP1, see Out of Band Management in Configuration Manager 2007 SP1.

Note
This tab is not enabled for secondary site servers. Wake-up packets are sent from the primary site server only, and the out of band service point cannot be installed in a secondary site.

The Wake On LAN tab contains the following elements.

Enable Wake On LAN for this site

Enables or disables Wake On LAN for the site.

This option is not enabled by default.

Use power on commands if the computer supports this technology; otherwise, use wake-up packets.

Applies only to Configuration Manager 2007 SP1.

Specifies that for scheduled activities, power on commands will be sent from the out of band service point to computers that are provisioned for out of band management. For computers that are not provisioned for out of band management, wake-up packets will be sent by using subnet-directed broadcast or unicast transmissions.

If Wake On LAN is enabled, this option is enabled by default.

Use power on commands only

Applies only to Configuration Manager 2007 SP1.

Specifies that for scheduled activities, only power on commands will be sent from the out of band service point to computers that are provisioned for out of band management.

Use wake-up packets only

Applies only to Configuration Manager 2007 SP1.

Specifies that for scheduled activities, only wake-up packets will be sent, using subnet-directed broadcast or unicast transmissions.

Subnet-directed broadcasts

Selects subnet-directed broadcasts as the transmission method of sending wake-up packets to computers.

For more information about using subnet-directed broadcast packets for wake-up packets, see About Subnet-Directed Broadcast Wake-Up Packets for Wake On LAN.

This option is not available if Use power on commands only is enabled.

Unicast

Selects unicast as the transmission method of sending wake-up packets to computers.

This option is not available if Use power on commands only is enabled.

This is the default setting when wake-up packets are used for scheduled activities.

For more information about using unicast packets for wake-up packets, see About Unicast Wake-Up Packets for Wake On LAN.

Advanced

Displays the Wake On LAN Advanced Properties dialog box to view or configure advanced settings for sending wake-up packets. This includes the number of transmission retries, the maximum number of wake-up packets to be transmitted before pausing, and the transmission offset time period.

For more information, see Wake On LAN Advanced Properties Dialog Box.

This option is not available if Use power on commands only is enabled.

To specify transmission configurations for out of band management in Configuration Manager 2007 SP1, see How to Configure Power On Transmissions for Scheduled Wake-Up Activities.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Administrator Checklist: Enabling Wake On LAN
Choose Between Unicast and Subnet-Directed Broadcast for Wake On LAN
Prerequisites for Out of Band Management
Prerequisites for Wake On LAN

Other Resources

Wake On LAN in Configuration Manager
Out of Band Management in Configuration Manager 2007 SP1


Site Properties: Ports Tab

Use this tab to specify the ports that Configuration Manager 2007 uses for the following client communication:

  • Client requests: Either HTTP for mixed mode or HTTPS for native mode. You can specify a default port and an alternate port, which is used when migrating clients to a custom Web site.
  • Wake On LAN: Transmissions using UDP packets to wake up computers.

This tab contains the following elements:

Active Ports

Lists the services used by the ports, the assigned port numbers, and descriptions of the ports used.

Properties icon

Opens the Port Detail dialog box, which allows you to modify the selected entry in the Active Ports table.

Service

Describes the service provided by each of the ports specified. Enabling the service check box allows client connections to be accepted on the port specified.

Note
At least one default client requests service using HTTP and one default client requests service using HTTPS is required.

You must specify an alternate client requests service if you implement a custom Web site.

Port

Specifies the port number to use for each service. Valid port numbers range from 1 to 65535. The default values for the ports are as follows:

  • HTTP: TCP 80
  • HTTPS: TCP 443
  • Wake On LAN: UDP 9
    Important
    If you use nondefault port numbers, it might not be supported by the network infrastructure, such as routers, firewalls, and proxy servers.

    Note
    Port settings cannot be changed for secondary sites because secondary sites inherit port settings from their parent site.

Description

User-defined name of the service (maximum 50 characters). The default client requests services are identified by (Default) at the beginning of the description.

Use custom web site

Enables the use of a custom Web site for client communications instead of the default Web site on site systems requiring Internet Information Services (IIS).

When the use of a custom Web site is enabled for a site, all client communications within the site will be directed to the custom Web site of site systems instead of the default Web site in IIS.

Before enabling the use of a custom Web site for client communication in the Configuration Manager console, you must manually create a custom Web site named SMSWEB on all site systems that require IIS in the site.

For more information about configuring a custom Web site for Configuration Manager sites see, How to Configure Custom Web Sites for Configuration Manager Sites.

Note
Custom Web site settings cannot be changed for secondary sites because secondary sites inherit custom Web site settings from their parent site.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the Site Properties: Ports Tab help documentation.

See Also

Reference

Site Properties: General Tab
Site Properties: Wake On LAN Tab
Site Properties: Advanced Tab
Site Properties: Site Mode Tab

Concepts

Configuration Manager Tasks for Configuring a Single Site
Port Detail Dialog Box
Ports Used by Configuration Manager
Firewall Settings for Configuration Manager Clients


Site Properties: Site Mode Tab

Topic last updated—January 2008

The Site Mode tab defines whether the Configuration Manager 2007 site will operate in native mode or mixed mode, and the site mode related settings. Site modes are used to specify how clients will communicate with the site. To select the mode that the site will operate in, select either Native or Mixed from the Site mode selection drop down list.

This tab is not visible when viewing the properties of a secondary site. Secondary sites inherit the settings contained on the site mode tab from their parent site.

Important
To ensure clients do not become unmanaged as a result of changing the site mode from mixed to native, see Administrator Checklist: Migrating a Site to Native Mode.

After selecting the site mode, the options displayed depend on whether you have selected native mode or mixed mode.

Note
If you change the site mode from mixed to native and you have a network load balancing (NLB) management point that is specified with an IP address, you must reconfigure this to use a fully qualified domain name (FQDN) instead. Until you reconfigure the NLB management point with an FQDN, clients will be unable to contact their default management point and will be unmanaged. For more information, see How to Configure the Intranet FQDN of an NLB Management Point.

Native Mode Settings Properties

If you select native mode site operation, the following native mode properties are displayed.

Site server signing certificate

Specifies the site server signing certificate, which is a requirement to configure the site to use native mode operation. This certificate must already be deployed to the site server externally to Configuration Manager 2007. You cannot configure native mode without specifying this certificate.

Note
The site server signing certificate must be configured directly on each primary site database. You cannot configure the site mode for a child primary site from a parent primary site because the certificate cannot be validated correctly in this scenario.

For more information about the PKI certificate requirements, see Certificate Requirements for Native Mode

For more information about deploying the PKI certificates required for native mode, see Deploying the PKI Certificates Required for Native Mode

Certificate

Specifies the site server signing certificate for the site.

If the certificate has been selected, this will display either the friendly name of the certificate if the certificate has a friendly name, or <No friendly name> if the selected certificate does not have a friendly name.

If the certificate is not yet specified, click Browse to select it, or you can type in the thumbprint in the Thumbprint text box.

This certificate is used by the site server to sign client policies. To accept policies signed by this certificate, clients must also have a copy of the site server signing certificate. For more information, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)

Browse

Browses to the certificate store on the site server so that you can select the site server signing certificate from the list of certificates displayed. Specifying the wrong certificate could result in the site being unmanaged, so the certificate you select will be validated for the following:

  • The certificate is within its validity period and has not expired.
  • The certificate has the correct certificate subject name, which includes the site code of the site.
  • The certificate purpose includes document signing.
Thumbprint

If you cannot browse to the site server's certificate store (for example, you do not have appropriate permissions), but you have the certificate's thumbprint, you can enter it here. The thumbprint must be entered as a sequential string of hexadecimal characters. To eliminate typing errors, copy and paste the string from the certificate itself.

Note
You can copy the thumbprint using the Microsoft Certificates MMC snap-in. On the computer where it is stored, navigate to the Local Computer, Personal store, and expand Certificates. Double-click the certificate, and then click the Details tab. Scroll through the files and click Thumbprint. Copy the string of hexadecimal numbers that is displayed in the text box.

When you enter the thumbprint, Configuration Manager 2007 will attempt to match it with a valid certificate on the site server's certificate store. If this is successful and the certificate is validated successfully, the friendly name will be displayed against the Certificate option.

Operating system deployment settings

Specifies settings related to operating system deployment when the site is operating in native mode. These settings are inherited by secondary sites, but not child primary sites.

Specify Root CA Certificates

Opens the Specify Root CA Certificates dialog box, which allows you to import exported root certification authority certificates for clients that are assigned to the site. These might be required for operating system deployment clients to complete installation.

For information about preparing the root certification authority certificates, see How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients.

Client settings published to Active Directory

Specifies the native mode site settings that are published to Active Directory Domain Services for client computers, and are automatically used with client push installations.

Client computers that can access these settings in Active Directory Domain Services are configured with these values periodically, including when site assignment succeeds, on startup and every 25 hours.

If client computers do not use the default settings, specify these options with CCMSetup installation properties if any of the following scenarios apply:

  • The Active Directory schema is not extended for Configuration Manager 2007.
  • The Active Directory schema is extended for Configuration Manager 2007 but you have clients that cannot access these settings because they are workgroup clients or are from another Active Directory forest.
  • You want to specify different client settings for installation only.
For more information about the command line properties, see About Configuration Manager Client Installation Properties.

Enable CRL checking on clients

Specifies whether Configuration Manager client computers use a certificate revocation list (CRL) before using the PKI certificates required for native mode.

The default for this setting is to enable CRL checking.

For more information, see Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)

Allow HTTP communication for roaming and site assignment

Specifies whether native mode client computers can use HTTP if they roam to a mixed mode site so that they can communicate with the resident management point for content location, and download content from that site's distribution points.

Additionally, HTTP is required for communication with a server locator point, which is required for site assignment if the Active Directory schema is not extended for Configuration Manager 2007, and also if native mode client computers use a network load balancing management point on the intranet and cannot locate this from Active Directory Domain Services.

The default for this option is not to allow HTTP communication for roaming and site assignment.

For more information about this option, see Decide If You Need to Configure HTTP Communication for Roaming and Site Assignment (Native Mode)

Certificate store

Specifies the location of the client certificate to use in native mode.

The default location is the Personal store in the Computer certificate store. If the client certificate has been deployed to an alternate location in the Computer store, specify it here.

Certificate selection criteria

Specifies the selection criteria to use if more than one valid certificate is found in the specified certificate store.

The default setting is to check only the certificate purpose. To specify the certificate selection criteria, select one of the following options, and then specify any associated value:

  • Check only certificate purpose: This option does not use the subject name or the subject alternative name when selecting certificates. Instead, certificates are selected only on the intended purpose of the certificate, which must include client authentication. This is the default certificate selection criteria.
  • Subject contains string: The string match on the subject name in the certificate is a case-insensitive match. This selection criteria is appropriate if you are using the fully qualified domain name of a computer, and you want the certificate selection to be based on the domain suffix, for example contoso.com. However, you can use this selection method to identify any string of sequential characters that differentiate the certificate from others in the client certificate store
  • Subject or alt includes attributes: The attribute identification is a case-sensitive match on the subject name, or subject alternative name field in the certificate. This selection criteria is appropriate if you are using X.500 distinguished names or equivalent object identifiers, in accordance with RFC 3280, and you want the certificate selection to be based on the attribute values. Specify only the attributes and their values that you require to uniquely identify or validate the certificate and differentiate the certificate from others in the client certificate store. The order in which the attributes are entered has no significance. For a list of attribute values that are supported for certificate selection criteria, refer to the table in Determine If You Need to Specify Client Certificate Settings (Native Mode). The following examples define certificate selection criteria by using object identifier attributes and by using distinguished names attributes:
    • Example 1: 2.5.4.8 =Maryland, 2.5.4.6 =US, 2.5.4.10= Lucerne Publishing, 2.5.4.11 =Sales
    • Example 2: ST=Maryland, C=US, O= Lucerne Publishing, OU=Managed Computers
If multiple certificates match criteria

Specifies the action to take if Configuration Manager finds more than one valid certificate based on the settings specified:

  • Select any certificate that matches: Of the certificates found that matched the selection, one will be chosen at random. If the client is running Configuration Manager 2007 SP1, the certificate with the longest validity period is selected. If a connection is not successfully made with this certificate, the other certificates found will not be tried and the client will send an error message to its assigned fallback status point.
  • Fail selection and send error message: None of the certificates will be used to attempt a connection. Instead, the client will not attempt communication with its management point, and instead it will send an error message to its assigned fallback status point. This is the default configuration.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the Site Properties: Site Mode Tab help documentation.

Mixed Mode Settings Properties

If you select mixed mode site operation, the following mixed mode properties are displayed.

Approval Settings

Specifies the client approval settings to use when authorizing computers to be fully managed in a mixed mode site.

Approve clients in a mixed mode site to verify client identity. Ensure that you select a client approval method that fits your risk profile. For more information about securing clients, see Best Practices for Securing Clients, and for more information about approval, see About Client Approval in Configuration Manager.

Note
Changing the site approval method will not automatically reset the approval status of clients already assigned to the site. The new setting will take effect for newly assigned clients only.

Manually approve each computer

Manually approving every computer in the site introduces the least risk, but the largest administrative overhead. Clients must be manually approved from within the Configuration Manager console. Reference the procedure "To approve clients manually" in How to Approve Configuration Manager Clients.

Automatically approve computers in trusted domains (recommended)

Automatically approving computers in trusted domains automatically authorizes client computers joined to domains trusted by the site server's domain.

Important
If your Configuration Manager 2007 hierarchy spans multiple domains, the management point must be configured with an intranet FQDN to approve clients that are in a different domain to the site server's domain.

For more information, see How to Configure the Intranet FQDN of Site Systems and Determine If You Will Use FQDN Server Names.

When using this setting, you should ensure that you have other security controls in place to prevent untrustworthy computers from joining a trusted domain.

Automatically approve all computers (not recommended)

Automatically approving all computers will authorize any computer that requests assignment with the site. This setting is never recommended because it allows any computer to receive potentially sensitive data without verifying trustworthiness.

This site contains only ConfigMgr 2007 clients.

Regardless of the client approval method selected, this setting enables stronger client communication security settings available for Configuration Manager clients that are incompatible with SMS 2003 client communication settings. Before enabling this setting, ensure that you have no SMS 2003 clients in the site.

Client Settings

Specifies client data encryption settings for client information sent to management points.

Encrypt data before sending to management point.

Select this setting to encrypt data sent from clients to management points within the site.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the Site Properties: Site Mode Tab help documentation.

See Also

Tasks

How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

Concepts

Configuration Manager Site Modes
Choose between Native Mode and Mixed Mode
About Client Approval in Configuration Manager
Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)
Determine If You Need to Specify Client Certificate Settings (Native Mode)
Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode)
Renewing or Changing the Site Server Signing Certificate
About Configuration Manager Client Installation Properties

Other Resources

Deploying the PKI Certificates Required for Native Mode


Site Properties: Advanced Tab

Use this tab to specify Microsoft System Center Configuration Manager 2007 publishing to Active Directory Domain Services, publishing to DNS, and child site connection security requirements.

This tab contains the following elements:

Publish this site in Active Directory Domain Services

Publishes Configuration Manager 2007 site data to Active Directory Domain Services.

If you clear this check box, the following message appears:

"You have chosen to disable publishing of identity data into Active Directory. This will not delete the identity data that is already published. You must manually delete this data from Active Directory."

Caution
After Configuration Manager 2007 site data is published in Active Directory Domain Services, the published data persists in Active Directory Domain Services unless it is manually removed. If Active Directory Domain Services publishing is disabled and the default management point is changed, existing Configuration Manager clients continue contacting the previously defined management point until Configuration Manager 2007 data is deleted from Active Directory Domain Services.

Publish the default management point in DNS (intranet only)

Select this check box to publish the default management point in DNS as a Service Location (SRV) record.

This option is only relevant if this site system is configured with the management point role.

Require secure key exchange between sites

Select this check box to allow communication between this site and Configuration Manager 2007 child sites only when keys are securely exchanged. Secure key exchange between sites is enabled by default for Configuration Manager 2007 sites.

Important
If the Require secure key exchange between sites check box is enabled and the site is not publishing site data to Active Directory Domain Services, you must use the hierarchy maintenance tool (Preinst.exe) to manually copy the child site's public key to the parent site.

Conflicting Records

Lets you decide if you want Configuration Manager 2007 to create new client records when it detects duplicate hardware IDs or if you want to manually decide to merge, block, or create new records. The default is to Automatically create new client records for duplicate hardware IDs because this allows sites to upgrade from SMS 2003 without requiring manual intervention if there are many conflicting records. Selecting Manually resolve conflicting records requires more administrative overhead, but helps remove the possibility of having clients in the database with duplicate hardware IDs.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Manage Conflicting Records for Configuration Manager Clients
How to Verify Site Information is Published to Active Directory Domain Services

Reference

Site Properties: General Tab
Site Properties: Wake On LAN Tab
Site Properties: Ports Tab
Site Properties: Site Mode Tab

Concepts

Configuration Manager Tasks for Configuring a Single Site
How to Use the Hierarchy Maintenance Tool (Preinst.exe)


Site System Properties

Site systems are computers running supported Windows server operating systems or server shares that provide Microsoft System Center Configuration Manager 2007 functionality to your site. Each site system hosts one or more roles to support a Configuration Manager 2007 site. Some site system roles can be assigned to site systems within the site by configuring the site system, while other roles are automatically assigned by the system and cannot be configured.

See Also

Reference

ConfigMgr Component Server Properties
ConfigMgr Device Management Point Properties: General Tab
ConfigMgr Distribution Point Server Share Properties: General Tab
ConfigMgr Fallback Status Point Properties: General Tab
ConfigMgr Management Point Properties: General Tab
ConfigMgr Reporting Point Properties: General Tab
ConfigMgr Site Server Properties: General Tab
ConfigMgr Server Locator Point Properties: General Tab
ConfigMgr Site Database Server Properties: General Tab
Site System Server Share Properties: General Tab
ConfigMgr Software Update Point Properties
State Migration Point Properties: General Tab
ConfigMgr System Health Validator Point Properties: General Tab

Concepts

Configuration Manager Site System Planning

Other Resources

ConfigMgr PXE Service Point Properties


Site System Status Summarizer Properties

The Configuration Manager 2007 Site System Status Summarizer Properties dialog box allows you to enable and configure status summarization for site systems in the Configuration Manager 2007 site.

Click any link in the following section for details about the associated tab in the Site System Status Summarizer Properties dialog box:

In This Section

Site System Status Summarizer Properties: General Tab

Enables or disables site system status summarization and configure replication settings.

Site System Status Summarizer Properties: Thresholds Tab

Displays the free space thresholds, which are used to specify the status of each Configuration Manager 2007 site system.

See Also

Tasks

How to View the Status of Site Systems

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Site System Status Summarizer Properties: General Tab

Use the General tab of the Configuration Manager 2007 Site System Status Summarizer Properties dialog box to enable and configure status summarization in the Configuration Manager 2007 site. Status summarizers count data and events from status messages and display this data in the System Status node of the Configuration Manager console.

This tab contains the following elements:

Enable status summarization

Enables summarization of site system status messages on this Configuration Manager 2007 site.

Replicate to parent site

Enables the passing of summarization data from this site to the parent site.

Replication priority

Specifies the sending priority to use when replicating summarization from the drop-down menu. You can choose from:

  • Low
  • Medium
  • High
Status summarization schedule

Displays how often site system summarization occurs at this Configuration Manager 2007 site. The default is 1 hour.

Schedule

Opens the Custom Schedule dialog box, which you can use to specify how often site system status summarization occurs.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to View the Status of Site Systems

Concepts

Using Status Messages for Configuration Manager Troubleshooting
About Data Priorities


Site System Status Summarizer Properties: Thresholds Tab

Use the Thresholds tab of the Configuration Manager 2007 Site System Status Summarizer Properties dialog box to view the free space thresholds that are used to specify the status of each Configuration Manager 2007 site system.

This tab contains the following elements:

Default thresholds

Displays the default free space status message thresholds for all storage objects in all site systems in the site. If the free disk space falls below these thresholds, the status of the site system changes to Warning or Critical.

The default values are 102,400 KB (Warning) and 51,200 KB (Critical).

Warning

Displays the threshold that, when crossed, changes the status of a site system to Warning in the Site System Status Summarizer.

Critical

Displays the threshold that, when crossed, changes the status of a site system to Critical in the Site System Status Summarizer.

Specific thresholds

Displays the thresholds (if any) set for specific storage objects.

Storage object

Displays any site system storage object with custom-specified threshold values.

Warning threshold

Displays the threshold that, when crossed, changes the status of a site system to Warning in the Site System Status Summarizer.

Critical threshold

Displays the threshold that, when crossed, changes the status of a site system to Critical in the Site System Status Summarizer.

New

Click to open the Free Space Threshold Properties dialog box, which enables you to specify a new storage object and set its thresholds.

Properties

Click to open the Free Space Threshold Properties dialog box for the selected storage object, which enables you to modify its thresholds.

Delete

Click to delete the selected storage object thresholds.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to View the Status of Site Systems


Site System Properties: General Tab

Topic Last Updated—August 2008

Use this tab to specify the configuration of site systems in a Configuration Manager 2007 site. A site system is a server or share that provides functionality to the site, depending on the assigned role. A site system can perform one or more roles.

This tab applies to all site system types (such as server computers and server shares).

This tab contains the following elements:

Name:

Displays the name of the selected site system and is not editable. If the name is incorrect, delete the site system and reinstall it with the correct name. For more information about deleting site systems, see How to Delete a Site System.

Specify a fully qualified domain name (FQDN) for this site system on the intranet.

Enables or cancels the intranet FQDN text box, which allows you to specify an intranet FQDN for the site system.

An FQDN is required for many scenarios in Configuration Manager including the following:

  • Automatic approval of trusted clients in mixed mode
  • Native mode if the site system PKI certificate uses an FQDN as specified in Certificate Requirements for Native Mode.
  • Environments that have multiple domains and do not use a fully replicated WINS.
Configuring an FQDN is also recommended if this site system will host the default management point that will publish to Domain Name System (DNS).

For more information, see Determine If You Will Use FQDN Server Names and Determine If You Need to Publish to DNS.

Intranet FQDN

Enter a fully qualified domain name (FQDN) for the site system on the intranet. This can be the same FQDN as the server's network configuration, or it can be a CNAME (alias) configured on the intranet DNS.

Note
If you use a CNAME (DNS alias) rather than the computer name as your FQDN, you might need to register this as a Kerberos service principal name (SPN), so that IIS authentication succeeds. Use the Setspn utility that ships with Windows Server support tools to register the CNAME as an SPN in Active Directory Domain Services. For more information, see Troubleshooting Configuration Manager Client Issues.

If the site is in native mode, the intranet FQDN you specify here must match the intranet FQDN specified in the server's certificate subject name (or subject alternative name). For more information about the certificates for native mode, see Certificate Requirements for Native Mode.

Enter an FQDN that adheres to RFC 1123:

  • ASCII letters, digits, and the `-' (hyphen or dash) character.
  • Labels cannot be all numbers, but can have a leading digit.
  • Labels must end and begin only with a letter or digit.
Important
Configuration Manager cannot validate that the name specified is configured on intranet DNS servers.

Specify an Internet-based fully qualified domain name for this site system

Enables or cancels the Internet FQDN text box, which allows you to specify an Internet FQDN for the site system if you are using Internet-based client management. This option is not required unless this site system will support Internet-based client management.

For more information about Internet-based client management, see Deploying Configuration Manager Sites to Support Internet-Based Clients.

Note
This name must be registered on public Internet DNS servers so that Internet-based clients can resolve the name when they are on the Internet.

Internet FQDN

Enter a fully qualified domain name (FQDN) for the site system on the Internet. This can be the same FQDN as the server's network configuration, or it can be a CNAME (alias) configured on the Internet DNS.

Note
If you use a CNAME (DNS alias) rather than the computer name as your FQDN, and this site system will host an Internet-based distribution point, you do not need to register this CNAME as a Kerberos service principal name (SPN) unless you have modified the default Configuration Manager package permissions to be more restrictive and you are authenticating access to them by mapping computer certificates to Active Directory accounts.

The Internet FQDN you specify here must match the Internet FQDN specified in the server's certificate subject name (or subject alternative name). For more information about the certificates for native mode, see Certificate Requirements for Native Mode.

Important
Configuration Manager cannot validate that the name specified is configured on Internet DNS servers.

Use the site server's computer account to install this site system

The site server needs to authenticate on the site system to install, configure, and monitor site system roles. The most secure method of achieving this authentication is to use the site server's computer account if it is trusted by the site system. This trusted communication is automatically available in the following scenarios:

  • The site system is in the same Active Directory forest as the site server.
  • The site system is in a different Active Directory forest than the site server, but there is a forest trust in place.
  • There is an external trust in place between the site system's domain and the site server's domain (with the site system's domain trusting the site server's domain).
If there is no trust mechanism in place between the two servers, you must use and configure a Microsoft Windows user account that is trusted on the site system server.

Use another account for installing this site system

Use this option if you cannot use the site server's computer account to authenticate to the site system.

You must also specify this option if you also select the option Allow only site server initiated data transfers from this site system on this tab.

Site System Installation Account

Displays the Windows user account that is specified to be used for site system installation.

Set

Click to open the Windows User Account dialog box to specify the Windows user account and password to use to authenticate the site server to the site system server.

Note
Universal Principle Names (UPNs) are not supported in Configuration Manager 2007, so the name format must be specified as domain\user.

Enable this site system as a protected site system

Enables or cancels the option to prevent clients from accessing the site system unless they are located within the configured protected boundaries of the site system. If a site system is configured as a protected site system and no boundaries are specified, clients will be unable to access the site system.

This option applies only to site systems that are configured as distribution points and state migration points.

Protected site systems cannot be configured for connections from clients over the Internet.

Select Boundaries

Click to open the Boundaries dialog box to specify protected boundaries for the site system.

Allow only site server initiated data transfers from this site system

By default, site systems initiate connections to the site server to send status information to the site. Enabling this option results in the site server initiating the connection to site systems that are configured for site system roles that are supported across forests. This configuration might introduce some latency in sending status messages, with a decrease in performance on the site server.

The site system roles that support this option are the following:

  • Management point
  • Distribution point
  • Software update point
  • Fallback status point
  • Multicast point
Enable this option only if these site system servers are in different forests than the site server and you need to control the direction of connections between the servers. The most likely scenario for this requirement is when the site is configured for Internet-based client management and the site system is in the perimeter network with the site server on the intranet. For more information, see Site System Roles that Support Internet-Based Client Management.

Important
You must use the Site System Installation Account with this option, and you cannot use the site server's computer account even if a trust exists.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

See Also

Tasks

Configuring DNS for Configuration Manager Site System Roles

Concepts

Determine If You Will Use FQDN Server Names

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Site System Properties


Site System Server Share Properties: General Tab

Use this tab to specify the configuration of site systems in a Configuration Manager 2007 site. A site system is a server or share that provides functionality to the site, depending on the assigned role. A site system can perform one or more roles.

This tab applies to all site system types (such as server computers and server shares).

This tab contains the following elements:

Specify a fully qualified domain name (FQDN) for this site system on the intranet. This is required for native mode and for publishing in DNS

Enables or cancels the intranet FQDN text box, which allows you to specify an intranet FQDN for the site system.

Enter an FQDN that adheres to RFC 1123:

  • ASCII letters, digits, and the '-' (hyphen or dash) character.
  • Labels cannot be all numbers, but can have a leading digit.
  • Labels must end and begin only with a letter or digit.
This option is recommended for native mode and if the site system is a management point that is publishing to Domain Name System (DNS).

Intranet FQDN

Enter a fully qualified domain name (FQDN) for the site system on the intranet. This can be the same FQDN as the server's network configuration, or it can be a CNAME.

Note
Configuration Manager cannot validate that the name specified is configured on DNS servers.

Specify an Internet-based fully qualified domain name for this site system

Enables or cancels the Internet FQDN text box, which allows you to specify an Internet FQDN for the site system if you are using Internet-based client management.

Internet FQDN

This option is not supported on site system server shares.

Enable this site system as a protected site system

Enables or cancels the option to prevent clients from accessing the site system unless they are located within the configured protected boundaries of the site system. If a site system is configured as a protected site system and no boundaries are specified, clients will be unable to access the site system. This option applies only to site systems that are configured as distribution points and state migration points.

Protected site systems cannot be configured for connections from clients over the Internet.

Select Boundaries

Click to open the Boundaries dialog box to specify protected boundaries for the site system.

Allow only site server initiated data transfers from this site system

By default, site systems initiate connections to the site server to send status information to the site. Enabling this option results in the site server initiating the connection to site systems that are configured for site system roles that are supported across forests. This configuration might introduce some latency in sending status messages, with a decrease in performance on the site server.

The site system roles that support this option are the following:

  • Management point
  • Distribution point
  • Software update point
  • Fallback status point
Enable this option only if these site system servers are in a different forest than the site server and you need to control the direction of connections between the servers. The most likely scenario for this requirement is when the site is configured for Internet-based client management and the site system is in the perimeter network with the site server on the intranet.

Important
You must use the Site System Installation Account with this option, and you cannot use the site server's computer account even if a trust exists.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

See Also

Concepts

Determine If You Will Use FQDN Server Names
Determine If You Need to Publish to DNS


State Migration Point Properties: General Tab

Use the General tab on the State Migration Point Properties dialog box to specify directories on this site system that will be used to store client data.

This page contains the elements described in the following table.

Name | Description
Enable restore-only mode | Configures the state migration point to refuse new requests to store client data.
New | Adds a new directory, click New and enter the path that should be used for storing state migration data.
Immediately | Deletes the data after it has been downloaded onto the target computer or choose Delete after and specify how long the data should be stored.


ConfigMgr System Health Validator Point Properties: General Tab

There are no properties to edit for this role because all System Health Validator points in a Configuration Manager 2007 site share the same settings, and therefore, are configured under Site Settings / Component Configuration / System Health Validator Point Component.

The General tab contains the elements listed in the following table.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About System Health Validator Points in Network Access Protection

Other Resources

How to Configure the System Health Validator Point for Network Access Protection


Software Distribution Properties

The Configuration Manager 2007 Software Distribution Properties dialog box displays configuration information for the Software Distribution component. This dialog box is also where the configuration settings can be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Software Distribution Properties: General Tab

Specifies general configuration information about the Software Distribution component

Software Distribution Properties: Distribution Point Tab

Specifies concurrent distribution settings, as well as software distribution retry settings.

See Also

Other Resources

Software Distribution Overview


Software Distribution Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Distribution Properties dialog box to specify package storage and distribution settings.

The General tab contains the following elements:

Drive on site server

Specifies the drive location on the local site server where packages (package source files) are stored. If the package source files are compressed, this drive must be in the NTFS format, as the FAT configuration will not properly store the compressed files.

Note
The package source folder on the site server is not the same as the package source folder located on distribution points.

See Also

Concepts

About Package Access Accounts

Other Resources

Software Distribution Properties


Software Distribution Properties: Distribution Point Tab

Use the Distribution Point tab of the Configuration Manager 2007 Software Distribution Properties dialog box to specify concurrent distribution settings, including maximum threads per package as well as software distribution retry settings.

The Distribution Point tab contains the following elements:

Concurrent distribution settings

Specifies the number of packages and maximum threads per package. Two settings are available:

  • Maximum number of packages: Specifies the maximum number of packages that Configuration Manager 2007 copies, in parallel.
  • Maximum threads per package: Specifies the maximum number of threads allocated to each package during distribution.
Retry settings

Specifies the retry settings that Distribution Manager will attempt when an initial software distribution attempt fails. Two settings are available:

  • Number of retries: Specifies the number of times that Distribution Manager attempts to distribute the software. Valid entries range from 1 to 1,000 attempts. The default value is 100 attempts
  • Delay before retrying (minutes): Specifies the interval between retry attempts when a previous attempt fails. Valid entries range from 1 to 1,440 minutes (24 hours). The default value is 30 minutes.
Send package from the nearest site in the hierarchy

Specifies that when a new distribution point is created, or when a site's distribution point is targeted to receive a new package, the source files are retrieved from the closest higher-level site in the hierarchy.

See Also

Concepts

About Distribution Points
How to Configure Distribution Points

Other Resources

Software Distribution Properties


Software Inventory Client Agent Properties

The software inventory client agent allows you to enable and configure software inventory settings for clients.

The software inventory client agent properties dialog box contains four tabs:

In This Section

Software Inventory Client Agent Properties: General Tab

Enables and schedules software inventory client agent settings.

Software Inventory Client Agent Properties: Inventory Collection Tab

Specifies the file types to inventory and how to report the inventory in Resource Explorer.

Software Inventory Client Agent Properties: File Collection Tab

Specifies files to collect from clients.

Software Inventory Client Agent Properties: Inventory Names Tab

Changes variations of a manufacturer or product name to a consistent display name.

See Also

Other Resources

Client Agents Properties


Software Inventory Client Agent Properties: General Tab

Use this tab to enable or disable software inventory for the site. If software inventory is enabled, you can schedule when software inventory is to be collected from clients.

Enable software inventory on clients

Enables software inventory for the site. When this check box is selected, software inventory is running, or will run, according to the schedule specified below. By default, this check box is cleared.

Inventory and file collection schedule

Specifies when software inventory runs on clients in the site.

Simple schedule

Determines software inventory and file collection schedule frequency. By default, this option is selected. Although the simple schedule allows less flexibility in scheduling inventory, this method usually causes less network traffic than the Custom Schedule option because the time interval between each client's inventory report is based on the time the Configuration Manager 2007 client was installed, and first policies retrieved, for each client. When Custom Schedule is selected, all clients will run software inventory at exactly the same time.

Run every

The number and type of time units (hours, days, or weeks) in the simple schedule. You can specify one through 23 hours, one through 31 days, or one through 4 weeks. By default, this interval is set to one week.

Custom schedule

Software inventory and file collection schedule specified by days and time (for example, every Monday at 4:00 A.M. or every Thursday at 7:30 P.M.).

Schedule

Click to open the custom schedule dialog box and set the software inventory and file collection schedule. You can specify a start date and time, and a recurrence of one through 59 minutes, one through 23 hours, or one through 31 days.

Note
If today is Wednesday and you set the inventory schedule to run every two weeks on Mondays, the next inventory collection will occur on the next Monday and alternate Mondays after that. The start date must match the day selected.

See Also

Concepts

Custom Schedule Dialog Box

Other Resources

Software Inventory Client Agent Properties


Software Inventory Client Agent Properties: Inventory Collection Tab

When you enable software inventory for a site, use this tab to specify the file types to inventory and how to report the inventory in Resource Explorer.

File types

File information you specify to inventory on clients in the site.

Add Button

Click to open the inventoried file properties dialog box so that you can add a new entry to the File types list.

Properties Button

Click to open the inventoried file properties dialog box so that you can modify an entry in the File types list.

Delete Button

Click to delete the selected file type.

Name

The file types that are inventoried on clients. By default, *.exe is listed.

Path

The client hard disk search location, set to either all client hard disks, a single variable, or a path name. By default, All client hard disks is listed.

Subdirectories

Specifies whether subdirectories under Path are searched. By default, Yes is listed.

Exclude

Specifies whether encrypted and compressed files are excluded from being inventoried.

Reporting detail

Specifies the level of inventory file information that you want reported in Resource Explorer. For Configuration Manager 2007 to report information about inventoried files, you must select at least one check box.

File details

Displays all scanned files, including unknown files, in Resource Explorer under File Details. By default, this check box is selected.

Product details

Resource Explorer lists software products only when manufacturer information is present. By default, this check box is selected.

See Also

Concepts

About Resource Explorer

Other Resources

Software Inventory Client Agent Properties


Software Inventory Client Agent Properties: File Collection Tab

When you enable software inventory for a site, use this tab to specify files to collect from clients.

Files to be collected

The list of files that you want to collect from site clients.

New Button

Click to open the collected file properties dialog box so that you can add a new entry to the Files to be collected list.

Properties Button

Click to open the collected file properties dialog box so that you can edit an entry in the Collect these files list.

Delete Button

Click to delete the selected file name from the list of files to be collected.

Name

The files or file types that are collected from clients. By default, no files or file types are listed.

Path

The full file path or system environment variable searched.

Subdirectories

Indicates whether Path subdirectories are searched.

Size (KB)

The maximum size allowed for collected files, in kilobytes (KB), that Configuration Manager collects from a client during a software inventory cycle. The value is determined by Maximum size (KB) in the collected file properties dialog box.

Exclude

Indicates whether encrypted and compressed files are excluded from collection. You can change this value in the collected file properties dialog box.

See Also

Concepts

Collected File Properties Dialog Box

Other Resources

Software Inventory Client Agent Properties


Software Inventory Client Agent Properties: Inventory Names Tab

During software inventory, the names of the manufacturers that produced the files on clients and the names of the files (or software products) themselves are retrieved from the header information of these files. Because these names are not always standardized in the header information, when you view software inventory information in Resource Explorer or run queries, different versions of the same manufacturer or product name can sometimes appear.

You can use this tab to change variations of a manufacturer or product name to a consistent display name. To do so, you specify the display name you want to use, and then specify the inventoried names you want to associate with the display name.

Note
When you specify new display names, the names that appear in the header information of the actual files on the clients are not changed. Instead, the inventoried names are changed to the display names in the Configuration Manager 2007 site database.

Name type

Specifies the type of inventoried name to change.

Manufacturer

Allows you to view, define, or modify inventoried names and display names for manufacturers.

Product

Allows you to view or modify inventoried names and display names for products.

Display name

Specifies the name that the associated inventoried names will be changed to. When you select a display name, the associated inventoried names appear in the Inventoried names list.

New icon

Opens the display name dialog box, which allows you to add a new entry to the Display name list.

Properties icon

Opens the display name properties dialog box, which allows you to modify the selected display name.

Delete icon

Deletes the selected display name. When you delete a display name, the next time software inventory runs, the inventoried names associated with this display name will not be changed to this display name.

Inventoried names

Specifies the names that you want to associate with the display name.

New icon

Opens the inventory name properties dialog box, which allows you to add a new entry to the Inventoried names list.

Properties icon

Opens the inventory name properties dialog box, which allows you to modify the selected inventoried name.

Delete icon

Deletes the selected inventory name. When you delete an inventoried name, the next time software inventory runs, this name will not be changed to the associated display name (the name that appears in the Display name list).

See Also

Reference

Display Name Properties Dialog Box
Inventory Name Properties Dialog Box

Other Resources

Software Inventory Client Agent Properties


Software Metering Client Agent Properties

Use the Configuration Manager 2007 Software Metering Client Agent Properties dialog box to enable the software metering client agent and to configure the data collection schedule.

In This Section

Software Metering Client Agent Properties: General Tab

Specifies whether software metering is enabled or disabled on the Configuration Manager 2007 site.

Software Metering Client Agent Properties: Schedule Tab

Allows you to view and specify the software metering data collection schedule.

See Also

Other Resources

Overview of Software Metering


Software Metering Client Agent Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Metering Client Agent Properties dialog box to enable or disable the software metering client agent.

This tab contains the following elements:

Enable software metering on clients

Specifies whether software metering is active on client computers within the Configuration Manager 2007 site.

See Also

Other Resources

Overview of Software Metering


Software Metering Client Agent Properties: Schedule Tab

Use the Schedule tab of the Configuration Manager 2007 Software Metering Client Agent Properties dialog box to view and specify the software metering data collection schedule.

This tab contains the following elements:

Data collection schedule

The data collection schedule specifies when software metering collects the data about metered applications. Click Schedule to modify the schedule. The default data collection schedule is every seven days.

See Also

Other Resources

Overview of Software Metering


Software Update Point Client Installation Properties

Use the General tab of the Configuration Manager 2007 Software Update Point Client Installation Properties dialog box to enable software update point client installation and to configure the client package version which will be published to the software update point.

This dialog box contains the following elements:

Enable Software Update Point Client Installation

Select this option to enable software update point client installation. This method of installation requires an existing software update point.

Note
When you enable this option, if the available version of the client package is newer than the version published to the software update point, the Upgrade Client Package Version dialog box will open. You can use this dialog box to confirm that you want to publish the latest version of the client package to the software update point.

Published version:

Displays the most recent version of the Configuration Manager 2007 client package which has been published to the software update point.

Note
If you are implementing this client installation method for the first time, then this field will be blank.

Available version:

Displays the most recent available version of the client installation package.

See Also

Tasks

How to Install Configuration Manager Clients Using Software Update Point Based Installation

Concepts

Overview of Configuration Manager Client Deployment

Other Resources

Software Updates in Configuration Manager


Software Update Point Component Properties

The Configuration Manager 2007 Software Update Point Properties dialog box displays information about the software update point settings. Use the following procedure to access the Software Update Point Component Properties.

To open the Software Update Point Configuration Properties dialog box

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Component Configuration.

  2. Right-click Software Update Point Component, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Software Update Point Component Properties: General Tab

Specifies whether the software update point is enabled, and if so, what server is the active software update point.

Software Update Point Component Properties: Internet-Based Tab

Specifies whether an Internet-based software update point is enabled, and if so, what server is the active Internet-based software update point.

Software Update Point Component Properties: Sync Settings Tab

Specifies the synchronization source for the software update point and whether WSUS reporting events are created on client computers.

Software Update Point Component Properties: Classifications Tab

Specifies the classifications for which software updates will be synchronized.

Software Update Point Component Properties: Products Tab

Specifies the products for which software updates will be synchronized.

Software Update Point Component Properties: Sync Schedule Tab

Specifies whether to synchronize software updates on a schedule or manually.

Software Update Point Component Properties: Languages Tab

Specifies the languages that are downloaded for software update files and update summary information.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Configure Software Updates Synchronization
How to Configure the Active Software Update Point Component to Use an NLB Cluster
How to Create and Configure an Active Internet-Based Software Update Point
How to Create and Configure an Active Software Update Point
How to Synchronize Updates Using Export and Import

Concepts

About the Software Update Point
About the Software Update Point Connection Account
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Software Update Point Component Properties: General Tab

Use the General tab in the Configuration Manager 2007 software update point properties to enable and configure the active software update point for the site. Multiple site systems can be installed with the software update point site role, but only one software update point can be defined as the active software update point. The active software update point is installed on a Windows Server Update Services (WSUS) server and allows Configuration Manager to configure the WSUS server for what software updates will be synchronized and to initiate software updates metadata synchronization from the WSUS database to the to the site server database.

When there are Internet-based client computers, the active software update point can be configured to allow connectivity from both the intranet and Internet. Or an active Internet-based software update point can be installed on a remote site system to handle all communications from Internet-based client computers. When an active Internet-based software update point is configured, the active software update point allows connectivity from only client computers on the intranet. The Internet-based software update point is configured on the Internet-based tab. For more information, see How to Create and Configure an Active Internet-Based Software Update Point.

The General tab contains the following elements:

None

Specifies that the software update point components will be installed on this site system, but the software update point will not be active. Until an active software update point is specified at this site, software updates will not be synchronized and Configuration Manager client computers will not scan for software updates compliance.

Active software update point on site server

Specifies that this site server is configured to be the active software update point for this site.

Active software update point on remote server

Specifies that the active software update point is enabled on a remote site system server. The name of the site system server is specified in the Active server name setting.

Use Network Load Balancing cluster for active software update point

Specifies that the active software update point is configured as a Network Load Balancing (NLB) cluster. The Network Load Balancing Settings must be configured when this setting is selected. For more information about configuring an active software update point as an NLB cluster for the active software update point, see How to Configure the Active Software Update Point Component to Use an NLB Cluster.

Port number

Specifies the HTTP port number configured on the WSUS server. The site server uses this port when communicating with the WSUS server. The port number must be from 1 to 65535. For information about finding the port numbers used by WSUS, see How to Determine the Port Settings Used by WSUS.

SSL port number

Specifies the SSL (HTTPS) port number configured on the WSUS server. When the Enable SSL for this WSUS server setting is enabled, the software updates components use this port when synchronizing software updates with the WSUS server. When the site is in native mode, this setting is automatically enabled. The port number must be from 1 to 65535.

Active server name

Specifies the server name for the active remote software update point. This setting is available only when Active software update point on remote server is specified.

Network Load Balancing Settings

Specifies the NLB cluster settings when the active software update point is configured as an NLB cluster. When configuring the NLB cluster, specify the following:

  • IP address type: Specify one of the following IP address types:
    • IPV4: Specifies that IP version 4 is used for the virtual address.
    • IPV6: Specifies that IP version 6 is used for the virtual address.
    • FQDN: Specifies that a private, fully qualified domain name is used.
  • Virtual IP or FQDN (private): Specifies the virtual IP or private FQDN for the address type specified above.
  • FQDN (public): Specifies the FQDN used by Internet-based clients when connecting to the NLB cluster.
Software Update Point Connection Account

Specifies the account that is used by the site server when it connects to a remote software update point or an active software update point configured as an NLB cluster. When this account is not specified, the computer account for the site server is used when connecting to the software update point. For more information about this account, see About the Software Update Point Connection Account.

Allow intranet-only client connections

Specifies that client connections from Internet-based clients are not allowed on this software update point. Select this setting if Internet-based client computers will connect to an Internet-based software update point. This setting is available only on sites that are configured for native mode.

Allow both intranet and Internet client connections

Specifies that connections from both intranet-based and Internet-based clients are allowed on this software update point. When this setting is selected, the settings on the Internet-based tab are disabled. This setting is available only on sites that are configured for native mode.

Enable SSL for this WSUS server

Specifies whether to enable Secure Sockets Layer (SSL) for the WSUS server that is configured to be the active software update point. When the site server is in native mode, this setting is enabled by default and cannot be modified. When this setting is enabled, the following actions apply:

  • The WSUS server will synchronize software updates metadata using SSL. The upstream server must be configured for SSL or synchronization will fail. For more information about configuring WSUS for SSL, see How to Configure the WSUS Web Site to Use SSL.
  • Client computers for the site and the WSUS Web site must have a trusted root CA in common. Without a common certificate, client computers will fail to scan for software update compliance. For more information, see Planning for the Software Update Point Installation.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Configure Software Updates Synchronization
How to Configure the Active Software Update Point Component to Use an NLB Cluster
How to Create and Configure an Active Internet-Based Software Update Point
How to Create and Configure an Active Software Update Point
How to Synchronize Updates Using Export and Import

Concepts

About the Software Update Point
About the Software Update Point Connection Account
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Software Update Point Component Properties: Internet-Based Tab

Use the Internet-based tab in the Configuration Manager 2007 Software Update Point Component Properties dialog box to enable and configure an active Internet-based software update point used exclusively for Internet-based client connections. The Internet-based software update point is configured on a site system server that is remote from the site server and the active software update point. The active Internet-based software update point is installed on a site system server running Microsoft Windows Server Update Services (WSUS) 3.0 and allows Configuration Manager to configure the WSUS server for what software updates should be synchronized and to initiate software updates metadata synchronization from the WSUS database on the active software update point site system server to the local WSUS database on the active Internet-based software update point.

The settings on the Internet-based tab are configurable only when the active software update point is configured for intranet-only client connections, where the Allow intranet-only client connections setting is selected on the General tab of the Software Update Point Component Properties dialog box and when the site is configured to operate in native mode. For more information, seeAdministrator Checklist: Configuring the Software Update Point in a Native Mode Site.

The Internet-based tab contains the following elements:

None

Specifies that the Internet-based software update point components will be installed on this site system, but the software update point will not be active. Until an active Internet-based software update point is specified at this site, or the active software update point is configured to accept communications from Internet-based clients, Internet-based client computers will not scan for software updates compliance.

Active remote Internet-based software update point

Specifies that the active Internet-based software update point is assigned to a remote site system server. The name of the site system server is specified in the Active server name setting.

Use Network Load Balancing cluster for active Internet-based software update point

Specifies that the active Internet-based software update point is configured as a Network Load Balancing (NLB) cluster. The Network Load Balancing Settings must be configured when this setting is selected. For more information about configuring an active software update point as an NLB cluster for the active software update point, see How to Configure the Active Software Update Point Component to Use an NLB Cluster.

Port number

Specifies the HTTP port number configured on the WSUS server. The site server uses this port when communicating with the WSUS server. The port number must be from 1 to 65535. For information about finding the port numbers used by WSUS, see How to Determine the Port Settings Used by WSUS.

SSL port number

Specifies the SSL (HTTPS) port number configured on the WSUS server. When the Enable SSL for this WSUS server setting is enabled, the site server uses this port when communicating with the WSUS server. The port number must be from 1 to 65535.

Active server name

Specifies the server name for the active Internet-based software update point. This setting is available only when Active remote Internet-based software update point is specified.

Network Load Balancing Settings

Specifies the NLB cluster settings when the active Internet-based software update point is configured as an NLB cluster. When configuring the NLB cluster, specify the following:

  • IP address type: Specify one of the following IP address types:
    • IPV4: Specifies that IP version 4 is used for the virtual address.
    • IPV6: Specifies that IP version 6 is used for the virtual address.
    • FQDN: Specifies that a private, fully qualified domain name is used.
  • Virtual IP or FQDN (private): Specifies the virtual IP or private FQDN for the address type specified above.
  • FQDN (public): Specifies the FQDN used by Internet-based clients when connecting to the NLB cluster.
Software Update Point Connection Account

Specifies the account that is used by the site server when it connects to a remote software update point or an active software update point configured as an NLB cluster. When this account is not specified, the computer account for the site server is used when connecting to the software update point. For more information about this account, see About the Software Update Point Connection Account.

Do not synchronize from the software update point located on the intranet

Specifies that the Internet-based software update point does not synchronize with the active software update point. Select this option if the active Internet-based software update point is unable to connect to the active software update point. The export and import functionality of the WSUSutil tool will need to be used to synchronize software updates metadata from the active software update point. For more information, see How to Synchronize Updates Using Export and Import.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Add the Software Update Point Site Role to a Site System
How to Configure Software Updates Synchronization
How to Configure the Active Software Update Point Component to Use an NLB Cluster
How to Create and Configure an Active Internet-Based Software Update Point
How to Create and Configure an Active Software Update Point
How to Synchronize Updates Using Export and Import

Concepts

About the Software Update Point
About the Software Update Point Connection Account
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
Planning for the Software Update Point Installation
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Configuring Internet-Based Client Management
Software Update Point Component Properties


Software Update Point Component Properties: Sync Settings Tab

Use the Sync Settings tab in the Configuration Manager 2007 Software Update Point Properties dialog box to configure the software update point synchronization settings and whether to create Windows Server Update Services (WSUS) reporting events.

The software update point will synchronize from Microsoft Update, from the upstream update server, or is not configured to synchronize. The software update point that is highest in the Configuration Manager 2007 hierarchy (most often the central site) synchronizes with Microsoft Update and all other software updates points synchronize with the software update point configured at the parent site.

Important
The software update point on the central site should always be configured to synchronize from Microsoft Update. When any other setting is selected, synchronization will not succeed on the central site.

Optionally, synchronization can be disabled and the Windows Server Update Services (WSUS) import/export tool can be used to export the software updates metadata from one site and import it at another site. Software update points are installed on WSUS servers and use site-to-site WSUS communication channels for synchronization.

When the software update point is configured to synchronize from an upstream update server or when synchronization is not enabled, the Classifications tab, Products tab, and the Summary Details column in the Languages tab are hidden and use the settings from the software update point that synchronizes with Microsoft Update, usually at the central site.

The Windows Update Agent (WUA) on client computers can be configured to create reporting event messages that are used in WSUS reporting. These reporting events are not used by Configuration Manager and can be disabled if WSUS reporting is not used.

The Sync Source tab contains the following elements:

Synchronize from Microsoft Update

Specifies that the software update point synchronizes with Microsoft Update. This setting should be selected for only the software update point that is highest in the Configuration Manager 2007 hierarchy.

Synchronize from an upstream update server

Specifies that the software update point synchronizes with an upstream update server. The software update point at the parent Configuration Manager 2007 site is automatically configured to be the upstream update server.

Do not synchronize from Microsoft Update or an upstream update server.

Specifies that the software update point does not synchronize with any server. Select this option if using the WSUS export/import function to obtain software update definitions. For more information, see How to Synchronize Updates Using Export and Import.

Do not create WSUS reporting events

Specifies that the WUA on client computers will not create the WSUS reporting events. This is the default setting.

Create only WSUS status reporting events

Specifies that the WUA on client computers will create only WSUS status reporting events.

Create all WSUS reporting events

Specifies that the WUA on client computers will create all WSUS status reporting events.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System
How to Synchronize Updates Using Export and Import

Concepts

About the Software Update Point
About the Software Updates Process
Determine the Software Update Point Infrastructure
How to Manage Software Updates Synchronization
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Software Update Point Component Properties: Classifications Tab

Use the Classifications tab in the Configuration Manager 2007 Software Update Point Properties dialog box to specify the classifications for which the software updates are synchronized. The software updates classifications are as follows:

  • Critical Updates
  • Definition Updates
  • Drivers
  • Feature Packs
  • Security Updates
  • Service Packs
  • Tools
  • Update Rollups
  • Updates

The classifications can be configured only on the software update point that is highest in the hierarchy, which is configured to synchronize with Microsoft Updates. If this software update point is configured to synchronize with an upstream server, this page is hidden and the update classifications are based on the classifications configured at the software update point highest in the hierarchy, most often the central site.

The Classifications tab contains the following elements:

All Classifications

Specifies that software updates in all classifications are synchronized. Each classification is selected automatically when selecting the All Classifications option.

Classification name

Specifies that software updates in the selected classification are synchronized. One or more classifications can be selected.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Software Update Point Component Properties: Products Tab

Use the Products tab in the Configuration Manager 2007 Software Update Point Properties dialog box to specify the products for which the software updates are synchronized. The products can be configured only on the software update point that is highest in the hierarchy, which is configured to synchronize with Microsoft Updates. If this software update point is configured to synchronize with an upstream server, this page is hidden and the products are based on the products configured at the software update point highest in the hierarchy.

The Products tab contains the following elements:

All Products

Specifies that software updates for all products are synchronized.

Vendor Name

Specifies that all software updates for the selected vendor are synchronized. One or more vendors can be selected.

Product Family Name

Specifies that all software updates for the selected product family are synchronized. For example, if Office is selected, all office products, such as Office 2002/XP, Office 2003, and so on, are automatically selected. One or more product families can be selected.

Product Name

Specifies that all software updates for the selected product are synchronized. One or more products can be selected.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Software Update Point Component Properties: Sync Schedule Tab

Use the Sync Schedule tab in the Configuration Manager 2007 Software Update Point Properties dialog box to specify whether the software update point is configured for synchronization on a schedule. The synchronization schedule is a site-wide setting and the Sync Schedule tab is available only at the highest site in the Configuration Manager 2007 hierarchy with an active software update point that synchronizes with Microsoft Update. If this software update point is configured to synchronize with an upstream server, this tab is hidden and the synchronization schedule is based on the configured site-wide schedule settings.

The Sync Schedule tab contains the following elements:

Enable synchronization on a schedule

Specifies whether software updates synchronization is runs on a schedule or is initiated manually from the Configuration Manager console.

Simple schedule

Specifies that synchronization is initiated on a specific interval based on number of hours, days, or weeks. You can specify from 1 to 23 hours, from 1 to 31 days, or from 1 to 4 weeks. By default, the simple schedule is selected and the interval is set to 7 days.

Custom schedule

Specifies that synchronization is initiated on a custom schedule. When the Custom option is selected, click the Customize button to open the Custom Schedule Dialog Box to configure the schedule.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Software Update Point Component Properties: Languages Tab

Use the Languages tab in the Configuration Manager 2007 Software Update Point Component Properties dialog box to specify the languages for which the software updates files are downloaded and software updates summary information (metadata) is synchronized. The configured language settings are stored in the site control file.

Note
In Systems Management Server (SMS) 2003, the download.ini file stored the configuration settings for the languages that were used. The download.ini file is no longer used when synchronizing software updates.

The Languages tab contains the following elements:

Update File

Specifies the default set of languages that will be available when downloading software updates at the site. When on the Language Selection page of the Deploy Software Updates Wizard or Download Software Updates Wizard, the languages configured for the software update point are automatically selected, but they can be modified each time updates are downloaded or deployed. When the wizard completes, the software update files for the configured languages are downloaded to the deployment package source location and then copied to the distribution points configured for the deployment package.

The update file language settings should be configured on the software update point with the languages that are most often used in your environment. For example, if client computers in the site use mostly English and Japanese languages for the operating system or applications, and there are very few other languages used at the site, select English and Japanese in the Update File column and clear the other languages. This allows you to most often use the default settings on the Language Selection page of the wizards and it also prevents unneeded update files from being downloaded. This setting is configured in the properties for the active software update point at each site in the Configuration Manager 2007 hierarchy.

Summary Details

Specifies the languages for which the metadata for the software updates is downloaded during synchronization. The metadata provides the information about the software update, such as name, description, products that the update supports, update classification, article ID, download URL, applicability rules, and so on.

The summary details settings are configured only on the active software update point on the central site server. The active software update point and Internet-based software update point, if configured, on child sites synchronize the software updates metadata from the upstream synchronization source for the languages configured at the central site. When selecting the summary details languages, you should select only the languages needed in your environment. The more languages that are selected, the longer it takes to synchronize the software updates metadata. The software updates metadata is displayed in the locale of the operating system where the Configuration Manager console is running. If the localized properties for the software updates are not available, the information displays in English.

Important
It is very important that you select all of the summary details languages that will be needed in your Configuration Manager hierarchy. When the active software update point on the central site is synchronized, the selected summary details languages determine what software updates metadata is retrieved. If the summary details languages are modified after the synchronization has run at least one time, the metadata is retrieved for the modified summary details languages for only new or updated software updates. The software updates that have already been synchronized will not retrieve metadata for different languages unless there is a change to the update on Microsoft Update.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


Software Updates Client Agent Properties

The Configuration Manager 2007 Software Updates Client Agent properties dialog box displays information about the client agent settings and allows the client agent settings to be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Software Updates Client Agent Properties: General Tab

Specifies whether the Software Updates Client Agent is enabled or disabled, and if enabled, sets the schedule for how often the client runs a compliance assessment scan.

Software Updates Client Agent Properties: Update Installation Tab

Specifies whether to enforce the installation of all mandatory software updates with a deadline within a specified period when another software update deadline is reached.

Software Updates Client Agent Properties: Deployment Re-Evaluation Tab

Specifies the schedule for when software updates are reevaluated for installation status and reinstalled if they are still required and no longer found on clients.

See Also

Tasks

How to Configure the Software Updates Client Agent

Concepts

About the Software Updates Client Agent


Software Updates Client Agent Properties: General Tab

Topic last updated—March 2008

Use the General tab in the Configuration Manager 2007 Software Updates Client Agent Properties dialog box to enable or disable the Software Updates Client Agent, and if enabled, to specify the software updates evaluation cycle and update installation settings. The client agent is enabled in Configuration Manager 2007 by default, allowing the client computer to scan for software updates compliance and software updates to be deployed to client computers. The scan schedule setting is available only after an active software update point site role has been installed on a site system server for the site.

Note
Before software updates can be deployed, there are other components and settings that need to be configured. For more information, see Administrator Checklists for Software Updates.

The General tab contains the following elements:

Enable software updates on clients

Specifies whether the Software Updates Client Agent is enabled or disabled for the site. The Software Updates Client Agent is installed on Configuration Manager 2007 clients by default. If the client agent is disabled, the client agent components are put into a dormant state but not removed on clients. Existing deployment policies will be removed from client computers when the client agent is disabled. Reenabling the Software Updates Client Agent will initiate a policy to request that the components on clients be enabled and the deployment metadata is downloaded. The Software Updates Client Agent is configured on a site-by-site basis and only affects clients assigned to that site. Disabling the Software Updates Client Agent at a site prevents software update compliance assessment and software updates from being deployed.

Simple schedule

Specifies how often the client initiates a software update compliance assessment scan. By default, the compliance scan is initiated once a week and the site database is updated with any changes since the last scan. The minimum value allowed for the scan schedule is 1 day and the maximum is 31 days. The default setting is 7 days.

Custom schedule

Specifies that the scan for software update compliance is initiated on a custom schedule. When the Custom option is selected, click the Customize button to open the Custom Schedule dialog box and specify the schedule start date and time, and recurrence using the following settings:

  • Start: Sets the date and time when the scan for software update compliance starts on client computers.
    Important
    The actual start time on client computers is the start time plus a random amount of time up to 2 hours. This prevents client computers from initiating the scan and connecting to Windows Server Update Services (WSUS) on the active software update point server at the same time.

  • Weekly: Scan recurrence is configured for every n weeks, where n specifies the number of weeks, on a specific day of the week, and at the configured start time. For example, the recurrence can be set for every 5 weeks on Saturday at the configured start time.
  • Monthly - Scan recurrence is configured for every n months, where n specifies the number of months and one of the following:
    1. Specific day of the month.
    2. The last day of the month.
    3. The first, second, third, fourth, or last week of the month and a specific day of the week. For example, the recurrence can be set for every 2 months on the second Friday of the month and at the configured start time.
  • Custom interval: Scan recurrence is configured based on a specific number days. You can specify from 1 to 31 days. The Interval setting is configured much like the simple schedule, but will always run at the specified start time.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure the Software Updates Client Agent

Concepts

Planning for Software Updates Client Settings
Planning for Software Updates Server Settings

Other Resources

Administrator Checklists for Software Updates
Software Updates Client Agent Properties


Software Updates Client Agent Properties: Update Installation Tab

Use the Update Installation tab in the Configuration Manager 2007 Software Updates Client Agent Properties dialog box to specify whether to enforce the installation of all mandatory software updates that have a deadline within a specified period of time when another mandatory software update deadline is reached and to hide deployments on client computers.

The Update Installation tab contains the following elements:

Enforce all mandatory deployments

Specifies whether to enforce all mandatory software update deployments that have deadlines within a specified period of time. When a deadline is reached for a mandatory software update deployment, installation is initiated on clients for the updates defined in the deployment. This setting determines whether to also initiate the installation for software updates defined in other mandatory deployments that have a configured deadline within the specified period of time.

The benefit of this setting is that it expedites software update installation for mandatory updates, might increase security, might decrease display notifications, and might decrease system restarts on client computers. By default, this setting is not enabled.

For deployment deadlines within

Specifies the timeframe for the Enforce all mandatory deployments setting. The minimum value allowed is 1 to 23 hours and 1 to 365 days. By default, this setting is configured for 7 days.

Hide all deployments from end users

Specifies that all deployments are hidden when they are received on Configuration Manager 2007 client computers. Use this setting to deploy software updates to computers without any display notifications or notification area icons. By default, this setting is not enabled.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure the Software Updates Client Agent

Other Resources

Software Updates Client Agent Properties


Software Updates Client Agent Properties: Deployment Re-Evaluation Tab

Topic last updated—March 2008

Use the Deployment Re-evaluation tab in the Configuration Manager 2007 Software Updates Client Agent Properties dialog box to configure how often the Software Updates Client Agent reevaluates software updates for installation status on Configuration Manager 2007 client computers. When software updates that have been previously installed are no longer found on client computers, and still required, they are reinstalled. The deployment reevaluation schedule should be adjusted based on company policy for software update compliance, whether users have the ability to uninstall software updates, and so on, and with the consideration that every deployment reevaluation cycle results in some network and client computer CPU activity.

Note
The scan cycle on Systems Management Server 2003 clients can be modified by configuring the recurring schedule on the Advanced SMS 2003 Deployment Properties dialog box.

The Deployment Re-evaluation tab contains the following elements:

Simple

Specifies that software updates are reevaluated on a specific interval based on the number of days. You can specify from 1 to 31 days. By default, the simple schedule is selected and the interval is set to 7 days.

Custom

Specifies that software updates are reevaluated on a custom schedule. When the Custom option is selected, click the Customize button to open the Custom Schedule dialog box and specify the schedule start date and time, and recurrence using the following settings:

  • Start: Sets the date and time when the deployment reevaluation schedule starts on client computers.
    Important
    The actual start time on client computers is the start time plus a random amount of time up to 2 hours. This prevents client computers from initiating the scan and connecting to Windows Server Update Services (WSUS) on the active software update point server at the same time.

  • Weekly: Deployment reevaluation recurrence is configured for every n weeks, where n specifies the number of weeks, on a specific day of the week, and at the configured start time. For example, the recurrence can be set for every 2 weeks on Saturday at the configured start time.
  • Monthly - Deployment reevaluation recurrence is configured for every n months, where n specifies the number of months and one of the following:
    1. Specific day of the month.
    2. The last day of the month.
    3. The first, second, third, fourth, or last week of the month and a specific day of the week. For example, the recurrence can be set for every 2 months on the second Friday of the month and at the configured start time.
  • Custom interval: Deployment reevaluation recurrence is configured based on a specific number days. You can specify from 1 to 31 days. The Interval setting is configured much like the simple schedule, but will always run at the specified start time.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure the Software Updates Client Agent

Reference

Advanced SMS 2003 Deployment Properties

Concepts

Planning for Software Updates Client Settings
Planning for Software Updates Server Settings

Other Resources

Software Updates Client Agent Properties


Status Summary Properties

System Center Configuration Manager 2007 generates many types of status messages.

The Component Status Summarizer determines when there are enough of a certain type of message to generate a warning or critical status in the Component Status display, and whether the status should be replicated to the parent site.

The Site System Status Summarizer determines when the free disk space on a site system falls below a specified threshold, and whether the status should be replicated to the parent site.

The Advertisement Status Summarizer determines only whether the status should be replicated to the parent site.

See Also

Reference

Advertisement Status Summarizer Properties: General Tab

Concepts

Using Status Messages for Configuration Manager Troubleshooting

Other Resources

Component Status Summarizer Properties
Site System Status Summarizer Properties


Status Filter Rules Properties

Use the Configuration Manager 2007 Status Filter Rules Properties dialog box to specify actions to take when status messages are received that match rules you define.

In This Section

Status Filter Rules Properties: General Tab

Specifies the criteria to use to identify status messages on which to take an action.

Status Filter Rules Properties: Actions Tab

Specifies the actions to take when a status message matches the criteria defined in the General tab.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Status Filter Rules Properties: General Tab

Use the General tab of the Configuration Manager 2007 Status Filter Rules Properties dialog box to specify a status message filter rule on which to take an action. For a status message to match a filter rule, all selected criteria must match the status message. For example, if Site Code and Severity are both selected, only messages that match both criteria will match the filter rule. You can select the values for each criteria from the appropriate lists.

Note
If you do not select any criteria, then all status messages will be processed by any actions on the Actions tab of this dialog box.

Name

Specifies the name of the status message filter rule, which must be unique.

Note
This field is read-only if you are editing the properties of an existing status filter rule.

Source

Specifies the source on which to match status messages from the drop-down list. The following values are available:

ConfigMgr Client A Configuration Manager 2007 client

ConfigMgr Provider An SMS provider.

ConfigMgr Server A Configuration Manager 2007 site system.

Site code

Specifies the Configuration Manager 2007 or SMS 2003 site code on which to match status messages from the drop-down list.

System

Specifies the Configuration Manager 2007 or SMS 2003 site system on which to match status messages from the drop-down list.

Component

Specifies the Configuration Manager 2007 or SMS 2003 component on which to match status messages from the drop-down list.

Message type

Specifies the type of status message on which to match from the drop-down list. The following values are available:

  • Audit
  • Detail
  • Milestone
Severity

Specifies the severity of the status message on which to match from the drop-down list. The following values are available:

  • Informational
  • Warning
  • Error
Message ID

Specifies the ID number of the status message you want to match.

Property

Specifies the property of the status message you want to match from the drop-down list. The following values are available:

  • Advertisement ID
  • Collection ID
  • Package ID
  • Policy Assignment ID
  • Policy ID
  • Software Metering Rule ID
  • Unique CIA ID
Property value

Specifies the value associated with the property you have defined. Values shown in this list vary depending on the selected property.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Status Filter Rule
How to Change the Order of Status Filter Rules

Concepts

Status Filter Rules Configuration Overview
Using Status Messages for Configuration Manager Troubleshooting


Status Filter Rules Properties: Actions Tab

Use the Actions tab of the Configuration Manager 2007 Status Filter Rules Properties dialog box to specify the actions to take when a status message matches the criteria specified in the General tab.

Write to the ConfigMgr database

Writes the status message to the Configuration Manager 2007 site database.

Allow the user to delete messages after how many days

Specifies the number of days to keep the status message in the Configuration Manager 2007 site database. The default is 1 day for newly created status filer rules. This counter is enabled only when Write to the ConfigMgr database is selected.

Report to the event log

Writes the status message to the Windows event log.

Replicate to the parent site

Passes the message up to the parent site.

Replication priority

Specifies the replication priority for sending status messages to the parent site, which can be one of the following:

  • Low
  • Medium
  • High
Run a program

Specifies that when a status message matches the status filter rule, then a program should be run. For example, you could specify a program that sends you mail saying a certain message has been generated, or a command that takes corrective action, such as defragmenting a disk.

Program

The command line of the program to run. The maximum length is 1024 characters. This field is enabled only when Run a program is selected.

Do not forward to status summarizers

Specifies that the status message should not be forwarded to any status summarizer.

Do not process lower-priority status filter rules

Stops evaluation at this filter rule. When a status message matches this rule, rules below it in the results pane (of Status Filter Rules) are not evaluated.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Status Filter Rule
How to Change the Order of Status Filter Rules

Concepts

About Data Priorities
Status Filter Rules Configuration Overview
Using Status Messages for Configuration Manager Troubleshooting


Status Threshold Properties: General Tab

Use the General tab of the Configuration Manager 2007 Status Threshold Properties dialog box to specify the number of status messages of a specified type that must be generated by the selected component to change its status in the Component Status Summarizer.

Message type

Displays the severity of status messages for which you want to change the thresholds. You can change this value in the Thresholds tab of the Component Status Summarizer Properties dialog box.

Status message thresholds

Specifies the number of Warning and Critical messages that this component must generate in order to cross the Warning or Critical thresholds.

Warning (messages)

Specifies the number of status messages that must be generated by this component to change its status to Warning in the Component Status Summarizer. The default value is 2000.

Critical (messages)

Specifies the number of status messages that must be generated by this component to change its status to Critical in the Component Status Summarizer. The default value is 5000.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Status Reporting Properties: General Tab

Use the General tab of the Configuration Manager 2007 Status Reporting Properties dialog box to specify status reporting settings for server and client components.

Caution
The default reporting settings are appropriate for most environments and should be changed with caution. Increasing the level of status reporting by choosing to report all status details can increase the load on the Configuration Manager 2007 site. Decreasing the level of status reporting can limit the usefulness of the status summarizers.

Server component status reporting

Controls which status messages, generated by server components, are reported and which messages are ignored.

Report

Specifies the type and severity of status messages to report from the drop-down list. The following options are available:

  • All Milestones and All Details
  • All Milestones
  • Error and Warning Milestones
  • Error Milestones
The default setting is All Milestones.

Report details on failure

Reports detailed status messages when an error occurs between milestones. This option is enabled only if Report is selected. If All Milestones and All Details is selected, this option is disabled because details are already being reported.

Log

Writes the specified type and severity of status message to the Windows event log. The options in the drop-down list are the same as for Report.

Log details on failure

Writes a status message to the Windows event log when an error occurs between milestones. This option is enabled only if Log is selected. If All Milestones and All Details is selected, this option is disabled because details are already being reported.

Client component status reporting

Specifies which status messages generated by client components are reported and which messages are ignored. The options are the same as for Server component status reporting.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


System Health Validator Point Component Properties

The System Health Validator Component Properties dialog box displays information about how the site System Health Validator points are configured and how the site health state references are stored and retrieved.

Click any link in the following section for detailed information about its associated tab in the dialog box.

In This Section

System Health Validator Point Component Properties: General Tab

Specifies how often health state references are retrieved from Active Directory Domain Services, and specifies time parameters for validating a client statement of health.

System Health Validator Point Component Properties: Health State Reference Tab

Specifies the location of health state references used in the validation process, and the accounts to publish and query the health state references if computer accounts cannot be used.

See Also

Concepts

About System Health Validator Points in Network Access Protection


System Health Validator Point Component Properties: General Tab

Use the General tab of the Configuration Manager 2007 System Health Validator Point Component properties to specify settings relating to the general operation of all System Health Validator points in the site.

Important
If you modify settings in this tab, they will take effect on the next query interval, which is defined on this tab.

This tab contains the elements listed in the following table.

Query interval (minutes)

Specifies in minutes how often System Health Validator points retrieve and cache Configuration Manager health state references from Active Directory Domain Services. The information is retrieved with a Lightweight Directory Access Protocol (LDAP) call to a global catalog.

The lower the value, the more quickly the System Health Validator will detect changes to the Configuration Manager NAP policies; however clients are more likely to be found non-compliant even though they have all the required software updates specified in the Configuration Manager NAP policies. In this scenario, if policies on the Network Policy Server are configured to give non-compliant clients limited network access, in this scenario, clients will not have full network access until they have download their Configuration Manager NAP policies, re-evaluated their compliance, and then send a new statement of health to the System Health Validator point. This process can take a few minutes.

The higher the value, the less likely clients will be found non-compliant when they have all the required software updates specified in the Configuration Manager NAP policies. In this scenario, clients will not risk having limited network access to download their Configuration Manager NAP policies and re-evaluate compliance. However, a higher value might mean that clients are deemed compliant when they haven't evaluated compliance with the latest Configuration Manager NAP policies.

A recommended setting to reduce the likelihood of clients that have the selected software updates having limited network access, but to ensure that compliance results are based on the latest Configuration Manager NAP policies, is to configure this option to be twice the value specified for the Policy polling interval in the Computer client agent properties (by default, this is set to once an hour).

This setting can be between 1 and 10080 minutes, and the default value is 120 minutes.

Validity period (hours)

Specifies the length of time in hours for which a cached client statement of health will be accepted as compliant by System Health Validator points.

If the client statement of health is older than the validity period, the System Health Validator point returns a health state of non-compliant to the Network Policy Server. In this scenario, if policies on the Network Policy Server enforce compliance, the client is forced to re-evaluate its compliance status and present a new statement of health. Therefore, a longer validity period results in quicker processing (and connecting times), but the compliance information might not be up to date.

This setting can be between 1 and 8760 hours, and the default value is 26 hours.

Important
If you change the default validity period, ensure that you configure a value that is higher than the configured evaluation schedule on the Network Access Protection client agent. If the compliance evaluation on the client occurs less frequently than the validity period, clients will be found non-compliant by the System Health Validator point.

In this scenario, remediation will instruct clients to re-evaluate their compliance and produce a current statement of health. This process might take a few minutes to complete, so if policies on the Network Policy Server are configured to limit network access for non-compliant computers, computers will not be able to access network resources on the full network during this re-evaluation time.

Date created must be after (UTC)

Specifies whether you want to ensure a client statement of health is created after a specified date and time (in Coordinated Universal Time). After selecting this option, select the date and time. The date and time cannot be set to a future value but must be the current or a previous date and time.

Setting this option is appropriate if you have just configured a new Configuration Manager Network Access Protection (NAP) policy and it is imperative that the software update selected in the policy is included in the evaluation, regardless of the validity period.

This option is not enabled by default.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection
How to Configure NAP Evaluation Settings
How to Install the System Health Validator Point

Concepts

About Compliance for Network Access Protection in Configuration Manager
About Configuration Manager NAP Policies in Network Access Protection
About Enforcing Compliance with Network Access Protection
About NAP Health State References in Network Access Protection
About the NAP Client Status in Network Access Protection
About the Statement of Health (SoH) in Network Access Protection
About System Health Validator Points in Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection


System Health Validator Point Component Properties: Health State Reference Tab

Use the Health State Reference tab of the Configuration Manager 2007 System Health Validator Point Component properties dialog box to specify configuration relating to the Configuration Manager 2007 health state references, which are used by System Health Validator points to validate a client statement of health.

For more information about the health state references, see About NAP Health State References in Network Access Protection.

Important
The Active Directory forest that will contain the published health state references must be extended with the Configuration Manager 2007 schema extensions, have a System Management container, and have Configuration Manager 2007 configured to publish to Active Directory Domain Services. For information about how to extend the Configuration Manager 2007 schema and publish to Active Directory Domain Services, see How to Extend the Active Directory Schema for Configuration Manager

Important
If you modify settings in this tab, they will take effect on the next query interval, which is defined on the General tab for the System Health Validator Point Component Properties dialog box.

This tab contains the following elements:

Use the same Active Directory forest

Specifies that the site server and System Health Validator points for this site are in the same Active Directory forest.

This is the default setting.

Designate an Active Directory forest

Specifies that the site server and System Health Validator points for this site are not in the same Active Directory forest. When this option is selected, you must also specify the domain suffix where health state references are published, and health state reference accounts if computer accounts cannot be used.

For more information about deploying Network Access Protection across multiple Active Directory forests, see About Network Access Protection and Multiple Active Directory Forests.

To help you decide which Active Directory forest to designate, see Decide Which Forest Will Publish Health State References for Network Access Protection.

This option is not enabled by default.

Domain suffix

Specifies the fully qualified domain for the published health state references. You must specify this if you are designating an Active Directory forest.

This option is not enabled by default.

Health state reference publishing account

Specifies a Microsoft Windows user account in the designated Active Directory forest if any of the following apply:

  • The designated forest is not the same forest as the site server.
  • There is no trust relationship between the site server's domain and the Domain suffix.
  • There is a trust relationship between the site server's domain and the Domain suffix, but Full Control permission has not be granted to the System Management Active Directory container for the site server's computer account.
The Windows account must be specified in the form: domain\user.

This option is not enabled by default.

Health state reference querying account

Specifies a Windows user account in the designated Active Directory forest if any of the following apply:

  • The designated forest is not the same forest as the System Health Validator points.
  • There is no trust relationship between the System Health Validator points and the Domain suffix.
  • The Windows account must be specified in the form: domain\user.
This option is not enabled by default.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About NAP Health State References in Network Access Protection
About System Health Validator Points in Network Access Protection
System Health Validator Point: Validation Process for Network Access Protection

Other Resources

How to Configure the System Health Validator Point for Network Access Protection


Collections Property Pages

The Configuration Manager 2007 Collections Property dialog box displays information about the collections available within your Configuration Manager 2007 site. These include both default collections and collections created using the New Collection Wizard. This dialog box is also where the collection properties and settings can be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Collections Properties

Specifies general and security information applicable to all of the collections currently defined within Configuration Manager 2007.

Collection Name Properties

Specifies information including description, membership rules and advertised programs associated with a specific collection.

Resource Properties

Specifies information about resources within a collection, including resource class, and discovery data, as well as advertisements and variables associated with them.

Query Rule Properties Dialog Box

Specifies information for a query-based membership rule for one or more collections.

See Also

Concepts

About Collections
About Resources
Queries in Configuration Manager


Collections Properties

The Microsoft System Center Configuration Manager 2007 Collections Properties dialog box displays both general and security information about the collections defined within Configuration Manager 2007. Only basic information is available, however, and not data on specific collections.

To display this dialog box, right-click the Collections node within Computer Management, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Collections Properties: General Tab

Displays general information about all collections within the Collections node.

Properties - Security Tab

Specifies security information about all collections within the Collections node, and allows administrators to change or update class security rights.

See Also

Concepts

About Collections
About Resources
Queries in Configuration Manager


Collections Properties: General Tab

Use the General tab of the Configuration Manager 2007 Collection Properties dialog box to specify general information about the collection object class.

The General tab contains the following elements:

Limit number of collection members displayed

Specifies whether or not to set an upper limit number on the number of collection resources that will be displayed. By default, this check box is cleared.

If selected, you can set the following value:

  • Limit: The maximum number of collection resources that will be displayed. By default, this value is set at 2,000.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Collection Name Properties

The Configuration Manager 2007 <Collection Name> Property dialog box displays information about a specific collection and allows users to configure or change many of the settings for that collection. This dialog box also includes information about membership rules, security, and programs being advertised to that collection.

This dialog box is available by right-clicking the specific collection <collection name> and then clicking Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box.

In This Section

Collection Name Properties: General Tab

Specifies general information, including name, recent updates, or membership changes, and any comments about the collection selected.

Collection Name Properties: Membership Rules Tab

Specifies information about membership rules that apply to the collection, including type, limitations, and whether the collection is updated with regard to the membership rules on a specified schedule.

Collection Name Properties: Advertisements Tab

Specifies information about programs and their advertisements currently being broadcast to members of the collection selected.

Properties - Security Tab

Specifies the security rights individual users have on both this class and the specific collection.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Collection Name Properties: General Tab

Use the General tab the Configuration Manager 2007 <Collection Name> Properties dialog box to view or modify general information about the selected collection.

The General tab contains the following elements:

Name

Specifies the name of the collection, up to a total of 127 characters. This field is required and must be unique within the Collections node.

Note
If a collection uses direct membership rules for populating the collection, the name should strongly reflect those rules if possible.

Comment

Specifies an optional description of the collection, up to a total of 127 characters.

Last update

Specifies the date and time when Configuration Manager 2007 last updated the collection.

Last membership change

Specifies the date and time when the collection membership list last changed (during an update).

Collection ID

Specifies the ID number assigned by Configuration Manager to the specific collection.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Collection Name Properties: Membership Rules Tab

Use the Membership Rules tab of the Configuration Manager 2007 <Collection Name> Properties dialog box to define rules that you can use to evaluate membership in the selected collection and set the collection update schedule.

The Membership Rules tab contains the following elements

Membership rules

Indicates the membership rules that are currently defined for the selected collection.

The following options are available for managing membership rules:

  • Computer icon: Click to start the Create Direct Membership Rule Wizard, which enables you to select one or more resources to include in this collection.
  • Query icon: Click to open the Query Rule Properties dialog box, which enables you to define a new query-based membership rule.
  • Properties icon: Click to modify the selected membership rule.
  • Delete icon: Click to delete the selected membership rule.
The following columns are displayed for each membership rule:

  • Rule: Specifies the name of the membership rule.
  • Type: Specifies the type of the membership rule, either Direct (for a specific resource) and/or Query (for a query-based rule).
  • Limit To: Indicates whether the rule is limited to a collection.
    If the rule is limited, the name of the collection that limits the rule appears. If the rule is not limited, <Unlimited> appears.
Update this collection on a schedule

Specifies if the collection membership will be updated on a specific schedule. The default setting for most collections is once per day. (Collections created using the Distribution Software wizard have a default setting of every two hours).

To set a custom schedule for updating the collection, click the Schedule button.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Collection Name Properties: Advertisements Tab

Use the Advertisements tab in the Configuration Manager 2007 <Collection Name> Properties dialog box to view a list of the programs that are being advertised to clients in the selected collection.

Note
The list in this tab also includes advertisements that are defined for other collections in which this collection is a subcollection.

The Advertisements tab contains the following elements:

Advertisements

Specifies the advertisements that are currently available to clients in the selected collection.

The following columns are displayed for the advertisements currently available:

  • Name: Indicates the name of the advertisement.
  • Program: Indicates the program that is specified in the advertisement.
  • Package: Indicates the package that contains the specified program.
  • Collection: Indicates the name of the top-level collection that is specified in the advertisement.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Advertisements
About Collections

Other Resources

How to Manage Advertisements
Collection Name Properties


Collection Name Settings

The Configuration Manager 2007 <Collection Name> Settings dialog box displays information about settings of a specific collection and allows authorized users to configure maintenance windows, custom variables, or polling/policy settings for that collection.

This dialog box is available by right-clicking the specific collection <collection name> and then clicking Modify Collection Settings.

In This Section

Collection Name Settings: Maintenance Windows Tab

Specifies maintenance windows and associated schedules that have been configured for the selected collection.

Collection Name Settings: Collection Variables Tab

Specifies defined collection variables and their values for the selected collection.

Collection Name Settings: Advanced Tab

Specifies restart notification and policy interval settings for resources within the selected collection.

Collection Name Settings: Out of Band Tab

Enables or disables automatic out of band management controller provisioning for resources within the selected collection.

See Also

Concepts

About Collections
About Maintenance Windows
About Configuration Manager NAP Policies in Network Access Protection


Collection Name Settings: Maintenance Windows Tab

Use the Maintenance Windows tab of the Configuration Manager 2007 Collection Name Settings dialog box to specify times when Configuration Manager can apply advertisements and software update deployments to the members in this collection.

Whether an advertisement can be applied to a collection that has been configured with maintenance windows depends on whether the Maximum Allowed Run Time of the advertised program is less than the length of the maintenance window or whether the program has been specifically set to ignore maintenance window restrictions. This latter option is available only if the advertised program is mandatory (assigned).

For more information on maintenance windows and the Maximum Allowed Run Time setting, see About Maintenance Windows.

The Maintenance Windows tab contains the following elements:

Maintenance windows

Specifies whether maintenance windows have been configured for this collection and what their settings are. Configured maintenance windows are displayed in the table.

Users with appropriate rights can select or clear the check boxes accompanying each displayed maintenance window to activate or deactivate the specific window on this collection.

Note
To modify maintenance windows and activate or deactivate them, a user must have Modify Collection Settings permission.

The following options are available for managing maintenance windows for this collection:

  • New icon: Click to open the New Schedule dialog box and create a new maintenance window.
  • Properties icon: Click to open the <Maintenance Window> Schedule dialog box to view or modify the current schedule settings.
  • Delete icon: Click to delete the selected maintenance window.
The following columns are displayed, showing configured maintenance windows:

  • Name: Specifies the name of the configured maintenance window.
  • Description: Specifies a description of the maintenance window, including scheduled time and frequency.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Collections
About Maintenance Windows
Program Run Scenario using Maintenance Windows


Collection Name Settings: Collection Variables Tab

Use the Collection Variables tab of the Configuration Manager 2007 Collection Name Settings dialog box to define custom task sequence variables and their associated values to be used by the resources in this collection. For more information about task sequence variables use the following link: About Task Sequence Variables

Note
Task sequence variables can also be assigned to computers. Task sequence variables that are assigned to a specific computer have a higher priority than variables assigned to the collection or collections where the Configuration Manager 2007 client is located.

The Collection tab contains the following elements:

Variables

Specifies whether custom task sequence variables have been defined for this collection and what their associated values are.

Note
Collection variable names can only contain ASCII characters.

The following options are available for managing collection variables for this collection:

  • New icon: Click to open the New Variable dialog box and create a new collection variable.
  • Properties icon: Click to open the <Name> Variable dialog box to view or modify the current variable settings.
  • Delete icon: Click to delete the selected variable.
The following columns are displayed, showing defined collection variables:

  • Name: Specifies the name of the defined variable.
  • Value: Displays the value of the defined variable unless that value has been masked by the administrator.
Precedence

Specifies the precedence assigned to the collection task sequence variables for this collection. Precedence level is used to determine which collection variables apply when a client computer is assigned as a member of multiple collections.

You can specify precedence by selecting a numeric value from the drop-down list, where 1 is the lowest, and 9 the highest precedence.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create Per-Collection Task Sequence Variables

Concepts

About Collections
About Task Sequence Variables
Operating System Deployment Task Sequence Variables


Collection Name Settings: Advanced Tab

Use the Collection Name Advanced tab of the Configuration Manager 2007 Collection Name Settings dialog box to specify restart notification and policy interval settings for resources within the selected collection.

The Collection Name Advanced tab contains the following elements:

Enable collection specific restart settings

Specifies whether restart notification settings specific to this collection will be enabled. If this option is selected, these settings override any sitewide settings.

If this option is selected, the following settings are available for customization:

  • Restart countdown (minutes): Specifies the length of the client restart notification (in minutes) for the computers within this collection. The default setting is 5 minutes.
  • Restart final notification (minutes): Specifies the length of time before restart (in minutes) that a final client notification is displayed for computers within this collection. The default setting is 1 minute.
Enable collection specific policy polling interval

Specifies whether a policy polling interval specific to this collection will be enabled. This interval specifies how often clients in this collection will poll for new policies. If this option is selected, this setting overrides any sitewide policy polling interval.

If this option is selected, the following setting must be set:

  • Policy polling interval (minutes): Specifies the interval (in minutes) between client polling for new policies. The default setting is 5 minutes.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

Important
If a client is a member of multiple collections with different polling and restart intervals, it will use the shortest configured interval.

See Also

Concepts

About Collections
About Resources
About Configuration Manager NAP Policies in Network Access Protection


Collection Name Settings: Out of Band Tab

Topic last updated—January 2008

Use the Out of Band tab in the Configuration Manager 2007 SP1 Collection Name Settings dialog box to enable automatic AMT provisioning for Configuration Manager 2007 SP1 clients within the selected collection.

To create a query-based collection that contains only computers that have management controllers, see How to Identify Computers That Can Support Out of Band Management.

The Out of Band tab contains the following elements.

Enable automatic out of band management controller provisioning

Specifies whether AMT-based computers that have the Configuration Manager 2007 SP1 client installed will automatically provision for AMT so that they can be managed out of band.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management
Prerequisites for Out of Band Management


Query Rule Properties Dialog Box

Use the General tab in the Configuration Manager 2007 Query Rule Properties dialog box to specify a query-based membership rule for one or more collections.

The General tab contains the following elements:

Name

Specifies the name of the membership rule up to 50 characters. This field is required.

Import Query Statement

Click to open the Browse Query dialog box, which enables you to select an existing query.

Resource class

Specifies the standard class of resource in which to search for the results of the query. The following options are available:

  • System Resource
  • User Group Resource
  • User Resource
Edit Query Statement

Click to open the Query Statement Properties dialog box, which enables you to modify the selected query expression.

Collection limiting

Specifies whether the query will be limited to the resources of a given collection and, if so, to which collection.

The following options are available:

  • Not collection limited: Specifies that the membership rule is not limited to a particular collection. By default, this option is selected.
    Note
    If you do not have security rights to read all collections, you cannot select this option.

  • Limit to collection: Specifies a collection to which the membership rule will be limited.
    To specify a collection, click Browse, select a collection, and then click OK.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Queries


Resource Properties

The Microsoft System Center Configuration Manager 2007 Resource Properties dialog box displays information about the resources included within a collection, including general information, programs currently advertised to the resource, and custom variables used by the resource while task sequences are being run.

To display this dialog box, click a specific collection, right-click the resource within the results pane, and then click Properties.

Click any link in the following table for detailed information about its associated tab in the dialog box:

In This Section

Resource Properties: General Tab

Displays general information about the selected resource, including name, resource class, and discovery data.

Resource Properties: Advertisements Tab

Displays information about the programs currently advertised to the selected resource.

Resource Properties: Variables Tab

Specifies custom variables and their associated values used by the selected resource while task sequences are being run.

See Also

Tasks

How to Update Collections

Concepts

About Resources

Other Resources

How to Manage Resources


Resource Properties: General Tab

Use the General tab in the Configuration Manager 2007 Resource Properties dialog box to specify general information about the selected resource, including name, resource class, and discovery data.

The General tab contains the following elements:

Name

Specifies the name of the selected resource.

Resource class

Specifies the classification type of the selected resource. Commonly used classifications include System, User, or User Group.

Discovery data

Displays the properties and the associated values of all the data about this resource collected during Configuration Manager 2007 discovery. Common properties found here include IP address, unique identifiers, hardware ID, and other information.

The following columns are displayed for each property collected:

  • Property
  • Value
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Display Resource Properties

Concepts

About Resources

Other Resources

How to Manage Resources


Resource Properties: Advertisements Tab

Use the Advertisements tab in the Configuration Manager 2007 Resource Properties dialog box to display programs that are currently being advertised to the selected resource. The Advertisements tab contains the following elements:

Advertisements

Specifies the advertisements that are currently available to the selected resource, including all the collections to which it belongs.

The following columns are displayed for each advertisement listed:

  • Name: Specifies the name of the advertisement.
  • Program: Specifies the program being advertised.
  • Package: Specifies the package containing the advertised program.
  • Collection: Specifies the name of the top-level collection to which the program is being advertised.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Display Resource Properties
How to View Advertisements for a Resource

Concepts

About Resources

Other Resources

How to Manage Resources


Resource Properties: Variables Tab

Use the Variables tab in the Microsoft System Center Configuration Manager 2007 Resource Properties dialog box to specify custom per-computer task sequence variables and their associated values used by the resource while task sequences are being run. For more information about task sequence variables use the following link: About Task Sequence Variables

Note
Task sequence variables can also be assigned to collections. Task sequence variables that are assigned to a specific computer have a higher priority than variables assigned to the collection or collections where the Configuration Manager 2007 client is located.

The Variables tab contains the following elements:

Variables

Specifies the custom task sequence variables associated with the resource and their associated values.

The following options are available for managing task sequence variables associated with this resource:

  • New icon: Click to open the New Variable dialog box and create a new variable and assign a value to it for this resource.
  • Properties icon: Click to open the <Variable Name> dialog box to modify the current value associated with the variable.
  • Delete icon: Click to delete the variable and its associated value from this resource.
The following columns are displayed for each variable listed:

  • Name
  • Value
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Display Resource Properties
How to Create Per-Computer Task Sequence Variables

Concepts

About Resources
Operating System Deployment Task Sequence Variables

Other Resources

How to Manage Resources


Resource Explorer Properties

You can use resource explorer to view client hardware, hardware history, and software inventory information.

In This Section

Resource Explorer: Hardware

Resource Explorer: Hardware History

Resource Explorer: Software

See Also

Other Resources

Collections Property Pages


Resource Explorer: Hardware

In Resource Explorer, the Hardware node is used to view the most recent hardware inventory information reported by Configuration Manager clients. This information can be used to determine the hardware installed on clients and specific information about the installed hardware itself.

The information Configuration Manager collects about client hardware inventory is determined through the use of a machine inventory reporting policy based on the contents of the SMS_def.mof file. The client inventory reporting policy is retrieved from the client's management point and automatically evaluated and applied during their normal machine policy polling interval. If the class level reporting property for a class is enabled (set to TRUE) in the SMS_def.mof, and at least one of the properties of the class has reporting enabled (set to TRUE), the data class corresponding the reporting class in the SMS_def.mof will be inventoried. After the inventory report from the client has been processed by the primary site server, the inventory results for the client will be viewable in Resource Explorer. If the reporting property is not enabled (set to FALSE) for a class or class property in the SMS_def.mof, it will not be inventoried or displayed in Resource Explorer.

Because hardware inventory is dependent on the data provided by hardware manufacturers, the data retrieved for some manufacturers may be different from the data retrieved for others. For example, if a client has two local hard drives and one hard drive manufacturer registers the hard drive serial number in the client's WMI repository while another manufacturer does not, you may see the serial number for the first hard drive in Resource Explorer while the second hard drive's serial number field will be empty.

Hardware inventory is also capable of inventorying installed software and registry keys on clients. For example, the Add or Remove Programs data for programs installed on clients is inventoried as part of hardware inventory process. This data is inventoried by reading the client registry and inventorying the uninstall registry key for installed programs.

To determine the most recent time that hardware inventory has been reported for a client you can review the Workstation Status details in Resource Explorer.

See Also

Concepts

About Resource Explorer
How to Extend Hardware Inventory

Other Resources

Resource Explorer Properties


Resource Explorer: Hardware History

In Resource Explorer, the Hardware History node contains client hardware inventory reporting information that has changed since the previous hardware inventory report was processed for a client as well as the most current inventory information for the changed class only.

If hardware inventory information for a reporting class has changed since a previous inventory was taken, you can view the previously reported information for a class by expanding the display name for the reporting class under the Hardware History node. To view what is currently being reported for the inventory class click Current. To view previously reported information, click the previous inventory reports displayed by the date and time the previous report was received.

For example, if a new hard drive has been added to a system since the previous inventory, both hard drives will be visible in the Hardware node of Resource Explorer, while the information for only one hard drive will be visible in the Hardware History node under previous inventory reporting information. You can click Current under the inventory report class in the Hardware History node to see what is currently being reported for a class and then compare it to the information inventoried at a previous date and time before the most current inventory was taken.

Previous hardware inventory history information remains displayed in Resource Explorer until it is deleted by the Delete Aged Inventory History predefined site maintenance task.

Note
Configuration Manager keeps historical hardware inventory reporting information for the number of days you specify in the Delete Aged Inventory History site maintenance task. For more information about this task see, Delete Aged Inventory History Task Overview.

See Also

Concepts

About Resource Explorer

Other Resources

Resource Explorer Properties


Resource Explorer: Software

The Software node in Resource Explorer is used to view the most recent software inventory information reported by Configuration Manager clients. You can use this information to determine the software installed on clients and specific information about the installed software itself.

The Software node of Resource Explorer contains information about:

  • Collected files
  • Last software scan and file collection information
  • Product details for installed applications.
  • Unknown files

Collected Files

If you have specified files to be collected from clients during software inventory, information about the collected files is displayed in Collected Files.

To display the following information in the results pane of Resource Explorer, click Collected Files:

Collection Date

The date when the file was collected from the client.

File Name

The name of the file that was collected.

File Path

The path to the file on the client.

File Size

The size of the collected file (in bytes).

Modified Date

The date and time when the collected file was last modified.

Last Software Scan Information

Information about the last software inventory cycle.

Last Inventory Collection

The date of the last software inventory collection on the client.

Last File Collection

The date of the last file collection on the client.

Product Details for Installed Applications

Information about products that were inventoried on the client, grouped by software manufacturer names. To display the following information in the results pane, double-click Product Details:

Company Name

A list of all company names associated with the inventoried products (for example, Microsoft Corporation). To display all product details, expand the Product Details folder.

Select a manufacturer to display the following information for each inventoried product that is associated with the selected manufacturer:

Product Name

The inventoried product name (for example, Microsoft Office 2000).

Product Version

The version of the product inventoried (for example, 7.0).

Product Language

The language of the product inventoried; for example, English (United States).

To display all inventoried files that are associated with a product, select a product. The same information that is displayed when you click the File Details folder is displayed in the results pane.

Inventoried File Details

Detailed information about inventoried files that are not associated with any specific product or manufacturer.

To display the following information in the results pane, click Unknown Files:

File Name

The name of the file that was inventoried (for example, Fastopen.exe).

File Description

A description of the file, if one exists in the file header.

File Version

The version number of the file, if one exists in the file header.

File Size

The size of the file, in bytes.

FilePath

The path of the file on the client computer. For example, if more than one copy of Install.cmd exists on a computer, this column displays the number of copies that are found.

Modified Date

The date and time when the file was last modified (for example, 8:00:00 AM 7/31/98).

See Also

Tasks

How to Configure Software Inventory for a Site

Concepts

About Resource Explorer

Other Resources

Resource Explorer Properties


Conflicting Records

Microsoft System Center Configuration Manager 2007 uses the hardware ID to attempt to identify clients that might be duplicates and alert you to the conflicting records. For example, if you have to reinstall a computer, the hardware ID would be the same but the GUID used by Configuration Manager 2007 might be changed. If the Advanced tab of the Site Server Properties is configured to Manually resolve conflicting records, client records with duplicate hardware IDs are displayed in this node and you must decide whether to merge the duplicate records, create a new record for the duplicate hardware ID, or create a new client record but block that client.

Note
You must have Modify Resource permission on any collection containing a conflicting record to reconcile the conflicting records that appear in the Conflicting Records node.

The Conflicting Records node allows you to perform the following actions on conflicting records:

Merge

Combines the newly detected record with the existing client record to create one unified record. Select this action if a computer has been recovered and you want to retain the previous client identity for reporting purposes.

New

Creates a new record for the conflicting client record. Select this action if you mistakenly have computers showing up with duplicate records, for example if you have imaged computers without first removing unique identifying information.

Block

Creates a new record for the conflicting client record but marks it as blocked.

See Also

Tasks

How to Block Configuration Manager Clients
How to Manage Conflicting Records for Configuration Manager Clients

Reference

Site Properties: Advanced Tab


Packages Property Pages

Within Configuration Manager 2007, packages property dialog boxes display information about software distribution packages and allow users to configure many settings for those packages. These dialog boxes include not only information about specific packages, but also information about the access accounts, distribution points, and programs associated with the package.

Click any link in the following section for detailed information about its associated properties page:

In This Section

Packages Properties

Specifies general and security information about all packages within the Software Distribution node.

Package Name Properties

Specifies information, including data source, access, distribution, and other settings about a specific package. These dialog boxes are available by right-clicking the specific package <package name> and then clicking Properties.

Access Account Properties: General Tab

Displays information about a specific access account, and allows administrators to change access rights for that account. This dialog box is available by clicking Access Accounts for a specific package in the results pane, and then right-clicking a specific account and clicking Properties.

Distribution Point Properties: General Tab

Displays information about a specific distribution point associated with a package. This dialog box is available by clicking Distribution Points for a specific package, and then right-clicking a specific distribution point in the results pane and clicking Properties.

Program Name Properties

Specifies information, including command line, requirements, environment, and other settings about a specific program. These dialog boxes are available by right-clicking the specific program <program name> and then clicking Properties.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages


Packages Properties

The Package Properties dialog box displays both general and security information about the packages available within Configuration Manager 2007. Only basic information is available, however, and not data on specific packages.

To display this information, right-click the Packages node within Software Distribution, and then click Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Packages Properties: General Tab

Displays general information about all packages within the Software Distribution node.

Properties - Security Tab

Specifies security information about all packages within the Software Distribution node, and allows administrators to change or update class security rights.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages


Packages Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Distribution Package Properties dialog box to specify general information about all packages within the Software Distribution node. Only basic information is available, however, and not data on specific packages.

The General tab contains the following elements:

OK

Saves any changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Properties


Package Name Properties

The <Package Name> Properties dialog box displays information about a specific software distribution package and allows administrators to configure many settings for that package. This dialog box also includes information about the access accounts, distribution points, and programs associated with the package.

This property page is available by right-clicking the specific package <package name> and then clicking Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Package Name Properties: General Tab

Specifies general information, including name, version, and any comments about the specific package selected.

Package Name Properties: Data Source Tab

Specifies data source information, including whether the package contains source files, where those files are located, and whether associated distribution points are updated on a schedule.

Package Name Properties: Data Access Tab

Specifies where Configuration Manager 2007 stores this package on distribution points and how it will be accessed.

Package Name Properties: Distribution Settings Tab

Specifies branch distribution point content settings, as well as sender and priority to use when sending this package to child sites.

Package Name Properties: Reporting Tab

Specifies how Management Information Format (MIF) files generated by clients apply to this package.

Properties - Security Tab

Specifies the security rights individual users have on both this class and the specific package.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Properties


Package Name Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Distribution <Package Name> Properties dialog box to specify general information about the specific package selected, including name, version, and any available comments.

The General tab contains the following elements:

Name

The name of the package, up to 50 characters. This field is required.

Version

The version number of the package, up to 32 characters.

Manufacturer

The software manufacturer of the package, up to 32 characters.

Language

The language version of the software package, up to 32 characters.

Comment

Optional text about the package, such as a description. You can use up to 127 characters.

OK

Saves any changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Properties
Package Name Properties


Package Name Properties: Data Source Tab

Use the Data Source tab of the Configuration Manager 2007 Software Distribution <Package Name> Properties dialog box to specify data source information, including whether the package contains source files, where those files are located, and whether associated distribution points are updated on a schedule. Package source files are any files that must be copied to a distribution point to support a package when one of its programs is advertised to clients.

The Data Source tab contains the following elements:

This package contains source files

Indicates the package has source files not already on the client computer that its programs must run. By default, this check box is cleared and Configuration Manager 2007 does not use distribution points for the package. When this check box is selected, distribution points are used.

Source directory

Specifies the network path to the package source files. This field is unavailable unless the This package contains source files check box is selected.

To specify the path to the source directory, click Set to open the Set Source Directory dialog box.

Note
Do not specify path/filenames for package source files that exceed 254 characters, paths of this length cannot be replicated.

Two options are available when designating a source directory:

  • Use a compressed copy of the source directory: Configuration Manager 2007 will create a compressed version of the source files on the site server. If this option is selected, this compressed version will be decompressed and copied to the distribution points instead of being copied directly from the original source folder when the distribution points are refreshed. Use this option if the source files might be removed from the specified path (for example, if the source files are on a CD).
    Important
    When defining a location to store a compressed file, the folder or drive used must an NTFS file, as the FAT format will not correctly store the compressed source file.

    If you select this option and then specify Update All Distribution Points in the Manage Distribution Points Wizard, a new version of the compressed copy is created from the specified source folder.
    Note
    A compressed version of the source folder is always created and used when the package is sent to distribution points in child sites.

  • Always obtain files from the source directory: Each time a distribution point is refreshed, Configuration Manager 2007 will obtain the package source files from the path specified in the Source directory box. Use this option if the source files are likely to remain at the specified path, such as a share on a server.
    Note
    This field is unavailable if the package is a compressed version replicated from a parent site.

Update distribution points on a schedule

Specifies the source files for this package will be regularly updated on distribution points. When this option is selected, the default schedule is set to the current date with an interval of one day. By default, this check box is cleared.

To set a schedule for distribution point updates, click Schedule to open the Custom Schedule dialog box. This button is available only when Update distribution points on a schedule is selected.

Persist content in client cache

Specifies whether content should be retained in the cache on the client computer indefinitely even if it has already been run. Although this option can be useful with some recurring packages such as virus software, you should know that this will reduce the available cache space. Specifying this option might cause a large package to fail at a later point if there is insufficient space available in the cache.

Enable binary differential replication

Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Properties
Package Name Properties


Package Name Properties: Data Access Tab

Use the Data Access tab of the Configuration Manager 2007 Software Distribution <Package Name> Properties dialog box to specify where Configuration Manager 2007 stores this package on distribution points and how it will be accessed.

The Data Access tab contains the following elements

Access distribution folder through common ConfigMgr package share

Specifies whether users will access the package through the common Configuration Manager 2007 package share (SMSPKGx$, where x is the drive letter) on distribution points. This option is selected by default.

Share distribution folder

Specifies whether the package will be created on distribution points with an administrator-specified share and path name. Selecting this option requires a share name.

Share name

Specifies a share name or path to be created for the package source files on distribution points. This share name must be unique, even across package types, as duplicate share names may cause data corruption.

Two options are available:

  • The value can be a share, in which case the name must be unique across all packages. If this option is used, all files and subdirectories within that share will be deleted and re-created each time the package is updated or refreshed.
  • The value can be a share and a path, in the format sharename\path, in which case the path must be unique across all packages. If this option is used, only the final directory in the path will be deleted and re-created each time the package is updated or refreshed.
    Note
    Do not enter a full Universal Naming Convention (UNC) path in Share name, such as \\server\share. Instead enter a share and path name in the format sharename\path.

To control which drive a package folder is created on, you can assign the distribution point role to a server share rather than a server computer. For distribution points on server shares, if a share name is entered for a package, it is treated as a path beneath the distribution point share (\\MyServer\MyShare). For more information, see Site Systems Configuration Overview.

Note
If the share distribution folder is subsequently changed, it is important to make sure that only the valid share name is used. If an invalid name is used, the package content will be deleted and the package source will need to be recopied to a valid share.

Disconnect users from distribution points

Specifies that users will be disconnected from distribution points when Configuration Manager 2007 updates package data. This option applies only to standard distribution points.

This check box is cleared by default.

If this option is selected, the following settings are available:

  • Number of retries before disconnecting users: Specifies the number of times that Configuration Manager 2007 tries to update the package source files before disconnecting users connected to the distribution point. The default setting is 2; you can specify 0 to 99, inclusive.
  • Interval between user notification and disconnection (minutes): Specifies the number of minutes Configuration Manager 2007 will wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.
    Note
    If the program within the package has the Run Program from Distribution Point option set, clients running either the Windows Vista or Windows Server 2008 operating systems will not receive user notification. For more information about verifying whether this option has been set, see Advertisement Name Properties: Distribution Points Tab.

OK

Saves any changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Properties
Package Name Properties


Package Name Properties: Distribution Settings Tab

Topic last updated—January 2008

Use the Distribution Settings tab of the Configuration Manager 2007 Software Distribution <Package Name> Properties dialog box to specify the sender and priority to use when sending this package to another site, as well as to specify your branch distribution point content settings.

The Distribution Settings tab contains the following elements listed in the following table.

Sending priority

Specifies the priority of this package when sent to another site. Three priorities are available:

  • High
  • Medium (default setting)
  • Low
Packages are sent in priority order, and packages with identical priorities are sent in order of creation.

Preferred sender

Specifies the sender to be used to send this package to other sites. You can specify any sender configured for the site or No Preference (the default setting), which uses any available sender.

Note
To use Courier Sender to distribute packages, you must select it as the preferred sender.

Automatically download content when packages are assigned to branch distribution points

Specifies that the package will be automatically downloaded to all branch distribution points that are selected as distribution points for the package. This is the default option. The other option available is to have the administrator manually copy the package to the branch distribution point.

When this option is selected, the following additional option is available:

  • Make this package available on protected distribution points when requested by clients inside the protected boundaries: Specifies whether the package is available for download to a branch distribution point that has not already been specifically designated as a distribution point when requested by a client located within the protected boundaries of that branch distribution point. If this option is selected, a client request will cause the local branch distribution point to download the package. After the content is successfully provisioned on the branch distribution point, a subsequent client request will be able to download and run this content.
    Note
    Download content on demand is available only for protected branch distribution points. If a branch distribution point is configured but not protected, the management point will not trigger the package download.

Administrator manually copies this package to branch distribution points

Specifies that the administrator must manually copy this package to the branch distribution points. It will not be automatically downloaded.

Allow this package to be transferred via multicast

Enables this package to be transferred via multicast. Multicast conserves network bandwidth by simultaneously sending data to multiple clients rather than sending the data to each client over a separate connection. Multicast is only supported for run command line actions that are part of a task sequence during the WinPE phase of an operating system deployment. This setting will not apply to other software distribution packages.

Applies only to Configuration Manager 2007 R2.

Encrypt packages when transferred via multicast

Specifies that the package will be sent encrypted when sent via multicast.

Applies only to Configuration Manager 2007 R2.

Only transfer this package via multicast

Specifies that this package can only be sent using multicast.

Applies only to Configuration Manager 2007 R2.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Properties
Package Name Properties


Package Name Properties: Reporting Tab

The Reporting tab of the Configuration Manager 2007 Software Distribution <Package Name> Properties dialog box specifies how Management Information Format (MIF) files generated by clients apply to this package.

The Reporting tab contains the following elements:

Use package properties for status MIF matching

Configuration Manager 2007 will use the properties on the General tab for status MIF file matching. This option is selected by default.

Use these fields for status MIF matching

Configuration Manager 2007 will use the values specified on this page for status MIF file matching.

If this option is selected, the following fields are available:

  • MIF file name: The name of the MIF file that contains the package status, up to 50 characters.
  • Name: The name of the package, up to 50 characters.
  • Version: The version number of the package, up to 32 characters.
  • Publisher: The software publisher of the package, up to 32 characters.
Note
Without these fields, Configuration Manager 2007 may pick up the wrong MIF file, which will then incorrectly report status back to the site.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Properties
Package Name Properties


Program Name Properties

The <Program Name> Properties dialog box displays information about a specific program within a software distribution package. It allows users to configure many settings for that program such as information about the command line, requirements, environment, and other settings associated with the program.

This dialog box is available by right-clicking the specific program <program name> and then clicking Properties.

Click any link in the following section for detailed information about the associated program dialog box tab:

Program Name Properties: General Tab

Specifies general information, including name, comments, command line, action to take after running, and other information about the specific program selected.

Program Name Properties: Requirements Tab

Specifies the disk space and platform requirements that must be met for the program to run on the client computer.

Program Name Properties: Environment Tab

Specifies any administrative conditions that must be met for the program to run on the client computer.

Program Name Properties: Advanced Tab

Specifies any additional criteria that must be met for the program to run on the client computer. Also available is the ability to disable the program.

Program Name Properties: Windows Installer Tab

Displays Windows Installer product information to enable source management of the program.

Program Name Properties: MOM Tab

Specifies whether to run a Microsoft Operations Manager (MOM) alert when the program is run or whether to disable the alert process while the program runs.

See Also

Concepts

About Programs

Other Resources

How to Manage Programs


Program Name Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Distribution <Program Name> Properties dialog box to specify general information about the program selected, including name, command line, comments, and behavior after running.

Note
The use of software deployed by Configuration Manager may be subject to license terms. All applicable license terms should be reviewed prior to deploying software.

The General tab contains the following elements:

Name

Specifies the name of the program, up to 50 characters. This field is required and must be unique within a package.

Note
After you create a program, you cannot modify its name.

On client computers, this name appears in Run Advertised Programs and Add or Remove Programs in Control Panel.

Comment

Specifies optional text about the program, such as a description. You can use up to 127 characters.

On client computers, this text is displayed in Run Advertised Programs in Control Panel.

Command line

Specifies the command line for the program, up to 255 bytes.

For example:

setup.exe /a

or

Msiexec /I my_app.msi /l*v /qn

This field is required.

To navigate to the program file, click Browse. By default, the package source folder appears, if it exists and is accessible. If it does not exist or is not accessible, the root folder of the current computer appears.

File name extensions are strongly recommended. If the file name does not have an extension specified, Configuration Manager 2007 tries .com, .exe, and .bat as possible extensions. If the file is not an executable, Configuration Manager 2007 will try to apply a local association if possible.

When the program is run on a client, Configuration Manager 2007 first searches for the command-line file name within the package, followed by the local Microsoft Windows folder. If the file cannot be found, the program fails.

Start in

Specifies the executable folder for the program, up to 127 characters. This folder can be an absolute path on the client or a path relative to the distribution point folder that contains the package. This field is optional.

For example:

c:\office_setup

or

install_files

Run

Specifies the mode in which the program will run on the client computer. The following modes are available:

  • Normal: The program runs in the normal mode based on system and program defaults. This is the default mode.
  • Minimized: The program runs minimized on the client computer.
  • Maximized: The program runs maximized on the client computer.
  • Hidden: The program is hidden while running on the client computer.
After running

Specifies the action that occurs after this program has completed successfully:

  • No action required: No restart or log off is required. This is the default value.
  • Configuration Manager restarts computer: The computer is restarted automatically by Configuration Manager 2007.
  • Program restarts computer: The program requires a restart and performs this action automatically.
  • Configuration Manager logs user off: The current user is logged off the computer after the program is completed. Use this option if the program requires that the user log off and then log on again before it can run.
Important
Both the Configuration Manager restarts computer and Configuration Manager logs user off actions are done forcefully after providing the user with a grace period. Applications that are running on clients when this occurs do not have an opportunity to save their states or data.

Category

Specifies the category under which the program will be displayed on the client computer.

Specifying a category for a program will help users find specific programs of interest. Advertised programs appear under the What's New category for up to 14 days or until they are run.

Note
By including ConfigMgr or a similar designation in the category name, categories can also be used to distinguish between programs in Add or Remove Programs that have been advertised by Configuration Manager 2007 and those advertised using group policies.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Program Name Properties: Requirements Tab

Use the Requirements tab of the Configuration Manager 2007 Software Distribution <Program Name> Properties dialog box to specify program requirements, including the client platforms on which the program will run, estimated disk space and run time for the program, and any additional requirements.

The Requirements tab contains the following elements:

Estimated disk space

Specifies the amount of disk space that the software program requires to run on the computer. This can be specified as Unknown (the default setting) or as a whole number greater than or equal to zero. If a value is specified, units for the value must also be specified.

On client computers, the specified value appears in Run Advertised Programs in the Control Panel.

Maximum allowed run time

Specifies the maximum time (in minutes) that the program is expected to run on the client computer. This can be specified as Unknown or as a whole number greater than zero.

By default, this value is set to 120 minutes.

Important
If you are using maintenance windows for the collection on which this program is run, a conflict may occur if the Maximum allowed run time is longer than the scheduled maintenance window. If the maximum run time is set to Unknown, the program will start during the maintenance window, but will continue to run until it completes or fails after the maintenance window is closed. As a result, programs with a maximum run time set to Unknown may run past the end of their maintenance windows. If the maximum run time is set by the user to a specific period (that is, not set to Unknown) that exceeds the length of any available maintenance window, then that program will not be run. For more information, see About Maintenance Windows.

It is not recommended that you set this value to Unknown because this value is used for two important purposes:

  • To monitor the results of the program.
  • To determine if a program will be launched when maintenance windows have been defined on the client computers.
If the value is set as Unknown, Configuration Manager 2007 sets the maximum allowed run time as 12 hours (720 minutes).

Note
If the maximum run time (whether set by the user or as the default value) is exceeded, Configuration Manager 2007 will stop the program if it is set to run with administrative rights and the allow users to interact with this program setting is not selected.

If the program itself is not stopped, Configuration Manager 2007 stops monitoring the program after the maximum allowed run time is exceeded. This allows Configuration Manager 2007 to continue with other software distribution functions, such as running other advertised programs. As a result, Configuration Manager does not:

  • Stop the program.
  • Free up any drives that have been mapped for the advertised program.
  • Free up any network connections made for the advertised program.
  • Remove security rights granted to the Client Token account, if any.
  • Free up operating system resources used by Configuration Manager when running advertised programs.
On client computers, the specified value for published programs appears in Run Advertised Programs in Control Panel and helps the user decide if and when to run the advertised program.

This program can run on any platform

Specifies whether the program can run on any available operating system platforms. If this option is selected, Configuration Manager 2007 does not check the platform type when advertising the program to clients. By default, this option is selected.

This program can run only on specified client platforms

Specifies whether the program can be run only on specific processors, operating systems, or service packs. When this option is selected, at least one platform from the accompanying list must also be selected.

Additional requirements

Specifies any additional requirement information for clients, up to 127 characters. For example, you can notify users that they should shut down all other applications before running the program. This field is optional.

If specified, the text appears on client computers in Run Advertised Programs in Control Panel.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Program Name Properties: Environment Tab

Use the Environment tab of the Configuration Manager 2007 Software Distribution <Program Name> Properties dialog box to specify any conditions, such as user interaction or necessary rights, that are required for a program to run on client computers.

The Environment tab contains the following elements:

Program can run

Specifies the logon conditions necessary for the program to run:

  • Only when a user is logged on: Prevents the program from running if no user is logged on to the client computer. This is the default setting.
  • Whether or not a user is logged on: Enables the program to run with or without a user logged on the client computer.
  • Only when no user is logged on: Prevents the program from running until the user logs off the computer.
    Note
    If a user logs on while the installation is running, the program continues to run.

Run Mode

Specifies the credentials required to run the program on the client computer. Two options are available:

  • Run with user's rights: Specifies whether the program runs with user credentials. This option is selected by default.
  • Run with administrative rights: Specifies whether the program runs with administrator credentials. If selected, this forces the program to run under the local system account (or called the computer account) on the client computer.
    If this option is selected, the following additional option is available:
    • Allow users to interact with this program: Specifies whether to allow users to interact with the program. This check box is available only when Only when no user is logged on is selected as a logon condition and Run with administrative rights is selected.
      Select this option only for programs that must run in an administrative context and that require the user to interact with the program. If you select this option, the user interface for the program is visible to the logged-on user, and that user can interact with the program.
      Leave this option clear for all programs that do not display any user interface or that display a user interface but do not require the user to interact with the program.
      Note
      If you advertise a program that is set to Run with administrative rights and you do not select Allow users to interact with this program, the program can fail if it displays a user interface that requires a user to make a selection or click a button. The program waits for user interaction until the program's configured Maximum allowed run time is exceeded, and then stops if no user interaction is received. If no Maximum allowed run time is specified, the program's process ends after 12 hours.

Runs with UNC name

Specifies that the program runs with a Universal Naming Convention (UNC) name. This is the default setting.

Requires drive letter

Indicates that the program requires a drive letter to fully qualify its location, but Configuration Manager 2007 can use any available drive letter on the client.

Requires specific drive letter

Indicates that the program requires a specific drive letter that you specify to fully qualify its location.

If the specified drive letter is already used on a given client, the program does not run.

Reconnect to distribution point at logon

Specifies that the client computer reconnects to the distribution point when the user logs on. By default, this check box is cleared.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Program Name Properties: Advanced Tab

Topic last updated—November 2007

Use the Advanced tab of the Configuration Manager 2007 Software Distribution <Program Name> Properties dialog box to specify any special settings, such as program dependencies, that must be met for the program to install and run on the client computer.

The Advanced tab contains the following elements:

Run another program first

Specifies that this program requires another program to run before it. By default, this check box is cleared. If a program is run first and fails on a client, the dependent program will not run.

Note
The program that you specify to run first does not need to be advertised separately.

Important
Dependent programs are not installed when a program is run in a task sequence. The Install Software action checks to see whether the dependent program is already installed. If so, the Install Software action will proceed with installing the main program. However, if the dependent program is not already installed, the installation of the main program will fail. You must explicitly install the dependent programs as part of your task sequence.

If this option is selected, the following fields must be completed:

  • Package: Specifies the package containing the program that must run before this program.
  • Program: Specifies the program that must run first.
In addition, the following option is available:

  • Always run this program first: Specifies whether the program that runs first should run every time the advertised program runs, regardless of previous run history.
    If the program that runs first has been run successfully, Configuration Manager 2007 does not automatically rerun it, even if the dependent program is on a recurring schedule.
When this program is assigned to a computer

Specifies how the program is assigned to users when Program can run (on the Environment tab) is set to Only when a user is logged on. The following options are available:

  • Run once for the computer: The program runs only once on the client computer. This is the default setting.
  • Run once for every user who logs on: The program runs once for each new user who logs on.
Suppress program notifications

Specifies that notification area icons and messages, as well as countdown notifications, will not be displayed for this program.

Disable this program on computers where it is advertised

Specifies whether all advertisements that contain this program are to be temporarily disabled. If this option is selected, the program is removed from the list of available programs for users to run and it will not be run through assignment until re-enabled. This check box is cleared by default.

Allow this program to be installed from the Install Software task sequence without being advertised

Specifies that the selected program can be installed by a task sequence step. This option must be selected or any task sequence steps that reference this program will fail.

Note
If the selected program has been previously advertised as part of a software distribution package, you must still select this option or any task sequence steps that reference this program will fail.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Program Name Properties: Windows Installer Tab

Topic last updated—November 2007

Use the Windows Installer tab in the Microsoft System Center Configuration Manager 2007 Software Distribution <Program Name> Properties dialog box to specify the Windows Installer product information used to enable installation source management of a product. This selection dynamically updates Windows Installer source locations with a list of distribution points that have the package available for that Configuration Manager 2007 client. The list of distribution points adheres to protected site system boundaries.

This tab is applied on a per-product basis, and it updates only source network locations for those Windows Installer products that are currently installed on the computer. It supports both per-computer and per-user installations.

Consider the following points when importing product codes:

  • Each Windows Installer product code configured for source path management must be unique within a Configuration Manager 2007 package. Because each Windows Installer product code is associated with a Configuration Manager 2007 program and it is possible to have multiple Configuration Manager 2007 programs per Configuration Manager 2007 package, it is also possible to have more than one Windows Installer product code defined per Configuration Manager 2007 package. However, it is not possible to specify the same Windows Installer product code more than one time in one Configuration Manager 2007 package.
  • Although you might have the same Windows Installer application in multiple Configuration Manager 2007 packages, it is not necessary to enable source path management for all of them. This creates additional overhead for each client and for the management point that must service all the requests for distribution point locations.
  • The Windows Installer file location must be contained within the package source directory (defined in package properties). It might reside deeper in the folder structure than the root of the package source directory.
  • Ensure that all distribution points have successfully received the package before defining the Windows Installer information. Otherwise, clients will receive the update notification for the source paths before they are actually available. The client must then wait until the next trigger time to update the source path.

The Windows Installer tab contains the following elements.

Windows Installer product code

Specifies the Windows Installer product code (GUID) that is the principal identification of an application or product. This field is updated only by importing a Windows Installer file.

Windows Installer file

Specifies the name of the Windows Installer file contained among the package source files (if present). This field is updated only by importing a Windows Installer file.

To import a Windows Installer file, click Import. This opens the standard Open dialog box, allowing you to browse within the package source location for a Windows Installer file.

To clear the Windows Installer product code and the Windows Installer file fields and enable the Import button, click Clear.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Packages
About Windows Installer Source Location Manager

Other Resources

How to Manage Packages
Packages Property Pages


Program Name Properties: MOM Tab

Use the MOM tab of the Configuration Manager 2007 Software Distribution <Program Name> Properties dialog box to specify the settings for Microsoft Operations Manager (MOM) when the program runs. By default, no items on this tab are selected.

The MOM tab contains the following elements:

Disable MOM alerts while this program runs

Specifies whether the computer running the program will be placed in maintenance mode for the duration of the program. When in maintenance mode, MOM alerts are disabled while the program runs.

The duration for which MOM does not generate alerts is specified by the Maximum allowed run time value on the Requirements page. If this value is greater than 12 hours or specified as Unknown, MOM does not generate alerts for 15 minutes.

Generate MOM alert if this program fails

Specifies whether MOM generates an application event log entry if the specified program fails. If generated, the log entry contains the package name, program name, advertisement ID, advertisement comment, and failure code or Management Information Format (MIF) failure description.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Access Account Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Distribution Access Account Properties dialog box to set or update permissions for users and user groups to access package data on distribution points. Only permissions for previously existing access accounts can be set in this dialog box; to add a new access account, you must use the New Access Account Wizard.

For more information about access accounts and when to use them, see About Package Access Accounts.

Caution
If you modify the permissions of an existing account, you must refresh all distribution points associated with your package. When distribution points are refreshed, the package source is recopied from each site server to its distribution points. To minimize the resulting impact on network resources, if you have several changes to make, make them all before refreshing the distribution points.

The following permissions can be specified for users and user groups:

  • Read: Enables the account to view and copy files, run programs, change folders with the shared folder, and read extended attributes of files.
    To run a program file (a file with a .com, .exe, or .bat extension), a user must have Read permission.
  • Change: Enables the account to change the contents and extended attributes of files. Change permission is required for applications that need to write information back to the shared package folder on the distribution point.
  • Full Control: Enables the account to read and write the contents and extended attributes of files.
  • No Access: Prevents the account from reading, writing, or deleting files on the package share.
    Note
    When using package access accounts, it is important to ensure that all clients that will receive the package have access to the distribution point through the defined access accounts. Advertised programs will fail to run if users do not have the appropriate rights to access the package.

The General tab contains the following elements:

Account

The name of the access account to which you want to grant access to the package share on distribution points.

Set

Allows the administrator to specify the account name. This option can be set using the New Access Account Wizard, but it is unavailable from the dialog box.

Account type

Displays the type of access account, either a Generic access account or a Windows User account.

Permissions

Allows the administrator to grant the level of access desired to the specified account.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Modify a Package Access Account

Concepts

About Package Access Accounts
About Packages

Other Resources

Packages Property Pages


Distribution Point Properties: General Tab

Use the General tab of the Configuration Manager 2007 Distribution Point Properties dialog box to display the properties of an existing distribution point associated with a specific package.

This dialog box is available by clicking Distribution Points for a specific package, and then right-clicking the distribution point in the results pane and clicking Properties.

Name

The name of the distribution point.

Site system type

The type of site system, such as server or server share.

Site code

The site code indicating which site the site system is a member of.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Distribution Points

Other Resources

How to Manage Distribution Points


Advertisements Property Pages

The Configuration Manager 2007 Software Distribution Advertisements Properties dialog boxes display information about software distribution advertisements and allows users to configure settings for those advertisements.

Two dialog boxes are available for configuring advertisement settings: the Advertisement Properties dialog box and the <Advertisement Name> Properties dialog box. These dialog boxes include settings both for advertisements in general and for specific advertisements, including advertisement schedules, distribution points, and advertisement security rights.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Advertisements Properties

Specifies general and security information about all advertisements within the Software Distribution node.

Advertisement Name Properties

Specifies information (including schedule, distribution points, security, and other settings) about a specific advertisement. These dialog boxes are available by right-clicking the specific advertisement <advertisement name> and then clicking Properties.

See Also

Concepts

About Advertisements

Other Resources

How to Manage Advertisements


Advertisements Properties

The Configuration Manager 2007 Software Distribution Advertisements Properties page displays both general and security information about the advertisements available within Configuration Manager 2007. Only basic information is available, however, and not data on specific advertisements.

To display this information, right-click the Advertisements node within Software Distribution, and then click Properties.

Click any link in the following section for detailed information about the associated package properties page tab:

In This Section

Advertisements Properties: General Tab

Displays general information about all advertisements within the Software Distribution node.

Properties - Security Tab

Specifies security information about all advertisements within the Software Distribution node and allows administrators to change or update class security rights.

See Also

Concepts

About Advertisements

Other Resources

How to Manage Advertisements


Advertisements Properties: General Tab

Use the General tab in the Configuration Manager 2007 Software Distribution Advertisements Properties dialog box to specify general information about all advertisements within the Software Distribution node. Only basic information is available, however, and not data on specific advertisements.

The General tab contains the following elements:

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Advertisements

Other Resources

Advertisements Properties
How to Manage Advertisements


Advertisement Name Properties

The Configuration Manager 2007 Software Distribution <Advertisement Name> Properties dialog box displays information about a specific software distribution advertisement and allows users to configure many settings for that advertisement. This also includes information about the schedule, distribution points, and programs associated with the advertisement.

This dialog box is available by right-clicking the specific advertisement <advertisement name> and then clicking Properties.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Advertisement Name Properties: General Tab

Specifies general information, including name, package, program, and the collection associated with the specific advertisement selected.

Advertisement Name Properties: Schedule Tab

Specifies schedule information, including start time, expiration, and priority for the specific advertisement selected. Users can also make an advertisement mandatory.

Advertisement Name Properties: Distribution Points Tab

Specifies distribution point settings for this advertisement, including boundary protection and download options.

Advertisement Name Properties: Interaction Tab

Specifies settings that affect how users are notified about and interact with this advertised program.

Properties - Security Tab

Specifies the security rights individual users have on both this class and the specific advertisement selected.

See Also

Concepts

About Advertisements

Other Resources

Advertisements Property Pages
How to Manage Advertisements


Advertisement Name Properties: General Tab

Use the General tab in the Configuration Manager 2007 Software Distribution <Advertisement Name> Properties dialog box to specify general information such as the associated package, program, and collection for the specific advertisement selected.

The General tab contains the following elements:

Name

Specifies the name of the advertisement, up to 100 characters. This field is required.

Comment

Specifies optional text about the advertisement, such as a description. You can use up to 127 characters. This information is made available to clients in the advertisement details.

Package

Specifies the package that contains the program that will be advertised to clients. This field is required.

Click the Browse button to open the Select a Package dialog box. Select the desired package, and click OK to choose the package.

Program

Specifies the program (within the specified package) to advertise to clients. This field is required.

Collection

Specifies the existing collection that will receive the advertisement. This field is required.

Click the Browse button to open the Browse Collection dialog box, enabling you to search for the collection you want.

Include members of subcollections

Specifies that the program will also be advertised to clients and users in the specified collection's subcollections.

Note
By default, the Include members of subcollections check box is selected. To avoid sending advertisements to subcollections, this option must be cleared.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements

Other Resources

Advertisement Name Properties


Advertisement Name Properties: Schedule Tab

Use the Schedule tab in the Configuration Manager 2007 Software Distribution <Advertisement Name> Properties dialog box to specify when and how a program is made available to client computers.

The Schedule tab contains the following elements:

Advertisement start time

Specifies the date and time when the program is advertised and available to run on clients in their respective time zones. By default, the current date and time is specified. To select another date and time, click the adjacent arrows. To specify that the advertisement start date and time are based on UTC rather than local time, select the UTC check box.

Note
If you select the UTC option, the program will be available on all clients simultaneously.

When a mandatory assignment is defined for this advertisement, client computers will use the advertisement start time to determine when to start downloading the package. This will occur if the advertisement settings indicate the client should download the package before running the program.

Advertisement will expire

Specifies whether the advertisement has a date and time after which the program advertisement is no longer available to run on clients in their respective time zones. By default, this check box is cleared and the advertisement will never expire. If selected, the cutoff date and time is set by default at 6 months from the date and time that the advertisement was created. To specify another date and time, click the adjacent arrows.

To specify that the advertisement start date and time are based on UTC rather than local time, select the UTC check box.

Note
If you select the UTC option, the advertisement will expire on all clients simultaneously.

Mandatory assignments

Specifies any mandatory assignment schedules, which indicate that Configuration Manager will automatically run the program at a specific time or according to a specific event (such as Logon/Logoff).

The following options are available for managing advertisement class security rights:

  • New icon: Click to open the Assignment Schedule dialog box and create a new assignment schedule.
  • Properties icon: Click to open the Assignment Schedule dialog box to view or modify the current schedule settings.
  • Delete icon: Click to delete the selected assignment.
Enable Wake On LAN

Specifies whether the site server will send a Wake On LAN transmission to wake up the client computer prior to the advertised program.

Ignore maintenance windows when running program

Specifies whether to have the advertised program ignore maintenance windows while the program is running.

Allow system restart outside maintenance windows

Specifies whether to allow the advertised program to restart the client even if the restart would occur outside a maintenance window.

Note
This setting only applies if the program has the ConfigMgr restarts computer option set as an after-running action.

Priority

Specifies the advertisement's sending priority when replicated to child sites. Available options are Low, Medium (default), and High priorities.

Program rerun behavior

Specifies whether the advertised program will be rerun on the client computer if it has previously been run before the scheduled mandatory time.

Note
These rerun settings will apply to the program even if it was previously run by a different advertisement.

This setting is only configurable for assigned (mandatory) advertisements.

The following options are available:

  • Never rerun advertised program: The program will not be rerun on the client if the program has previously been run on the client, even if the program originally failed or the program files have been changed.
  • Always rerun program: The program will always be rerun on the client when the advertisement is scheduled, even if the program has already been successfully run. This is particularly useful when using recurring advertisements in which the program is routinely updated, as with some virus detection software.
    Note
    Although this option is set by default if the advertisement is not assigned, this setting only has an impact if the advertisement is assigned. This is because users can run an optional program at any time and Configuration Manager will always allow the program to rerun.

  • Rerun if failed previous attempt: The program will be rerun when the advertisement is scheduled only if it failed on the previous run attempt. This is particularly useful when assigning a mandatory advertisement, so that it will rerun according to the assignment schedule if it has not successfully done so. This option is set by default if the advertisement is assigned (mandatory).
  • Rerun if succeeded on previous attempt: The program will be rerun only if it has previously run successfully on the client. This is useful when using recurring advertisements in which the program is routinely updated, and in which each update requires the previous update to have been successfully installed.

Note
When an advertised program is launched from the Run Advertised Program dialog box on a client, the program rerun property is not evaluated before running the program. This means a mandatory program with "Never rerun advertised program" program rerun property can still be rerun as many times as the end user wants to from that dialog box. It's therefore highly recommended that prior to sending out a program, administrators carefully evaluate and test the advertised program rerun behavior and understand the impact if the end user chooses to rerun the program multiple times.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements
About Maintenance Windows

Other Resources

Advertisement Name Properties


Advertisement Name Properties: Distribution Points Tab

Use the Distribution Points tab in the Configuration Manager 2007 Software Distribution <Advertisement Name> Properties dialog box to specify how to deliver and run the content for the specific advertisement selected, depending on the type of boundary to which the client computer is connected.

Important
Selecting the Download content from distribution point and run locally option is strongly recommended for greatest security. When this option is selected, the package is hashed so that Configuration Manager 2007 can ensure package integrity. When the Run program from distribution point option is selected, the package hash is not verified prior to running the specified program. Therefore, package integrity cannot be ensured as it is possible for users with administrative rights to alter or tamper with package contents.

The Distribution Points tab contains the following elements:

When a client is connected within a fast (LAN) network boundary

Specifies the options available when the client is within a fast network boundary. The following options are available:

  • Run program from distribution point. Specifies whether an advertised program is run directly from a distribution point when the client is connected within a fast (LAN) network boundary.
  • Download content from distribution point and run locally. Specifies whether an advertised program is downloaded to the client computer before Configuration Manager 2007 attempts to run the program when connected within a fast (LAN) network boundary.
    If the distribution point supports Background Intelligent Transfer Service (BITS), you can use this setting to ensure a fault tolerant download of the advertised program. In the event of interruption, BITS resumes the download the next time the computer connects to the network so this will not cause a problem. If you are not using a BITS-enabled distribution point and the computer disconnects from the network, the download fails.
When a client is connected within a slow or unreliable network boundary

Specifies the options available when the client is within a slow or unreliable network boundary. The following options are available:

  • Do not run program. Specifies whether a program should not be run when a client is connected within a slow or unreliable network boundary.
  • Download content from distribution point and run locally. Specifies whether an advertised program is downloaded to the client computer before Configuration Manager 2007 attempts to run the program when connected within slow or unreliable network boundary.
    If the distribution point supports Background Intelligent Transfer Service (BITS), you can use this setting to ensure a fault tolerant download of the advertised program. In the event of interruption, BITS resumes the download the next time the computer connects to the network so this will not cause a problem. If you are not using a BITS-enabled distribution point and the computer disconnects from the network, the download fails.
    Note
    This setting is also used by clients who are not in any boundaries for the site.

  • Run program from distribution point. This option is unavailable when a client is connected within a slow or unreliable network boundary.
Allow clients to fallback to unprotected distribution points when the content is not available on the protected distribution point

Specifies whether Configuration Manager 2007 will permit a client to use an unprotected distribution point if content is not immediately available on its protected distribution point, or if it forces a client to use the protected local distribution point if it is within the boundaries for that point. This option is selected by default..

If this checkbox is selected, a client will use distribution points based on the following criteria:

  • If a protected distribution point with the content provisioned exists, the client will not use unprotected distribution points.
  • If a protected distribution with the content provisioned does not exist, the client will use unprotected distribution points.
If the check box is cleared, then regardless of whether or not a protected distribution point with the content provisioned exists, the client will not use unprotected distribution points.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Advertisements
About Distribution Points

Other Resources

Advertisement Name Properties


Advertisement Name Properties: Interaction Tab

Use the Interaction tab in the Configuration Manager 2007 Software Distribution <Advertisement Name> Properties dialog box to specify how to deliver and run the content for the specific advertisement selected, depending on the type of boundary to which the client computer is connected.

The Interaction tab contains the following elements:

Allow users to run the program independently of assignments

Specifies whether or not users may run the advertised program independently, regardless of its assignment status. This option is cleared by default.

Display reminders according to the client agent reminder intervals

Specifies whether advertisement reminders are broadcast to the client according to the default intervals set on the Computer Client Agent.

Use custom countdown notification length (minutes)

Specifies whether client notifications are broadcast based on a custom notification length in minutes. If selected, the user should specify a custom length in minutes.

Note
This option is only available if the advertised program is assigned. In this case, it is used only if the advertised program is presented before the mandatory assignment schedule runs the program.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create an Advertisement

Reference

Computer Client Agent Properties: General Tab

Concepts

About Advertisements
Configure Your Client Agents

Other Resources

Advertisement Name Properties


Software Updates Property Pages

This section contains the Configuration Manager 2007 Software Updates property dialog box help topics. Click any link in the following section for detailed information about its associated property dialog box:

In This Section

Software Update Name Properties

Provides information about the properties dialog box for a selected software update.

Deployment Name Properties

Provides information about the properties dialog box for a selected software update deployment.

SMS 2003 Advertisement Name Properties

Displays information about a specific advertisement that is created for SMS 2003 client computers when deploying software updates.

Software Updates Client Agent Properties

Provides information about the Software Updates Client Agent properties dialog box.

Deployment Template Name Properties

Provides information about the properties dialog box for a selected software update deployment template.

Deployment Package Name Properties

Provides information about the properties dialog box for a selected software update deployment package.

Update List Name Properties

Provides information about the update list and allows for the name and description to be modified, as well as the security for the update list object.

Software Updates Console Tree Properties

Provides information about software updates console tree node properties.

Software Updates Package Status Home Page

Provides summary information for each deployment package on the Configuration Manager 2007 site.


Software Update Name Properties

The Configuration Manager 2007 properties dialog box for software updates displays information about software updates and associated content, and allows administrators to configure the maximum run time, NAP evaluation, custom severity, and security settings. When opening the properties for multiple updates, only the maximum run time and custom severity tabs display.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Software Update Name Properties: General Tab

Specifies general information about the software update.

Software Update Name Properties: Maximum Run Time Tab

Specifies the maximum amount of time a software update installation has to complete.

Software Update Name Properties: NAP Evaluation Tab

Specifies whether to enable or disable Network Access Protection evaluation for the software update.

Software Update Name Properties: Custom Severity Tab

Specifies the custom severity values for the software update if predefined severity values do not meet administrator needs.

Software Update Name Properties: Content Information Tab

Specifies the languages available for the software update and other supporting information.

Properties - Security Tab

Specifies the class and instance security rights for the software update.


Software Update Name Properties: General Tab

The General tab in the Configuration Manager 2007 properties dialog box for a software update displays summary information for the selected update. The following information is listed in the results pane:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Date revised: Specifies the date the software update was last modified.
  • Maximum severity rating: Specifies the predefined vendor severity rating for the software update. The severity can range from low to critical and cannot be modified.
  • Description: Presents an overview of why the software update should be installed and what condition it fixes.
  • Applicable Languages: Specifies the supported languages for the software update.
  • Affected Products: Specifies what products are affected by the software update.
Note
This tab is not displayed when opening the properties for multiple software updates.

The General tab contains the following elements:

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates

Other Resources

Software Update Name Properties


Software Update Name Properties: Maximum Run Time Tab

Use the Maximum Run Time tab in the Configuration Manager 2007 <software update name> Properties dialog box to set the maximum amount of time a software update has to complete installation on client computers. If the maximum run-time value has been reached, a status message is created and the deployment is no longer monitored for software update installation. This setting can be configured only on the site that synchronizes with Microsoft Update, most likely the central site.

This setting is also used to determine whether the software update installation should be initiated within a configured maintenance window. If the maximum run-time value is greater than the time left in the maintenance window, software update installation is not initiated until the start of the next maintenance window. When there are multiple software updates to be installed on a client computer with a configured maintenance window, the update with the lowest maximum run time installs first, the update with the next lowest maximum run time installs next, and so on. Before installing each update, the client verifies that the available maintenance window is long enough to install the update. After an update starts installing, it will continue to install even if the installation goes beyond the end of the maintenance window.

Important
Ensure that the maximum run-time value is not set for more time than the configured maintenance window or the software update installation will never initiate.

Some software updates might take more time to install than the default setting allows. Increasing the Maximum run time (minutes) setting to accommodate larger software updates is recommended.

Note
This tab is not displayed when opening the properties for multiple software updates.

The Maximum Run Time tab contains the following elements:

Maximum run time (minutes)

Sets the maximum number of minutes that a software update installation has to complete before the installation is no longer monitored by Configuration Manager. This setting is also used to determine whether there is enough time to install the update before the end of a maintenance window. The default setting is 60 minutes for service packs and 20 minutes for all other software update types. Values can range from 5 to 9999 minutes.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates

Concepts

About Maintenance Windows
Planning for Software Updates Server Settings

Other Resources

Software Update Name Properties


Software Update Name Properties: NAP Evaluation Tab

Use the NAP Evaluation tab in the Configuration Manager 2007 software update name properties dialog box to specify whether the software update is required for compliance when using Network Access Protection (NAP). Enable NAP evaluation to include the software update in a NAP policy that will become effective on NAP-capable clients based on the configured schedule.

When the policy becomes effective, NAP-capable clients might have restricted access until they comply with the selected software update. Network restriction and remediation is dependent on how the policies are configured on the Windows Network Policy Server. This setting can be configured only on the site that is highest in the hierarchy with an active software update point

Note
This tab is not displayed when opening the properties for multiple software updates or when the NAP agent is not enabled on the site.

The NAP Evaluation tab contains the following elements:

Enable NAP evaluation

Specifies whether the software update is included in the NAP policy and evaluated on NAP-capable clients.

As soon as possible

Specifies that the software update is included in the NAP policy, which becomes effective on NAP-capable clients as soon as possible.

Date and time

Specifies that the software update is included in the NAP policy, which becomes effective on NAP-capable clients on the specified date and time.

OK

Save the changes and exit the dialog box.

Cancel

Exit the dialog box without saving any changes.

Apply

Save the changes and remain in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates
How to Create a Configuration Manager NAP Policy for Network Access Protection

Concepts

About the NAP Effective Date in Network Access Protection
About NAP Evaluation in Network Access Protection
About Configuration Manager NAP Policies in Network Access Protection

Other Resources

Software Update Name Properties


Software Update Name Properties: Custom Severity Tab

The Custom Severity tab in the Configuration Manager 2007 software update name properties dialog box can be used to configure custom severity values for software updates if predefined severity values do not meet administrators' needs. The custom values are listed in the Custom Severity column in the ConfigMgr Administrator console. Administrators can sort software updates by the defined custom severity values and also create queries and reports that can filter on these values. This setting can be configured only on the highest site in the hierarchy with an active software update point

The Custom Severity tab contains the following elements:

Custom Severity

Sets a custom severity value for software updates. Select Critical, Important, Moderate, or Low from the drop-down list. By default, the custom severity value is empty.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates

Other Resources

Software Update Name Properties


Software Update Name Properties: Content Information Tab

The Content Information tab in the Configuration Manager 2007 software update name properties dialog box displays information about the software update broken out into the languages supported by the update. The following information is listed in the results pane:

  • Content ID: Specifies the ID used to track the software update and associated language in the ConfigMgr SQL database.
  • Downloaded: Specifies whether the software update has been downloaded and is available on distribution points.
  • Language: Specifies the language supported by the software update file.
  • Source Path: Specifies the source location for the software update file.
Note
This tab is not displayed when opening the properties for multiple software updates.

The Content Information tab contains the following elements:

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates

Other Resources

Software Update Name Properties


Deployment Name Properties

The Configuration Manager 2007 software update deployment properties dialog box displays information about the software update deployments created in the Deploy Software Updates Wizard and allows the deployment settings to be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Deployment Name Properties: General Tab

Specifies the name and description of the deployment.

Deployment Name Properties: Collection Tab

Specifies the collection that is targeted for the deployment.

Deployment Name Properties: Software Updates Tab

Specifies the software updates defined in the deployment and provides the ability to add or remove software updates.

Deployment Name Properties: SMS 2003 Settings Tab

Specifies whether to deploy the software updates to SMS 2003 clients that are in the target collection.

Deployment Name Properties: Schedule Tab

Specifies when a software update deployment becomes available to clients, whether the software update installation will be enforced on clients, whether Wake On LAN will be used in the deployment, and whether to ignore maintenance windows.

Deployment Name Properties: Download Settings Tab

Specifies the behavior for software update installation when clients are within a slow or unreliable network boundary and when clients are within the boundaries of protected distribution points that do not have the software updates available.

Properties - Security Tab

Specifies the class and instance security for the deployment object.

Deployment Name Properties: Display/Time Settings Tab

Specifies whether notifications are displayed on clients and whether a client evaluates the deployment schedule based on local or UTC.

Deployment Name Properties: Restart Settings Tab

Specifies the system restart behavior when a software update installs on a client and requires a restart to complete.

Deployment Name Properties: Event Generation Tab

Specifies whether to disable Microsoft Operations Manager alerts during software update installation and whether an Operation Manager alert is created when a software update installations fails.

See Also

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
How to Manage Software Update Deployments


Deployment Name Properties: General Tab

Use the General tab in the Configuration Manager 2007 deployment name properties dialog box to specify the deployment name and description.

The General tab contains the following elements:

Name

Specifies the name of the deployment. The name should be unique and descriptive. By default, the name is populated with <vendor name> - <date> <time>. For example, Microsoft Updates - 10/10/2006 09:28:00 PM.

Description

Specifies the description for the deployment. The description should provide an overview of the deployment configuration and other relevant information that helps identify it among others in the Deployments node of the ConfigMgr Administrator console.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deployment Name Properties: Collection Tab

Use the Collection tab in the Configuration Manager 2007 deployment name properties dialog box to configure the collection that is targeted for the software update deployment. Members of the collection and subcollections, if configured, receive available deployments during their next Machine Policy Retrieval & Evaluation Cycle.

The Collections tab contains the following elements:

Collection

Specifies the target collection for the deployment. Members of the collection receive the software updates defined in the deployment. To select a collection, click Browse, select the collection from the list, and click OK.

Include members of subcollection

Specifies whether members of any subcollection of the main collection receive the software updates defined in the deployment. By default, this setting is not enabled and only members of the collection are targeted for the deployment.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deployment Name Properties: Software Updates Tab

Use the Software Updates tab in the Configuration Manager 2007 deployment name properties dialog box to review the software updates that are part of the deployment, add new software updates to the deployment, or remove existing software updates from the deployment.

Each software update defined in the deployment is listed in the results pane with the following information:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. This column is blank for software updates that aren't security related. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Title: Specifies the name of the software update.
  • Language: Specifies the supported language for the software update.
  • Severity: Specifies the predefined vendor severity rating for the software update. The severity can range from low to critical and cannot be modified.
Note
To add software updates to existing deployments, they must first be downloaded to a package using the Download Updates Wizard or from a previously created deployment. Software updates that have not been downloaded do not appear in the Add Software Update dialog box.

The Software Updates tab contains the following elements:

Add

Adds software updates to the deployment. Click Add to open the Add Software Update Dialog Box that contains the software updates that have been downloaded. Expand the classification, expand the vendor, and expand the product to display the available updates. Select the updates to add to the deployment and then click OK. There is no limit to the number of software updates that can be in a deployment.

Remove

Removes a software update that is no longer needed in the deployment. Highlight the software update in the results pane, and then click Remove. Software updates that are removed from this dialog box are only removed from the deployment definition. The folders and source files for removed software updates are not deleted so that they are available for other deployments.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Add Software Updates to a Deployment Package

Reference

Add Software Update Dialog Box

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deployment Name Properties: SMS 2003 Settings Tab

Use the SMS 2003 Settings tab in the Configuration Manager 2007 deployment name properties dialog box to deploy software updates to SMS 2003 clients that are members of the target collection. This page does not display if any of the software updates in the deployment are not deployable to SMS 2003 clients. Software updates from the Microsoft Update catalog and synchronized using Inventory Tool for Microsoft Updates catalog can be deployed to SMS 2003 clients.

The SMS 2003 Settings tab contains the following elements:

Deploy software updates to SMS 2003 clients

Specifies whether to deploy the software updates in the deployment to SMS 2003 clients that are in the target collection. A package, package instruction files, and advertisement are created and sent to child SMS 2003 sites to support the update installation on SMS 2003 clients. By default, this setting is not enabled.

Important
When this setting is disabled in an active deployment that includes SMS 2003 clients, this setting cannot be enabled again. The corresponding program and advertisement created for SMS 2003 clients are disabled. Before permanently disabling this deployment for SMS 2003 clients, make sure this is the intended action.

Collect hardware inventory immediately

Specifies whether to collect hardware inventory on SMS 2003 clients immediately following software update installation. This increases reporting accuracy but might increase system activity on the SMS 2003 clients. By default, the check box is not selected and hardware inventory is collected during its scheduled hardware inventory cycle.

When a distribution point is available locally

Specifies that SMS 2003 clients handle software update installation when the updates are available on a local distribution point according to the following options:

  • Run update installation from distribution point: Specifies that the software updates are installed from the distribution point.
  • Download updates from distribution point and then run installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client. This is the default setting.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

When no distribution point is available locally

Specifies that SMS 2003 clients handle software update installation when the updates are available only on remote distribution points according to the following options:

  • Do not run update installation: Specifies that the software update installation will not run. This is the default setting.
  • Download updates from a remote distribution point prior to update installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

  • Run update installation from a remote distribution point: Specifies that the software updates are installed from the remote distribution point.
Advanced

Opens the Advance SMS 2003 Deployment Properties dialog box where you can hide deployed software updates from SMS 2003 clients, configure the deployment schedule for the advertisement, and specify whether the start time and maximum installation time are enforced on SMS 2003 clients. For more information, see Advanced SMS 2003 Deployment Properties.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

Note
It is highly recommended that you enable Background Intelligent Transfer Service (BITS) on distribution points that are used for software updates when downloading the updates from the distribution point and then installing them. If BITS is enabled on the distribution point, disconnection from the network during the software updates download does not cause the deployment to fail because BITS resumes the download, starting where it was interrupted, the next time the client has network access. If BITS is not enabled on the distribution point and a network problem occurs during the software updates download, the software updates installation fails.

See Also

Tasks

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

Reference

Advanced SMS 2003 Deployment Properties

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment
Planning the SMS 2003 Software Updates Upgrade

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Advanced SMS 2003 Deployment Properties

Use the Advanced SMS 2003 Deployment Properties dialog box in Configuration Manager 2007 to configure advanced deployment properties for Systems Management Server (SMS) 2003 clients. This dialog box is opened from the SMS 2003 Settings tab in the properties for a deployment.

This dialog box contains the following elements:

Hide Deployments from SMS 2003 client computers

Specifies that all software updates deployed to SMS 2003 client computers hidden when they are received and installed. Use this setting to deploy software updates to SMS 2003 computers without any display notifications or notification area icons. By default, this setting is not enabled.

Mandatory assignments

Specifies the one time or recurring schedule for the software update advertisement. When the advertisement runs on the configured recurrence schedule, the software update is reinstalled if it is no longer installed on SMS 2003 clients. Click the New icon to open the Custom Schedule dialog box and configure the start time and schedule. By default, the advertisement uses the site-wide deployment reevaluation schedule that is configured in the properties for the Software Updates Client Agent.

Enforce start time and maximum installation time

Specifies whether the software updates are automatically installed on SMS 2003 clients at the configured start time and whether the maximum installation time is enforced.

Maximum installation time (minutes): Specifies the maximum time, in minutes, that the software update installation is expected to run on SMS 2003 client computers. When the software update advertisement runs, it checks for the schedule time and whether the maximum installation time is configured. If the current time is greater than the schedule time plus the maximum installation time, then the advertisement does not run the installation.

See Also

Concepts

About the Deploy Software Updates Wizard
Custom Schedule Dialog Box
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments
Software Updates Client Agent Properties


Deployment Name Properties: Schedule Tab

Use the Schedule tab in the Configuration Manager 2007 deployment name properties dialog box to specify when a software update deployment will become active and whether software update installation will be enforced on clients.

The Schedule tab contains the following elements:

As soon as possible

Specifies that the software updates in the deployment are made available to clients as soon as possible. When the deployment is created, the machine policy is updated, clients are made aware of the deployment at their next machine policy evaluation cycle, and then the updates are available for installation.

Date and time

Specifies that the software updates in the deployment will not be made available to clients until a specific date and time. When the deployment is created, the machine policy is updated and clients are made aware of the deployment at their next machine policy evaluation cycle, but the software updates in the deployment are not available for installation until the configured date and time.

Do not set a deadline for software update installation

Specifies that the software updates in the deployment are optional and do not require automatic installation by a specific date and time.

Set deadline for software update installation

Specifies that the software updates in the deployment are mandatory and require automatic installation by a specific date and time. If the deadline is reached and the software updates in the deployment are still required on the client, the update installation will automatically be initiated.

Enable Wake On LAN

Specifies whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more updates in the deployment. The computers that are not running are started at the deadline so the update installation can be initiated. Clients that do not require any updates in the deployment are not started. By default, this setting is not enabled and available only when there is a deadline configured for the deployment.

Ignore maintenance windows and install immediately at deadline

Specifies whether the software updates in the deployment are installed at the deadline regardless of a configured maintenance window. By default, this setting is not enabled and available only when there is a deadline configured for the deployment.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes without closing the dialog box

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Maintenance Windows
About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments
Overview of Wake On LAN


Deployment Name Properties: Download Settings Tab

Use the Download Settings tab in the Configuration Manager 2007 deployment name properties dialog box to configure how clients interact with distribution points when they receive a software update deployment.

Each boundary configured in Configuration Manager 2007 is designated as a fast (LAN) or slow or unreliable network. Clients connected to a LAN always download software updates from the distribution point and then install them. You can configure the client behavior when they are connected to a slow or unreliable network boundary.

Protected distribution points are configured with specific boundaries. When clients are within these boundaries, you can specify whether they must install software updates from protected distribution points or allow them to install updates from unprotected distribution points when the updates are not available on any protected distribution points.

The Download Settings tab contains the following elements:

When a client is connected within a slow or unreliable network boundary

Specifies whether clients will install software updates when they are connected to a slow or unreliable network boundary.

  • Do not install software updates: Specifies that clients do not install software updates if they are within network boundaries that are designated as slow or unreliable. This is the default selection.
  • Download software updates from distribution point and install: Specifies that clients download the software updates from the distribution point and install them if they are within network boundaries that are designated as slow or unreliable. This is the same behavior as if the client was within a local area network boundary.
Specify whether to allow clients that are within the boundaries for one or more protected distribution points to download and install software updates from unprotected distribution points when the updates are not available from any protected distribution point

Specifies whether clients will install software updates from unprotected distribution points when the updates are not available on any protected distribution points.

  • Do not install software updates: Indicates that when protected distribution points do not have the software updates available for clients that are within the protected distribution point boundaries, software updates will not be installed. This is the default selection.
  • Download software updates from unprotected distribution point and install: Indicates that when protected distribution points do not have the software updates for clients that are within the protected distribution point boundaries, the client downloads the software updates from an unprotected distribution point and installs them.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Configuration Manager Boundaries

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deployment Name Properties: Display/Time Settings Tab

Use the Display/Time Settings tab in the Configuration Manager 2007 deployment name properties dialog box to configure whether users are notified of pending software updates and see the update installation progress, and whether a client evaluates the deployment schedule based on local time or UTC.

The Display/Time Settings tab contains the following elements:

Allow display notifications on clients

Specifies that display notifications are used on clients that inform end users of available software updates and progress indicators are displayed during software update installation. By default, this setting is selected and display notifications are allowed on clients.

Suppress display notifications on clients

Specifies that display notifications are not used on clients and progress indicators are not displayed during update installation. Software update notification icons will still display on clients and users can click this icon to see available updates.

Client Local Time

Specifies that clients use their local time to evaluate the schedules for when software updates become available on clients and when deadlines enforce software update installation, if enabled. By default, this setting is selected and the local time on the client computer is used to evaluate deployment schedules.

UTC

Specifies that clients use UTC to evaluate schedules for when software updates become available on clients and when deadlines enforce software update installation.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deployment Name Properties: Restart Settings Tab

Use the Restart Settings tab in the Configuration Manager 2007 deployment name properties dialog box to configure system restart behavior when a software update installs on a client and requires a restart to complete, and when maintenance windows are configured.

Important
Suppressing system restarts can be useful in server environments or in cases in which you do not want the computers that are installing the software updates to restart by default. However, forcing a system restart after software update installation ensures that updates fully complete, whereas suppressing post-installation restart requests can leave systems in an insecure state.

The Restart Settings tab contains the following elements:

Servers

Specifies whether to suppress a system restart on servers, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and servers will restart if required by the software update installation.

Workstations

Specifies whether to suppress a system restart on workstations, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and workstations will restart if required by the software update installation.

Allow system restart outside of maintenance windows

Specifies whether to allow system restarts for both workstations and servers outside of configured maintenance windows. By default, this setting is not enabled, and when a system restart is required for a software update installation to complete, it is only initiated when the there is more than 10 minutes left in the configured maintenance window.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deployment Name Properties: Event Generation Tab

Use the Event Generation tab in the Configuration Manager 2007 deployment name properties dialog box to specify whether to disable Microsoft Operations Manager alerts during software update installation and whether Operations Manager alerts are created when software update installations fail.

The Event Generation tab contains the following elements:

Disable Operations Manager alerts while software updates run

Specifies that Operation Manager alerts are disabled during the software update installation. This is useful when deploying software updates that will impact an application that is being monitored by Operations Manager. Disabling alerts while the update is being installed will prevent alerts from triggering, such as a service that is stopped, as a result of the update installation. By default, this setting is not enabled.

Generate Operation Manager alert when a software update installation fails

Specifies that an Operations Manager alert is created for each software update installation failure. By default, this setting is not enabled.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


SMS 2003 Advertisement Name Properties

The Configuration Manager 2007 <SMS 2003 Advertisement Name> Properties dialog box displays information about a specific advertisement that is created for SMS 2003 client computers when deploying software updates.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

SMS 2003 Advertisement Name Properties: General Tab

Specifies read-only information about the deployment package, the program being used, and the collection that was targeted for the SMS 2003 advertisement.

SMS 2003 Advertisement Name Properties: Schedule Tab

Specifies schedule information for the SMS 2003 advertisement, including start time, expiration time, and priority.

SMS 2003 Advertisement Name Properties: Distribution Points Tab

Specifies distribution point settings for this advertisement, including boundary protection and download options.

SMS 2003 Advertisement Name Properties: Interaction Tab

Specifies settings that affect how users are notified about and interact with this advertised program.

Properties - Security Tab

Specifies the security rights individual users have on both this class and the specific advertisement selected.

See Also

Tasks

How to Deploy Software Updates to SMS 2003 Clients

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About the Deploy Software Updates Wizard

Other Resources

Deployment Name Properties
Deploy Software Updates Wizard


SMS 2003 Advertisement Name Properties: General Tab

Use the General tab in the Configuration Manager 2007 <SMS 2003 Advertisement Name> Properties dialog box to specify general information about the SMS 2003 advertisement. The SMS 2003 advertisement is created in the Deploy Software Updates Wizard when deploying software updates to SMS 2003 client computers. The General tab provides information about the deployment package, the program being used, and the collection that was targeted for the SMS 2003 advertisement. These properties are read-only.

The General tab contains the following elements:

Name

Specifies the name of the SMS 2003 advertisement. The deployment package name is limited to no more than 50 characters.

Comment

Specifies the description for the SMS 2003 advertisement, which is left blank by default.

Package

Specifies the name of the deployment package. The package should have a unique name, describe the package content, and be limited to no more than 50 characters.

Program

Specifies the program name that will run on SMS 2003 clients.

Collection

Specifies the target collection for the deployment. Members of the collection receive the software updates defined in the deployment.

Include members of subcollections

Specifies whether members of any subcollection of the main collection receive the software updates defined in the deployment. By default, this setting is not enabled and only members of the collection are targeted for the deployment.

OK

Saves any changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates to SMS 2003 Clients

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About the Deploy Software Updates Wizard
SMS 2003 Advertisement Name Properties

Other Resources

Deployment Name Properties
Deploy Software Updates Wizard


SMS 2003 Advertisement Name Properties: Schedule Tab

Use the Schedule tab in the Configuration Manager 2007 <SMS 2003 Advertisement Name> Properties dialog box to specify when and how a program is made available to client computers.

Note
When you click OK or Apply, Configuration Manager 2007 ensures that any assignment schedule entries do not occur before the Advertisement start time. Configuration Manager 2007 also ensures that if an expiration date and time is set, it does not occur before any of the assignment schedule entries or before the Advertisement start time.

The Schedule tab contains the following elements:

Advertisement start time

Specifies the date and time when the program is advertised and available to run on clients in their respective time zones. By default, the current date and time is specified. To select another date and time, click the adjacent arrows. To specify that the advertisement start date and time are based on UTC rather than local time, select the UTC check box.

Note
If you select the UTC option, the program will be advertised on all clients simultaneously.

When a mandatory assignment is defined for this advertisement, client computers will use the advertisement start time to determine when to start downloading the package. This will occur if the advertisement settings indicate the client should download the package before running the program.

Advertisement will expire

Specifies whether the advertisement has a date and time after which the program advertisement is no longer available to run on clients in their respective time zones.

By default, the cutoff date and time is set at 6 months from the current date and time. To specify another date and time, click the adjacent arrows.

To specify that the advertisement start date and time be based on UTC rather than local time, select the UTC check box.

Note
If you select the UTC option, the advertisement will expire on all clients simultaneously.

Mandatory assignments

Specifies any mandatory assignment schedules, which indicate that Configuration Manager will automatically run the program at a specific time or according to a specific event (such as Logon/Logoff).

The following options are available for managing advertisement class security rights:

  • New icon: Click to open the Assignment Schedule dialog box and create a new assignment schedule.
  • Properties icon: Click to open the Assignment Schedule dialog box to view or modify the current schedule settings.
  • Delete icon: Click to delete the selected assignment.
Enable Wake On LAN

Specifies whether the site server will send a Wake On LAN transmission to wake up the client computer prior to the advertised program.

Ignore maintenance windows when running program

Specifies whether to have the advertised program ignore maintenance windows while the program is running.

Allow system restart outside maintenance windows

Specifies whether to allow the advertised program to restart the client even if the restart would occur outside a maintenance window.

Priority

Specifies the advertisement's sending priority when replicated to child sites. Available options are Low, Medium (default), and High priorities.

Program rerun behavior

Specifies whether the advertised program will be rerun on the client computer and under what conditions. The following options are available:

  • Never rerun advertised program (default)
  • Always rerun program
  • Rerun if failed previous attempt
  • Rerun if succeeded on previous attempt
OK

Saves any changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates to SMS 2003 Clients

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About the Deploy Software Updates Wizard
SMS 2003 Advertisement Name Properties

Other Resources

Deployment Name Properties
Deploy Software Updates Wizard


SMS 2003 Advertisement Name Properties: Distribution Points Tab

Use the Distribution Points tab in the Configuration Manager 2007 <SMS 2003 Advertisement Name> Properties dialog box to specify how to deliver and run the content for the specific advertisement selected, depending on the type of boundary to which the client computer is connected.

Important
The Download content from distribution point and run locally option is the most secure option. When this option is selected, the package is hashed so that Configuration Manager 2007 can ensure package integrity. When the Run program from distribution point option is selected, the package hash is not verified prior to running the specified program. Therefore, package integrity cannot be ensured, as it is possible for users with administrative rights to alter or tamper with package contents.

The Distribution Points tab contains the following elements:

When a client is connected within a fast (LAN) network boundary

Specifies the options available when the client is within a fast network boundary. The following options are available:

  • Run program from distribution point. Specifies whether an advertised program is run directly from a distribution point when the client is connected within a fast (LAN) network boundary.
  • Download content from distribution point and run locally. Specifies whether an advertised program is downloaded to the client computer before Configuration Manager 2007 attempts to run the program when connected within a fast (LAN) network boundary.
    If the distribution point supports Background Intelligent Transfer Service (BITS), you can use this setting to ensure a fault-tolerant download of the advertised program. In the event of interruption, BITS resumes the download the next time the computer connects to the network so that this will not cause a problem. If you are not using a BITS-enabled distribution point and the computer disconnects from the network, the download fails and will need to start over during the next attempt.
When a client is connected within a slow or unreliable network boundary

Specifies the options available when the client is within a slow or unreliable network boundary. The following options are available:

  • Do not run program. Specifies whether a program should not be run when a client is connected within a slow or unreliable network boundary.
  • Download content from distribution point and run locally. Specifies whether an advertised program is downloaded to the client computer before Configuration Manager 2007 attempts to run the program when connected within a slow or unreliable network boundary.
    If the distribution point supports Background Intelligent Transfer Service (BITS), you can use this setting to ensure a fault-tolerant download of the advertised program. In the event of interruption, BITS resumes the download the next time the computer connects to the network so that this will not cause a problem. If you are not using a BITS-enabled distribution point and the computer disconnects from the network, the download fails.
    Note
    This setting is also used by clients who are not in any boundaries for the site.

  • Run program from distribution point. This option is unavailable when a client is connected within a slow or unreliable network boundary.
If the client is in the boundaries for one or more protected distribution points, allow the client to access the content only from the protected distribution points

Specifies whether Configuration Manager 2007 forces a client to use the protected local distribution point if it is within the boundaries for that distribution point, even if content is not immediately available on that distribution point.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates to SMS 2003 Clients

Concepts

About Advertisements
About Software Update Deployment Packages
About Distribution Points
About Software Update Deployments
About the Deploy Software Updates Wizard
SMS 2003 Advertisement Name Properties

Other Resources

Advertisement Name Properties
Deployment Name Properties
Deploy Software Updates Wizard


SMS 2003 Advertisement Name Properties: Interaction Tab

Use the Interaction tab in the Configuration Manager 2007 <SMS 2003 Advertisement Name> Properties dialog box to specify how to deliver and run the content for the advertisement, depending on the type of boundary to which the client computer is connected.

The Interaction tab contains the following elements:

Display reminders according to the client agent reminder intervals

Specifies whether advertisement reminders are displayed on client computers according to the default intervals set in the Computer Client Agent Properties.

Allow users to run the program independently of assignments

Specifies whether or not users can run the advertised program independently, regardless of its assignment status. This option is selected by default.

Use custom countdown notification length (minutes)

Specifies whether client notifications are displayed based on a custom notification length in minutes. If this option is selected, specify a custom length in minutes.

Note
This option is available only if the advertised program is assigned. In this case, it is used only if the advertised program is presented before the mandatory assignment schedule runs the program.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Deploy Software Updates to SMS 2003 Clients

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About the Deploy Software Updates Wizard
SMS 2003 Advertisement Name Properties

Other Resources

Computer Client Agent Properties
Deployment Name Properties
Deploy Software Updates Wizard


Deployment Template Name Properties

The Configuration Manager 2007 software update deployment template properties dialog box displays information about the software update deployment templates and allows the deployment template settings to be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Deployment Template Name Properties: General Tab

Specifies the name and description of the deployment template.

Deployment Template Name Properties: Collection Tab

Specifies the collection that is targeted for the software update deployment.

Deployment Template Name Properties: Display/Time Settings Tab

Specifies whether notifications are displayed on clients, whether a client evaluates the deployment schedule based on local or UTC, and specifies the default duration.

Deployment Template Name Properties: Restart Settings Tab

Specifies the system restart behavior when a software update installs on a client and requires a restart to complete

Deployment Template Name Properties: SMS 2003 Settings Tab

Specifies whether to generate a special deployment for SMS 2003 clients that are in the software updates target collection.

Deployment Template Name Properties: Event Generation Tab

Specifies whether to disable Microsoft Operations Manager alerts during software update installation and whether an Operation Manager alert is created when a software update installations fails.

Deployment Template Name Properties: Download Settings Tab

Specifies the behavior for software update installation when clients are within a slow or unreliable network boundary and when clients are within the boundaries of protected distribution points that do not have the software updates available.

Properties - Security Tab

Specifies the class and instance security for the deployment object.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Template Name Properties: General Tab

Use the General tab in the Configuration Manager 2007 deployment template name properties dialog box to specify the deployment template name and description.

The General tab contains the following elements:

Name

Specifies the name of the deployment template. The template name must be unique and help to describe the objective of the deployment template.

Description

Specifies the description for the deployment template. The description should provide an overview of the deployment template configuration and other relevant information that helps to identify it among others in the Deployment Templates node of the ConfigMgr Administrator console.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Template Name Properties: Collection Tab

Use the Collection tab in the Configuration Manager 2007 deployment name properties dialog box to configure the collection that is targeted for the software update deployment. Members of the collection and subcollections, if configured, receive available deployments during their next Machine Policy Retrieval & Evaluation Cycle.

The Collections tab contains the following elements:

Collection

Specifies the target collection for the deployment. Members of the collection receive the software updates defined in the deployment. To select a collection, click Browse, select the collection from the list, and click OK.

Include members of subcollection

Specifies whether members of any subcollection of the main collection receive the software updates defined in the deployment. By default, this setting is not enabled and only members of the collection are targeted for the deployment.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Template Name Properties: Display/Time Settings Tab

Use the Display/Time Settings tab in the Configuration Manager 2007 deployment name properties dialog box to configure whether users are notified of pending software updates and see the update installation progress, whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.

The Display/Time Settings tab contains the following elements:

Allow display notifications on clients

Specifies that display notifications are used on clients that inform end users of available software updates and progress indicators are displayed during software update installation. By default, this setting is selected and display notifications are allowed on clients.

Suppress display notifications on clients

Specifies that display notifications are not used on clients and progress indicators are not displayed during update installation. Software update notification icons will still display on clients and users can click this icon to see available updates.

Client Local Time

Specifies that clients use their local time to evaluate the schedules for when software updates become available on clients and when deadlines enforce software update installation, if enabled.

UTC

Specifies that clients use UTC to evaluate schedules for when software updates become available on clients and when deadlines enforce software update installation. By default, this setting is selected and UTC is used to evaluate deployment schedules.

Duration

Specifies the duration, which is used when a template is used while creating a deployment. The deadline setting in the deployment defaults to the time an update is available plus the configured duration setting. By default, the duration is set at 2 weeks.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Template Name Properties: Restart Settings Tab

Use the Restart Settings tab in the Configuration Manager 2007 deployment name properties dialog box to configure system restart behavior when a software update installs on a client and requires a restart to complete, and when maintenance windows are configured.

Important
Suppressing system restarts can be useful in server environments or in cases in which you do not want the computers that are installing the software updates to restart by default. However, forcing a system restart after software update installation ensures that updates fully complete, whereas suppressing post-installation restart requests can leave systems in an insecure state.

The Restart Settings tab contains the following elements:

Servers

Specifies whether to suppress a system restart on servers, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and servers will restart if required by the software update installation.

Workstations

Specifies whether to suppress a system restart on workstations, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and workstations will restart if required by the software update installation.

Allow system restart outside of maintenance windows

Specifies whether to allow system restarts for both workstations and servers outside of configured maintenance windows. By default, this setting is not enabled, and when a system restart is required for a software update installation to complete, it is only initiated when the there is more than 10 minutes left in the configured maintenance window.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Template Name Properties: SMS 2003 Settings Tab

Use the SMS 2003 Settings tab in the Configuration Manager 2007 software update deployment template name properties dialog box to deploy software updates to SMS 2003 clients in the target collection. . If the Deploy software updates to SMS 2003 clients setting is enabled, this template can only be used to initiate deployments with software updates that are deployable to SMS 2003 clients. Software updates from the Microsoft Update catalog and synchronized using Inventory Tool for Microsoft Updates catalog can be deployed to SMS 2003 clients.

The SMS 2003 Settings tab contains the following elements:

Deploy software updates to SMS 2003 clients

Specifies whether to deploy the software updates in the deployment to SMS 2003 clients that are in the target collection. A package, package instruction files, and advertisement are created and sent to child SMS 2003 sites to support the update installation on SMS 2003 clients. By default, this setting is not enabled.

Collect hardware inventory immediately

Specifies whether to collect hardware inventory on SMS 2003 clients immediately following software update installation. This increases reporting accuracy clients but might increase system activity on the SMS 2003 clients. By default, the check box is not selected and hardware inventory is collected during its scheduled hardware inventory cycle.

When a distribution point is available locally

Specifies that SMS 2003 clients handle software update installation when the updates are available on a local distribution point according to the following options:

  • Run update installation from distribution point: Specifies that the software updates are installed from the distribution point. This is the default setting.
  • Download updates from distribution point and then run installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

When a client is connected within a slow or unreliable network boundary

Specifies that SMS 2003 clients handle software update installation when the updates are available only on remote distribution points according to the following options:

  • Do not run update installation: Specifies that the software update installation will not run.
  • Download updates from a remote distribution point prior to update installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

  • Run update installation from a remote distribution point: Specifies that the software updates are installed from the remote distribution point. This is the default setting.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

Note
It is highly recommended that you enable Background Intelligent Transfer Service (BITS) on distribution points that are used for software updates when downloading the updates from the distribution point and then installing them. If BITS is enabled on the distribution point, disconnection from the network during the software updates download does not cause the deployment to fail because BITS resumes the download, starting where it was interrupted, the next time the client has network access. If BITS is not enabled on the distribution point and a network problem occurs during the software updates download, the software updates installation fails.

See Also

Tasks

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment
Planning the SMS 2003 Software Updates Upgrade

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Deployment Template Name Properties: Event Generation Tab

Use the Event Generation tab of the Configuration Manager 2007 deployment name properties dialog box to specify whether to disable Microsoft Operations Manager alerts during software update installation and whether Operations Manager alerts are created when software update installations fail.

The Event Generation tab contains the following elements:

Disable Operations Manager alerts while software updates run

Specifies that Operation Manager alerts are disabled during the software update installation. This is useful when deploying software updates that will impact an application that is being monitored by Operations Manager. Disabling alerts while the update is being installed will prevent alerts from triggering, such as a service that is stopped, as a result of the update installation. By default, this setting is not enabled.

Generate Operation Manager alert when a software update installation fails

Specifies that an Operation Manager alert is created for each software update installation failure. By default, this setting is not enabled.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Template Name Properties: Download Settings Tab

Use the Download Settings tab in the Configuration Manager 2007 software update deployment template name properties dialog box to configure how clients interact with distribution points when they receive a software update deployment.

Each boundary configured in Configuration Manager 2007 is designated as a fast (LAN) or slow or unreliable network. Clients connected to a LAN always download software updates from the distribution point and then install them. You can configure the client behavior when they are connected to a slow or unreliable network boundary.

Protected distribution points are configured with specific boundaries. When clients are within these boundaries, you can specify whether they must install software updates from protected distribution points or allow them to install updates from unprotected distribution points when the updates are not available on any protected distribution points.

The Download Settings tab contains the following elements:

When a client is connected within a slow or unreliable network boundary

Specifies whether clients will install software updates when they are connected to a slow or unreliable network boundary.

  • Do not install software updates: Specifies that clients do not install software updates if they are within network boundaries that are designated as slow or unreliable. This is the default selection.
  • Download software updates from distribution point and install: Specifies that clients download the software updates from the distribution point and install them if they are within network boundaries that are designated as slow or unreliable. This is the same behavior as if the client was within a local area network boundary.
Specify whether to allow clients that are within the boundaries for one or more protected distribution points to download and install software updates from unprotected distribution points when the updates are not available from any protected distribution point

Specifies whether clients will install software updates from unprotected distribution points when the updates are not available on any protected distribution points.

  • Do not install software updates: Indicates that when protected distribution points do not have the software updates available for clients that are within the protected distribution point boundaries, software updates will not be installed.
  • Download software updates from unprotected distribution point and install: Indicates that when protected distribution points do not have the software updates for clients that are within the protected distribution point boundaries, the client downloads the software updates from an unprotected distribution point and installs them. This is the default selection.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Configuration Manager Boundaries

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Package Name Properties

The Configuration Manager 2007 software update deployment package name properties dialog box displays information about the deployment packages and allows the deployment package settings to be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Deployment Package Name Properties: General Tab

Specifies the deployment package name and description, package source, sending priority, and whether to use binary differential replication.

Deployment Package Name Properties: Data Access Tab

Specifies how users can access distribution points to retrieve the files contained in the deployment package.

Deployment Package Name Properties: Distribution Settings Tab

Specifies the sending priority and preferred sender for the deployment package when it is sent to child sites, and specifies the content settings for branch distribution points.

Properties - Security Tab

Specifies the class and instance security for the deployment object.

See Also

Tasks

How to Manually Download Software Updates

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment


Deployment Package Name Properties: General Tab

Use the General tab in the Configuration Manager 2007 deployment package name properties dialog box to specify the deployment package name and description, package source, sending priority, and whether to use binary differential replication. Deployment packages are created by using the Download Updates Wizard or Deploy Software Updates Wizard.

The General tab contains the following elements:

Name

Specifies the name of the deployment package. The package should have a unique name, describe the package content, and is limited to no more than 50 characters.

Description

Specifies the description of the deployment package. The package description should describe the package contents in detail and is limited to no more than 127 characters.

Package source

Specifies the location of the software update source files. When the deployment is generated, the source files are compressed and copied to the distribution points that are associated with the deployment package. The source location must be entered as a network path (for example, \\server\sharename\path), or the Browse button can be used to find the network location.

Note
The deployment package source location must not be used by another deployment or software distribution package.

Important
The SMS Provider computer account and the user who will actually download the software updates to the download location both require write access to the download location. Restrict access to the download location to reduce the risk of attackers tampering with the software updates source files in the download location.

Enable binary differential replication

Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred. For more information, see About Binary Differential Replication.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Manually Download Software Updates

Concepts

About Binary Differential Replication
About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Deployment Package Name Properties: Data Access Tab

Use the Data Access tab in the Configuration Manager 2007 deployment package name properties dialog box to specify how users can access distribution points to retrieve the files contained in the deployment package. Deployment packages are created by using the Download Updates Wizard or Deploy Software Updates Wizard.

The General tab contains the following elements:

Access distribution folder through common ConfigMgr package share

Specifies that users access the package through the common package shared folder (SMSPKGx$, where x is the drive letter) on distribution points. By default, this option is selected.

Share distribution folder

Specifies that users access the package through a custom package shared folder and path. The folder should be created and shared prior to selecting this option.

  • Share name: Specifies a unique shared folder name and path to be created for the package source files on distribution points. The value can either be a shared folder, which must be unique among all packages, or a shared folder and path, where the path must be unique among all packages. See the following table for examples.

Shared folder name | Resulting path on distribution points
Office | \\DPservername\Office
Packages\OfficeXP | \\DPservername\Packages\OfficeXP
Packages\Spreadsheets\Excel | \\DPservername\Packages\Spreadsheets\Excel
Note
Do not enter a full Universal Naming Convention (UNC) path in Share name, such as \\server\share. Instead, enter the shared folder name as shown in the table above.

If the shared folder name is entered as a shared folder only, as in the first example, all files and subdirectories within that shared folder are deleted and re-created each time the package is updated or refreshed. If the shared folder name is entered as a shared folder name and path, only the bottom path (OfficeXP and Excel in the above examples) is deleted and re-created each time the package is updated or refreshed.

To control which drive either the default or custom package folder is created on, assign the distribution point role to a server shared folder instead of a server computer. For distribution points on server shared folders, if a shared folder name is entered for a package, it is treated as a path beneath the distribution point shared folder (\\MyServer\MyShare):

Package shared folder name | Resulting path on distribution points
Office | \\MyServer\MyShare\Office
Packages\OfficeXP | \\MyServer\MyShare\Packages\OfficeXP
Packages\Spreadsheets\Excel | \\MyServer\MyShare\Packages\Spreadsheets\Excel
Disconnect users from distribution points

Specifies whether to notify users and disconnect them from distribution points when ConfigMgr updates package data. By default, this setting is not enabled. When enabled, the following options are available:

  • Number of retries before disconnecting users: Specifies the number of times that ConfigMgr tries to update the package source files before starting to disconnect users from distribution points. The default value is 2 and you can specify 0 to 99, inclusive.
  • User grace period (in minutes): Specifies the number of minutes Configuration Manager should wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Manually Download Software Updates

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Deployment Package Name Properties: Distribution Settings Tab

Use the Distribution Settings tab in the Configuration Manager 2007 deployment package name properties dialog box to specify the sending priority and preferred sender for the deployment package when it is sent to child sites, and to specify the content settings for branch distribution points. Deployment packages are created by using the Download Updates Wizard or Deploy Software Updates Wizard.

The Distribution Settings tab contains the following elements:

Sending priority

Specifies the sending priority for the deployment package. The sending priority is used for the deployment package when it is sent to distribution points at child sites. Packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. By default, a deployment package has a Medium sending priority.

Note
Unless there is a backlog, the package processes immediately regardless of its priority.

Preferred sender

Specifies the sender that is used to send this deployment package to distribution points at other sites. By default, this setting uses the <No Preference> value, which allows any available sender to be used. All senders that are configured for the site can be used.

Note
To use Courier Sender to distribute deployment packages, you must select it as the preferred sender.

Branch distribution points automatically download this package when they receive the deployment

Specifies that the content is downloaded to branch distribution points when packages are assigned to branch distribution points. By default, this setting is selected and the following additional setting is available:

  • Make this package available on protected distribution points when requested by clients inside the protected boundaries: Specifies that when a client is within the boundaries of protected distribution points and the client requests the package content, the package is downloaded to the protected distribution points.
Administrator manually copies this package to branch distribution points

Specifies that the content must be manually managed and is not automatically downloaded to the branch distribution points.

OK

Saves the changes and exits the dialog box

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Manually Download Software Updates

Concepts

About Standard and Branch Distribution Points
About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Update List Name Properties

The Configuration Manager 2007 update list name properties dialog box displays information about the update list and allows for the name and description to be modified, as well as the security for the update list object.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Update List Name Properties: General Tab

Specifies the name and description for the update list.

Properties - Security Tab

Specifies the class and instance security for the deployment object.

See Also

Concepts

About the Update List Wizard
About Update Lists in Software Updates
How to Manage Software Updates Metadata


Update List Name Properties: General Tab

Use the General page in the Configuration Manager 2007 update list name properties dialog box to configure the name and description for the update list. For information about how to add software updates to an existing update list, see How to Add Software Updates to an Update List.

The General tab contains the following elements:

Name

Specifies the name for the update list. The name must be unique and should help to describe the software updates contained in the update list.

Description

Specifies the description for the update list. The description should provide an overview of what software updates are contained in the update list and information that helps to identify it among others in the Update List node of the Configuration Manager console.

See Also

Tasks

How to Add Software Updates to an Update List

Concepts

About the Update List Wizard
About Update Lists in Software Updates
How to Manage Software Updates Metadata

Other Resources

Update List Name Properties


Software Updates Console Tree Properties

The software updates console tree node properties in Configuration Manager 2007 are used to configure the security for each object. Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Update Lists Properties

Specifies the security for the Update Lists object.

Update Repository Properties

Specifies the security for the Update Repository object.

Deployment Management Properties

Specifies the security for the Deployment Management object.

Deployment Templates Properties

Specifies the security for the Deployment Template object.

Deployment Packages Properties

Specifies the security for the Deployment Packages object.

See Also

Concepts

About Software Update Deployment Packages
About Deployment Templates in Software Updates
About Software Update Deployments
About Update Lists in Software Updates
How to Manage Software Update Files
How to Manage Software Updates Metadata

Other Resources

How to Manage Software Update Deployments
Planning for Software Updates


Update Lists Properties

The Update Lists properties dialog box in Configuration Manager 2007 specifies the console tree object name, which cannot be modified, from the General tab and allows the Update Lists console tree object security to be modified from the Security tab.

Update list objects use the Configuration Item class security. From the Security tab, users can be added or removed from the Configuration Item class security and security rights can be configured for each user.

Important
The Configuration Item security class is used by the following Configuration Manager console tree nodes: Update Lists, Update Repository, Network Access Protection, Policies, and Desired Configuration Management. The Configuration Item class security rights can be modified from the Security tab in the properties for any of these console tree nodes.

Click the link in the following section for detailed information about the Security tab in the Update Lists Properties dialog box.

In This Section

Properties - Security Tab

Specifies the class and instance security for the Update Lists object.

See Also

Tasks

How to Deploy Software Updates Using an Update List

Concepts

About Update Lists in Software Updates
About the Update List Wizard
How to Manage Software Updates Metadata

Other Resources

Update List Name Properties


Update Repository Properties

The Update Repository properties dialog box in Configuration Manager 2007 allows the Update Repository console tree object security to be modified. The General tab specifies that console tree object name, which cannot be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Properties - Security Tab

Specifies the class and instance security for the deployment object.

See Also

Tasks

How to Deploy Software Updates
How to Synchronize Software Updates

Concepts

About Software Updates Metadata
About Software Updates Synchronization
How to Manage Software Updates Metadata

Other Resources

Software Update Name Properties


Deployment Management Properties

The Deployment Management properties dialog box in Configuration Manager 2007 allows the Deployment Management console tree object security to be modified. The General tab specifies that console tree object name, which cannot be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Properties - Security Tab

Specifies the class and instance security for the deployment object.

See Also

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Name Properties
How to Manage Software Update Deployments


Deployment Templates Properties

The Deployment Templates properties dialog box in Configuration Manager 2007 allows the Deployment Templates console tree object security to be modified. The General tab specifies that console tree object name, which cannot be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Properties - Security Tab

Specifies the class and instance security for the deployment object.

See Also

Concepts

About Deployment Templates in Software Updates
About the Deployment Template Wizard

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Packages Properties

The Deployment Packages properties dialog box in Configuration Manager 2007 allows the Deployment Packages console tree object security to be modified. The General tab specifies that console tree object name, which cannot be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Properties - Security Tab

Specifies the class and instance security for the deployment package object.

See Also

Tasks

How to Download Software Updates

Concepts

About Software Update Deployment Packages
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Software Updates Package Status Home Page

The Software Updates Package Status Home page in the Configuration Manager 2007 console tree displays summary information for each deployment package on the Configuration Manager 2007 site.

For each site to which the deployment package is targeted, the following information is shown by default:

  • Site: Displays the name of the Configuration Manager 2007 site to which the deployment package is targeted.
  • Source Version: Displays the version number of the deployment package source files. This is incremented each time you revise the package and can be used to determine whether a distribution point has the latest version of the deployment package source.
  • Targeted: Displays the total number of distribution points, including child sites that have been targeted with a copy of the deployment package.
  • Installed: Displays the total number of distribution points to which the current version of the deployment package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this deployment package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

Selecting any site from the Package Status node displays the following information by default:

  • Distribution Point: Displays the name of each distribution point to which this deployment package has been targeted.
  • Source Version: Displays the version number of the deployment package source files. This is incremented each time you revise the deployment package and can be used to determine whether a distribution point has the latest version of the deployment package source.
  • State: Displays the current status of the deployment package on the distribution point.
  • Last Copied: Displays the date and time when the deployment package was last copied to the distribution point.
  • Path: Displays the location of the deployment package files on the distribution point.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Software Updates Package Status Home Page

The following actions are available from the software updates package status home page:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected deployment package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the detail pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Tasks

How to Create a Deployment Package

Concepts

About Software Update Deployment Packages
How to Manage Software Update Files
Using Status Messages for Configuration Manager Troubleshooting


Operating System Deployment Property Pages

This section contains the help topics for Operating System Deployment property pages.

In This Section

Operating System Deployment: Boot Images Node

Operating System Deployment: Computer Association Node

Operating System Deployment: Operating System Images Node

Operating System Deployment: Task Sequences Node

Operating System Deployment: Task Sequence Editor

Operating System Deployment: Drivers and Driver Packages Nodes

Operating System Deployment: Operating System Install Packages Node

Operating System Deployment: Operating System Deployment Feature Pack Packages

See Also

Other Resources

Dialog Pages
Wizard Pages


Operating System Deployment: Boot Images Node

An Operating System Deployment boot image is a Windows Pre-Installation Environment (PE) 2.0 image that is used during the operating system deployment process. The Boot Images node displays a list of the Operating System Deployment boot images that have been created, the actions that can be run, and, when a boot image is selected from the Boot Images list, specific actions that can be run for that boot image.

The Operating System Deployment boot images that have been created are displayed in a list in the Boot Images results pane. The Name column is used as the default sort order. The following columns are displayed by default:

  • Name: The name of the boot image package.
  • Version: The version of the boot image. This represents an arbitrary value set by the Configuration Manager 2007 Administrator.
  • Comment: An optional user defined description of the image.
  • Image ID: The unique ID number created by Configuration Manager 2007 that is associated with the boot image.

You can filter the boot images that are displayed in the Boot Images pane using the four filter actions located above the list.

Look For

Enter all or part of a boot image name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific boot image is selected in the Boot Images pane, the General tab on the lower half of the Boot Images results pane displays the following properties of the boot image:

  • The name of the boot image
  • Version
  • Comment
  • Image ID

You can select the following default actions grouped under Boot Images in the Actions pane. You can collapse the default actions by clicking the up arrow in the Boot Images section header.
Add Boot Image

Select this action to run the Add Boot Image Package Wizard. This wizard lets you add a new boot image to the selected boot image folder.

Copy Packages

Select this action to launch the Copy Packages Wizard. You can use this wizard to copy packages from one distribution point to another. You must have appropriate permissions to the packages you want to copy.

New Folder

Select this action to create a new folder at the highlighted point in the console tree.

New Search Folder

Select this action to launch the Search Folder Criteria dialog box. The search folder dialog box provides a way put Configuration Manager 2007 objects into a folder based on administrator defined search criteria. For more information about specifying the search criteria use the following link: Search Folder Criteria Dialog Box

View

Select this action to add or remove columns in the operating system install package pane, to export the list of operating system install package to a tab-delimited or comma-delimited text or unicode text file, and to hide the search bar in the operating system install package results pane.

New Window from Here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display general properties for the Boot Images node, and to set class security on that node.

Help

Select this action to display Configuration Manager 2007 product help for this node.

When you select a specific boot image in the Boot Images results pane, or expand the Boot Images node and select a boot image from the console tree, you can run the following actions grouped under that boot image name section in the Actions pane. You can collapse the default actions by clicking the up arrow in that section header.
Update Distribution Points

Select this action to run the Update Distribution Points Wizard. This wizard is used to update distribution points with a new version of a boot image after changes have been made to that boot image.

Manage Distribution Points

Select this action to run the Manage Distribution Points Wizard. This wizard is used to distribute the boot image to one or more distribution points, from which it can be used by target computers.

Move Items

Select this to launch the Move Items dialog box. This dialog box is used to move a selected image to a new container.

New Window from here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Cut

Select this action to cut the selected boot image to paste in another boot image folder in this tree.

Delete

Select this action to delete the boot image. When you delete a boot image, you will be prompted to confirm the deletion.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display detailed properties for the selected boot image.

Help

Select this action to display Configuration Manager 2007 product help for this node.


Boot Images Node Properties

The following two tabs are displayed:

  • General
  • Security

General

This tab displays the name of the node. No other configurable options are available on this tab.

See Also

Reference

Properties - Security Tab


Boot Image Properties

In This Section

Boot Image Properties - General Tab

Specifies general information about the boot image.

Boot Image Properties - Images Tab

Specifies property names and values associated with the boot image.

Boot Image Properties - Windows PE Tab

Specifies the device drivers in the driver catalog that should be associated with Windows PE.

Boot Image Properties - Data Source Tab

Specifies the boot image for this package.

Boot Image Properties - Data Access Tab

Specifies how users will access operating system images on distribution points.

Boot Image Properties - Distribution Settings Tab

Specifies the preferred sender and sending method for the package.

Properties - Security Tab

Specifies the class and instance security for the deployment object.


Boot Image Properties - General Tab

Use this tab to specify basic information required for this boot image.

You can configure the following settings:

Name

The name of this image.

Version

The version number of the image, up to 32 characters.

Comment

An optional user-defined comment for the image.

See Also

Other Resources

Boot Image Properties


Boot Image Properties - Images Tab

The Image tab displays property names and values that are associated with a selected image. The property values are populated from metadata in the Configuration Manager 2007 database.

Note
If the administrator is connected on a child site, the property values will be read-only.

To load the property values for a specific image, select the image you want to view from the drop-down list. The image properties will appear in the Image Properties window. You can update the property values for each item marked with a pen icon. The properties without the pen icon are read-only.

Important
Changes made on this page will modify the source image file.

This page contains the elements described in the following table.

Name Description

Reload

Causes the image to attempt to re-read the original properties from the source image. This action will reload property values from the source image and more current image property changes will be lost.

Note
If the administrator is working on a child site form where the boot image package resides, this action is disabled.

See Also

Other Resources

Boot Image Properties


Boot Image Properties - Windows PE Tab

Use the Windows PE tab to specify device drivers in the driver catalog that should be added to the Windows PE 2.0 boot image.

The Drivers pane displays Windows device drivers that are currently associated with the selected Windows PE image. To add a new driver, click New to open the Select a driver dialog box. The available device drivers are displayed with their associated properties Name, Provider, Class and Digital Signer, and INF file listed at the bottom of the dialog box. Select the device driver you want to add, and then click OK.

The Windows PE tab contains the following elements:

Enable command support (testing only)

Enables command line support for testing purposes only. After command line support is enabled, you can press F8 to open a command shell while the task sequence is running in Windows PE or in the new operating system

Use the default background

Select this option to use the default background bitmap when running Windows PE.

Specify the custom background bitmap(UNC Path)

Select this option to specify a custom background bitmap. The image specified must be in bitmap (bmp) format. The SMS Provider must have read access to the share specified.

See Also

Other Resources

Boot Image Properties


Boot Image Properties - Data Source Tab

Use this tab to specify the boot image for this package and to update the image source as needed.

This page contains the following elements:

Image Path

Specify the path to the image file using the Browse button.

Image Index

Specify the image you wish to use for this package using the drop down to select the desired image.

Source Version

Displays the number of times an administrator has updated the image source files and requested an update to distribution points, followed by the date and time of the last update. The Source version is incremented each time the path in Source directory is changed, or the Update all distribution points command is run or selected in the Manage Distribution Points Wizard. This field is empty unless the This package contains source files check box is selected.

Update distribution points on a schedule

The source files for this image will be regularly updated on distribution points. When selected, the default schedule is set to the current date with an interval of one day. By default, this check box is cleared.

Schedule

Click to open the Schedule dialog box, where you can specify how frequently to update the image data on distribution points. This button is available only when Update distribution points on a schedule is selected.

Persist content in client cache

Enable this option to ensure that the image source files remain cached on the destination computer rather than being aged out of cache by later downloaded images or packages.

Enable binary differential replication

Enable this option to only replicate package files that have changed since the last update.

See Also

Other Resources

Boot Image Properties


Boot Image Properties - Data Access Tab

Use this tab to configure how users can access distribution points for an image.

You can configure the following settings:

Access distribution folder through common Configuration Manager 2007 package share

The image is accessed through the common Configuration Manager 2007 package share (SMSPKGx$, where x is the drive letter) on distribution points. By default, this option is selected.

Share distribution folder

The image will be created on distribution points with an administrator-specified share and path name.

Share name

If you select Share distribution point, enter a unique share name and path to be created for the image source files on distribution points. See the section Share names later in this document.

Package update settings

Specify the disconnect settings that will take effect when Configuration Manager 2007 updates images on distribution points.

Disconnect users from distribution points

Select this option to notify users before disconnecting them from distribution points when Configuration Manager 2007 updates package data. By default, this check box is cleared.

Number of retries before disconnecting users

The number of times that Configuration Manager 2007 tries to update the image source files before disconnecting users who are connected to the distribution point. The default setting is 2; you can specify 0 to 99, inclusive.

Interval between user notification and disconnection

The number of minutes Configuration Manager 2007 should wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.

Share Names

If you select Share distribution point, enter a unique share name and path to be created for the image source files on distribution points. The value can either be a share, which must be unique among all images and Configuration Manager 2007 packages, or a share and a path, where the path must be unique among all images and Configuration Manager 2007 packages. See the following table for examples.

Share name | Resulting path on distribution points
Office | \\distributionpointservername\office
Images\XPPro | \\distributionpointservername\images\XPPro
Packages\images\Vista | \\distributionpointservername\packages\images\Vista
Note
Do not enter a full Universal Naming Convention (UNC) path in Share name, such as \\server\share. Enter only the name of the shared folder on distribution points.

If the share name is entered as a share only, as in the first example, all files and subdirectories within that share will be deleted and re-created each time the package is updated or refreshed. If the share name is entered as a share name and a path, only the bottom path (XPPro and Vista in the above examples) will be deleted and re-created each time the package is updated or refreshed.

To control which drive either the default or custom package folder is created on, assign the distribution point role to a server share instead of a server computer. For more information, see Site Systems Configuration Overview. For distribution points on server shares, if a share name is entered for an image, it is treated as a path beneath the distribution point share (\\MyServer\MyShare), as shown in the following table:

Package share name | Resulting path on distribution points
Office | \\Myserver\Myshare\office
Images\XPPro | \\Myserver\Myshare\images\XPPro
Packages\images\Vista | \\Myserver\Myshare\packages\images\Vista

See Also

Other Resources

Boot Image Properties


Boot Image Properties - Distribution Settings Tab

When image packages are distributed between sites, you must use senders to communicate with other sites. Use this tab to specify the optional sending priority and preferred sender for the package.

You can configure the following settings:

Sending priority

The priority of this image package when sent to distribution points in child sites. Images can be sent with High, Medium, or Low priority. The default setting is Medium priority.

Images are sent in priority order: High first, Medium next, and then Low. Images with identical priorities are sent in the order in which they were created in the Configuration Manager 2007 console.

Sending priority for an image is carried over in those sent from a parent site to a child site.

Preferred sender

The sender to be used to send this image to distribution points in other sites. You can specify any sender configured for the site, or No Preference, which uses any available sender. The default setting is No Preference.

Note
To use Courier Sender to distribute images, you must select it as the preferred sender.

Branch Distribution Point content settings

Use the options in this section to configure how images are distributed to branch distribution points.

Branch distribution points automatically download this package when they receive the advertisement.

Select this option to have the image download automatically to a branch distribution point when a branch distribution point is specified manually, receives an advertisement, or when running the Manage Distribution Points Wizard. This option is selected by default.

Make this package available on protected distribution points when requested by clients inside the protected boundaries.

Select this option to make Configuration Manager 2007 packages available to only Configuration Manager 2007 clients that are located inside the protected boundaries serviced by the protected distribution point.

Administrator manually copies this package to branch distribution points

Select this option to manually manage how the image is distributed to branch distribution points.

See Also

Other Resources

Boot Image Properties


Task Sequence Node Properties - General Tab

The following two tabs are displayed:

  • General
  • Security

General

This tab displays the name of the node. No other configurable options are available on this tab.

See Also

Reference

Properties - Security Tab


Operating System Deployment: Computer Association Node

A computer association organizes the migration of user state and settings from a source computer to a destination computer. The source computer is an existing computer that is managed by Configuration Manager 2007, which contains the user state and settings that will be migrated. These settings are migrated to a specified destination computer.

The Computer Association node displays a list of the computer associations that have been created, the actions that can be run, and, when a computer association is selected in the Computer Association results pane, specific actions that can be run for that computer association are displayed.

The computer associations that have been created are displayed in a list in the Computer Association results pane. The Source Computer column is used for the default sort order. The following columns are displayed by default:

  • Source Computer: The name of the source computer that contains the state that is being migrated to a destination computer.
  • Source MAC: The MAC address of the network interface card installed in the source computer.
  • Destination Computer: The name of the computer that the migrated settings will be applied to.
  • Destination MAC: The MAC address of the network interface card installed in the destination computer.
  • Migration Type: The migration type used to store the user state. The migration types are Side-by-side, and In-place.

You can also add the following two columns using Add/Remove columns.

  • Source User: The name of the user profile associated with the source computer that is being migrated to a destination computer. The user profile reported is the most recent user account to access the computer when the last hardware inventory was run. This information is intended to help identify the computer, but does not affect the migration process.
  • Destination User: The name of the user profile on the destination computer that migrated settings will be applied to. This is the same as the Source User profile.

You can filter the computer associations that are displayed in the Computer Association results pane using the four filter actions located above the list.

Filter Action List

Look For

Enter all or part of a computer association name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific computer association is selected in the Computer Associations results pane, the General tab on the lower half of the Computer Associations results pane displays the following properties of the computer associations:

  • Migration date - Date the source computer settings were restored to the destination computer.
  • State deleted on - Date the computer state was deleted from the state migration point after the retention period has elapsed.
  • Date state saved - Date the source computer state was saved
  • State location - Location where source computer settings were saved
  • You can right-click an existing computer association and the following default actions are available:
Note
You must have Configuration Manager 2007 recover user state permissions to access this information

  • Specify User Accounts - specifies which user accounts will be migrated. By default all user profiles are migrated.
  • View Recovery Information - displays the user state recovery information for the computer association. The associated source and destination computer information is displayed with the user state store location and the user state recovery key.

You can select the following default actions grouped under Computer Associations in the Actions pane. You can collapse the default actions by clicking the up arrow in the Computer Associations section header.

Default Action List

New

Select this action to run the Manage Computer Association Wizard to create a new computer association or to create a new folder at the highlighted location in the console tree.

Import Computer Information

Select this action to run the Import Computer Information Wizard. This wizard allows you to import information about unknown or new computers into the Configuration Manager 2007 database. For more information about importing new computer information see: How to Add a New Computer to the Configuration Manager Database

View

Select this action to add or remove columns in the Computer Associations results pane, to export the list of computer associations to a tab-delimited or comma-delimited text or unicode text file, and to hide the search bar in the Computer Associations results pane.

New Window from Here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display general properties for the Computer Associations node, and to set class security on that node.

Help

Select this action to display Configuration Manager 2007 product help for this node.

When you select a computer association in the Computer Associations results pane, you can run the following actions grouped under that computer association's name section in the Actions pane. You can collapse the default actions by clicking the up arrow in that section header.

Actions for Selected Computer Association

Delete

Select this action to delete the computer association. When you delete a computer association, you will be prompted to confirm the deletion. If the Date state saved or State deleted on fields are blank, The migration might not yet have completed, and some target computers might not yet have restored user state. Do not delete the computer association until all target computers have restored user state.

Source computer properties

Select this item to display detailed properties for the source computer in the selected computer association.

Destination computer properties

Select this item to display detailed properties for the destination computer in the selected computer association.

Cut

Select this action to cut the selected computer association to paste in another computer association folder in this tree.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Help

Select this action to display Configuration Manager 2007 product help for this node.


Operating System Deployment: Drivers and Driver Packages Nodes

The driver catalog consists of the Drivers node and the Driver Packages node in the Configuration Manager 2007 administrator console.

Drivers Node

The device drivers that have been imported are displayed in a list in the Drivers results pane. The Name column is used as the default sort order. The following columns are displayed by default:

  • Name
  • Provider
  • Class
  • Version Number
  • Version Date
  • Categories
  • Status

You can filter the drivers that are displayed in the Drivers pane using the four filter actions located above the list.

Look For

Enter all or part of a device driver name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific driver is selected in the Drivers pane, the General tab on the lower half of the device driver properties pane displays the following properties of the device driver:

  • Driver name
  • Description
  • Status
  • Provider
  • Class
  • Version Number
  • Version Date

The Applicability tab displays the following properties associated with the selected device driver:

  • Supported Platforms
  • Supported Models
  • The Usage tab displays the following properties associated with the selected device driver:
  • Package
  • Package ID

You can select the following default actions grouped under Drivers in the Actions pane. You can collapse the default actions by clicking the up arrow in the Drivers section header.
Import

Select this action to run the Import New Driver Wizard and import one or more device drivers into the driver catalog.

New Folder

Select this action to create a new folder at the highlighted point in the console tree.

New Search Folder

Select this action to launch the Search Folder Criteria dialog box. The search folder dialog box provides a way put Configuration Manager 2007 objects into a folder based on administrator defined search criteria. For more information about specifying the search criteria use the following link: Search Folder Criteria Dialog Box

When you select a device driver in the Drivers properties pane,, you can run the following actions grouped under that device driver name section in the Actions pane. You can collapse the default actions by clicking the up arrow in that section header.
Import

Select this action launch the Import New Driver Wizard package. You can use this wizard to import a new device driver into the driver catalog.

New Folder

Select this action to launch the New Folder dialog box which will allow you to create a new folder to store device drivers.

New Search Folder

Select this action to launch the Search Folder Criteria dialog box. You can specify the object properties that should be searched.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display detailed properties for the selected device driver.

Disable

Disables a device driver in the driver catalog. If a device driver is disabled it will not be installed by the Auto Apply Driver action but can still be installed as part of a Apply Driver Package action.

Enable

Enables a device driver in the driver catalog. If a device driver is enabled it can be installed by the Auto Apply Driver action and as part of an Apply Driver Package action.

Categories

Select this action to assign, modify, or remove a category for the associated device driver.

Add or Remove Drivers to Packages

Allows you to add a new device driver to a driver package, or remove a device driver from an existing driver package. Use the Add or Remove Drivers to Packages dialog box to add or remove the content associated with a selected device driver to or from a driver package.

Add or Remove Drivers to Boot Images

Select this action to add or remove a device driver from a boot image package.

Cut

Select this action to cut the selected device driver to paste in another device driver folder in this tree.

Copy

Select this action to copy the selected device driver to paste in another device driver folder in this tree.

Delete

Select this action to delete the device driver. When you delete a device driver, you will be prompted to confirm the deletion.

Properties

Select this option to display the properties associated with the selected device driver.

Driver Packages Node

The driver packages that have been created are displayed in a list in the Driver Packages results pane. The Name column is used as the default sort order. The following columns are displayed by default:

  • Name
  • Version
  • Package ID

You can filter the drivers that are displayed in the Driver Packages pane using the four filter actions located above the list.

Look For

Enter all or part of a driver package name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

You can select the following default actions grouped under Driver Packages in the Actions pane. You can collapse the default actions by clicking the up arrow in the Drivers section header.
New

Select this action to run the New Driver Package Wizard to create a new driver package.

Copy Packages

Select this action run the Copy Packages Wizard which will allow you to copy a driver package from one Configuration Manager 2007 distribution point to another.

New Search Folder

Select this action to launch the Search Folder Criteria dialog box. The search folder dialog box provides a way put Configuration Manager 2007 objects into a folder based on administrator defined search criteria. For more information about specifying the search criteria use the following link: Search Folder Criteria Dialog Box

When you select a driver package in the Driver Packages results pane, you can run the following actions grouped under that device driver name section in the Actions pane. You can collapse the default actions by clicking the up arrow in that section header.

Update Distribution Points

Select this action to update the distribution points that contain the driver package with the latest version of the driver package. Click Yes to confirm and initiate the update.

Manage Distribution Points

Select this action to launch the Manage Distribution Points Wizard. The wizard will assist you with copying the driver package to a new distribution point.

Move Items

Select this to launch the Move Items dialog box. This dialog box is used to move a selected image to a new container.

Cut

Select this action to cut the selected driver package to paste in another driver package folder in this tree.

Delete

Select this action to delete the driver package. When you delete a driver package, you will be prompted to confirm the deletion.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display detailed properties for the selected device driver.

Help

Select this action to display Configuration Manager 2007 product help for this node.

See Also

Other Resources

How to Manage the Driver Catalog


Operating System Deployment: Operating System Images Node

The Operating System Images node displays a list of the Operating System Deployment image packages that have been created, the actions that can be run, and, when an operating system image package is selected from the Operating System Images results pane, specific actions that can be run for that operating system image package.

The Operating System Deployment image packages that have been created are displayed in a list in the Operating System Images results pane. The Name column is used as the default sort order. The following columns are displayed by default:

  • Name: The name of the operating system image package. The name is derived from the operating system image selected when the operating system image package was created, followed by the Image ID associated with the package.
  • Version: The version of the operating system image package.
  • Comments: The optional description entered for the operating system image package.
  • Image ID: The ID number created by Configuration Manager 2007 for the operating system image package.

You can filter the operating system image packages that are displayed in the Operating System Images pane using the four filter actions located above the list.

Look For

Enter all or part of an operating system image package name, or use the drop-down list to select from existing filter criteria.

Search In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

There are three tabs on the lower half of the Operating System Images results pane: General, Images, and Disk Configuration.

The General tab displays the following properties of the WIM file that are stored in the Configuration Manager 2007 database:

  • Version
  • Comment
  • Image ID

The Images tab displays the following properties of the WIM file referenced by the operating system image you selected. These properties are stored in the WIM file and are available to external tools that access the WIM file directly.

  • Index
  • Operating System
  • Version
  • Edition
  • Language
  • Architecture
  • Size
  • HAL Type

The Disk Configuration tab displays the following disk partition information included with the operating system image:

  • Name
  • Size
  • File System
  • Architecture
  • Offset Value

You can select the following default actions grouped under Operating System Images in the Actions pane. You can collapse the default actions by clicking the up arrow in the Operating System Images section header.
Add Operating System Image Package

Select this action to run the Add Operating System Image Package Wizard. This wizard lets you select and add an operating system image as an Configuration Manager 2007 package.

Copy Packages

Select this action to launch the Copy Packages wizard. Use this wizard to copy packages from one distribution point to another.

New Folder

Select this option to create a new folder. Folders can be used to organize operating system images.

New Search Folder

Select this option to search folders. In the Search Folder Criteria dialog box, specify the properties that should be used to perform the search.

View

Select this action to add or remove columns in the Operating System Images results pane, to export the list of operating system image packages to a tab-delimited or comma-delimited text or unicode text file, and to hide the search bar in the Operating System Images results pane.

New Window from Here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display general properties for the Operating System Images node, and to set class security on that node.

Help

Select this action to display Configuration Manager 2007 product help for this node.

When you select a specific operating system image in the Operating System Images results pane, or expand the Operating System Images node and select an operating system image from the console tree, you can run the following actions grouped under the Operating System Image Package section in the Actions pane. You can collapse the default actions by clicking the up arrow in that section header.
Manage Distribution Points

Select this action to run the Manage Distribution Points Wizard. This wizard is used to distribute the boot image to one or more distribution points, from which it can be used by target computers.

Update Distribution Points

Select this action to update the package information on distribution points. This wizard is used to update distribution points with a new version of a boot image after changes have been made to that boot image.

Cut

Select this action to cut the selected operating system image to paste in another Operating System Images folder in this tree.

Delete

Select this action to delete the operating system image package. When you delete an operating system image package, you will be prompted to confirm the deletion.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display detailed properties for the selected operating system image package.

Help

Select this action to display Configuration Manager 2007 product help for this node.


Operating System Deployment: Task Sequences Node

The Task Sequences node displays a list of the task sequences that have been created, the actions that can be run, and, when a task sequence is selected from the Task Sequences results pane, specific actions that can be run for that task sequence.

The task sequences that have been created are displayed in a list in the Task Sequences results pane. The Name column is used as the default sort order. The following columns are displayed by default:

  • Name: The name of the task sequence as specified by the Configuration Manager Administrator.
  • Comment: The optional comment entered for the task sequence.
  • Task ID: The ID number created by Configuration Manager 2007 for the task sequence.
  • Creation date: The date and time that the task sequence was created.

You can filter the task sequences that are displayed in the Task Sequences results pane using the four filter actions located above the list.

Look For

Enter all or part of a task sequence name, or use the drop-down list to select from existing filter criteria.

Search In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific task sequence is selected in the Task Sequences results pane, the General tab on the lower half of the Task Sequences results pane displays the following properties of the task sequence:

  • Task Sequence name
  • Description
  • Task ID
  • Optional category associated with the task sequence
  • Boot images associated with the task sequence

You can select the following default actions grouped under Task Sequences in the Actions pane. You can collapse the default actions by clicking the up arrow in the Task Sequences section header.
Import

Select this action to import task sequences that have been exported from other Configuration Manager 2007 sites.

Create Task Sequence Media

Select this action to run the Task Sequence Media Wizard.

New

Select this action to run the New Task Sequence Wizard or to create a new folder under the highlighted node in the console tree.

View

Select this action to add or remove columns in the Task Sequences results pane, to export the list of task sequences to a tab-delimited or comma-delimited text or unicode text file, and to hide the filter bar in the Task Sequences results pane.

New Window from Here

Select this action to display a new Configuration Manager console window rooted at the selected node in the console tree.

Refresh

Select this action to refresh the Configuration Manager console display.

Properties

Select this item to display general properties for the Task Sequences node, and to set class security on that node.

Help

Select this action to display Configuration Manager 2007 product help for this node.

When you select a specific task sequence in the Task Sequences results pane, you can run the following actions grouped under the Task Sequences section in the Actions pane. You can collapse the default actions by clicking the up arrow in that section header.
Edit

Select this action to run the Task Sequence Editor.

Export

Select this action to export the selected task sequence to a tab-delimited or comma-delimited text or unicode text file.

Create Task Sequence Media

Select this action to run the Task Sequence Media Wizard.

Duplicate

Select this action to create a copy of the selected task sequence.

Advertise

Select this action to run the New Advertisement Wizard.

Cut

Select this action to cut the selected task sequence to paste in another Task Sequence folder in this tree.

Move Items

Select this action to launch the Move Items dialog box. You can move the selected task sequence to an available container by clicking the appropriate folder and clicking the Move button.

Delete

Select this action to delete the task sequence. When you delete a task sequence, you will be prompted to confirm the deletion.

Refresh

Select this action to refresh the Configuration Manager console display.

Properties

Select this item to display detailed properties for the selected task sequence.

Help

Select this action to display Configuration Manager 2007 product help for this node.


Operating System Deployment: Operating System Install Packages Node

The Operating System Install Packages node displays a list of Configuration Manager 2007 operating installation packages.

The operating system deployment install packages that have been created are displayed in the operating system install packages results pane. The following columns are displayed by default:

  • Name: The name of the operating system install package.
  • Comment: The optional description entered for the operating system install package.
  • Package ID: The ID number created by Configuration Manager 2007 for the operating system install package.
  • Language: The language associated with the selected operating system install package.
  • Version: The version of the operating system install package.
Look For

Enter all or part of an operating system install package name, or use the drop-down list to select from existing filter criteria.

Search In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

When a specific operating system install package is selected in the operating system install package pane, the General tab on the lower half of the operating system install package results pane displays the following properties of the operating system install package:

  • Version
  • Comment
  • Package ID

The Editions tab displays properties associated with the selected operating system install package. The following properties are displayed:

  • Index
  • Operating System
  • Version
  • Edition
  • Language
  • Architecture
  • Size

You can select the following default actions grouped under operating system install package in the Actions pane. You can collapse the default actions by clicking the up arrow in the operating system install package section header.
Add Operating System Install Package

Select this action to run the Add Operating System Install Package Wizard. This wizard lets you add a new operating system install package to the selected operating system install package folder.

Copy Packages

Select this action to launch the Copy Packages Wizard. You can use this wizard to copy packages from one distribution point to another. You must have appropriate permissions to the packages you want to copy.

New Folder

Select this action to create a new folder at the highlighted point in the console tree.

New Search Folder

Select this action to launch the Search Folder Criteria dialog box. The search folder dialog box provides a way put Configuration Manager 2007 objects into a folder based on administrator defined search criteria. For more information about specifying the search criteria use the following link: Search Folder Criteria Dialog Box

View

Select this action to add or remove columns in the operating system install package pane, to export the list of operating system install package to a tab-delimited or comma-delimited text or unicode text file, and to hide the search bar in the operating system install package results pane.

New Window from Here

Select this action to display a new Configuration Manager 2007 Administrator Console window rooted at the selected node in the console tree.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display general properties for the operating system install package node, and to set class security on that node.

Help

Select this action to display Configuration Manager 2007 product help for this node.

When you select a specific operating system install package in the operating system install package results pane, or expand the operating system install package node and select a operating system install package from the console tree, you can run the following actions grouped under that operating system install package name section in the Actions pane. You can collapse the default actions by clicking the up arrow in that section header.
Update Distribution Points

Select this action to run the Update Distribution Points Wizard. This wizard is used to update distribution points with a new version of a operating system install package after changes have been made to that operating system install package.

Manage Distribution Points

Select this action to run the Manage Distribution Points Wizard. This wizard is used to distribute the operating system install package to one or more distribution points, from which it can be used by target computers.

Move Items

Select this to launch the Move Items dialog box. This dialog box is used to move a selected image to a new container.

Cut

Select this action to cut the selected operating system install package to paste in another operating system install package folder in this tree.

Delete

Select this action to delete the operating system install package. When you delete a operating system install package, you will be prompted to confirm the deletion.

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Properties

Select this item to display detailed properties for the selected operating system install package.

Help

Select this action to display Configuration Manager 2007 product help for this node.


Operating System Deployment: Unprovisioned Computer Node

Topic last updated—January 2008

An unprovisioned computer is a computer that has been discovered by the Configuration Manager 2007 operating system deployment task sequence as an unknown computer but has not yet installed a Configuration Manager 2007 client. When deploying an operating system to an unknown computer using a task sequence, the unknown computer is assigned an SMS unique identifier and added to the unprovisioned computers node. After the operating system has been deployed and a Configuration Manager 2007 client has been installed, the computer is removed from the unprovisioned computer node. If the task sequence is not successfully completed for some reason, the computer will remain in this node.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

The unprovisioned computers that have been discovered are displayed in a list in the Unprovisioned Computers properties pane. The Name column is used for the default sort order. The following columns are displayed by default:

  • Name - The name of the unprovisioned computer. This will be 'unknown'.
  • Resource Type - The code for the resource type. The code for 'machine,' 5, is the only value for unprovisioned computers.
  • Agent Site - The site code to which the unknown computer belongs.
  • SMS Unique Identifier - The unique GUID assigned by the Configuration Manager 2007 server.

You can filter the unprovisioned computers that are displayed in the Unprovisioned Computers pane by using the four filter actions located above the list.

Look For

Enter all or part of a device driver name, or use the drop-down list to select from existing filter criteria.

In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

See Also

Other Resources

Operating System Deployment Property Pages


Computer Association Node Properties - General Tab

The following tab is displayed:

  • General: Displays the name of the node. No other configurable options are available on this tab.

General

This tab displays the name of the node. No other configurable options are available on this tab.


Computer Association Properties

Three actions become available in the Actions pane when you select an existing computer association on the Computer Associations node:

Delete

Select this action to delete the selected computer association.

Reference Computer Properties

Select this action to display the Reference Computer properties dialog box. You can also access this action by right-clicking the selected computer association and choosing Reference Computer properties from the action menu.

Destination Computer Properties

Select this action to display the Destination Computer properties dialog box. You can also access this action by right-clicking the selected computer association and choosing Destination Computer properties from the action menu.

See Also

Reference

Computer Association - Reference Computer Properties
Computer Association - Destination Computer Properties


Computer Association - Reference Computer Properties

The Reference Computer properties dialog box displays the following two tabs:

  • General
  • Advertisements

General Tab

The General tab displays non-configurable information about the reference computer. The following information is displayed:

Name

The computer name of the reference computer.

Resource class

The WMI resource class that is associated with the reference computer. The resource class is typically System Resource.

Discovery data

The Discovery data list box displays each discovered property of the reference computer, and the value of that property.

Advertisements Tab

The Advertisements tab displays a list of all advertisements that are current for the reference computer.

See Also

Reference

Computer Association - Destination Computer Properties


Computer Association - Destination Computer Properties

The Destination Computer properties dialog box displays the following two tabs:

  • General
  • Advertisements

General Tab

The General tab displays non-configurable information about the reference computer. The following information is displayed:

Name

The computer name of the reference computer.

Resource class

The WMI resource class that is associated with the reference computer. The resource class is typically System Resource.

Discovery data

The Discovery data list box displays each discovered property of the reference computer, and the value of that property.

Advertisements Tab

The Advertisements tab displays a list of all advertisements that are current for the reference computer.

See Also

Reference

Computer Association - Reference Computer Properties


Operating System Images Node Properties

The following two tabs are displayed:

  • General
  • Security

General

This tab displays the name of the node. No other configurable options are available on this tab.

See Also

Reference

Properties - Security Tab


Operating System Image Properties

The Operating System Image Properties page displays the following five tabs:

Operating System Images - General Tab

Operating System Images - Images Tab

Operating System Images - Data Source Tab

Operating System Images - Data Access Tab

Operating System Images - Distribution Settings Tab

Properties - Security Tab


Operating System Images - General Tab

Use this tab to specify basic information required for this image. The information provided here is metadata about the Operating System Image package and is stored in the Configuration Manager 2007 database. These settings are not saved as part of the Windows Image (WIM) file you created from the reference computer.

You can configure the following settings:

Name

The name of this image.

Version

The version number of the image, up to 32 characters.

Comment

An optional user-defined description of the image.

See Also

Reference

Operating System Images - Images Tab
Operating System Images - Data Source Tab
Operating System Images - Data Access Tab
Operating System Images - Distribution Settings Tab
Properties - Security Tab


Operating System Images - Images Tab

The Image tab displays property names and values that are associated with a selected image. The property values are populated from metadata in the Configuration Manager 2007 database.

Note
If the administrator is connected on a child site, the property values will have read-only status.

To load the property values for a specific image, select the image you want to view from the drop-down list. The image properties will display in the Image Properties window. You can update the property values for each item marked with a pen icon. The properties without the pen icon are read-only.

Important
Changes on this page will modify the source image file.

The Images tab contains the following elements.

Reload

Causes the image to attempt to re-read the original properties from the source image. This action will reload property values from the source image and all image property changes will be lost.

Note
If the administrator is on a child site form where the boot image package resides, this action is disabled.

See Also

Reference

Operating System Images - General Tab
Operating System Images - Data Access Tab
Operating System Images - Data Source Tab
Operating System Images - Distribution Settings Tab
Properties - Security Tab


Operating System Images - Data Source Tab

Use this tab to view the image properties associated with the operating system image for this package.

You can configure the following settings:

Image Path

Specify the path to the image file using the Browse button.

Source Version

The number of times an administrator has updated the image source files and requested an update to distribution points, followed by the date and time of the last update. The Source version is incremented each time the path in Source directory is changed, or the Update all distribution points command is run or selected in the Manage Distribution Points Wizard.

Update distribution points on a schedule

The source files for this image will be regularly updated on distribution points. When selected, the default schedule is set to the current date with an interval of one day. By default, this check box is cleared.

Custom Schedule

Click to open the Schedule dialog box, where you can specify how frequently to update the image data on distribution points. This button is available only when Update distribution points on a schedule is selected.

Persist content in client cache

Enable this option to ensure that the image source files remain cached on the destination computer rather than being aged out of cache by later downloaded images or packages.

Enable binary differential replication

Enable this option to only replicate package files that have changed since the last update.

See Also

Reference

Operating System Images - General Tab
Operating System Images - Images Tab
Operating System Images - Data Access Tab
Operating System Images - Distribution Settings Tab
Properties - Security Tab


Operating System Images - Data Access Tab

Use this tab to configure how users can access distribution points for an image.

You can configure the following settings:

Access distribution folder through common Configuration Manager 2007 package share

The image is accessed through the common Configuration Manager 2007 package share (SMSPKGx$, where x is the drive letter) on distribution points. By default, this option is selected.

Share distribution folder

The image will be created on distribution points with an administrator-specified share and path name.

Share name

If you select Share distribution point, enter a unique share name and path to be created for the image source files on distribution points. See the section Share names later in this document.

Package update settings

Specify the disconnect settings that will take effect when Configuration Manager 2007 updates images on distribution points.

Disconnect users from distribution points

Select this option to notify users before disconnecting them from distribution points when Configuration Manager 2007 updates package data. By default, this check box is cleared.

Number of retries before disconnecting users

The number of times that Configuration Manager 2007 tries to update the image source files before disconnecting users who are connected to the distribution point. The default setting is 2; you can specify 0 to 99, inclusive.

User grace period

The number of minutes Configuration Manager 2007 should wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.

Share Names

If you select Share distribution point, enter a unique share name and path to be created for the image source files on distribution points. The value can either be a share, which must be unique among all images and Configuration Manager 2007 packages, or a share and a path, where the path must be unique among all images and Configuration Manager 2007 packages. See the following table for examples.

Share name | Resulting path on distribution points
Office | \\distributionpointservername\office
Images\XPPro | \\distributionpointservername\images\XPPro
Packages\images\Vista | \\distributionpointservername\packages\images\Vista
Note
Do not enter a full Universal Naming Convention (UNC) path in Share name, such as \\server\share. Enter only the name of the shared folder on distribution points.

If the share name is entered as a share only, as in the first example, all files and subdirectories within that share will be deleted and re-created each time the package is updated or refreshed. If the share name is entered as a share name and a path, only the bottom path (XPPro and Vista in the above examples) will be deleted and re-created each time the package is updated or refreshed.

To control which drive either the default or custom package folder is created on, assign the distribution point role to a server share instead of a server computer. For more information, see Site Systems Configuration Overview. For distribution points on server shares, if a share name is entered for an image, it is treated as a path beneath the distribution point share (\\MyServer\MyShare), as shown in the following table:

Package share name | Resulting path on distribution points
Office | \\Myserver\Myshare\office
Images\XPPro | \\Myserver\Myshare\images\XPPro
Packages\images\Vista | \\Myserver\Myshare\packages\images\Vista

See Also

Reference

Operating System Images - General Tab
Operating System Images - Images Tab
Operating System Images - Data Source Tab
Operating System Images - Distribution Settings Tab
Properties - Security Tab


Operating System Images - Distribution Settings Tab

Topic last updated—January 2008

When image packages are distributed between sites, you must use senders to communicate with other sites. Use this tab to specify the optional sending priority and preferred sender for the package.

This tab contains the following elements.

Sending priority

Specifies the priority of this image package when sent to distribution points in child sites. Images can be sent with High, Medium, or Low priority. The default setting is Medium priority.

Images are sent in priority order: High first, Medium next, and then Low. Images with identical priorities are sent in the order in which they were created in the Configuration Manager console.

Sending priority for an image is carried over in those sent from a parent site to a child site.

Preferred sender

Specifies the sender to be used to send this image to distribution points in other sites. You can specify any sender configured for the site, or you can specify No Preference, which uses any available sender. The default setting is No Preference.

Note
To use Courier Sender to distribute images, you must select it as the preferred sender.

Branch Distribution Point content settings

Allows you to configure how images are distributed to branch distribution points.

Branch distribution points automatically download this package when they receive the advertisement.

Automatically downloads the image to a branch distribution point when a branch distribution point is specified manually or when running the Manage Distribution Points Wizard. This option is selected by default.

Make this package available on protected distribution points when requested by clients inside the protected boundaries

Makes the package available only to Configuration Manager 2007 clients inside the protected boundaries when requested.

Manually manage content downloads to branch distribution points

Allows you to manually manage how the image is distributed to branch distribution points.

Allow this package to be transferred via multicast

Enables this package to be transferred via multicast. Multicasting conserves network bandwidth by simultaneously sending data to multiple clients rather than copying and sending a copy of the data to each client over a separate connection.

Applies only to Configuration Manager 2007 R2.

Encrypt packages when transferred via multicast

Specifies that the package will be sent encrypted when sent via multicast. Use this option if the operating system image package contains sensitive information. If not encrypted, the contents of the package will be visible in clear text on the network and could be read by other computers connected to the network.

Applies only to Configuration Manager 2007 R2.

Only transfer this package via multicast

Specifies that this package can only be sent using multicast. If multicast is unavailable, this package will not be distributed.

Applies only to Configuration Manager 2007 R2.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Operating System Images - Data Access Tab
Operating System Images - Data Source Tab
Operating System Images - General Tab
Operating System Images - Images Tab
Properties - Security Tab


Operating System Deployment - Manage Distribution Points

The Manage Distribution Points Wizard guides you through the steps necessary to send, update, refresh, or operating system images on distribution points so that the image can be deployed to clients.

As you complete the wizard, you will be prompted to specify the following information:

Manage Distribution Points

Select the management task to perform:

  • Copy the package data to new distribution points.
  • Update all distribution points with a new package source version.
  • Refresh the package on selected distribution points.
Important
Updating distribution points with a new package source version automatically applies to all distribution points defined for the package, ensuring that consistent package source files are used.

  • Remove the package from selected distribution points.

Distribution Points

Select the distribution points that you want to add, update, refresh, or remove. If you are copying the package data to new distribution points, the list contains only the distribution points in the site that do not currently support the package. If you are refreshing or removing package data on distribution points, the list contains only the distribution points that currently support the package.

To select a group of distribution points to add, update, or remove, click Select Group (which opens the Browse Distribution Point Group dialog box).


Operating System Deployment - Update Distribution Points

Select this option to update all Configuration Manager 2007 sites and distribution points that the selected operating system image has been distributed to with the latest version of the image. You will be prompted to confirm this action.

See Also

Reference

Operating System Deployment - Manage Distribution Points


Task Sequence Properties

The Task Sequence Properties page displays the following two tabs:

Task Sequence Properties - General Tab

Task Sequence Properties - Advanced Tab

Properties - Security Tab


Task Sequence Properties - General Tab

Use the General tab in the Configuration Manager 2007 Task Sequence Properties dialog box to specify the task sequence name, description, whether the task sequence is assigned to a category, and what text is displayed in the progress notification dialog box when the task sequence runs.

The General tab contains the following elements:

Name

The name of this task sequence.

Comment

An optional user-defined description of the package.

Category

An optional category to use to group task sequences. You can enter a new category and click Apply or select an existing category from the Category drop-down list. When advertising many task sequences to computers, the category helps you find specific task sequences of interest. Categories can also be used to distinguish among other programs in Add or Remove Programs that have been advertised by Configuration Manager 2007 and those advertised using group policies.

Use default text

Specifies that the default text string is used in the progress notification dialog box while the task sequence is running. For example, if the task sequence name is Task Sequence 1 then the text string would be Running: Task Sequence 1. This is the default setting.

Use custom text

Specifies that a custom text string is used in the progress notification dialog box while the task sequence is running. Enter the custom text string in the text box. There is a maximum of 50 characters.

See Also

Reference

Task Sequence Properties - Advanced Tab

Concepts

About Task Sequences


Task Sequence Properties - Advanced Tab

Use this tab to apply additional program settings such as program dependencies.

You can configure the following settings:

Run another program first

Select this check box when this task sequence requires another program (in another package) to run before it. By default, this check box is cleared. The program that you specify to run first does not need to be advertised separately.

Package

When you select Run another program first, enter or browse for the package that contains the program that must run before this task sequence.

Program

When you select Run another program first, select the program that must run before this task sequence from the Program drop-down list.

  • If the selected program fails to run on a client, the task sequence will not be run.
  • If the selected program runs successfully, it will not be run again, even if the task sequence is rerun on the same client.
Disable this task sequence on computers where it is advertised

If this check box option is selected, all advertisements that contain this task sequence are temporarily disabled. The task sequence is removed from the list of advertisements available to run and will not run until it has been re-enabled. By default, this check box is cleared.

Maximum run time

A whole number, greater than zero, that represents the time (in minutes) required to run the task sequence on the destination computer.

Use Boot Image

Enable this option to use the specified boot image when running the task sequence.

Change the boot image by clicking Browse to locate and select another boot image. Deselect this option to disable use of the specified boot image when running the specified task sequence.

This task sequence can run on any platform

If this option is selected, Configuration Manager 2007 does not check the platform type of the destination computer when advertising the task sequence. This option is selected by default.

This task sequence can only run on the specified client platforms

This option specifies the processors, operating systems, and service packs on which this task sequence can run. When this option is selected, at least one platform must also be selected from the list displayed. By default, no platforms are selected. Configuration Manager 2007 uses this information when evaluating which destination computers in a collection receive the advertised task sequence.

When a task sequence is run from boot media or by PXE boot, this option is ignored and the task sequence runs as though the option This program can run on any platform is selected.

See Also

Reference

Task Sequence Properties - General Tab


Advertised Task Sequence Properties

The Configuration Manager 2007 properties for an advertised task sequences displays information about the advertised task sequence.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Advertised Task Sequence Properties - General Tab

Specifies general information about the advertised task sequence.

Advertised Task Sequence Properties - Schedule Tab

Specifies when the program will be advertised to members of the target collection.

Advertised Task Sequence Properties - Distribution Points Tab

Specifies how Configuration Manager 2007 clients will interact with the distribution points to obtain content reference by the task sequence.

Advertised Task Sequence Properties - Interaction Tab

Specifies how users are notified and will interact with the advertised program.

Properties - Security Tab

Specifies the default Configuration Manager 2007 class and instance security rights on this object.


Advertised Task Sequence Properties - General Tab

Use the General tab to specify information required for this advertised task sequence.

The General tab contains the following settings:

UI Element List

Name

Specifies the name of this task sequence.

Comment

Specifies an optional user-defined comment for the task sequence.

Task Sequence

Specifies the task sequence that should be associated with this task sequence. Click Browse to open the Select a Package dialog box, select the task sequence, and then click OK.

Collection

Specifies the collection that should receive this advertisement. Click Browse to open the Browse Collection dialog box, and then specify the target collection for this advertisement.

Include members of subcollections

Select this check box to advertise this task sequence to subcollections of the collection specified. This check box is checked by default.

Make this task sequence available to boot media and PXE

Select this check box to make this task sequence advertisement available to PXE and boot media. This option must be selected for PXE and boot media initiated operating system deployments.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Advertised Task Sequence Properties


Advertised Task Sequence Properties - Schedule Tab

Use the Schedule tab to specify when the task sequence will be advertised to members of the target collection. You can also make the advertisement mandatory, which will allow the task sequence to run without user intervention.

The Schedule tab contains the following settings:

UI Element List

Advertisement start time

Specifies the time that the task sequence advertisement will be advertised.

Advertisement expires

Configures the time that the task sequence advertisement will no longer be available to target computers.

Mandatory assignments

Click the New button to launch the Assignment Schedule dialog box. To configure a schedule, click the Schedule button, and then specify the schedule in the Custom Schedule dialog box. To advertise the task sequence immediately, select Assign immediately after this event. Click OK to close the Assignment Schedule dialog box. Mandatory assignments do not require user intervention and will be run as scheduled..

Enable Wake On LAN

Enables Wake On LAN for this mandatory advertisement. For more information about using Wake On LAN, see Wake On LAN in Configuration Manager

Ignore maintenance windows when running program

Configures the task sequence advertisement to ignore any configured maintenance windows when running this advertisement. For more information about Configuration Manager 2007 maintenance windows, see About Maintenance Windows

Allow system restart outside of maintenance windows

Configures the task sequence to allow the target computer to restart outside of any configured maintenance windows.

Priority

Specifies the priority that will be assigned to this task sequence. You can assign a Low, Medium, or High priority.

Program rerun behavior

Specifies how the task sequence advertisement should be rerun in the vent the task sequence does not succeed. Use the drop-down list to specify the desired rerun behavior.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Advertised Task Sequence Properties


Advertised Task Sequence Properties - Distribution Points Tab

Topic Last Updated—August 2008

Use the Distribution Points tab to specify how Configuration Manager 2007 clients will interact with distribution points to retrieve the package content reference by the advertised task sequence.

The Distribution Points tab contains the following settings:

UI Element List

Download content locally when needed by running task sequence

Specifies whether an advertised program is downloaded only as files are needed by the Configuration Manager 2007 client computer.

Download all content locally before running task sequence

Specifies whether an advertised program is completely downloaded to the client computer before Configuration Manager 2007 attempts to run the program.

Access content directly from a distribution point when needed by a running task sequence

Specifies whether an advertised program is run directly form a distribution point. This option should be selected for low bandwidth network connections.

When no local distribution point is available, use a remote distribution point

Specifies whether the Configuration Manager 2007 client will use a remote distribution point if a local distribution is not available.

When no protected distribution point is available, use an unprotected distribution point

Specifies whether Configuration Manager 2007 will permit a client to use an unprotected distribution point if content is not immediately available on its protected distribution point, or if it forces a client to use the protected local distribution point if it is within the boundaries for that point.

If this check box is selected, a client will use distribution points based on the following criteria:

  1. If a protected distribution point with the content provisioned is detected, the client will use a protected distribution point.
  2. If a protected distribution point is detected but the content does not appear to be present (such as with network problems), the client will continue to check the protected distribution point for eight hours and then use an unprotected distribution point.
  3. If no protected distribution with the content is detected, the client will use an unprotected distribution point.
If the check box is cleared, the client will only use an unprotected distribution point if the content has not been sent to any protected distribution point.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Advertised Task Sequence Properties


Advertised Task Sequence Properties - Interaction Tab

Use the Interaction tab to specify how Configuration Manager 2007 clients will be notified and interact with the advertised task sequence.

The Interaction tab contains the following settings:

UI Element List

Allow users to run programs independently of assignments

Specifies if users will be able to run programs independently from the assignments. If you have specified that the advertisement is a mandatory assignment users will not be given the option to run the advertisement.

Display remainders according to the client agent reminder

Specifies if the user reminder will adhere to the client agent reminder settings. This option is available only if you have selected Allow users to run programs independently of assignments.

Use custom countdown notification length (minutes)

Specifies how long the custom countdown that is displayed to users will last in minutes.

Show task sequence progress

Specifies if the task sequence progress user interface will be visible to users.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Advertised Task Sequence Properties


Operating System Deployment: Task Sequence Editor

Use the Task Sequence Editor to modify new or existing task sequences. Task sequence can be organized into groups of task sequence steps. If either Install an existing image package or Build a reference operating system image package was selected when the New Task Sequence Wizard was run, the task sequence will contain a set of baseline task sequence groups and steps. If Create a new custom task sequence was selected when the New Task Sequence Wizard was run, then an empty task sequence is created.

The Task Sequence Editor displays the task sequence groups and steps in the tree view on the left side of the editor window. When you select a task sequence group or step, its properties are displayed next to the tree view with two or more tabs that you can select to configure settings for that task sequence group or step. Task sequence groups and steps can be nested within other task sequence groups.

Add

Click Add to add one of the following items to the task sequence list. The item will be added after the task sequence group or step you have highlighted in the task sequence list box.

  • New Group: Adds a new group of task sequence steps to the task sequence list box.
  • General Steps: Expands to display a list of basic task sequence steps that you can add to the task sequence list. General steps can be used in any task sequence regardless of whether the task sequence is deploying an operating system.
  • Deployment Steps: Expands to display a list of task sequence steps that are specific to the deployment of an operating system image package.
  • Build Steps: Expands to display a list of task sequence steps that are specific to the creation of a reference computer and the capture of its image.
Remove

Select a task sequence group or step in the task sequence list box and click Remove to delete it from the task sequence list box. If you remove a group, all task sequence steps in that group are also removed.

Move Up

Select a task sequence step or group in the task sequence list box and use the Move Up arrow to change its position in the list. The position of a task sequence in the list determines when that task sequence is run on a destination computer.

Note
When you move a task sequence step, be aware that you can move it into and out of groups in the task sequence using this button. Moving a task sequence step into and out of groups can affect the way the task sequence step and the task sequence itself runs. For example, if you move a stand-alone task sequence step that immediately follows a task sequence group up one click, it will not appear to have moved, but will be indented in the task sequence tree view. The indentation indicates that the task sequence step is now part of the task sequence group and is no longer stand-alone. Use the tree view to note the position of the task sequence step in the task sequence as you move it.

Move Down

Select a task sequence step or group in the task sequence list box and use the Move Down arrow to change its position in the list. The position of a task sequence in the list determines when that task sequence is run on a destination computer.

Note
When you move a task sequence step, be aware that you can move it into and out of groups in the task sequence using this button. Moving a task sequence step into and out of groups can affect the way the task sequence step and the task sequence itself runs. For example, if you move the last task sequence step in a group down one click, it will not appear to have moved, but will no longer be indented as part of the group. Use the tree view to note the position of the task sequence step in the task sequence as you move it.

General Steps

The following general task sequence steps can be added to the task sequence list box:

Step | Reference
Run Command Line | Run Command Line
Install Software | Install Software
Install Software Update | Install Software Updates
Join Domain or Workgroup | Join Domain or Workgroup
Connect to Network Folder | Connect to Network Folder
Reboot to Windows PE or hard disk | Restart Computer
Set Task Sequence Variable | Set Task Sequence Variable

Disk Steps

The following deployment-related task sequence steps can be added to the task sequence list box:

Step | Reference
Format and Partition Disk | Format and Partition Disk
Convert Disk to Dynamic | Convert Disk to Dynamic
Enable BitLocker | Enable BitLocker
Disable BitLocker | Disable BitLocker

User State Steps

The following user state related task sequence steps can be added to the task sequence list box:

Step | Reference
Request State Store | Request State Store
Release State Store | Release State Store
Capture User State | Capture User State
Restore User State | Restore User State

Images Steps

The following image related task sequence steps can be added to the task sequence list box:

Step | Reference
Apply Operating System | Apply Operating System
Apply Data Image | Apply Data Image
Install Deployment Tools | Install Deployment Tools
Prepare ConfigMgr Client for Capture | Prepare ConfigMgr Client for Capture
Prepare Windows for Capture | Prepare Windows for Capture
Capture Operating System Image | Capture Operating System Image

Driver Steps

The following driver related task sequence steps can be added to the task sequence list box:

Step | Reference
Auto Apply Drivers | Auto Apply Drivers
Apply Driver Package | Apply Driver Package

Settings Steps

The following settings related task sequence steps can be added to the task sequence list box:

Step | Reference
Capture Network Settings | Capture Network Settings
Capture Windows Settings | Capture Windows Settings
Apply Network Settings | Apply Network Settings
Apply Windows Settings | Apply Windows Settings


Task Sequence Options Tab

Use the Options tab to configure specific settings for task sequence steps and groups, and to configure conditions that Configuration Manager 2007 must evaluate before running the task sequence step or group. You can enter options individually, or group them using the If Statement.

The following settings can be configured for the task sequence step:

Disable this step

When this option is enabled, Configuration Manager 2007 will not run this task sequence step or group. Disabling a group disables all task sequence steps or groups in that group. Use this option to temporarily comment out this step or group without having to remove it and recreate it.

Continue on error

A user-defined option that determines how the task sequence processes task sequence steps and groups that do not complete successfully.

For a Task Sequence Step:

  • When a task sequence step completes successfully, the next sequential step in the task sequence is processed
  • When a task sequence step fails, and Continue on error is enabled, the error is ignored and the step is considered to have run successfully. The next sequential step in the task sequence is then processed.
  • When a task sequence step fails, and Continue on error is not enabled, all the remaining task sequence steps or sub-groups in the containing group are skipped, and the containing group is considered to have failed. Further processing of the task sequence is determined by the setting of the Continue on error option for the containing group. If there is no containing group, then the task sequence terminates with an error.
For a Task Sequence Group:

A group completes successfully if the last step or sub-group in the group completes successfully or has Continue on error enabled. In this case, the task sequence continues processing with the next sequential step in the task sequence.

When a group fails (because a task sequence step or sub-group contained in the group fails), and Continue on error is enabled for the group, the task sequence continues processing with the next sequential step in the task sequence.

When a group fails, and Continue or error is not enabled for the group, all remaining task sequence steps or sub-groups contained in the group are skipped, and the containing group is reported to have failed. Further processing of the task sequence is determined by the setting of the Continue on error option for the containing group. If there is no containing group, then the task sequence terminates with an error.

Example 1: Continue on error is enabled for a task sequence step.

If the task sequence step returns an error, Configuration Manager 2007 will continue processing the remaining task sequence steps whether the task sequence step is contained in a group, or is stand-alone in the task sequence.

Example 2: Continue on error is not enabled for a task sequence step, and the task sequence step is a stand-alone step.

If the task sequence step returns an error, Configuration Manager 2007 will stop processing the task sequence altogether.

Example 3: Continue on error not enabled for a task sequence step, and the task sequence step is contained in a group.

  • If Continue on error is enabled for the group, and a task sequence step contained in the group returns an error, the remaining task sequence steps within the group are skipped. Configuration Manager 2007 will continue processing the task sequence with the next task sequence step or group after the affected group.
  • If Continue on error is not enabled for a top-level group, and a task sequence step contained in the group returns an error, then Configuration Manager 2007 will stop processing the task sequence altogether. If he group is contained within another group, the next task sequence step or group following the group that fails will be processed.
Add condition

Click Add Condition to add one or more optional conditional statements to the task sequence step for Configuration Manager 2007 to evaluate before running the step. If the conditional statement evaluates to true, the task sequence step runs. If the conditional statement evaluates to false, the task sequence step does not run.

When a conditional statement is added for a task sequence group, conditional statement evaluates to true, the task sequence steps in the group are processed. If the conditional statement evaluates to false, all task sequence steps in the group and its subgroups are ignored.

Use the If statement to combine two or more conditions. There are seven conditions that can be used with a task sequence step:

  • Task Sequence Variable
  • Operating System Version
  • File Properties
  • Folder Properties
  • Registry Setting
  • Query WMI
  • Installed Software
Example:

When you create task sequences using the New Task Sequence Wizard, Operating System Deployment often configures groups with specific default conditions. For example, when you use the New Task Sequence Wizard to create an Install Image Task Sequence, the first group that is created is called Prepare and Capture Settings. The default condition for this setting is:

This group/step will run if the following conditions are met: Task Sequence Variable SMSTSInWinPE equals "false"

Continue of error is not enabled. Therefore, if the destination computer is not running Windows PE, the task sequence steps and groups contained in this group are ignored, and processing continues with the next task sequence or group.

Remove

This option deletes the selected condition from the list of conditions. This option is enabled when at least one condition is added to the condition list. If the selected condition is an If Statement, clicking Remove will delete the If Statement and all of its sub-conditions.

Remove all

This option deletes all conditions from the list of conditions. This option is enabled when at least one condition is added to the condition list.

See Also

Reference

Task Sequence Options - If Statement
Task Sequence Options - Task Sequence Variable
Task Sequence Options - Operating System Version
Task Sequence Options - File Properties
Task Sequence Options - Registry Setting
Task Sequence Options - Query WMI
Task Sequence Options - Installed Software
Task Sequence Options - Folder Properties


Task Sequence Options - If Statement

Use an If Statement to group conditions together when evaluating them for a task sequence step. When an If Statement is selected and you click Add Condition, the new condition is contained within the If Statement and evaluated depending on the If Statement evaluation option you choose.

The following evaluation options can be selected when you add an If Statement:

All conditions

Select this option if all conditions contained in the If Statement must evaluate to True for the If Statement to evaluate to true. This option is equivalent to a Boolean AND.

Any condition

Select this option if any conditions contained in the If Statement must evaluate to True for the If Statement to evaluate to true. This option is equivalent to a Boolean OR.

None

Select this option if none of the conditions contained in the If Statement can evaluate to True for the If Statement to evaluate to true. This option is equivalent to a Boolean NOT AND.

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Options - Task Sequence Variable

Use the task sequence variable condition to check for the existence of a task sequence variable or to compare the value of that variable. The value of the variable must match the value entered in the task sequence variable condition for the condition to evaluate as true.

The following settings can be configured for the task sequence variable condition:

Variable

The name of the task sequence variable. This is a required field.

Condition

The operator that Configuration Manager 2007 will use when evaluating the value of the variable. The default condition is equals. There are eight operators:

  • Exists
  • Not Exists
  • Equals
  • Not equals
  • Greater than
  • Greater than or equals
  • Less than
  • Less than or equals
    Note
    The condition exists is used to evaluate whether the named task sequence variable is a valid variable.

Value

The value that the variable must match to evaluate as a success. This is a required field unless exists is selected as a condition. If you select exists as a condition, this field is disabled.

Note
This option uses a case-sensitive string comparison unless both the value of the variable and the comparison value are integers, in which case a numeric comparison is performed

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Options - Operating System Version

Use this task sequence condition to evaluate whether the target computer is running a specified processor architecture, operating system, and version.

Select one or more operating system platforms from the list. Each platform option represents a processor architecture, operating system and version, for example: "x86 Windows Server 2003 SP1". Operating system platforms can also represent a version range, such as "All x86 Windows XP" which corresponds to any version of the Windows XP operating system for computers with the x86 chip architecture.

For example, if you select All x86 Vista and you also select x86 Windows XP Professional SP2, Configuration Manager 2007 will evaluate whether the target computer is running Windows Vista with an x86 architecture, including the original release or any service pack release, or if the target computer is running Windows XP Professional Service Pack 2 with an x86 architecture.

Name | Description
OK | Saves the operating system version selection.
Cancel | Closes the dialog box without saving any changes.

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Options - File Properties

Use this task sequence condition to verify that a specific file exists on a destination computer. The following settings can be configured for this condition:

Path

The local path on the destination computer for the file that is being verified. This field is required for this condition. The path can contain embedded task sequence and system environment variables. For example: %windir%\notepad.exe

You can use the browse button to browse the local computer for the path, but ensure that the path you enter matches the path on the destination computer. For example, if the computer you are accessing this property page is running a different Windows operating system than the destination computer, then the path you browse for and enter might not be valid on the destination computer.

Check the version

Enable this option to evaluate the destination computer for a specific version of a file. When this option is enabled, you can select one of the following six conditions to evaluate:

  • Equals
  • Not equals
  • Greater than
  • Greater than or equals
  • Less than
  • Less than or equals
Check the timestamp

Enable this option to evaluate the destination computer for a specific timestamp on a file. The timestamp that is displayed in the Configuration Manager console is the local time on the computer running the Configuration Manager console. The timestamp is converted to UTC, and the comparison on the destination computer will be done using the UTC timestamp so that the comparison is not affected by time zones and daylight savings time.

When this option is enabled, you can select one of the following six conditions to evaluate:

  • Equals
  • Not equals
  • Greater than
  • Greater than or equals
  • Less than
  • Less than or equals

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Options - Registry Setting

Use this task sequence condition to verify that the specified Windows registry key exists and/or has the specified values on a destination computer.

The following settings can be configured for this condition:

Root Key

One of the following four root key values provided in the drop-down list:

  • HKEY_CURRENT_USER
  • HKEY_LOCAL_MACHINE
  • HKEY_USERS
  • HKEY_CURRENT_CONFIG
This is a required field.

Key

The specific registry key that should be evaluated on a destination computer. This is a required field.

For example: Software\Microsoft\Outlook Express

Condition

The operator that Configuration Manager 2007 will use when evaluating the value of the value type. The default condition is equals. There are eight operators:

  • Exists
  • Not exist
  • Equals
  • Not equals
  • Greater than
  • Greater than or equals
  • Less than
  • Less than or equals
Note
The condition exists is used to evaluate whether the value name is valid on the destination computer. When this operator is selected, the Value type and Value fields are disabled.

This is a required field.

Value Type

One of the following three value types of the Value name for the specified registry key that should be evaluated on a destination computer:

  • Reg_SZ
  • Reg_Expand_SZ
  • Reg_DWord
If you select exists as a condition, this field is disabled. For value types Reg_SZ and Reg_Expand_SZ, this option uses a case-sensitive string comparison. For value type Reg_DWord, this option uses a numeric comparison.

This setting is optional.

Value Name

The value name for the specified registry key that should be evaluated on a destination computer.

For example: HTTP Mail Enabled

This setting is optional.

Value

The value of the value name for the specified registry key that should be evaluated on a destination computer.

For example: 1

If you select exists as a condition, this field is disabled. This setting is optional.

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Options - Query WMI

Use this task sequence condition to run a WMI query on the destination computer. This condition is evaluated as true if the WMI query returns at least one record.

The following settings can be configured for this condition:

WMI Namespace

A valid WMI namespace on the destination computer to run the query against.

For example:

root\cimv2

WQL Query

The WQL query that Configuration Manager 2007 will run in the specified WMI namespace on the destination computer.

For example:

WMI Query Select * FROM Win32_OperatingSystem WHERE Caption="Microsoft Windows XP Professional" AND CSDVersion="Service Pack 2”

Test Query

If you select this option, the WQL query is evaluated on the local computer running the Configuration Manager Admin Console under the logged in user's credentials.

Important
Running this option does not guarantee that the WQL query will run successfully or return the same set of results on every computer that it is run. The environment on each destination computer might be different than the computer you are testing on. This option checks for syntax errors. It is recommended that you use this option to evaluate WMI syntax and indicate the number of results that might be returned.

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Options - Installed Software

Use this task sequence condition to evaluate whether the specified software is installed on the destination computer. You can only evaluate software that was installed using a Windows Installer file (.MSI).

The following settings can be configured for this condition:

MSI file

The local path and file name for the Windows Installer file (.MSI) that will be evaluated. When a valid Windows Installer file is entered, the following information about the Windows Installer file is automatically displayed:

  • Name
  • Version
  • Product Code
  • Upgrade code
If the Windows Installer file does not provide the information, a question mark is displayed in the field.

Match this specific product (Product Code and Upgrade Code)

Select this option for Configuration Manager 2007 to evaluate for a specific software version associated with the Windows Installer file (.MSI) that exists on the destination computer.

Match any version of this product (Upgrade Code only)

Select this option for Configuration Manager 2007 to evaluate if any version of the software associated with the Windows Installer file exists on the destination computer.

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Options - Folder Properties

Use this task sequence condition to verify that a specific folder exists on a destination computer. The following settings can be configured for this condition:

Path

The local path on the destination computer for the folder that is being verified. This field is required for this condition.

You can use the browse button to browse the local computer for the path, but ensure that the path you enter matches the path on the destination computer. For example, if the computer you are accessing this property page is running a different Windows operating system than the destination computer, then the path you browse for and enter might not be valid on the destination computer.

Check the timestamp

Enable this option to evaluate the destination computer for a specific timestamp on a file. When this option is enabled, you can select one of the following six conditions to evaluate:

  • Equals
  • Not equals
  • Greater than
  • Greater than or equals
  • Less than
  • Less than or equals

See Also

Reference

Operating System Deployment: Task Sequence Editor


Task Sequence Editor - General Steps

General task sequence steps can be added to any task sequence.

In This Section

The following general task sequence steps can be added to the task sequence list box:

Step | Reference
Run Command Line | Run Command Line
Install Software | Install Software
Install Software Update | Install Software Updates
Join Domain or Workgroup | Join Domain or Workgroup
Connect to Network Folder | Connect to Network Folder
Reboot to Windows PE or hard disk | Restart Computer
Set Task Sequence Variable | Set Task Sequence Variable


Run Command Line

Use this task sequence step to run any command-line action. You can configure the following settings on the Properties tab.

Name

Specifies a short user-defined name that describes the command that is run.

Description

Specifies more detailed information about the command that is run.

Command line

Specifies the command line for the program. This field is required. File name extensions are strongly recommended—for example, .vbs and .exe. Include all required settings files, command-line options, or switches.

If the file name does not have a file name extension specified, Configuration Manager 2007 tries .com, .exe, and .bat. If the file name has an extension that is not an executable, Configuration Manager 2007 tries to apply a local association. For example, if the command line is readme.gif, Configuration Manager 2007 starts the application specified on the target computer for opening .gif files.

Examples:

setup.exe /a

cmd.exe /c copy Jan98.dat c:\sales\Jan98.dat

Note
Command-line actions, such as output redirection, piping, or copy—as in the preceding example—must be preceded by the cmd.exe /c command to run successfully.

Start in

Specifies the executable folder for the program, up to 127 characters. This folder can be an absolute path on the target computer or a path relative to the distribution point folder that contains the package. This field is optional.

Examples:

c:\officexp

i386

Note
The Browse button browses the local computer for files and folders, so anything you select this way must also exist on the target computer in the same location and with the same file and folder names.

Package

When you specify files or programs on the command line that are not already present on the target computer, select this option to specify the Configuration Manager 2007 package that contains the appropriate files. The package does not require a program. This option is not required if the specified files exist on the target computer.

Timeout

Specifies a value that represents how long Configuration Manager 2007 will allow the command line to run. This value can be from 10 minutes to 999 minutes. The default value is 15 minutes.

This option is disabled by default.

Important
If you enter a value that does not allow enough time for the Run Command Line task sequence step to complete successfully, the task sequence step will fail and the entire task sequence could fail depending on other control settings. If the time-out expires, Configuration Manager 2007 will terminate the command-line process.

Specify the account credentials to use when running this step

Specifies that the command line should be run as a Windows user account other than the local system account.

Applies only to Configuration Manager 2007 R2.

Account

Specifies the Run As Windows user account for the command-line task in the task sequence to be run by this action. The command line will be run with the permissions of the specified account. Click Set to specify the local user or domain account.

Applies only to Configuration Manager 2007 R2.

Important
If a Run Command Line task sequence action specifying a user account is executed while in Windows PE, the action will fail because Windows PE cannot be joined to a domain. The failure will be recorded in the smsts.log file.

Options Tab

On the Options tab for this task sequence step, an additional option is available: Success Codes.

A success code is a user-defined number that this task sequence step will return when it runs successfully. This field can contain integers separated by any combination of a comma, space, or tab. This field is enabled only for the Run Command Line task sequence step.

When a task sequence step runs a command line, it returns a result code upon completion. The result code is then compared against a list of success codes to determine whether the command line and the task sequence step completed successfully.

Note
You will not be able to specify a Run Command Line action that is expecting success codes of "-1 -2". Only the first success code can be a negative number; all other success codes must be a positive number.

Valid success codes:

-1 2 3 4

Nonvalid success codes:

-1 -2 3 4

1 -2 3 4

See Also

Reference

Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab

Concepts

About Creating the Operating System Deployment Packages

Other Resources

Task Sequence Editor - General Steps


Install Software

Use this task sequence step to specify a Configuration Manager 2007 package and program to install as part of the task sequence.

You can configure the following settings:

Name

Specifies a short user-defined name that describes the action taken in this step.

Description

Allows you to enter more detailed information about the action taken in this step.

Install a single application

Configures the task sequence step to install one application. To specify the Configuration Manager 2007 package that should be installed, click Browse. Use the drop-down list to select the program that should be associated with the specified package.

The program you select must meet the following criteria:

  • It must run under the local system account and not the user account.
  • It should not interact with the desktop. The program must run silently or in an unattended mode.
  • It must not initiate a reboot on its own. The program must request a reboot using a 3010 return code. This ensures that the task sequence step will properly handle the reboot.
    Important
    Configuration Manager 2007 software programs that use the Run another program first option to install a dependent program as part of the package are not supported by Operating System Deployment. If Run another program first is enabled for a program and the other program has already been run on the target computer, the specified package or program will be run. However, if the other program has not already been run on the target computer, the task sequence step will fail.

Configuration Manager 2007 will filter out any disabled programs or any programs with the following settings and the programs will not be available:

  • Only when a user is logged on
  • Run with user rights
Install multiple applications

Select this option to Configures the task sequence step to install multiple applications in sequence. This step specifies the base variable name for a series of task sequence variables that each contain a <packageID, program name> pair separated by a colon. For example:

To install a single application using a task sequence variable called AA001, you specify the following:

Task Sequence variable: AA001

Value: Package ID:Program name

To install multiple applications using a task sequence variable called AA002 you specify the following:

Task Sequence variable: AA002

Value: Package ID:Program name

Task Sequence variable: AA003

Value: Package ID:Program name

The series of variable names is formed by appending a numeric suffix between 001 and 999 to the administrator-defined base name. The variable names and associated values form a dynamic package list that can be scripted. The list of packages ends when no variable name exists with the next sequential numeric suffix. The associated packages will be installed in the order specified in the list. Each package installation will be completed before the installation for the next package begins. When you specify the Package ID always specify the Package ID using upper case.

If the value of a variable is not created in the correct format and does not specify a valid package ID and program name, the installation of the package will fail. If no variables with the specified base name and "001" suffix are found, no packages are installed and the action succeeds.

The program you select must meet the following criteria:

  • It must run under the local system account and not the user account.
  • It should not interact with the desktop. The program must run silently or in an unattended mode.
  • It must not initiate a reboot on its own. The program must request a reboot using a 3010 return code. This ensures that the task sequence step will properly handle the reboot.
    Important
    The program specified must have the Allow this program to be installed from a list of software packages in the “Install Software” task sequence step without being advertised option selected or the installation will fail. This option can be selected when adding a program to an existing package in the New Program Wizard. Alternatively, you can specify this option by right-clicking an existing program, selecting clicking Properties, and then clicking the Advanced tab.

See Also

Reference

Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab


Install Software Updates

Use this task sequence step to install software updates a target computer. The target computer is not evaluated for applicable software updates until this task sequence step runs. At that point, the target computer is evaluated for software updates as any other Configuration Manager 2007-managed client.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Mandatory software updates

Select this option to install all software updates flagged in Configuration Manager 2007 as mandatory for the target computers that will receive the task sequence. Mandatory software updates have administrator defined deadlines within a specified period of time. When a deadline is reached for a mandatory software update deployment, installation is initiated on clients for the updates defined in the deployment.

All software updates

Select this option to install all available software updates targeted for the Configuration Manager 2007 collection that will receive the task sequence. All available software updates will be installed on the target computers.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor

Concepts

Software Updates Home Page


Join Domain or Workgroup

Use this task sequence step to specify information needed to have the target computer join a workgroup or domain.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Join a workgroup

Select this option to have the target computer join the specified workgroup.

Join a domain

Select this option to have the target computer join the specified domain.

Optionally, enter or browse for an Organizational unit in the specified domain for the computer to join.

Enter the account which has permission to join the domain

Click Set to enter an account and password that has permissions to join the domain. The account must be entered in the following format:

Domain\account

Important
You must enter the appropriate domain credentials if you plan to migrate either the domain settings or the workgroup settings.

For more information, see About the Task Sequence Editor Domain Joining Account.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor


Connect to Network Folder

Use this task sequence step to create a connection to a shared network folder.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

For example: Connect to network folder \\server\share.

Description

More detailed information about the action taken in this step. This field is optional.

Path

The location of the network folder in the form: \\servername\sharename. Click Browse to browse for the UNC path of the network folder.

Note
When you click Browse, you are browsing from the computer running the Configuration Manager console. It is possible that computer might not have access to the network folder even though the target computer does when using the Account you specify. Consequently, you might need to manually enter the UNC path to the network folder rather than browsing for it.

Drive

The drive letter to assign to the network connection. This field is optional. If no drive letter is specified, then the network share you specify is not mapped to a local drive letter. If you specify a drive letter that is already mapped to a different resource on the target computer, then the task sequence step will fail.

Account

The Windows account that the target computer will use that has permissions to access the specified network folder. Click Set to enter the User name in the format domain\user, and to enter and confirm the appropriate Password for the account to use.

For more information, see About the Task Sequence Editor Network Folder Connection Account.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor


Restart Computer

Use this task sequence step to specify restart options for the target computer that will receive this task sequence.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

The boot image assigned to this task sequence

Select this option for the target computer to use the boot image that is contained on the media. The boot image will be used to initiate communication with the management point.

The currently installed default operating system

Select this option for the target computer to reboot into the installed operating system.

Notify the user before restarting

Select this option to display a notification to the user that the computer will be restarted. This option is selected by default.

Notification message

Enter a notification message that will be displayed to the user before the computer is restarted.

Message display time-out

Specify the amount of time in seconds that a user will be given before the computer is restarted. The default amount of time is sixty (60) seconds.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor


Set Task Sequence Variable

Use this task sequence step to set the value of a task sequence variable to be used with the task sequence.

You can configure the following settings:

Name

A short user-defined name for this task sequence step that describes the task sequence variable.

For example:

Define task sequence variable test.

Description

More detailed information about the task sequence variable and its use.

Task sequence variable

A user-defined name for the task sequence variable.

Value

The value that is associated with the task sequence variable.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor


Task Sequence Editor - Disks Steps

Disk task sequence steps can be added to any task sequence.

In This Section

The following disk task sequence steps can be added to the task sequence list box:

Step | Reference
Format and Partition Disk | Format and Partition Disk
Convert Disk to Dynamic | Convert Disk to Dynamic
Enable BitLocker | Enable BitLocker
Disable BitLocker | Disable BitLocker


Format and Partition Disk

Use this task sequence step to format and partition a specified disk on a target computer.

Important
Every setting you specify for this task sequence step applies to a single specified disk. If you want to format and partition another disk on the target computer, you must add an additional Format and Partition task sequence step to the task sequence.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Disk Number

The physical disk number of the disk that will be formatted.

Disk Type

The type of disk that will be formatted. There are two options to select from the drop-down list:

  • Standard(MBR)
  • GPT
Note
If you change the disk type from Standard (MBR) to GPT, and the partition layout contains an extended partition, all extended and logical partitions will be removed from the layout. You will be prompted to confirm this action before changing the disk type.

Volume

Specific information about the partition or volume that will be created, including the following:

  • Name
  • Remaining disk space
To create a new partition, click the New button to launch the Partition Properties dialog box. You can specify the partition type and size, and specify is this will be a boot partition. You can also specify the type of formatting you want to use in the Formatting Options section. The options are None, NTFS, or FAT32.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor

Concepts

Operating System Deployment: Partition Properties


Convert Disk to Dynamic

Use this task sequence step to convert a physical disk from a basic disk type to a dynamic disk type.

Important
You cannot use this task sequence step with the Microsoft Windows 2000 operating system.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Disk Number

The physical disk number of the disk that will be converted.

See Also

Other Resources

Task Sequence Editor - Disks Steps


Enable BitLocker

Topic Last Updated—August 2008

BitLocker drive encryption provides low-level encryption of the contents of a disk volume. BitLocker requires at least two partitions on the hard drive. The first active partition contains the Windows bootstrap code. Another partition contains the operating system. The bootstrap partition must remain unencrypted.

Note
BitLocker is used with computers running Windows Vista and Windows Server 2008.

If you specified TPM Only or TPM and Startup Key on USB, before you can run the Enable Bitlocker task sequence step the Trusted Platform Module (TPM) must be in the following state:

  1. Enabled
  2. Activated
  3. Ownership Allowed

The task sequence step can complete any remaining TPM initialization, because the remaining steps do not require physical presence or reboots. The remaining TPM initialization steps which can be completed transparently by Enable BitLocker (if necessary) include:

  • Create endorsement key pair
  • Create owner authorization value and escrow to Active Directory, which must have been extended to support this value
  • Take ownership
  • Create the storage root key, or reset if already present but incompatible

If the hard drive is already encrypted but BitLocker is disabled then Enable BitLocker re-enables the key protector or protectors and will be completed almost instantly. Re-encryption of the hard drive is not necessary in this case. For more information about disabling BitLocker, see Disable BitLocker.

If you want the Enable BitLocker action to wait until the drive encryption process has been completed before continuing with the next step in the task sequences, select the Wait check box. BitLocker can be used to encrypt multiple drives on a computer system (both operating system and data drives). To encrypt a data drive, the operating system must already be encrypted and the encryption process must be completed, because the key protectors for the data drives are stored on the operating system drive. As a result, if you encrypt the operating system drive and the data drive in the same process, the wait option must be selected for the step that enables BitLocker for the operating system drive.

This page contains the elements described in the following table.

Name

Specifies a descriptive name for this task sequence step.

Description

Allows you to optionally enter a description for this task sequence step.

Choose the drive to encrypt

Specifies the drive to encrypt. To encrypt the current operating system drive, select Current operating system drive and then configure the key management. To specify that the Trusted Platform Module (TPM) should be used for key management, select TPM only. To specify that the startup key should be on USB only, select Startup key on USB only. To specify the key management for both the TPM and USB select TPM and startup key on USB only. To encrypt a specific drive (a non-operating system data drive) select Specific drive.

Note
If you select USB, you must have a USB drive attached to the computer when the operating system deployment is performed. The startup key is written to the USB drive.

Chose where to create the recovery key

To specify where the recovery password should be created, select In Active Directory to escrow the password in Active Directory. If you select this option you must extend Active Directory for the site so that the associated BitLocker recovery information is saved. Select not to create a password at all by selecting Do not create recovery key, which is not recommended.

Wait for Bitlocker to complete the drive encryption process on all drives before continuing task sequence execution

Select this option to allow the BitLocker drive encryption to be completed prior to running the next step in the task sequence. If this option is selected all of the files contained on the hard drive will be encrypted before the user is able to login to the computer.

The encryption process can take hours to be completed when a large hard drive is being encrypted. Not selecting this option will allow the task sequence to proceed immediately.

See Also

Reference

Disable BitLocker


Disable BitLocker

Topic Last Updated—August 2008

BitLocker drive encryption provides low-level encryption of the contents of a disk volume. The Disable BitLocker task sequence step allows you to disable the BitLocker encryption on the current operating system drive, or on a specific drive. Disable BitLocker leaves the key protectors visible in clear text on the hard drive, but it does not decrypt the contents of the drive. Consequently this task sequence action will be completed almost instantly.

If you have multiple drives encrypted, you must disable BitLocker on any data drives before disabling BitLocker on the operating system drive.

Note
You can use BitLocker only for client computers running Windows Vista and Windows Server 2008.

This page contains the elements described in the following table.

Name | Description
Name | Specifies a short user-defined name that describes the action taken in this step.
Description | Provides more detailed information about the action taken in this step.
Current operating system drive | Disables BitLocker on the current operating system drive.
Specific drive | Disables Bitlocker on a specific drive. Use the drop-down list to specify the drive where BitLocker should be disabled.

See Also

Reference

Enable BitLocker


Task Sequence Editor - User State Steps

User state task sequence steps can be added to any task sequence.

In This Section

The following user state task sequence steps can be added to the task sequence list box:

Step | Reference
Request State Store | Request State Store
Release State Store | Release State Store
Capture User State | Capture User State
Restore User State | Restore User State


Request State Store

Use this task sequence step to request access to a state migration point when capturing state from a computer or restoring state to a computer.

This task sequence step is used in conjunction with the Release State Store, Capture User State, and Restore User State task sequence steps to migrate computer state using a state migration point and the User State Migration Tool (USMT).

Capture User State specifies migration options for USMT to use.

Restore User State specifies migration options for USMT to use when restoring user state.

Release State Store notifies the state migration point that the capture or restore task is complete.

Note
If you have just established a new state migration point site role (SMP), it can take up to one hour to be available for user state storage. To expedite the availability of the SMP you can adjust any state migration point property setting to trigger a site control file update.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Capture state from the computer

Select this option to request access and reserve disk space on a state migration point for the purpose of capturing the user state and settings from a computer.

If the Configuration Manager 2007 site has multiple state migration points enabled, this task sequence step finds a state migration point that has disk space available by querying the site's management point for a list of state migration points, and then evaluating each until it finds one with free disk space.

Restore state from another computer

Select this option to request access to a state migration point for the purpose of restoring previously captured user state and settings to a target computer.

If the Configuration Manager 2007 site has multiple state migration points, this task sequence step finds the state migration point that has the computer state that was stored for the target computer.

Number of retries

The number of times that this task sequence step will try to find an appropriate state migration point before failing.

Retry delay (in seconds)

The amount of time in seconds that the task sequence step should wait between retry attempts.

If computer account fails to connect to a state store, use the network access account.

Specifies that the Configuration Manager 2007 network access account credentials will be used to connect to the state migration point if the Configuration Manager 2007 client cannot access the SMP state store using the computer account.

See Also

Tasks

How to Configure the State Migration Point

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor
Capture User State
Restore User State
Release State Store


Release State Store

This task sequence step notifies the state migration point that the capture or restore action has been completed. This task sequence step is used in conjunction with the Request State Store, Capture User State, and Restore User State task sequence steps to migrate computer state using a state migration point and the User State Migration Tool (USMT).

Request State Store requests access to a state migration point when capturing state from a computer or restoring state to a computer

Capture User State specifies migration options for USMT to use when capturing user state.

Restore User State specifies migration options for USMT to use when restoring user state.

If you requested access to a state migration point to capture user state in the Request State Store task sequence step, this task sequence step notifies the state migration point that the capture process is complete. And that the computer state is available to be restored. The state migration point sets the access control permissions for the captured state so that it can only be accessed (as read-only) by the restoring computer.

If you requested access to a state migration point to restore user state in the Request State Store task sequence step, this task sequence notifies the state migration point that the restore process is complete. At this point, whatever retention settings you configured for the state migration point are activated.

Important
The task sequence step that runs prior to the release state store task sequence step must be successful so that the release state store task sequence step can determine if it needs to change the associated counter values.

This page contains the following elements:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

See Also

Tasks

How to Configure the State Migration Point

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor
Request State Store
Capture User State
Restore User State


Capture User State

Use this task sequence step to use the User State Migration Tool (USMT) to capture user state and settings from the computer that will receive the task sequence associated with this task step. This task sequence is used in conjunction with the Restore User State task sequence step.

This task sequence step can be used with the Request State Store and Release State Store task sequence steps if you want to save the state settings to or restore settings from a state migration point in the Configuration Manager 2007 site.

You cannot set all of the available USMT options in the Configuration Manager console

In the Configuration Manager 2007 console, you can set the following options for the User State Migration Tool (USMT):

  • Skip files using EFS
  • Continue if some files cannot be captured
  • Enable verbose logging

However, there are additional settings available in the USMT that cannot be set in the Configuration Manager 2007 console. For a list of all available settings in USMT, see the USMT documentation.

You can use a command line to set all available USMT settings.

To use command line actions for USMT in Configuration Manager

  1. In the USMT documentation, locate the switch for the setting you want.
  2. In the task sequence editor, create a Run Command Line task sequence action to run either scanstate or loadstate with the switch specified in Step 1.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

User state migration tool package

Enter the Configuration Manager 2007 package that contains the version of USMT for this task step to use when migrating the user state and settings. This package does not require a program. When the task sequence step is run, the task sequence will use the version of USMT in the package you specify.

Note
USMT versions 2.6.1 and 3.0 are supported depending on the version of Windows you are deploying.

Capture all user profiles with standard options

Select this option to migrate all user profile information. This option is selected by default.

Important
If you capture all user profiles with standard options, you must restore local computer user profiles.

In Task Sequence Editor, if you add a step for Capture User State and select Capture all user profiles with standard options, but do not select the option to Restore local computer user profiles in the in the Restore User State task sequence step, the task sequence will fail because Configuration Manager 2007 cannot migrate the new accounts without assigning them passwords. Also, if you use the New Task Sequence wizard and create a task sequence to Install an exiting image package, the resulting task sequence defaults to Capture all user profiles with standard options, but does not select the option to Restore local computer user profiles.

You should select Restore local computer user profiles and provide a password for the account to be migrated. In a manual task sequence, this setting is found under the Restore User State step. In a task sequence created by the New Task Sequence wizard, this setting is found under the step Restore User Files and Settings.

If you have no local user accounts, this does not apply.

Customize how user profiles are captured

Select this option to specify a custom profile file migration. Click Files to select the configuration files for USMT to use with this task step. You must specify a custom .xml file that contains rules that define the user state files that should be migrated.

Click here to select configuration files:

Select this option to select the configuration files you want to use for capturing user profiles. Click the Files button to launch the Configuration Files dialog box. To specify a configuration file, enter the name of the file on the Filename line and click the Add button.

Skip files using encrypted file system

Enable this option to skip capturing files that are encrypted, including profile files.

Continue if some files cannot be captured

Enable this option to continue the migration process even if some files cannot be captured. This option is enabled by default. If you disable this option, if a file cannot be captured, the task sequence step will fail. The action of any remaining task sequence steps, groups, and the task sequence itself depends on whether the Continue on Error option on the Options tab for this task sequence step, or the group it might be contained in, has been enabled. For more information about the Continue on Error option see the Task Sequence Options Tab.

Enable verbose logging

Enable this option to generate more detailed log file information. When capturing state, the log Scanstate.log is generated and stored in the Tasksequence Logdir in the \windows\system32\ccm\logs folder by default. Similarly, when restoring state, the log Loadstate.log is generated and stored in the same location.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab
Request State Store
Release State Store
Restore User State


Restore User State

Use this task sequence step to initiate the User State Migration Tool (USMT) to restore user state and settings to a target computer. This task sequence step is used in conjunction with the Capture User State task sequence step.

This task sequence step can be used with the Request State Store and Release State Store task sequence steps if you want to save the state settings to or restore settings from a state migration point in the Configuration Manager 2007 site.

Important
If you are using this task sequence step for a task unrelated to an operating system deployment scenario, you should add the Restart Computer task sequence step immediately following this task sequence step.

This page contains the elements described in the following table.

Name

Specifies a short user-defined name that describes the action taken in this step.

Description

Specifies more detailed information about the action taken in this step.

User state migration tool package

Allows you to select the User State Migration Tool package that contains the user state you want to restore, by clicking Browse . You can select the package you want from the list of available existing packages.

Restore all captured user profiles with standard options

Restores the captured user profiles with the standard options. To customize the options that will be restored, select Customize user profile capture.

Customize how user profiles restored

Allows you to customize the files that you want to restore to the target computer. You can click Files to specify the configuration files you want to use for restoring the user profiles. To add a configuration file, enter the name of the file in the Filename box, and then click Add. The configuration files that will be used for the operation are listed in the Files pane. The .xml file you specify defines which user file will be restored.

Restore local computer user profiles

Restores the local computer user profiles. You will need to assign new passwords to the restored local user accounts because the original local user account passwords cannot be migrated. Enter the new password in the Password box, and confirm the password in the Confirm Password box.

Continue if some files cannot be restored

Continues restoring user state and settings even if some files are unable to be restored. This option is enabled by default. You can disable this option if you do not want all user state files to be restored.

Enable verbose logging

Select this option to allow the task sequence status information to be logged. This option is disabled by default.

See Also

Tasks

How to Configure the State Migration Point

Reference

Capture User State
Release State Store
Request State Store
Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab


Task Sequence Editor - Images Steps

Images task sequence steps can be added to any task sequence.

In This Section

The following images task sequence steps can be added to the task sequence list box:

Step | Reference
Apply Operating System | Apply Operating System
Apply Data Image | Apply Data Image
Install Deployment Tools | Install Deployment Tools
Prepare ConfigMgr Client for Capture | Prepare ConfigMgr Client for Capture
Prepare Windows for Capture | Prepare Windows for Capture
Capture Operating System Image | Capture Operating System Image


Apply Operating System

Topic Last Updated—August 2008

Use this task sequence step to install a specified operating system image on a target computer. This step installs an operating system from an existing operating system image or operating system install package after first deleting all files on the target volume.

Note
Configuration Manager 2007-specific control files are not deleted.

This page contains the elements described in the following table.

Name Description

Name

Specifies a short user-defined name that describes the action taken in this step.

Description

Allows you to provide more detailed information about the action taken in this step.

Apply operating system from a captured image

Installs an operating system image that has already been captured. Click Browse to open the Select a package dialog box, and then select the existing image package you want to install. If multiple images are associated with the specified Image package, use the drop-down list to specify the associated image that will be used for this deployment. You can view basic information about each existing image by clicking on the image.

Apply operating system image from an original installation source

Installs an operating system using an original installation source. Click Browse to open the OS Install Packages dialog box, and then select the existing operating system installation package you want to use. You can view basic information about each existing image source by clicking on the image source. The associated image source properties are displayed in the results pane at the bottom of the dialog box. If there are multiple editions associated with the specified package, use the drop-down list to specify the associated Edition that should be used.

Use an unattended or sysprep answer file for a custom installation

Use this option to provide a Windows setup answer file (unattend.xml, unattend.txt, or sysprep.inf) depending on the operating system version and installation method. The file you specify can include any of the standard configuration options supported by Windows answer files. For example, you can use it to specify the default Internet Explorer home page. You must specify the package that contains the answer file and the associated path to the file in the package.

Note
The Windows setup answer file that you supply can contain embedded task sequence variables of the form %varname%, where varname is the name of the variable. The %varname% string will be substituted for the actual variable values in the Setup Windows and ConfigMgr task sequence action. Note however, that such embedded task sequence variables cannot be used in numeric-only fields in an unattend.xml answer file.

If you do not supply a Windows setup answer file, this task sequence action will automatically generate a default answer.

Destination

Specifies an existing formatted partition and hard disk, specific logical drive letter, or the name of a task sequence variable that contains the logical drive letter.

  • Next available partition – Use the next sequential partition that has not been previously targeted by an Apply Operating System or Apply Data Image action in this task sequence.
  • Specific disk and partition – Select the Disk number (starting with 0) and the Partition number (starting with 1).
  • Specific logical drive letter – Specify the task sequence variable containing the drive letter assigned to the partition by Windows PE. This variable would typically be set in Advanced section of the Partition Properties dialog box for the Format and Partition Disk task sequence action.
  • Logical drive letter stored in a variable – Assigned by a task sequence variable (in format of E: for example). For example, this could be set in an advanced option in the Format and Partition Disk action in the Partition Properties option.

See Also

Reference

Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab


Apply Data Image

Topic Last Updated—August 2008

Use this task sequence step to apply an existing data image to a target computer.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Image Package

Specify the Image Package that will be used by this task sequence step by clicking Browse. Select the package you want to install in the Select a Package dialog box. The associated property information for each existing image package is displayed at the bottom of the Select a Package dialog box. Use the drop-down list to select the Image you want to install from the selected Image Package.

Note
This task sequence action treats the image as a data file and does not do any of the setup necessary to boot the image as an operating system.

Destination

Specifies an existing formatted partition and hard disk, specific logical drive letter, or the name of a task sequence variable that contains the logical drive letter.

  • Next available partition – Use the next sequential partition that has not been previously targeted by an Apply Operating System or Apply Data Image action in this task sequence.
  • Specific disk and partition – Select the Disk number (starting with 0) and the Partition number (starting with 1).
  • Specific logical drive letter – Specify the Drive Letter assigned to the partition by Windows PE. Note that this drive letter can be different from the drive letter that the newly deployed operating system will assign.
  • Logical drive letter stored in a variable – Specify the task sequence variable containing the drive letter assigned to the partition by Windows PE. This variable would typically be set in Advanced section of the Partition Properties dialog box for the Format and Partition Disk task sequence action.
Delete all content on the partition before applying the image

Specifies that all files on the target partition will be deleted before the image is installed. By not deleting the content of the partition, this step can be used to apply additional content to a previously targeted partition.

See Also

Reference

Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab


Setup Windows and ConfigMgr

Use the Setup Windows and ConfigMgr task sequence step to specify the additional installation properties that should be used when installing the Configuration Manager 2007 client.

You can configure the following settings:

UI Element List

Name

Specifies a short user-defined name that describes the action taken in this step.

Description

Specifies additional information about the action taken in this step.

Package

Specifies the Configuration Manager 2007 client installation package that will be used by this task sequence step. Click Browse and select the client installation package you want to use to install the Configuration Manager 2007 client. The client installation package specified should be located on the site server.

Installation Properties

Site assignment and the default configuration will be automatically specified by the task sequence action. You can use this field to specify any additional installation properties to use when installing the client. To enter multiple installation properties, separate them with a space.

If you are installing the Configuration Manager 2007 client on a computer that is a member of a workgroup you must specify a Configuration Manager 2007 server locator point. The server locator point will locate the assigned software packages and updates that will be installed on the target computer. Use the following information to specify the server locator point for a computer that is a member of a workgroup:

Modify the following registry key with the value provided:

Registry Key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM\SMSSLP

Value:

SMSSLP=<serverlocatorpointname>

For more information about Configuration Manager 2007 client installation properties see, About Configuration Manager Client Installation Properties.


Install Deployment Tools

Topic Last Updated—August 2008

Use this task sequence step to specify the Configuration Manager 2007 package that contains the appropriate version of Sysprep to use with this operating system to capture the reference computer settings. This task sequence step will copy the deployment tools, i.e., Sysprep, onto the reference computer. Click Browse to select from a list of available Configuration Manager 2007 packages.

If the operating system version you are capturing is Windows Vista or Windows Server 2008, Sysprep is already available on the computer and you should not include this task sequence step as part of the capture task sequence. For Windows XP or earlier operating system versions, you must specify a package that contains the version of Sysprep and its support files that are appropriate for that operating system version. This package does not require a program. Operating system deployment uses the Sysprep files that are contained in the package. This package will be copied into a folder named Sysprep on the root directory of the reference computer.

For more information about Sysprep packages, see About Creating the Operating System Deployment Packages.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Sysprep package

The Configuration Manager 2007 package that contains the appropriate version of Sysprep to run on the reference computer.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor

Concepts

About the Operating System Deployment Reference Computer


Prepare ConfigMgr Client for Capture

This task sequence step takes the Configuration Manager 2007 client on the reference computer and prepares it for capture as part of the imaging process.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor

Concepts

About the Operating System Deployment Reference Computer


Prepare Windows for Capture

Topic Last Updated—August 2008

Use this task sequence action to specify the Sysprep options to use when capturing Windows settings from the reference computer. This task sequence action runs Sysprep and then reboots the computer into the Windows PE boot image specified for the task sequence. The reference computer must not be domain joined for this action to be completed successfully.

Important
This task sequence action resets the local administrator password on the reference computer to blank. Any administration password policy will be cleared and the password set to blank.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Automatically build mass storage driver list

Select this option to have Sysprep automatically build a list of mass storage drivers from the reference computer. This option enables the Build Mass Storage Drivers option in the Sysprep.inf file on the reference computer. For more information about this setting, refer to the Sysprep documentation.

Do not reset activation flag

Select this option to prevent Sysprep from resetting the product activation flag. Refer to the Sysprep documentation for more information about the implications of this setting.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor

Concepts

About the Operating System Deployment Reference Computer


Capture Operating System Image

Topic Last Updated—August 2008

This task sequence action captures one or more images from a reference computer and stores them in a .WIM file on the specified network share. The Add Operating System Image Package Wizard can then be used to import this .WIM file into Configuration Manager 2007 so it can be used for image-based operating system deployments.

Each volume (drive) on the reference computer is captured as a separate image. If the referenced computer has multiple volumes, the resulting .WIM file will contain a separate image for each volume. Only volumes that are formatted as NTFS or FAT32 are captured. Volumes with other formats and USB volumes, are skipped.

The installed operating system on the reference computer must be a version of Windows that is supported by Configuration Manager 2007 and must have been prepared by using the SysPrep tool. The installed operating system volume and the boot volume must be the same volume.

You must also enter a Windows account that has write permissions to the network share you selected.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Target

The location that Configuration Manager 2007 should use when storing the captured operating system image.

Description

An optional user-defined description of the captured operating system image that is stored in the .WIM file.

Version

An optional user-defined version number to assign to the captured operating system image. This value can be any combination of letters and numbers and is stored in the .WIM file.

Created by

The optional name of the user that created the operating system image and is stored in the WIM file.

Capture operating system image account

You must enter the Windows account that has permissions to the network share you specified. Click Set to specify the name of that Windows account. For more information, see About the Capture Operating System Image Account.

See Also

Reference

Task Sequence Options Tab
Operating System Deployment: Task Sequence Editor
Operating System Images - Data Source Tab

Concepts

About the Operating System Deployment Reference Computer


Task Sequence Editor - Drivers Steps

Drivers task sequence steps can be added to any task sequence.

In This Section

The following drivers task sequence steps can be added to the task sequence list box:

Step | Reference
Auto Apply Drivers | Auto Apply Drivers
Apply Driver Package | Apply Driver Package


Auto Apply Drivers

This task sequence step allows you to match and install drivers as part of an operating system deployment. Using the Windows PE environment the Auto Apply Drivers task sequence step will automatically detect and install all applicable plug and play device drivers it can locate in the driver catalog. While this task sequence action will be able to locate most of the device drivers you will need there may be device drivers that will not be detected. The Apply Driver Package task sequence step allows the administrator to add common device drivers to a specific location for use by Windows Setup. For more information about using a driver package click the following link: Apply Driver Package

Important
The Auto Apply Drivers task sequence step cannot be used with stand-alone media because Windows Setup will have no connection to the Configuration Manager 2007 site.

Click the Options tab to add conditions to device driver installations. Conditions can be if statements or other property information that will determine under which circumstances device drivers can be installed. You can also specify whether Windows Setup should continue after an error is found by selecting the Continue on error check box.

Auto Apply Drivers contains the following elements:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Install only the best matched compatible drivers

Specifies that the task sequence step will install only the best matched driver for each hardware device detected.

Install all compatible drivers

Specifies that the task sequence step will install all compatible drivers for each hardware device detected and allow Windows setup to choose the best driver.

Consider drivers from all categories

Specifies that the task sequence action will search all available driver categories for appropriate device drivers.

Limit driver matching to only consider drivers in selected categories

Specifies that the task sequence action will search for device drivers in specified driver categories for the appropriate device drivers.

Do unattended installation of unsigned drivers on versions of Windows where this is allowed

Allows this task sequence action to install unsigned Windows device drivers.

Important
This option does not apply to operating systems where driver signing policy cannot be configured.

See Also

Tasks

How to Install Drivers on a Configuration Manager 2007 Client Using a Task Sequence


Apply Driver Package

The Apply Driver Package task sequence step allows you to make all device drivers in a driver package available for use by Windows setup. This step can be added to a task sequence between the Apply Operating System and the Setup Windows and ConfigMgr task sequence step to make the device drivers in the driver package available to Windows Setup. Typically this task sequence step is placed after the Auto Apply Drivers task sequence step. This task sequence step is also useful with stand-alone media deployment scenarios.

You should put similar device drivers into a driver package and distribute them to the appropriate distribution points so that Configuration Manager 2007 client computers can install them. For example; you can put all Dell drivers into a driver package, and then assign the package a distribution point where the associated computers can access them. This action can also be used to install boot critical mass storage device drivers for Windows 2000, Windows XP, and Windows 2003.

Note
To view the contents of a driver package, the computer running the Configuration Manager 2007 console must have at least read access to the share.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Driver package

Specify the driver package that contains the needed device drivers, and make them available for Microsoft Windows setup by clicking Browse and launching the Select a Package dialog box. Specify an existing package to be made available. The associated package properties are displayed at the bottom of the dialog box.

Select the mass storage driver within the package that needs to be installed before setup on pre-Windows Vista operating systems

Specify any mass storage device drivers that are needed for pre- Windows Vista operating system installations.

Driver

Select the mass storage device driver file to be installed before setup on pre-Windows Vista operating system deployments. The drop-down list is populated from the specified package.

Model

Specify the boot-critical device that is needed for pre-Windows Vista operating system deployments.

Allow Windows to install unsigned drivers

Select this option to allow Windows to install drivers that are unsigned on the reference computer.

See Also

Reference

Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab

Concepts

About the Operating System Deployment Reference Computer


Task Sequence Editor - Settings Steps

Settings task sequence steps can be added to any task sequence.

In This Section

The following settings task sequence steps can be added to the task sequence list box:

Step | Reference
Capture Network Settings | Capture Network Settings
Capture Windows Settings | Capture Windows Settings
Apply Network Settings | Apply Network Settings
Apply Windows Settings | Apply Windows Settings


Capture Network Settings

Use this task sequence step to capture network settings from the computer that will receive the task sequence associated with this task sequence step.

Important
The settings captured when this step runs will override the settings you configure on the Configure Network Settings task sequence step.

Name Description

Name

Specifies a short user-defined name that describes the action taken in this step.

Description

Provides more detailed information about the action taken in this step.

Migrate domain and workgroup membership

Captures the target computer's domain and workgroup membership information. Selecting this option will allow the task sequence step to maintain the network information of the target computer after it has received the task sequence step action.

Migrate network adapter configuration

Captures the target computer's network adapter configuration. Selecting this option will allow the task sequence step to maintain the network adapter configuration information of the target computer after it has received the task sequence step action.

Important
The network adapter configuration information specified with this task sequence step will override any custom network adapter settings that have been specified in the Apply Network Settings task sequence step.

See Also

Tasks

How to Configure the State Migration Point

Reference

Operating System Deployment: Task Sequence Editor
Task Sequence Options Tab


Capture Windows Settings

Use this task sequence step to identify the Microsoft Windows settings that should be captured from the computer that will receive the task sequence.

Important
The settings captured when this step runs will override the settings you configure on the Apply Windows Settings task sequence step.

The settings captured by this task sequence step are only used to populate the installation answer file. You should use this task sequence step in conjunction with the Join Domain or Workgroup task sequence step so that if the domain join action fails a log message will be generated.

You can configure the following settings:

Name

A short user-defined name that describes the action taken in this step.

Description

More detailed information about the action taken in this step.

Migrate computer name

Select this option to capture the computer name of the reference computer. The captured user information will be used to populate the installation answer file.

Migrate registered user and organization names

Select this option to capture the registered user and organization names from the reference computer. The captured user information will be used to populate the installation answer file.

Migrate time zone

Select this option to capture the time zone setting on the reference computer. The captured user information will be used to populate the installation answer file.

See Also

Other Resources

Task Sequence Editor - Settings Steps


Apply Network Settings

Use this task sequence step to specify the network or workgroup configuration information for the target computer.

You can configure the following settings.

Name

A short user-defined name that describes the action taken in this step

Description

More detailed information about the action taken in this step.

Join a workgroup

Select this option to have the target computer join the specified workgroup. Enter the name of the workgroup on the Workgroup line.

Join a domain

Select this option to have the target computer join the specified domain. Specify the organizational unit and domain by optionally entering, or browsing for a Domain and Organizational unit for the computer to join. You can alternatively enter a custom Lightweight Directory Access Protocol query for across forest assignment.

Account

Click the Set button to specify an account with the necessary permissions to join the computer to the domain. In the Windows User Account dialog box you can enter the user name using the following format: Domain\User or if you are using a variable to specify this account, enter the variable name in the following format %variable%.

For more information, see About the Task Sequence Editor Domain Joining Account.

Adapter settings

Specify a static network IP address and other configuration options by clicking the New button. Configure the computer to obtain an IP address using DHCP or provide the static network information in the Network Settings dialog box. This task sequence step will configure the network adapter to use DHCP by default.

Important
When you select the Migrate network adapter configuration option in the Capture network settings task sequence step, the configuration information specified will override the network settings specified by this task sequence step.

See Also

Other Resources

Task Sequence Editor - Settings Steps


Apply Windows Settings

Use this task sequence step to configure the Windows settings configuration information for the target computer.

You can configure the following settings.

Name

A short user-defined name that describes the action taken in this step

Description

More detailed information about the action taken in this step.

User name

Specify the user name that will be associated with the target computer.

Organization name

Enter the organization name information.

Product key

Specify the product key that will be used for the Windows installation on the target computer.

Server licensing

Specify the server licensing mode. You can select Per server or Per user as the licensing mode. If you select per Server as the licensing mode you will also need to specify the maximum number of connections that will be permitted per your license agreement. If the target computer is not a server or you do not want to specify the licensing mode you should select Do not specify.

Maximum connections

Specify the maximum number of connections that are available for this computer as stated in your license agreement.

Randomly generate the local administrator password and disable the account on all supported platforms (recommended)

Select this option to randomly generate a local administrator password. This will randomly create a local administrator password and will disable the account on supported platforms.

Enable the account and specify the local administrator password

Select this option if want to enable the local administrator account and create the local administrator password. Enter the password on the Password line and confirm the password on the Confirm password line.

Time Zone

Specify the time zone that should be configured on the target computer by using the drop down and selecting the desired time zone.


Driver Packages - Drivers

The Drivers sub node displays all drivers that are currently contained in the selected driver package.

There are three tabs on the lower half of the results pane: General, Applicability, and Usage.

The General tab displays the following properties associated with the Drivers sub node:

  • Name
  • Description
  • Status
  • Provider
  • Class
  • Version Number
  • Version Date

The Applicability tab displays the following properties associated with the Drivers sub node:

  • Supported Platforms
  • Supported Models
  • Usage

UI Element List

You can select the following default actions grouped under Drivers in the Actions pane. You can collapse the default actions by clicking the up arrow in the Drivers section header

Refresh

Select this action to refresh the Configuration Manager 2007 Administrator Console display.

Remove from Package

Select this action to remove the device driver form the driver package.

Properties

Select this item to display general properties for the device driver, and to set class security on that node.


New Driver Package Dialog Box

The New Driver Package dialog box allows you to create new driver packages.

Name Description

Name

Specifies an identifying name for the driver package.

Comment

Specifies an optional description for the driver package.

Driver package source

Specifies the UNC path to an empty directory share that the Windows device drivers to be added to. Click Browse to search for a source. When a new device driver is imported Configuration Manager 2007 will copy the content into this share and when a device driver is removed the content will be deleted. The path specified must be a UNC path. You can also create a new directory by clicking New Folder.

Important
The Configuration Manager 2007 system account must have read/write permissions to the specified driver package source location.

See Also

Reference

Add or Remove Drivers to Driver Packages
Operating System Deployment: Drivers and Driver Packages Nodes


Add or Remove Drivers to Driver Packages

The Add or Remove Drivers to Packages dialog box allows you to add or remove Windows device drivers to a new or existing driver package.

The Windows device drivers that will be added to the package are displayed at the top of the page with the source location of the device driver content. When a device driver is added to a driver package, the device driver content will be copied from the driver source location to the driver package. It may be necessary to change this source location if the SMS Provider does not have access to the original source location. For example, when a device driver from a parent site is being added to a driver package located at a child site.

This page contains the elements described in the following table.

Reference | Description
Select All | Adds the Windows device drivers to all existing driver packages.
Clear All | Clears the selection and no device drivers will be added to driver packages.
New Package | Allows you to create a new driver package.
Update distribution points when finished | Updates the distribution points immediately. To update distribution points later, right-click the driver package to be updated, and then click Update Distribution Points.

See Also

Tasks

How to Import Windows Device Drivers into the Driver Catalog


Driver Packages Properties - General Tab

The following two tabs are displayed:

  • General
  • Security

General

This tab displays the name of the node. No other configurable options are available on this tab.

See Also

Reference

Properties - Security Tab


Driver Package Properties

The Driver Package properties display the following four tabs:

In This Section

Driver Package Properties - General Tab

Driver Package Properties - Data Source Tab

Driver Package Properties - Data Access Tab

Driver Package Properties - Distribution Settings


Driver Package Properties - General Tab

The General tab page displays Name, Version, and Description information for the driver package. You can also specify the associated data source and distribution settings.

Name

Specifies a descriptive name for the driver package.

Version

Specifies the version information for the driver package.

Comment

Allows you to optionally provide a description for the driver package.

Data Source

Specifies whether this package contains source files. The source location specified must be a UNC path to an empty directory. When a driver package is created, the driver content will be copied into the empty directory, and when a device driver is removed the content will be removed from the directory. The Configuration Manager 2007 computer account must have read/write access to the directory specified.

You can also specify the schedule that will be used to update distribution points.

Data Access

Specifies where Configuration Manager 2007 stores this package on distribution points. These settings apply to all distribution points receiving the package.

Distribution Settings

Specifies the sending priority and the preferred sender to use when sending the package. You can also specify branch distribution point content update settings.

Security

Sets Configuration Manager 2007 class and instance security for the driver package.

See Also

Reference

Add or Remove Drivers to Driver Packages
Operating System Deployment: Drivers and Driver Packages Nodes


Driver Package Properties - Data Source Tab

Use the Data Source tab to specify whether this package contains source files. The source location specified must be a UNC path to an empty directory. When a driver package is created the driver content will be copied into the empty directory and when a device driver is removed the content will be removed from the directory.

You can configure the following settings:

UI Element List

Source directory

Click the Select button to launch the Set Source Directory dialog box. Specify a source directory for the driver package by clicking the Browse button to search for a directory, or enter the path in UNC format. The location specified must be available to the Configuration Manager 2007 service account.

Use a compressed copy of the source directory

Select this option if you want to use a compressed version of the source files.

Always obtain files from the source directory

Select this option if Configuration Manager 2007 clients should always obtain files form the source directory.

Update distribution points on a schedule

The source files for this image will be regularly updated on distribution points. When selected, the default schedule is set to the current date with an interval of one day. By default, this check box is cleared.

Schedule

Click to open the Schedule dialog box, where you can specify how frequently to update the image data on distribution points. This button is available only when Update distribution points on a schedule is selected.


Driver Package Properties - Data Access Tab

Use this tab to configure how users can access distribution points for driver packages.

You can configure the following settings:

UI Element List

Access distribution folder through common Configuration Manager 2007 package share

The driver package is accessed through the common Configuration Manager 2007 package share (SMSPKGx$, where x is the drive letter) on distribution points. By default, this option is selected.

Share distribution folder

The driver package will be created on distribution points with an administrator-specified share and path name.

Share name

If you select Share distribution point, enter a unique share name and path to be created for the driver package source files on distribution points. See the section Share names later in this document.

Package update settings

Specify the disconnect settings that will take effect when Configuration Manager 2007 updates driver packages on distribution points.

Disconnect users from distribution points

Select this option to notify users before disconnecting them from distribution points when Configuration Manager 2007 updates package data. By default, this check box is cleared.

Number of retries before disconnecting users

The number of times that Configuration Manager 2007 tries to update the driver package source files before disconnecting users who are connected to the distribution point. The default setting is 2; you can specify 0 to 99, inclusive.

Interval between user notification and disconnection

The number of minutes Configuration Manager 2007 should wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.


Driver Package Properties - Distribution Settings

Topic last updated—January 2008

When driver packages are distributed between sites, you must use senders to communicate with other sites. Use this tab to specify the optional sending priority and preferred sender for the driver package.

You can configure the following settings:

UI Element List

Sending priority

The priority of this driver package when sent to distribution points in child sites. Packages can be sent with High, Medium, or Low priority. The default setting is Medium priority.

Packages are sent in priority order: High first, Medium next, and then Low. Packages with identical priorities are sent in the order in which they were created in the Configuration Manager console.

Sending priority for an image is carried over in those sent from a parent site to a child site.

Preferred sender

The sender to be used to send this image to distribution points in other sites. You can specify any sender configured for the site, or No Preference, which uses any available sender. The default setting is No Preference.

Note
To use Courier Sender to distribute Packages, you must select it as the preferred sender.

Branch Distribution Point content settings

Use the options in this section to configure how Packages are distributed to branch distribution points.

Automatically download the content when packages are assigned to branch distribution points.

Select this option to have the image download automatically to a branch distribution point when a branch distribution point is specified manually or when running the Manage Distribution Points Wizard. This option is selected by default.

Make this package available on protected distribution points when requested by clients inside the protected boundaries

Select this option to make the package only available to Configuration Manager 2007 clients inside the protected boundaries when requested.

Administrator manually copies this package to branch distribution points

Select this option to manually manage how the image is distributed to branch distribution points.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.


Drivers Node Properties - General Tab

The following two tabs are displayed:

  • General
  • Security

General

This tab displays the name of the node. No other configurable options are available on this tab.

See Also

Reference

Properties - Security Tab


Driver Properties

The Driver properties display the following three tabs:

In This Section

Driver Properties - General Tab

Driver Properties - Applicability Tab

Driver Properties - Usage Tab


Driver Properties - General Tab

The General tab of the Selected Driver Properties dialog box displays information about Windows device drivers that have been imported into the driver catalog. This tab also displays general device driver information and the supported hardware.

This page contains the elements described in the following table.

Name | Description
Name | Specifies a descriptive name for the device driver.
Description | Specifies an optional description for the device driver.
Driver Source | Specifies the device driver source by clicking Browse. Locate the directory that contains the device driver source in the Browse for Folder dialog box.
Enable this driver and allow computers to install it | Enables the device driver and makes it available for computers to install it. The device driver must be enabled and available on a distribution point for computers to install it.
Categories | Opens the Categories dialog box where you can assign a device driver to a category for filtering purposes. The available categories are listed in the Available Categories pane. To add a new category, type the name in the Add a new category box, and then click Add.

See Also

Tasks

How to Add Windows Device Drivers to a Boot Image


Driver Properties - Applicability Tab

Use the Applicability tab on the Selected Driver Properties dialog box to specify which platforms the Microsoft Windows device drivers can be installed on.

This page contains the elements described in the following table.

Name | Description
This driver can run on any platform | Makes the device drivers available to any computer platform.
This driver can run only on the specified platform | Allows you to manually select the available computer platforms that can install the device driver. Select the applicable platforms by selecting the box next to the desired platform.
Supported Models | Displays the supported models that the selected device driver supports. The associated device driver Manufacturer and Model information is also listed.


Driver Properties - Usage Tab

The Usage tab on the Selected Driver Properties dialog box displays information about the packages and boot images that are currently using device drivers. Only mass storage and network device drivers can be added to boot images.

Important
Drivers must be added to an existing package and deployed to a distribution point before computers can install them.


Operating System Install Packages - General Tab

The following tab is displayed:

  • General: Displays the name of the node. No other configurable options are available on this tab.

General

This tab displays the name of the node. No other configurable options are available on this tab.


Operating System Install Packages Properties - Operating System Install Package

The Operating System Install Packages Properties tab contains the following elements:

UI Element List

Operating System Install Packages Properties - General Tab

Operating System Install Packages Properties - Editions Tab

Operating System Install Packages Properties - Data Source Tab

Operating System Install Packages Properties - Data Access Tab

Operating System Install Packages Properties - Distribution Settings Tab


Operating System Install Packages Properties - General Tab

You can provide identifying information for the operating system install package on the General page.

  • Name - Enter a descriptive name for the install package.
  • Version - Enter the applicable version information for the install package.
  • Comment - Enter an optional comment about the install package.

See Also

Reference

Operating System Install Packages Properties - Editions Tab
Operating System Install Packages Properties - Data Access Tab
Operating System Install Packages Properties - Distribution Settings Tab
Properties - Security Tab

Concepts

Operating System Install Packages Properties - Data Source Tab


Operating System Install Packages Properties - Editions Tab

The Editions tab allows you to view the properties of operating system editions contained in an operating system install package. It also displays the version of the operating system as read from the WIM file metadata. If there are multiple editions listed, use the drop-down list to select the image you wish to view the properties for.

You can update image property information in the Properties window.

Name | Description
Reload | Reloads the image from the original source, which will overwrite all current changes to the properties.

See Also

Reference

Operating System Install Packages Properties - Data Access Tab
Operating System Install Packages Properties - Distribution Settings Tab
Properties - Security Tab

Concepts

Operating System Install Packages Properties - General Tab
Operating System Install Packages Properties - Data Source Tab


Operating System Install Packages Properties - Data Source Tab

Use the Data Source tab to specify the directory that contains the source files for the selected operating system install package.

UI Element List

Name | Description
Source Directory | Displays the location of the WIM image associated with this install package. Click Browse to locate and select the package and associated path. The Source version is also displayed.
Update distribution points on a schedule | Specifies that the source files for this package will be regularly updated on distribution points. When selected, you can configure how often distribution points are updated. Click the Schedule button to configure a custom distribution update schedule.
Persist content in client cache | Enable this option to ensure that the package source files remain cached on the destination computer rather than being aged out of cache by later downloaded packages.
Enable binary differential replication | Enables only changed files to be replicated to distribution points. Only the files that have been updated or changed will be replicated.

See Also

Reference

Operating System Install Packages Properties - Editions Tab
Operating System Install Packages Properties - Data Access Tab
Operating System Install Packages Properties - Distribution Settings Tab
Properties - Security Tab

Concepts

Operating System Install Packages Properties - General Tab


Operating System Install Packages Properties - Data Access Tab

The Data Access tab allows you to specify where Configuration Manager 2007 will save the operating system install package on the distribution point. The location specified will be applied to all distribution points that receive the package.

This page contains the elements described in the following table.

Access distribution folder through common Configuration Manager 2007 package share

Specifies that the image is accessed through the common Configuration Manager 2007 package share (SMSPKGx$, where x is the drive letter) on distribution points. By default, this option is selected.

Share distribution folder

Specifies a unique distribution folder. Enter the name of the share in the Share name box. The name specified must be a valid share and cannot contain the following characters:

/, :, *, ?, ", <, >, \, =

Package update settings

Specifies the disconnect settings that will take effect when Configuration Manager 2007 updates images on distribution points.

Disconnect users from distribution points

Notifies users before disconnecting them from distribution points when Configuration Manager 2007 updates package data. By default, this check box is cleared.

Number of retries before disconnecting users

Specifies the number of times that Configuration Manager 2007 tries to update the image source files before disconnecting users who are connected to the distribution point. The default setting is 2; however, you can specify the number of retries from 0 to 99.

Interval between user notification and disconnection (minutes)

Specifies, in minutes, how long Configuration Manager 2007 should wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; however, you can specify a grace period from 0 to 59 minutes.

See Also

Reference

Operating System Install Packages Properties - Editions Tab
Operating System Install Packages Properties - Distribution Settings Tab
Properties - Security Tab

Concepts

Operating System Install Packages Properties - General Tab
Operating System Install Packages Properties - Data Source Tab


Operating System Install Packages Properties - Distribution Settings Tab

When image packages are distributed between sites, you must use senders to communicate with other sites. Use the Distribution Settings tab to specify the optional sending priority and preferred sender for the package.

The Distribution Settings tab contains the following settings:

Sending priority

Specifies the priority of this image package when sent to distribution points in child sites. Images can be sent with High, Medium, or Low priority. The default setting is Medium priority.

Images are sent in priority order: high-priority items are sent first, medium priority items next, and then low priority items. Images with identical priorities are sent in the order in which they were created in the Configuration Manager console.

Sending priority for an image is carried over for images sent from a parent site to a child site.

Preferred sender

Specifies the sender to be used to send this image to distribution points in other sites. You can specify any sender configured for the site or No Preference, which uses any available sender. The default setting is No Preference.

Note
To use Courier Sender to distribute images, you must select it as the preferred sender.

Branch Distribution Point content settings

Specifies configuration options for specifying how images are distributed to branch distribution points.

Branch distribution points automatically download this package when they receive the advertisement

Specifies that the package download automatically to a branch distribution point when a branch distribution point is specified manually or when running the Manage Distribution Points Wizard. This option is selected by default.

Make this package available on protected distribution points when requested by clients inside the protected boundaries

Specifies that the package be made available to Configuration Manager 2007 clients inside the protected boundaries. This option is available only when the Branch distribution points automatically download this package when they receive the advertisement option is selected.

Administrator manually copies this package to branch distribution points

Allows you to manually manage how the package is distributed to branch distribution points.

See Also

Reference

Operating System Install Packages Properties - Editions Tab
Operating System Install Packages Properties - Data Access Tab
Properties - Security Tab

Concepts

Operating System Install Packages Properties - General Tab
Operating System Install Packages Properties - Data Source Tab


Operating System Deployment: Operating System Deployment Feature Pack Packages

When you upgrade from Systems Management Server 2003 to Configuration Manager 2007, all existing operating system feature pack packages are displayed under the OSD FP Packages node. This node is created during the upgrade and will appear until all the operating system packages are deleted.

The Name, Manufacturer, Language, Version, and Package ID information associated with the selected operating system is displayed in the results pane. You can see additional associated operating system image information by clicking the View menu, and then clicking Add/Remove columns.

Note
You cannot create new advertisements or distribute the upgraded feature pack operating system images to distribution points. The upgraded operating system feature pack packages are not listed in the wizards and dialog boxes where you select other available Configuration Manager 2007 operating system images.


Operating System Deployment: Partition Properties

Use this page to format and configure a hard disk partition for use with operating system deployment. You can also save this configuration so that is available to use with future deployments. When you use this task sequence to apply the disk partition, all information will be erased on the target hard disk.

Important
You cannot capture or apply operating system images that have been configured as hidden or have no default drive letter assigned for the deployment.

This page contains the following elements:

UI Element List

Partition name

Specifies a name for the new partition. The name specified will be used as the volume name when formatting the partition.

Partition type

Specifies the type of partition you want to create: Primary, Extended, or Hidden. If you specify Extended or Hidden you cannot make this partition the boot partition or assign a task sequence variable that will assign a specific drive letter.

Use a percentage of remaining free disk space

Specifies the percentage of remaining disk space that will be used to create the new partition. The percentage specified is the percentage of unused disk space not a percentage of the total disk size.

Use specific size

Configures the size of the disk partition. Use the drop down to specify if the size should be measured in MB or GB.

Make this the boot partition

Makes this partition the boot partition. This option is not available if you specify Extended, or Hidden as the partition type. This option is also not available for use with GUID Partition Table (GPT) hard disks.

File system

Specifies the file system to use when formatting this partition; NTFS, FAT32, or None to leave the partition unformatted. This option is not available if you specify Extended or Hidden as the partition type.

Quick format

Specifies that the partition should be formatted using the quick method. If this option is not selected, a full disk format will be performed.

Note
Quick format does not check the volume for errors. If you are re-provisioning existing computers, a full hard disk format is recommended.

Variable

Configuration Manager 2007 will automatically assign the next available drive letter to this partition. To save this drive letter as a task sequence variable, enter the name of the variable here. You can use this variable in subsequent task sequence actions which run in Windows PE (for example, the Apply Operating System task sequence step) to refer to this partition.

For more information about using task variables, see About Task Sequence Variables


Boot Image Package Status Home Page

The Boot Image Package Status Home page in the Configuration Manager 2007 console tree displays summary information for each boot image package on the Configuration Manager 2007 site.

For each site to which the boot image package is targeted, the following information is shown by default:

  • Site: Displays the name of the Configuration Manager 2007 site to which the boot image package is targeted.
  • Source Version: Displays the version number of the boot image package source files. This is incremented each time you revise the boot image package and can be used to determine whether a distribution point has the latest version of the boot image package source.
  • Targeted: Displays the total number of distribution points, including child sites that have been targeted with a copy of the boot image package.
  • Installed: Displays the total number of distribution points to which the current version of the boot image package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this boot image package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

Selecting any site from the boot image package status node displays the following information by default:

  • Distribution Point: Displays the name of each distribution point to which this boot image package has been targeted.
  • Source Version: Displays the version number of the boot image package source files. This is incremented each time you revise the boot image package and can be used to determine whether a distribution point has the latest version of the boot image package source.
  • State: Displays the current status of the boot image package on the distribution point.
  • Last Copied: Displays the date and time when the boot image package was last copied to the distribution point.
  • Path: Displays the location of the boot image package files on the distribution point.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Boot Image Package Status Home Page

The following actions are available from the boot image package status home page:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected boot image package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Operating System Install Package Status Home Page

The Operating System Install Package Status Home page in the Configuration Manager 2007 console tree displays summary information for each install package on the Configuration Manager 2007 site.

For each site to which the install package is targeted, the following information is shown by default:

  • Site: Displays the name of the Configuration Manager 2007 site to which the install package is targeted.
  • Source Version: Displays the version number of the install package source files. This is incremented each time you revise the install package and can be used to determine whether a distribution point has the latest version of the install package source.
  • Targeted: Displays the total number of distribution points, including child sites that have been targeted with a copy of the install package.
  • Installed: Displays the total number of distribution points to which the current version of the install package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this install package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

Selecting any site from the install package Status node displays the following information by default:

  • Distribution Point: Displays the name of each distribution point to which this install package has been targeted.
  • Source Version: Displays the version number of the install package source files. This is incremented each time you revise the install package and can be used to determine whether a distribution point has the latest version of the install package source.
  • State: Displays the current status of the install package on the distribution point.
  • Last Copied: Displays the date and time when the install package was last copied to the distribution point.
  • Path: Displays the location of the install package files on the distribution point.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Operating System Install Package Status Home Page

The following actions are available from the operating system install package status home page:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected install package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Operating System Image Package Status Home Page

The Operating System Image Package Status Home page in the Configuration Manager 2007 console tree displays summary information for each image package on the Configuration Manager 2007 site.

For each site to which the image package is targeted, the following information is shown by default:

  • Site: Displays the name of the Configuration Manager 2007 site to which the image package is targeted.
  • Source Version: Displays the version number of the image package source files. This is incremented each time you revise the image package and can be used to determine whether a distribution point has the latest version of the image package source.
  • Targeted: Displays the total number of distribution points, including child sites that have been targeted with a copy of the image package.
  • Installed: Displays the total number of distribution points to which the current version of the image package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this image package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

Selecting any site from the image package Status node displays the following information by default:

  • Distribution Point: Displays the name of each distribution point to which this image package has been targeted.
  • Source Version: Displays the version number of the image package source files. This is incremented each time you revise the image package and can be used to determine whether a distribution point has the latest version of the image package source.
  • State: Displays the current status of the image package on the distribution point.
  • Last Copied: Displays the date and time when the image package was last copied to the distribution point.
  • Path: Displays the location of the image package files on the distribution point.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Operating System Image Package Status Home Page

The following actions are available from the operating system image package status home page:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected image package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Driver Packages Package Status Home Page

The Driver Package Status Home page in the Configuration Manager 2007 console tree displays summary information for each driver package on the Configuration Manager 2007 site.

For each site to which the driver package is targeted, the following information is shown by default:

  • Site: Displays the name of the Configuration Manager 2007 site to which the driver package is targeted.
  • Source Version: Displays the version number of the driver package source files. This is incremented each time you revise the driver package and can be used to determine whether a distribution point has the latest version of the driver package source.
  • Targeted: Displays the total number of distribution points, including child sites that have been targeted with a copy of the driver package.
  • Installed: Displays the total number of distribution points to which the current version of the driver package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this driver package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

Selecting any site from the driver package Status node displays the following information by default:

  • Distribution Point: Displays the name of each distribution point to which this driver package has been targeted.
  • Source Version: Displays the version number of the driver package source files. This is incremented each time you revise the driver package and can be used to determine whether a distribution point has the latest version of the driver package source.
  • State: Displays the current status of the driver package on the distribution point.
  • Last Copied: Displays the date and time when the driver package was last copied to the distribution point.
  • Path: Displays the location of the driver package files on the distribution point.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Driver Package Status Home Page

The following actions are available from the driver package status home page:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected driver package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Asset Intelligence Property Pages

Topic last updated—January 2008

This section contains the help topics for the Asset Intelligence property pages.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Asset Intelligence Properties

Customize Catalog Property Pages

Inventoried Software Titles Property Pages

Processor Properties: General Tab

Hardware Requirements Properties: General Tab

Asset Intelligence Reports Properties: General Tab

Asset Intelligence Synchronization Point Properties

See Also

Other Resources

Property Pages


Asset Intelligence Properties

Topic last updated—January 2008

The Asset Intelligence Configuration Manager console node contains no editable properties.

For information about the Asset Intelligence home page, see Asset Intelligence Home Page.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

See Also

Concepts

Asset Intelligence Property Pages


Customize Catalog Property Pages

Topic last updated—January 2008

This section contains the help topics for the Asset Intelligence Customize Catalog Configuration Manager console node properties pages.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Customize Catalog Properties: General Tab[Top Node]

Software Category Properties: General Tab

Software Family Properties: General Tab

Custom Label Properties: General Tab

See Also

Concepts

Asset Intelligence Property Pages


Customize Catalog Properties: General Tab

Topic last updated—January 2008

The Customize Catalog Configuration Manager console node is used to customize software category, software family, and custom label information for software titles stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Customize Catalog properties contains the following elements.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Because there are no editable properties for this dialog box, Apply is not enabled.

See Also

Concepts

Customize Catalog Property Pages


Software Category Properties: General Tab

Topic last updated—January 2008

The Software Categories Properties General tab is used to view the properties of existing Asset Intelligence software categories.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Software Categories Properties General tab contains the following elements.

Category name

Displays the name of the selected software category.

Validation state

Displays the validation state of the software category selected. Validation states available are Validated and User Defined.

Description

Displays the description for the selected software category.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Apply is enabled only for user-defined software categories.

See Also

Concepts

Customize Catalog Property Pages


Software Family Properties: General Tab

Topic last updated—January 2008

The Software Family Properties General tab is used to view the properties of existing Asset Intelligence software families.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Software Family Properties General tab contains the following elements.

Family name

Displays the name of the selected software family.

Validation state

Displays the validation state of the software family selected. Validation states available are Validated and User Defined.

Description

Displays the description for the selected software family.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Apply is enabled only for user-defined software families.

See Also

Concepts

Customize Catalog Property Pages


Custom Label Properties: General Tab

Topic last updated—January 2008

The Custom Label Properties General tab is used to view the properties of existing Asset Intelligence custom labels.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Custom Label Properties General tab contains the following elements.

Label name

Displays the name of the selected custom label.

Description

Displays the description for the selected custom label.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Apply is enabled only when changes have been made to the custom label.

See Also

Concepts

Customize Catalog Property Pages


Inventoried Software Titles Property Pages

Topic last updated—January 2008

This section contains the help topics for the Asset Intelligence Inventoried Software Titles and Uncategorized Software Configuration Manager console node properties pages.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Inventoried Software Titles Properties: General Tab

Inventoried Software Title Properties: General Tab

Inventoried Software Title Properties: Custom Labels Tab

Uncategorized Software Properties: General Tab

See Also

Concepts

Asset Intelligence Property Pages


Inventoried Software Titles Properties: General Tab

Topic last updated—January 2008

The Inventoried Software Titles Configuration Manager console node is used to view inventoried software titles stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Inventoried Software Titles Properties page contains the following elements.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Because there are no editable properties for this dialog box, Apply is not enabled.

See Also

Concepts

Inventoried Software Titles Property Pages


Inventoried Software Title Properties: General Tab

Topic last updated—January 2008

The Inventoried Software Title Properties General tab is used to view the properties of an inventoried software title stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Inventoried Software Title Properties General tab contains the following elements.

Product name

Displays the name of the inventoried software title.

Vendor

Displays the name of the vendor that developed the inventoried software title.

Version

Displays the product version of the inventoried software title.

Software category

Displays the currently assigned software category for the inventoried software title.

Software family

Displays the currently assigned software family for the inventoried software title.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Apply is enabled only when changes have been made to inventoried software title information.

See Also

Concepts

Inventoried Software Titles Property Pages


Inventoried Software Title Properties: Custom Labels Tab

Topic last updated—January 2008

The Inventoried Software Title Properties Custom Labels tab is used to view the custom label properties of an inventoried software title stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Up to three user-defined custom labels can be associated with each inventoried software title. For more information about managing custom labels, see How to Manage Custom Labels.

The Inventoried Software Titles Properties Custom Labels tab contains the following elements.

Label 1

Displays the first custom label specified for the selected inventoried software title.

Label 2

Displays the second custom label specified for the selected inventoried software title.

Label 3

Displays the third custom label specified for the selected inventoried software title.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Apply is enabled only when changes have been made to inventoried software title information.

See Also

Concepts

Inventoried Software Titles Property Pages


Uncategorized Software Properties: General Tab

Topic last updated—January 2008

The Uncategorized Software Configuration Manager console node contains no editable properties.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

For information about inventoried software title properties, see Inventoried Software Titles Properties: General Tab.

See Also

Concepts

Inventoried Software Titles Property Pages


Processor Properties: General Tab

Topic last updated—January 2008

The Processor Properties Configuration Manager console node is used to view the current CPU information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Processor Properties property page contains the following elements.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Because there are no editable properties for this dialog box, Apply is not enabled.

See Also

Reference

Processor Properties: General Tab

Concepts

Asset Intelligence Property Pages


Processor Properties: General Tab

Topic last updated—January 2008

The Processor Properties General tab is used to view processor information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Processor Properties General tab contains the following elements.

Name

Displays the name of the selected CPU.

Manufacture date

Displays the date of manufacture for the selected CPU.

Manufacturer

Displays the manufacturer of the selected CPU.

Brand ID

Displays the brand ID of the selected CPU.

Speed

Displays the processing speed of the selected CPU in MHz.

Mobile

Displays whether or not the selected CPU is designed for mobile devices.

PC Cache

Displays the amount of cache memory available with the selected CPU.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Because there are no editable properties for this dialog box, Apply is not enabled.

See Also

Reference

Processor Properties: General Tab


Hardware Requirements Properties: General Tab

Topic last updated—January 2008

The Hardware Requirements Configuration Manager console node is used to view the current software title hardware requirements information stored in the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Hardware Requirements properties page contains the following elements.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Because there are no editable properties for this dialog box, Apply is not enabled.

See Also

Reference

Hardware Requirement Properties: General Tab

Concepts

Asset Intelligence Property Pages


Hardware Requirement Properties: General Tab

Topic last updated—January 2008

The Hardware Requirement Properties General tab is used to view software title hardware requirement information stored in the Asset Intelligence Catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Hardware Requirement Properties General tab contains the following elements.

Software title

Displays the software title name that relates to the specified hardware requirements.

Validation state

Displays the validation state of the hardware requirement selected. Validation states available are Validated and User Defined.

Minimum CPU (MHz)

Displays the minimum processor speed, in MHz, required for the software title specified in Software title.

Minimum RAM (KB)

Displays the minimum RAM, in KB, required for the software title specified in Software title.

Minimum Disk Space (KB)

Displays the minimum free disk space, in KB, required for the software title specified in Software title.

Minimum Disk Size (KB)

Displays the minimum hard disk space, in KB, required for the software title specified in Software title.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Apply is enabled only for user-defined hardware requirements.

See Also

Reference

Hardware Requirements Properties: General Tab


Asset Intelligence Reports Properties: General Tab

Topic last updated—January 2008

The Asset Intelligence Reports Configuration Manager console node is used to view available Asset Intelligence reports.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Customize Catalog properties contain the following elements.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Note
Because there are no editable properties for this dialog box, Apply is not enabled.

Help

Opens the help topic for this dialog box.

See Also

Reference

Properties - Security Tab

Concepts

Asset Intelligence Property Pages

Other Resources

Report Name Properties


Asset Intelligence Synchronization Point Properties

Topic last updated—January 2008

Asset Intelligence synchronization points are used by customers with Microsoft Software Assurance (SA) licenses to connect to and synchronize with System Center Online, to download updated Asset Intelligence catalog information as well as to upload custom software title catalog information.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Asset Intelligence Synchronization Point Properties: General Tab

Asset Intelligence Synchronization Point Properties: Proxy Server Tab

Asset Intelligence Synchronization Point Properties: Schedule Tab

See Also

Concepts

Asset Intelligence Property Pages


Asset Intelligence Synchronization Point Properties: General Tab

Topic last updated—January 2008

Asset Intelligence synchronization points can be used by Microsoft Software Assurance (SA) license customers to connect to and synchronize with System Center Online, to download updated Asset Intelligence catalog information as well as to upload custom software title information.

Important
All software titles uploaded to System Center Online for categorization will be treated as public information by Microsoft. Therefore, you should ensure that your custom software titles do not contain confidential or proprietary information.

To use this site system as an Asset Intelligence synchronization point, you must specify an authentication certificate to use when connecting to System Center Online.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Asset Intelligence synchronization point General tab contains the following elements.

Path to certificate

Specifies the path to the System Center Online authentication certificate (.pfx) file.

Browse

Used to specify the path to a valid authentication certificate (.pfx) file to be used to authenticate to System Center Online.

Port

Specifies the TCP port to be used to connect to System Center Online.

Note
The port number to be used is read only because System Center Online accepts connections only on TCP port 443.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Concepts

Asset Intelligence Synchronization Point Properties


Asset Intelligence Synchronization Point Properties: Proxy Server Tab

Topic Last Updated—August 2008

Asset Intelligence synchronization points can be used by Microsoft Software Assurance (SA) license customers to connect to and synchronize with System Center Online, to download updated Asset Intelligence catalog information as well as to upload custom software title information.

Important
All software titles uploaded to System Center Online for categorization will be treated as public information by Microsoft. Therefore, you should ensure that your custom software titles do not contain confidential or proprietary information.

If proxy server settings are required for the Asset Intelligence synchronization point to connect and synchronize with System Center Online, these settings can be entered on the Asset Intelligence synchronization point Proxy Server tab.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Asset Intelligence synchronization point Proxy Server tab contains the following elements.

Use a proxy server when synchronizing

Select this option if proxy server settings are required to allow the Asset Intelligence synchronization point to synchronize with System Center Online.

Server Name

Used to specify the proxy server name that is required to allow synchronization with System Center Online.

Port

Specifies the TCP port to be used to connect to System Center Online. The default setting is to use port 80.

Use credentials to connect to the proxy server

Used to enable proxy server logon account settings to connect to the proxy server if the proxy server logon credentials that must be used are different than the local system account of the Asset Intelligence synchronization point computer.

Proxy server account

Used to specify a proxy server account, in <domain>\<username> format, to use to connect to the proxy server if the logon credentials to be used are other than the local system account of the Asset Intelligence synchronization point.

Set…

Used to open the Windows User Account selection dialog to specify a proxy server account.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Concepts

Asset Intelligence Synchronization Point Properties


Asset Intelligence Synchronization Point Properties: Schedule Tab

Topic last updated—January 2008

The Asset Intelligence Synchronization Point Schedule tab is used to enable or disable the Asset Intelligence synchronization point site system role and to configure synchronization schedule settings for the Asset Intelligence synchronization point to connect to System Center Online.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

If you do not enable automatic synchronization by using the Asset Intelligence synchronization point, you must manually synchronize with System Center Online to obtain Asset Intelligence catalog updates.

The Asset Intelligence Synchronization Point Schedule tab contains the following elements.

Enable synchronization on a schedule

Enables or disables scheduled Asset Intelligence catalog updates using the Asset Intelligence synchronization point site system role.

Simple schedule

Schedules Asset Intelligence catalog synchronization to run at a single, specific interval in days. This option is selected by default.

Run every (days)

When Simple schedule is selected, this option specifies the interval, in days, between automatic Asset Intelligence catalog synchronizations with System Center Online.

You can specify 1 to 31 days. By default, this interval is set to 31 days.

Custom schedule

Schedules Asset Intelligence catalog synchronization to run using a custom schedule.

Custom synchronization schedules allow you to schedule the first start date and time for synchronization to occur.

Custom schedules can be set to run weekly, monthly, or at a custom interval.

Custom weekly schedules can run from 1–4 weeks on the day of the week specified.

Custom monthly schedules can run from 1–12 months on either a specific day of the week from 1–31; the last day of each month; or the first, second, third, fourth, or last selected day of the week for each month.

Custom synchronization schedules can also be set to run on a custom interval of 1–31 days. This option differs from the simple schedule in that you can specify a start time to begin the synchronization process.

Note
As an example, if today is Wednesday and you set the synchronization schedule to run every two weeks on Mondays, the next synchronization will occur on the next Monday and alternate Mondays after that.

Customize

Opens the Custom Schedule dialog box to set a custom synchronization schedule.

OK

Saves the changes and exits the dialog box.

Apply

Saves the changes and remains in the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Concepts

Asset Intelligence Synchronization Point Properties
Custom Schedule Dialog Box


Software Metering Property Pages

This section contains the Configuration Manager 2007 software metering property pages dialog box help topics. Click any link in the following section for detailed information about its associated property dialog box:

In This Section

Software Metering Properties: General Tab

Specifies options for the automatic generation of Configuration Manager 2007 software metering rules.

Software Metering Rule Properties: General Tab

Specifies options for creating new Configuration Manager 2007 software metering rules.

See Also

Other Resources

Overview of Software Metering


Software Metering Rule Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Metering Properties dialog box to specify the details of the executable file for which you want to create a software metering rule.

This tab contains the following elements:

Name

Specifies the name of the software metering rule. The name should be unique and descriptive, and it can be up to 256 characters in length. If you select an executable file to be metered by using the Browse button, this field is automatically filled if product information is present in the header of the file.

File name

Specifies the name of the executable file you want to meter. You can click Browse to display the Open dialog box, in which you can select the executable file to include in the software metering rule.

Note
If you type the executable name into the File name field, no checks are carried out to determine whether this file exists or whether it contains the necessary header information. When possible, use the Browse button to specify the executable file to be metered.

Wildcard characters are not permitted in the file name.

This field is optional if a value for Original file name is specified.

Original file name

Specifies the name of the executable file you want to meter by reading the file name from the header of the file. This can be used in cases where the file has been renamed but you want to meter it by the original name.

Note
Wildcard characters are not permitted in the original file name.

This field is optional if a value for File Name is specified.

Version

Specifies the version of the executable file to meter. You can use the wildcard character (*) to represent any string of characters or the wildcard character (?) to represent any single character. If you want to meter for all versions of an executable file, use the default value (*).

Note
This field is not required. However, if you leave the field blank, Configuration Manager 2007 software metering will match this field only if the version field in the executable file header is also blank. It is recommended you enter a value for this field or enter the wildcard symbol (*) to match any version of the executable file.

Language

Specifies the language of the executable file to meter. The default value is English (United States). If you select an executable file to be metered by using the Browse button, this field is automatically filled if language information is present in the header of the file. To meter all language versions of a file, select - Any - from the drop-down list.

Comment

Specifies an optional description for the software metering rule.

Site code

The Configuration Manager 2007 site code that the software metering rule will apply to.

This rule applies to the specified site and all its child sites

Indicates whether the software metering rule will apply to all lower level Configuration Manager 2007 sites, in addition to the site code specified in Site code.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Software Metering in Configuration Manager


Software Metering Properties: General Tab

Use the General tab of the Configuration Manager 2007 Software Metering Properties dialog box to specify settings for the automatic generation of software metering rules.

This tab contains the following elements:

Recent Usage Inventory Settings

Specifies settings for the automatic generation of software metering rules and for the amount of time to retain data generated by these rules.

Data Retention (in days)

Specifies the amount of time that data generated by software metering rules will be held in the site database. The default value is 90 days.

Auto create disabled metering rules from recent usage inventory data

If selected, this option allows you to specify settings for the automatic generation of software metering rules from Configuration Manager 2007 inventory data. The following items can be configured:

  • Specify the percentage of computers in a Configuration Manager 2007 site that must use a particular executable before a software metering rule for that executable is automatically created. The default value is 10 percent.
  • Specify the number of rules after which no new software metering rules will be automatically created. The default value is 100 rules.
Note
Software metering rules are created in a disabled state. To enable a software metering rule, right-click the rule and select Enable.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Software Metering in Configuration Manager


Software Metering Properties

In This Section

Properties - Security Tab

Software Metering Properties: General Tab


Reporting Property Pages

This section contains the Configuration Manager 2007 reporting property dialog box help topics. Click any link in the following section for detailed information about its associated property dialog box:

In This Section

Dashboard Name Properties

Provides information about the properties dialog box for a selected dashboard.

Reports Properties

Provides information about the properties dialog box for the Reports console tree node.

Report Name Properties

Provides information about the properties dialog box for a selected report.

See Also

Tasks

How to Modify Report Properties

Concepts

About Configuration Manager Reports


Dashboard Name Properties

The Configuration Manager 2007 properties dialog box for dashboards displays information about the dashboard and allows the settings for the dashboard to be modified. Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Dashboard Name Properties: General Tab

Specifies the general properties for the dashboard.

Dashboard Name Properties: Reports Tab

Specifies the dimensions for the dashboard and the reports that display in each dashboard position.

See Also

Tasks

How to Modify Dashboard Properties

Concepts

About Configuration Manager Dashboards


Dashboard Name Properties: General Tab

Use the General tab of the Configuration Manager 2007 Dashboard Properties dialog box to specify the general properties for the dashboard. The General tab contains the following elements:

Name

Specifies the name for the dashboard. This setting is required and must be unique.

Comment

Specifies the description for the dashboard. This setting is optional.

Limit cell height

Specifies whether to limit the height of the dashboard display. When this element is selected, type the maximum height, in pixels, in the Height text box. The default value is 250.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Manager Dashboards

Other Resources

Dashboard Name Properties


Dashboard Name Properties: Reports Tab

Use the Reports tab of the Configuration Manager 2007 Dashboard Properties dialog box to specify the dimensions for the dashboard and the reports that will display in each position. The Reports tab contains the following elements:

Dashboard dimensions

Specifies the dimensions for the dashboard in rows and columns. By default, the dashboard is made of two rows and two columns. When the dimensions are modified, click Set to change the number of positions listed in the Dashboard reports section.

Dashboard reports

Specifies the reports that will be displayed at the given position in the dashboard. The positions are identified by the row and column combination, as detailed here:

  • To add a report to a position, double-click anywhere on the row for the position or select a position, and then click the Select Report icon. Select a report from the Select Report dialog box, and then click OK. When there are no reports defined for a position, the Report column displays -Blank-. For more information, see How to Add Reports to a Dashboard.
  • To remove a report from a position, add the -Blank- report to the position. To remove groups of reports from a dashboard, the dimensions can be modified. For more information, see How to Remove Reports from a Dashboard.
  • Use the Move Up and Move Down icons to change the dashboard position for a highlighted report.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Add Reports to a Dashboard

Concepts

About Configuration Manager Dashboards
How to Remove Reports from a Dashboard

Other Resources

Dashboard Name Properties


Reports Properties

The Configuration Manager 2007 Reports Properties dialog box displays information about the console node object and specifies security rights that users have on the Report class. Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Reports Properties: General Tab

Displays the name of the Configuration Manager console tree node object.

Properties - Security Tab

Specifies the security rights that users have on the Report class.

See Also

Concepts

About Configuration Manager Reports


Reports Properties: General Tab

The General tab in the Configuration Manager 2007 Reports Properties dialog box displays Reports as the console tree node object. The General tab contains the following elements:

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Manager Reports

Other Resources

Reports Properties


Report Name Properties

The Configuration Manager 2007 properties dialog box for reports displays information about the report and allows the settings for the report to be modified. Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Report Name Properties: General Tab

Specifies general information about the report, the SQL statement used to retrieve the report data, and whether report prompts are configured.

Report Name Properties: Display Tab

Specifies whether the report data is automatically refreshed and whether a chart is created for the report.

Report Name Properties: Links Tab

Specifies whether the report links to a target resource.

Properties - Security Tab

Specifies the security rights that users have on the Report class and the report instance.


Report Name Properties: General Tab

Use the General tab of the Configuration Manager 2007 Report Properties dialog box to specify the general information about the report, modify the SQL statement for the report, and create one or more report prompts. The General tab contains the following elements:

Name

Specifies the name for the report. The report name is required and must be unique.

Category

Specifies the category for the report. Categories are case sensitive, and unless a new category is being created for the report, it is recommended that the category be selected from the Category drop-down list. If the category name is entered so that it is not identical to the name in the drop-down list, a new category will be created.

Display in Computer Details

Specifies whether the report will appear on the Computer Details page of Report Viewer. This setting is available only to reports that have one or no report prompts configured.

Comment

Specifies a description for the report. This is an optional field that helps to describe the purpose of the report.

SQL statement

Specifies the SQL statement used to retrieve the report data. Click Edit SQL Statement to modify the SQL statement.

Edit SQL Statement

Opens the Report SQL Statement dialog box, where the SQL statement can be modified and report prompts can be created or modified.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create or Modify Report Prompts

Reference

Prompts Dialog Box
Report SQL Statement Dialog Box

Concepts

How to Modify the Report SQL Statement
SQL Query Statement Reference

Other Resources

Report Name Properties


Report Name Properties: Display Tab

Use the Display tab of the Configuration Manager 2007 Report Properties dialog box to specify whether the report automatically refreshes at a configured interval and whether to provide a chart for the report. The Display tab contains the following elements:

Refresh the report automatically

Specifies whether the data in a report is automatically refreshed by running the report query at a configured interval. When this element is enabled, configure the following setting:

  • Refresh interval: Specifies the number of minutes between automatic updates. The refresh interval can be configured to be from 1 to 60 minutes.
Provide a chart for the report

Specifies whether a chart is created that can be displayed when the report is run. When this element is enabled, configure the following settings:

  • Default chart type: Specifies the default chart type that is displayed when the chart is opened. The available chart types are Column, Bar, Line, Area, Pie, Exploded Pie, Doughnut, Exploded Doughnut, and Scatter (X,Y). After the chart opens, a different chart type can be specified.
    Note
    Use scatter graphs for numerical data only.

  • Chart title: Specifies the title displayed above the chart.
  • Category (X) axis column: Specifies the column number from the report that is used for the data that is presented, along the horizontal axis (X axis) of the chart.
  • Category (X) axis label: Specifies the label for the horizontal axis (X axis) of the chart.
  • Value (Y) axis column: Specifies the column from the report that is used for the data that is presented along the vertical axis (Y axis) of the chart.
  • Value (Y) axis label: Specifies the label for the vertical axis (Y axis) of the chart.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Modify Report Properties

Other Resources

Report Name Properties


Report Name Properties: Links Tab

Use the Links tab of the Configuration Manager 2007 Report Properties dialog box to specify whether the report has a link to another target resource. The Links tab contains the following elements:

Link type

Specifies whether there is a link to a target resource. The following link types and associated properties are available:

  • No link: Specifies that this report does not link to a target resource.
  • Link to another report: Specifies that this report links to another report. The following properties must be configured:
    • Report: Specifies the target report. Click Select, choose from one of the reports in the Select Report dialog box, and then click OK.
    • Prompts: Specifies the prompts that are configured for the target report. Double-click a prompt, select the column number from this report that contains the data for the prompt, and then click OK.
  • Link to Computer Details: Specifies that this report links to the Computer Details page that provides more information about a specific computer. In the Computer name column text box, type the column number from this report that contains computer names.
  • Link to Status Message Details: Specifies that this report links to the Status Message Details page that provides more information about a specific status message. In the RecordID text box, type the column number from this report that contains the record ID value for status messages.
  • Link to URL: Specifies that this report links to a URL resource. In the URL text box, type the URL path.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Modify Report Properties

Concepts

About Report Links

Other Resources

Report Name Properties


Desired Configuration Management Property Pages

This section contains the Configuration Manager 2007 Desired Configuration Management property pages dialog box help topics. Click any link in the following section for detailed information about its associated property dialog box:

In This Section

Desired Configuration Management Properties: General Tab

Configuration Baseline Properties

Configuration Item Properties

Setting Properties

Object Properties

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Items in Desired Configuration Management


Desired Configuration Management Properties: General Tab

This tab has no properties to view or edit.

See Also

Other Resources

Overview of Desired Configuration Management


Configuration Baseline Properties

The Configuration Manager 2007 Configuration Baseline Properties dialog box displays information about a configuration baseline created in the Create Configuration Baseline Wizard or imported in the Import Configuration Data Wizard, together with information about its relationship to other configuration baselines, its assignments, and its rules.

Click any link in the following section for detailed information about its associated tab in the Configuration Baseline Properties dialog box:

In This Section

Configuration Baseline Properties: General Tab

Specifies the name and description of the configuration baseline and displays its properties and assigned configuration categories.

Configuration Baseline Properties: Rules Tab

Specifies which configuration items and configuration baselines are referenced by this configuration baseline.

Configuration Baseline Properties: Relationships Tab

Displays which configuration baselines reference this configuration baseline.

Configuration Baseline Properties: Assignments Tab

Specifies which collections this configuration baseline has been assigned to.

Properties - Security Tab

Specifies the class and instance security for the configuration baseline.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management

Other Resources

How to Configure Configuration Baselines for Desired Configuration Management


Configuration Baseline Properties: General Tab

Use the General tab of the Configuration Manager 2007 configuration baseline properties to modify the name, description, and assigned categories of the selected configuration baseline.

This tab contains the following elements:

Name:

Specifies the name of the configuration baseline. The name should be unique and descriptive.

Description:

Specifies the description for the configuration baseline. The description should give an overview of the configuration baseline and other relevant information that helps identify it among others in the configuration baselines node of the Configuration Manager 2007 console. You can use a maximum of 256 characters for the description.

Properties:

Displays the following properties of the configuration baseline:

  • The configuration baseline type
  • The version number
  • The site code where it was created
  • The date and time of creation
  • The Windows user account used to create the configuration baseline
  • The date and time of last modification
  • The Windows user account used for the last modification
Assigned categories to improve searching and filtering

Displays the categories (if any) that have been assigned to the configuration baseline.

Categories

Opens the Categories dialog box from where you can assign, modify or remove a category for this configuration baseline and also create new categories and delete existing categories.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Categories in Desired Configuration Management

Other Resources

How to Configure Configuration Baselines for Desired Configuration Management


Configuration Baseline Properties: Rules Tab

Use the Rules tab of the Configuration Manager 2007 configuration baseline properties dialog box to add or delete configuration items and configuration baselines that define how compliance will be evaluated on client computers.

Note
If you see Unresolved configuration item reference in place of a configuration item name, this might denote one of the following scenarios and to resolve both cases, obtain an updated version of the configuration item:

Scenario 1: A read-only child configuration item whose parent configuration item has been modified or superseded. The child configuration item will still be correctly evaluated for compliance by desired configuration management, with all details of that compliance available except for the display name.

Scenario 2: A read-only configuration baseline that contains a configuration item that is now superseded or that has been deleted. The configuration item will still be correctly evaluated for compliance by desired configuration management, but the details of that compliance will not be available in the server reports. However, the details of that compliance are available in the client report.

This tab contains the following elements:

Rules

Specifies which configuration items and configuration baselines define compliance for this configuration baseline. To add configuration items or configuration baselines to a rule, click the rule hyperlink. To delete a configuration item or configuration baseline from the rules, select it and click Delete.

Delete

Removes the selected configuration item or configuration baseline from a configuration baseline rule.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Modify the Rules within a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management
About Compliance and Compliance Information in Desired Configuration Management


Configuration Baseline Properties: Relationships Tab

Use the Relationships tab of the Configuration Manager 2007 configuration baseline properties dialog box to view which configuration baselines reference this configuration baseline in its rules.

Configuration baseline table

Displays the Name, Description, Status, Version, and Categories of any configuration baselines that reference the selected configuration baseline in their configuration baseline rules.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management


Configuration Baseline Properties: Assignments Tab

Use the Assignments tab of the Configuration Manager 2007 configuration baseline properties to view which collections this configuration baseline has been assigned to, the assignment date and time, and the evaluation schedule.

Note
Although configuration baselines can be assigned to a collection that contains users, configuration baselines will be evaluated only by computers in the collection, and not by users in the collection.

This tab contains the following elements:

Assignments table

Displays the collection name, the assignment date and time, and the schedule for each collection the configuration baseline is assigned to.

Properties

Click to display the properties of the selected configuration baseline assignment, to enable or disable Include subcollections, and to configure a simple or custom schedule.

Delete

Click to delete the selected configuration baseline assignment.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management

Reference

Configuration Baseline Assignment Properties Dialog Box

Concepts

About Configuration Baselines in Desired Configuration Management


Configuration Item Properties

The Configuration Manager 2007 Configuration Item Properties dialog box displays information about configuration items imported with the Import Configuration Data Wizard or created with one of the following wizards:

  • Create Application Configuration Item Wizard
  • Create General Configuration Item Wizard
  • Create Operating System Configuration Item Wizard

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Configuration Item Properties: General Tab

Specifies the name and description of the configuration item and displays the properties and assigned categories.

Configuration Item Properties: Windows Version Tab

Specifies the Windows version information required by the operating system configuration item.

Configuration Item Properties: Objects Tab

Specifies the objects that you want to include in the configuration item. Examples of configuration item objects are files, folders, and registry keys.

Configuration Item Properties: Settings Tab

Specifies settings and their validation criteria to include in the configuration item. Examples of configuration item settings are those which define values to be validated from Active Directory Domain Services, the registry, and scripts.

Configuration Item Properties: Detection Method Tab

Specifies the method by which the application will be detected on client computers. Applicable to application configuration items only.

Configuration Item Properties: Applicability Tab

Applicable to application configuration items and general configuration items only. Specifies that the configuration item is applicable to the selected Windows platforms only.

Configuration Item Properties: Relationships Tab

Displays which configuration baselines reference the configuration item, and displays any parent or child relationships with other configuration items.

Properties - Security Tab

Specifies the class and instance security for the configuration item.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management

Other Resources

How to Configure Configuration Items for Desired Configuration Management


Configuration Item Properties: General Tab

Use the General tab of Configuration Manager 2007 configuration item properties to modify its name and description, to view its properties (such as when it was created and last modified), and to view any assigned configuration categories.

This tab contains the following elements:

Name

Specifies the name of the configuration item. The name should be unique for the configuration item type, and it should be descriptive.

Description

Specifies the description for the configuration item. The description should give an overview of the configuration item and other relevant information that helps identify it among others in the Configuration Items node of the Configuration Manager 2007 console. You can use a maximum of 256 characters for the description.

Properties

Displays the following properties of the configuration item:

  • The configuration item type
  • The version number
  • The site code where it was created
  • The date and time of creation in coordinated universal time (UTC).
  • The Windows user account used to create the configuration item
  • The date and time of last modification in coordinated universal time (UTC).
  • The Windows user account used for the last modification
Assigned categories to improve searching and filtering

Displays the categories (if any) that have been assigned to this configuration item.

Categories

Opens the Categories dialog box from where you can assign, modify or remove a category for this configuration item and also create new categories and delete existing categories.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Baselines in Desired Configuration Management
About Configuration Categories in Desired Configuration Management


Configuration Item Properties: Windows Version Tab

Use the Windows Version tab of the Configuration Manager 2007 configuration item properties dialog box to specify the Windows version information that is applicable to the operating system configuration item. Client computers running operating system versions that are different from those specified will not include this operating system configuration item in their compliance evaluation.

This tab contains the following elements:

Specify Windows version by description

Identifies the Windows version by description rather than details such as version numbers. Select one of the descriptions from the dropdown list.

Specify Windows version by details

Identifies the Windows version by details such as version numbers rather than by description. Type in each of the following version numbers:

  • Major version
  • Minor version
  • Build number
  • Service Pack major version
  • Service Pack minor version
Note
You can use the winver.exe command from a Windows command prompt to display the full Windows version.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management


Configuration Item Properties: Objects Tab

Use the Objects tab of the Configuration Manager 2007 configuration item properties dialog box to view, add, edit, and delete objects that you want to include in this configuration item. Examples of configuration item objects are files, folders, and registry keys.

This tab contains the following elements:

Object list

Displays a list of any objects defined for this configuration item with the following properties:

  • Name
  • Location
  • Type
New

Click to define a new object for this configuration item of one of the following types:

  • Assembly
  • File or Folder
  • Registry Key
Edit

Click to edit a selected object for this configuration item.

Remove

Click to remove a selected object for this configuration item.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management


Configuration Item Properties: Settings Tab

Use the Settings tab of the Configuration Manager 2007 configuration item properties dialog box to view, add, edit, and delete settings and their validation criteria that you want to include in this configuration item. Examples of configuration item settings are those obtained from Active Directory Domain Services, the registry, and scripts.

This tab contains the following elements:

Look for setting

Filters the settings that are displayed on the Settings tab based on the keyword entered in the text box.

Find Now

Initiates the filter and then displays the results in the Search Results node of the settings tree.

Settings Tree

Displays a tree view showing the following information:

  • All settings: Displays all settings created for this configuration item.
  • Parent settings: Displays the parent configuration item settings if the configuration item is a child of another configuration item.
  • Settings Groups: If specified, a list of settings groups is shown. Click any settings group to see the settings that are contained in that group. You can click New and then Settings Group to create a new settings group.
  • Search Results: Displays the results of the most recent search specified in the Look for setting text box.
Settings list

Displays a list of any configuration item settings for the selected settings group, search results or all settings with the following properties:

  • Name
  • Data Type
  • Validation
  • Setting
  • Location
New

Defines a new setting for this configuration item. You will be prompted to select one of the following data sources for the setting:

  • Active Directory Domain Services
  • IIS Metabase
  • Registry
  • Script
  • SQL Query
  • WQL Query
  • XML
  • Settings Group
You can specify a new settings group in this dialog box which will appear in the settings tree. Clicking New will create a setting in the currently selected settings group.

Edit

Edits a selected setting for this configuration item.

Validation

Specifies the validation criteria for a selected setting, such as the required value or range.

Note
Where more than one validation criteria have been specified, this option is not available. In this case, click Edit to change the properties of the selected setting.

Remove

Removes a selected setting for this configuration item.

Note
Removing a settings group removes all settings contained within that group.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management


Configuration Item Properties: Detection Method Tab

Use the Detection Method tab of the Configuration Manager 2007 configuration item properties dialog box to specify how the application will be detected on client computers. For example, the detection method could use the properties of the Windows Installer application, such as the product code and version. Alternatively, the detection method could be achieved by using a custom script to look for a defined registry key or another mechanism to identify whether the application is installed. The Detection Method tab is only available for application configuration items.

This tab contains the following elements:

Always assume application is installed

Specifies that no detection method will be used to identify the application configuration item, and the application will be assumed to be installed.

Do not use this option if you need to use this application configuration item with either of these configuration baseline rules:

  • If these optional application configuration items are detected, they must be properly configured.
  • These application configuration items must not be present.
Use Windows Installer (MSI) detection

Specifies that the presence of the application on client computers will be detected using Windows Installer properties.

Product code

Specifies the product code of the application if using Windows Installer detection. This must be a valid globally unique identifier (GUID).

Version

Specifies the version of the application if using Windows Installer detection. This must be in the standard Windows Installer four-part version number format.

Open

Click to open a Windows Installer file to automatically populate the Product code and Version fields.

This application is installed per user

Specifies that detection should be performed for each user profile on the client computer.

Use custom script

Specifies that the presence of the application on client computers will be detected using a custom script. Use the drop-down list box to specify one of the following scripting languages:

  • VBScript
  • JScript
  • PowerShell
Use the text box to edit or view the custom script contents.

Open

Click to select the custom script that will detect the presence of the application. The script contents will be added to the text box. By default, the Open dialog box will search for files of the type specified in the Custom script drop-down list box.

Clear

Click to clear the custom script contents.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management


Configuration Item Properties: Applicability Tab

Use the Applicability tab of the Configuration Manager 2007 configuration item properties to specify the Windows platforms that are applicable to the application configuration item or the general configuration item. For example, if you specify only All x86 Windows XP, then a computer running Windows Vista would not include this configuration item in its compliance evaluation.

This tab contains the following elements:

All Windows platforms

Specifies that this application configuration item is applicable to all Windows platforms and will therefore be evaluated for compliance by all targeted client computers.

Specified Windows platforms

Specifies that this configuration item is applicable to only the selected Windows platforms and therefore client computers running these Windows platforms only will evaluate this configuration item for compliance.

This application runs on 64-bit computers only

Specifies that this configuration item is applicable to only those computers running 64-bit Windows platforms and therefore client computers running these platforms only will evaluate this configuration item for compliance.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management


Configuration Item Properties: Relationships Tab

Use the Relationships tab of the Configuration Manager 2007 configuration item properties to view which configuration baselines include this configuration item in its rules and to view any parent or child relationships with other configuration items.

Configuration baseline table

Displays the Name, Description, Status, Version, and Categories of any baselines that include the selected configuration item in their baseline rules.

Configuration item table

Displays any child or parent relationship that this configuration item has with other configuration items.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management


Setting Properties

The Configuration Manager 2007 settings properties dialog box displays information about a setting within a configuration item. To view and edit the setting properties, select the setting on the configuration item properties Settings tab, and click Edit.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Configuration Item Setting: General Tab

  • Specifies the name and description of the settings that display in the Configuration Manager 2007 administrator console, and defines values for the setting which will be used to determine compliance on client computers.
  • XML Query Setting Properties: General Tab
  • WQL Query Setting Properties: General Tab
  • SQL Query Setting Properties: General Tab
  • Script Setting Properties: General Tab
  • Registry Setting Properties: General Tab
  • Active Directory Domain Services Setting Properties: General Tab
  • IIS Metabase Setting Properties: General Tab
Setting Properties: Validation Tab

Specifies the validation criteria for the setting, and whether to raise a noncompliance event of the specified severity if the specified instance count rule fails.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management
About Validation Criteria in Desired Configuration Management
Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management

Other Resources

How to Configure Configuration Items for Desired Configuration Management


XML Query Setting Properties: General Tab

Use the General tab of the Configuration Manager 2007 XML Query Setting Properties dialog box to define an XML query that will be used to assess compliance on client computers.

Note
For more information about using XPath queries, visit the XPath reference web page (http://go.microsoft.com/fwlink/?LinkId=90948).

This tab contains the following elements:

Display name

Specifies a name for the XML query setting you will see in the Configuration Manager 2007 administrator console.

Description

Specifies a description for the XML query setting. The description should give an overview of the XML query setting and other relevant information that helps identify it among other XML query settings.

Path

Specifies the path to the XML file on all client computers that will be used to assess compliance. Configuration Manager 2007 supports the use of all Windows system environment variables and the %USERPROFILE% user variable in the path name.

XML file name

Specifies the file name containing the XML query that will be used to assess compliance on client computers.

XPath query

Specifies a valid full XML path language (XPath) query that will be used to assess compliance on client computers.

Name pattern search depth

Specifies the folder depth to which XML file name searches will be performed.

Specified Path specifies that the search for the specified XML file will only be performed in the specified path. The exact XML file name must be specified.

Specified path (pattern) specifies that the search for the specified XML file will only be performed in the specified path. When using this option, you must use wildcards in the XML file name.

Specified path and all subfolders specifies that searches for the specified XML file will be performed in the specified path and all folders below this path in the folder tree. When using this option, you must use wildcards in the XML file name.

Is this file associated with a 64-bit application?

Specifies whether the 64-bit system file location (%windir%\system32) should be searched in addition to the 32-bit system file location (%windir%\syswow64) on Configuration Manager 2007 clients running a 64-bit version of Windows.

  • No specifies that only the 32-bit system file location will be searched on clients running a 32-bit version of Windows or a 64-bit version of Windows.
  • Yes specifies that both the 32-bit and 64-bit registry keys will be searched on clients running a 64-bit version of Windows.
Note
It is possible that the same file could exist in both the 64-bit and 32-bit system file locations on the same 64-bit computer, which will result in desired configuration management finding multiple XML files.

Namespaces

Opens the Define XML Namespaces dialog box to identify namespaces and prefixes to be used during the XPath query.

Open

Opens a browse dialog box to select a text file that contains the XML query and add its contents to the XPath query edit box.

Clear

Clears the contents of the edit box.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Overview of Desired Configuration Management


WQL Query Setting Properties: General Tab

Use the General tab of the Configuration Manager 2007 WQL Query Setting Properties to define your own name and description of this setting, and to define the WQL query that will be used to assess compliance on client computers.

This tab contains the following elements:

Display name

Specifies the name of the WQL query setting you will see in the Configuration Manager 2007 Administrator console.

Description

Specifies the description for the WQL query setting. The description should give an overview of the WQL query setting and other relevant information that helps identify it among other WQL query settings.

Namespace

Specifies the WMI namespace which will be used to build a WQL query that will be assessed for compliance on client computers. The default value is Root\default.

Class

Specifies the WMI class which will be used to build a WQL query that will be assessed for compliance on client computers.

Property

Specifies the WMI property which will be used to build a WQL query that will be assessed for compliance on client computers.

WQL query WHERE clause

You can use the WQL query WHERE clause item to specify a WHERE clause to be applied to the specified namespace, class and property on client computers.

Note
The word WHERE is automatically inserted into the string.

Example: name="ccm"

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Overview of Desired Configuration Management


SQL Query Setting Properties: General Tab

Use the General tab of the Configuration Manager 2007 SQL Query Setting Properties to define your own name and description of this setting, and to define the SQL query that will be used to assess compliance on client computers.

This tab contains the following elements:

Display name

Specifies the name of the SQL query setting you will see in the Configuration Manager 2007 Administrator console.

Description

Specifies the description for the SQL query setting. The description should give an overview of the SQL query setting and other relevant information that helps identify it among other SQL query settings.

Use default instance

Specifies that the SQL query should be run against the default instance of Microsoft SQL Server that is running on the client computer.

All instances

Specifies that the SQL query should be run against all instances of Microsoft SQL Server that are running on the client computer.

Instance name

Specifies that the SQL query should be run against the specified named instance of Microsoft SQL Server that is running on the client computer.

Note
The instance name must refer to a local instance of SQL Server. To refer to a clustered SQL server instance, you should use a script setting.

Database

Specifies the name of the Microsoft SQL Server database against which the SQL query will be run.

Column

Specifies the column name returned by the T-SQL statement that will be used to assess compliance.

T-SQL statement

Specifies the full SQL query in an edit box for the SQL query.

Open

Opens a browse dialog box to select a file with a .SQL extension that contains the SQL query and add its contents to the edit box.

Clear

Clears the contents of the edit box.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Overview of Desired Configuration Management


Script Setting Properties: General Tab

Use the General tab of the Configuration Manager 2007 Script Setting Properties to define your own name and description of this setting, and to define the script that will be used to assess compliance on client computers.

Note
The output from the specified script is used to determine compliance.

This tab contains the following elements:

Display name

Specifies the name of the script setting you will see in the Configuration Manager 2007 Administrator console.

Description

Specifies the description for the script setting. The description should give an overview of the script setting and other relevant information that helps identify it among other script settings.

Script language

Specifies the scripting language used for the script with choices being VBScript, JScript, and PowerShell.

Script

Allows you to edit the script that will be used to assess compliance on client computers. You can also use this box to input new script items.

Open

Opens a browse dialog box to select a file that contains the required script and display its contents in the Script box. The file must be of the type VBScript, JScript, or PowerShell.

Clear

Clears the contents of the edit box.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Overview of Desired Configuration Management


Registry Setting Properties: General Tab

Use the General tab of the Configuration Manager 2007 Registry Setting Properties to define your own name and description of this setting, and to define the registry key setting that will be used to assess compliance on client computers.

Important
Configuration Manager 2007 does not support the validation of environment variables (REG_EXPANDSX values) in registry settings. If an environment variable is found in a registry key value, this will be treated as a literal string, and not expanded to its full value.

This tab contains the following elements:

Display name

Specifies the name of the registry key setting you will see in the Configuration Manager 2007 Administrator console.

Description

Specifies the description for the registry key setting. The description should give an overview of the registry key setting and other relevant information that helps identify it among other registry key settings.

Hive

Specifies the hive for the registry key that will be used to assess compliance on client computers. The following values are available:

  • HKEY_LOCAL_MACHINE
  • HKEY_CLASSES_ROOT
  • HKEY_CURRENT_USER
  • HKEY_USERS
  • HKEY_CURRENT_CONFIG
Key

Specifies the registry key name that will be used to assess compliance on client computers. The format used should be key\subkey.

Value name

Specifies the registry key value name or .Net regular expression that will be used to assess compliance on client computers.

Note
Configuration Manager 2007 does not currently support the detection of blank values in the registry key value name.

The value name is a .Net regular expression

Specifies whether the value entered in the Value name field is a registry value or a .Net regular expression.

Is this registry key associated with a 64-bit application?

Specifies whether the 64-bit registry keys should be searched in addition to the 32-bit registry keys on Configuration Manager 2007 clients running a 64-bit version of Windows.

  • No specifies that only the 32-bit registry keys will be searched on clients running a 32-bit version of Windows or a 64-bit version of Windows.
  • Yes specifies that both the 32-bit and 64-bit registry keys will be searched on clients running a 64-bit version of Windows.
    Note
    It is possible that the same registry key could exist in both the 64-bit and 32-bit registry locations on the same 64-bit computer, which will result in desired configuration management finding multiple registry objects.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Overview of Desired Configuration Management


Active Directory Domain Services Setting Properties: General Tab

Use the General tab of the Configuration Manager 2007 Active Directory Domain Services Setting Properties to define your own name and description of this setting, and to define the Active Directory Domain Services setting that will be used to assess compliance on client computers.

This tab contains the following elements:

Display name

Specifies the name of the Active Directory Domain Services setting you will see in the Configuration Manager 2007 administrator console.

Description

Specifies the description for the Active Directory Domain Services setting. The description should give an overview of the Active Directory Domain Services setting and other relevant information that helps identify it among other Active Directory Domain Services settings.

LDAP prefix

Specifies a valid LDAP prefix to the Active Directory Domain Services query to assess compliance on client computers. You can use either LDAP:// or GC://.

Distinguished Name (DN)

Specifies the distinguished name of the Active Directory Domain Services object that will be assessed for compliance on client computers.

LDAP filter

Specifies an optional LDAP filter to refine the results from the Active Directory Domain Services query to assess compliance on client computers.

Search scope

Specifies the search scope in Active Directory Domain Services:

  • Specified path queries only the object specified.
  • Specified path and the first level of subfolders This option is not used in this version of Configuration Manager 2007.
  • Specified path and all subfolders queries the object specified and its complete subtree in the directory.
Property

Specifies the property of the Active Directory Domain Services object that will be used to assess compliance on client computers.

Query

Displays the LDAP query constructed from the entries in LDAP Prefix, Distinguished Name, LDAP Filter (if present) and Property, which will be used to assess compliance on client computers.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Overview of Configuration Manager Client Deployment


IIS Metabase Setting Properties: General Tab

Use the General tab of the Configuration Manager 2007 IIS Metabase Setting Properties to define your own name and description of this setting, and to define the IIS Metabase setting that will be used to assess compliance on client computers.

This tab contains the following elements:

Display name

Specifies the name of the IIS Metabase setting you will see in the Configuration Manager 2007 Administrator console.

Description

Specifies the description for the IIS Metabase setting. The description should give an overview of the IIS Metabase setting and other relevant information that helps identify it among other IIS Metabase settings.

Metabase path

Specifies a valid path for the IIS Metabase setting.

Property ID

Specifies the numeric property of the IIS Metabase setting.

Note
For more information about IIS Metabase properties, visit the Metabase Property Reference Web page (http://go.microsoft.com/fwlink/?LinkId=80045).

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Overview of Desired Configuration Management


Setting Properties: Validation Tab

Topic last updated -- November 2007

Use the Validation tab of the Configuration Manager 2007 setting properties dialog box to configure how the setting should be validated.

This tab contains the following elements:

Data Type

Specifies the data type of the setting, which can be one of the following::

  • String
  • Date / Time
  • Integer
  • Floating Point
  • Version
Important
When specifying the Version data type, you must ensure that the version value on client computers that you are evaluating is in the form major version.minor version. If the value returned from the client computer is a single digit, then the setting will always report compliance.

Details

Specifies the list of validation criteria, which has the following properties:

  • Name
  • Severity
  • Validation
  • Description
New

Opens the Configure Validation dialog box for you to name the validation, configure the criteria, and specify the severity level for non-compliance.

Edit

Opens the Configure Validation dialog box so you can view and edit the selected validation.

Remove

Removes the selected validation.

Report a non-compliance event when this instance count fails

If this box is checked, a noncompliance event of the specified severity will be recorded when the number of instances of an object or setting are not in the range specified.

Instance count operator

Use to validate the number of instances of an object or setting. Specify one of the following operators:

  • Equals
  • Not Equals
  • Greater Than
  • Greater than or equal to
  • Less Than
  • Less than or equal to
  • Between
  • One Of (specify values separated by spaces)
  • None Of (specify values separated by spaces)
The default value is Greater Than.

Values

Specifies the value to use with the selected operator. The default value is 0.

AND

Specifies an additional value to use with the selected operator. This option is only available if the operator is set to Between.

Severity

Specifies the severity level if this configuration setting instance count fails. This severity level will be displayed in conjunction with the non-compliance status and can report as a Windows event, which will be logged to the Windows application event log. Note that monitoring software such as Microsoft Operations Management (MOM) can be used to monitor the severity level for client computers out of compliance.

For more information, see About the Non-Compliance Severity Level in Desired Configuration Management.

Available severity levels:

  • Information - no Windows event messages Client computers that fail this instance count will not raise Windows events to record this event but will still report a non-compliance status in Configuration Manager 2007.
  • Information Computers that fail this instance count rule will raise the Windows event type of Informational. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
  • Warning Computers that fail this instance count will raise the Windows event type of Warning. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
  • Error Computers that fail this instance count will raise the Windows event type of Error. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Validation Criteria in Desired Configuration Management
About the Non-Compliance Severity Level in Desired Configuration Management


Object Properties

The Configuration Manager 2007 object properties dialog box displays information about an object within a configuration item. To view and edit the object properties, select the object on the configuration item properties Objects tab, and click Edit.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Assembly Object Properties: General Tab

Specifies parameters for an assembly object.

File or Folder Object Properties: General Tab

Specifies parameters for a file or folder object.

Registry Key Object Properties: General Tab

Specifies parameters for a registry key object.

Object Properties: Validation Tab

Specifies the validation criteria for the object and whether to raise a non-compliance event of the specified severity if the specified instance count rule fails.

Object Properties: Permissions Tab

Specifies the configuration of the access control list for registry key or file and folder objects.

Object Properties: Attributes Tab

Specifies if and how attributes are specified for registry key or file and folder objects.

See Also

Concepts

About Configuration Items in Desired Configuration Management
About Validation Criteria in Desired Configuration Management
Step-by-Step Guide to Authoring Configuration Items in Desired Configuration Management

Other Resources

How to Configure Configuration Items for Desired Configuration Management


Assembly Object Properties: General Tab

Use the General tab of the Configuration Manager 2007 Assembly Properties dialog box to define your own name and description for this assembly object that will be assessed for compliance.

This tab contains the following elements:

Assembly name

Specifies the name of the assembly object you will see in the Configuration Manager 2007 administrator console. The name cannot be the same as other assembly objects of the same type and must be registered in the Global Assembly Cache. The assembly name can be up to 256 characters long.

Note
An assembly is a piece of code that can be shared between applications. Assemblies can have the file extension .dll or .exe. The Global Assembly Cache is a folder named %systemroot%\assembly on client computers where all shared assemblies are stored.

Description

Specifies the description for the assembly object. The description should give an overview of the assembly object and other relevant information that helps identify it among other objects. The description can be up to 256 characters long.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New Configuration Item in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management
About the Non-Compliance Severity Level in Desired Configuration Management


File or Folder Object Properties: General Tab

Use the General tab of the Configuration Manager 2007 File or Folder Properties to define your own name and description for the file or folder object that will be assessed for compliance.

This tab contains the following elements:

Type

Specifies whether the object is a file or folder.

Path

Specifies the path to the specified file or folder on client computers. You can specify system environment variables and the %USERPROFILE% environment variable in the path.

Note
If you use the %USERPROFILE% environment variable in the Path or File or folder name fields, all user profiles on the client computer will be searched, which could result in multiple instances of the file or folder being found.

File or folder name

Specifies the name of the file or folder object that will be assessed for compliance. You can specify system environment variables and the %USERPROFILE% environment variable in the file or folder name. You can also use the wildcards * and ? in the filename.

Note
Specifying a file or folder name with wildcards may produce large numbers of results when the configuration baseline is assessed on client computers. This could result in high resource use on the client computer and also high network traffic when reporting non-compliance details to the Configuration Manager 2007 site server.

If the name pattern search depth used is Specified path, you cannot use wildcard characters in the file or folder name. If the name pattern search depth used is Specified path and the first level of subfolders, or Specified path and all subfolders, you must use wildcard characters in the file or folder name.

Name pattern search depth

Specifies the folder depth to which file and folder name searches will be performed.

  • Specified Path specifies that searches for file and folder objects will only be performed in the specified path. The exact file or folder name must be specified.
  • Specified path (pattern) specifies that searches for file and folder objects will only be performed in the specified path. When using this option, you must use wildcards in the file or folder name.
  • Specified path and all subfolders specifies that searches for file and folder objects will be performed in the specified path and all folders below this path in the folder tree. When using this option, you must use wildcards in the file or folder name.
Description

Specifies the description for the file or folder object. The description should give an overview of the file or folder object and other relevant information that helps identify it among other objects.

Is this file or folder from a 64-bit application?

Specifies whether the 64-bit system file location (%windir%\system32) should be searched in addition to the 32-bit system file location (%windir%\syswow64) on Configuration Manager 2007 clients running a 64-bit version of Windows.

  • No specifies that only the 32-bit system file location will be searched on clients running a 32-bit version of Windows or a 64-bit version of Windows.
  • Yes specifies that both the 32-bit and 64-bit registry keys will be searched on clients running a 64-bit version of Windows.
    Note
    It is possible that the same file or folder could exist in both the 64-bit and 32-bit system file locations on the same 64-bit computer, which will result in desired configuration management finding multiple file or folder objects.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New Configuration Item in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management
About the Non-Compliance Severity Level in Desired Configuration Management


Registry Key Object Properties: General Tab

Use the General tab of the Configuration Manager 2007 Registry Key Properties dialog box to specify the registry key that will be assessed for compliance.

This tab contains the following elements:

Hive

Specifies the hive for the registry key. The default value is HKEY_LOCAL_MACHINE.

Available hives:

  • HKEY_LOCAL_MACHINE
  • HKEY_CLASSES_ROOT
  • HKEY_CURRENT_USER
  • HKEY_USERS
  • HKEY_CURRENT_CONFIG
Key

Specifies the registry key name as it appears in a registry editor, for example Software\Microsoft\Internet Explorer.

Is this registry key associated with a 64-bit application?

Specifies whether the 64-bit registry keys should be searched in addition to the 32-bit registry keys on Configuration Manager 2007 clients running a 64-bit version of Windows.

No specifies that only the 32-bit registry keys will be searched on clients running a 32-bit version of Windows or a 64-bit version of Windows.

Yes specifies that both the 32-bit and 64-bit registry keys will be searched on clients running a 64-bit version of Windows.

Note
It is possible that the same registry key could exist in both the 64-bit and 32-bit registry locations on the same 64-bit computer, which will result in desired configuration management finding multiple registry objects.

Report a non-compliance event when this instance count fails

If this box is selected, a non-compliance event of the specified severity will be recorded when the number of instances of an object or setting are not in the range specified.

Instance count operator

Use to validate the number of instances of an object or setting. Specify one of the following operators:

  • Equals
  • NotEquals
  • GreaterThan
  • LessThan
  • GreaterThanOrEquals
  • LessThanOrEquals
  • Between
  • One Of
  • None Of
Values

Specifies the value to use with the selected operator.

AND

Specifies an additional value to use with the selected operator. This option is only available if the operator is set to Between.

Severity

Specifies the severity level if this registry key object instance count fails. This severity level will be displayed in conjunction with the non-compliance status and can report as a Windows event, which will be logged to the Windows application event log. Note that monitoring software such as Microsoft Operations Management (MOM) can be used to monitor the severity level for client computers out of compliance.

For more information, see About the Non-Compliance Severity Level in Desired Configuration Management.

Available severity levels:

  • Information - no Windows event messages Client computers that fail this instance count will not raise Windows events to record this event but will still report a non-compliance status in Configuration Manager 2007.
  • Information Computers that fail this instance count will raise the Windows event type of Informational. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
  • Warning Computers that fail this instance count will raise the Windows event type of Warning. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
  • Error Computers that fail this instance count rule raise the Windows event type of Error. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New Configuration Item in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management
About the Non-Compliance Severity Level in Desired Configuration Management


Object Properties: Validation Tab

Topic last updated -- November 2007

Use the Validation tab of the Configuration Manager 2007 Assembly Properties dialog box or File or Folder Properties dialog box to configure the validation criteria for the object.

Note
The validation tab is not included in the Registry Properties dialog box.

The list of validation criteria is displayed with the following properties:

  • Name
  • Severity
  • Property
  • Validation

This tab contains the following elements:

New

Allows you to choose the property against which the object will be validated and then opens the Configure Validation dialog box.
For assembly objects the following properties are available:

  • Version: The version of the assembly file in the form major version.minor version.build number.revision number.
  • Culture: The locale of the assembly, for example, enu.
  • Public Key Token:
For file or folder objects, the following properties are available:

  • Size: (can be used for files only) Specifies the size of the file in Bytes.
  • Product name: (can be used for files only) Specifies the product name.
  • File Version: (can be used for files only) Specifies the version number of the file in the form major version.minor version.
  • Date Modified: Specifies the date and time in coordinated universal time (UTC) when the file or folder was last modified. Use the form M/D/YYYY HH:MM:SS.
  • Date Created: Specifies the date and time in coordinated universal time (UTC) when the file or folder was created. Use the form M/D/YYYY HH:MM:SS.
  • Company: (can be used for files only) Specifies the company name contained in the file.
  • SHA-1 Hash: Specifies the SHA-1 hash value of the file.
Important
When specifying the file version, you must ensure that the file version on client computers that you are evaluating is in the form major version.minor version. If the value returned from the client computer is a single digit, then the object will always report compliance.

Edit

Opens the Configure Validation dialog box so that you can view and edit the object's validation.

Delete

Deletes the selected validations for the object.

Report a non-compliance event when this instance count fails

If this box is checked, a non-compliance event of the specified severity will be recorded when the number of instances of an object or setting are not in the range specified.

Instance count operator

Use to validate the number of instances of an object or setting. Specify one of the following operators:

  • Equals
  • Not Equals
  • Greater Than
  • Greater than or equal to
  • Less Than
  • Less than or equal to
  • Between
  • One Of (specify values separated by spaces)
  • None Of (specify values separated by spaces)
The default value is Greater Than.

Values

Specifies the value to use with the selected operator. The default value is 0.

AND

Specifies an additional value to use with the selected operator. This option is only available if the operator is set to Between.

Severity

Specifies the severity level if this configuration object instance count fails. This severity level will be displayed in conjunction with the non-compliance status and can report as a Windows event, which will be logged to the Windows application event log. Note that monitoring software such as Microsoft Operations Management (MOM) can be used to monitor the severity level for client computers out of compliance.

For more information, see About the Non-Compliance Severity Level in Desired Configuration Management.

Available severity levels:

  • Information - no Windows event messages Client computers that fail this instance count will not raise Windows events to record this event but will still report a non-compliance status in Configuration Manager 2007.
  • Information Computers that fail this instance count will raise the Windows event type of Information. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
  • Warning Computers that fail this instance count will raise the Windows event type of Warning. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
  • Error Computers that fail this instance count will raise the Windows event type of Error. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New Configuration Item in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Validation Criteria in Desired Configuration Management


Object Properties: Permissions Tab

Use the Permissions tab of the Configuration Manager 2007 Assembly Properties dialog box or File or Folder Properties dialog box to configure if and how Windows security permissions will be included in the validation for the object's compliance.

Note
You cannot add new permissions to a child configuration item.

This tab contains the following elements:

Include permissions

Specifies whether Windows security permissions will be included in the object's validation.

Exclusive

Specifies that only those Windows groups or users in the group or user name list can have access to the object and must have the permissions specified in the Permissions list. If other Windows users or groups have permissions to the object, or if the specified Windows Users or groups have different permissions to those in the Permissions list, then the object will report a non-compliance status.

Non-exclusive

Specifies that Windows groups or users in the group or user name list must have by minimum the security rights shown in the Permissions list to be reported as compliant. If other Windows groups or users have access to this object, they will not be included when assessing this object for compliance.

Group or user name:

Displays a list of Windows user account or group names that will be included when assessing compliance for this object and whether the user or group is configured with allow or deny security permissions to the object.

Add

Opens the Enter Group or User Name dialog box to specify the Windows security group or user names to include in the permission validation and whether they will be configured with allow or deny permissions to the object.

Remove

Deletes the selected group or user name so that they will not be included in the permission validation.

Permissions:

Displays the relevant security permissions for the selected group or user name so that you can enable the options for each security permission to include in the validation. Specify the permissions that the user or group will be validated against. Note that some permissions automatically include and exclude others. For example, enabling Read will also automatically enable the Read Attributes permission, and enabling Full Control will enable all permissions in the list.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New Configuration Item in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console


Object Properties: Attributes Tab

Use the Attributes tab of the Configuration Manager 2007 File or Folder Properties dialog box to configure if and how file or folder attributes will be included in the validation for the object's compliance.

Note
When a child configuration item inherits a file or folder object from a parent configuration item, any specified attributes will be read only.

This tab contains the following elements:

Choose the attributes to be verified on this file or folder object.

You can specify which file or folder attributes to assess for compliance by choosing one of the following options for each attribute.

  • On To be assessed as compliant, the selected attribute must be set on the file or folder.
  • Off To be assessed as compliant, the selected attribute must not be set on the file or folder.
  • Do not verify The selected attribute will not be assessed for compliance.
The following file or folder attributes can be assessed for compliance:

  • Archive
  • Compressed
  • Encrypted
  • Hidden
  • Read Only
  • System
Severity

Specifies the severity value if validation fails on client computers. This severity level will be displayed in conjunction with the non-compliance status.

Available severity levels:

  • Information - no Windows event messages: Client computers that are out of compliance with this validation will record a severity status of None in conjunction with their non-compliance status.
  • Information: Client computers that are out of compliance with this validation will record a severity level of Informational in conjunction with their non-compliance status.
  • Warning: Client computers that are out of compliance with this validation will record a severity level of Warning in conjunction with their non-compliance status.
  • Error: Client computers that are out of compliance with this validation will record a severity level of Error in conjunction with their non-compliance status.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New Configuration Item in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console


Queries Property Pages

In This Section

Queries Properties

Query Name Properties

Query Statement Properties

Query Result Properties: General Tab

Criterion Properties: General Tab

Attribute Class Join Properties: General Tab

Query Properties Dialog Box: General Tab


Queries Properties

In This Section

Queries Properties: General Tab

See Also

Reference

Properties - Security Tab


Queries Properties: General Tab

Use this tab to limit the number of query result items that are returned. Some queries might be broad enough and some Microsoft System Center Configuration Manager 2007 sites might be large enough that running a query might require a long period of time while consuming site system site system resources. Limiting the number of items that are returned can help reduce the amount of time required to run a query. This can be especially helpful when testing queries.

The value entered on this tab applies to all the queries that are listed in the Configuration Manager 2007 console under Queries; however, you can override this value by selecting Run Query Special, rather than Run Query. In this case, you will be prompted to modify this value by using the Run Query Special dialog box.

Limit number of query result items

Causes Configuration Manager 2007 to stop executing the query after the specified number of objects are found.

Limit

The maximum number of items that Configuration Manager 2007 will return for queries. By default, this value is 2,000.

Note
To display all resources for each query in the results pane, enter 0 in the Limit box.

See Also

Concepts

Overview of Queries
How to Run a Query Special


Query Name Properties

In This Section

Query Name Properties: General Tab

Use this tab to specify the general properties for the query that you want to run.


Query Name Properties: General Tab

Use this tab to specify the general properties for the query that you want to run. You can edit the query statement by clicking Edit Query Statement.

Name

To specify a new query, type a unique name that identifies the query. You can use up to 127 characters. To specify an existing query, click Browse, which opens the Browse Query dialog box.

Comment

An optional comment that describes the query.

Import Query Statement

Click to open the Import Statement Properties dialog box, which you can use to import the query statement properties.

Object type

Select an object type to query. An object type is a set of related attribute classes. A query can search against only one object type at a time.

Edit Query Statement

Click to open the Query Statement Properties dialog box, which you can use to edit the query statement properties.

Collection limiting

Specify if and how queries are limited to collections. This applies only to the following object types: System Resource, User Resource, and User Group Resource.

Not collection limited

The query is not limited to a specific collection.

Limit to collection

The query is limited to a specific collection. Type the collection name or click Browse to locate and select a collection in the Browse Collection dialog box.

Prompt for collection

Administrators who want to run the query will be prompted to specify the collection to limit the query to.

Note
You cannot limit a query to more than one collection using this feature.

See Also

Reference

Browse Query Dialog Box

Concepts

Overview of Queries
Browse Collection Dialog Box
About Collections
About Object Types


Query Statement Properties

In This Section

Query Statement Properties: Query Language Tab

Query Statement Properties: General Tab

Query Statement Properties: Criteria Tab

Query Statement Properties: Joins Tab


Query Statement Properties: Query Language Tab

Topic Last Updated—August 2008

Use this tab to work in the Query Language view. You can work in the Query Language view to compose or edit a query manually by using WBEM Query Language (WQL) commands. For more information about WQL, see the Configuration Manager 2007 software development kit (SDK).

Caution
Use the Query Language view only if you have a good working knowledge of WQL. If you enter a query that is not valid (for example, one that is not syntactically correct), you will get an error message. If the query statement that you edit uses features of WQL that are not supported in design view, you cannot return to design view. However, you can still save and run the query.

Query statement

Displays the query syntax. To edit the query, press ALT+Q. As many as 4,096 characters are allowed.

Show Query Design

Click to return to design view.

Note
If you select only a portion of a clause in a query that has multiple clauses, the Delete button is disabled. Select the entire clause.

Caution
When creating a new collection with an 'Unknown Computer' resource class, the power builder screen will not open. Instead, the query is displayed and must be edited using WQL.


Query Statement Properties: General Tab

Use this tab to specify the attributes that are returned in the query results and to determine how the results are displayed in the results pane of the Microsoft System Center Configuration Manager 2007 console.

Note
Site database queries are different from status message queries. When creating status message queries, use the status message query builder. Do not paste text from a standard Configuration Manager 2007 query into a status message query.

Find objects of type

Displays the object type that the query searches against.

Omit duplicate rows

When the query is run, duplicate results are omitted when the results are displayed. Only one instance of each result is displayed.

Results

The attributes that are returned in the query results. You can use the buttons in this table to add, modify, or delete query result attributes and to modify how the query results are ordered in columns and are sorted.

New button

Click to open the Query Result Properties dialog box, which you can use to add a new query result attribute.

Properties button

Click to open the Query Result Properties dialog box, which you can use to modify the properties of a query result attribute.

Delete button

Click to remove a query result attribute from the query criteria in the table.

Move up button

Click to move a query result attribute up one line in the table.

Note
The top-to-bottom order of the attributes in the Query result attributes table reflects the left-to-right order in which they are displayed in the query results columns when the query is run. In other words, the top attribute in the table appears in the leftmost query results column and the bottom attribute in the table appears in the rightmost query results column. For more information about how query results are displayed, see About Displaying Query Results.

Move down button

Click to move a query result attribute down one line in the table.

Class

The attribute class for the query result attribute. (An attribute class groups related attributes.)

Attribute

The query result attribute.

Sort

The sort order for the query result attribute.

Show Query Language

Opens the Query Statement Properties dialog box to display the query in the Query language view. You can work in the Query Language view to compose or edit a query manually by using WBEM Query Language (WQL) commands.

See Also

Concepts

About Attribute Class Joins
About Displaying Query Results

Other Resources

Query Statement Properties


Query Statement Properties: Criteria Tab

Use this tab to refine the results of a Microsoft System Center Configuration Manager 2007 query.

Criteria

Displays the criteria expression, with one criterion per line and nested terms indented. You can use this table to view, add, modify, or delete query criteria. Also, you can change the order of the criteria, group elements in a criteria statement, and modify query operators.

New button

Click to open the General tab in the Criterion Properties dialog box, which you can use to add a new query criterion. If the Criteria table is not empty, the criterion will be included with the currently selected expression. If nothing is selected, the criterion will not be included with the last expression in the table.

Modify button

Click to open the General tab in the Criterion Properties dialog box, which you can use to modify the properties of a query criterion.

Delete button

Click to remove the selected criterion from the query criteria.

Note
If you select only a portion of a clause in a query that has multiple clauses, the Delete button is disabled. Select the entire clause.

Group button

Click to group the selected elements of the query statement. Group Parentheses are inserted around the selected statement.

Note
When you reopen a query, the parentheses disappear. However, the query's behavior remains the same; click Show Query Language to see that the parentheses are still in the actual WBEM Query Language (WQL) statement.

Ungroup button

Click to ungroup the selected elements of the query statement. The group parentheses are removed from the selected statement. Also, you can select and remove a single group parenthesis, and the matching group parenthesis will also be removed.

Note
There are two ways to remove invisible parentheses:

  • Click Show Query Language, and then edit the WQL statement.
  • Click the group button to add the parentheses again, and then remove them by clicking the ungroup button again.
Change operator button

Click to change a selected OR in the criteria to an AND, and vice versa. For more information about logical operators, see About Logical Operators.

NOT button

Click to add a NOT operator to the query criteria. You must select the elements of the query statement to which you want to apply this operator. The selected portion of the query statement that is enclosed in group parentheses and the NOT operator are added to the preceding line. You can also use this button to remove a selected NOT operator (the group parentheses are removed automatically).

Show Query Language

Opens the Query Statements dialog box to display the query in the Query Language view. You can work in the Query Language view to compose or edit a query manually by using WQL commands.

See Also

Tasks

How to Modify How Query Results Are Displayed

Concepts

Overview of Queries
About Query Elements
Criterion Properties: General Tab
About Group Parentheses
About Logical Operators and Operator Precedence


Query Statement Properties: Joins Tab

Use this tab to combine attributes from two different attribute classes with a join operation. For more information about configuring join operations, see About Configuring Attribute Class Joins.

Note
Join operations are configured automatically on both the General tab and the Criteria tab when you add attributes from more than one attribute class to the query. In this case, you can use the Joins tab to modify the properties of the join.

Caution
Join operations are an advanced function of Microsoft SQL Server. Before configuring or modifying a join operation, you must have a good working knowledge of the Structured Query Language (SQL) syntax that is needed to create various types of table joins. For more information about join operations, see your SQL Server documentation.

Attribute class joins

Displays the attributes and attribute classes that are part of the query and indicates whether they are joined. You can use this table to combine attribute classes by creating a new join operation or by modifying the attributes of an existing join operation.

New button

Click to open the Attribute Class Join Properties dialog box, which you can use to join a new attribute class to the selected attribute class. The selected attribute class is the base attribute class. The base attribute class is an attribute class, which you have already added to the query, to which you want to join another attribute class. The new class that is joined becomes a child of the selected attribute class in the tree.

Modify button

Click to open the Attribute Class Join Properties dialog box, which you can use to modify the join properties of a selected attribute class. The child attribute class must be selected.

Delete button

Click to remove a selected attribute class and all of its subclasses from the query criteria. If the selected class or any of its subclasses are used by any result attributes of the query criteria, you will be prompted to confirm whether you want the result attributes or criteria to be deleted from the query.

Show Query Language

Opens the Query Statements dialog box to display the query in the Query Language view. You can work in the Query Language view to compose or edit a query manually by using WBEM Query Language (WQL) commands.

See Also

Concepts

About Attribute Class Joins
Overview of Queries
About Query Elements
About Attribute Class Joins
Attribute Class Join Properties: General Tab
About Attributes and Attribute Classes


Query Result Properties: General Tab

Use this tab to view, add, or modify a query result attribute and to determine whether query results for this attribute are sorted. You can also determine in what order the query results are sorted.

Attribute

Displays the attribute class, optional alias, and attribute for this query result. Click Select to specify an attribute.

Select

Opens the Select Attribute dialog box, which you can use to specify an attribute.

Sort

Selects a sort order for the attribute.

Unsorted

Results are not sorted. This is the default setting.

Ascending

Results are sorted in ascending order.

Descending

Results are sorted in descending order.

Note
Sorting and grouping of array attributes are not supported. If you select any of the following array attributes, then the results data cannot be sorted based on those attributes:

  • Package: Icon
  • Program: Icon
  • System Resource: Agent Name, Agent Site, Agent Time, IP Addresses, IP Subnets, IPX Addresses, IPX Network NUmbers, MAC Addresses, Resource Names, SMS Assigned Sites, SMS Installed Sites, System Roles
  • User Resource: Agent Name, Agent Site, Agent Time, SMS Assigned Sites

See Also

Tasks

How to Modify How Query Results Are Displayed

Concepts

Overview of Queries
About Attributes and Attribute Classes
About the Optional Alias


Criterion Properties: General Tab

Use this Microsoft System Center Configuration Manager 2007 tab to select the criterion types, attribute, operator, and value for the criterion.

Note
The settings that appear on this tab depend on the criterion type that you select from the Criterion type list. The criterion type determines the form that an expression can take.

Criterion type

Specify the criterion type. Your selection will determine the settings that are enabled on this tab.

Null Value

Compares the query attribute to a null value. Null values are unknown. This selection enables the null value settings.

Simple value

Compares the query attribute to a constant value. This selection enables the simple value settings.

Attribute reference

Compares the query attribute to another attribute. This selection enables the attribute reference settings.

Subselected values

Compares the attribute to the results that were returned by another query. This selection enables the subselected values settings.

List of values

Compares the attribute to a list of constant values. This selection enables the list of values settings.

See Also

Tasks

How to Modify How Query Results Are Displayed

Concepts

About Criterion Types
Overview of Queries
About Query Elements


Criterion Properties (Prompted Value Criterion Type)

Use this Microsoft System Center Configuration Manager 2007 dialog box to compare a query attribute with a value to be provided when the query is run.

Where

The attribute class, optional alias, and query attribute for the query result. Click Select to specify the query attribute and attribute class.

Select

Specifies a query attribute and attribute class. Click to open the Select Attribute dialog box.

Operator

The relational operator for this query criterion.

Prompt

The placeholder for the value that will be supplied when the query is run. This field cannot be edited.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Criterion Types
Overview of Queries
About Query Elements
Criterion Properties: General Tab


Criterion Properties (Attribute Reference Criterion Type)

Use this Microsoft System Center Configuration Manager 2007 dialog box to compare a query attribute with another attribute.

Where

The attribute class, optional alias, and query attribute for the query result. Click Select to specify the query attribute and attribute class.

Select

Specifies a query attribute and attribute class. Click to open the select attribute dialog box.

Operator

The relational operator for this query criterion.

Reference

The attribute to which the query attribute, specified earlier, is compared. This field displays the class, optional alias, and attribute for the result. Click Select to specify the query attribute and attribute class.

Select

Specifies a reference attribute. Click to open the select attribute dialog box.

See Also

Concepts

Criterion Properties: General Tab
About Criterion Types
Overview of Queries
About Query Elements


Criterion Properties (Subselected Values Criterion Type)

Use this Microsoft System Center Configuration Manager 2007 dialog box to compare a query attribute with the results of another query.

Where

The attribute class, optional alias, and query attribute for the query result. Click Select to specify the query attribute and attribute class.

Select

Specifies a query attribute and attribute class. Click to open the Select Attribute dialog box.

Operator

The relational operator for this query criterion.

Subselect

The query whose results should be compared with the specified query attribute. Type the query text or click Browse to locate and retrieve a query statement from an existing query.

Browse

Locates and retrieves a query statement from an existing query. Click to open the Browse Query dialog box.

See Also

Concepts

Criterion Properties: General Tab
About Criterion Types
Overview of Queries
About Query Elements


Criterion Properties (List of Values Criterion Type)

Use this Microsoft System Center Configuration Manager 2007 dialog box to compare a query attribute with a list of constant values. An object that matches any of the listed values is returned in the query results.

Where

The class, optional alias, and query attribute for the query result. Click Select to specify the query attribute and attribute class.

Select

Specifies a query attribute and attribute class. Click to open the select attribute dialog box dialog box.

Operator

The relational operator for this query criterion.

Value to add

The value for the query to match for this query criterion. You must first enter a value in this box, and then click Add to add the value to the Values to match list.

You can click Values to enter a value by using the Values dialog box or enter a value in the Value box.

Repeat this process for each value that you want to add.

Values to match

The values that are matched for the query. Objects that match at least one of the values in the list are returned in the query results.

Add

Click to move a value from the Value to add box to the Values to match list.

Remove

Click to remove a selected value from the Values to match list.

See Also

Concepts

Criterion Properties: General Tab
About Criterion Types
Overview of Queries
About Query Elements


Criterion Properties (Null Value Criterion Type)

Use this Microsoft System Center Configuration Manager 2007 dialog box to compare a query attribute with a null value.

Any data type can have a null value, and null values are unknown. Therefore, they are not evaluated as True or False. Dealing with null values requires using three-valued logic (True, False, and Unknown). For example, the expression USER = "ChrisJones" is evaluated as either True or False, unless USER is null, in which case the expression is evaluated as Unknown. For more information, see the SQL Server documentation.

Where

The attribute class, optional alias, and query attribute for the query result. Click Select to specify the query attribute and attribute class.

Select

Specifies a query attribute and attribute class. Click to open the Select Attribute dialog box.

Operator

The relational operator for this query criterion.

See Also

Concepts

Criterion Properties: General Tab
About Criterion Types
Overview of Queries
About Query Elements


Criterion Properties (Simple Value Criterion Type)

Use this Microsoft System Center Configuration Manager 2007 dialog box to compare a query attribute with a constant value.

Where

The attribute class, optional alias, and query attribute for the query result. Click Select to specify the query attribute and attribute class.

Select

Specifies a query attribute and attribute class. Click to open the select attribute dialog box.

Operator

The relational operator for this query criterion.

Value

The valuethat the query matches for this query criterion. All objects with the same value are returned in the query results.

You can click Values to enter a value by using the Values dialog box, or enter a value in the Values box.

See Also

Concepts

Criterion Properties: General Tab
About Criterion Types
Overview of Queries
About Query Elements


Attribute Class Join Properties: General Tab

Use this dialog box to create a new join operation or to modify an existing join operation.

Caution
Join operations are an advanced function of Microsoft SQL Server. Before configuring or modifying a join operation, you must have a good working knowledge of the Structured Query Language (SQL) syntax that is needed to create or modify various types of table joins. For more information about join operations, see your SQL Server documentation.

The Attribute Class Join Properties tab includes the following fields:

Type

Selects the type of join to configure.

Inner

Displays only the matching results.

Left

Displays all the results for the base attribute and only the matching results for the join attribute.

Right

Displays all the results for the join attribute and only the matching results for the base attribute.

Full

Displays all the results for both the base attribute and the join attribute.

Join attribute

Select the attribute to be joined. This attribute will be connected to the base attribute on the Joins tab in the Query Statement Properties dialog box. The base attribute class is the attribute class that you have already added to the query to which you want to join another attribute class. The join attribute becomes a child of the selected attribute class in the tree. Click Select to select an attribute class and attribute.

Select

Click to open the Select Attribute dialog box, which enables you to select an attribute.

Operator

Select the relational operator that will be used in the join. The default operator is "is equal to."

Base attribute

Displays the base attribute class, optional alias, and attribute for the join operation. The attribute class selected in Join attribute, defined earlier, will be joined to this attribute class. You cannot change the base attribute class; however, you can click Select to change the base attribute.

Select

Click to open the Select Attribute dialog box, which you can use to select a different base attribute. The attribute class and optional alias are unavailable (they appear dimmed in the dialog box); you cannot change these.

See Also

Reference

Select Attribute Dialog Box

Concepts

About Attribute Class Joins
Overview of Queries
About Query Elements
About Attribute Class Joins
About Relational Operators
About the Optional Alias


Query Properties Dialog Box: General Tab

Use this tab to specify the general properties for the query that you want to run. You can edit the query statement by clicking Edit Query Statement.

Name

To specify a new query, type a unique name that identifies the query. You can use up to 127 characters. To specify an existing query, click Browse, which opens the Browse Query dialog box.

Comment

An optional comment that describes the query.

Import Query Statement

Click to open the Import Statement Properties dialog box, which you can use to import the query statement properties.

Object type

Select an object type to query. An object type is a set of related attribute classes. A query can search against only one object type at a time.

Edit Query Statement

Click to open the Query Statement Properties dialog box, which you can use to edit the query statement properties.

Collection limiting

Specify if and how queries are limited to collections. This applies only to the following object types: System Resource, User Resource, and User Group Resource.

Not collection limited

The query is not limited to a specific collection.

Limit to collection

The query is limited to a specific collection. Type the collection name or click Browse to locate and select a collection in the Browse Collection dialog box.

Prompt for collection

Administrators who want to run the query will be prompted to specify the collection to limit the query to.

Note
You cannot limit a query to more than one collection using this feature.

See Also

Reference

Browse Query Dialog Box

Concepts

Overview of Queries
Browse Collection Dialog Box
About Collections
About Object Types


Mobile Device Management Property Pages

This section contains the help topics for Mobile Device Management property pages.

In This Section

Configuration Items | Description
Browser Favorite Properties | Specifies the dial-up network configurations that can be distributed to mobile device clients.
Certificate Installation Properties | Specifies the certificate distributed to mobile devices and the store on the device where the certificate is saved.
Dial-up Network Properties | Provides Configuration Manager 2007 password management support for mobile devices that use the Messaging and Security Feature Pack (MSFP).
Exchange ActiveSync (WM03 mode) Properties | Specifies Exchange options to synchronize on the Windows Mobile 2003 mobile device with a desktop computer or server.
Exchange ActiveSync (WM05 mode) Properties | Specifies Exchange options to synchronize on the Windows Mobile 5.0 mobile device with a desktop computer or server.
GPRS Network Properties | Specifies the general packet radio service (GPRS) network options to distribute to mobile devices.
Internet E-mail Properties | Specifies the Internet e-mail settings to configure on the mobile device.
Network Proxy Properties | Specifies the network proxy settings to configure on the mobile device.
Password Policy for MSFP Properties | Specifies the password policies for the messaging and security feature pack (MSFP) to be enforced on the mobile device.
Password Policy for Pocket PC 2003 Properties | Specifies the password policy for the Windows Mobile Pocket PC 2003 mobile device.
Registry Properties | Specifies the registry key, value name, data type, and value to distribute to mobile devices.
Security Policies Properties | Specifies security polices for software installation on the mobile device.
VPN Properties | Specifies the virtual private network (VPN) configurations for the mobile device.
WiFi Settings Properties | Specifies the wireless network connection settings to be configured on the mobile device.
Configuration Package Name Properties | Specifies the properties of the mobile device configuration package.
Configuration Package Program Name Properties | Specifies the properties of the mobile device configuration package program.
Access Account Properties: General Tab (Mobile Device Management) | Specifies the access account properties for mobile device management.
Mobile Device Management Package Status Home Page | Specifies the properties for the mobile device management home page.
Advertisement for Mobile Devices Properties | Specifies the properties for the advertisement for mobile devices.

See Also

Concepts

How to Create Configuration Items for Mobile Devices
How to Create Programs for Mobile Devices

Other Resources

Create Configuration Package Wizard for Mobile Devices


Configuration Items Properties for Mobile Device Management

The following configuration items are available for distribution to mobile devices. Click any link in the following section for detailed information about its associated configuration item.

In This Section

Browser Favorite Properties | Specifies the dial-up network configurations that can be distributed to mobile device clients.
Certificate Installation Properties | Specifies the certificate distributed to mobile devices and the store on the device where the certificate is saved.
Dial-up Network Properties | Provides Configuration Manager 2007 password management support for mobile devices that use the Messaging and Security Feature Pack (MSFP).
Exchange ActiveSync (WM03 mode) Properties | Specifies Exchange options to synchronize on the Windows Mobile 2003 mobile device with a desktop computer or server.
Exchange ActiveSync (WM05 mode) Properties | Specifies Exchange options to synchronize on the Windows Mobile 5.0 mobile device with a desktop computer or server.
GPRS Network Properties | Specifies the general packet radio service (GPRS) network options to distribute to mobile devices.
Internet E-mail Properties | Specifies the Internet e-mail settings to configure on the mobile device.
Network Proxy Properties | Specifies the network proxy settings to configure on the mobile device.
Password Policy for MSFP Properties | Specifies the password policies for the messaging and security feature pack (MSFP) to be enforced on the mobile device.
Password Policy for Pocket PC 2003 Properties | Specifies the password policy for the Windows Mobile Pocket PC 2003 mobile device.
Registry Properties | Specifies the registry key, value name, data type, and value to distribute to mobile devices.
Security Policies Properties | Specifies security polices for software installation on the mobile device.
VPN Properties | Specifies the virtual private network (VPN) configurations for the mobile device.
WiFi Settings Properties | Specifies the wireless network connection settings to be configured on the mobile device.

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

New Mobile Device Configuration Item Wizard


Browser Favorite Properties

The browser favorites configuration item specifies the URL and the name of a browser favorite that can be distributed to mobile device clients.

In This Section

Browser Favorite Properties: General tab

Browser Favorite Properties: Browser Favorite

Browser Favorite Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Browser Favorite Properties: General tab

Use the General tab of the Configuration Manager 2007 mobile device browser favorite properties dialog box to specify the configuration item name and description.

Specify the name and description of the configuration item to be distributed to mobile devices.

The General tab contains the following elements:

Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Browser Favorite Properties: General tab
Browser Favorite Properties: Browser Favorite
Browser Favorite Properties: Security

Other Resources

Configuration Package Name Properties


Browser Favorite Properties: Browser Favorite

Use the Browser Favorite tab of the Configuration Manager 2007 properties dialog box to specify the name and uniform resource locator (URL) to distribute a configuration item to mobile devices.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name displayed in the favorites list of the browser on the mobile device.

URL

Specifies the URL to be distributed as a browser favorite.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Configuration Items Properties for Mobile Device Management


Browser Favorite Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

See Also

Other Resources

Browser Favorite Properties


Certificate Installation Properties

The certificate installation configuration item specifies the certificate distributed to mobile devices and the store on the device where the certificate is saved.

In This Section

Certificate Installation Properties: General

Certificate Installation Properties: Certificate Installation

Certificate Installation Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Certificate Installation Properties: General

Use the General tab of the Configuration Manager 2007 mobile device certificate installation properties dialog box to specify the configuration item name and description.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Certificate Installation Properties: Certificate Installation
Certificate Installation Properties: Security

Other Resources

Certificate Installation Properties


Certificate Installation Properties: Certificate Installation

Use the Certificate Installation tab of the Configuration Manager 2007 configuration item properties dialog box to specify the certificate to be sent to mobile devices and the certificate store where the certificate will be stored.

Specify settings of the certificate to distribute to mobile devices.
Software Publishing Certificate (SPC)

Specifies the distributed certificate is a software publishing certificate (SPC). SPC certificates are stored in the SPC store on the mobile device.

Store

Specifies the distributed SPC certificate will also be stored in the specified store on the mobile device. There are two execution stores: one for unprivileged certificates and one for privileged certificates.

Root

Specifies the certificate should be stored in the root store on the client device.

Intermediate

Specifies the certificate should be stored in the intermediate store on the client device.

Certificate

Specifies the public key infrastructure certificate to be distributed to the mobile devices. Click Browse to select the certificate.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Certificate Installation Properties: General
Certificate Installation Properties: Security

Other Resources

Certificate Installation Properties


Certificate Installation Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Dial-up Network Properties

The dial-up network configuration item specifies the dial-up network configurations that can be distributed to mobile device clients.

In This Section

Dial-up Network Properties: General

Dial-up Network Properties: Dial-up Network

Dial-up Network Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Dial-up Network Properties: General

Use the General tab of the Configuration Manager 2007 mobile device dial-up network properties dialog box to specify the configuration item name and description.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description (Optional)

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Dial-up Network Properties: Dial-up Network
Dial-up Network Properties: Security

Other Resources

Dial-up Network Properties


Dial-up Network Properties: Dial-up Network

Use the Dial-up Network Properties tab of the Configuration Manager 2007 configuration item properties dialog box to specify the dial-up network configuration to distribute to mobile devices.

Name

Specifies the name of the dial-up network displayed on the mobile device.

Connects to

Specifies whether the dial-up network of the mobile device connects to the Internet or a corporate network.

Phone

Specifies the phone number used to establish the dial-up network connection. Do not include non-numeric characters such as dashes or periods in the phone number. For example, use 12065550100 for 1-206-555-0100.

User name

Specifies the user name for authentication on the dial-up network.

Domain

Specifies the domain of the user for authentication.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Dial-up Network Properties: General
Dial-up Network Properties: Dial-up Network
Dial-up Network Properties: Security

Other Resources

Dial-up Network Properties


Dial-up Network Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Exchange ActiveSync (WM03 mode) Properties

The Exchange ActiveSync configuration item specifies the ActiveSync configurations that can be distributed to Windows Mobile 2003 mobile device clients.

In This Section

Exchange ActiveSync (WM03) Properties: General

Exchange ActiveSync (WM03) Properties: Sync

Exchange ActiveSync (WM03) Properties: Calendar/Contacts

Exchange ActiveSync (WM03) Properties: E-mail

Exchange ActiveSync (WM03) Properties: Optional

Exchange ActiveSync (WM03) Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Exchange ActiveSync (WM03) Properties: General

Use the Exchange ActiveSync (WM03) General tab to specify the general properties of the configuration item to distribute to mobile devices. Configuration items are sent to mobile devices using the New Configuration Packages Wizard.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description (Optional)

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM03) Properties: Sync
Exchange ActiveSync (WM03) Properties: Calendar/Contacts
Exchange ActiveSync (WM03) Properties: E-mail
Exchange ActiveSync (WM03) Properties: Optional
Exchange ActiveSync (WM03) Properties: Security

Other Resources

Exchange ActiveSync (WM03 mode) Properties


Exchange ActiveSync (WM03) Properties: Sync

Use the Exchange ActiveSync (WM03) Synchronization tab to specify the sync properties of the configuration item to distribute to mobile devices. Sync properties specify the host Exchange server, how often the client synchronizes Exchange data, and how client-server conflicts are resolved.

  • Specify the settings of the configuration item to be distributed to mobile devices.
Server

Specifies the host name of the Exchange server. Valid formats include fully qualified domain name (FQDN) or URL.

This server uses an SSL connection

Specifies that Exchange server requires a Secure Sockets Layer (SSL) connection.

Synchronize

Specifies how often Exchange data on the mobile device is synchronized with the Exchange server.

Synchronize when cradled

Specifies how often the mobile device synchronizes Exchange data with the Exchange server when the mobile device is cradled.

Disconnect when done

Specifies that the mobile device should disconnect after synchronizing with the Exchange server.

Conflict resolution

Specifies how conflicts between Exchange data on the mobile device and Exchange data on the Exchange server should be resolved by default.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM03) Properties: Sync
Exchange ActiveSync (WM03) Properties: Calendar/Contacts
Exchange ActiveSync (WM03) Properties: E-mail
Exchange ActiveSync (WM03) Properties: Optional
Exchange ActiveSync (WM03) Properties: Security

Other Resources

Exchange ActiveSync (WM03 mode) Properties


Exchange ActiveSync (WM03) Properties: Calendar/Contacts

Use the Exchange ActiveSync (WM03) Calendar/Contacts tab to specify the properties of the configuration item to distribute to mobile devices. Calendar/Contacts properties define age filtering for calendar data and whether contacts are synchronized between the mobile device and the Exchange server by default.

  • Specify the settings of the configuration item to be distributed to mobile devices.
Enable Calendar Synchronization

Specifies that by default Exchange calendar data is synchronized on mobile devices.

Age Filter

Specifies the default age of calendar data to synchronize on the mobile device.

Enable contacts synchronization

Specifies that by default Exchange contact data is synchronized on the mobile devices.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM03) Properties: Sync
Exchange ActiveSync (WM03) Properties: E-mail
Exchange ActiveSync (WM03) Properties: Optional
Exchange ActiveSync (WM03) Properties: Security

Other Resources

Exchange ActiveSync (WM03 mode) Properties


Exchange ActiveSync (WM03) Properties: E-mail

Use the Exchange ActiveSync (WM03) E-mail tab to specify the e-mail properties of the configuration item to distribute to mobile devices. E-mail properties specify settings for age filtering for calendar data and whether body truncation is applied to conserve device memory and reduce communication traffic.

  • Specify the settings of the configuration item to be distributed to mobile devices.
Enable e-mail synchronization

Enables e-mail synchronization between the mobile device client and the Exchange server.

Age filter

Specifies the age of e-mail to be synchronized with the client. E-mail older than the specified date will not be synchronized.

Body truncation

Specifies the size of the e-mail downloaded to the mobile device by default. Users can opt to download complete e-mail messages after reviewing the truncated message.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM03) Properties: Sync
Exchange ActiveSync (WM03) Properties: Calendar/Contacts
Exchange ActiveSync (WM03) Properties: Optional
Exchange ActiveSync (WM03) Properties: Security

Other Resources

Exchange ActiveSync (WM03 mode) Properties


Exchange ActiveSync (WM03) Properties: Optional

Use the Exchange ActiveSync (WM03) Optional tab to specify the optional properties of the configuration item to distribute to mobile devices. The client will present this user name and Active Directory domain name when attempting to authenticate with the Exchange server.

User name

Specifies the user name presented to the Exchange server for authentication.

Domain

Specifies the Active Directory domain name presented to the Exchange server for authentication.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM03) Properties: Sync
Exchange ActiveSync (WM03) Properties: Calendar/Contacts
Exchange ActiveSync (WM03) Properties: E-mail
Exchange ActiveSync (WM03) Properties: Security

Other Resources

Exchange ActiveSync (WM03 mode) Properties


Exchange ActiveSync (WM03) Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Exchange ActiveSync (WM05 mode) Properties

The Exchange ActiveSync configuration item specifies the ActiveSync configurations that can be distributed to Windows Mobile 5 mobile device clients.

In This Section

Exchange ActiveSync (WM05) Properties: General

Exchange ActiveSync (WM05) Properties: Sync

Exchange ActiveSync (WM05) Properties: Calendar/Contact

Exchange ActiveSync (WM05) Properties: E-mail

Exchange ActiveSync (WM05) Properties: Optional

Exchange ActiveSync (WM05) Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Exchange ActiveSync (WM05) Properties: General

Use the Exchange ActiveSync (WM05) General tab to specify the general properties of the configuration item to distribute to mobile devices. Configuration items are sent to mobile devices using the New Configuration Packages Wizard.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description (Optional)

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM05) Properties: Sync
Exchange ActiveSync (WM05) Properties: Calendar/Contact
Exchange ActiveSync (WM05) Properties: E-mail
Exchange ActiveSync (WM05) Properties: Optional
Exchange ActiveSync (WM05) Properties: Security

Other Resources

Exchange ActiveSync (WM05 mode) Properties


Exchange ActiveSync (WM05) Properties: Sync

Use the Exchange ActiveSync (WM05) Synchronization tab to specify the sync properties of the configuration item to distribute to mobile devices. Sync properties specify the host Exchange server, how often the client synchronizes Exchange data, and how client-server conflicts are resolved.

Specify the settings of the configuration item to be distributed to mobile devices.
Server

Specifies the host name of the Exchange server. Valid formats include fully qualified domain name (FQDN) or URL.

This server uses an SSL connection

Specifies that Exchange server requires a Secure Sockets Layer (SSL) connection.

Synchronize

Specifies how often Exchange data on the mobile device is synchronized with the Exchange server.

Synchronize when cradled

Specifies how often the mobile device synchronizes Exchange data with the Exchange server when the mobile device is cradled.

Disconnect when done

Specifies that the mobile device should disconnect after synchronizing with the Exchange server.

Conflict resolution

Specifies how conflicts between Exchange data on the mobile device and Exchange data on the Exchange server should be resolved by default.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM05) Properties: General
Exchange ActiveSync (WM05) Properties: Calendar/Contact
Exchange ActiveSync (WM05) Properties: E-mail
Exchange ActiveSync (WM05) Properties: Optional
Exchange ActiveSync (WM05) Properties: Security

Other Resources

Exchange ActiveSync (WM05 mode) Properties


Exchange ActiveSync (WM05) Properties: Calendar/Contact

Use the Exchange ActiveSync (WM05) Calendar/Contact tab to specify the properties of the configuration item to distribute to mobile devices. Calendar/Contacts properties define age filtering for calendar data and whether contacts are synchronized between the mobile device and the Exchange server by default.

Specify the settings of the configuration item to be distributed to mobile devices.
Enable Calendar Synchronization

Specifies that by default Exchange calendar data is synchronized on mobile devices.

Age Filter

Specifies the default age of calendar data to synchronize on mobile devices.

Enable contacts synchronization

Specifies that by default Exchange contact data is synchronized on mobile devices.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM05) Properties: General
Exchange ActiveSync (WM05) Properties: Sync
Exchange ActiveSync (WM05) Properties: E-mail
Exchange ActiveSync (WM05) Properties: Optional
Exchange ActiveSync (WM05) Properties: Security

Other Resources

Exchange ActiveSync (WM05 mode) Properties


Exchange ActiveSync (WM05) Properties: E-mail

Use the Exchange ActiveSync (WM05) E-mail tab to specify the e-mail properties of the configuration item to distribute to mobile devices. E-mail properties specify default settings for age filtering for calendar data and whether body truncation is applied to conserve device memory and reduce communication traffic.

Specify the settings of the configuration item to be distributed to mobile devices.
Enable e-mail synchronization

Enables e-mail synchronization between the mobile device client and the Exchange server.

Age filter

Specifies the age of e-mail to be synchronized with the client. E-mail older than the specified date will not be synchronized.

Body truncation

Specifies the size of the e-mail downloaded to the mobile device by default. Users can opt to download complete e-mail messages after reviewing the truncated message.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM05) Properties: General
Exchange ActiveSync (WM05) Properties: Sync
Exchange ActiveSync (WM05) Properties: Calendar/Contact
Exchange ActiveSync (WM05) Properties: Optional
Exchange ActiveSync (WM05) Properties: Security

Other Resources

Exchange ActiveSync (WM05 mode) Properties


Exchange ActiveSync (WM05) Properties: Optional

Use the Exchange ActiveSync (WM05) Optional tab to specify the optional properties of the configuration item to distribute to mobile devices. The client will present this user name and Active Directory domain name when attempting to authenticate with the Exchange server.

User name

Specifies the user name presented to the Exchange server for authentication.

Domain

Specifies the domain name presented to the Exchange server for authentication.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Exchange ActiveSync (WM05) Properties: General
Exchange ActiveSync (WM05) Properties: Sync
Exchange ActiveSync (WM05) Properties: Calendar/Contact
Exchange ActiveSync (WM05) Properties: E-mail
Exchange ActiveSync (WM05) Properties: Security

Other Resources

Exchange ActiveSync (WM05 mode) Properties


Exchange ActiveSync (WM05) Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


GPRS Network Properties

Use the Configuration Manager 2007 mobile device general packet radio service (GPRS) properties to specify the configuration item settings.

In This Section

GPRS Network Properties: General

GPRS Network Properties: GPRS Network

GPRS Network Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


GPRS Network Properties: General

Use the General tab of the Configuration Manager 2007 mobile device general packet radio service (GPRS) properties dialog box to specify the configuration item name and description.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
GPRS Network Properties: GPRS Network
GPRS Network Properties: Security


GPRS Network Properties: GPRS Network

Use the GPRS Network tab of the Configuration Manager 2007 configuration item properties dialog box to specify the general packet radio service (GPRS) default configurations to distribute to client mobile devices. Configuration items are sent to client mobile devices using the New Configuration Packages Wizard.

Specify the name and description of the configuration item to be distributed to mobile devices.
Description

Specifies the description of the GPRS Network configuration shown on the client device.

Access point name

Specifies the name of the GPRS Network configuration shown on the client device.

Connects to

Specifies that the GPRS Network connects via a corporate network or the Internet.

User name (optional)

Specifies the default user name for the GPRS Network connection.

IP address (optional)

Specifies the default IP address for the GPRS Network connection.

Primary DNS (optional)

Specifies the IP address of the primary DNS server for the GPRS Network connection.

Secondary DNS (optional)

Specifies the IP address of the secondary DNS server for the GPRS Network connection.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
GPRS Network Properties: General
GPRS Network Properties: Security


GPRS Network Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Internet E-mail Properties

Use the Internet E-mail Properties Microsoft System Center Configuration Manager 2007 configuration item to specify the properties of the Internet e-mail settings to distribute to mobile devices.

In This Section

Internet E-mail Properties: General

Internet E-mail Properties: Internet E-mail

Internet E-mail Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Internet E-mail Properties: General

Use this tab to set the name and description of the Internet E-Mail Properties configuration item for mobile client devices.

  • Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Internet E-mail Properties: Internet E-mail
Internet E-mail Properties: Security


Internet E-mail Properties: Internet E-mail

Use the Internet E-mail Properties tab of the Configuration Manager 2007 configuration item properties dialog box to specify the properties of the Internet e-mail settings to distribute to mobile devices.

Specify the settings to distribute to mobile devices.
E-mail type

Specifies the Internet e-mail type. Supported Internet e-mail types include IMAP4 and POP3.

Service name

Specifies the name of the Internet e-mail service displayed to the client.

Incoming e-mail server

Specifies the URL or IP address of the incoming e-mail server. This value must be alphanumeric.

Outgoing e-mail server

Specifies the domain name or IP address of the outgoing e-mail server. This value must be alphanumeric.

Domain

Specifies the domain associated with the Internet e-mail account.

Friendly user name

Specifies the friendly user name of the Internet e-mail settings and can be alphanumeric with common symbols.

User name

Specifies the user name for the Internet e-mail account.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Internet E-mail Properties: General
Internet E-mail Properties: Security


Internet E-mail Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Network Proxy Properties

Use the Network Proxy Properties configuration item to specify the properties of the network proxy settings to distribute to mobile devices.

In This Section

Network Proxy Properties: General

Network Proxy Properties: Network Proxy

Network Proxy Properties: Security


Network Proxy Properties: General

Use the General tab of the Configuration Manager 2007 mobile device network proxy properties dialog box to specify the configuration item name and description.

  • Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Network Proxy Properties: Network Proxy
Network Proxy Properties: Security


Network Proxy Properties: Network Proxy

Use the Network Proxy Properties tab of the Configuration Manager 2007 configuration item properties dialog box to specify the properties of the network proxy settings to distribute to mobile devices.

Specify the name and description of the configuration item to be distributed to mobile devices.
Description

Specifies a description of the network proxy delivered to the mobile device. The description should give relevant information that identifies the network proxy and its intended use.

Connects from

Specifies whether the network proxy connects from the corporate network or the Internet.

Connects to

Specifies whether the network proxy connects from the Internet or the corporate network.

Proxy

Specifies the name and port number of the network proxy (ex. Name:Port).

Type

Specifies the type of network proxy accessed by the configuration item, as follows:

  • HTTP
  • WAP
  • SOCKS4
  • SOCKS5
User name

Specifies the default user name sent for authentication to the network proxy.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Network Proxy Properties: General
Network Proxy Properties: Security


Network Proxy Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Password Policy for MSFP Properties

The Password Policy configuration item provides Configuration Manager 2007 password management support for mobile devices that use the Messaging and Security Feature Pack (MSFP).

Many enterprises have a corporate policy that all employee contact information and current e-mail is to be securely protected. Password policy allows a Configuration Manager 2007 administrator to enforce password usage by users. The Configuration Manager 2007 administrator can specify the type of password and the timeout interval. Configuration Manager 2007 administrators can decide whether to allow users to change these settings on mobile devices.

Password policy also allows for the Configuration Manager 2007 administrator to enforce a strong administrator password after a specified number of failed entry attempts. This setting instructs the mobile device to display a strong administrator password prompt if a user incorrectly enters a password into the password entry dialog box a specified number of times. The administrator password feature is designed so that, in the event of an attack on a locked stolen mobile device, an administrator-defined strong password protects the mobile device. A different message appears, saying that an administrator password is required to return to the user-defined password prompt.

The administrator-defined password does not circumvent the user’s password since the user password is still required to be entered following successful entry of the administrator lock-out password. Also, this feature is not designed to assist users if they have forgotten their user-defined password. In this scenario, users must perform a reset on the mobile device and reload their data.

In This Section

Password Policy for MSFP Properties: General

Password Policy for MSFP Properties: Device Security

Password Policy for MSFP Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Password Policy for MSFP Properties: General

Use the General tab of the Configuration Manager 2007 mobile device Messaging and Security Feature Pack (MSFP) properties dialog box to specify the configuration item name and description.

Many enterprises have a corporate policy that all employee contact information and current e-mail must be securely protected. Password policy allows a Configuration Manager 2007 administrator to enforce password usage by users. The Configuration Manager 2007 administrator can specify the type of password and the timeout interval. Configuration Manager 2007 administrators can decide whether to allow users to change these settings on the mobile devices.

Password policy also allows for the Configuration Manager 2007 administrator to enforce a strong administrator password after a specified number of failed entry attempts. This setting instructs the mobile device to display a strong administrator password prompt if a user incorrectly enters a password into the password entry dialog box a specified number of times. The administrator password feature is designed so that, in the event of an attack on a locked stolen mobile device, an administrator-defined strong password protects the mobile device. A different message appears, saying that an administrator password is required to return to the user-defined password prompt.

The administrator-defined password does not circumvent the user’s password since the user password is still required to be entered following successful entry of the administrator lock-out password. Also, this feature is not designed to assist users if they have forgotten their user-defined password. In this scenario, users must perform a reset on the mobile device and reload their data.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Password Policy for MSFP Properties: Device Security
Password Policy for MSFP Properties: Security


Password Policy for MSFP Properties: Device Security

Use the Password Policy for MSFP Properties: Device Security tab of the Configuration Manager 2007 configuration item properties dialog box to specify the properties of the password policy to distribute to mobile devices. Mobile devices must have the Windows Mobile 5.0 or later Messaging and Security Feature Pack (MSFP) installed to use this configuration item.

Specify the settings of the configuration item to be distributed to mobile devices.
Enforce password on device

Specifies that the password policy settings on the mobile device be enforced.

Minimum PIN length (digits)

Specifies the minimum number of characters in password on the mobile device.

Require both numbers and letters

Specifies that the password must include both numbers and letters.

Inactivity time

Specifies the number of minutes that the device can be idle before requiring the password to be reentered.

Wipe device after failed (attempts)

Specifies a number of failed authentication attempts after which user data on the phone is removed from the mobile device. Phone storage card data is not deleted.

Enforce password history

Specifies that a new password must be used when the password is changed. This prevents users from reusing an old password within the Maximum passwords remembered limit.

Maximum passwords remembered

Specifies how many old passwords are remembered to test against the enforced password history.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Password Policy for MSFP Properties: General
Password Policy for MSFP Properties: Security


Password Policy for MSFP Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Password Policy for Pocket PC 2003 Properties

The Password Policy configuration item provides Configuration Manager 2007 password management support for Pocket PC 2003-based mobile devices.

Many enterprises have a corporate policy that all employee contact information and current e-mail must be securely protected. Password policy allows a Configuration Manager 2007 administrator to enforce password usage by users. The Configuration Manager 2007 administrator can specify the type of password and the timeout interval. Configuration Manager 2007 administrators can decide whether to allow users to change these settings on mobile devices.

Password policy also allows for the Configuration Manager 2007 administrator to enforce a strong administrator password after a specified number of failed entry attempts. This setting instructs the mobile device to display a strong administrator password prompt if a user incorrectly enters a password into the password entry dialog box a specified number of times. The administrator password feature is designed so that, in the event of an attack on a locked stolen mobile device, an administrator-defined strong password protects the mobile device. A different message appears, saying that an administrator password is required to return to the user-defined password prompt.

The administrator-defined password does not circumvent the user’s password since the user password is still required to be entered following successful entry of the administrator lock-out password. Also, this feature is not designed to assist users if they have forgotten their user-defined password. In this scenario, users must perform a reset on the mobile device and reload their data.

In This Section

Password Policy for Pocket PC 2003 Properties: General

Password Policy for Pocket PC 2003 Properties: Password Policy

Password Policy for Pocket PC 2003 Properties: Administrator Mode

Password Policy for Pocket PC 2003 Properties: Security


Password Policy for Pocket PC 2003 Properties: General

Use the General tab of the Configuration Manager 2007 mobile device password policy for the Pocket PC 2003 properties dialog box to specify the configuration item name and description.

Many enterprises have a corporate policy that all employee contact information and current e-mail must be securely protected. Password policy allows a Configuration Manager 2007 administrator to enforce password usage by users. The Configuration Manager 2007 administrator can specify the type of password and the timeout interval. Configuration Manager 2007 administrators can decide whether to allow users to change these settings on mobile devices.

Password policy also allows for the Configuration Manager 2007 administrator to enforce a strong administrator password after a specified number of failed entry attempts. This setting instructs the mobile device to display a strong administrator password prompt if a user incorrectly enters a password into the password entry dialog box a specified number of times. The administrator password feature is designed so that, in the event of an attack on a locked stolen mobile device, an administrator-defined strong password protects the mobile device. A different message appears, saying that an administrator password is required to return to the user-defined password prompt.

The administrator-defined password does not circumvent the user’s password since the user password is still required to be entered following successful entry of the administrator lock-out password. Also, this feature is not designed to assist users if they have forgotten their user-defined password. In this scenario, users must perform a reset on the mobile device and reload their data.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Password Policy for Pocket PC 2003 Properties: Password Policy
Password Policy for Pocket PC 2003 Properties: Administrator Mode
Password Policy for Pocket PC 2003 Properties: Security


Password Policy for Pocket PC 2003 Properties: Password Policy

Use the Password Policy for Pocket PC 2003 Properties: Password Policy tab of the Configuration Manager 2007 configuration item properties dialog box to specify the properties of the password policy to distribute to mobile devices. This configuration item can only be advertised to mobile devices running Windows Mobile Pocket PC 2003.

Specify the name and description of the configuration item to be distributed to mobile devices.

Enable password policy on device

Specifies that the password policy settings on the mobile device be enforced.

Enforce user password type

Specifies the type of password enforced, as follows:

  • None specified - Password type is not enforced.
  • PIN only - A minimum of four digits.
  • PIN or strong - A minimum of four digits or a minimum of seven characters with at least one number, one uppercase character, and one lowercase character (e.g., 12345aA).
Enforce password timeout

Specifies that the password times out after a certain number of minutes or hours.

Password timeout

Specifies the number of minutes or hours for the password timeout.

Enable password history

Specifies that the password be unique within the maximum number of passwords remembered.

Maximum passwords remembered

Specifies how many old passwords are remembered to test against the password history.

Message displayed to user

Specifies the message displayed to the user of the mobile device when prompting for a password.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Password Policy for Pocket PC 2003 Properties: General
Password Policy for Pocket PC 2003 Properties: Administrator Mode
Password Policy for Pocket PC 2003 Properties: Security


Password Policy for Pocket PC 2003 Properties: Administrator Mode

Use the Password Policy for Pocket PC 2003 Properties: Administrator Mode tab of the Microsoft System Center Configuration Manager 2007 configuration item properties dialog box to specify the properties of the administrator mode password policy to distribute to mobile devices. The administrator mode password allows the user to unlock the password retry count in the event they have locked themselves out of the device. The administrator mode password will not bypass the existing password on the device and does not allow access to the device. This configuration item can only be advertised to mobile devices running Windows Mobile Pocket PC 2003.

Specify the name and description of the configuration item to be distributed to mobile devices.
Enable administrator mode if user password type is

Specifies the type of password to enable administrator mode.

  • None specified - Password type is not enforced.
  • PIN only - A minimum of four digits.
  • PIN or strong - A minimum of four digits or a minimum of seven characters with at least one number, one uppercase character, and one lowercase character (e.g., 12345aA).
Number of failed attempts to activate administrator mode

Specifies the number of failed password attempts before locking the device and instructing the user to get the administrator password from their Configuration Manager 2007 administrator.

Administrator password

Specifies the administrator password.

Confirm password

Confirms the administrator password.

Message displayed to user in administrator mode

Specifies the message displayed to the user of the mobile device when prompting for the administrator password. This is intended to be a contact number where the user can obtain the administrator mode password and unlock the password retry count.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Configuration Package Program Name Properties: General
Password Policy for Pocket PC 2003 Properties: General
Password Policy for Pocket PC 2003 Properties: Password Policy
Password Policy for Pocket PC 2003 Properties: Security


Password Policy for Pocket PC 2003 Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Registry Properties

Use the Microsoft System Center Configuration Manager 2007 mobile device registry properties to specify the registry configuration item settings.

In This Section

Registry Properties: General

Registry Properties: Registry

Registry Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Registry Properties: General

Use the General tab of the Configuration Manager 2007 mobile device registry properties dialog box to specify the configuration item name and description.

  • Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Registry Properties: General
Registry Properties: Registry
Registry Properties: Security

Other Resources

Configuration Package Name Properties


Registry Properties: Registry

Use the Registry Properties: Registry tab of the Configuration Manager 2007 configuration item properties dialog box to specify the registry key to distribute to mobile devices.

Specify the name and description of the configuration item to be distributed to mobile devices.
Key

Specifies the registry key to be added.

Note
The registry key should start with HKLM, HKCU, HKCR, or HKU. For example, HKCU\Software\Microsoft\Example.

Value name

Specifies the value name of the registry key.

Data type

Specifies the data type for the registry key. Data types include the following:

  • Binary
  • Boolean
  • Date and Time
  • Float
  • Integer
  • Multiple Strings
  • String
Value

Specifies the value of the registry key.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Registry Properties: General
Registry Properties: Security

Other Resources

Configuration Package Name Properties


Registry Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

See Also

Reference

Registry Properties: General
Registry Properties: Registry

Other Resources

Configuration Package Name Properties


Security Policies Properties

Use the Configuration Manager 2007 mobile device security policies properties to specify the security policies configuration item settings.

In This Section

Security Policies Properties: General

Security Policies Properties: Security Policies

Security Policies Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


Security Policies Properties: General

Use the General tab of the Configuration Manager 2007 mobile device security policies properties dialog box to specify the configuration item name and description.

  • Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Security Policies Properties: Security Policies
Security Policies Properties: Security Policies

Other Resources

Configuration Package Name Properties


Security Policies Properties: Security Policies

Use the Security Policy Properties: Security Policy tab of the Configuration Manager 2007 configuration item to specify the properties of the security policies settings to distribute to the mobile devices.

Specify the name and description of the configuration item to be distributed to mobile devices.
Install unsigned .cab files

Specifies whether to allow, disallow, or leave unchanged the ability of the user to install unsigned .cab files.

Prompt for unsigned .cab installation

Specifies whether to enable, disable, or leave unchanged the user prompt for unsigned .cab file installation.

Run unsigned applications

Specifies whether to allow, disallow, or leave unchanged the ability for the user to run unsigned applications.

Install unsigned theme files

Specifies whether to allow, disallow, or leave unchanged the ability for the user to install unsigned theme files.

Auto run applications from a memory card

Specifies whether to allow, disallow, or leave unchanged the ability for the device to auto run applications from a memory card.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Security Policies Properties: Security Policies
Security Policies Properties: Security Policies

Other Resources

Configuration Package Name Properties


Security Policies Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

See Also

Reference

Security Policies Properties: Security Policies
Security Policies Properties: Security

Other Resources

Configuration Package Name Properties


VPN Properties

Use the Configuration Manager 2007 mobile device virtual private network (VPN) properties to specify the VPN configuration item settings.

In This Section

VPN Properties: General

VPN Properties: VPN

VPN Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


VPN Properties: General

Use the General tab of the Configuration Manager 2007 mobile device virtual private network (VPN) properties dialog box to specify the configuration item name and description.

  • Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

VPN Properties: VPN
VPN Properties: Security

Other Resources

Configuration Package Name Properties


VPN Properties: VPN

Use the VPN tab of the Configuration Manager 2007 configuration item properties dialog box to specify the default VPN settings to distribute to mobile devices. Configuration items are sent to mobile devices using the New Configuration Packages Wizard.

Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the display name of the VPN network on the client mobile device.

Connects from

Specifies whether the VPN connects from the Internet or the work (corporate) network.

Connects to

Specifies whether the VPN connects to the Internet or the work (corporate) network.

Host name

Specifies the default host name of the VPN connection.

User name

Specifies the default user name of the VPN connection.

Domain

Specifies the default domain name of the user.

Type

Specifies the default type of the VPN connection. Connection type may be either Point-to-Point Tunneling Protocol (PPTP) or IP Security/Layer 2 Tunneling Protocol (IPSec/L2TP).

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

VPN Properties: General
VPN Properties: Security

Other Resources

Configuration Package Name Properties


VPN Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section.

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

See Also

Reference

VPN Properties: General
VPN Properties: VPN
VPN Properties: Security

Other Resources

Configuration Package Name Properties


WiFi Settings Properties

Use the Configuration Manager 2007 mobile device WiFi properties to specify the WiFi configuration item settings.

In This Section

WiFi Properties: General

WiFi Properties: Wireless Network Tab

WiFi Properties: Authentication

WiFi Properties: Security

See Also

Concepts

How to Create Configuration Items for Mobile Devices

Other Resources

Configuration Items Properties for Mobile Device Management
New Mobile Device Configuration Item Wizard


WiFi Properties: General

Use the General tab of the Configuration Manager 2007 mobile device WiFi properties dialog box to specify the configuration item name and description.

  • Specify the name and description of the configuration item to be distributed to mobile devices.
Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the SMS Administrator console.

Configuration Type

Specifies the configuration type of the configuration item for mobile devices.

Platform

Specifies the platforms that the configuration item can configure.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

WiFi Properties: Wireless Network Tab
WiFi Properties: Authentication
WiFi Properties: Security

Other Resources

Configuration Package Name Properties


WiFi Properties: Wireless Network Tab

Use the WiFi Settings Properties: Wireless Network tab of the Configuration Manager 2007 configuration item properties dialog box to specify the default VPN settings to distribute to client mobile devices. Configuration items are sent to client mobile devices using the New Configuration Packages Wizard.

Specify the name and description of the configuration item to be distributed to mobile devices.
Network Name (SSID)

Specifies the name of the wireless local area network (WLAN). All clients on the WLAN must have the same service set identifier (SSID) to communicate.

Connects to (DestID)

Specifies whether the WiFi properties connect to Internet or the corporate network.

This is a device-to-device (ad-hoc) connection

Specifies whether the connection allows the device to connect to any WiFi enabled device (ad-hoc) or whether it will only connect to WiFi infrastructure devices, such as a WiFi router.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

WiFi Properties: General
WiFi Properties: Authentication
WiFi Properties: Security


WiFi Properties: Authentication

Use the WiFi Settings Properties: Authentication tab of the Configuration Manager 2007 configuration item properties dialog box to specify the default VPN settings to distribute to mobile devices. Depending upon the preceding selections, some options may not be available.

Specify the name and description of the configuration item to be distributed to mobile devices.
Authentication type

Specifies the authentication protocol. Options include:

  • Open authentication
  • Shared authentication
  • WiFi Protected Access (WPA)
  • WPA with pre-shared key (PSK)
Encryption type

Specifies whether encryption is wired equivalent privacy (WEP) or disabled.

The key is provided automatically

Specifies whether the authentication key is sent automatically.

Enable network access using IEEE 802.1x

Specifies whether port-based, network access control standards are used for authentication.

EAP Type

Specifies whether smart card/certificate or protected extensible authentication protocol (EAP) is used for authentication.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

WiFi Properties: General
WiFi Properties: Wireless Network Tab
WiFi Properties: Security


WiFi Properties: Security

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Click the New button to open the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Click the Edit button to open the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Click the Delete button to delete the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Click the New button to open the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Click the Edit button to open the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Click the Delete button to delete the selected security right.

See Also

Reference

WiFi Properties: General
WiFi Properties: Wireless Network Tab
WiFi Properties: Authentication


Configuration Package Name Properties

The Microsoft System Center Configuration Manager 2007 configuration package name properties dialog box displays information about the configuration package and allows the configuration package settings to be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box.

In This Section

Configuration Package Name Properties: General Tab

Configuration Package Name Properties: Data Access Tab

Configuration Package Name Properties: Distribution Settings Tab

Configuration Package Name Properties: Security Tab


Configuration Package Name Properties: General Tab

Use the General tab of the Microsoft System Center Configuration Manager 2007 mobile device configuration package properties dialog box to specify the general properties of the configuration package.

Name

Specifies the name of the configuration package for mobile devices. The name should be unique and descriptive and can include up to 50 characters

Version

Specifies the version of the configuration package. The version can include up to 32 characters.

Manufacturer

Specifies the software publisher of the configuration package.

Language

Specifies the supported language for the software update and can include up to 32 characters.

Comment

Specifies comments about the configuration package up to 127 characters.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Packages for Mobile Devices


Configuration Package Name Properties: Data Access Tab

Use the Data Access tab of the Microsoft System Center Configuration Manager 2007 mobile device configuration package properties dialog box to specify the data access properties of the configuration package.

Specify the configuration pack settings.
Access distribution folder through common ConfigMgr package share

Specifies whether users will access the configuration package through the common Configuration Manager 2007 package share (SMSPKGx$, where x is the drive letter) on distribution points. This option is selected by default.

Share distribution folder

Specifies whether the configuration package will be created on distribution points with an administrator-specified share and path name. Selecting this option requires a share name.

Share name

Specifies a share name or path to be created for the configuration package source files on distribution points.

Two options are available:

  • The value can be a share, in which case the name must be unique across all packages. If this option is used, all files and subdirectories within that share will be deleted and re-created each time the package is updated or refreshed.
  • The value can be a share and a path, in the format sharename\path, in which case the path must be unique across all packages. If this option is used, only the final directory in the path will be deleted and re-created each time the package is updated or refreshed.
Note
Do not enter a full Universal Naming Convention (UNC) path in Share name, such as \\server\share. Instead enter a share and path name in the format sharename\path.

To control which drive a configuration package folder is created on, you can assign the distribution point role to a server share rather than a server computer. For distribution points on server shares, if a share name is entered for a configuration package, it is treated as a path beneath the distribution point share (\\MyServer\MyShare).

Disconnect users from distribution points

Specifies that users will be disconnected from distribution points when Configuration Manager 2007 updates configuration package data. This check box is cleared by default.

If this option is selected, the following settings are available:

  • Number of retries before disconnecting users: Specifies the number of times that Configuration Manager 2007 tries to update the configuration package source files before disconnecting users connected to the distribution point. The default setting is 2; you can specify 0 to 99, inclusive.
Interval between user notification and disconnection (minutes): Specifies the number of minutes Configuration Manager 2007 will wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Packages for Mobile Devices


Configuration Package Name Properties: Distribution Settings Tab

Use the Distribution Settings tab of the Configuration Manager 2007 mobile device configuration package properties dialog box to specify the sender and priority to use when sending this package to another site, as well as to specify your branch distribution point content settings.

Sending priority

Specifies the priority of this configuration package when sent to another site. Three priorities are available:

  • High
  • Medium (default setting)
  • Low
Configuration packages are sent in priority order, and packages with identical priorities are sent in order of creation.

Preferred sender

Specifies the sender to be used to send this package to other sites. You can specify any sender configured for the site or No Preference (the default setting), which uses any available sender.

Note
To use Courier Sender to distribute packages, you must select it as the preferred sender.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Packages for Mobile Devices


Configuration Package Name Properties: Security Tab

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Class security rights section:

New

Opens the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

The following actions are available in the Instance security rights section:
New

Opens the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Opens the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Deletes the selected security right.


Configuration Package Program Name Properties

The Microsoft System Center Configuration Manager 2007 configuration package program name properties dialog box displays information about the configuration package program and allows the configuration package program settings to be modified.

Click any link in the following section for detailed information about its associated tab in the dialog box.

In This Section

Configuration Package Program Name Properties: General

Specifies the name and description of the mobile device configuration package program.

Configuration Package Program Name Properties: Requirements

Specifies the disk size, download program and additional requirements for the mobile device configuration package program.

See Also

Concepts

How to Create Programs for Mobile Devices


Configuration Package Program Name Properties: General

Use the General tab of the Configuration Manager 2007 configuration package program name properties dialog box to specify the configuration item name, comment, download folder, and program properties of the package program.

Specify the properties of the configuration package program to be distributed to mobile devices.
Name

Specifies the name of the program for the configuration pack.

Comment

Specifies the comment about the configuration pack.

Download folder

Specifies the download folder that holds the source files.

Command line

Specifies the file containing the command line parameters.

Browse

Opens a dialog box to specify the command line file.

Run command line in download folder

Specifies the command line should be run from the download folder.

Run command line from this folder

Specifies the command line should be run from the specified folder.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

How to Create Programs for Mobile Devices


Configuration Package Program Name Properties: Requirements

Use the Requirements tab of the Configuration Manager 2007 mobile device configuration package properties dialog box to specify the program requirements of the configuration package.

  • Specify the properties of the configuration package program requirements to be distributed to mobile devices.
Estimated disk space

Species the amount of disk space required by the configuration item.

Download program

Specifies the circumstances when the program should be downloaded.

Additional requirements

Specifies the additional requirements of the configuration item.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

How to Create Programs for Mobile Devices


Access Account Properties: General Tab (Mobile Device Management)

Use the General tab of the Configuration Manager 2007 Software Distribution Access Account Properties dialog box to set or update permissions for users and user groups to access package data on distribution points. Only permissions for previously existing access accounts can be set in this dialog box; to add a new access account, you must use the New Access Account Wizard.

Note
Mobile devices do not use Access Accounts. Mobile devices access distribution points anonymously.

For more information about access accounts and when to use them, see About Package Access Accounts.

Caution
If you modify the permissions of an existing account, you must refresh all distribution points associated with your package. When distribution points are refreshed, the package source is recopied from each site server to its distribution points. To minimize the resulting impact on network resources, if you have several changes to make, make them all before refreshing the distribution points.

The following permissions can be specified for users and user groups:

  • Read: Enables the account to view and copy files, run programs, change folders with the shared folder, and read extended attributes of files.
    To run a program file (a file with a .com, .exe, or .bat extension), a user must have Read permission.
  • Change: Enables the account to change the contents and extended attributes of files. Change permission is required for applications that need to write information back to the shared package folder on the distribution point.
  • Full Control: Enables the account to read and write the contents and extended attributes of files.
  • No Access: Prevents the account from reading, writing, or deleting files on the package share.
    Note
    When using package access accounts, it is important to ensure that all clients that will receive the package have access to the distribution point through the defined access accounts. Advertised programs will fail to run if users do not have the appropriate rights to access the package.

The General tab contains the following elements:

UI Element List

Account

Specifies the name of the access account to which you want to grant access to the package share on distribution points.

Set

Allows the administrator to specify the account name. This option can be set using the New Access Account Wizard, but it is unavailable from the dialog box.

Account type

Displays the type of access account, either a Generic access account or a Windows User account.

Permissions

Allows the administrator to grant the level of access desired to the specified account.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Modify a Package Access Account

Concepts

About Package Access Accounts
About Packages

Other Resources

Packages Property Pages


Mobile Device Management Package Status Home Page

The Mobile Device Management Package Status Home page in the Configuration Manager 2007 console tree displays summary information for each configuration package on the Configuration Manager 2007 site.

For each site to which the configuration package is targeted, the following information is shown by default:

  • Site: Displays the name of the Configuration Manager 2007 site to which the configuration package is targeted.
  • Source Version: Displays the version number of the configuration package source files. This is incremented each time you revise the configuration package and can be used to determine whether a distribution point has the latest version of the configuration package source.
  • Targeted: Displays the total number of distribution points, including child sites that have been targeted with a copy of the configuration package.
  • Installed: Displays the total number of distribution points to which the current version of the configuration package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this configuration package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

Selecting any site from the Package Status node displays the following information by default:

  • Distribution Point: Displays the name of each distribution point to which this configuration package has been targeted.
  • Source Version: Displays the version number of the configuration package source files. This is incremented each time you revise the configuration package and can be used to determine whether a distribution point has the latest version of the configuration package source.
  • State: Displays the current status of the configuration package on the distribution point.
  • Last Copied: Displays the date and time when the configuration package was last copied to the distribution point.
  • Path: Displays the location of the configuration package files on the distribution point.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Mobile Device Management Package Status Home Page

The following actions are available from the mobile device management package status home page:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected configuration package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Advertisement for Mobile Devices Properties

The Advertisement for Mobile Devices properties allow you to create an advertisement for devices and distributes the advertisement to members of the target collection.

Click the related link below for detailed information about each page in the New Advertisement for Devices properties.

Advertisement for Mobile Devices: General Page

Specifies a program to distribute to a collection of clients.

Advertisement for Mobile Devices: Schedule Page

Specifies when the program will be advertised to members of the target collection. You can also create assignments to make the program mandatory by assigning the program.

See Also

Reference

Advertisement for Mobile Devices: General Page
Advertisement for Mobile Devices: Schedule Page


Advertisement for Mobile Devices: General Page

Use the General page in the Configuration Manager 2007 Advertisement for Devices properties to specify general information such as the associated package, program, and collection for the specific advertisement selected.

The General tab contains the following elements:

Name

Specifies the name of the advertisement, up to 100 characters. This field is required.

Comment

Specifies optional text about the advertisement, such as a description. You can use up to 127 characters. This information is made available to clients in the advertisement details.

Package

Specifies the package that contains the program that will be advertised to mobile device clients. This field is required.

Click the Browse button to open the Select a Package dialog box. Select the desired package, and click OK to choose the package.

Note
Only one package may be selected at a time.

The following information is displayed for packages that are available for distribution:

  • Package: Specifies the name of the given package.
  • Package ID: Specifies the ID of the package. This is the name of the .xml file associated with the package.
  • Last refresh time: Specifies the date and time the package was last refreshed.
Comment: Specifies the description or comments included in the package when it was created.

Program

Specifies the program (within the specified package) to advertise to clients. This field is required.

Collection

Specifies the existing collection that will receive the advertisement. This field is required.

Click the Browse button to open the Browse Collection dialog box, enabling you to search for the collection you want.

Include members of subcollections

Specifies that the program will also be advertised to clients and users in the specified collection's subcollections.

Note
By default, the Include members of subcollections check box is selected. To avoid sending advertisements to subcollections, this option must be cleared.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Advertisement for Mobile Devices: Schedule Page

Concepts

Advertisement for Mobile Devices Properties


Advertisement for Mobile Devices: Schedule Page

Use the Schedule page in the Microsoft System Center Configuration Manager 2007 Advertisement for Devices pane to specify schedule information such as advertisement start time, assignment and rerun settings for the specific advertisement selected.

The Schedule tab contains the following elements:

Advertisement start time

Specifies the date and time when the program is advertised and available to run on clients. By default the current date and time is specified.

UTC (Universal Coordinated Time)

Specifies the date and time based on Universal Coordinated Time (UTC) and is independent of local time zones. For instance, if you select this option and set the time to 1:00 P.M., the program will be advertised on all clients simultaneously - 1:00 P.M. for clients in the UTC zone, 10:00 A.M. for clients in the Eastern time zone, and 7:00 A.M. for clients in the Pacific time zone, and so on.

Note
This check box is cleared by default and Configuration Manager 2007 treats the specified time as a local time. If the time is set to 1:00 P.M., for example, the program will be advertised on clients at 1:00 P.M. in each time zone.

This program is assigned

Specifies that the program is assigned, making it mandatory for advertisement recipients.

Recurrence pattern

Mobile device advertisements can be set to recur on assigned programs. When the Configuration Manager 2007 administrator sets the Advertisement start time (start date and start time) on the Schedule tab of the Device Advertisement Properties dialog box, the following recurrence pattern options are available:

  • None: The scheduled advertisement occurs once at the specified time.
  • Interval: The scheduled advertisement occurs according to the recurrence pattern interval defined.
Rerun this Advertisement when the Program or Advertisement details change

Select the Rerun this advertisement when the program or advertisement details change check box to rerun the advertisement on the device if the program or the advertisement details change. Clearing the check box results in the mobile device ignoring any changes.

Previous

Navigates to the previous page of the wizard.

Next

Navigates to the next page of the wizard.

Finish

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Reference

Advertisement for Mobile Devices: General Page

Concepts

Advertisement for Mobile Devices Properties


Network Access Protection Property Pages

This section contains the property page help content for Network Access Protection (NAP).

In This Section

Network Access Protection Properties: General Tab

Policies Properties: General Tab

NAP Policy Properties: General Tab

See Also

Other Resources

Network Access Protection in Configuration Manager


Network Access Protection Properties: General Tab

This tab contains no properties to view or edit.

See Also

Other Resources

Overview of Network Access Protection


Policies Properties: General Tab

This tab contains no properties to view or edit.


NAP Policy Properties: General Tab

You can view and change when the selected software updates will be evaluated on Configuration Manager 2007 NAP-capable clients. This setting can also be configured in the properties of the update under the Software Update node.

To stop a software update from being included in Network Access Protection (NAP) evaluation, delete the policy by selecting it in the Policies node and pressing the Delete key. This will not delete any software update deployments or packages.

Note
If you do not have a System Health Validator point for computers in this site, non-compliant computers in this site cannot have NAP policies enforced and cannot be restricted through Network Access Protection.

This tab contains the following elements:

As soon as possible

Select whether you want to include an NAP evaluation as soon as possible.

Date and time

Select a date and time on the client when the NAP policy becomes effective.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection
How to Create a Configuration Manager NAP Policy for Network Access Protection

Concepts

About the NAP Effective Date in Network Access Protection
About the NAP Client Status in Network Access Protection
About NAP Evaluation in Network Access Protection
About Configuration Manager NAP Policies in Network Access Protection


Application Compatibility Toolkit Connector Property Pages

Click any of the following links for more information about the Application Compatibility Toolkit Connector property pages.

In This Section

Application Compatibility Toolkit Connector Node Properties

Application Compatibility Toolkit Connector Server Properties


Application Compatibility Toolkit Connector Node Properties

The following tab is displayed:

  • General: Displays the name of the node. No other configurable options are available on this tab.

General

This tab displays the name of the node. No other configurable options are available on this tab.


Application Compatibility Toolkit Connector Server Properties

Use the ACT Configuration properties page to configure the connection with ACT.

This page contains the following elements:

Name | Description
SQL Server | Specify the Microsoft SQL server that ACT should connect to.
ACT Database | Specify the database that ACT should connect to on the server specified.
Application Compatibility Toolkit Log Processing Service will collect log files external to ConfigMgr | Specifies if ACT should collect log file information from a share on the server where ACT is installed.
ConfigMgr will collect ACT log files using ConfigMgr software file collection. Specify the severe running the ACT log processing service | Specifies that collected log file information will be collected from a network share located on a Configuration Manager 2007 site server.


Configure Application Compatibility Toolkit Connector Server Node

The ACT servers node displays the ACT servers that have been created are displayed in a list in the Configure ACT server results pane. The ACT Server column is used as the default sort order. The following columns are displayed by default:

  • ACT Server: The name of the server with ACT installed.
  • ACT Database: The Microsoft SQL database that is configured for ACT.
  • ACT Log Processing Service Server - The log processing server network share that will be used by ACT to write collected log information to.

This dialog box contains the following elements:

UI Element List

Look For

Specifies all or part of a boot image name, or use the drop-down list to select from existing filter criteria.

In

Specifies the column to use when applying the filter criteria.

Find Now

Runs the filter.

Clear

Removes the filter and display the entire list.

You can select the following default actions grouped under Configure ACT Server in the Actions pane. You can collapse the default actions by clicking the up arrow in the Configure ACT Server section header.

UI Element List

Refresh

Refreshes the Configuration Manager 2007 Administrator Console display.

Properties

Displays general properties for the selected ACT server.


System Status Property Pages

This section contains the Configuration Manager 2007 System Status property pages dialog box help topics. Click any link in the following section for detailed information about its associated property dialog box.

In This Section

Site System Status Properties: General Tab

Status Message Query Properties: General Tab

Component Status Properties: General Tab

Status Message Viewer Window

Status Viewer Options Properties

System Status Properties: General Tab

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Site System Status Properties: General Tab

Use the General tab of the Configuration Manager 2007 Site System Status Properties dialog box to view free space threshold information for the selected site system.

This tab contains the following elements:

Storage Object

Displays the name and location of the storage object on the Configuration Manager 2007 site system.

Free Space Thresholds

Displays the free space thresholds at which the Configuration Manager 2007 status system will report a status of Warning or Critical for a site system. These thresholds can be set in the Thresholds tab of the Site System Status Summarizer Properties dialog box.

See Also

Reference

Site System Status Summarizer Properties: General Tab

Concepts

ConfigMgr Status Message Viewer Overview


Status Message Query Properties: General Tab

Use the General tab of the Configuration Manager 2007 Status Message Query Properties dialog box to modify the name and description of a status message query and also to edit or create the code for a new query or import an existing Configuration Manager 2007 query.

This tab contains the following elements:

Name

Specifies a name for the status message query. The name should be unique and descriptive.

Comment

Specifies the description for the status message query.

Import Query Statement

Opens the Browse Query dialog box from which you can import an existing Configuration Manager 2007 status message query for use or modification.

Edit Query Statement

Opens the Query Statement Properties dialog box from which you can define a new query or edit an existing query to be used in the status message query.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Status Message Queries


Component Status Properties: General Tab

Use the General tab of the Configuration Manager 2007 Component Status Properties dialog box to view status message threshold information for the selected Configuration Manager 2007 component.

This tab contains the following elements:

Component

Displays the name of the selected component.

Threshold period:

Displays the time when threshold evaluation started. For example, if the threshold period is Since 01:00:00 and the informational messages threshold is set to 100 for Warning and 200 for Critical, then the component's status indicator is set to Warning whenever the component has reported between 100 and 199 informational status messages since 01:00:00 on any given day.

Status message thresholds

Displays the thresholds at which the Configuration Manager 2007 status system will report a status of Warning or Critical for the selected component. These thresholds can be set in the Thresholds tab of the Component Status Summarizer Properties dialog box.

See Also

Reference

Component Status Summarizer Properties: General Tab

Concepts

ConfigMgr Status Message Viewer Overview


Status Message Viewer Window

Use the Configuration Manager 2007 Status Message Viewer window to view the status messages in a Configuration Manager 2007 database. You can control the amount of information you view by using queries and filters. You can also view status messages from child sites of the current Configuration Manager 2007 site as these are sent to the parent site.

You can modify how messages are displayed in the status message viewer window and which messages are displayed, for example:

  • Sort the items in a column by clicking the column heading.
  • Change the order of columns by dragging column headings.
  • Add or remove columns by clicking View, Options and then clicking the Columns tab.
  • Change the width of columns by dragging column separators. Any item that is too wide for the current column width ends in ellipses (...). The full item is shown in a box that appears when you point to the item.
  • Change the messages that are displayed by running a query from the query list.
  • Change the messages that are displayed by using a filter.

If there are many messages, it might take a moment for them to be loaded into the status message viewer window. You can view the first messages while the others are being loaded, but any operations such as finding, sorting, or querying are suspended until all messages are loaded.

This dialog box contains the following elements:

Severity

Displays the status message severity as one of the following:

  • Error
  • Warning
  • Informational
Type

Displays the type of status message from one of the following:

  • Any
  • Milestone
  • Detail
  • Audit
Site code

Specifies the site code and name of the Configuration Manager 2007 or SMS 2003 site where the status message was generated.

Date/Time

Specifies the date (in mm/dd/yy format) and time (in hh:mm:ss format) that the status message was generated.

System

Specifies the name of the Configuration Manager 2007 site system that generated the status message.

Component

Specifies the name of the Configuration Manager 2007 component that generated the status message (for example, SMS_SCHEDULER).

MSG ID

Specifies the message ID of the status message.

Description

Specifies the text of the status message. When displaying results, the viewer displays only the first 12 characters of the string. You can hover the mouse cursor over the description to read the full message.

Save

Saves the current contents of the status message viewer window as an ASCII text file with the columns separated by tabs or as a CSV file with the columns separated by commas.

Print

Prints the entire current contents of the status message viewer window, including those messages which might not currently be visible in the window without scrolling.

Copy

Copies the selected messages to the clipboard (with the columns separated by tabs).

Delete

Deletes the selected messages from the Configuration Manager 2007 database.

Find

Opens the Find Status Message dialog box, which enables you to find the next status message that meets the specified criteria.

Filter

Opens the Filter Status Messages dialog box, which enables you to configure the status message viewer window to display only messages that meet the specified criteria.

Stop

Stops the loading of messages into the status message viewer window, either during the initial loading or as the result of running a subsequent query.

New Query

Runs a new query. The default setting is Original Query.

See Also

Tasks

How to Delete Status Messages
How to Filter Status Messages
How to Find Status Messages
How to Refresh Status Messages
How to Set ConfigMgr Status Message Viewer Options
How to Query Status Messages
How to View Status Message Details

Concepts

ConfigMgr Status Message Viewer Overview


Status Viewer Options Properties

The Configuration Manager 2007 Status Viewer Options Properties dialog box allows you to configure options for the display of status messages in the status viewer message window.

Click any link in the following section for detailed information about its associated tab in the Status Viewer Options Properties dialog box:

In This Section

Status Viewer Options Properties: General Tab

Specifies general display options for the status message viewer window.

Status Viewer Options Properties: Columns Tab

Specifies which columns are displayed in the status message viewer window.

Status Viewer Options Properties: Export Tab

Specifies the appearance of status messages when they are copied, printed, or saved to a file.

Status Viewer Options Properties: Font Tab

Specifies the font and style for the display of status messages in the status message viewer window.

See Also

Concepts

ConfigMgr Status Message Viewer Overview


Status Viewer Options Properties: General Tab

Use the General tab of the Configuration Manager 2007 Status Viewer Options Properties dialog box to specify general refresh and display options for the status message viewer window.

This tab contains the following elements:

Auto-Refresh

Refreshes the display in the status message viewer window at the time interval you specify, using the currently active query and filters. The default value is 5 minutes.

Limit messages returned from query

Limits the number of messages that are returned by a query to conserve disk space. For more information, see the topic About Messages Returned by a Query. The default value is 1000 messages. To view all messages, specify the value 0.

Display time in selected time zone

Displays status message times in the selected time zone. By default, message times are displayed in the time zone local to the computer running status message viewer.

Resolve description strings

Many status messages contain variables that are resolved when the message is generated because there is no way to know ahead of time what the data will be. For example, message 1106 reported by SMS_EXECUTIVE corresponds to the following string: Scheduled thread component %1 is next scheduled to start on %2.

If Resolve description strings is selected, then when this message is generated, an actual thread component replaces %1, and its scheduled start time replaces %2, resulting in a string like:

Scheduled thread component SMS_SITE_SYSTEM_STATUS_SUMMARIZER is next scheduled to start on Mon Aug 31 13:00:00 1998 Pacific Daylight Time.

If Resolve description strings is not selected, message retrieval is faster, but the preceding message would appear as:

Scheduled thread component "" is next scheduled to start on "".

This option is unavailable when status message viewer is launched from a query because the query determines whether description strings are resolved.

Resolve property strings

Many status messages contain properties and property values that are resolved when the message is generated because there is no way to know ahead of time what the data will be. If Resolve property strings is selected, status message properties and property values, if any, are included with the message and can be searched or filtered. If this option is not selected, message retrieval is faster, but properties and property values cannot be searched or filtered.

This option is unavailable when status message viewer is launched from a query because the query determines whether property strings are resolved.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Set ConfigMgr Status Message Viewer Options

Concepts

ConfigMgr Status Message Viewer Overview


Status Viewer Options Properties: Columns Tab

Use the Columns tab of the Configuration Manager 2007 Status Viewer Options Properties dialog box to specify which columns will be displayed in the status message viewer window.

This tab contains the following elements:

Available columns

Displays the available columns that can be added to the Displayed columns list.

Displayed columns

Displays the columns that will be displayed in the status message viewer window.

Add

Moves the selected columns in the Available columns list to the Displayed columns list.

Remove

Moves the selected columns in the Displayed columns list to the Available columns list.

Note
You cannot move the Severity column from the Displayed Columns list to the Available columns list.

Reset

Resets the Available columns and Displayed columns lists to their default values.

Move Up

Moves the selected columns up in the Displayed columns list, which moves them to the left in the status message viewer window.

Move Down

Moves the selected columns down in the Displayed columns list, which moves them to the right in the status message viewer window.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Set ConfigMgr Status Message Viewer Options

Concepts

ConfigMgr Status Message Viewer Overview


Status Viewer Options Properties: Export Tab

Use the Export tab of the Configuration Manager 2007 Status Viewer Options Properties dialog box to specify the appearance of status messages when they are copied, printed, or saved to a file.

This tab contains the following elements:

Exported details

Choose one of the following options:

  • Only displayed columns: Specifies that only the data that is currently displayed in the status message viewer window will be exported.
  • All possible columns: Specifies that all status message data will be exported, including columns that are not displayed in the status message viewer window.
Information delimiter

Choose one of the following options:

  • Tab delimited: Specifies that exported column data will be separated by the tab character.
  • Comma delimited: Specifies that exported column data will be separated by the comma character.
Export selection

Choose one of the following options:

  • Selected messages: Specifies that only the status messages that are selected in the status message viewer window will be exported.
  • All messages: Specifies that all status messages displayed in the status message viewer window will be exported.
Force selection of export options for each report

Specifies that you want to confirm export settings each time you export status messages.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Set ConfigMgr Status Message Viewer Options

Concepts

ConfigMgr Status Message Viewer Overview


Status Viewer Options Properties: Font Tab

Use the Font tab of the Configuration Manager 2007 Status Viewer Options Properties dialog box to specify the font and style to be used for displaying status message information in the status message viewer window.

This tab contains the following elements:

Type face

Specifies the font to be used to display status message information. You can choose from any installed Windows font on the computer running the Configuration Manager Console.

Type style

Specifies the type style to be used to display status message information.

Size

Specifies the font size to be used to display status message information.

Sample

Displays a preview of the specified type face, type style, and size.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Set ConfigMgr Status Message Viewer Options

Concepts

ConfigMgr Status Message Viewer Overview


System Status Properties: General Tab

This tab has no properties to view or edit.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Security Rights Property Pages

In This Section

Properties - Security Tab

Rights Properties: Security Tab

Object Class Security Right Properties: General Tab

Object Instance Security Right Properties: General Tab

User Security Rights


Properties - Security Tab

Use this tab to set the default Configuration Manager 2007 class and instance security rights on this object. To see and configure this tab, you must have Administrator permission on this node, or on at least one object within this node.

Important
For these Configuration Manager 2007 rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The following columns are displayed in the Class security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

This tab contains the following elements in the Class security rights section:

New

Click the New button to open the Object Class Security Right Properties dialog box, which you can use to create a new security right.

Edit

Click the Edit button to open the Object Class Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Click the Delete button to delete the selected security right.

The following columns are displayed in the Instance security rights section:

  • Name: Displays the Windows User account or group name for which the security right applies.
  • Permissions: Displays the permissions granted for the account in Name for this security object class.

This tab contains the following elements in the Instance security rights section:
New

Click the New button to open the Object Instance Security Right Properties dialog box, which you can use to create a new security right.

Edit

Click the Edit button to open the Object Instance Security Right Properties dialog box, which you can use to modify an existing security right.

Delete

Click the Delete button to delete the selected security right.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Concepts

Overview of Configuration Manager Object Security and WMI
Classes and Instances for Object Security in Configuration Manager

Other Resources

Security Rights Property Pages


Rights Properties: Security Tab

Microsoft System Center Configuration Manager 2007 has many different classes of objects. Use this tab to choose the classes that you want displayed.

Note
Security rights for status messages are not granted on an instance level, although status messages are included in the list of classes by which you can filter.

Caution
The permissions filter is effective until you change it. Consider including all permissions on the filter after you have configured security rights.

Classes

Lists all Configuration Manager 2007 security object classes. Classes are unavailable when the logged-on user has insufficient rights. The Detail pane displays each selected class. Cleared classes are not displayed.

See Also

Concepts

Overview of Configuration Manager Object Security and WMI
Classes and Instances for Object Security in Configuration Manager

Other Resources

Security Rights Property Pages


Object Class Security Right Properties: General Tab

Use this tab to add a new Microsoft System Center Configuration Manager 2007 class security right for a user.

Important
For these Configuration Manager 2007 rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The General tab contains the following elements:

Account

Indicates the user account you are modifying.

User Name

Indicates the user account you are modifying.

Class

Specifies the class of rights.

Instance

You cannot set individual instances for the Object Class Security Rights properties. To change the instances, use the Object Instance Security Rights properties.

Rights

Shows the list of rights that are available with the selected Class. Rights vary from class to class.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Concepts

Overview of Configuration Manager Object Security and WMI
Classes and Instances for Object Security in Configuration Manager

Other Resources

Security Rights Property Pages


Object Instance Security Right Properties: General Tab

Use this tab to add a new Microsoft System Center Configuration Manager 2007 instance security right for a user.

Important
For these Configuration Manager 2007 rights to be effective, the user must be a member of the SMS Admins group on the SMS Provider computer. Adding user rights through the Object Class Security Right Properties dialog box or the Object Instance Security Right Properties dialog box does not give the user or group the necessary membership in SMS Admins.

The General tab contains the following elements:

Account

Indicates the user account you are modifying.

User Name

Indicates the user account you are modifying.

Class

Specifies the class of rights.

Instance

Specifies the instances available for the selected Class.

Rights

Shows the list of rights that are available with the selected Class and Instance. Rights vary between classes and instances.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

See Also

Concepts

Overview of Configuration Manager Object Security and WMI
Classes and Instances for Object Security in Configuration Manager

Other Resources

Security Rights Property Pages


User Security Rights

Use this tab to view, create, or modify security rights on a user account that has already been granted rights to the System Center Configuration Manager 2007 console. If you want to add rights to a new user, run the Manage ConfigMgr Users Wizard.

Name

The user account you want to modify.

Rights

Specifies whether you want to view the rights By Class, By Instance, or Both Class and Instance.

Class

The type of object you want to modify (for example, Collections, Queries, or Packages).

Permissions

The rights assigned to the user.

Add

Lets you add one new class or one new instance right, or lets you run the Manage ConfigMgr Users Wizard to perform more complex rights assignment.

Modify

Lets you modify the selected entry in the Class list.

Remove

Lets you remove the selected entry in the Class list.

Close

Closes the dialog box.


Tools Property Pages

The only default tool under the Microsoft System Center Configuration Manager 2007 Tools node is ConfigMgr Service Manager. To run ConfigMgr Service Manager, right-click the tool name and then click Start ConfigMgr Service Manager. You cannot double-click to start the tools.

In This Section

ConfigMgr Service Manager

See Also

Other Resources

Site Settings Property Pages


ConfigMgr Service Manager

You use Microsoft System Center Configuration Manager 2007 to control Configuration Manager 2007 services. In Configuration Manager 2007 Service Manager, you can view the status of any Configuration Manager 2007 services or threads (referred to collectively as Configuration Manager 2007 components) that are running on any site system. Components are managed the same way you manage services in Windows; you can start, stop, pause, resume, or query Configuration Manager 2007 components.

Services run as soon as there is something for them to do (typically, when a configuration file is written to a component's inbox).

Note
When you open Service Manager, you are opening a separate application. That application does not provide help when you press F1. See the list below for Service Manager Help topics available in this Help file.

See Also

Tasks

How to Open ConfigMgr Service Manager
How to Disconnect a Site
How to Select All Components
How to Query a Component
How to Stop a Component
How to Start a Component
How to Pause a Component
How to Resume a Component
How to Enable Logging for a Component

Concepts

How to Connect to a Site
How to Clear All Status Values
About ConfigMgr Service Manager Actions


Virtual Application Packages Property Pages

This section contains the Configuration Manager 2007 Virtual Application Packages property pages dialog box help topics.

In This Section

Virtual Application Package Properties

Displays information about the selected virtual application package.


Virtual Application Package Properties

In This Section

Virtual Application Package Properties - General Tab

Virtual Application Package Properties - Data Source Tab

Virtual Application Package Properties - Virtual Applications Tab


Virtual Application Package Properties - General Tab

Topic last updated—January 2008

Use the General tab of the Virtual Application Package properties dialog box to specify general information about the virtual application package.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

The General tab contains the following elements:

Name

Specifies the name of the virtual application package, which can be up to 50 characters long. This field is required.

Version

Specifies the version number of the virtual application package, which can be up to 32 characters long.

Manufacturer

Specifies the software manufacturer of the virtual application package, which can be up to 32 characters long.

Language

Specifies the language version of the virtual application package, which can be up to 32 characters long.

Comment

Optional text about the virtual application package, such as a description. You can use up to 127 characters.

Remove this package from clients when it is no longer advertised

Specifies if the virtual application package and associated applications should be removed from target computers when the package advertisement is no longer available. This option is selected by default.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the Help topic for this tab of the dialog box.

See Also

Other Resources

Virtual Application Package Properties


Virtual Application Package Properties - Data Source Tab

Topic last updated—January 2008

Use the Data Source tab of the Virtual Application Package properties to specify the location and to configure additional virtual application package options.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

The Data Source tab contains the following elements:

Source Directory

Specifies the network path to the virtual application package source files. Click Set to launch the New Source dialog box and specify the source directory for the virtual application package.

Update distribution points on a schedule

Specifies that the source files for this virtual application package will be regularly updated on distribution points. When this option is selected, the default schedule is set to the current date with an interval of one day. By default, this check box is cleared.

To set a schedule for distribution point updates, click Schedule to open the Custom Schedule dialog box. This button is available only when Update distribution points on a schedule is selected.

Persist content in client cache

Specifies whether content should be retained in the cache on the client computer indefinitely even if it has already been run. Although this option can be useful with some recurring virtual application packages, you should know that this will reduce the available cache space. Specifying this option might cause a large virtual application package to fail at a later point if there is insufficient space available in the cache. For Configuration Manager 2007 R2 virtual application packages this setting cannot be changed.

Enable binary differential replication

Specifies whether binary delta comparison should be used on changed virtual application package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred.

See Also

Other Resources

Virtual Application Package Properties


Virtual Application Package Properties - Virtual Applications Tab

Topic last updated—January 2008

Use the Virtual Applications tab of the Virtual Application Package properties dialog to verify Name and Version information associated with the virtual application package. This information is generated when the virtual application is created.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

See Also

Other Resources

Virtual Application Package Properties


Wizard Pages

In This Section

Add Boot Image Package Wizard

You can add new boot images for use with operating system deployment using the Add Boot Image Package Wizard.

Add Operating System Install Packages Wizard

You can add new operating system install packages using the Add Operating System Install Packages wizard.

Add Operating System Image Wizard

You can add new operating system install packages using the Add Operating System Install Packages wizard.

Advertise Task Sequence Wizard

You can use the Advertise Task Sequence wizard to advertise a new task sequence.

Assign Configuration Baseline Wizard

Provides links to detailed information about each wizard page in the Assign Configuration Baseline Wizard.

Client Push Installation Wizard

Describes the Client Push Installation Wizard.

Completing the Wizard Page

This wizard page indicates that you have completed the information necessary for the wizard.

ConfigMgr User Wizard

Describes the tabs of the ConfigMgr wizard.

Connect to Site Database Wizard

Use the Connect to Site Database Wizard in Configuration Manager 2007 to guide you through the steps necessary to create a connection to a site database for a Configuration Manager console.

Copy Packages Wizard

Use the Copy Packages Wizard in Configuration Manager 2007 to replicate packages targeted to one or more distribution points or to another distribution point.

Create Application Configuration Item Wizard

Use the Create Application Configuration Item Wizard in Configuration Manager 2007 to create an application configuration item.

Create General Configuration Item Wizard

Use the Create General Configuration Item Wizard in Configuration Manager 2007 to create a general configuration item.

Create Configuration Baseline Wizard

The Create Configuration Baseline Wizard allows you to create a configuration baseline, which contains configuration items and configuration baseline rules that can be used to determine compliance on client computers.

Create Configuration Package Wizard for Mobile Devices

Use the Create Mobile Device Configuration Package Wizard to create a new configuration package for mobile devices in Microsoft System Center Configuration Manager 2007.

Create Direct Membership Rule Wizard

Use the Create Direct Membership Rule Wizard in Configuration Manager 2007 to locate resources that you want to add as direct members of a collection and then create the appropriate membership rules for that collection.

Create Operating System Capture Disk Wizard

This wizard lets you create an operating system capture disk for use with a reference computer.

Create Operating System Configuration Item Wizard

Use the Create Operating System Configuration Item Wizard in Configuration Manager 2007 to create an operating system configuration item.

Create Package From Definition Wizard

Use the Create Package from Definition Wizard in Configuration Manager 2007 to create a package from a package definition file.

Create SQL Reporting Services Report Wizard

Use the Create SQL Reporting Services Report Wizard in Configuration Manager 2007 R2 to create a new model-based or SQL-based report.

Create SQL Reporting Services Subscription Wizard

Use the Create SQL Reporting Services Subscription Wizard in Configuration Manager 2007 R2 to configure a subscription to a SQL Reporting Services report.

Task Sequence Media Wizard

This wizard helps you create new stand-alone or bootable media form which you can launch your operating system deployment from. You can specify CD, DVD, or USB media as the type of media to use.

Delete Collection Wizard

Use the Delete Collection Wizard in Configuration Manager 2007 to delete a collection as well as to display the properties of the collection you want to delete.

Delete Package Wizard

Use the Delete Package Wizard in Configuration Manager 2007 to delete a package as well as to display the properties of the package you want to delete.

Delete Program Wizard

Use the Delete Program Wizard in Configuration Manager 2007 to delete a program as well as to display the properties of the program you want to delete.

Delete Secondary Site Wizard

The Delete Secondary Site Wizard is used to delete or uninstall a secondary site from the primary site Configuration Manager console.

Deploy Software Updates Wizard

Use the Deploy Software Updates Wizard in Configuration Manager 2007 to create a software update deployment, which downloads the software updates and creates a deployment package if necessary, allows for the creation of deployment templates, and deploys the software updates defined in the deployment to members of the target collection.

Deployment Template Wizard

Use the Software Update Deployment Template Wizard in Configuration Manager 2007 to create a software update deployment template, which stores many of the software update deployment properties.

Distribute Software Wizard

Use the Distribute Software Wizard in Configuration Manager 2007 to distribute an existing software distribution package or create a new package and then distribute it to clients.

Distribute Software to Devices Wizard

The Distribute Software to Devices Wizard enables you to easily distribute software to mobile devices by guiding you through the process of defining a package and creating an advertisement for a selected collection.

Download Updates Wizard

Use the Download Updates Wizard in Configuration Manager 2007 to download and copy the software updates to the deployment package folder on the distribution points configured for the package. It allows administrators to prepare, or provision, the distribution points with the software updates source files prior to deploying them.

Export Object Wizard

Use the Configuration Manager 2007 Export Object Wizard to export the following object types, Reports, Queries and Collections.

Import Computer Information Wizard

The Import Computer Information Wizard in Configuration Manager 2007 imports new computer information into the Configuration Manager database.

Import Configuration Data Wizard

Use the Configuration Manager 2007 Import Configuration Data Wizard to import configuration items and configuration baselines from cabinet (.cab) files.

Import New Driver Wizard

Use the Import New Driver Wizard to import Windows device drivers into the driver catalog.

Import Object Wizard

Use the Microsoft System Center Configuration Manager 2007 Import Object Wizard to import the following object types, Reports, Queries and Collections.

Manage Distribution Points Wizard

Use the Manage Distribution Points Wizard in Configuration Manager 2007 to guide you through the steps necessary to copy, update, refresh, or delete package data on distribution points so that programs within the current package can be advertised to clients.

Manage Distribution Points (Operating System Deployment)

The Manage Distribution Points Wizard helps you copy a package to a new distribution point, remove a package from an existing distribution point, or update the contents of an existing package on a distribution point.

New Advertisement Wizard

Use the New Advertisement Wizard in Configuration Manager 2007 to create an advertisement that causes a program to run on a specific client or collection of clients.

New Dashboard Wizard

Use the New Dashboard Wizard in Configuration Manager 2007 to create a new dashboard, which displays multiple reports on a single page.

New Distribution Points Wizard

Use the New Distribution Points Wizard in Configuration Manager 2007 to select the distribution points to which you want to add the package.

New Distribution Points Wizard - Operating System Deployment

The New Distribution Points Wizard helps you copy a new or existing package to a new distribution point. Before computers can access and install a package they must be available on an accessible distribution point.

New Package Wizard

Use the New Package Wizard in Configuration Manager 2007 to create a package manually in its entirety.

New Policies Wizard

The New Policies Wizard in Configuration Manager 2007 lets you create ConfigMgr NAP policies that you want to be included in Network Access Protection (NAP) evaluation, and specify when they will be become active on Configuration Manager 2007 clients that are able to support Network Access Protection.

New Program Wizard

Use the New Program Wizard in Configuration Manager 2007 to add a new program for inclusion within a package.

New Report Wizard

Use the New Report Wizard in Configuration Manager 2007 to add a new report.

New Windows Vista Deployment Collection Wizard

The New Windows Vista Deployment Collection Wizard allows you to create a Configuration Manager 2007 collection of computers that you can deploy the Windows Vista operating system to.

Secondary Site Creation Wizard

The Secondary Site Creation Wizard allows you to create a secondary site from a primary site Configuration Manager console.

New Site Role Wizard

The New Site Role Wizard is used to add new site roles to existing site systems.

New Site System Server Share Wizard

The New Site System Server Share Wizard allows you to create a new server share site system to host the distribution point site server role.

New Site System Server Wizard

The New Site System Server Share Wizard allows you to create a new server share site system to host the distribution point site server role.

New Task Sequence Wizard

Use this wizard to create a new task sequence.

New Program for Device Wizard

The New Program for Device Wizard allows you to create a program for mobile devices.

New Mobile Device Configuration Item Wizard

Use the New Mobile Device Configuration Item Wizard to create new configuration items for mobile devices in Configuration Manager 2007.

New Collection Wizard

Use the New Collection Wizard in Configuration Manager 2007 to specify information about a new collection, and to configure membership rules, security, and other information for that collection.

Site Repair Wizard

The Site Repair Wizard is used to recover failed Configuration Manager sites from backups created using the Backup ConfigMgr Site Server maintenance task.

Task Sequence - New Advertisement Wizard

The New Advertisement Wizard is used to advertise a task sequence to a collection of one or more target computers.

Transfer Site Settings Wizard

The Transfer Site Settings Wizard is used to transfer site settings to or from a site.

Update List Wizard

Use the Update List Wizard in Configuration Manager 2007 to add software updates to a new or existing update list.

Upgrade Secondary Site Wizard

The Upgrade Secondary Site Wizard helps you to upgrade Microsoft Systems Management Server (SMS) 2003 sites or reinstall Configuration Manager 2007 secondary sites directly beneath the primary site that the wizard is started on.

Wizard - Summary Page

The Summary wizard page displays the options and settings that you have selected for this wizard.

Wizard - Progress Page

The Progress page displays the current task and progress of the wizard.

Wizard - Completing the Wizard Page

This wizard page lists the settings that were applied by the wizard.


Add Boot Image Package Wizard

You can add new boot images for use with operating system deployment using the Add Boot Image Package Wizard.

See Also

Concepts

Add Boot Image Package Wizard - Data Source Page
Add Boot Image Package Wizard - General Page


Add Boot Image Package Wizard - Data Source Page

You can use the Data Source page to add a boot image to use with operating system deployment. You must specify a path to the boot image WIM file in a valid Universal Naming Convention (UNC) format. The SMS Provider must have read access to the location specified.

This page contains the elements described in the following table.

Setting Description

Path

Specifies the path to the boot image you want to add by using UNC format. You can enter the information, or click Browse to search for the WIM file you want to add.

Boot Image

If multiple boot images are associated with the WIM file specified, use the drop-down list to select the boot image that you want to use.

Only finalized boot images can be imported. A finalized boot image must have at least three optional components installed. The three components that must be installed on the boot image are:

  • Scripting
  • WMI
  • XML

See Also

Concepts

Add Boot Image Package Wizard - General Page


Add Boot Image Package Wizard - General Page

You can provide identifying information for the boot image package on the General page.

  • Name - Enter a descriptive name for the boot image package.
  • Version - Enter the applicable version information for the boot package.
  • Comment - Enter an optional comment about the boot image package.

See Also

Concepts

Add Boot Image Package Wizard - Data Source Page


Add Operating System Install Packages Wizard

You can add new operating system install packages using the Add Operating System Install Packages wizard.

See Also

Reference

Add Operating System Install Packages - Data Source
Add Operating System Install Packages - General


Add Operating System Install Packages - Data Source

Specify the source location for the new operating system package on the Data Source page. The path specified must be a valid Universal Naming Convention (UNC) path. The SMS Provider must have read access to the location specified.

This page contains the elements described in the following table.

Name | Description
Browse | Specifies the source directory for the operating system install package. The source directory is specified in UNC format.


Add Operating System Install Packages - General

The General page of the Add Operating System Install Packages Wizard allows you to provide identifying information for the operating system install package.

This page contains the elements described in the following table.

Name | Description
Name | Specifies a descriptive name for the install package.
Version | Specifies the applicable version information for the install package.
Comment | Allows you to optionally enter a comment about the install package.


Add Operating System Image Wizard

You can add a new operating system image for use with operating system deployment using the Add Operating System Image Wizard.

See Also

Concepts

Add Operating System Image - Data Source
Add Operating System Image - General


Add Operating System Image - Data Source

Specify the source location and file name for the new operating system image WIM file on the Data Source page. The path specified must be a valid Universal Naming Convention (UNC) path. The SMS Provider must have read access to the location specified.

This page contains the element described in the following table.

UI Element List

Name | Description
Browse | Specifies the source directory and file name for the operating system install package WIM file. The source directory is specified in UNC format.

See Also

Concepts

Add Operating System Image Wizard


Add Operating System Image - General

The General page of the Add Operating System Image Wizard allows you to provide identifying information for the operating system image.

This page contains the elements described in the following table.

Name | Description
Name | Specifies a descriptive name for the install package.
Version | Specifies the applicable version information for the install package.
Comment | Allows you to optionally enter a comment about the install package.

See Also

Concepts

Add Operating System Image Wizard


Advertise Task Sequence Wizard

You can use the Advertise Task Sequence wizard to advertise a new task sequence.

In This Section

Name

Advertise Task Sequence Wizard - General Page

Advertise Task Sequence Wizard - Schedule Tab

Advertise Task Sequence Wizard - Distribution Points

Advertise Task Sequence Wizard - Interaction Page


Advertise Task Sequence Wizard - General Page

Use the General page of the New Advertisement Wizard to configure general information about the new advertisement.

This page contains the elements described in the following table.

Name | Description
Name | Specifies a descriptive name for the new advertisement.
Comment | Optionally, allows you to enter a comment about the advertisement.
Task Sequence | Allows you to specify the task sequence that should be advertised by clicking Browse, and then selecting the task sequence that should be advertised to Configuration Manager 2007 clients.
Collection | Specifies the collection that this advertisement will be made available to. Click the Browse button to launch the Browse Collection dialog box. Specify the collection by selecting the appropriate item in the Collections list. Click OK to close the Browse Collection dialog box.
Include members of subcollections | Specifies that the advertisement should be made available to members of the subcollections. By default, the task sequence will be made available to subcollections.
Make this task sequence available to Boot Media and PXE | Specifies that the advertisement should be made available to Boot Media or PXE Configuration Manager 2007 clients.

See Also

Other Resources

Advertise Task Sequence Wizard


Advertise Task Sequence Wizard - Schedule Tab

Use the Schedule tab to specify when a program will be advertised to members of a target collection.

Note
When you click OK or Apply, Configuration Manager 2007 ensures that any assignment schedule entries do not occur before the Advertisement start time. Configuration Manager 2007 also ensures that if an expiration date and time is set, it does not occur before any of the assignment schedule entries or before the Advertisement start time.

The Schedule tab contains the following elements:

UI Element List

Advertisement start time

Specifies the date and time when the program is advertised and available to run on clients in their respective time zones. By default, the current date and time is specified. To select another date and time, click the adjacent arrows. To specify that the advertisement start date and time are based on UTC rather than local time, select the UTC check box.

Note
If you select the UTC option, the program will be advertised on all clients simultaneously.

When a mandatory assignment is defined for this advertisement, client computers will use the advertisement start time to determine when to start downloading the package. This will occur if the advertisement settings indicate the client should download the package before running the program.

Advertisement expires

Specifies whether the advertisement has a date and time after which the program advertisement is no longer available to run on clients in their respective time zones.

By default, the cutoff date and time is set at 6 months from the current date and time. To specify another date and time, click the adjacent arrows.

To specify that the advertisement start date and time are based on UTC rather than local time, select the UTC check box.

Note
If you select the UTC option, the advertisement will expire on all clients simultaneously.

Mandatory assignments

Specifies any mandatory assignment schedules, which indicate that Configuration Manager will automatically run the program at a specific time or according to a specific event (such as Logon/Logoff).

The following options are available for managing advertisement class security rights:

  • New icon: Click to open the Assignment Schedule dialog box and create a new assignment schedule.
  • Properties icon: Click to open the Assignment Schedule dialog box to view or modify the current schedule settings.
  • Delete icon: Click to delete the selected assignment.
Enable Wake On LAN

Specifies whether the site server will send a Wake On LAN transmission to wake up the client computer prior to the advertised program.

Ignore maintenance windows when running program

Specifies whether to have the advertised program ignore maintenance windows while the program is running.

Allow system restart outside maintenance windows

Specifies whether to allow the advertised program to restart the client even if the restart would occur outside a maintenance window.

Priority

Specifies the advertisement's sending priority when replicated to child sites. Available options are Low, Medium (default), and High priorities.

Program rerun behavior

Specifies whether the advertised program will be rerun on the client computer and under what conditions. The following options are available:

  • Never rerun advertised program (default)
  • Always rerun program
  • Rerun if failed previous attempt
  • Rerun if succeeded on previous attempt
OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Other Resources

Advertise Task Sequence Wizard


Advertise Task Sequence Wizard - Distribution Points

You can specify how Configuration Manager 2007 clients interact and obtain content from packages referenced by the task sequence on the Distribution Points page.

This page contains the elements described in the following table.

Term Definition

Download content locally when needed by running task sequence

Configures the Configuration Manager Client to download files as needed to complete the task sequence. Only files that are not already present on the target computer will be downloaded.

Download all contents locally before starting task sequence

Configures the Configuration Manager Client to download all of the necessary installation files locally before initiating the installation. All of the files will be downloaded and stored in the client cache prior to running the task sequence.

Access content directly from a distribution point when needed by the running task sequence

Configures the Configuration Manager Client to run the task sequence installation from a distribution point. The task sequence will access and install the necessary files and applications over the network.

When no local distribution point is available, use a remote distribution point

Allows the Configuration Manager Client to use a remote distribution point if no local distribution point is available. All programs and files referenced with the task sequence must be available on a distribution point accessible by the Configuration Manager Client or the task sequence will fail.

When no protected distribution point is available, use an unprotected distribution point

Specifies whether Configuration Manager 2007 will permit a client to use an unprotected distribution point if content is not immediately available on its protected distribution point, or if it forces a client to use the protected local distribution point if it is within the boundaries for that point. This option is selected by default.

If this checkbox is selected, a client will use distribution points based on the following criteria:

  • If a protected distribution point with the content provisioned exists, the client will not use unprotected distribution points.
  • If a protected distribution with the content provisioned does not exist, the client will use unprotected distribution points.

If the check box is cleared, then regardless of whether or not a protected distribution point with the content provisioned exists, the client will not use unprotected distribution points.

Note
All programs and files referenced by the task sequence must be available on a distribution point accessible by the Configuration Manager Client or the task sequence will fail.

See Also

Other Resources

Advertise Task Sequence Wizard


Advertise Task Sequence Wizard - Interaction Page

You can specify how Configuration Manager 2007 clients are notified and interact with this advertised program on the Interaction page.

This page contains the elements described in the following table.

Allow users to run the program independently of assignments

Specifies whether Configuration Manager 2007 clients can run this program when they receive it or if the user must wait for the configured mandatory assignment.

Display reminders according to the client agent reminders

Displays client reminders as specified in the client agent. For more information about client agent reminders and other properties use the following link: Client Agents Properties

Use custom countdown notification length (minutes):

Specifies in minutes how long the notification should run.

Show the task sequence progress

Specifies if the task sequence progress bar is visible to users..

See Also

Other Resources

Advertise Task Sequence Wizard


Assign Configuration Baseline Wizard

Use the Assign Configuration Baseline Wizard in Configuration Manager 2007 to assign a configuration baseline to a Configuration Manager 2007 collection. After a configuration baseline is assigned to a collection, the assignment is shown in the Assignments tab of the configuration baseline properties where it can be edited or deleted.

Note
You might need to run the Refresh action before new configuration baselines are displayed in the Configuration Baselines node.

Click the related link below for detailed information about each wizard page in the Assign Configuration Baseline Wizard.

Choose Configuration Baselines Page

Specifies one or more configuration baselines to assign to a Configuration Manager 2007 collection. After the assignment is created, it is displayed in the Configuration Baseline Properties: Assignments Tab

Choose Collection Page

Specifies the Configuration Manager 2007 collection to assign the configuration baseline to and whether to include members of subcollections in the assignment. After the assignment is created, it is displayed in the Configuration Baseline Properties: Assignments Tab

Set Schedule Page

Specifies the schedule by which the assigned configuration baseline will be evaluated on client computers. This can be either a simple or a custom schedule. After the assignment is created, it is displayed in the Configuration Baseline Properties: Assignments Tab

Note
Although you can assign configuration baselines to a collection that contains users or user groups, the configuration baselines will only be evaluated on client computers in the collection, and not users or user groups in the collection.

Summary Page

Displays the Wizard - Summary Page.

Progress Page

Displays the Wizard - Progress Page.

Completing the Wizard Page

Displays the Wizard - Completing the Wizard Page.

See Also

Tasks

How to Set the Configuration Baseline Assignment Compliance Evaluation Schedule in Desired Configuration Management

Reference

Configuration Baseline Assignment Properties Dialog Box
Configuration Baseline Properties: Assignments Tab

Concepts

About Configuration Baselines in Desired Configuration Management


Client Push Installation Wizard

Use the Client Push Installation Wizard in Configuration Manager 2007 to install the Configuration Manager client to a collection, a query or a computer.

The client push installation wizard contains the pages described in the following table:

Welcome Page

Displays an introduction page to identify the purpose of the wizard.

Installation Options Page

Configures the following options for client push installation:

  • Include domain controllers: If this item is selected, then the Configuration Manager 2007 client will be installed to any domain controllers in the targeted resources.
Note
If you have configured client push installation to install to domain controllers on the General tab of the Client Push Installation Properties dialog box then this item will be automatically selected and grayed out.

  • Include only clients in this site's boundaries: If this item is selected, then any targeted computers must be in this Configuration Manager 2007 site boundaries to install the client software.
Note
If no boundaries are defined for this Configuration Manager 2007 site then this item will be unavailable.

  • Include subcollections: If this item is selected and you are targeting the client push installation to a collection, then any subcollections of this collection will also be targeted with the Configuration Manager 2007 client.
Note
If you are targeting client push installation to a single computer or to the results obtained from running a query then this option will be unavailable.

  • Always install (repair or upgrade existing client): If this item is selected then the Configuration Manager 2007 client will be installed on all applicable targeted computers, even if they already contain a Configuration Manager 2007 client.
Completing the Wizard Page

This page lists the settings that were specified for this wizard. Click Finish to close the wizard and to begin the client push installation based on these settings.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push

Concepts

Overview of Configuration Manager Client Deployment


Completing the Wizard Page

This wizard page indicates that you have completed the information necessary for the wizard. Click Finish to complete the wizard and close the dialog box.


ConfigMgr User Wizard

In This Section

ConfigMgr User Wizard: User Name Tab

ConfigMgr User Wizard: User Rights Tab

ConfigMgr User Wizard: Add Right Tab

ConfigMgr User Wizard: Copy Right Tab

See Also

Reference

Wizard - Summary Page
Wizard - Progress Page
Wizard - Completing the Wizard Page

Concepts

Overview of Configuration Manager Object Security and WMI

Other Resources

Wizard Pages


ConfigMgr User Wizard: User Name Tab

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name Description

Modify an existing user

Selects a user or group that has already been added to the Configuration Manager console.

Add a new user

Adds a user or group that exists in the Active Directory Domain Services database but has not yet been added to the Configuration Manager console.

Remove an existing user

Removes a user or group from the Configuration Manager console.

Browse

Opens the Select User, Computer, or Group dialog box to select a user from Active Directory Domain Services.

Note
When assigning security rights to users in forests different than the site server forest, and there is a two-way trust between the forests, if you use the Browse button to locate the user, the user name is entered as <FQDN>:3268\<username>. The :3268 after the fully qualified domain is not valid syntax and you cannot proceed until you delete the :3268 after the FQDN

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Other Resources

ConfigMgr User Wizard


ConfigMgr User Wizard: User Rights Tab

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name | Description
Rights | Displays the rights currently assigned to the user.
Delete | Deletes the selected right in the Rights table.
The listed rights are sufficient | Lets you proceed to the final page of the wizard.
Add another right or modify an existing one | Lets you proceed to the Add Rights tab.
Copy rights from an existing ConfigMgr user or user group | Lets you proceed to the Copy Rights tab.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Other Resources

ConfigMgr User Wizard


ConfigMgr User Wizard: Add Right Tab

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name | Description
Class | Selects the object class you want to assign.
Instance | Selects an instance of the object class you want to assign. The default is (All Instances). Some classes do not allow you to set instance permissions, such as Status Message. Some classes have no instances until you create them, such as Package.
Rights | Lists the available rights for the Class and Instance you selected. The available rights vary by instance and class. You must also have Read to use any right except Administer, Create, or Delegate.
Select All | Selects all rights in the list.
Clear All | Clears all rights in the list.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Other Resources

ConfigMgr User Wizard


ConfigMgr User Wizard: Copy Right Tab

This page contains the Microsoft System Center Configuration Manager 2007 elements described in the following table.

Name | Description
Source user | Selects a user that already exists in the Configuration Manager console.
Rights | Displays all of the rights currently assigned to the source user. You must copy all of these rights to the destination user and these rights will replace any rights the destination user currently has.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Other Resources

ConfigMgr User Wizard


Connect to Site Database Wizard

Use the Connect to Site Database Wizard in Configuration Manager 2007 to guide you through the steps necessary to create a connection to a site database for a Configuration Manager console.

You can use the wizard to locate and connect to a Configuration Manager primary site database. You can reconnect to a site database you have previously connected to, or you can create a new connection to a new site database.

Click the related link in the following list for detailed information about each wizard page in the Connect to Site Database Wizard.

In This Section

Connect to Site Database Wizard: Welcome Page

The Welcome page introduces you to the purpose of the wizard.

Connect to Site Database Wizard: Locate Site Database Page

The Locate Site Database page is used to select a site database for the Configuration Manager console to reconnect or connect to.

Connect to Site Database Wizard: Console Tree Items Page

The Console Tree Items page is used to select the console tree items displayed in the Configuration Manager console after the connection to a primary site server has been established.

Note
This page is displayed only if you select to customize the console tree items displayed in the Locate Site Database page.

Connect to Site Database Wizard: Summary Page

The Summary page displays the selected tree items to be displayed in the Configuration Manager console after the connection to a primary site server has been established.


Connect to Site Database Wizard: Welcome Page

The Welcome page of the Connect to Site Database Wizard introduces you to the purpose of the wizard.

You can use the wizard to located and connect to a Configuration Manager primary site database. You can reconnect to a site database you have previously connected to, or you can create a new connection to a new site database.

This page contains the elements described in the following table.

Name | Description
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Connects to the selected site database (disabled on the Welcome page).
Cancel | Discards the settings, and exits the wizard.

See Also

Concepts

Connect to Site Database Wizard


Connect to Site Database Wizard: Locate Site Database Page

The Locate Site Database page of the Connect to Site Database Wizard is used to select a site database for the Configuration Manager console to reconnect or connect to.

This page contains the elements described in the following table.

Name Description

Reconnect to the site database for the following server

Use this option to reconnect the Configuration Manager console to a previously connected site server. By default, the previously connected site server name is displayed.

Connect to the site database for the following server

This option is used to enter a valid primary site server to connect to. You can either manually type in a computer name or click Browse to select from a list of computer names.

Note
When entering a site server name to connect to, you must enter the NetBIOS name of the site server computer. FQDN site server names are not supported for connecting the Configuration Manager console to the site server.

Load all console tree items (typical)

This option is used to display all Configuration Manager console tree items when the connection to a primary site server is made.

Select console items to be loaded (custom)

This option is used to customize the Configuration Manager console tree items displayed when the connection to a primary site server is made. Selecting this option will cause the Console Tree Items page to be displayed when you click Next.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Connects to the selected site database.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Connect to Site Database Wizard


Connect to Site Database Wizard: Console Tree Items Page

The Console Tree Items page of the Connect to Site Database Wizard is used to select the console tree items displayed in the Configuration Manager console after the connection to a primary site server has been established.

This page contains the elements described in the following table.

Name | Description
Items | Select from the available console tree items to be displayed in the Configuration Manager console after the connection to the primary site server has been established. By default, all Configuration Manager console tree items are selected. To select or deselect a console tree item, click the check box next to the item name.
Select All | Selects all available console tree items.
Clear All | Deselects all available console tree items.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Connects to the selected site database.
Cancel | Discards the settings, and exits the wizard.

See Also

Concepts

Connect to Site Database Wizard


Connect to Site Database Wizard: Summary Page

The Summary page of the Connect to Site Database Wizard displays the selected tree items to be displayed in the Configuration Manager console after the connection to a primary site server has been established.

This page contains the elements described in the following table.

Name | Description
Console Tree Items | Displays the console tree items that will be displayed in the Configuration Manager console after the connection to the primary site server has been established.
Select All | Selects all available console tree items.
Clear All | Deselects all available console tree items.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Connects to the selected site database.
Cancel | Discards the settings, and exits the wizard.

See Also

Concepts

Connect to Site Database Wizard


Copy Packages Wizard

Use the Copy Packages Wizard in Microsoft System Center Configuration Manager 2007 to replicate packages targeted to one or more distribution points or to another distribution point.

Click the related link below for detailed information about each wizard page in the Copy Packages Wizard.

In This Section

Select Destination Distribution Point Page

Specifies the destination distribution point to which you want to replicate the copied packages.

Select Packages Page

Specifies the package or packages that you want to copy to the destination distribution point.

Wizard - Summary Page

Provides a summary of the new program properties.

Wizard - Progress Page

Provides the progress for the new program creation.

Wizard - Completing the Wizard Page

Provides a summary of the created program properties or a list of issues that occurred during program creation.

See Also

Tasks

How to Create a Program

Concepts

About Programs

Other Resources

How to Manage Programs


Select Destination Distribution Point Page

Use the Select Destination Distribution Point page in the Configuration Manager 2007 Copy Packages Wizard to specify the destination distribution point to which you want to replicate the copied packages.

This page contains the elements described in the following table.

UI Element List

Name | Description
Destination Distribution Point | Specifies the distribution point that will receive the packages.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages


Select Packages Page

Use the Select Packages page in the Configuration Manager 2007 Copy Packages Wizard to specify the package or packages that you want to copy to the destination distribution point.

The Copy Packages Wizard prefilters the copy sources based on the package type, so that when run from the Software Distribution node, this wizard will display only software packages. If you want to copy all package types to a new distribution point (that is, you want to effectively "clone" the original distribution point), this wizard must be run five times, once from each appropriate package-type node (Software Updates, OSD, and so forth).

This page contains the elements described in the following table.

UI Element List

Name Description

Select Packages

Specifies the software distribution package or packages to replicate to the destination distribution point. To specify a package, select that package in the displayed list.

Two viewing options are available in the displayed list:

  • Expand All: Expands any folders present in the displayed list.
  • Collapse All: Collapses any expanded folders in the displayed list.

The following options are available for selecting packages:

  • Select All: Selects all packages displayed in the list.
  • Clear All: Clears all selected packages displayed in the list.
  • Source: Opens the Select Source Distribution Point dialog box, where you can select a distribution from which all packages present will be replicated. To specify the replication of all packages from one or more distribution points, select the appropriate distribution points in this dialog box, and then click OK.

Note
When you select packages for copying, those packages will be copied to the destination distribution point, even if they have already been copied previously.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages


Copy Reports to Reporting Services Wizard

Topic Last Updated—August 2008

Use the Copy Reports to Reporting Services Wizard in Configuration Manager 2007 to copy the standard Configuration Manager reports to SQL Reporting Services.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This wizard contains the elements described in the following table.

Name Description

Data Source Settings page
  • Server name: Specify the name of the Configuration Manager 2007 database server to be used as the data source for SQL Reporting Services. To specify a database instance, use the format <Server Name>\<Instance Name>.
  • Database name: Specify the name of the Configuration Manager 2007 database to be used as the data source for SQL Reporting Services.
  • Test: Click to test the connection to the Configuration Manager 2007 database.
    Note
    If the connection test fails, a red warning symbol will be displayed. Move the cursor over this symbol to read details of the failure. Correct the failure, then click Test again.

Data Source Authentication page
  • Credentials supplied by the user running the report: This option is not currently supported by SQL Reporting Services in Configuration Manager 2007 R2.
  • Display the following text to prompt the user for a username and password: This option is not currently supported by SQL Reporting Services in Configuration Manager 2007 R2.
  • Credentials stored securely in the report server: Select this option if you want to store an encrypted user name and password for users to use to access reports on the report server. This option is typically used when you need to run reports unattended—for example, a report initiated by a subscription.
  • User name: If the option Credentials stored securely in the report server is selected, specify the user name that users must specify to access reports.
  • Password: If the option Credentials stored securely in the report server is selected, specify the password that users must use to access reports.
  • Use as Windows credentials when connecting to the data source: Check this box if the specified credentials are Windows authentication credentials. Do not check this box if you are using database authentication (for example, SQL Server authentication).
  • Impersonate the authenticated user after a connection has been made to the data source: If the option Credentials stored securely in the report server is selected, this option can be used to allow delegation of credentials if the data source supports it. For more information about this option, refer to your SQL Server documentation.
  • Windows integrated security: If selected, the credentials of the logged-on user will be used to access the data source.
  • Credentials are not required: If selected, no credentials are required or used when connecting to the data source.

Select Reports page

Specifies the reports you want to copy to the reporting services point. Select Overwrite existing reports to overwrite any reports that already exist on the reporting services point.

Security page

Specifies the users and associated permissions that will be applied to the copied reports. For more information about the options on this page, see Reporting Services Properties: Security Tab.

Summary

Displays a summary of the actions that will be taken by the wizard.

Confirmation

Provides a confirmation that the Configuration Manager reports were successfully copied to the Reporting Services point. When the wizard fails to copy reports, an error displays on this page.

See Also

Tasks

How to Copy Configuration Manager Reports to SQL Reporting Services
How to Create a Reporting Services Point for SQL Reporting Services
How to Configure Properties for the Reporting Services Point

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create Application Configuration Item Wizard

Use the Create Application Configuration Item Wizard in Configuration Manager 2007 to create an application configuration item. After the application configuration item is created, it is displayed in the Configuration Items node of the Configuration Manager console and available for use when creating or modifying configuration baselines.

Note
You might need to run the Refresh action before new configuration items are displayed in the Configuration Items node.

Click the related link below for detailed information about each wizard page in the Create Application Configuration Item Wizard.

Identification Page

Specifies the name and description of the configuration item, and also allows you to assign categories to the configuration item. After the configuration item is created, these options are displayed in the Configuration Item Properties: General Tab.

Detection Method Page

Specifies the options in the Configuration Item Properties: Detection Method Tab.

Objects Page

Specifies the options in the Configuration Item Properties: Objects Tab.

Settings Page

Specifies the options in the Configuration Item Properties: Settings Tab.

Applicability Page

Specifies the options in the Configuration Item Properties: Applicability Tab

Summary Page

Displays the Wizard - Summary Page.

Progress Page

Displays the Wizard - Progress Page.

Completing the Wizard Page

Displays the Wizard - Completing the Wizard Page.

See Also

Concepts

About Configuration Items in Desired Configuration Management
About Configuration Categories in Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Authoring Configuration Data for Desired Configuration Management
Determine If You Need to Create Configuration Items for Desired Configuration Management
Choose the Configuration Item Type to Create for Desired Configuration Management

Other Resources

How to Configure Configuration Items for Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


Create General Configuration Item Wizard

Use the Create General Configuration Item Wizard in Configuration Manager 2007 to create a general configuration item. After the general configuration item is created, it is displayed in the Configuration Items node of the Configuration Manager console and available for use when creating or modifying configuration baselines.

Note
You might need to run the Refresh action before new configuration items are displayed in the Configuration Items node.

Click the related link in the following section for detailed information about each wizard page in the Create General Configuration Item Wizard:

Identification Page

Specifies the name and description of the configuration item, and also allows you to assign categories to the configuration item. After the configuration item is created, these options are displayed in the Configuration Item Properties: General Tab.

Objects Page

Specifies the options in the Configuration Item Properties: Objects Tab.

Settings Page

Specifies the options in the Configuration Item Properties: Settings Tab.

Applicability Page

Specifies the options in the Configuration Item Properties: Applicability Tab.

Summary Page

Displays the Wizard - Summary Page.

Progress Page

Displays the Wizard - Progress Page.

Completing the Wizard Page

Displays the Wizard - Completing the Wizard Page.

See Also

Concepts

About Authoring Configuration Data for Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Configuration Categories in Desired Configuration Management
About Configuration Items in Desired Configuration Management
Choose the Configuration Item Type to Create for Desired Configuration Management
Determine If You Need to Create Configuration Items for Desired Configuration Management

Other Resources

How to Configure Configuration Items for Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


Create Configuration Baseline Wizard

The Create Configuration Baseline Wizard allows you to create a configuration baseline, which contains configuration items and configuration baseline rules that can be used to determine compliance on client computers.

When the wizard has successfully created the configuration baseline, you can view and edit its properties from the Configuration Baselines node and perform the following additional actions:

Note
You might need to run the Refresh action before new configuration baselines are displayed in the Configuration Baselines node.

  • Assign to a collection
  • Export configuration data
  • Duplicate
  • Disable
  • View XML definition
  • Manage categories

Click the related link below for detailed information about each wizard page in the Create Configuration Baseline Wizard.

In This Section

Create Configuration Baseline Wizard: Identification Page

Displays the name and description of the configuration baseline and also allows you to assign categories to the configuration baseline. After the configuration baseline is created, these options are displayed in the Configuration Baseline Properties: General Tab

Create Configuration Baseline Wizard: Set Configuration Baseline Rules

Displays the same options that can be found in the Configuration Baseline Properties: Rules Tab. These specify the configuration items and configuration baseline rules.

Create Configuration Baseline Wizard: Summary Page

Displays the Wizard - Summary Page, which provides a summary of the configuration baseline properties.

Create Configuration Baseline Wizard: Progress Page

Displays the Wizard - Progress Page, which provides the progress for the configuration baseline creation.

Create Configuration Baseline Wizard: Completed Page

Displays the Wizard - Completing the Wizard Page, which provides a summary of the created configuration baseline properties or a list of issues that occurred during configuration baseline creation.


Create Configuration Package Wizard for Mobile Devices

Use the Create Mobile Device Configuration Package Wizard to create a new configuration package for mobile devices in Microsoft System Center Configuration Manager 2007. After the configuration package is created, it is displayed in the Administrator console in System Center Configuration Manager / Site Database / Computer Management / Mobile Device Management / Configuration Packages node and can be advertised and distributed to Configuration Manager 2007-managed mobile devices.

In This Section

Click the related link below for detailed information about each create configuration package wizard page.

Name and Description for Configuration Packages for Mobile Devices

Specifies the name and description of the mobile device configuration package.

Select Configuration Items for Configuration Packages for Mobile Devices

Specifies the platform and configuration item or configuration items in the configuration package.

Wizard - Summary Page

Displays the options and settings that you have selected for this wizard.

Wizard - Progress Page

Displays the current task and progress of the wizard.

Wizard - Completing the Wizard Page

Lists the settings that were applied by the wizard.

See Also

Concepts

About Configuration Packages for Mobile Devices
About Configuration Items for Mobile Devices


Name and Description for Configuration Packages for Mobile Devices

Use the Name and Description page of the Create Configuration Package Wizard to specify the name and description of the configuration package in Microsoft System Center Configuration Manager 2007. After the configuration package is created, it is displayed in the Administrator console in Configuration Manager / Site Database / Computer Management / Mobile Device Management / Configuration Packages.

This page contains the elements described in the following table.

Name

Specifies the name of the configuration package for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration package for mobile devices. The description should give an overview of the configuration package and relevant information that helps identify it among other items displayed in the Configuration Package pane of the Configuration Manager 2007 Administrator console.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Reference

Select Configuration Items for Configuration Packages for Mobile Devices

Concepts

How to Create Configuration Packages for Mobile Devices
How to Create Configuration Items for Mobile Devices

Other Resources

Create Configuration Package Wizard for Mobile Devices


Select Configuration Items for Configuration Packages for Mobile Devices

Use the Select Configuration Items page of the Create Configuration Package Wizard to specify the mobile device platform of the configuration package and the configuration items distributed by the configuration package in Microsoft System Center Configuration Manager 2007.

This page contains the elements described in the following table.

Show configuration items for the following platform

Specifies the platform of the configuration items to be displayed.

Note
Use caution in selecting the platform for the configuration package. Once the configuration package is created the platform cannot be changed. Configuration items unavailable to the selected platform type cannot be added to the package later.

Include the following configuration items in the package

Specifies the configuration items to be included in the configuration package. Mark the checkbox of each of the configuration items to be included in the configuration package.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Reference

Name and Description for Configuration Packages for Mobile Devices

Concepts

How to Create Configuration Packages for Mobile Devices
How to Create Configuration Items for Mobile Devices

Other Resources

Create Configuration Package Wizard for Mobile Devices


Create Direct Membership Rule Wizard

Use the Create Direct Membership Rule Wizard in Configuration Manager 2007 to locate resources that you want to add as direct members of a collection and then create the appropriate membership rules for that collection.

Click the related link below for detailed information about each wizard page in the Create Direct Membership Rule Wizard.

In This Section

Search for Resources Page

Provides a means for searching for the resources that you want to add as direct members of a collection.

Collection Limiting Page

Specifies a specific collection in which to search for resources.

Select Resources Page

Specifies the resources that you want to add as direct members of a collection.

Completing the Wizard Page

Specifies that you have provided the information needed by the wizard, and confirms that you want to delete the program.

See Also

Tasks

How to Create a Collection

Concepts

About Collections
About Resources


Search for Resources Page

Use the Search for Resources page in the Configuration Manager 2007 Create Direct Membership Rule Wizard to provide a means for searching for the resources that you want to add as direct members of a collection.

This page contains the elements described in the following table.

UI Element List

Name Description

Resource class

Specifies the resource class in which to search for the resource to add as a direct member of the collection.

Attribute name

Specifies the name of the attribute to search for within the selected resource class. The selection of attributes changes depending on the resource class chosen.

Exclude obsolete packages

Specifies whether obsolete packages should not be included as potential members of the collection. This option is only available for the System Resource class.

Value

Specifies the attribute value to search for.

Note
If you are searching for a string value, use the percent character (%) as a wildcard character to match multiple strings or to allow partial string matching.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Collection

Concepts

About Collections
About Resources


Collection Limiting Page

Use the Collection Limiting page in the Configuration Manager 2007 Create Direct Membership Rule Wizard to specify a given collection in which to search for resources.

This page contains the elements described in the following table.

UI Element List

Name Description

Search in this collection

Specifies the collection in which you want to search for resources. If you have sufficient permissions to search the entire resource database, you can leave this blank to search all collections. If you do not have sufficient permissions, a collection must be specified.

To indicate a specific collection to search, type the collection name or click the Browse button to select a collection.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Collection

Concepts

About Collections
About Resources


Select Resources Page

Use the Select Resources page in the Configuration Manager 2007 Create Direct Membership Rule Wizard to specify the resources that you want to add as direct members of a collection.

This page contains the elements described in the following table.

UI Element List

Name Description

Resources

Specifies the resources that you want to add as direct members to the collection. To add a member to the collection, select the check box next to the resource.

To add all of the listed resources, click the Select All button.

To clear all check boxes, click the Clear All button.

Note
If no resources are found that match your search criteria, this page will not be displayed.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Completed page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Collection

Concepts

About Collections
About Resources


Create Operating System Capture Disk Wizard

This wizard lets you create an operating system capture disk for use with a reference computer. Enter a path and file name for the capture disk output file in the Output file field, or click Browse to specify the path and file name. The output file is of type .ISO. Click Browse to select from a list of available images.

After the ISO file is created, you must use the appropriate software to copy the file to CD or DVD boot media.

Note
The architecture of the boot image must be compatible with the hardware architecture of the computer being used as the reference computer.


Create Operating System Configuration Item Wizard

Use the Create Operating System Configuration Item Wizard in Configuration Manager 2007 to create an operating system configuration item. After the operating system configuration item is created, it is displayed in the Configuration Items node of the Configuration Manager console and available for use when creating or modifying configuration baselines.

Note
You might need to run the Refresh action before new configuration items are displayed in the Configuration Items node.

Click the related link below for detailed information about each wizard page in the Create Operating System Configuration Item Wizard.

Identification Page

Specifies the name and description of the configuration item and also allows you to assign the configuration item to configuration categories. After the configuration item is created, these options are displayed in the Configuration Item Properties: General Tab.

Windows Version Page

Specifies the options in the Configuration Item Properties: Windows Version Tab.

Objects Page

Specifies the options in the Configuration Item Properties: Objects Tab.

Settings Page

Specifies the options in the Configuration Item Properties: Settings Tab.

Summary Page

Displays the Wizard - Summary Page.

Progress Page

Displays the Wizard - Progress Page.

Completing the Wizard Page

Displays the Wizard - Completing the Wizard Page.

See Also

Concepts

About Configuration Items in Desired Configuration Management
About Configuration Categories in Desired Configuration Management
About Configuration Baselines in Desired Configuration Management
About Authoring Configuration Data for Desired Configuration Management
Determine If You Need to Create Configuration Items for Desired Configuration Management
Choose the Configuration Item Type to Create for Desired Configuration Management

Other Resources

How to Configure Configuration Items for Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


Create Package From Definition Wizard

Use the Create Package from Definition Wizard in Configuration Manager 2007 to create a package from a package definition file.

Click the related link below for detailed information about each wizard page in the Create Package from Definition Wizard.

In This Section

Package Definitions Page

Specifies the package definition to use as a template for the new package.

Source Files Page

Specifies how Configuration Manager 2007 should manage any source files for the package.

Source Directory Page

Specifies the source directory location for the package.

Completing the Wizard Page

Specifies that you have provided the information needed by the wizard, and confirms that you want to create the package.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Package Definition Files
About Packages
About the Package Definition File Format

Other Resources

Software Distribution Overview


Package Definitions Page

Use the Package Definitions page in the Configuration Manager 2007 Create Package from Definition Wizard to specify the package definition to use as a template for the new package.

This page contains the elements described in the following table.

UI Element List

Name Description

Publisher

Specifies the publisher of the package definition file that you want to use. Only files published by the selected publisher are displayed in the package definition list.

To choose a publisher, select from the drop-down list for currently available publishers or click the Browse button to navigate to specific package definition file.

Package definition

Specifies the package definition files available from the publisher selected. To continue the wizard, you must select one of the files listed.

The following columns are displayed for package definition files from the selected publisher:

  • Name: Specifies the name of the package definition file, which typically indicates the file's functionality.
  • Version: Specifies the version of the package definition file, if indicated.
  • Language: Specifies the language version of the package definition file, if indicated.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Package Definition Files
About Packages
About the Package Definition File Format


Source Files Page

Use the Source Files page in the Configuration Manager 2007 Create Package from Definition Wizard to specify how Configuration Manager 2007 should manage any source files for the package.

This page contains the elements described in the following table.

UI Element List

Name Description

This package does not contain any source files

Specifies whether the package requires source files that its programs must run and that are not already on the client computer.

Always obtain files from a source directory

Specifies that the package requires source files that its programs must run, and that you must indicate the location of those source files. Each time a distribution point is refreshed, Configuration Manager 2007 will obtain the package source files from the path specified in the Source directory box. Use this option if the source files are likely to remain at the specified path, such as a share on a server.

Create a compressed version of the source

Specifies that the package requires source files that its programs must run and that these source files will be stored in a compressed version on the site server. If this option is selected, this compressed version will be decompressed and copied to the distribution points instead of being copied directly from the original source folder when the distribution points are refreshed. Use this option if the source files might be removed from the specified path (for example, if the source files are on a CD).

If you select this option and then specify Update All Distribution Points in the Manage Distribution Points Wizard, a new version of the compressed copy is created from the specified source folder.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Package Definition Files
About Packages


Source Directory Page

Use the Source Directory page in the Configuration Manager 2007 Create Package from Definition Wizard to specify the source directory location for the package. This page has the same functionality whether you are using a compressed version of your source files or not. If the package will always obtain files from a specified source directory, access to that directory needs to be available for as long as the package exists. If the package will use a compressed version of the source files, access to the directory is necessary until Configuration Manager 2007 has finished storing the files.

This page contains the elements described in the following table.

UI Element List

Name Description

Package

Specifies the name of the package being created.

Source directory location

Specifies the type of location for the source directory. Two options are available:

  • Network path (UNC Name)
  • Local drive on site server

Source directory

Specifies the network path to the package source files.

To specify the path to the source directory, either type the path or click Browse to navigate to the source directory location.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Package Definition Files
About Packages


Create SQL Reporting Services Report Wizard

Topic Last Updated—August 2008

Use the Create Report Wizard in Configuration Manager 2007 R2 to guide you through the process of creating a new SQL Reporting Services report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

Create Report Wizard - Information Page

Create Report Wizard - Model Selection Page

Create Report Wizard - Create Datasets Page

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create Report Wizard - Information Page

Topic Last Updated—August 2008

Use the Information page of the Configuration Manager 2007 R2 Create Report Wizard to specify the type of SQL Reporting Services report you want to create and to specify properties for the report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name Description

Type

Specify the type of report you want to create. Choose from the following:

  • Model-based Report: Create a report in Microsoft Report Builder using a reporting services model.
  • SQL-based Report: Create a report using SQL statements.

Information

Specify properties for the new report.

  • Name: Specify a name for this report.
  • Description: Specify a description for this report.
  • Server: Displays the name of the report server on which you are creating this report.
  • Path: Displays the report folder in which this report will be stored.
  • Browse: Click to open the Report Path dialog box to specify the folder in which to store this report.
    Note
    The options in the Information section of this dialog box are not available if you are creating a model-based report.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create Report Wizard - Model Selection Page

Topic Last Updated—August 2008

Use the Model Selection page of the Configuration Manager 2007 R2 Create Report Wizard to select the report model to use for constructing a model-based SQL Reporting Services report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name | Description
Model | Specifies the name of the report model you want to use to build this SQL Reporting Services report. Choose an available model from the drop-down list.
Preview | Displays the SQL views and entities made available by the selected report model.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services
Step-by-Step Guide to Creating a Report Model in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create Report Wizard - Create Datasets Page

Topic Last Updated—August 2008

Use the Create datasets page of the Configuration Manager 2007 Create Reports Wizard to create and modify the datasets used by the report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name | Description
New | Click to create a new dataset.
Edit Command Text | Click to open the Command Text dialog box to edit the SQL statement for the currently selected dataset.
Report Parameters | Click to open the Report Parameters dialog box to modify the parameters used by this report.
Delete Dataset | Click to delete the currently selected dataset.
Dataset Name | Choose the dataset you want to view or edit from the drop-down list.
Timeout | Specify the time in seconds after which processing of this query will fail if data cannot be retrieved from the data source. The default value is 30 seconds.
Display dataset on report | Check this box to display the results of this dataset in the report.
SQL Statement | Displays the SQL statement for the currently selected dataset. Click the edit button to modify the SQL statement.
Fields | Displays the rows that will be returned by the currently selected dataset.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create SQL Reporting Services Subscription Wizard

Topic Last Updated—August 2008

Use the Configuration Manager 2007 R2 Create Subscription Wizard to subscribe to a report created in SQL Reporting Services.

Click the related link below for detailed information about each page in the Create Subscription Wizard.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

Create Subscription Wizard - Subscription Delivery Page

Create Subscription Wizard - Subscription Schedule Page

Create Subscription Wizard - Subscription Parameters Page

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create Subscription Wizard - Subscription Delivery Page

Topic Last Updated—August 2008

Use the Subscription Delivery page of the Configuration Manager 2007 R2 Create Subscription Wizard to configure the delivery method and properties for this report subscription.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name | Description
Report delivered by | Choose a delivery method for this subscription from the drop-down list. The available delivery methods are E-mail and Windows File Share.

E-mail Delivery Options

Name Description

To

Enter a valid e-mail address to send this report to. You can enter multiple e-mail recipients by separating each e-mail address with a semi-colon.

Cc

Optionally, specify an e-mail address to send a copy of this report to.

Bcc

Optionally, specify an e-mail address to send a blind copy of this report to.

Reply-To

Specify the reply address for the recipient to use if the recipient replies to the e-mail message.

Subject

Specify a subject line for the subscription e-mail message.

Priority

Select the priority flag for this e-mail message. Choose from Low, Medium, or High. The priority setting is used by Microsoft Exchange to set a flag indicating the importance of the e-mail message.

Comment

Specify text to be added to the body of the subscription e-mail message.

Description

Specify a description for this report subscription.

Include Link

Includes a URL to the subscribed report in the body of the e-mail message.

Important
If both Include Report and Include Link are cleared, only the text in the e-mail subject line is sent.

Include Report

Specify that the report should be attached to the e-mail message. The format in which the report will be attached is specified in the Render Format drop-down list.

Render Format

Choose a format for the attached report from the drop-down list. The following options are available:

  • Web archive—Embeds the report in the body of the e-mail message.
  • XML file with report data—Attaches the report in Extensible Markup Language format.
  • CSV (comma delimited)—Attaches the report in comma-separated-value format.
  • TIFF file—Attaches the report in Tagged Image File Format.
  • Acrobat (PDF) file—Attaches the report in Acrobat Portable Document Format.
  • Excel—Attaches the report as a Microsoft Office Excel spreadsheet.

Windows File Share Delivery Options

Name Description

File Name

Specify a file name for this report.

Add file extension when created

Select this box to automatically add a file extension to this report based on the render format.

Path

Specify a Universal Naming Convention (UNC) path to an existing folder where you want to deliver this report (for example, \\<server name>\<report folder>).

Render Format

Choose a format for the report from the drop-down list. The following options are available:

  • XML file with report data—Saves the report in Extensible Markup Language format.
  • CSV (comma delimited)—Saves the report in comma-separated-value format.
  • TIFF file—Saves the report in Tagged Image File Format.
  • Acrobat (PDF) file—Saves the report in Acrobat Portable Document Format.
  • Web page for IE 5.0 or later (.htm)—Saves the report as a Web page viewable only in browsers running Internet Explorer 5 or later.
  • Web page for most web browsers (.htm)—Saves the report as a Web page viewable in most Web browsers.
  • Web archive—Saves the report in MIME HTML format (mhtml), which is viewable in many Web browsers.
  • Excel—Saves the report as a Microsoft Office Excel spreadsheet.

User Name

Specify a Microsoft Windows user name with permissions to access the destination file share.

Password

Specify the password for the Windows user name.

Overwrite an existing file with a newer version

If the report file already exists, it will be overwritten with the new version.

Do not overwrite an existing file

If the report file already exists, no action will be taken.

Increment file names as newer versions are added

If the report file already exists, the new report will have a number added to the file name to distinguish it from other versions.

Description

Specify a description for this report subscription.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create Subscription Wizard - Subscription Schedule Page

Topic Last Updated—August 2008

Use the Subscription Schedule page of the Configuration Manager 2007 R2 Create Subscription Wizard to configure the schedule by which a subscribed report will be run and delivered.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name Description

Use shared schedule

A shared schedule is a previously defined schedule that can be used by other report subscriptions. Select this box, and then select a shared schedule if any have been specified.

Note
You cannot create shared schedules from the Configuration Manager console. For more information about creating shared schedules, see your SQL Reporting Services documentation.

Create new schedule

Configure the schedule on which this report will run and the start and end dates for this subscription.

Note
The options to create a schedule will vary depending on the schedule type you choose.

Start time

Specify the time of day to run this report subscription.

Begin on

Specify the start date for this report subscription.

Stop on

Select this box to specify an end date for this report subscription, and then specify the date from the drop-down list.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Create Subscription Wizard - Subscription Parameters Page

Topic Last Updated—August 2008

Use the Subscription Parameters page of the Configuration Manager 2007 R2 Create Subscription Wizard to configure the parameters that this report requires when it is run unattended.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name | Description
Specify the report parameters to use with this subscription. | For each report parameter in the list, click Values to open the Parameter Value dialog box. In the Parameter Value dialog box, type in the value for the report parameter, or select it from the list, and then click OK.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Copy Configuration Manager Reports to SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Task Sequence Media Wizard

This wizard helps you create new stand-alone or bootable media form which you can launch your operating system deployment from. You can specify CD, DVD, or USB media as the type of media to use.

Task Sequence Media - Select Media Type Page

Task Sequence Media Wizard - Select Media Type Page

Bootable Media - Security Page

Task Sequence Media Wizard - Bootable Media Security Page

Stand-alone Media - Security Page

Task Sequence Media Wizard - Stand-alone Media Security Page

Task Sequence Media - Media Type Page

Task Sequence Media Wizard - Media Type Page

Variables Page

Task Sequence Media Wizard - Variables Page

Stand-alone DVD/CD Page

Task Sequence Media Wizard - Stand-alone DVD/CD Page

Task Sequence Media - Distribution Points Page

Task Sequence Media Wizard - Distribution Points Page

Boot Image Page

Task Sequence Media Wizard - Boot Image Page


Task Sequence Media Wizard - Select Media Type Page

This page allows you to select the media type you want to use for your image deployment. You can specify CD, DVD, or USB as the boot media.

This page contains the elements described in the following table.

Name | Description
Stand-alone media | Creates stand-alone media. Stand-alone media runs independently from the Configuration Manager 2007 infrastructure
Bootable media | Accesses the Configuration Manager 2007 infrastructure to complete the image operating system image deployment.
Capture media | Captures an operating system from a source computer running a Windows operating system.

See Also

Reference

Task Sequence Media Wizard


Task Sequence Media Wizard - Bootable Media Security Page

Topic last updated—March 2008

You can configure how the boot media should be protected on the Security page.

The Security page contains the elements described in the following table.

Settings Description

Enable unknown system support

Enables the provisioning of unknown systems for operating system deployment by Configuration Manager 2007.

Applies only to Configuration Manager 2007 R2.

Protect media with a password

Enable this option to password-protect the media. Enter a password in the Password field. Verify the password by reentering it in the Confirm password field. This field is enabled by default. If you specify a password to protect the media from unauthorized access, a user must be present at the target computer to enter the password.

Important
It is recommended that you protect the media with a password so that unauthorized users cannot use the media to deploy operating systems and potentially gain access to confidential information, such as credentials to join a Windows domain.

Create self-signed media certificate

If your site is running in mixed mode, you can select this option to create a self-signed certificate that will be included on the media. Use the time and date selectors to set a starting date and expiration date for the self-signed media certificate. The certificate will not be valid outside this date range. By default, these fields are populated to create a certificate valid for one year.

Import certificate

If your site is running in native mode, select this option to import a PKI-issued certificate that will be added to the boot media for client authentication and communication with the Configuration Manager 2007 site. The certificate must be in a PFX file accessible by the Configuration Manager 2007 administrator console where you are creating the media. For more information about creating and exporting certificates for use with operating system deployment media, see How to Export Certificates For Use With Operating System Deployment.

The certificate you import must be issued by a certification authority trusted by the Configuration Manager 2007 site. For more information about preparing and specifying the root certification authority, see How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients and How to Specify the Root Certification Authority Certificates for Operating System Deployment Clients.

Click Browse to locate and specify the certificate that should be added to the media, and provide the password that was used when exporting the certificate. This password is not necessarily the same as the password used to protect the media. This password will not be required when booting media.

See Also

Reference

Task Sequence Media Wizard

Concepts

Benefits of Using Native Mode
Certificate Requirements for Native Mode
Configuration Manager Site Modes


Task Sequence Media Wizard - Stand-alone Media Security Page

Use the Stand-alone Media Security page to specify a password to protect your media.

Important
It is recommended that you protect the media with a password so that unauthorized users cannot use the media to deploy operating systems and potentially gain access to confidential information, such as credentials, to join a Windows domain.

UI Element List

This page contains the element described in the following table.

Name | Description
Protect media with a password | Specify a password, and then confirm the password in the Confirm password box. This password will need to be entered at the target computer to use the media.

See Also

Reference

Task Sequence Media Wizard


Task Sequence Media Wizard - Media Type Page

The Media Type page assists you in creating stand-alone or bootable media to run your image deployment. You can create a CD, DVD, or a bootable USB flash drive. These three media are stand-alone media and are able to run offline from the Configuration Manager 2007 infrastructure. The source computer must be running a Microsoft Windows operating system. If you specify a USB bootable flash drive as the media type and you have a task sequence step that will cause the computer to restart, you must configure the target computer's BIOS to boot from the hard disk or the computer will boot using the attached media.

Note
Formatting capability is only available for Windows Vista Premium Hardware.

This page contains the elements described in the following table.

Name Description

USB Flash drive

Writes files to a USB flash drive. This option is enabled only if a USB flash drive is plugged into the local computer. The dropdown will be populated with the drive letters of suitable drives. If running on Windows Vista the USB flash drive will be formatted and made bootable. If running on an earlier version of the Windows operating system the drive must already be bootable. The best way to ensure that the drive is bootable is to format it on Windows Vista using this wizard. Once made bootable the drive's contents can be rewritten on computers running earlier versions of the Windows operating system.

Important
You must format the USB media with the Windows Vista operating system. To format the media for Windows Vista, connect the USB media to a computer running Windows Vista and format the media. The FAT 16 file system format is not supported for use with USB media.

CD\DVD set

Creates an ISO files bootable CD or DVD set. If multiple pieces of media are needed, a sequence number will be appended to the name of each piece of media. For stand-alone media, use the Media size list to specify the size of the media you are using.

Media file

Specifies the name of the ISO file created.

Note
Selecting an existing .iso image using the Task Sequence Media Wizard will delete that .iso image from the drive or share as soon as you proceed to the next step of the media creation process even if you then cancel the wizard.

See Also

Reference

Task Sequence Media Wizard


Task Sequence Media Wizard - Variables Page

Use this page to specify task sequence variables that will be added to the stand-alone media. You can set task sequence variables to customize task sequence run behavior similar to the way you would customize task sequences through collection or per-computer variables.

This page contains the elements described in the following table.

Name | Description
New | Click New to specify a new task sequence variable that will be assigned to the media.
Name | Specifies the name of the variable.
Value | Specifies the associated value for the variable.

See Also

Reference

Task Sequence Media Wizard


Task Sequence Media Wizard - Stand-alone DVD/CD Page

This page allows you to select an existing task sequence that will be run from this media. You can specify the task sequence information by clicking Browse, and in opening the Select a Task Sequence dialog box.

This page contains the elements described in the following table.

Name | Description
Browse | Opens the Select a Task Sequence dialog box which allows you to add an existing task sequences to the stand-alone CD/DVD media. In the Select a Task Sequence dialog box, click the task sequences you want to add to the media, and then click OK. The associated Task ID, Source Version, Last Refresh Time, and Comment information for each task sequence is also displayed.
This task sequence references the following packages | Displays the packages that are referenced by the task sequence. The referenced packages must be contained on the CD.

See Also

Reference

Task Sequence Media Wizard


Task Sequence Media Wizard - Distribution Points Page

This page allows you to specify which distribution points to copy Configuration Manager 2007 packages from. All packages referenced by the task sequence must be copied from distribution points onto the media. You must select a set of distribution points which contains all packages referenced by the task sequence.

This page contains the elements as described in the following table.

Setting | Description
Available distribution points containing packages required by the task sequence | Displays any available distribution point that contains packages referenced by the task sequence.
Selected distribution points containing packages required by the task sequence | Displays all distribution points that have been selected and can be used by the task sequence. If there are referenced packages on a distribution point that is not accessible to the computer the task sequence will fail. Make sure you have added all necessary distribution points.
Show distribution points from child sites | Select this option to view distribution points that are located in child sites.
Add | Moves a distribution point from the list of available distribution points to the list of selected distribution points.
Remove | Removes a distribution point from the list of selected distribution points back to the list of available distribution points.

See Also

Reference

Task Sequence Media Wizard


Task Sequence Media Wizard - Boot Image Page

Use the Boot Image page to specify the boot image that will run from the media. This boot image will be used to initiate a task sequence.

Important
You must specify an existing distribution point that contains the specified boot image. Use the drop-down list to make the specification.

Name | Description
Boot Image | Specifies the boot image that will run from the media. Click Browse to open the Select a Boot Image dialog box. The available boot images display with the associated Image ID, Architecture, and Comment information. Only boot images that have been added to Configuration Manager 2007 display.
Distribution Point | Specifies the distribution point that contains the boot image referenced by the task sequence media. You must specify an existing distribution point that contains the specified boot image.
Show distribution points from child sites | Displays distribution points from child sites. This option is not selected by default. If this option is not selected only distribution points from the site where the media is created will be available.

See Also

Tasks

How to Add a Boot Image to Configuration Manager

Reference

Task Sequence Media Wizard


Delete Collection Wizard

Use the Delete Collection Wizard in Configuration Manager 2007 to delete a collection as well as to display the properties of the collection you want to delete. Reviewing this information can help you determine the effects of deleting the collection.

Note
If the collection you are deleting is linked to another collection, the Delete Collection Wizard will present you with an abbreviated version of the wizard. In this version, you will be asked only if you want to delete this instance of the collection. If you choose to delete this instance, other instances of the collection will not be affected. Additionally, because at least one other instance of the collection will still be present, the deletion effects covered by this wizard do not apply.

Click the related link below for detailed information about each wizard page in the Delete Collection Wizard.

In This Section

Delete Effects Page

Specifies whether or not to display the effects of deleting the specified collection prior to deleting it.

Subcollections Page

Specifies details of the subcollections associated with the collection that will be deleted.

Advertisements Page

Specifies details on the advertisements associated with the collection that will be deleted.

Baselines Page

Specifies details on the baselines associated with the collection that will be deleted.

Deployments Page

Specifies details on any deployments associated with the collection that will be deleted.

Templates Page

Specifies details on any templates associated with the collection that will be deleted.

Queries Page

Specifies details on any queries that will be affected by deleting the collection.

Membership Rules Page

Specifies details on other collections that will be affected by deleting this collection, due to the removal of associated query rules for membership.

Administrators Page

Specifies details on administrators who will be affected by deleting the collection.

Delete Collection Confirmation Page

Specifies whether or not, after reviewing the effects, you want to delete or keep the collection.

Completing the Wizard Page

Specifies that you have provided the information needed by the wizard and confirms that you want to delete the package.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Delete Effects Page

Use the Delete Effects page in the Configuration Manager 2007 Delete Collection Wizard to specify whether or not to display the effects of deleting the specified collection prior to deleting it.

This page contains the elements described in the following table.

UI Element List

Name Description

Do you want to view more details of the effects?

Specifies whether or not to display the effects of deleting this collection.

Two options are available:

  • Yes. I want to see more information.
  • No. I know that I want to delete this collection.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Subcollections Page

Use the Subcollections page in the Configuration Manager 2007 Delete Collection Wizard to specify details of the subcollections associated with the collection that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name | Description
Subcollections | Specifies all subcollections of this collection, displayed by Name. These subcollections will be deleted when the collection is deleted. Instances of the subcollections displayed on this page do not occur elsewhere in the Configuration Manager 2007 tree hierarchy.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Advertisements Page

Use the Advertisements page in the Configuration Manager 2007 Delete Collection Wizard to view details about the advertisements associated with the collection that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name | Description
Advertisements | Specifies all advertisements to this collection, displayed by Name. These advertisements will be deleted when the collection is deleted, and clients will not be able to run the advertised program.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Baselines Page

Use the Baselines page in the Configuration Manager 2007 Delete Collection Wizard to view details on the baselines associated with the collection that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name | Description
Baselines | Specifies all baselines associated with this collection, displayed by Name. These baselines will be removed when the collection is deleted, and clients will not be able to evaluate against them.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Deployments Page

Use the Deployments page in the Configuration Manager 2007 Delete Collection Wizard to specify details on any software update deployments associated with the collection that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name | Description
Deployments | Specifies all software update deployments associated with this collection, displayed by Name. These deployments will be deleted when the collection is deleted and clients will not be able to run them.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Templates Page

Use the Templates page in the Configuration Manager 2007 Delete Collection Wizard to view details on any templates associated with the collection that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name | Description
Templates | Displays all templates associated with this collection, listed by Name. These templates will be deleted when the collection is deleted and deployments will not be able to use them.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Queries Page

Use the Queries page in the Configuration Manager 2007 Delete Collection Wizard to view details on any queries that will be affected by deleting the collection.

This page contains the elements described in the following table.

UI Element List

Name | Description
Queries | Displays all queries limited to this collection, displayed by Name. These queries will not be deleted. However, running these queries will not return any results.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Membership Rules Page

Use the Membership Rules page in the Configuration Manager 2007 Delete Collection Wizard to specify details on other collections that will be affected by deleting this collection, due to the removal of associated query rules for membership.

This page contains the elements described in the following table.

UI Element List

Name Description

Collections

Specifies any other collections that will be affected by deleting this collection.

Note
When membership query rules that are used by a collection are deleted (along with that collection), this may affect what resources are considered members of the affected collections.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Administrators Page

Use the Administrators page in the Configuration Manager 2007 Delete Collections Wizard to specify details about administrators who will be affected by deleting the collection.

This page contains the elements described in the following table.

UI Element List

Name | Description
Administrators | Specifies any other administrators, by Name, who can view the resources used by the collection being deleted. If the resources are not also available in other collections viewable by these administrators, those administrators will no longer be able to view those resources.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Delete Collection Confirmation Page

Use the Delete Collection Confirmation page in the Configuration Manager 2007 Delete Collection Wizard to specify whether or not, after reviewing the effects, you want to delete or keep the collection.

This page contains the elements described in the following table.

UI Element List

Name Description

Do you want to delete this collection?

Specifies whether or not to delete this collection.

Two options are available:

  • Yes. Delete the collection.
  • No. Don't delete the collection.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Collection

Concepts

About Collections


Delete Package Wizard

Use the Delete Package Wizard in Configuration Manager 2007 to delete a package as well as to display the properties of the package you want to delete. Reviewing this information can help you determine the effects of deleting the package.

Click the related link below for detailed information about each wizard page in the Delete Package Wizard.

In This Section

Deletion Effects Page

Specifies whether or not to display the effects of deleting the specified package prior to deleting it.

Programs Page

Specifies details on the programs associated with the package that will be deleted.

Advertisements Page

Specifies details on the advertisements associated with the package that will be deleted.

Task Sequences Page

Specifies details on task sequences that will be affected by deleting the package.

Distribution Points Page

Specifies details on the distribution points that will be affected by deleting the package.

Access Accounts Page

Specifies details on the access accounts that will be removed when the package is deleted.

Security Rights Page

Specifies details on the specific security rights that will be removed when the package is deleted.

Delete Confirmation Page

Specifies whether or not, after reviewing the effects, you want to delete or keep the package.

Completing the Wizard Page

Specifies that you have provided the information needed by the wizard, and confirms that you want to delete the package.

See Also

Tasks

How to Delete a Package

Concepts

About Packages


Deletion Effects Page

Use the Delete Effects page in the Configuration Manager 2007 Delete Package Wizard to specify whether or not to display the effects of deleting the specified package prior to deleting it.

This page contains the elements described in the following table.

UI Element List

Name Description

Do you want to view more details of the effects?

Specifies whether or not to display the effects of deleting this package.

Two options are available:

  • Yes. I want to see more information.
  • No. I know that I want to delete this package.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Programs Page

Use the Programs page in the Configuration Manager 2007 Delete Package Wizard to view details on the programs associated with the package that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name Description

Programs

Displays all programs within this package. These programs will be deleted when the package itself is deleted.

The following columns are displayed for each program in the package:

  • Name: Displays the name of the specific program.
  • Comment: Displays any comments available for each program.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Advertisements Page

Use the Advertisements page in the Configuration Manager 2007 Delete Package Wizard to view details about the advertisements associated with the package that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name Description

Advertisements

Specifies all advertisements of programs within this package. These advertisements will be deleted when the package itself is deleted, and the advertised programs will not be available to run.

The following columns are displayed for each program in the package:

  • Name: Displays the name of the specific advertisement.
  • Advertise After: Displays the date and time when the program is advertised and available to run on clients.
  • Expires After: Displays whether the advertisement has a date and time after which the program advertisement is no longer available to run on clients.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Advertisements
About Packages

Other Resources

How to Manage Packages
Package Name Properties


Task Sequences Page

Use the Task Sequences page in the Configuration Manager 2007 Delete Package Wizard to view details on task sequences that will be affected by deleting the package.

This page contains the elements described in the following table.

UI Element List

Name Description

Task Sequences

Displays all task sequences that will be affected by deleting this package. This package is referenced by the task sequences displayed and will be removed from those references if deleted.

The following columns are displayed for each task sequence:

  • Name: Displays the name of the specific task sequence.
  • Comment: Displays any comments available for each task sequence.
  • Creation Date: Displays the date that the task sequence was created.
Note
To set a new package for one of the displayed task sequences, go to the Task Sequence properties.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Distribution Points Page

Use the Distribution Points page in the Configuration Manager 2007 Delete Package Wizard to view details on the distribution points that will be affected by deleting the package.

This page contains the elements described in the following table.

UI Element List

Name Description

Distribution points

Specifies details on all distribution points that will be affected by deleting this program. When the program is deleted, all package files on the displayed distribution points will be removed.

The following columns are displayed for each distribution on which source files for this package are stored.

  • Name: Displays the name of the site server on which the distribution point is placed.
  • Site: Displays the site name of the distribution point.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Distribution Points
About Packages

Other Resources

How to Manage Packages
Package Name Properties


Access Accounts Page

Use the Access Accounts page in the Configuration Manager 2007 Delete Package Wizard to specify details on the access accounts that will be removed when the package is deleted.

This page contains the elements described in the following table.

UI Element List

Name Description

Access Accounts

Specifies the access accounts for this package, by Name. When the package is deleted, the displayed accounts will also be deleted.

Note
Deleting these accounts will not delete the Windows accounts to which they correspond.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Packages

Other Resources

How to Configure Package Access Accounts
Package Name Properties
How to Manage Packages


Security Rights Page

Use the Security Rights page in the Configuration Manager 2007 Delete Package Wizard to specify details on the security rights that will be removed when the package is deleted.

This page contains the elements described in the following table.

UI Element List

Name | Description
Administrators | Specifies the Configuration Manager 2007 administrators, by Name, with current security rights to this package. These security rights (although not the accounts) will be deleted when the package itself is deleted.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Packages

Other Resources

Package Name Properties
How to Manage Packages


Delete Confirmation Page

Use the Delete Confirmation page in the Configuration Manager 2007 Delete Package Wizard to specify whether or not, after reviewing the effects, you want to delete or keep the package.

This page contains the elements described in the following table.

UI Element List

Name Description

Do you want to delete this package?

Specifies whether or not to delete this package.

Two options are available:

  • Yes. Delete the package.
  • No. Don't delete the package.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Package

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Delete Program Wizard

Use the Delete Program Wizard in Configuration Manager 2007 to delete a program as well as to display the properties of the program you want to delete. Reviewing this information can help you determine the effects of deleting the program.

Click the related link below for detailed information about each wizard page in the Delete Program Wizard.

In This Section

Effects Page

Specifies whether or not to display the effects of deleting the specified program prior to deleting it.

Advertisements Page

Specifies details on the advertisements associated with the program that will be deleted.

Task Sequences Page

Specifies details on task sequences that will be affected by deleting the program.

Delete Confirmation Page

Specifies whether or not, after reviewing the effects, you want to delete or keep the program.

Completing the Wizard Page

Specifies that you have provided the information needed by the wizard and confirms that you want to delete the program.

See Also

Tasks

How to Delete a Program

Concepts

About Programs

Other Resources

How to Manage Programs


Effects Page

Use the Effects page in the Configuration Manager 2007 Delete Program Wizard to specify whether or not to display the effects of deleting the specified program prior to deleting it.

This page contains the elements described in the following table.

UI Element List

Name Description

Do you want to view more details of the effects?

Specifies whether or not to display the effects of deleting this program.

Two options are available:

  • Yes. I want to see more information.
  • No. I know that I want to delete this program.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Program

Concepts

About Programs

Other Resources

How to Manage Programs


Advertisements Page

Use the Advertisements page in the Configuration Manager 2007 Delete Program Wizard to specify details on the advertisements associated with the program that will be deleted.

This page contains the elements described in the following table.

UI Element List

Name Description

Advertisements

Specifies all advertisements of this program. These advertisements will be deleted when the program itself is deleted and will not be available to run.

The following columns are displayed for this program:

  • Name: Displays the name of the specific advertisement.
  • Advertise After: Displays the date and time when the program is advertised and available to run on clients.
  • Expires After: Displays whether the advertisement has a date and time after which the program advertisement is no longer available to run on clients.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Program

Concepts

About Programs

Other Resources

How to Manage Programs


Task Sequences Page

Use the Task Sequences page in the Configuration Manager 2007 Delete Program Wizard to view details on task sequences that will be affected by deleting the program.

This page contains the elements described in the following table.

UI Element List

Name Description

Task Sequences

Displays all task sequences that will be affected by deleting this program. This program is referenced by the task sequences displayed and will be removed from those references if deleted.

The following columns are displayed for each task sequence:

  • Name: Displays the name of the specific task sequence.
  • Comment: Displays any comments available for each task sequence.
  • Creation Date: Displays the date that the task sequence was created.
Note
To set a new package for one of the displayed task sequences, go to the Task Sequence properties.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Program

Concepts

About Programs

Other Resources

How to Manage Programs


Delete Confirmation Page

Use the Delete Confirmation page in the Configuration Manager 2007 Delete Program Wizard to specify whether or not, after reviewing the effects, you want to delete or keep the program.

This page contains the elements described in the following table.

UI Element List

Name Description

Do you want to delete this program?

Specifies whether or not to delete this program.

Two options are available:

  • Yes. Delete the program.
  • No. Don't delete the program.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Delete a Program

Concepts

About Programs

Other Resources

How to Manage Programs


Delete Secondary Site Wizard

The Delete Secondary Site Wizard is used to delete or uninstall a secondary site from the primary site Configuration Manager console. The wizard helps you to decide whether to delete or uninstall a secondary site. It also describes the differences between deleting and uninstalling a secondary site.

In This Section

Delete Secondary Site Wizard: Welcome Page

Delete Secondary Site Wizard: Delete or Uninstall Page

Delete Secondary Site Wizard: Completion Page


Delete Secondary Site Wizard: Welcome Page

This page contains the elements described in the following table.

Name | Description
Site | Read-only site name and description of the secondary site to be deleted.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Deletes or uninstalls the secondary site.
Cancel | Discards the settings, and exits the wizard.

See Also

Concepts

Delete Secondary Site Wizard


Delete Secondary Site Wizard: Delete or Uninstall Page

This page contains the elements described in the following table.

Name Description

Delete this site

Select this option to delete the secondary site. Deleting a secondary site will delete all information about the site and its resources from the site database at its parent site, but it will leave the secondary site component files installed on the secondary site server computer.

Important
When Configuration Manager 2007 sites are deleted, the deleted site information is only deleted from the deleted site's direct parent site. Site deletion information is not propagated up the hierarchy to grandparent sites. In order to delete the site from the site database at sites above the deleted site's direct parent site, the hierarchy maintenance tool (Preinst.exe) must be run on every primary site above the deleted site's parent primary site using the command Preinst /delsite. For more information about the hierarchy maintenance tool, see Hierarchy Maintenance Tool (Preinst.exe).

Uninstall this site

Select this option to uninstall the secondary site. Uninstalling a secondary site will uninstall the secondary site component from the secondary site server computer, and then delete all information about the site and its resources from the site database at its parent site.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Deletes or uninstalls the secondary site.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Delete Secondary Site Wizard


Delete Secondary Site Wizard: Completion Page

This page contains the elements described in the following table.

Name | Description
Details | Read-only site name and description of the secondary site to be deleted or uninstalled.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Deletes or uninstalls the secondary site.
Cancel | Discards the settings, and exits the wizard.

See Also

Concepts

Delete Secondary Site Wizard


Deploy Software Updates Wizard

Use the Deploy Software Updates Wizard in Configuration Manager 2007 to create a software update deployment, which downloads the software updates and creates a deployment package if necessary, allows for the creation of deployment templates, and deploys the software updates defined in the deployment to members of the target collection.

The following deployment properties are defined in the Deploy Software Updates Wizard:

  • Deployment name and description
  • *Collection
  • *Display and time settings
  • *Restart settings
  • *Event generation
  • *Download settings
  • *SMS 2003 settings (available only when every software updates in the deployment is deployable to Systems Management Server 2003)
  • Deployment package (available only when at least one software update has not been already downloaded or when deploying to SMS 2003 clients)
  • Download location
  • Language selection
  • Deployment schedule
  • Network Access Protection (NAP) evaluation (if NAP is enabled)

An asterisk (*) denotes the properties that can be stored in a deployment template. An existing deployment template can be selected at the start of the wizard to automatically populate these properties. If a deployment template is not used when creating a deployment, the properties are manually entered and can optionally be saved as a deployment template within the wizard and used in future deployments.

The deployment package settings are not displayed if all software updates in the deployment have previously been downloaded and copied to a package shared folder on the distribution point. When previously downloaded, the deployment is automatically configured to use the package that hosts the software update.

The NAP evaluation settings are not available when NAP is not configured for this site. For more information about configuring NAP, see Administrator Checklist: Configure Network Access Protection for Configuration Manager.

The Review/Accept License Terms Dialog Box opens before the Deploy Software Updates Wizard if one or more software updates require License Terms approval. When the license terms are approved, the Deploy Software Updates Wizard opens.

Click the related link for detailed information about each wizard page in the Deploy Software Updates Wizard.

In This Section

Deploy Software Updates Wizard: General Page

Specifies the name and description of the deployment.

Deploy Software Updates Wizard: Deployment Template Page

Specifies whether to use a deployment template.

Deploy Software Updates Wizard: Collection Page

Specifies the collection that will be targeted for the software update deployment.

Deploy Software Updates Wizard: Display/Time Settings Page

Specifies whether the user will be notified of pending software updates, the installation progress for software updates, whether a client evaluates the deployment schedule based on local or Coordinated Universal Time (UTC), and the default duration between software update availability and mandatory installation on clients.

Deploy Software Updates Wizard: Restart Settings Page

Specifies the system restart behavior when a software update installs on a client and requires a restart to complete.

Deploy Software Updates Wizard: Event Generation Page

Specifies whether Microsoft Operation Manager alerts are disabled while the software updates install and whether an Operation Manager alert is created when a software update installation fails.

Deploy Software Updates Wizard: Download Settings Page

Specifies how clients will interact with distribution points when they receive a software update deployment.

Deploy Software Updates Wizard: SMS 2003 Settings Page

Specifies whether to deploy software updates to SMS 2003 clients that are in the target collection.

Deploy Software Updates Wizard: Create Template Page

Specifies whether to save the configured deployment properties in a template for use in future software update deployments.

Deploy Software Updates Wizard: Deployment Package Page

Specifies the package that will be used to host the software updates in the deployment.

Deploy Software Updates Wizard: Distribution Points Page

Displays the distribution points used to host the software update package defined in the deployment.

Add Distribution Points Dialog Box

Specifies the distribution points that are available to be added to the deployment package.

Deploy Software Updates Wizard: Download Location Page

Specifies whether the software updates in the deployment are downloaded from the Internet or from the local network.

Deploy Software Updates Wizard: Language Selection Page

Specifies the languages for which the software updates in the deployment are downloaded.

Deploy Software Updates Wizard: Deployment Schedule Page

Specifies the schedule for when a software update deployment becomes active, when software update installation is enforced on clients, whether to enable Wake On LAN, and whether to ignore maintenance windows when installing updates.

Deploy Software Updates Wizard: NAP Evaluation Page

Specifies whether the software updates in this deployment will be included in a Network Access Protection (NAP) evaluation.

Wizard - Summary Page

Provides a summary of the deployment properties.

Wizard - Progress Page

Provides the progress for deployment creation.

Wizard - Completing the Wizard Page

Provides a summary of the created deployment properties or a list of issues that occurred during deployment creation.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: General Page

Use the General page in the Configuration Manager 2007 Deploy Software Updates Wizard to configure the name and description of the software update deployment.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Name | Specifies the name of the software update deployment. The name must be unique, help to describe the objective of the deployment, and identify it from others in the Deployments node of the Configuration Manager console. The deployment name is a required field, is limited to 63 characters, and has a default value of "<vender name> Updates - <date and time>". For example, a deployment created on 9/28/2006 at 10:10:00 AM and with software updates from Microsoft Update will default to Microsoft Updates - 9/28/2006 10:10:00 AM.
Description | Specifies the description for the software update deployment. The description should provide an overview of the deployment configuration and any other relevant information that helps to identify the deployment among others in the Deployments node of the Configuration Manager console. The description field is optional, has a limit of 256 characters, and has a blank value by default.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Deployment Template Page

Use the Template Selection page in the Configuration Manager 2007 Deploy Software Updates Wizard to specify whether a previously created deployment template should be used. Deployment templates contain many of the software update deployment properties and can be used when creating deployments to ensure consistency among similar deployments and to save time. The following properties are saved in the deployment template:

  • Name and description: Specifies the name and description of the deployment template.
  • Collection: Specifies the collection that is targeted for the software update deployment. Templates can be created without a collection so that one deployment template can be used during a phased deployment where collections change over time.
  • Display/Time Settings: Specifies whether users are notified of pending software updates and see the update installation progress, whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.
  • Restart Settings: Specifies the system restart behavior when a software update installs on a client and requires a restart to complete, and whether system restarts are allowed outside of configured maintenance windows.
  • Event Generation: Specifies whether to disable Microsoft Operations Manager alerts during software update installation and whether an Operation Manager alert is created when a software update installations fails.
  • Download Settings: Specifies the behavior for software update installation when clients are within a "slow or unreliable" network boundary and when clients are within the boundaries of a protected distribution point that does not contain the software update.
  • SMS 2003 Settings: Provides the option to deploy software updates to SMS 2003 clients.

Templates that Specify SMS 2003 Settings

When deployment templates are created with the Deploy software updates to SMS 2003 clients setting enabled, the template will be available on the Deployment Template page of the Deploy Software Updates Wizard only when all software updates can be deployed to SMS 2003 clients. For example, if the software updates that are being deployed all have a value of Yes for the Deployable to SMS2003 setting, the Deploy Software Updates Wizard will show all templates regardless of configured SMS 2003 settings. If the software updates that are being deployed have a value of No for the Deployable to SMS 2003 setting, the Deploy Software Updates Wizard will not show templates that have the SMS 2003 settings configured.

UI Element List

This page contains the elements as described in the following table.

Name | Description
Create a deployment definition | Specifies that a template is not used and the deployment settings are manually configured in the wizard. The Create Template page provides the option to save the settings to a template that will be available for use in other deployments.
Use an existing template | Specifies that a previously created deployment template is used to populate many of the deployment properties. To use an existing template, select the template from the list. When the template is highlighted, the settings defined in the template are displayed in the Details window.
Previous | Navigates to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Collection Page

Use the Collection page in the Configuration Manager 2007 Deploy Software Updates Wizard to configure the collection that is targeted for the software updates deployment. Members of the collection and subcollections, if configured, receive available deployments during their next Machine Policy Retrieval & Evaluation Cycle.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Collection | Specifies the target collection for the deployment. Members of the collection receive the software updates defined in the deployment. To select a collection, click Browse, select the collection from the list, and then click OK.
Include members of subcollection | Specifies whether members of any subcollection of the main collection receive the software updates defined in the deployment. By default, this setting is enabled and members of both the collection and subcollection are targeted for the deployment.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Display/Time Settings Page

Use the Display/Time Settings page in the Configuration Manager 2007 Deploy Software Updates Wizard to configure whether users are notified of pending software updates and see the update installation progress, whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Allow display notifications on clients | Specifies that display notifications are used on clients that inform end users of available software updates and progress indicators are displayed during software update installation. By default, this setting is selected and display notifications are allowed on clients.
Suppress display notifications on clients | Specifies that display notifications are not used on clients and progress indicators are not displayed during update installation. Software update notification icons will still display on clients and users can click this icon to see available updates.
Client Local Time | Specifies that clients use their local time to evaluate the schedules for when software updates become available on clients and when deadlines enforce software update installation, if enabled.
UTC | Specifies that clients use UTC to evaluate schedules for when software updates become available on clients and when deadlines enforce software update installation. By default, this setting is selected and UTC is used to evaluate deployment schedules.
Duration | Specifies the duration, which is used when a template is used while creating a deployment. The deadline setting in the deployment defaults to the time an update is available plus the configured duration setting. By default, the duration is set at 2 weeks.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Restart Settings Page

Use the Restart Settings page in the Configuration Manager 2007 Deploy Software Updates Wizard to configure system restart behavior when a software update installs on a client and requires a restart to complete, and when maintenance windows are configured.

Important
Suppressing system restarts can be useful in server environments or in cases in which you do not want the computers that are installing the software updates to restart by default. However, forcing a system restart after software update installation ensures that updates fully complete, whereas suppressing post-installation restart requests can leave systems in an insecure state.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Servers | Specifies whether to suppress a system restart on servers, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and servers will restart if required by the software update installation.
Workstations | Specifies whether to suppress a system restart on workstations, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and workstations will restart if required by the software update installation.
Allow system restart outside of maintenance windows | Specifies whether to allow system restarts for both workstations and servers outside of configured maintenance windows. By default, this setting is not enabled, and when a system restart is required for a software update installation to complete, it is only initiated when the there is more than 10 minutes left in a configured maintenance window.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Event Generation Page

Use the Event Generation page in the Configuration Manager 2007 Deploy Software Updates Wizard to specify whether to disable Microsoft Operations Manager alerts during software update installation and whether Operations Manager alerts are created when software update installations fail.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Disable Operations Manager alerts while software updates run | Specifies that Operation Manager alerts are disabled during the software update installation. This is useful when deploying software updates that will impact an application that is being monitored by Operations Manager. Disabling alerts while the update is being installed will prevent alerts from triggering, such as a service that is stopped, as a result of the update installation. By default, this setting is not enabled.
Generate Operation Manager alert when a software update installation fails | Specifies that an Operations Manager alert is created for each software update installation failure. By default, this setting is not enabled.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Download Settings Page

Use the Download Settings page in the Configuration Manager 2007 Deploy Software Updates Wizard to configure how clients interact with distribution points when they receive a software update deployment.

Each boundary configured in Configuration Manager 2007 is designated as a fast (LAN) or slow or unreliable network. Clients connected to a LAN always download software updates from the distribution point and then install them. You can configure the client behavior when they are connected to a slow or unreliable network boundary.

Protected distribution points are configured with specific boundaries. When clients are within these boundaries, you can specify whether they must install software updates from protected distribution points or allow them to install updates from unprotected distribution points when the updates are not available on any protected distribution points.

This page contains the elements as described in the following table.

UI Element List

Name Description

When a client is connected within a slow or unreliable network boundary

Specifies whether clients will install software updates when they are connected to a slow or unreliable network boundary.

  • Do not install software updates: Specifies that clients do not install software updates if they are within network boundaries that are designated as slow or unreliable. This is the default selection.
  • Download software updates from distribution point and install: Specifies that clients download the software updates from the distribution point and install them if they are within network boundaries that are designated as slow or unreliable. This is the same behavior as if the client was within a local area network boundary.

Specify whether to allow clients that are within the boundaries for one or more protected distribution points to download and install software updates from unprotected distribution points when the updates are not available from any protected distribution point

Specifies whether clients will install software updates from unprotected distribution points when the updates are not available on any protected distribution points.

  • Do not install software updates: Indicates that when protected distribution points do not have the software updates available for clients that are within the protected distribution point boundaries, software updates will not be installed.
  • Download software updates from unprotected distribution point and install: Indicates that when protected distribution points do not have the software updates for clients that are within the protected distribution point boundaries, the client downloads the software updates from an unprotected distribution point and installs them. This is the default selection.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Configure Configuration Manager Boundaries

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: SMS 2003 Settings Page

Use the SMS 2003 Settings page in the Configuration Manager 2007 Deploy Software Updates Wizard to deploy software updates to SMS 2003 clients that are members of the target collection. This page does not display in the wizard if any of the specified software updates are not deployable to SMS 2003 clients. Software updates from the Microsoft Update catalog and synchronized using Inventory Tool for Microsoft Updates catalog can be deployed to SMS 2003 clients.

This page contains the elements as described in the following table.

UI Element List

Name Description

Deploy software updates to SMS 2003 clients

Specifies whether to deploy the software updates in the deployment to SMS 2003 clients that are in the target collection. A package, package instruction files, and advertisement are created and sent to child SMS 2003 sites to support the update installation on SMS 2003 clients. By default, this setting is not enabled.

Collect hardware inventory immediately

Specifies whether to collect hardware inventory on SMS 2003 clients immediately following software update installation. This increases reporting accuracy but might increase system activity on the SMS 2003 clients. By default, this setting is not enabled and hardware inventory is collected during its scheduled hardware inventory cycle.

When a distribution point is available locally

Specifies that SMS 2003 clients handle software update installation when the updates are available on a local distribution point according to the following options:

  • Run update installation from distribution point: Specifies that the software updates are installed from the distribution point. This is the default setting.
  • Download updates from distribution point and then run installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

When a client is connected within a slow or unreliable network boundary

Specifies that SMS 2003 clients handle software update installation when the updates are available only on remote distribution points according to the following options:

  • Do not run update installation: Specifies that the software update installation will not run.
  • Download updates from a remote distribution point prior to update installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client. This is the default setting.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

  • Run update installation from a remote distribution point: Specifies that the software updates are installed from the remote distribution point.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

Note
It is highly recommended that you enable Background Intelligent Transfer Service (BITS) on distribution points that are used for software updates when downloading the updates from the distribution point and then installing them. If BITS is enabled on the distribution point, disconnection from the network during the software updates download does not cause the deployment to fail because BITS resumes the download, starting where it was interrupted, the next time the client has network access. If BITS is not enabled on the distribution point and a network problem occurs during the software updates download, the software updates installation fails.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment
Planning the SMS 2003 Software Updates Upgrade

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Create Template Page

Use the Template Name page in the Configuration Manager 2007 Deploy Software Updates Wizard to save the deployment properties in a template for use in future software update deployments. Templates are used when creating new deployments to ensure consistency among similar deployments and to save time. The properties in the following wizard pages are saved within a template and auto populated when creating a new deployment:

  • Collection
  • Display/Time Settings
  • Restart Settings
  • Event Generation
  • Download settings
  • SMS 2003 Settings

This page contains the elements as described in the following table.

UI Element List

Name Description

Save deployment properties as a template

Specifies whether to save the deployment properties in a template to use in future software update deployments. If enabled, the new template is saved and available for use when creating a new deployment and displayed in the Deployment Templates node of the Configuration Manager console.

Note
You might need to run the Refresh action before new templates are displayed in the Deployment Templates node.

Template Name

Specifies the name of the deployment template. The name must be unique and help to describe the objective of the deployment template.

Template Description

Specifies the description for the deployment template. The description should provide an overview of the deployment template configuration and other relevant information that helps to identify it among others in the Deployment Templates node of the ConfigMgr Administrator console.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
Deployment Template Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Deployment Package Page

Use the Deployment Package page in the Configuration Manager 2007 Deploy Software Updates Wizard or Update List Wizard to select an existing deployment package or create a new one for the deployment. The software updates in the deployment are downloaded and copied to the deployment package folder on the distribution points configured for the package. If all software updates in the deployment have previously been downloaded and copied to a package shared folder on the distribution point, the Deployment Package page of the wizard does not display. The deployment is automatically configured with the package used to download the update.

When creating a software update deployment that will target SMS 2003 clients, and at least one software update has not yet been downloaded, all of the software updates not in the package configured for the deployment will be downloaded even when they were previously downloaded to another package. When all software updates have been downloaded prior to creating the deployment, when the downloaded updates were previously downloaded to the package selected in the deployment, or when the Deploy software updates to SMS 2003 clients setting is not selected in the deployment, the wizard downloads only the software updates that have not been previously downloaded. To prevent this behavior, download the software updates that have not yet been downloaded prior to creating the deployment by using the Download Updates Wizard or the Update List Wizard.

Note
The Deployment Package page only displays in the Update List Wizard if the Download the files associated with the selected software updates setting is enabled on the Update List page.

This page contains the elements as described in the following table.

UI Element List

Name Description

Select deployment package

Specifies that an existing package is used for the software updates in the deployment. Click Browse to open the Select a Deployment Package dialog box, which lists only packages created to host software updates. When a deployment package is highlighted, the package name, package description, and package ID are listed in the bottom pane. Select the deployment package to be used for the software updates in the deployment, and then click OK.

Note
Deployment packages are displayed only from the current site. Packages created at a parent site are not available for selection.

Create a new deployment package

Specifies that a new package is created for the software updates in the deployment. The following properties are configured as part of the deployment package.

  • Deployment package name: Specifies the name of the deployment package. The package should have a unique name, describe the package content, and is limited to no more than 50 characters.
  • Deployment package description: Specifies the description of the deployment package. The package description should describe the package contents in detail and is limited to no more than 127 characters.
  • Deployment package source: Specifies the location of the software update source files. When the deployment is generated, the source files are compressed and copied to the distribution points that are associated with the deployment package. The source location must be entered as a network path (for example, \\server\sharename\path), or the Browse button can be used to find the network location. The shared folder for the deployment package source files must be manually created before proceeding to the next page.
    Note
    The deployment package source location must not be used by another deployment or software distribution package.

    Important
    The SMS Provider computer account and the user who will actually download the software updates to the download location both require write access to the download location. Restrict access to the download location to reduce the risk of attackers tampering with the software updates source files in the download location.

  • Deployment package sending priority: Specifies the sending priority for the deployment package. The sending priority is used for the deployment package when it is sent to distribution points at child sites. Packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. Unless there is a backlog, the package will process immediately regardless of its priority.
  • Enable binary differential replication: Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred. For more information, see About Binary Differential Replication. This setting can be modified for existing packages in the properties for the package.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Manage Distribution Points in Deployment Packages

Concepts

About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
How to Manage Software Update Files
How to Manage Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
Deployment Package Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Distribution Points Page

Use the Distribution Points page in the Configuration Manager 2007 Deploy Software Updates Wizard or Update List Wizard to select the distribution points that are used to host the software update files defined in the new deployment package. After a deployment package is created, distribution points are managed from the Distribution Points node under the associated package.

Important
When no distribution points are selected, the deployment is created and the software update file is downloaded to the source folder, but the update file will not be available to client computers until at least one distribution point is added to the package.

If all software updates in the deployment have previously been downloaded and copied to a package shared folder on the distribution point, the Distribution Points page of the wizard does not display. The deployment is automatically configured with the package used to download the update.

Note
The Distribution Points page only displays in the Update List Wizard if the Download the files associated with the selected software updates setting is enabled on the Update List page.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Browse | Opens the Add Distribution Points dialog box to select the distribution points for the software update deployment package. In the Distribution Points pane, each site in the hierarchy displays and can be expanded to show the distribution points that are available. Check the box to the left of the distribution point server names to select the distribution points for the package. Click OK to exit the dialog box. To add all site distribution points for a site, click the box to the left of the site code for the site.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Manage Distribution Points in Deployment Packages

Concepts

About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
How to Manage Software Update Files
How to Manage Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
Deployment Package Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Download Location Page

Use the Download Location page in the Configuration Manager 2007 Deploy Software Updates Wizard or Update List Wizard to configure whether the software updates in the deployment should be downloaded from the Internet location specified by the vendor and stored in the update definition or to download software updates from the local network.

Important
When a new deployment is being created in the Deploy Software Update Wizard that targets Systems Management Server 2003 clients, select Download software updates from the Internet even when the updates are already in a deployment package. The software updates are validated in the package, but not downloaded.

Note
The Download Location page only displays in the Update List Wizard if the Download the files associated with the selected software updates setting is enabled on the Update List page.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Download software updates from the Internet | Specifies that the software updates are downloaded from the location on the Internet that is defined in the software update definition. This setting is enabled by default. Internet connectivity is required from the site server when using this setting.
Download software updates from a location on the local network | Specifies that the software updates are downloaded from a local directory or shared folder. Use this setting when the site server does not have Internet access. The software updates can be downloaded from any computer that has Internet access and stored in a location on the local network that is accessible from the site server. For more information, see How to Manually Download Software Updates.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Manually Download Software Updates

Concepts

About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deploy Software Updates Wizard: Language Selection Page

Use the Language Selection page in the Configuration Manager 2007 Deploy Software Updates Wizard or Update List Wizard to configure the languages that are downloaded for the selected software updates. The software updates are downloaded only if they are available in the selected languages. Software updates that are not language specific are always downloaded.

If all software updates in the deployment have previously been downloaded and copied to the shared folder for the package on the distribution point, the Language Selection page of the wizard does not display. The deployment is automatically configured to download the updates in the languages that were previously downloaded.

Note
The Language Selection page only displays in the Update List Wizard if the Download the files associated with the selected software updates setting is enabled on the Update List page.

This page contains the elements as described in the following table.

Name | Description
Update File | Specifies the languages for which software update files are downloaded. By default, the languages configured in the software update point properties are selected. Selecting additional languages does not add them to the configured software update point language settings. At least one language must be selected before proceeding to the next page. When only a language is selected on this page that is not supported by the software update, the download will fail for the software update.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Software Update Point
How to Manage Software Update Files
Planning for a Software Update Deployment
Planning for the Software Update Point Settings

Other Resources

Deploy Software Updates Wizard
Deployment Package Name Properties
Deployment Name Properties
Download Updates Wizard
How to Manage Software Update Deployments
Software Update Point Component Properties


Deploy Software Updates Wizard: Deployment Schedule Page

Use the Deployment Schedule page in the Configuration Manager 2007 Deploy Software Updates Wizard to specify when a software update deployment will become active and whether software update installation will be enforced on clients.

This page contains the elements as described in the following table.

UI Element List

Name | Description
As soon as possible | Specifies that the software updates in the deployment are made available to clients as soon as possible. When the deployment is created, the machine policy is updated, clients are made aware of the deployment at their next machine policy evaluation cycle, and then the updates are available for installation.
Date and time | Specifies that the software updates in the deployment will not be made available to clients until a specific date and time. When the deployment is created, the machine policy is updated and clients are made aware of the deployment at their next machine policy evaluation cycle, but the software updates in the deployment are not available for installation until the configured date and time.
Do not set a deadline for software update installation | Specifies that the software updates in the deployment are optional and do not require automatic installation by a specific date and time.
Set deadline for software update installation | Specifies that the software updates in the deployment are mandatory and require automatic installation by a specific date and time. If the deadline is reached and the software updates in the deployment are still required on the client, the update installation will automatically be initiated.
Enable Wake On LAN | Specifies whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more updates in the deployment. The computers that are not running are started at the deadline so the update installation can be initiated. Clients that do not require any updates in the deployment are not started. By default, this setting is not enabled and available only when there is a deadline configured for the deployment.
Ignore maintenance windows and install immediately at deadline | Specifies whether the software updates in the deployment are installed at the deadline regardless of a configured maintenance window. By default, this setting is not enabled and available only when there is a deadline configured for the deployment.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Maintenance Windows
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments
Overview of Wake On LAN


Deploy Software Updates Wizard: NAP Evaluation Page

Use the NAP Evaluation page in the Configuration Manager 2007 Deploy Software Updates Wizard to specify whether the software updates in this deployment are required for compliance when using Network Access Protection (NAP). Enable NAP evaluation to include the software updates in a NAP policy that will become effective on NAP-capable clients based on the configured schedule.

When the policy becomes effective, NAP-capable clients might have restricted access until they comply with the selected software update. Network restriction and remediation is dependent on how the policies are configured on the Windows Network Policy Server.

Note
This page is not displayed when NAP is not configured for this site.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Enable NAP evaluation | Specifies whether the software update is included in the NAP policy and evaluated on NAP-capable clients.
As soon as possible | Specifies that the software update is included in the NAP policy, which becomes effective on NAP-capable clients as soon as possible.
Date and time | Specifies that the software update is included in the NAP policy, which becomes effective on NAP-capable clients on the specified date and time. The default date and time value is determined by adding 14 days to the deployment deadline date and time that was configured on the Deployment Schedule page.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Configure NAP Evaluation for Software Updates

Concepts

About NAP Evaluation in Network Access Protection
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deploy Software Updates Wizard
Deployment Name Properties
How to Manage Software Update Deployments


Deployment Template Wizard

Use the Software Update Deployment Template Wizard in Configuration Manager 2007 to create a software update deployment template, which stores many of the software update deployment properties. Deployment templates can be used when creating software update deployments to ensure consistency in similar deployments and to save time. After the new template is created, it is displayed in the Deployment Templates node of the Configuration Manager console and available for use when creating new deployments.

Note
You might need to run the Refresh action before new templates are displayed in the Deployment Templates node.

Click the related link for detailed information about each wizard page in the Software Update Deployment Template Wizard.

In This Section

Deployment Template Wizard: Template Name Page

Specifies the name and description of the deployment template.

Deployment Template Wizard: Collection Page

Specifies the collection that is targeted for the software update deployment. Templates can be created without a collection so that one deployment template can be used during a phased deployment where collections change over time.

Deployment Template Wizard: Display/Time Settings Page

Specifies whether users are notified of pending software updates and see the update installation progress, whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.

Deployment Template Wizard: Restart Settings Page

Specifies the system restart behavior when a software update installs on a client and requires a restart to complete, and whether system restarts are allowed outside of configured maintenance windows.

Deployment Template Wizard: Event Generation Page

Specifies whether to disable Microsoft Operations Manager alerts during software update installation and whether an Operation Manager alert is created when a software update installations fails.

Deployment Template Wizard: Download Settings Page

Specifies the behavior for software update installation when clients are within a "slow or unreliable" network boundary and when clients are within the boundaries of a protected distribution point that does not contain the software update.

Deployment Template Wizard: SMS 2003 Settings Page

Specifies whether to generate a special deployment for SMS 2003 clients that are in the software updates target collection.

Wizard - Summary Page

Provides a summary of the deployment template properties.

Wizard - Progress Page

Provides the progress for deployment template creation.

Wizard - Completing the Wizard Page

Provides a summary of the created deployment template properties or a list of issues that occurred during deployment template creation.

See Also

Concepts

About the Deployment Template Wizard

Other Resources

Deployment Template Name Properties
How to Manage Software Update Deployments


Deployment Template Wizard: Template Name Page

Use the General page in the Configuration Manager 2007 Deployment Template Wizard to configure the name and description of the deployment template.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Name | Specifies the name of the deployment template. The name must be unique and help to describe the objective of the deployment template.
Description | Specifies the description for the deployment template. The description should provide an overview of the deployment template configuration and other relevant information that helps to identify it among others in the Deployment Templates node of the Configuration Manager console.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Deployment Template Wizard: Collection Page

Use the Collection page in the Configuration Manager 2007 Deployment Template Wizard to configure the collection that is targeted for the software updates deployment. Members of the collection and subcollections, if configured, receive available deployments during their next Machine Policy Retrieval & Evaluation Cycle.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Collection | Specifies the target collection for the deployment. Members of the collection receive the software updates defined in the deployment. Templates can be created without a collection so that one deployment template can be used during a phased deployment where collections change over time. To select a collection, click Browse, select the collection from the list, and then click OK.
Include members of subcollection | Specifies whether members of any subcollection of the main collection receive the software updates defined in the deployment. By default, this setting is enabled and members of both the collection and subcollection are targeted for the deployment.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Deployment Template Wizard: Display/Time Settings Page

Use the Display/Time Settings page in the Configuration Manager 2007 Deployment Template Wizard to configure whether users are notified of pending software updates and see the update installation progress, whether a client evaluates the deployment schedule based on local time or UTC, and the duration setting that is used to set the default deadline time in a deployment.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Allow display notifications on clients | Specifies that display notifications are used on clients that inform end users of available software updates and progress indicators are displayed during software update installation. By default, this setting is selected and display notifications are allowed on clients.
Suppress display notifications on clients | Specifies that display notifications are not used on clients and progress indicators are not displayed during update installation. Software update notification icons will still display on clients and users can click this icon to see available updates.
Client Local Time | Specifies that clients use their local time to evaluate the schedules for when software updates become available on clients and when deadlines enforce software update installation, if enabled.
UTC | Specifies that clients use UTC to evaluate schedules for when software updates become available on clients and when deadlines enforce software update installation. By default, this setting is selected and UTC is used to evaluate deployment schedules.
Duration | Specifies the duration, which is used when a template is used while creating a deployment. The deadline setting in the deployment defaults to the time an update is available plus the configured duration setting. By default, the duration is set at 2 weeks.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Deployment Template Wizard: Restart Settings Page

Use the Restart Settings page in the Configuration Manager 2007 Deployment Template Wizard to configure system restart behavior when a software update installs on a client and requires a restart to complete, and when maintenance windows are configured.

Important
Suppressing system restarts can be useful in server environments or in cases in which you do not want the computers that are installing the software updates to restart by default. However, forcing a system restart after software update installation ensures that updates fully complete, whereas suppressing post-installation restart requests can leave systems in an insecure or unstable state.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Servers | Specifies whether to suppress a system restart on servers, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and servers will restart if required by the software update installation.
Workstations | Specifies whether to suppress a system restart on workstations, requested by a software update installation when a restart is required for the installation to complete. By default, this setting is not enabled, and workstations will restart if required by the software update installation.
Allow system restart outside of maintenance windows | Specifies whether to allow system restarts for both workstations and servers outside of configured maintenance windows. By default, this setting is not enabled, and when a system restart is required for a software update installation to complete, it is only initiated when the there is more than 10 minutes left in a configured maintenance window.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Deployment Template Wizard: Event Generation Page

Use the Event Generation page in the Configuration Manager 2007 Deployment Template Wizard to specify whether to disable Microsoft Operations Manager alerts during software update installation and whether Operations Manager alerts are created when software update installations fail.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Disable Operations Manager alerts while software updates run | Specifies that Operation Manager alerts are disabled during the software update installation. This is useful when deploying software updates that will impact an application that is being monitored by Operations Manager. Disabling alerts while the update is being installed will prevent alerts from triggering, such as a service that is stopped, as a result of the update installation. By default, this setting is not enabled.
Generate Operation Manager alert when a software update installation fails | Specifies that an Operations Manager alert is created for each software update installation failure. By default, this setting is not enabled.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Deployment Template Wizard: Download Settings Page

Use the Download Settings page in the Configuration Manager 2007 Deployment Template Wizard to configure how clients interact with distribution points when they receive a software update deployment.

Each boundary configured in Configuration Manager 2007 is designated as a fast (LAN) or slow or unreliable network. Clients connected to a LAN always download software updates from the distribution point and then install them. You can configure the client behavior when they are connected to a slow or unreliable network boundary.

Protected distribution points are configured with specific boundaries. When clients are within these boundaries, you can specify whether they must install software updates from protected distribution points or allow them to install updates from unprotected distribution points when the updates are not available on any protected distribution points.

This page contains the elements as described in the following table.

UI Element List

Name Description

When a client is connected within a slow or unreliable network boundary

Specifies whether clients will install software updates when they are connected to a slow or unreliable network boundary.

  • Do not install software updates: Specifies that clients do not install software updates if they are within network boundaries that are designated as slow or unreliable. This is the default selection.
  • Download software updates from distribution point and install: Specifies that clients download the software updates from the distribution point and install them if they are within network boundaries that are designated as slow or unreliable. This is the same behavior as if the client was within a local area network boundary.

Specify whether to allow clients that are within the boundaries for one or more protected distribution points to download and install software updates from unprotected distribution points when the updates are not available from any protected distribution point

Specifies whether clients will install software updates from unprotected distribution points when the updates are not available on any protected distribution points.

  • Do not install software updates: Indicates that when protected distribution points do not have the software updates available for clients that are within the protected distribution point boundaries, software updates will not be installed.
  • Download software updates from unprotected distribution point and install: Indicates that when protected distribution points do not have the software updates for clients that are within the protected distribution point boundaries, the client downloads the software updates from an unprotected distribution point and installs them. This is the default selection.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Configure Configuration Manager Boundaries

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Deployment Template Wizard: SMS 2003 Settings Page

Use the SMS 2003 Settings page in the Microsoft System Center Configuration Manager 2007 Deployment Template Wizard to deploy software updates to SMS 2003 clients that are members of the target collection. If the Deploy software updates to SMS 2003 clients setting is enabled, this template can only be used to initiate deployments with software updates that are deployable to SMS 2003 clients. Software updates from the Microsoft Update catalog and synchronized using Inventory Tool for Microsoft Updates catalog can be deployed to SMS 2003 clients.

This page contains the elements as described in the following table.

UI Element List

Name Description

Deploy software updates to SMS 2003 clients

Specifies whether to deploy the software updates in the deployment to SMS 2003 clients that are in the target collection. A package, package instruction files, and advertisement are created and sent to child SMS 2003 sites to support the update installation on SMS 2003 clients. By default, this setting is not enabled.

Important
When this setting is disabled in an active deployment that includes SMS 2003 clients, this setting cannot be enabled again. The corresponding program and advertisement created for SMS 2003 clients are disabled. Before permanently disabling this deployment for SMS 2003 clients, make sure this is the intended action.

Collect hardware inventory immediately

Specifies whether to collect hardware inventory on SMS 2003 clients immediately following software update installation. This increases reporting accuracy but might increase system activity on the SMS 2003 clients. By default, this setting is not enabled and hardware inventory is collected during its scheduled hardware inventory cycle.

When a distribution point is available locally

Specifies that SMS 2003 clients handle software update installation when the updates are available on a local distribution point according to the following options:

  • Run update installation from distribution point: Specifies that the software updates are installed from the distribution point.
  • Download updates from distribution point and then run installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client. This is the default setting.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

When a client is connected within a slow or unreliable network boundary

Specifies that SMS 2003 clients handle software update installation when the updates are available only on remote distribution points according to the following options:

  • Do not run update installation: Specifies that the software update installation will not run. This is the default setting.
  • Download updates from a remote distribution point prior to update installation: Specifies that the software updates are downloaded from the distribution point and then installed on the client.
    Caution
    When software updates are downloaded and then installed on SMS 2003 clients, all updates contained in the package are downloaded regardless of applicability for the client. When deployment packages contain a lot of updates that might not be applicable to the SMS 2003 client, you should consider whether to run the update installation directly from the distribution point.

  • Run update installation from a remote distribution point: Specifies that the software updates are installed from the remote distribution point.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

Note
It is highly recommended that you enable Background Intelligent Transfer Service (BITS) on distribution points that are used for software updates when downloading the updates from the distribution point and then installing them. If BITS is enabled on the distribution point, disconnection from the network during the software updates download does not cause the deployment to fail because BITS resumes the download, starting where it was interrupted, the next time the client has network access. If BITS is not enabled on the distribution point and a network problem occurs during the software updates download, the software updates installation fails.

See Also

Tasks

How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS

Concepts

About Deployment Templates in Software Updates
About Software Update Deployments
About the Deployment Template Wizard
Planning for a Software Update Deployment
Planning the SMS 2003 Software Updates Upgrade

Other Resources

Deployment Template Name Properties
Deployment Template Wizard
How to Manage Software Update Deployments


Distribute Software Wizard

Use the Distribute Software Wizard in Configuration Manager 2007 to distribute an existing software distribution package or create a new package and then distribute it to clients.

Click the following related links for detailed information about each wizard page in the Distribute Software Wizard.

In This Section

Package Page

Specifies whether to create a new package or distribute an existing package to clients.

Package Definition Page

Specifies which package definition file to use to create the new package.

Package Identification Page

Specifies the general information for a new package being created without a definition file.

Program Identification Page

Specifies the general information for a new program being created within the new package.

Program Properties Page

Specifies the conditions under which the program can run, as well as the action to take after it runs.

Source Files Page

Specifies whether the package contains source files that must be accessed from a directory or stored on the distribution point.

Source Directory Page

Specifies the directory location of any source files that need to be accessed to run the package.

Source File Compression Page

Specifies the directory location of any compressed source files that need to be accessed to run the package.

Distribution Points Page

Specifies the distribution points where client computers will access the package.

Advertise Program Page

Specifies whether or not to advertise a program from this package to client resources.

Select Program Page

Specifies which program to advertise to members of a collection.

Current Advertisements Page

Specifies whether the current advertisements for the selected program are sufficient.

Advertisement Target Page

Specifies the target collection to be reached by the advertisement.

New Collection Page

Specifies general information about the new collection to which the advertised program will be distributed.

Collection Membership Rules Page

Specifies the rules for populating the new collection to which the advertised program will be distributed.

Advertisement Name Page

Specifies a name and any additional comments for the advertisement.

Advertisement Subcollection Page

Specifies whether the advertisement should apply to subcollections.

Advertisement Schedule Page

Specifies when the program should be advertised.

Assign Program Page

Specifies whether the program should be made mandatory for clients.

Wizard - Summary Page

Provides a summary of the advertisement and program properties.

Wizard - Progress Page

Provides the progress for the advertisement creation.

Wizard - Completing the Wizard Page

Provides a summary of the created advertisement and program properties or a list of issues that occurred during the advertisement creation.

See Also

Concepts

About Advertisements
About Collections
About Packages

Other Resources

Software Distribution Overview


Package Page

Use the Package page in the Configuration Manager 2007 Distribute Software Wizard to specify whether to create a new package or distribute an existing package to clients.

This page contains the elements described in the following table.

UI Element List

Name Description

Create a new package from definition

Specifies that the wizard will create a new package from a package definition file prior to distributing the software. If selected, the wizard will open pages similar to those of the Create Package from Definition Wizard. For more information about this wizard, see Create Package From Definition Wizard.

Create a new package and program

Specifies that the wizard will create a new package and program prior to distributing the software. If selected, the wizard will open pages similar to those of the New Package Wizard and the New Program Wizard. For more information about these wizards, see New Package Wizard and New Program Wizard.

Select an existing Package

Specifies that the selected package will be distributed using the wizard. If this wizard is not being launched from a specific package, this option is required.

Note
Only one package may be selected at a time.

To specify a package to distribute, click Browse to open the Select a Package dialog box. Select the desired package, and click OK to choose the package.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Package Definition Files
About Packages

Other Resources

Software Distribution Overview


Package Definition Page

Use the Package Definition page in the Configuration Manager 2007 Distribute Software Wizard to specify which package definition file to use to create the new package.

This page contains the elements described in the following table.

UI Element List

Name Description

Publisher

Specifies the publisher of the package definition file that you want to use. Only files published by the selected publisher are displayed in the package definition list.

To choose a publisher, select from the drop-down list for currently available publishers or click the Browse button to navigate to a specific package definition file.

Package definition

Specifies the package definition files available from the publisher selected. To continue the wizard, you must select one of the files listed.

The following columns are displayed for package definition files from the selected publisher:

  • Name: Specifies the name of the package definition file, which typically indicates the file's functionality.
  • Version: Specifies the version of the package definition file, if indicated.
  • Language: Specifies the language version of the package definition file, if indicated.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

About Package Definition Files
About Packages
About the Package Definition File Format


Package Identification Page

Use the Package Identification page in the Configuration Manager 2007 Distribute Software Wizard to specify the general information for a new program being created within the new package.

This page contains the elements described in the following table.

UI Element List

Name | Description
Name | The name of the package, which can contain up to 50 characters. This field is required.
Version | The version number of the package, which can contain up to 32 characters.
Publisher | The software publisher of the package, which can contain up to 32 characters.
Language | The language version of the software package, which can contain up to 32 characters.
Comment | Optional text about the package, such as a description. You can use up to 127 characters.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Concepts

About Packages

Other Resources

Package Name Properties
How to Manage Packages


Program Identification Page

Use the Program Identification page in the Configuration Manager 2007 Distribute Software Wizard to specify the general information for a new program being created within the new package.

This page contains the elements described in the following table.

UI Element List

Name Description

Name

Specifies the name of the program, which can contain up to 50 characters. This field is required and must be unique within a package.

Note
After you create a program, you cannot modify its name.

On client computers, this name appears in Run Advertised Programs and Add or Remove Programs in Control Panel.

Comment

Specifies optional text about the program, such as a description. You can use up to 127 characters.

On client computers, this text is displayed in Run Advertised Programs in Control Panel.

Command line

Specifies the command line for the program, which can contain up to 255 bytes.

For example:

setup.exe /a

or

Msiexec /I my_app.msi /l*v /qn

This field is required.

To navigate to the program file, click Browse. By default, the package source folder appears if it exists and is accessible. If it does not exist or is not accessible, the root folder of the current computer appears.

File name extensions are strongly recommended. If the file name does not have an extension specified, Configuration Manager 2007 tries .com, .exe, and .bat as possible extensions. If the file is not an executable, Configuration Manager 2007 tries to apply a local association if possible.

When the program is run on a client, Configuration Manager 2007 first searches for the command-line file name within the package, followed by the local Microsoft Windows folder. If the file cannot be found, the program fails.

Category

Specifies the category under which the program will be displayed on the client computer.

Specifying a category for a program will help users find specific programs of interest. Advertised programs appear under the What's New category for up to 14 days or until they are run.

Note
By including ConfigMgr or a similar designation in the category name, categories can also be used to distinguish between programs in Add or Remove Programs that have been advertised by Configuration Manager 2007 and those advertised using group policies.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Reference

Program Name Properties

Concepts

About Programs

Other Resources

How to Manage Programs


Program Properties Page

Use the Program Properties page in the Configuration Manager 2007 Distribute Software Wizard to specify the conditions under which the program can run, as well as the action to take after it runs.

This page contains the elements described in the following table.

UI Element List

Name Description

Program can run

Specifies the logon conditions necessary for the program to run:

  • Only when a user is logged on: Prevents the program from running if no user is logged on to the client computer. This is the default setting.
  • Only when no user is logged on: Prevents the program from running until the user logs off the computer.
    Note
    If a user logs on while the installation is running, the program continues to run.

  • Whether or not a user is logged on: Enables the program to run with or without a user logged on the client computer.

Run with administrative rights

Specifies whether the program runs with administrator credentials. If selected, this option forces the program to run under the local administrator account on the client computer.

If this option is selected, the following option is available:

  • Allow users to interact with this program: Specifies whether to allow users to interact with the program. This check box is available only when Run with administrative rights is selected.
    Select this option only for programs that must run in an administrative context and that require the user to interact with the program. If you select this option, the user interface for the program is visible to the logged-on user, and that user can interact with the program.
    Leave this option clear for all programs that do not display any user interface or that display a user interface but do not require the user to interact with the program.
    Note
    If you create a program that is set to Run with administrative rights and you do not select Allow users to interact with this program, the program can fail if it displays a user interface that requires a user to make a selection or click a button. The program waits for user interaction until the program's configured Maximum allowed run time is exceeded, and then it stops if no user interaction is received. If the Maximum allowed run time is set to Unknown, the program's process ends after 12 hours.

After running

Specifies the action that occurs after this program has completed successfully:

  • No action required: No restart or log off is required. This is the default value.
  • Program restarts computer: The program requires a restart and performs this action automatically.
  • ConfigMgr restarts computer: The computer is restarted automatically by Configuration Manager 2007.
  • ConfigMgr logs user off: The current user is logged off the computer after the program is completed. Use this option if the program requires that the user log off and then log on again before it can run.
Important
Both the ConfigMgr restarts computer and ConfigMgr logs user off actions are done forcefully after providing the user with a grace period. Applications that are running on clients when this occurs do not have an opportunity to save their states or data.

Maximum allowed run time

Specifies the maximum time (in minutes) that the program is expected to run on the client computer. This setting can be specified as a whole number greater than zero or as Unknown.

The default setting is 120 minutes.

It is not recommended that you set this value to Unknown because this value is used for two important purposes:

  • To monitor the results of the program.
  • To determine if a program will be launched when maintenance windows have been defined on the client computers.

On client computers, the specified value for published programs appears in Run Advertised Programs in Control Panel and helps the user decide if and when to run the advertised program.

Monitoring Program Results

If the value is set as Unknown, Configuration Manager 2007 interprets the maximum allowed run time as 12 hours (720 minutes).

If this maximum run time (whether set by the user or as the default value) is exceeded, Configuration Manager 2007 will stop the program if it is set to Run with administrative rights and the Allow users to interact with this program setting is not selected.

If the program itself is not stopped, Configuration Manager 2007 stops monitoring the program after the maximum allowed run time is exceeded. This allows Configuration Manager 2007 to continue with other software distribution functions, such as running other advertised programs. As a result, Configuration Manager does not do the following:

  • Stop the program.
  • Free up any drives that have been mapped for the advertised program.
  • Free up any network connections made for the advertised program.
  • Remove security rights granted to the Client Token account, if any.
  • Free up operating system resources used by Configuration Manager when running advertised programs.

Maintenance Windows

When a maintenance window is in place, a program will be launched only if there is time available remaining in the maintenance window to accommodate the Maximum Allowed Run Time setting (plus the Advertised Programs Client Agent countdown duration).

Important
A conflict might occur if the Maximum allowed run time is longer than the scheduled maintenance window. If the maximum run time is set by the user to a period exceeding the length of any available maintenance window, that program will not be run. For more information, see About Maintenance Windows.

If an advertised program has the Maximum allowed run time option set to Unknown, however, the available time evaluation proceeds differently. Although an Unknown setting is evaluated by Configuration Manager 2007 as 12 hours, this is for monitoring purposes only. When determining whether there is sufficient time to run a program within a given maintenance window, a setting of Unknown is evaluated as 0 minutes, regardless of whether the program actually takes 1 minute to run or 3 hours.

As a result, a program with the maximum run time set to Unknown will start running during a maintenance window that has even 1 minute available and can continue to run even if it finishes outside the designated maintenance window.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

About Maintenance Windows
About Packages
About Programs


Source Files Page

Use the Source Files page in the Configuration Manager 2007 Distribute Software Wizard to specify whether the package contains source files that must be accessed from a directory or stored on the distribution point.

This page contains the elements described in the following table.

UI Element List

Name Description

This package does not contain any source files

Specifies whether the package requires source files that its programs must run and that are not already on the client computer.

Always obtain files from a source directory

Specifies that the package requires source files that its programs must run and that you must indicate the location of those source files. Each time a distribution point is refreshed, Configuration Manager 2007 obtains the package source files from the path specified in the Source directory box. Use this option if the source files are likely to remain at the specified path, such as a share on a server.

Create a compressed version of the source files

Specifies that the package requires source files that its programs must run and that these source files will be stored in a compressed version on the site server. If this option is selected, this compressed version will be decompressed and copied to the distribution points instead of being copied directly from the original source folder when the distribution points are refreshed. Use this option if the source files might be removed from the specified path (for example, if the source files are on a CD).

If you select this option and then specify Update All Distribution Points in the Manage Distribution Points Wizard, a new version of the compressed copy is created from the specified source folder.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

About Packages


Source Directory Page

Use the Source Directory page in the Configuration Manager 2007 Distribute Software Wizard to specify the directory location of any source files that need to be accessed to run the package.

This page contains the elements described in the following table.

UI Element List

Name Description

Package

Specifies the name of the package being created.

Source directory location

Specifies the type of location for the source directory. Two options are available:

  • Network path (UNC Name)
  • Local drive on site server

Source directory

Specifies the network path to the package source files.

To specify the path to the source directory, either type the path or click Browse to navigate to the source directory location.

Persist content in client cache

Specifies whether content should be retained in the cache on the client computer indefinitely even if it has already been run. Although this option can be useful with some recurring packages, such as virus software or Windows Installer-based software that requires a local source copy to be available for applying updates, it will reduce the available cache space. Specifying this option might cause a large package to fail at a later point if there is insufficient space available in the cache.

Enable binary differential replication

Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

About Packages

Other Resources

Software Distribution Overview


Source File Compression Page

Use the Source File Compression page in the Configuration Manager 2007 Distribute Software Wizard to specify the directory location of any compressed source files that need to be accessed to run the package.

This page contains the elements described in the following table.

UI Element List

Name Description

Package

Specifies the name of the package being created.

Source directory location

Specifies the type of network path used for the package source directory. The following options are available:

  • Network path (UNC Name)
  • Local drive on site server

Source directory

Specifies the network path to the package source directory.

To specify the path to the source directory, either type the path or click Browse to navigate to the source directory location.

Persist content in client cache

Specifies whether content should be retained in the cache on the client computer indefinitely even if it has already been run. Although this option can be useful with some recurring packages, such as virus software or Windows Installer-based software that requires that a local source copy be available for applying updates, it will reduce the available cache space. Specifying this option might cause a large package to fail at a later point if there is insufficient space available in the cache.

Enable binary differential replication

Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

About Packages


Distribution Points Page

Use the Distribution Points page in the Microsoft System Center Configuration Manager 2007 Distribute Software Wizard to specify where clients will access this package.

This page contains the elements described in the following table.

UI Element List

Name Description

Distribution points

Specifies the distribution points from which the clients will be able to access the package. Multiple distribution points can be selected. If the package has previously been distributed, some of the displayed distribution points might already be selected. If you clear a selected distribution point, the package will be deleted from that distribution point.

The following columns are displayed for distribution points in the list:

  • Name: Specifies the name of the specific distribution point.
  • Site: Specifies the name of the site on which the distribution point resides.
  • Type: Specifies the type of site on which the distribution point resides.

Three buttons are available for selecting distribution points from the list:

  • Select All: Selects all distribution points displayed in the list.
  • Clear All: Clears all distribution points displayed in the list.
  • Select Group: Opens the Browse Distribution Point Groups dialog box, allowing you to select a distribution point group to which the package will be distributed.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Distribution Points

Other Resources

Software Distribution Overview
Package Name Properties


Advertise Program Page

Use the Advertise Program page in the Configuration Manager 2007 Distribute Software Wizard to specify whether or not to advertise a program from this package to client resources.

This page contains the elements described in the following table.

UI Element List

Name Description

Do you want to advertise a program from this package?

Specifies whether you want to advertise a program from this package. Two options are available:

  • Yes
  • No

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Programs

Other Resources

Software Distribution Overview


Select Program Page

Use the Select Program page in the Configuration Manager 2007 Distribute Software Wizard to specify which program to advertise to members of a collection.

This page contains the elements described in the following table.

UI Element List

Name Description

Programs

Specifies the specific program to be advertised to a collection.

Note
Only one program may be selected at a time.

The following columns are displayed for distribution points in the list:

  • Name: Specifies the name of the specific program.
  • Description: Specifies any description available for the specific program.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections
About Programs

Other Resources

Software Distribution Overview


Current Advertisements Page

Use the Current Advertisements page in the Configuration Manager 2007 Distribute Software Wizard to view a list of advertisements and optionally, add one or more new advertisements for the selected program.

This page contains the elements described in the following table.

UI Element List

Name Description

Current advertisements for this program

Specifies all advertisements currently existing for the selected program.

The following columns are displayed for the advertisements listed:

  • Name: Displays the name of the specific advertisement.
  • Collection: Displays the name of the collection to which the program is advertised.
  • Advertise After: Displays the date and time when the program is advertised and available to run on clients.
  • Expires After: Displays whether the advertisement has a date and time after which the program advertisement is no longer available to run on clients.

These advertisements are sufficient

Specifies that the advertisements as displayed are sufficient to meet your distribution needs. Selecting this option will open the Summary page of the wizard.

Create a new advertisement

Specifies that the wizard should be continued to create a new advertisement for the selected program.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections

Other Resources

Software Distribution Overview


Advertisement Target Page

Use the Advertisement Target page in the Configuration Manager 2007 Distribute Software Wizard to specify the target collection to be reached by the advertisement.

This page contains the elements described in the following table.

UI Element List

Name | Description
Advertise this program to an existing collection | Specifies whether an existing collection should be used as the target for the new advertisement. If this option is selected, a collection must be selected. Click the Browse button to select an existing collection.
Create a new collection and advertise this program to it | Provides options to create a new collection to advertise the program. These options allow you to specify membership rules for the collection and a schedule for updating the collection's membership.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections

Other Resources

Software Distribution Overview


New Collection Page

Use the New Collection page in the Configuration Manager 2007 Distribute Software Wizard to specify general information about the new collection to which the advertised program will be distributed.

This page contains the elements described in the following table.

UI Element List

Name | Description
Name | Specifies the name of the new collection, up to a total of 127 characters. This field is required and must be unique within the Collections node.
Comment | Specifies an optional description of the collection, up to a total of 127 characters.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Collection Membership Rules Page

Use the Collection Membership Rules page in the Configuration Manager 2007 Distribute Software Wizard to define rules that you can use to evaluate membership in the new collection and set the collection update schedule.

This page contains the elements described in the following table.

UI Element List

Name Description

Membership rules

Specifies the membership rules that are defined for the new collection.

The following options are available for creating and managing these membership rules:

  • Computer icon: Click to start the Create Direct Membership Rule Wizard, which enables you to select one or more resources to include in this collection.
  • Query icon: Click to open the Query Rule Properties dialog box, which enables you to define a new query-based membership rule.
  • Properties icon: Select a defined membership rule, and click to modify the rule.
  • Delete icon: Select a defined membership rule, and click to delete the rule.

The following columns are displayed for each membership rule:

  • Rule: Specifies the name of the membership rule.
  • Type: Specifies the type of the membership rule, either Direct (for a specific resource), Query (for a query-based rule), or both.
  • Limit To: Indicates whether the rule is limited to a specific collection.
    If the rule is limited, the name of the collection that limits the rule appears. If the rule is not limited, <Unlimited> appears.

How often should ConfigMgr update this collection's membership?

Specifies the schedule that Configuration Manager will use to reassess the membership of the collection to update if changes have been made. The default setting is to update the collection membership every two hours.

To set a custom schedule for updating the collection, click the Schedule button.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

About Collections
About Membership Rules


Advertisement Name Page

Use the Advertisement Name page in the Microsoft System Center Configuration Manager 2007 Distribute Software Wizard to specify a name and any additional comments for the advertisement.

This page contains the elements described in the following table.

UI Element List

Name Description

Name

Specifies the name of the advertisement, up to 100 characters. This field is required.

Note
The default name for this advertisement is a concatenation of the package name, the program name, and the name of the collection to which it is being advertised. In some cases, especially if you are advertising a program created using a package definition file and are advertising to a collection with a long name, this will be longer than 100 characters and will need to be changed before the program can be advertised.

Comment

Specifies optional text about the advertisement, such as a description. You can use up to 127 characters.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements

Other Resources

Software Distribution Overview
Advertisement Name Properties


Advertisement Subcollection Page

Use the Advertisement Subcollection page in the Configuration Manager 2007 Distribute Software Wizard to specify whether the advertisement should apply to subcollections of the primary collection. If the collection has links to other collections, you can advertise the program to members of those collections as well.

This page contains the elements described in the following table.

UI Element List

Name | Description
Advertise the program only to members of the specified collection | Specifies that the program will only be advertised to the selected collection and will not be advertised to subcollections or linked collections.
Advertise the program to members of subcollections as well | Specifies that the program will be advertised to members of the selected collection, associated subcollections, and linked collections.
The program will be advertised to these collections | Displays a list of all collections, subcollections, and linked collections to which the program will be advertised.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to View the Advertisements for a Collection

Concepts

About Advertisements
About Collections
About Subcollections

Other Resources

Software Distribution Overview


Advertisement Schedule Page

Use the Advertisement Schedule page in the Microsoft System Center Configuration Manager 2007 Distribute Software Wizard to specify when the program should be advertised.

This page contains the elements described in the following table.

UI Element List

Name Description

Advertise the program after

Specifies the date and time when the program is advertised and available to run on clients in their respective time zones. By default, the current date and time is specified. To select another date and time, click the adjacent arrows.

When a mandatory assignment is defined for this advertisement, client computers will use the advertisement start time to determine when to start downloading the package. This will occur if the advertisement settings indicate the client should download the package before running the program.

No. This advertisement never expires.

Specifies that the advertised program remains available for clients to access indefinitely.

Yes. This advertisement expires.

Specifies that the advertisement expires at a given date and time. If this option is selected, you must use the Expiration date and time fields to specify a date and time after which the program advertisement is no longer available to run on clients in their respective time zones.

By default, the cutoff date and time is set at 6 months from the current date and time. To specify another date and time, click the adjacent arrows.

Download content from unprotected distribution point and run locally.

Specifies that if the advertised program is not available on a protected distribution point, the client should download it from an unprotected distribution point and run it locally.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections
About Distribution Points

Other Resources

Software Distribution Overview


Assign Program Page

Use the Assign Program page in the Configuration Manager 2007 Distribute Software Wizard to specify whether the program should be assigned for clients. Assigning a program causes it to become mandatory. An assigned program will automatically run if it has not already been run on a client.

This page contains the elements described in the following table.

UI Element List

Name | Description
No. Do not assign this program. | Specifies that the program will not be made mandatory for clients. If this option is selected, all other fields on this page will be unavailable.
Yes. Assign this program. | Specifies that the program will be mandatory for clients. If this option is selected, all other fields on this page will be available.
Available after | Specifies the date and time after which the advertised program is available. This field displays the date and time set on the Advertisement Schedule page of the wizard.
Assign after | Specifies the date and time when the program is assigned to run on clients in their respective time zones. By default, the date and time at which the program becomes available is specified. To select another date and time, click the adjacent arrows.
Expires after | Specifies the date and time after which the advertised program is no longer available to clients. This field displays the date and time set on the Advertisement Schedule page of the wizard.
Enable Wake on LAN | Specifies whether to have the site server wake up the client computer to run the program.
Ignore maintenance windows when running program | Specifies whether to have the advertised program ignore maintenance windows while the program is running.
Allow system restart outside maintenance windows | Specifies whether to allow the advertised program to restart the client even if the restart would occur outside a maintenance window.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
Advertisement Schedule Page

Other Resources

Software Distribution Overview
How to Manage Advertisements


Distribute Software to Devices Wizard

The Distribute Software to Devices Wizard enables you to easily distribute software to mobile devices by guiding you through the process of defining a package and creating an advertisement for a selected collection.

Click the related link below for detailed information about each wizard page in the Distribute Software to Devices Wizard.

Welcome to the Distribute Software to Devices Wizard

Distribute Software to Devices Wizard

Package Page

Package Page

Package Definition Page

Package Definition Page

Package Identification Page

Package Identification Page

Source Files Page

Source File Page

Source Directory Page

Source Directory Page

Source File Compression Page

Source File Compression Page

Program Identification Page

Program Identification Page

Program Properties Page

Program Properties Page

Advertise Program Page

Advertise Program Page

Distribution Points Page

Distribution Points Page

Select Program Page

Select Program Page

Current Advertisement Page

Current Advertisement Page

Advertisement Target Page

Advertisement Target Page

Advertisement Name Page

Advertisement Name Page

Advertisement Subcollection Page

Advertisement Subcollection Page

Advertisement Schedule Page

Advertisement Schedule Page

Assign Program Page

Assign Program Page

See Also

Concepts

How to Deploy Software to Mobile Devices


Package Page

Use the Package page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify whether to create a new package or distribute an existing package to clients.

This page contains the elements described in the following table.

UI Element List

Create a new package from definition

Specifies that the wizard will create a new package from a package definition file prior to distributing the software. If selected, the wizard will open pages similar to those of the Create Package from Definition Wizard

Create a new package and program

Specifies that the wizard will create a new package and program prior to distributing the software. If selected, the wizard will open pages similar to those of the New Package Wizard and the New Program Wizard.

Select an existing Package

Specifies the package that contains the program that will be advertised to mobile device clients. This field is required.

Click the Browse button to open the Select a Package dialog box. Select the desired package, and click OK to choose the package.

Note
Only one package may be selected at a time.

The following information is displayed for packages that are available for distribution:

  • Package: Specifies the name of the given package.
  • Package ID: Specifies the ID of the package. This is the name of the .xml file associated with the package.
  • Last refresh time: Specifies the date and time the package was last refreshed.
  • Comment: Specifies the description or comments included in the package when it was created.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections

Other Resources

Create Package From Definition Wizard
Software Distribution Overview
New Package Wizard
New Program Wizard
Package Name Properties


Package Definition Page

Use the Package Definitions page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify the package definition to use as a template for the new package.

This page contains the elements described in the following table.

UI Element List

Publisher

Specifies the publisher of the package definition file that you want to use. Only files published by the selected publisher are displayed in the package definition list.

To choose a publisher, select from the drop-down list for currently available publishers or click the Browse button to navigate to specific package definition file.

Package definition

Specifies the package definition files available from the publisher selected. To continue the wizard, you must select one of the files listed.

The following columns are displayed for package definition files from the selected publisher:

  • Name: Specifies the name of the package definition file, which typically indicates the file's functionality.
  • Version: Specifies the version of the package definition file, if indicated.
  • Language: Specifies the language version of the package definition file, if indicated.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Package Definition Files
About Packages
About the Package Definition File Format


Package Identification Page

Use the Package Definitions page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify the package definition to use as a template for the new package.

This page contains the elements described in the following table.

UI Element List

Name

Specifies the name of the new package that you want to create. The name should be unique and descriptive of the package you are creating. This field cannot be left blank

Version

Specifies the version number of the new package that you want to create.

Publisher

Specifies the publisher of the package definition file that you want to use.

Language

Specifies the language of the new package you want to create. The language should be identified to ensure clients receive packages appropriate to their users.

Comment

Specifies comments to identify the new package you want to create.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.


Source File Page

Use the Source Files page in the Configuration Manager Distribute Software to Devices Wizard to specify how Microsoft System Center Configuration Manager 2007 should manage any source files for the package.

This page contains the elements described in the following table.

UI Element List

This package does not contain any source files

Specifies whether the package requires source files that its programs must run and that are not already on the mobile device.

Always obtain files from a source directory

Specifies that the package requires source files that its programs must run, and that you must indicate the location of those source files. Each time a distribution point is refreshed, Configuration Manager 2007 will obtain the package source files from the path specified in the Source directory box. Use this option if the source files are likely to remain at the specified path, such as a share on a server.

Create a compressed version of the source

Specifies that the package requires source files that its programs must run and that these source files will be stored in a compressed version on the site server. If this option is selected, this compressed version will be decompressed and copied to the distribution points instead of being copied directly from the original source folder when the distribution points are refreshed. Use this option if the source files might be removed from the specified path (for example, if the source files are on a CD).

If you select this option and then specify Update All Distribution Points in the Manage Distribution Points Wizard, a new version of the compressed copy is created from the specified source folder.

Note
The storage location of the source files must be NTFS format. FAT file format will not store files.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Package Definition Files
About Packages


Source Directory Page

Use the Source Directory page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify the source directory location for the package. This page has the same functionality whether you are using a compressed version of your source files or not. If the package will always obtain files from a specified source directory, access to that directory needs to be available for as long as the package exists. If the package will use a compressed version of the source files, access to the directory is necessary until Configuration Manager 2007 has finished storing the files.

This page contains the elements described in the following table.

UI Element List

Package

Specifies the name of the package being created.

Source directory location

Specifies the type of location for the source directory. Two options are available:

  • Network path (UNC Name)
  • Local drive on site server
Source directory

Specifies the network path to the package source files.

To specify the path to the source directory, either type the path or click Browse to navigate to the source directory location.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Package from a Package Definition File

Concepts

About Package Definition Files
About Packages


Source File Compression Page

Use the Source File Compression page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify the directory containing the source files to be compressed and stored for the package. Ensure that the directory remains accessible to the site server until it finishes storing the compressed version of the source files. This page contains the elements described in the following table.

UI Element List

Package

Specifies the name of the package being created.

Source directory location

Specifies the type of location for the source directory. Two options are available:

  • Network path (UNC Name)
  • Local drive on site server
Source directory

Specifies the network path or local directory path to the package source files. To specify the path to the source directory, either type the path or click Browse to navigate to the source directory location.

Note
The source directory of the source files must be NTFS format. FAT file format will not store files.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.


Program Identification Page

Use the Package Definitions page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to identify the new program.

This page contains the elements described in the following table.

UI Element List

Name

Specifies the name of the new program that you want to create. The name should be unique and descriptive of the program you are creating. This field cannot be left blank.

Command line

Specifies command line used to run the program. Type the command line to be run.

Comment

Specifies comments to identify the new program you want to create.

Download folder

Specifies the folder to which the program is downloaded.

Run command line in download folder

Specifies that the command line should be run in the download folder.

Run command line from this folder

Specifies that the command line should be run from a folder other than the download folder. Type the folder where the program command line should be run in the space provided.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.


Program Properties Page

Use the Program Properties page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify the device network connection type that must be present for the program to be run.

This page contains the elements described in the following table.

UI Element List

Download program

Specifies the network connection type that must be present for the program to be run:

  • Any time - The program for devices will be run regardless of connection type.
  • Over a fast network - The program for devices will be run over the air if there is a fast network.
  • Only when the device is docked - The program for devices will only be run when the mobile device is docked.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.


Advertise Program Page

Use the Advertise Program page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify whether or not to advertise a program from this package to mobile devices.

UI Element List

This page contains the elements described in the following table.

Do you want to advertise a program from this package?

Specifies whether you want to advertise a program from this package. Two options are available:

  • Yes - The program will be advertised for distribution to a collection of mobile devices. The wizard will help you create a new advertisement when you click Next
  • No - The package and program will be created but not advertised for distribution.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Programs

Other Resources

Software Distribution Overview


Distribution Points Page

Use the Distribution Points page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify where clients will access this package.

This page contains the elements described in the following table.

UI Element List

Distribution points

Specifies the mobile device management enabled distribution points from which the mobile device will be able to access the package. Multiple distribution points can be selected. If the package has previously been distributed, some of the displayed distribution points might already be selected. If you clear a selected distribution point, the package will be deleted from that distribution point.

The following columns are displayed for distribution points in the list:

  • Name: Specifies the name of the specific distribution point.
  • Site: Specifies the name of the site on which the distribution point resides.
  • Type: Specifies the type of site on which the distribution point resides.
Three buttons are available for selecting distribution points from the list:

  • Select All: Selects all distribution points displayed in the list.
  • Clear All: Clears all distribution points displayed in the list.
  • Select Group: Opens the Browse Distribution Point Groups dialog box, allowing you to select a distribution point group to which the package will be distributed.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Distribution Points

Other Resources

Software Distribution Overview
New Package Wizard
Package Name Properties


Select Program Page

Use the Select Program page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify which program to advertise to members of a collection.

This page contains the elements described in the following table.

UI Element List

Programs

Specifies the specific program to be advertised to a collection.

Note
Only one program may be selected at a time.

The following columns are displayed for distribution points in the list:

  • Name: Specifies the name of the specific program.
  • Description: Specifies any description available for the specific program.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections
About Programs

Other Resources

Software Distribution Overview


Current Advertisement Page

Use the Current Advertisement page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify whether current advertisements of this program are sufficient. If the advertisement is insufficient the wizard can help you create a new advertisement. This page contains the elements described in the following table.

UI Element List

Package

Specifies the name of the package being created.

Current advertisements for this program

Specifies the advertisements that are available for this program. Advertisement information includes:

  • Name
  • Collection
  • Available After
These advertisements are sufficient

Specifies that the advertisements currently available are sufficient for the program.

Create a new advertisement

Specifies that a new advertisement is needed for the program. The wizard will help you create a new advertisement when you click Next.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.


Advertisement Target Page

Use the Advertisement Target page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify the target collection to be reached by the advertisement.

This page contains the elements described in the following table.

UI Element List

Advertise this program to an existing collection

Specifies whether an existing collection should be used as the target for the new advertisement. If this option is selected, a collection must be selected. Click the Browse button to select an existing collection.

Create a new collection and advertise this program to it

Provides options to create a new collection to advertise the program. These options allow you to specify membership rules for the collection and a schedule for updating the collection's membership. This functionality is similar to that provided by the New Collection Wizard. For more information about that wizard, see New Collection Wizard.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections

Other Resources

Software Distribution Overview
New Collection Wizard


New Collection

Use the New Collection page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify the new collection to contain the target resources for this advertisement.

This page contains the elements described in the following table.

UI Element List

Name | Description
Name | Specifies the name of the new collection. The name should be unique among collections and descriptive.
Comment | Specifies the description of the collection. The description should give an overview of the collection and relevant information that helps identify it among other collections.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.


Collection Membership Rules

Use the Collection Membership Rules page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to create the rules for populating the new collection There must be at least one membership rule.

This page contains the elements described in the following table.

UI Element List

Membership rules

Specifies the membership rules of the collection by periodically running queries against the resource database or by directly including specific resources

  • New Direct Membership Rule icon: Click to open the Create Direct Membership Rule Wizard. Direct membership contains specific selected resources.
  • New Query Membership Rule icon: Click to open the Query Rule Property dialog box. Query rules specify query-based membership of collections.
  • Properties icon: Click to open the Membership Rule Properties dialog box to view or modify the current membership rule for the collection.
  • Delete icon: Click to delete the membership rule for the collection.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.


Advertisement Name Page

Use the Advertisement Name page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify a name and any additional comments for the advertisement.

This page contains the elements described in the following table.

UI Element List

Name

Specifies the name of the advertisement, up to 100 characters. This field is required.

Comment

Specifies optional text about the advertisement, such as a description. You can use up to 127 characters.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements

Other Resources

Software Distribution Overview
Advertisement Name Properties


Advertisement Subcollection Page

Use the Advertisement Subcollection page in the Configuration Manager 2007 Distribute Software to Devices Wizard to specify whether the advertisement should apply to subcollections of the primary collection. If the collection has links to other collections, you can advertise the program to members of those collections as well.

This page contains the elements described in the following table.

UI Element List

Advertise the program only to members of the specified collection

Specifies that the program will only be advertised to the selected collection and will not be advertised to subcollections or linked collections.

Advertise the program to members of subcollections as well

Specifies that the program will be advertised to members of the selected collection, associated subcollections, and linked collections.

The program will be advertised to these collections

Displays a list of all collections, subcollections, and linked collections to which the program will be advertised.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to View the Advertisements for a Collection

Concepts

About Advertisements
About Collections
About Subcollections

Other Resources

Software Distribution Overview


Advertisement Schedule Page

Use the Advertisement Schedule page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify when the program should be advertised.

This page contains the elements described in the following table.

UI Element List

Advertise the program after

Specifies the date and time when the program is advertised and available to run on mobile devices in their respective time zones. By default, the current date and time is specified. To select another date and time, click the adjacent arrows.

No. This advertisement never expires.

Specifies that the advertised program remains available for clients to access indefinitely.

Yes. This advertisement expires.

Specifies that the advertisement expires at a given date and time. If this option is selected, you must use the Expiration date and time fields to specify a date and time after which the program advertisement is no longer available to run on mobile devices in their respective time zones.

By default, the cutoff date and time is set at 6 months from the current date and time. To specify another date and time, click the adjacent arrows.

Download content from unprotected distribution point and run locally.

Specifies that if the advertised program is not available on a protected distribution point, the mobile device should download it from an unprotected distribution point and run it locally.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements
About Collections
About Distribution Points

Other Resources

Software Distribution Overview


Assign Program Page

Use the Assign Program page in the Microsoft System Center Configuration Manager 2007 Distribute Software to Devices Wizard to specify whether the program should be assigned for mobile devices. Assigning a program causes it to become mandatory. An assigned program will automatically run if it has not already been run on a mobile device.

This page contains the elements described in the following table.

UI Element List

No. Do not assign this program.

Specifies that the program will not be made mandatory for mobile devices. If this option is selected, all other fields on this page will be unavailable.

Yes. Assign this program.

Specifies that the program will be mandatory for mobile devices. If this option is selected, all other fields on this page will be available.

Recurrence pattern

Specifies whether the scheduled even occurs only once or on a specific interval.

  • None. The assigned program will run only once.
  • Interval. The assigned program will run on a specified interval
Recur every

Specifies the interval that the program runs. Specify the number of the frequency and interval of minutes, hours or days.

Rerun this advertisement when the program or advertisement details change

Specifies whether the advertisement is rerun if the program or advertisement details change.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

Note
If an assigned package distribution containing a .cab file is set to recur Windows Mobile Pocket PC 2003 users will be informed each time during .cab file installation.

See Also

Concepts

About Advertisements
Advertisement Schedule Page

Other Resources

Software Distribution Overview
How to Manage Advertisements


Download Updates Wizard

Use the Download Updates Wizard in Configuration Manager 2007 to download and copy the software updates to the deployment package folder on the distribution points configured for the package. It allows administrators to prepare, or provision, the distribution points with the software updates source files prior to deploying them.

Click the related link for detailed information about each wizard page in the Download Updates Wizard.

In This Section

Download Updates Wizard: Deployment Package Page

Specifies the package that will be used to host the software updates in the deployment.

Download Updates Wizard: Distribution Points Page

Specifies the distribution points used to host the software update files defined in the deployment.

Download Updates Wizard: Data Access Page

Specifies how users can access distribution points to retrieve the files contained in the deployment package.

Add Distribution Points Dialog Box

Specifies the distribution points that are available to be added to the deployment package.

Download Updates Wizard: Distribution Settings Page

Specify the sending priority and preferred sender for the deployment package when it is sent to child sites and the content settings for branch distribution points.

Download Updates Wizard: Download Location Page

Specifies whether the software updates in the deployment package should be downloaded from the Internet location specified in the vendor catalog or to use local copies of the software updates

Download Updates Wizard: Language Selection Page

Specifies the languages that are downloaded for the software updates in the deployment.

Wizard - Summary Page

Provides a summary of the packaging properties.

Wizard - Progress Page

Provides the progress for the packaging creation.

Wizard - Completing the Wizard Page

Provides a summary of the created packaging properties or a list of issues that occurred during packaging creation.

See Also

Concepts

About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Download Updates Wizard: Deployment Package Page

Use the Deployment Package page in the Configuration Manager 2007 Download Updates Wizard to select an existing deployment package or create a new one for the deployment. The software updates in the deployment are downloaded and copied to the deployment package folder on the distribution points configured for the package.

This page contains the elements as described in the following table.

UI Element List

Name Description

Select deployment package

Specifies that an existing package is used for the software updates in the deployment. Click Browse to open the Select a Deployment Package dialog box, which lists only packages created to host software updates. When a deployment package is highlighted, the package name, package description, and package ID are listed in the bottom pane. Select the deployment package to be used for the software updates in the deployment and click OK.

Note
Deployment packages are displayed only from the current site. Packages created at a parent site are not available for selection.

Create a new deployment package

Specifies that a new package is created for the software updates in the deployment. The following properties are configured as part of the deployment package.

  • Deployment package name: Specifies the name of the deployment package. The package should have a unique name, describe the package content, and is limited to no more than 50 characters.
  • Deployment package description: Specifies the description of the deployment package. The package description should describe the package contents in detail and is limited to no more than 127 characters.
  • Deployment package source: Specifies the location of the software update source files. When the deployment is generated, the source files are compressed and copied to the distribution points that are associated with the deployment package. The source location must be entered as a network path (for example, \\server\sharename\path), or the Browse button can be used to find the network location. The shared folder for the deployment package source files must be manually created before proceeding to the next page.
    Note
    The deployment package source location must not be used by another deployment or software distribution package.

    Important
    The SMS Provider computer account and the user who will actually download the software updates to the download location both require write access to the download location. Restrict access to the download location to reduce the risk of attackers tampering with the software updates source files in the download location.

  • Enable binary differential replication: Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred. For more information, see About Binary Differential Replication. This setting can be modified for existing packages in the properties for the package.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Binary Differential Replication
About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Download Updates Wizard: Distribution Points Page

Use the Distribution Points page in the Configuration Manager 2007 Download Updates Wizard to select the distribution points that are used to host the software update files defined in the new deployment package. After a package is created, distribution points are managed from the Distribution Points node under the associated package.

Important
When no distribution points are selected, the deployment is created and the software update file is downloaded to the source folder, but the update file will not be available to client computers until at least one distribution point is added to the package.

Note
The Distribution Points page only displays when creating new deployment packages. Additional distribution points can be configured in the properties for the deployment package.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Browse | Opens the Add Distribution Points dialog box to select the distribution points for the software update deployment package. In the Distribution Points pane, each site in the hierarchy displays and can be expanded to show the distribution points that are available. Check the box to the left of the distribution point server names to select the distribution points for the package. Click OK to exit the dialog box. To add all site distribution points for a site, click the box to the left of the site code for the site.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Manage Distribution Points in Deployment Packages

Concepts

About Standard and Branch Distribution Points
About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Download Updates Wizard: Data Access Page

Use the Data Access page in the Configuration Manager 2007 Download Updates Wizard to specify how users can access distribution points to retrieve the files contained in the deployment package.

Note
The Data Access page only displays when creating new deployment packages.

This page contains the elements as described in the following table.

UI Element List

Name Description

Access distribution folder through common ConfigMgr package share

Specifies that users access the package through the shared folder for the package (SMSPKGx$, where x is the drive letter) on distribution points. By default, this option is selected.

Share distribution folder

Specifies that users access the package through a custom shared folder and path for the package. The folder should be created and shared prior to selecting this option.

  • Share name: Specifies a unique shared folder name and path to be created for the package source files on distribution points. The value can either be a shared folder, which must be unique among all packages, or a shared folder and path, where the path must be unique among all packages. See the following table for examples.

Shared folder name | Resulting path on distribution points
Office | \\DPservername\Office
Packages\OfficeXP | \\DPservername\Packages\OfficeXP
Packages\Spreadsheets\Excel | \\DPservername\Packages\Spreadsheets\Excel
Note
Do not enter a full Universal Naming Convention (UNC) path in Share name, such as \\server\share. Instead, enter the shared folder name as shown in the table above.

If the shared folder name is entered as a shared folder only, as in the first example, all files and subdirectories within that shared folder are deleted and re-created each time the package is updated or refreshed. If the shared folder name is entered as a shared folder name and path, only the bottom path (OfficeXP and Excel in the above examples) is deleted and re-created each time the package is updated or refreshed.

To control which drive either the default or custom package folder is created on, assign the distribution point role to a shared folder on the server instead of a server computer. For distribution points that use a server shared folder, if a shared folder name is entered for a package, it is treated as a path beneath the distribution point shared folder (\\MyServer\MyShare):

Package shared folder name | Resulting path on distribution points
Office | \\MyServer\MyShare\Office
Packages\OfficeXP | \\MyServer\MyShare\Packages\OfficeXP
Packages\Spreadsheets\Excel | \\MyServer\MyShare\Packages\Spreadsheets\Excel

Name Definition

Disconnect users from distribution points

Specifies whether to notify users and disconnect them from distribution points when ConfigMgr updates package data. By default, this setting is not enabled. When enabled, the following options are available:

  • Number of retries before disconnecting users: Specifies the number of times that ConfigMgr tries to update the package source files before starting to disconnect users from distribution points. The default value is 2 and you can specify 0 to 99, inclusive.
  • User grace period (in minutes): Specifies the number of minutes ConfigMgr should wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Software Update Deployment Packages
About Distribution Points
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Download Updates Wizard: Distribution Settings Page

Use the Distribution Settings page in the Configuration Manager 2007 Download Updates Wizard to specify the sending priority and preferred sender for the deployment package when it is sent to child sites, and to specify the content settings for branch distribution points.

Note
The Distribution Settings page only displays when creating new deployment packages.

This page contains the elements as described in the following table.

UI Element List

Name Description

Sending priority

Specifies the sending priority for the deployment package. The sending priority is used for the deployment package when it is sent to distribution points at child sites. Packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. Unless there is a backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority.

Preferred sender

Specifies the sender that is used to send this deployment package to distribution points at other sites. By default, this setting uses the <No Preference> value, which allows any available sender to be used. All senders that are configured for the site can be used.

Note
To use Courier Sender to distribute deployment packages, you must select it as the preferred sender.

Branch distribution points automatically download this package when they receive the advertisement

Specifies that the content is downloaded to branch distribution points when packages are assigned to branch distribution points. By default, this setting is selected and the following additional setting is available:

  • Make this package available on protected distribution points when requested by clients inside the protected boundaries: Specifies that when a client is within the boundaries of protected distribution points and the client requests the package content, the package is downloaded to the protected distribution points.

Administrator manually copies this package to branch distribution points

Specifies that the content must be manually managed and is not automatically downloaded to the branch distribution points.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Standard and Branch Distribution Points
About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Download Updates Wizard: Download Location Page

Use the Download Location page in the Configuration Manager 2007 Download Updates Wizard to configure whether the software updates in the deployment should be downloaded from the Internet location specified by the vendor and stored in the update definition or to download software updates from the local network.

This page contains the elements as described in the following table.

UI Element List

Name Description

Download software updates from the Internet

Specifies that the software updates are downloaded from the location on the Internet that is defined in the software update definition. This setting is enabled by default.

Note
Internet connectivity is required from the site server when using this setting.

Download software updates from a location on the local network

Specifies that the software updates are downloaded from a local directory or shared folder. Use this setting when the site server does not have Internet access. The software updates can be downloaded from any computer that has Internet access and stored in a location on the local network that is accessible from the site server. For more information, see How to Manually Download Software Updates.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Manually Download Software Updates

Concepts

About Standard and Branch Distribution Points
About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties


Download Updates Wizard: Language Selection Page

Use the Language Selection page in the Configuration Manager 2007 Download Updates Wizard to configure the languages that are downloaded for the selected software updates. The software updates are downloaded only if they are available in the selected languages. Software updates that are not language specific are always downloaded.

This page contains the elements as described in the following table.

Name | Description
Update File | Specifies the languages for which software update files are downloaded. By default, the languages configured in the software update point properties are selected. Selecting additional languages does not add them to the software update point language settings. When only a language is selected on this page that is not supported by the software update, the download will fail for the software update.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Standard and Branch Distribution Points
About Software Update Deployment Packages
About Software Update Deployments
About the Download Updates Wizard
About the Software Update Point
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties
Software Update Point Component Properties


Export Object Wizard

Use the Microsoft System Center Configuration Manager 2007 Export Object Wizard to export the following object types:

  • Reports
  • Queries
  • Collections
Note
Collections, packages, and site settings can also be transferred or exported using the Transfer Site Settings Wizard.

  • To export the objects, you must have Read rights for each object you want to export.
  • The objects you can export vary depending on where you started the wizard. For example, if you right-click Collections and then click Export Objects, you can select any collection to export, but if you right-click a collection name, you can select only that object to export.
  • The Managed Object Format (MOF) file created by the wizard is a text file. You must specify a path and a .mof extension for the file name.
Important
Save the text file in a secure location to prevent information disclosure and tampering with the file.

The text file can be imported to a site using the Import Object Wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another
How to Use the Export and Import Object Wizards


Import Computer for Out of Band Management Wizard

Topic last updated—May 2008

The Import Computer for Out of Band Management Wizard in Configuration Manager 2007 SP1 imports new computer information into the Configuration Manager database. This allows administrators to provision computers for AMT when those computers do not have the Configuration Manager 2007 SP1 client installed, including computers that currently have no operating system installed.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The wizard is also used to migrate AMT-based computers from another AMT-based solution to Configuration Manager. For more information about migrating, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager.

Information for one or more computers can be imported by using a file that contains the appropriate computer information, or the information for a single computer can be imported by specifying the appropriate information in the wizard.

Important
If there is an existing computer record in the Configuration Manager 2007 database for the computer that is imported with the wizard, the new computer information will update the existing computer information so that it can be provisioned out of band.

For more information about provisioning computers for AMT, see How to Provision Computers for AMT.

To run the Import Computer for Out of Band Management Wizard, you must have the security right Import computer entry, which is granted at the Site object class level. Additionally, you must have the security right of Read for the Collections class and the security right of Modify for the collection selected in the wizard that will contain the imported computers. For more information about configuring security rights in the Configuration Manager console, see Overview of Configuration Manager Object Security and WMI.

To run the wizard, right-click the Collections node, and then click Import Out of Band Computers.

In This Section

Import Computer for Out of Band Management Wizard - Select Source Page

Specifies whether the computer information is imported by using a file or by specifying the information in the wizard.

Import Computer for Out of Band Management Wizard - Choose Mapping Page

Specifies the file that will be used for importing the information for one or more computers. This page displays only if the Import computers using a file option is selected on the Select Source page of the wizard.

Import Computer for Out of Band Management Wizard - Single Computer Page

Specifies information about the computer that will be imported. This page displays only if the Import single computer option is selected on the Select Source page of the wizard.

Import Computer for Out of Band Management Wizard - Data Preview Page

Displays the information about the computers that will be imported.

Import Computer for Out of Band Management Wizard - Choose Target Collection Page

Specifies whether the new computers will be added to an existing collection.

Wizard - Summary Page

Provides a summary of the computer information that will be imported.

Wizard - Progress Page

Provides the progress while the computer information is being imported.

Wizard - Completing the Wizard Page

Provides a summary of the computer information that was imported or a list of issues that occurred during the import process.

See Also

Tasks

How to Configure AMT Provisioning
How to Migrate AMT-Based Computers to Configuration Manager After Running an Export Utility
How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management


Import Computer for Out of Band Management Wizard - Select Source Page

Topic last updated—March 2008

Use the Select Source page in the Configuration Manager 2007 SP1 Import Computer for Out of Band Management Wizard to specify whether to import one or more computers to provision for AMT by using a file or a single computer by specifying the information in the wizard.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Important
Do not proceed with the wizard unless you have the correct SMBIOS GUID for each computer that you will import. The SMBIOS GUID is also known as the UUID, and this value is required for out of band provisioning. Your computer manufacturer or supplier should be able to provide this value if you cannot locate it.

This page contains the elements described in the following table.

Name | Description
Import computers using a file | Specifies that one or more computers will be imported by using a file that contains information about the computers. By default, this setting is selected.
Import single computer | Specifies that a single computer will be imported using the information specified on the Single Computer page in the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Import Computer for Out of Band Management Wizard
Out of Band Management in Configuration Manager 2007 SP1


Import Computer for Out of Band Management Wizard - Choose Mapping Page

Topic Last Updated—August 2008

Use the Choose Mapping page in the Configuration Manager 2007 SP1 Import Computer for Out of Band Management Wizard to specify the file that contains the information for one or more computers that will be imported for AMT provisioning.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page displays only when the Import computers using a file option is selected on the Select Source page of the wizard.

This page contains the elements described in the following table.

Name Description

Import file

Specifies the file that contains the information about the computers that will be imported. Type the path and file name, or click Browse to find the import file.

The import file must be created in the comma-separated values (CSV) format. Use the following format when entering the computer information:

<short_name>,<FQDN>,<SMBIOS>,<optional_MAC_address>,<optional_MEBx_password>,<optional_remote_admin_password>.

Example: NEWCOMP1,NEWCOMP1.contoso.com,55555555-5555-5555-5555-555555555555,05:06:07:08:09:0A

If you are specifying the MEBx password or the remote admin password, they cannot be specified in clear text but must be encoded with Base 64. For more information about how to encode text by using Base 64, see the knowledge base article about sample Base 64 encoding and decoding (http://go.microsoft.com/fwlink/?LinkId=122491).

The information for each computer should be created in a new row in the CSV file. If the computer information is not entered using this format, the computer import will fail.

Note
You must specify the SMBIOS GUID, which is required for out of band provisioning. The SMBIOS GUID is also known as the UUID, and your manufacturer should be able to provide this value if you cannot locate it.

Specify the MEBx password if you are importing an AMT-based computer that has not been provisioned but the MEBx password has been changed locally in the BIOS extensions.

Specify both the MEBx password and the AMT remote admin password if the computer has been already been provisioned by an AMT management solution other than Configuration Manager. These values might be automatically obtained for you if the other management solution provides a migration export utility. For more information about this scenario, see Decide How to Migrate from an AMT-Based Management Solution to Out of Band Management in Configuration Manager. However, if you are manually creating an import file that contains passwords, the passwords must be encoded with Base 64. For more information about how to encode text by using Base 64, see the knowledge base article about sample Base 64 encoding and decoding (http://go.microsoft.com/fwlink/?LinkId=122491.

Important
When using a CSV file that contains passwords, store the file securely, and ensure that you can access it securely when you run the Import Computer for out of Band Management Wizard.

This file has column headings

Specifies whether the CSV file has column headings. If this setting is selected, the first line of the file will be ignored. By default, this setting is not selected.

File preview

Displays the following information from the imported file:

  • Source Column: Specifies the column number for the data item in the import file.
  • Sample Data: Specifies the data from one row of the import file with an assigned column number for each data item where a Configuration Manager property is assigned.
  • Assign as: Specifies the Configuration Manager property that is assigned to the data item for the source column in the import file.

Select the column for data that needs to be assigned to a different Configuration Manager property, and then select the property from the Assign as drop-down list.

Column

Specifies the column number for the data item in the import file.

Assign as

Specifies the Configuration Manager property that the selected data will be assigned. The following properties are available:

  • Name: Specifies the name of the computer. The name property must be assigned to one of the columns.
  • SMBIOS GUID: Specifies the SMBIOS GUID for the computer. Either the MAC address or the SMBIOS GUID must be assigned to a column.
  • MAC Address: Specifies the MAC address for the computer. Either the MAC address or the SMBIOS GUID must be assigned to a column.
  • Ignore: Specifies that the column should be ignored and not assigned a Configuration Manager property.
  • Variable: Specifies that the column should use a custom variable property. When Variable is selected, the Variable Name setting must also be entered.

Variable name

Specifies the name of the variable if Variable is selected in the Assign as drop-down list. Variable names must be at least two characters and contain no spaces or special characters.

Previous

Navigates to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management
About the AMT Remote Admin Account
About the MEBx Account

Other Resources

Import Computer for Out of Band Management Wizard
Out of Band Management in Configuration Manager 2007 SP1


Import Computer for Out of Band Management Wizard - Single Computer Page

Topic last updated—March 2008

Use the Single Computer page in the Configuration Manager 2007 SP1 Import Computer for Out of Band Management Wizard to specify the information for a computer that will be imported for AMT provisioning.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page displays only when the Import single computer option is selected on the Select Source page of the wizard.

This page contains the elements described in the following table.

Name Description

Computer name

Specifies the name for the computer that will be imported.

This is a required setting.

FQDN

Specifies the fully qualified name (FQDN) of the computer to import.

This is a required setting.

MAC address

Specifies the MAC address for the computer that will be imported.

The MAC address is optional.

SMBIOS GUID

Specifies the SMBIOS GUID for the computer that will be imported.

The SMBIOS GUID must be entered.

Note
The SMBIOS GUID is also known as the UUID and is required for out of band provisioning. Your manufacturer should be able to provide this value if you cannot locate it.

MEBx password

Specifies the password for the MEBx Account.

The MEBx password is optional and is required if you are importing an AMT-based computer that has not been provisioned but the MEBx password has been changed locally in the BIOS extensions, or if you are importing an AMT-based computer that has been provisioned by another AMT management solution.

Confirm password

Specifies the MEBx password for confirmation.

Remote admin password

Specifies the password for the AMT Remote Admin Account.

The AMT remote admin password is optional and is required together with the MEBx password if you are importing an AMT-based computer that has been provisioned by another AMT management solution.

Confirm password

Specifies the password for AMT Remote Admin Account for confirmation.

Previous

Navigates to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management
About the AMT Remote Admin Account
About the MEBx Account

Other Resources

Import Computer for Out of Band Management Wizard
Out of Band Management in Configuration Manager 2007 SP1


Import Computer for Out of Band Management Wizard - Data Preview Page

Topic last updated—January 2008

Use the Data Preview page in the Configuration Manager 2007 SP1 Import Computer for Out of Band Management Wizard to verify the computer information to be imported.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page contains the elements described in the following table.

Name | Description
Data preview | Displays the information for each computer that is being imported. Each column lists a Configuration Manager property with the associated computer data listed on each row.
Previous | Navigates to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Import Computer for Out of Band Management Wizard
Out of Band Management in Configuration Manager 2007 SP1


Import Computer for Out of Band Management Wizard - Choose Target Collection Page

Topic last updated—May 2008

Use the Choose Target Collection page in the Configuration Manager 2007 SP1 Import Computer for Out of Band Management Wizard to specify whether the imported computers are added to an existing collection.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page contains the elements described in the following table.

Name Description

Add new computers to the All Systems collection only

Specifies that the imported computer will not be statically added to the All Systems collection but will be added dynamically by adding a discovery record for the computer.

By default, this setting is selected.

Add computers to the following collection

Specifies that the imported computer is added to the selected collection.

Enter the collection name, or click Browse to choose the collection from the Browse Collection dialog box.

The imported computers will be statically added to the specified collection by creating a direct membership rule.

Previous

Navigates to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Provision Computers for AMT

Concepts

About AMT Provisioning for Out of Band Management

Other Resources

Import Computer for Out of Band Management Wizard
Out of Band Management in Configuration Manager 2007 SP1


Import Computer Information Wizard

Topic last updated—March 2008

The Import Computer Information Wizard in Configuration Manager 2007 imports new computer information into the Configuration Manager database. This allows administrators to deploy an operating system to a new computer that is not managed by Configuration Manager, including computers that currently have no operating system installed. Information for one or more computers can be imported by using a file that contains the appropriate computer information, or the information for a single computer can be imported by specifying the appropriate information in the wizard.

Important
If the computer to be imported already exists in the Configuration Manager 2007 database, the new computer information will overwrite the existing computer information.

To run the Import Computer Information Wizard, you must have the security right of Read\Collection for the collection selected in the wizard that will contain the imported computers.

In This Section

Import Computer Information Wizard - Select Source Page

Specifies whether the computer information is imported by using a file or by specifying the information in the wizard.

Import Computer Information Wizard - Choose Mapping Page

Specifies the file that will be used for importing the information for one or more computers. This page displays only if the Import computers using a file option is selected on the Select Source page of the wizard.

Import Computer Information Wizard - Single Computer Page

Specifies information about the computer that will be imported. This page displays only if the Import single computer option is selected on the Select Source page of the wizard.

Import Computer Information Wizard - Data Preview Page

Displays the information about the computers that will be imported.

Import Computer Information Wizard - Choose Target Collection Page

Specifies whether the new computers will be added to an existing collection.

Wizard - Summary Page

Provides a summary of the computer information that will be imported.

Wizard - Progress Page

Provides the progress while the computer information is being imported.

Wizard - Completing the Wizard Page

Provides a summary of the computer information that was imported or a list of issues that occurred during the import process.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database


Import Computer Information Wizard - Select Source Page

Use the Select Source page in the Configuration Manager 2007 Import Computer Information Wizard to specify whether to import one or more computers using a file or a single computer by specifying the information in the wizard.

Note
If you import a computer that already exists in the Configuration Manager 2007 database with the same GUID, the previous computer's record will be overwritten with the new computer information.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Import computers using a file | Specifies that one or more computers will be imported by using a file that contains information about the computers. By default, this setting is selected.
Import single computer | Specifies that a single computer will be imported using the information specified on the Single Computer page in the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database

Other Resources

Import Computer Information Wizard


Import Computer Information Wizard - Choose Mapping Page

Use the Choose Mapping page in the Configuration Manager 2007 Import Computer Information Wizard to specify the file that contains the information for one or more computers that will be imported. This page displays only when the Import computers using a file option is selected on the Select Source page of the wizard.

This page contains the elements as described in the following table.

UI Element List

Name Description

Import File

Specifies the file that contains the information about the computers that will be imported. Type the path and filename or click Browse to find the import file.

The import file must be created in the comma separated values (CSV) format. Use the following format when entering the computer information: NEWCOMP1,55555555-5555-5555-5555-555555555555,05:06:07:08:09:0A. The information for each computer should be created a new row in the CSV file. If the computer information is not entered using this format the computer import will fail.

This file has column headings

Specifies whether the CSV file has column headings. If this setting is selected, the first line of the file will be ignored. By default, this setting is not selected.

File preview

Displays the following information from the imported file:

  • Source Column: Specifies the column number for the data item in the import file.
  • Sample Data: Specifies the data from one row of the import file with an assigned column number for each data item where a Configuration Manager property is assigned.
  • Assign as: Specifies the Configuration Manager property that is assigned to the data item for the source column in the import file.

Select the column for data that needs to be assigned to a different Configuration Manager property, and then select the property from the Assign as drop-down list.

Column

Specifies the column number for the data item in the import file.

Assign as

Specifies the Configuration Manager property that the selected data will be assigned. The following properties are available:

  • Name: Specifies the name of the computer. The name property must be assigned to one of the columns.
  • SMBIOS GUID: Specifies the SMBIOS GUID for the computer. Either the MAC address or SMBIOS GUID must be assigned to a column.
  • MAC Address: Specifies the MAC address for the computer. Either the MAC address or SMBIOS GUID must be assigned to a column.
  • Reference Computer: Specifies that a computer association will be created with the reference computer. This is an optional property.
  • Ignore: Specifies that the column should be ignored and not assigned a Configuration Manager property.
  • Variable: Specifies that the column use a custom variable property. When Variable is selected, the Variable Name setting must also be entered.

Variable Name

Specifies the name of the variable if Variable is selected in the Assign as drop-down list. Variable names must be at least 2 characters and contain no spaces or special characters.

Previous

Navigates to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database

Other Resources

Import Computer Information Wizard


Import Computer Information Wizard - Single Computer Page

Use the Single Computer page in the Configuration Manager 2007 Import Computer Information Wizard to specify the information for a computer that will be imported. This page displays only when the Import single computer option is selected on the Select Source page of the wizard.

This page contains the elements as described in the following table.

UI Element List

Name Description

Computer Name

Specifies the name for the computer that will be imported. This is a required setting.

MAC address

Specifies the MAC address for the computer that will be imported. Either the MAC address or SMBIOS GUID must be entered.

SMBIOS GUID

Specifies the SMBIOS GUID for the computer that will be imported. Either the MAC address or SMBIOS GUID must be entered.

Reference Computer

Specifies that a computer association will be created. This is an optional setting. Enter the reference computer name or click Search to find the computer from the Search Computer dialog box. This is an optional setting.

Important
The Computer Name specified and the Reference Computer name specified must not be the same.

Previous

Navigates to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database

Other Resources

Import Computer Information Wizard


Import Computer Information Wizard - Data Preview Page

Use the Data Preview page in the Configuration Manager 2007 Import Computer Information Wizard to verify that the computer information is that will be imported is correct.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Data preview | Displays the information for each computer that is being imported. Each column lists a Configuration Manager property with the associated computer data listed on each row.
Previous | Navigates to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database

Other Resources

Import Computer Information Wizard


Import Computer Information Wizard - Choose Target Collection Page

Use the Choose Target Collection page in the Configuration Manager 2007 Import Computer Information Wizard to specify whether the imported computers are added to an existing collection.

Important
For a computer to receive an operating system deployment, it must be a member of a collection.

This page contains the elements as described in the following table.

UI Element List

Name | Description
Do not add computers to a collection | Specifies that the imported computers are not added to an existing collection. By default, this setting is selected.
Add computers to an existing collection | Specifies that the imported computers are added to the selected collection. Enter the collection name or click Browse to choose the collection from the Browse Collection dialog box. The imported computers will be statically added to the specified collection.
Previous | Navigates to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Add a New Computer to the Configuration Manager Database

Other Resources

Import Computer Information Wizard


Import Configuration Data Wizard

Use the Configuration Manager 2007 Import Configuration Data Wizard to import configuration items and configuration baselines from cabinet (.cab) files. These files can contain information about configuration data from one of the following sources:

  • Best practices from a Microsoft® System Center Configuration Manager 2007 Configuration Pack (http://go.microsoft.com/fwlink/?LinkId=71837)
  • Configuration data that has been authored externally and packaged into a cabinet (.cab) file
  • Configuration data exported from Configuration Manager 2007

The files you choose to import will be validated for a digital signature and for the correct content format. You will be prompted to Run or Don't Run if the file does not have a valid digital signature or the publisher is untrusted. The wizard will validate the format of the files to import and reject files if they contain configuration data in an invalid format.

Once successfully imported, configuration items will be displayed in the Configuration Items node and can then be viewed, edited, and included in configuration baselines. Configuration baselines that are successfully imported will be displayed in the Configuration Baselines node and can then be viewed, edited, and included in other configuration baselines.

Note
You might need to run the Refresh action before new configuration baselines are displayed in the Configuration Baselines node.

The Choose Files page contains the elements described in the following table:

UI Element List

Action | Description
Files containing configuration items or configuration baselines:: | Displays the Name, Date Modified, and Size of selected files to import. To add new files to import, click Add. To remove selected files displayed, click them and then click Delete.
Add | Displays the Open dialog box in which you can select the configuration data file to import.
Delete | Deletes the selected configuration files, without prompting, so that they will not be imported.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.


Import New Driver Wizard

Use the Import New Driver Wizard to import Windows device drivers into the driver catalog.

In This Section

Click the related link below for more information about each page of the wizard.

Import New Driver Wizard - Locate Driver

Specifies the device driver or directory of device drivers you want to import.

Import New Driver Wizard - Driver Details

Specifies a name and optional description for the device driver.

Import New Driver Wizard - Platforms Applicability

Confirms the platforms on which this device driver will be installed.

Import New Driver Wizard - Add Drivers to Packages

Allows you to add device drivers to packages and assign packages to distribution points.

Import New Driver Wizard - Add Drivers to Boot Images

Allows you to assign device drivers to boot images.


Import New Driver Wizard - Locate Driver

The Locate Driver page in the Configuration Manager 2007 Import Driver Wizard allows you to specify whether you want to import a specific driver or all drivers contained in the specified directory. You should not copy more then one driver into the same directory or all device drivers will be installed.

This page contains the elements as described in the following table.

Name Description

Source

Specifies the source location for a device driver.

Source Folder

Specifies the source directory for a group of device drivers.

Import all drivers in the following network path (UNC)

Allows you to import all of the device drivers from a specific folder. Enter the UNC path to the folder or click Browse to find the folder on the network.

Note
To import a subset of device drivers from a large directory, you can create a new subdirectory, share the new subdirectory, and copy the desired driver into the newly created directory. Each driver should be in an individual subdirectory.

Import a specific driver by specifying the network path (UNC) to its .inf or txtsetup.oem file.

Allows you to specify the UNC path to an .inf file or a txtsetup.oem file. Enter the UNC path to the folder or click Browse to specify a folder on the network.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

Import New Driver Wizard


Import New Driver Wizard - Driver Details

Use the Driver Details page in the Configuration Manager 2007 Import New Driver Wizard to specify a descriptive name and an optional description for an individual driver or select the files to be imported from the specified folder. You can also enable the device drivers on this page so that they are available to computers for installation and assign the drivers to one or more categories. The Driver Details page displays different settings depending on what setting is selected on the Locate Driver page of the wizard.

When the Import all drivers in the following network path (UNC) setting is selected on the Locate Driver page, the file name for all driver files located in the specified folder are displayed on this page, as well as an Import setting that specifies whether the file should be imported. Each driver file is selected by default, but a subset of the drivers in the folder can be imported by deselecting the unwanted driver files.

When the Import a specific driver by specifying the network path (UNC) to its .inf or txtsetup.oem file setting is selected on the Locate Drivers page, the name and description for the driver is displayed, as well as the provider, class, version number, version date, digital signer, and supported models information. The name and description fields can be modified.

This page contains elements described in the following table.

Name Description

Enable this driver and allow computers to install it

Specifies that this device driver will be made available to all computers. If this check box is not selected, the device driver will not be available for computers to install. Typically, you should enable drivers unless you are not ready to deploy them, or if the device driver is causing a problem and you want to suspend deployment.

Important
For computers to use and install a driver, it must be enabled. To enable a driver that is currently set to disabled in the driver catalog, right-click the driver, click Properties, and then click Enable these drivers and allow computers to install them.

Categories

Allows you to assign the device drivers to categories. Categories are useful for filtering purposes by keeping specific device drivers together in a logical fashion for use in different deployment scenarios.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

Import New Driver Wizard


Import New Driver Wizard - Platforms Applicability

The Platforms Applicability tab allows you to specify which platforms the new device driver can be installed on. The initial set of applicable platforms that the device drivers are associated with is calculated when the device driver is initially imported.

This program can be run on any platform

Allows the device drivers to be available to all client platforms. Selecting this option will make the device driver to all computer platforms.

This program can only run on specified client platforms

Allows you to specify which client platforms this device driver is available to. You can override the device driver defaults by selecting this option.

See Also

Concepts

Import New Driver Wizard


Import New Driver Wizard - Add Drivers to Packages

The Add Drivers to Packages page allows you assign device drivers to an existing package or create a new driver package. Device drivers that have been added to packages should be saved to an available distribution point for computers to install them.

This page contains the elements described in the following table.

Name | Description
Select All | Allows you to add the device drivers to all existing packages. If you select this option, the device driver will be added to all existing driver packages.
Clear All | Allows you to remove the device driver from all existing driver packages.
New Package | Creates a new driver package.
Update distribution points when finished | Updates associated distribution points after you have added a device driver to a driver package. Device drivers must be present on a distribution point for computers to install them. The associated device driver Name and Package ID information also displays.

See Also

Concepts

Import New Driver Wizard


Import New Driver Wizard - Add Drivers to Boot Images

You can add device drivers to boot images on the Add Driver to Boot Images page. Only mass storage and network device drivers should be added to boot images for operating system deployment scenarios.

Note
The Windows PE environment is Windows Vista-based, so the device drivers that are added should support Windows Vista.

The image Name and associated Package ID is also displayed. You can add device drivers to the images by checking the appropriate selection.

Name | Description
Update distribution points when finished | Select this option to update all associated distribution points immediately. Only the new device driver information will be replicated to the distribution point as part of the update.
Select All | Allows you to add the device drivers to all boot images.
Clear All | Allows you to remove the device driver from all boot images.

See Also

Concepts

Import New Driver Wizard


Import Object Wizard

Topic last updated -- November 2007

Use the Microsoft System Center Configuration Manager 2007 Import Object Wizard to import the following object types:

  • Reports
  • Queries
  • Collections

The wizard always imports the objects to the right node, regardless where you ran the wizard from. For example, if you run the wizard from the Reports node but are importing a .mof file that contains collections objects, you create collections objects under the Collections node and not the Reports node.

Usually you import a .mof file that was previously exported using the Export Object Wizard, but you could also write your own .mof, or modify a .mof that was previously exported.

Note
Collections, packages, and site settings can also be transferred or imported using the Transfer Site Settings Wizard.

To import the objects, you must have Create rights for the object classes you want to import.

You should verify that the object names you are importing are unique. For reports, if the object name already exists, the imported object overwrites the existing object. For queries and collections, if the object name already exists in the site, you create a new object with the same name but with a different object ID, which could be confusing. If you have duplicate names, change the object name in the object properties.

See Also

Tasks

How to Use the Export and Import Object Wizards
How to Copy Site Settings from One Site to Another


License Import Wizard

Topic last updated—January 2008

The License Import Wizard is used to import Microsoft and non-Microsoft licensing information into the Asset Intelligence catalog.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

License Import Wizard: Welcome Page

License Import Wizard: Import Page

Wizard - Summary Page

Wizard - Progress Page

Wizard - Completing the Wizard Page

See Also

Other Resources

Wizard Pages


License Import Wizard: Welcome Page

Topic last updated—January 2008

The License Import Wizard is used to import Microsoft and non-Microsoft software licensing information into the Configuration Manager site database from an XML-formatted licensing information file stored on a standard network shared folder.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The shared folder used to store the licensing information file should be properly secured to prevent unauthorized access to licensing information.

This page contains the elements described in the following table.

Name | Description
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

License Import Wizard


License Import Wizard: Import Page

Topic last updated—January 2008

The Import page of the License Import Wizard is used to import Microsoft and non-Microsoft software licensing information into the Configuration Manager site database from an XML-formatted licensing information file stored on a standard network shared folder.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The shared folder should be properly secured to prevent unauthorized access to the licensing information file.

This page contains the elements described in the following table.

Name | Description
Path | Specifies the path to XML-formatted license information file.
Browse | Specifies the path to a valid MVLS, XML-formatted, software license file to import into the Configuration Manager site database.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

License Import Wizard


Manage Distribution Points Wizard

Use the Manage Distribution Points Wizard in Configuration Manager 2007 to guide you through the steps necessary to copy, update, refresh, or delete package data on distribution points so that programs within the current package can be advertised to clients.

Click the related link below for detailed information about each wizard page in the Manage Distribution Points Wizard.

In This Section

Select Task Page

Specifies the distribution point task that you want to complete using the wizard. Options available include copying, updating, refreshing, or deleting package data on distribution points.

Copy Package Page

Specifies the distribution point to which you want to copy the package data.

Refresh Package Page

Specifies the distribution point on which you want to refresh the package data.

Remove Package Page

Specifies the distribution point from which you want to remove the package data.

Completing the Wizard Page

Specifies that you have provided the information needed by the wizard, and confirms that you want to complete the distribution point task you've chosen.

See Also

Tasks

How to Remove a Package from a Distribution Point
How to Send a Package to Distribution Points
How to Update Package Data on Distribution Points

Concepts

About Distribution Points


Select Task Page

Use the Select Task page in the Configuration Manager 2007 Manage Distribution Points Wizard to specify the distribution point task that you want to complete using the wizard.

This page contains the elements described in the following table.

UI Element List

Name | Description
Package | Specifies the name of the package that you want to manage on the distribution point.
Copy the package to new distribution points | Specifies that the package will be copied or uploaded to one or more distribution points. Selecting this option opens the Copy Package page of the wizard.
Refresh the package on selected distribution points | Specifies that the package will be refreshed on one or more distribution points. Selecting this option opens the Refresh Package page of the wizard.
Update all distribution points with a new package source version | Specifies that the package source files should be updated on all distribution points. Selecting this option automatically updates the distribution points.
Remove the package from selected distribution points | Specifies that the package will be removed from one or more distribution points. Selecting this option opens the Remove Package page of the wizard.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Remove a Package from a Distribution Point
How to Send a Package to Distribution Points
How to Update Package Data on Distribution Points

Concepts

About Distribution Points


Copy Package Page

Use the Copy Package page in the Configuration Manager 2007 Manage Distribution Points Wizard to specify the distribution point or points to which you want to copy the package data.

Note
The listing of distribution points on this page is case sensitive. As a result, if a distribution point has been renamed or re-created, it may not appear on this list if the case does not match the original distribution point entry.

This page contains the elements described in the following table.

UI Element List

Name Description

Distribution points

Specifies the distribution points on which the package is not currently located. Multiple distribution points can be selected.

The following columns are displayed for distribution points in the list:

  • Name: Specifies the name of the specific distribution point.
  • Site: Specifies the name of the site on which the distribution point resides.
  • Type: Specifies the type of site on which the distribution point resides.

Three buttons are available for selecting distribution points from the list:

  • Select All: Selects all distribution points displayed in the list.
  • Clear All: Clears all distribution points displayed in the list.
  • Select Group: Opens the Browse Distribution Point Groups dialog box, allowing you to select a distribution point group to which the package will be copied.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Send a Package to Distribution Points

Concepts

About Distribution Points


Refresh Package Page

Use the Refresh Package page in the Configuration Manager 2007 Manage Distribution Points Wizard to specify the distribution point or points on which you want to refresh the package data.

This page contains the elements described in the following table.

UI Element List

Name Description

Distribution points

Specifies the distribution points on which the package is currently located and which should be refreshed. Multiple distribution points can be selected.

The following columns are displayed for distribution points in the list:

  • Name: Specifies the name of the specific distribution point.
  • Site: Specifies the name of the site on which the distribution point resides.
  • Type: Specifies the type of site on which the distribution point resides.

Three buttons are available for selecting distribution points from the list:

  • Select All: Selects all distribution points displayed in the list.
  • Clear All: Clears all distribution points displayed in the list.
  • Select Group: Opens the Browse Distribution Point Groups dialog box, allowing you to select a distribution point group to refresh.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Distribution Points


Remove Package Page

Use the Remove Package page in the Configuration Manager 2007 Manage Distribution Points Wizard to specify the distribution point or points from which you want to remove the package data.

Note
The listing of distribution points on this page is case sensitive. As a result, if a distribution point has been renamed or re-created, it may not appear on this list if the case does not match the original distribution point entry.

This page contains the elements described in the following table.

UI Element List

Name Description

Distribution points

Specifies the distribution points on which the package is currently located and from which the package data will be removed. Multiple distribution points can be selected.

The following columns are displayed for distribution points in the list:

  • Name: Specifies the name of the specific distribution point.
  • Site: Specifies the name of the site on which the distribution point resides.
  • Type: Specifies the type of site on which the distribution point resides.

Three buttons are available for selecting distribution points from the list:

  • Select All: Selects all distribution points displayed in the list.
  • Clear All: Clears all distribution points displayed in the list.
  • Select Group: Opens the Browse Distribution Point Groups dialog box, allowing you to select a distribution point group from which the package will be removed.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Remove a Package from a Distribution Point

Concepts

About Distribution Points


Manage Distribution Points (Operating System Deployment)

The Manage Distribution Points Wizard helps you copy a package to a new distribution point, remove a package from an existing distribution point, or update the contents of an existing package on a distribution point.

See Also

Concepts

Manage Distribution Points (Operating System Deployment) - Select Destination Distribution Point
Manage Distribution Points (Operating System Deployment) - Package


Manage Distribution Points (Operating System Deployment) - Select Destination Distribution Point

The Select Destination Distribution Point page allows you to specify the settings that you want for distribution points.

Name | Description
Copy the Package to new distribution points | Copies a package to a new distribution point.
Refresh the package on selected distribution points | Refreshes a package on a distribution point. When a package is refreshed, only the changed files will be copied to the distribution point.
Update all distribution points with a new package source version | Replaces an existing package on all distribution points with a new version of the package.
Remove the package from selected distribution points | Removes a package from a distribution point. Specify which distribution points should not contain the package. When a package is not available on a distribution point, computers will not be able to install it.

See Also

Concepts

Manage Distribution Points (Operating System Deployment)


Manage Distribution Points (Operating System Deployment) - Package

Use the Package page to specify the package that should be copied to the distribution point.

This page contains the elements described in the following table.

Name | Description
Distribution Points | Specifies the distribution points that should receive the package by selecting the check box next to the distribution point. Packages must be available on distribution points for computers to install them.
Select All | Copies the package to all available distribution points.
Clear all | Clears all selected available distribution points. You must select at least one distribution point to complete the wizard.
Select Group | Specifies that the package be copied to a group of distribution points.

See Also

Concepts

Manage Distribution Points (Operating System Deployment)


Manage Distribution Points (Operating System Deployment) - Completion

The Completion page of the Manage Distribution Points (Operating System Deployment) Wizard displays the selected distribution points that the Configuration Manager 2007 Package will be copied to.

Name | Description
Finish | Click to copy the package to the selected distribution points.
Previous | Select this to add the package to additional distribution points.

See Also

Concepts

Manage Distribution Points (Operating System Deployment)


New Advertisement Wizard

Use the New Advertisement Wizard in Configuration Manager 2007 to create an advertisement that causes a program to run on a specific client or collection of clients.

Click the related link below for detailed information about each wizard page in the New Advertisement Wizard.

In This Section

General Page

Specifies general information about the advertisement, including the name, package, program, and collection associated with it.

Schedule Page

Specifies when the program will be advertised to the target collection, as well as whether or not it will be mandatory.

Distribution Points

Specifies how to run the content of the program from the distribution point, depending on the type of boundary within which the client computer is connected.

Interaction Page

Specifies settings that affect how users are notified about and interact with the advertised program.

Properties - Security Tab

Specifies class and instance security rights granted to users of the advertised program.

Wizard - Summary Page

Provides a summary of the new advertisement properties.

Wizard - Progress Page

Provides the progress for the new advertisement creation.

Wizard - Completing the Wizard Page

Provides a summary of the created advertisement properties or a list of issues that occurred during the advertisement creation.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements

Other Resources

Advertisements Property Pages


General Page

Use the General page in the Configuration Manager 2007 New Advertisement Wizard to specify general information such as the associated package, program, and collection for the advertisement being created.

This page contains the elements described in the following table.

Name Description

Name

Specifies the name of the advertisement, which can be up to 100 characters long. This field is required.

Comment

Specifies optional text about the advertisement, such as a description. You can use up to 127 characters.

Package

Specifies the package that contains the program that will be advertised to clients. This field is required.

Click the Browse button to open the Select a Package dialog box. Select the desired package, and click OK to choose the package.

Note
In Configuration Manager 2007 R2, if the package specified is a virtual application package, you do not need to specify an associated program and the Program line will not be visible.

Program

Specifies the program (within the specified package) to advertise to clients. This field is required.

Collection

Specifies the existing collection that will receive the advertisement. This field is required.

Click the Browse button to open the Browse Collection dialog box, which enables you to search for the collection you want.

Include members of subcollections

Specifies that the program will also be advertised to clients and users in the specified collection's subcollections.

Note
By default, the Include members of subcollections check box is selected. To avoid sending advertisements to subcollections, this option must be cleared.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements

Other Resources

Advertisement Name Properties


Schedule Page

Use the Schedule page in the Configuration Manager 2007 New Advertisement Wizard to specify when and how a program is made available to client computers.

This page contains the elements described in the following table.

UI Element List

Name Description

Advertisement start time

Specifies the date and time when the program is advertised and available to run on clients in their respective time zones. By default, the current date and time is specified. To select another date and time, click the adjacent arrows.

If an advertisement start time is earlier than a mandatory assignment time, the client will download the package at the advertisement start time.

To specify that the advertisement start date and time are based on UTC rather than local time, select the UTC check box.

Note
If you select this option, the program will be available on all clients simultaneously.

Advertisement will expire

Specifies whether the advertisement has a date and time after which the program advertisement is no longer available to run on clients in their respective time zones. By default, this check box is cleared and the advertisement will never expire. If selected, the cutoff date and time is set by default at 6 months from the current date and time. To specify another date and time, click the adjacent arrows.

To specify that the advertisement start date and time are based on UTC rather than local time, select the UTC check box.

Note
If you select this option, the advertisement will expire on all clients simultaneously.

Mandatory assignments

Specifies any advertisements that are set as mandatory assignments.

Note
A maximum of 15 mandatory assignments (including re-run advertisements) are allowed at one time for each program.

The following options are available for managing mandatory advertisements:

  • New icon: Click to open the Assignment Schedule dialog box and create a new assignment schedule.
  • Properties icon: Click to open the Assignment Schedule dialog box to view or modify the current schedule settings.
  • Delete icon: Click to delete the selected assignment.

Enable Wake On LAN

Specifies whether to have the advertised program wake up the client computer at the time indicated in the schedule to run the advertised program.

Ignore maintenance windows when running program

Specifies whether to have the advertised program ignore preset system maintenance windows while the program is running.

Allow system restart outside maintenance windows

Specifies whether to allow a restart of the client system if the restart would occur outside a preset maintenance window.

Note
This setting only applies if the program has the ConfigMgr restarts computer option set as an after-running action.

Priority

Specifies the advertisement's priority when sent to child sites. Available options are Low, Medium (default), and High priorities.

Program rerun behavior

Specifies whether the advertised program will be rerun on the client computer if it has previously been run before the scheduled mandatory time.

Note
These rerun settings will apply to the program even if it was previously run by a different advertisement. You cannot specify program rerun behavior for Configuration Manager 2007 R2 virtual application packages. Virtual application packages will always be configured to Always rerun program.

This setting is only configurable for assigned (mandatory) advertisements.

The following options are available:

  • Never rerun advertised program: The program will not be rerun on the client if the program has previously been run on the client, even if the program originally failed or the program files have been changed.
  • Always rerun program: The program will always be rerun on the client when the advertisement is scheduled, even if the program has already been successfully run. This is particularly useful when using recurring advertisements in which the program is routinely updated, as with some virus detection software.
    Note
    Although this option is set by default if the advertisement is not assigned, this setting only has an impact if the advertisement is assigned. This is because users can run an optional program at any time and Configuration Manager will always allow the program to rerun.

  • Rerun if failed previous attempt: The program will be rerun when the advertisement is scheduled only if it failed on the previous run attempt. This is particularly useful when assigning a mandatory advertisement, so that it will rerun according to the assignment schedule if it has not successfully done so. This option is set by default if the advertisement is assigned (mandatory).
  • Rerun if succeeded on previous attempt: The program will be rerun only if it has previously run successfully on the client. This is useful when using recurring advertisements in which the program is routinely updated, and in which each update requires the previous update to have been successfully installed.

Note
When an advertised program is launched from the Run Advertised Program dialog box on a client, the program rerun property is not evaluated before running the program. This means a mandatory program with "Never rerun advertised program" program rerun property can still be rerun as many times as the end user wants to from that dialog box. It's therefore highly recommended that prior to sending out a program, administrators carefully evaluate and test the advertised program rerun behavior and understand the impact if the end user chooses to rerun the program multiple times.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements

Other Resources

Advertisement Name Properties


Distribution Points

Use the Distribution Points page in the Configuration Manager 2007 New Advertisement Wizard to specify how to deliver and run the content for the new advertisement, depending on the type of boundary to which the client computer is connected.

Important
Selecting the Download content from distribution point and run locally option is strongly recommended for greatest security. When this option is selected, the package is hashed so that Configuration Manager 2007 can ensure package integrity. When the Run program from distribution point option is selected, the package hash is not verified prior to running the specified program and package integrity cannot be ensured, because it is possible for users with administrative rights to alter or tamper with package contents.

This page contains the elements described in the following table.

Name Description

When a client is connected within a fast (LAN) network boundary

Specifies the options available when the client is within a fast network boundary. The following options are available:

Applies only to Configuration Manager 2007 R2.

  • Stream virtual application(s) from distribution points. Specifies that the virtual application package will run from the distribution point across the network. You should select this option when the destination computer is connected by a fast, reliable network connection.
  • Run program from distribution point. Specifies whether an advertised program is run directly from a distribution point when the client is connected within a fast (LAN) network boundary.
  • Download content from distribution point and run locally. Specifies whether an advertised program is downloaded to the client computer before Configuration Manager 2007 attempts to run the program when connected within a fast (LAN) network boundary.
    If the distribution point supports Background Intelligent Transfer Service (BITS), you can use this setting to ensure the safe download of the advertised program. In the event of interruption, BITS resumes the download the next time the computer connects to the network so that this will not cause a problem. If the distribution point does not support BITS and the computer disconnects from the network, the download fails.

When a client is connected within a slow or unreliable network boundary

Specifies the options available when the client is within a fast network boundary. The following options are available:

  • Do not run program. Specifies whether a program should not be run when a client is connected within a slow or unreliable network boundary.
  • Download content from distribution point and run locally. Specifies whether an advertised program is downloaded to the client computer before Configuration Manager 2007 attempts to run the program when connected within a slow or unreliable network boundary.
    If the distribution point supports BITS, you can use this setting to ensure the safe download of the advertised program. In the event of interruption, BITS resumes the download the next time the computer connects to the network so that this will not cause a problem. If the distribution point does not support BITS and the computer disconnects from the network, the download fails.
  • Run program from distribution point. This option is unavailable when a client is connected within a slow or unreliable network boundary.

Allow clients to fallback to unprotected distribution points when the content is not available on the protected distribution point

Specifies whether Configuration Manager 2007 will permit a client to use an unprotected distribution point if content is not immediately available on its protected distribution point, or if it forces a client to use the protected local distribution point if it is within the boundaries for that point. This option is selected by default.

If this check box is selected, a client will use distribution points based on the following criteria:

  • If a protected distribution point with the content provisioned exists, the client will not use unprotected distribution points.
  • If a protected distribution with the content provisioned does not exist, the client will use unprotected distribution points.

If the check box is cleared, the client will not use unprotected distribution points.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Distribution Points

Other Resources

Advertisement Name Properties


Interaction Page

Use the Interaction page in the Configuration Manager 2007 New Advertisement Wizard to specify how users are notified about and interact with the advertised program.

This page contains the elements described in the following table.

UI Element List

Name | Description
Allow users to run the program independently of assignments | Specifies whether or not users may run the advertised program independently, regardless of its assignment status. This option is cleared by default.
Display reminders according to the client agent reminder intervals | Specifies whether advertisement reminders are broadcast to the client according to the default intervals set on the client agent.
Use custom countdown notification length (minutes) | Specifies whether client notifications are broadcast based on a custom notification length in minutes. If selected, the user should specify a custom length in minutes.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Create an Advertisement

Concepts

About Advertisements

Other Resources

Advertisement Name Properties


New Custom Label Wizard: General Page

Topic last updated—January 2008

The New Custom Label Wizard is used to create custom labels for software titles.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page contains the elements described in the following table.

Name | Description
Label name | Specifies the name of the new custom label.
Description | Specifies a description for the new custom label.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Other Resources

Wizard Pages


New Software Category Wizard: General Page

Topic last updated—January 2008

The New Software Category Wizard is used to create new software categories that can be used to group software families and inventoried software titles.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page contains the elements described in the following table.

Name Description

Category name

Specifies the new software category name.

Validation state

Specifies the validation state of the new software category name.

Note
Custom software category names are always user-defined.

Description

Specifies additional software category description information.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Other Resources

Wizard Pages


New Software Family Wizard: General Page

Topic last updated—January 2008

The New Software Family Wizard is used to create new software family names that can be used to group inventoried software titles.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page contains the elements described in the following table.

Name Description

Family name

Specifies the new software family name.

Validation state

Specifies the validation state of the new software family name.

Note
Custom software family names are always user-defined.

Description

Specifies additional software family description information.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Other Resources

Wizard Pages


New Dashboard Wizard

Use the New Dashboard Wizard in Configuration Manager 2007 to create a new dashboard, which displays multiple reports on a single page. You can create dashboards to monitor information about related hardware or software or to group the reports you use most frequently. The user creating a dashboard must have Read permission for the Reports security object class to add reports to the dashboard.

The New Dashboard Wizard contains the pages and associated elements as described in the following table.

Name Description

General

Configure the following settings for the dashboard:

  • Name: Specifies the name for the dashboard. This setting is required and must be unique.
  • Comment: Specifies the description for the dashboard. This setting is optional.
  • Limit cell height: Specifies whether to limit the height of the dashboard display. When this element is selected, type the maximum height, in pixels, in the Height text box. The default value is 250.

Reports

Configure the following settings for the dashboard:

  • Dashboard dimensions: Specifies the dimensions for the dashboard in rows and columns. By default, the dashboard is made of two rows and two columns. When the dimensions are modified, click Set to change the number of positions listed in the Dashboard reports section.
  • Dashboard reports: Specifies the reports that will be displayed at the given position in the dashboard. The positions are identified by the row and column combination.
    • To add a report to a position, double-click anywhere on the row for the position or select a position. Click the Select Report icon, select a report from the Select Report dialog box, and then click OK. When there are no reports defined for a position, the Report column displays -Blank-. For more information, see How to Add Reports to a Dashboard.
    • To remove a report from a position, add the -Blank- report to the position. To remove groups of reports from a dashboard, the dimensions can be modified. For more information, see How to Remove Reports from a Dashboard.
    • Use the Move Up and Move Down icons to change the dashboard position for a highlighted report.

Progress

Provides information about the progress for creating the report.

Confirmation

Provides a confirmation that the report was created successfully. When the wizard fails to create a report, an error will display on this page.

See Also

Tasks

How to Add Reports to a Dashboard

Concepts

About Configuration Manager Dashboards
How to Remove Reports from a Dashboard

Other Resources

Dashboard Name Properties


New Distribution Points Wizard

Use the New Distribution Points Wizard in Configuration Manager 2007 to select the distribution points to which you want to add the package.

The available list includes only the distribution points that do not currently support the package.

See Also

Tasks

How to Send a Package to Distribution Points

Concepts

About Distribution Points


New Distribution Points Wizard - Operating System Deployment

The New Distribution Points Wizard helps you copy a new or existing package to a new distribution point. Before computers can access and install a package they must be available on an accessible distribution point.

Click Next to go to the Copy Packages page where you can specify which distribution points should receive the package.

In This Section

New Distribution Points Wizard - Copy Package


New Distribution Points Wizard - Copy Package

Specify the distribution points that should receive the package on the Copy Package page. The available distribution points are displayed in the Distribution points window. Select the distribution points that should receive the package by selecting the check-box next to the appropriate selection.

UI Element List

Select All

Select this option to copy the package to all available distribution points. Each available distribution point displayed will receive a copy of the package. You can deselect individual distribution points so they do not receive a copy of the package by deselecting the check-box next to the distribution point that should not receive the package.

Clear All

Select this option to deselect all available distribution points. No distribution points displayed will receive a copy of the package.

Select Group

Select this option to specify a group of distribution points that should receive the package. Each distribution point in the selected group will receive a copy of the package.


New Hardware Requirements Wizard: General Page

Topic last updated—January 2008

The New Hardware Requirements Wizard is used to specify the hardware requirements for a specified software title.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This page contains the elements described in the following table.

Note
All fields are required.

Name | Description
Software title | Specifies the new software title name.
Validation state | Describes the current validation state of the hardware requirement. By default, all new custom hardware requirements are user-defined.
Minimum processor speed required (MHz) | Specifies the minimum processor speed required for the software title in megahertz.
Minimum RAM required (KB) | Specifies the minimum amount of RAM required for the software title in kilobytes.
Minimum free disk space required (KB) | Specifies the minimum amount of free disk space required for the software title in kilobytes.
Minimum disk size required (KB) | Specifies the minimum hard disk size required for the software title in kilobytes.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Other Resources

Wizard Pages


New Package Wizard

Use the New Package Wizard in Configuration Manager 2007 to create a package manually in its entirety.

You can also create a package using a package definition file as a template. For information about how to do this, see How to Create a Package from a Package Definition File. To find out more about package definition files, see About Package Definition Files.

Click the related link below for detailed information about each wizard page in the New Package Wizard.

In This Section

General Page

Specifies general information, including name, version, and any comments about the specific package selected.

Data Source Page

Specifies data source information, including whether the package contains source files, where those files are located, and whether associated distribution points are updated on a schedule.

Data Access Page

Specifies where Configuration Manager 2007 stores this package on distribution points and how it will be accessed.

Distribution Settings Page

Specifies branch distribution point content settings, as well as the sender and priority to use when sending this package to child sites.

Reporting Page

Specifies how Management Information Format (MIF) files generated by clients apply to this package.

Security Page

Specifies the security rights that individual users have on both this class and the specific package.

Wizard - Summary Page

Provides a summary of the new package properties.

Wizard - Progress Page

Provides the progress for new package creation.

Wizard - Completing the Wizard Page

Provides a summary of the created package properties or a list of issues that occurred during the package creation.

See Also

Tasks

How to Create a Package
How to Create a Package from a Package Definition File

Concepts

About Packages

Other Resources

Software Distribution Overview


General Page

Use the General page in the Configuration Manager 2007 New Package Wizard to specify general information about the package being created, including name, version, and any desired comments.

This page contains the elements described in the following table.

UI Element List

Name | Description
Name | The name of the package, up to 50 characters. This field is required.
Version | The version number of the package, up to 32 characters.
Manufacturer | The software manufacturer of the package, up to 32 characters.
Language | The language version of the software package, up to 32 characters.
Comment | Optional text about the package, such as a description. You can use up to 127 characters.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Data Source Page

Use the Data Source page in the Configuration Manager 2007 New Package Wizard to specify data source information, including whether the package contains source files, where those files are located, and whether associated distribution points are updated on a schedule.

This page contains the elements described in the following table.

UI Element List

Name Description

This package contains source files

Indicates the package has source files not already on the client computer that its programs must run. By default, this check box is cleared and Configuration Manager 2007 does not use distribution points for the package. When this check box is selected, distribution points are used.

Source directory

Specifies the network path to the package source files. This field is unavailable unless the This package contains source files check box is selected.

To specify the path to the source directory, click Set to open the Set Source Directory dialog box.

Note
Do not specify path/filenames for package source files that exceed 254 characters, paths of this length cannot be replicated.

Two options are available when designating a source directory:

  • Use a compressed copy of the source directory: Configuration Manager 2007 will create a compressed version of the source files on the site server. If this option is selected, this compressed version will be decompressed and copied to the distribution points instead of being copied directly from the original source folder when the distribution points are refreshed. Use this option if the source files might be removed from the specified path (for example, if the source files are on a CD).
    If you select this option and then specify Update All Distribution Points in the Manage Distribution Points Wizard, a new version of the compressed copy is created from the specified source folder.
  • Always obtain files from the source directory: Each time a distribution point is refreshed, Configuration Manager 2007 will obtain the package source files from the path specified in the Source directory box. Use this option if the source files are likely to remain at the specified path, such as a share on a server.

Update distribution points on a schedule

Specifies the source files for this package will be regularly updated on distribution points. When this option is selected, the default schedule is set to the current date with an interval of 1 day. By default, this check box is cleared.

To set a schedule for distribution point updates, click Schedule to open the Custom Schedule dialog box. This button is available only when Update distribution points on a schedule is selected.

Persist content in client cache

Specifies whether content should be retained in the cache on the client computer indefinitely even if it has already been run. Although this option can be useful with some recurring packages, such as virus software or Windows Installer-based software that requires a local source copy be available for applying updates, it will reduce the available cache space. Specifying this option might cause a large package to fail at a later point if there is insufficient space available in the cache.

Enable binary differential replication

Specifies whether binary delta comparison should be used on changed package source files. Selecting the check box enables this behavior and allows Distribution Manager to transfer only parts of the file that have changed instead of the entire file. This behavior can result in large bandwidth savings in transferring the changes for large files, compared with the traditional method where the entire file is transferred.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Data Access Page

Use the Data Access page in the Configuration Manager 2007 New Package Wizard to specify where Configuration Manager 2007 stores this package on distribution points and how it will be accessed.

This page contains the elements described in the following table.

UI Element List

Name Description

Access distribution folder through common ConfigMgr package share

Specifies whether users will access the package through the common Configuration Manager 2007 package share (SMSPKGx$, where x is the drive letter) on distribution points. This option is selected by default.

Share distribution folder

Specifies whether the package will be created on distribution points with an administrator-specified share and path name. Selecting this option requires a share name.

Share name

Specifies a share name or path to be created for the package source files on distribution points. This share name must be unique, even across package types, as duplicate share names may cause data corruption.

Two options are available:

  • The value can be a share, in which case the name must be unique across all packages. If this option is used, all files and subdirectories within that share will be deleted and re-created each time the package is updated or refreshed.
  • The value can be a share and a path, in the format sharename\path, in which case the path must be unique across all packages. If this option is used, only the final directory in the path will be deleted and re-created each time the package is updated or refreshed.
    Note
    Do not enter a full Universal Naming Convention (UNC) path in Share name, such as \\server\share. Instead, enter a share and path name in the format sharename\path.

To control which drive a package folder is created on, you can assign the distribution point role to a server share rather than a server computer. For distribution points on server shares, if a share name is entered for a package, it is treated as a path beneath the distribution point share (\\MyServer\MyShare). For more information, see Site systems Configuration Overview.

Disconnect users from distribution points

Specifies that users will be disconnected from distribution points when Configuration Manager 2007 updates package data. This check box is cleared by default.

If this option is selected, the following settings are available:

  • Number of retries before disconnecting users: Specifies the number of times that Configuration Manager 2007 tries to update the package source files before disconnecting users connected to the distribution point. The default setting is 2; you can specify 0 to 99, inclusive.
  • User grace period (minutes): Specifies the number of minutes Configuration Manager 2007 will wait after notifying users before disconnecting them from distribution points. The default setting is 5 minutes; you can specify 0 to 59 minutes, inclusive.
    Note
    If the program within the package has the Run Program from Distribution Point option set, clients running either the Windows Vista or Windows Server® 2008 operating systems will not receive user notification. For more information about verifying whether this option has been set, see Advertisement Name Properties: Distribution Points Tab.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Reference

Advertisement Name Properties: Distribution Points Tab

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Distribution Settings Page

Use the Distribution Settings page in the Configuration Manager 2007 New Package Wizard to specify the sender and priority to use when sending this package to another site, as well as to specify your branch distribution point content settings.

This page contains the elements described in the following table.

Name Description

Sending priority

Specifies the priority of this package when sent to another site. Three priorities are available:

  • High
  • Medium (default setting)
  • Low

Packages are sent in priority order, and packages with identical priorities are sent in order of creation.

Preferred sender

Specifies the sender to be used to send this package to other sites. You can specify any sender configured for the site or No Preference (the default setting), which uses any available sender.

Note
To distribute package content using physical media, you must select Courier Sender as the preferred sender.

Automatically download content when packages are assigned to branch distribution points

Specifies that the package will be automatically downloaded to all branch distribution points that are selected as distribution points for the package. This is the default option. The other option available is to have the administrator manually copy the package to the branch distribution point.

When this option is selected, the following additional option is available:

  • Make this package available on protected distribution points when requested by clients inside the protected boundaries: Specifies whether the package is available for download to a branch distribution point that has not already been specifically designated as a distribution point when requested by a client located within the protected boundaries of that branch distribution point. If this option is selected, a client request will cause the local branch distribution point to download the package. After the content is successfully provisioned on the branch distribution point, a subsequent client request will be able to download and run this content.
    Note
    Download content on demand is available only for protected branch distribution points. If a branch distribution point is configured but not protected, the management point will not trigger the package download.

Administrator manually copies this package to branch distribution points

Specifies that the administrator must manually copy this package to the branch distribution points. It will not be automatically downloaded.

Allow this package to be transferred via multicast

Applies only to Configuration Manager 2007 R2.

Specifies that this operating system deployment package can be transferred using multicast. Multicast is a feature that conserves network bandwidth by simultaneously sending data to multiple clients rather than copying and sending the data to each client over a separate connection.

Note
Multicast is available only for operating system deployment packages.

Encrypt packages when transferred via multicast

Applies only to Configuration Manager 2007 R2.

Specifies that the package should be encrypted when transferred to clients using multicast.

Only transfer this package via multicast

Applies only to Configuration Manager 2007 R2.

Specifies that the package should be transferred only by using multicast.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

New Package Wizard
How to Manage Packages
Package Name Properties


Reporting Page

Use the Reporting page in the Configuration Manager 2007 New Package Wizard to specify how Management Information Format (MIF) files generated by clients apply to this package.

This page contains the elements described in the following table.

UI Element List

Name Description

Use package properties for status MIF matching

Configuration Manager 2007 will use the properties on the General tab for status MIF file matching. This option is selected by default.

Use these fields for status MIF matching

Configuration Manager 2007 will use the values specified on this page for status MIF file matching.

If this option is selected, the following fields are available:

  • MIF file name: The name of the MIF file that contains the package status, up to 50 characters.
  • Name: The name of the package, up to 50 characters.
  • Version: The version number of the package, up to 32 characters.
  • Publisher: The software publisher of the package, up to 32 characters.
Note
Without these fields, Configuration Manager 2007 may pick up the wrong MIF file, which will then incorrectly report status back to the site.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Package Name Properties


Security Page

Use the Security page in the Configuration Manager 2007 New Package Wizard to specify the security rights individual users have on both this class and the specific package.

This page contains the elements described in the following table.

UI Element List

Name Description

Class security rights

Specifies the user accounts and security permissions set for the package object class. This applies to all packages within the Software Distribution node.

It is important to note that any changes made here will be applied to the entire package object class.

The following options are available for managing package class security rights:

  • New icon: Click to open the Object Class Security Rights Properties dialog box and grant security rights to a user account for the package object class.
  • Properties icon: Click to open the Object Class Security Rights Properties dialog box to view or modify the current security permissions granted for the package object class.
  • Delete icon: Click to delete all security rights for a specific user account for the package object class.
    Note
    Deleting a user's object class security rights will also delete those rights on all instances of this class.

The following columns are displayed for users who currently have security rights for this class:

  • Name: Specifies each user name that currently has security rights for the package object class.
  • Permissions: Specifies the permissions that each user has been granted for the package object class.

Instance security rights

Specifies the user accounts and security permissions set for this specific package instance.

The following options are available for managing package instance security rights:

  • New icon: Click to open the Instance Security Rights Properties dialog box and grant security rights to a user account for this package instance.
  • Properties icon: Click to open the Instance Security Rights Properties dialog box to view or modify the current security permissions granted for this package instance.
  • Delete icon: Click to delete all security rights for a specific user account for the <package name> instance.

The following columns are displayed for users who currently have security rights for this instance:

  • Name: Specifies each user name that currently has security rights for this package instance.
  • Permissions: Specifies the permissions that each user has been granted for this package instance.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

Package Name Properties
How to Manage Packages


New Policies Wizard

The New Policies Wizard in Configuration Manager 2007 lets you create ConfigMgr NAP policies that you want to be included in Network Access Protection (NAP) evaluation, and specify when they will be become active on Configuration Manager 2007 clients that are able to support Network Access Protection.

Policies created in this Configuration Manager 2007 site apply to all computers in the All Systems collection and will flow down to child sites that are also enabled for Network Access Protection.

Once you have completed the wizard, the settings you define can then be modified in two places:

  • In the policy properties under the Policies node.
  • In the software update properties under the Software Updates node.

Software updates can also be included in NAP evaluation with the option Enable NAP evaluation in the Deploy Software Updates Wizard, and they can be included as a software update property under the Software Updates node.

Note
If the Configuration Manager NAP policies will result in computers having restricted network access if they do not have the selected software updates, ensure that those software updates are available on a sufficient number of distribution points serving as remediation servers so that remediation will occur in a timely fashion.

Click the following related link for detailed information about each wizard page in the New Policies Wizard.

UI Element List

Select Software Updates for Network Access Protection

Displays any software updates that have been downloaded and exist in a software update package. Select one or more software updates you want to include in NAP evaluation.

Set NAP Evaluation

Specifies when you want the selected software updates to become active on NAP-capable clients.

Important
Do not specify a time before the software update packages that contain the selected software updates have completed replication to distribution points.

The two options are as follows:

  • As soon as possible: Select this option if you want the selected software updates to be included in NAP evaluation as soon as possible.
  • Date and time: Select a date and time on the client when the NAP policy becomes effective.
Summary Page

Displays the Wizard - Summary Page.

Progress Page

Displays the Wizard - Progress Page.

Completing the Wizard Page

Displays the Wizard - Completing the Wizard Page.

See Also

Tasks

How to Delete a Configuration Manager NAP Policy to Stop NAP Evaluation in Network Access Protection
How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection
How to View Configuration Manager NAP Policies for Network Access Protection

Concepts

About the NAP Effective Date in Network Access Protection
About the NAP Client Status in Network Access Protection
About NAP Evaluation in Network Access Protection
About Network Access Protection in Configuration Manager Hierarchies
About Network Access Protection Remediation
About Configuration Manager NAP Policies in Network Access Protection


New Program Wizard

Use the New Program Wizard in Configuration Manager 2007 to create a new program for inclusion within a package.

Click the related link below for detailed information about each wizard page in the New Program Wizard.

In This Section

General Page

Specifies general information, including name, version, and any comments about the specific program selected.

Requirements Page

Specifies the disk space and platform requirements that must be met for the program to run on the client computer.

Environment Page

Specifies any administrative conditions that must be met for the program to run on the client computer.

Advanced Page

Specifies any additional criteria that must be met for the program to run on the client computer.

Windows Installer Page

Specifies Windows Installer product information to enable source management of the program.

MOM Page

Specifies whether to run a Microsoft Operations Manager (MOM) alert when the program is run or whether to disable the alert process while the program runs.

Wizard - Summary Page

Provides a summary of the new program properties.

Wizard - Progress Page

Provides the progress for the new program creation.

Wizard - Completing the Wizard Page

Provides a summary of the created program properties or a list of issues that occurred during program creation.

See Also

Tasks

How to Create a Program

Concepts

About Programs

Other Resources

How to Manage Programs


General Page

Use the General page in the Microsoft System Center Configuration Manager 2007 New Program Wizard to specify general information about the specific program selected, including name, command line, comments, and behavior after running.

Note
The use of software deployed by Configuration Manager may be subject to license terms. All applicable license terms should be reviewed prior to deploying software.

This page contains the elements described in the following table.

UI Element List

Name Description

Name

Specifies the name of the program, up to 50 characters. This field is required and must be unique within a package.

Note
After you create a program, you cannot modify its name.

On client computers, this name appears in Run Advertised Programs and Add or Remove Programs in Control Panel.

Comment

Specifies optional text about the program, such as a description. You can use up to 127 characters.

On client computers, this text is displayed in Run Advertised Programs in Control Panel.

Command line

Specifies the command line for the program, up to 255 bytes.

For example:

setup.exe /a

or

Msiexec /I my_app.msi /l*v /qn

This field is required.

To navigate to the program file, click Browse. By default, the package source folder appears, if it exists and is accessible. If it does not exist or is not accessible, the root folder of the current computer appears.

File name extensions are strongly recommended. If the file name does not have an extension specified, Configuration Manager 2007 tries .com, .exe, and .bat as possible extensions. If the file is not an executable, Configuration Manager 2007 will try to apply a local association if possible.

When the program is run on a client, Configuration Manager 2007 first searches for the command-line file name within the package, followed by the local Microsoft Windows folder and the local %path%. If the file cannot be found, the program fails.

Start in

Specifies the executable folder for the program, up to 127 characters. This folder can be an absolute path on the client or a path relative to the distribution point folder that contains the package. This field is optional.

For example:

c:\office_setup

or

install_files

Run

Specifies the mode in which the program will run on the client computer. The following modes are available:

  • Normal: The program runs in the normal mode based on system and program defaults. This is the default mode.
  • Minimized: The program runs minimized on the client computer.
  • Maximized: The program runs maximized on the client computer.
  • Hidden: The program is hidden while running on the client computer.

After running

Specifies the action that occurs after this program has completed successfully:

  • No action required: No restart or log off is required. This is the default value.
  • SMS restarts computer: The computer is restarted automatically by Configuration Manager 2007.
  • Program restarts computer: The program requires a restart and performs this action automatically.
  • SMS logs user off: The current user is logged off the computer after the program is completed. Use this option if the program requires that the user log off and then log on again before it can run.
Important
Both the Configuration Manager restarts computer and Configuration Manager logs user off actions are done forcefully after providing the user with a grace period. Applications that are running on clients when this occurs do not have an opportunity to save their states or data.

Category

Specifies the category under which the program will be displayed on the client computer.

Specifying a category for a program will help users find specific programs of interest. Advertised programs appear under the What's New category for up to 14 days or until they are run.

Note
By including ConfigMgr or a similar designation in the category name, categories can also be used to distinguish between programs in Add or Remove Programs that have been advertised by Configuration Manager 2007 and those advertised using group policies.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Requirements Page

Use the Requirements page in the Configuration Manager 2007 New Program Wizard to specify program requirements, including the client platforms on which the program will run, estimated disk space and run time for the program, and any additional requirements.

This page contains the elements described in the following table.

UI Element List

Name Description

Estimated disk space

Specifies the amount of disk space that the software program requires to run on the computer. This can be specified as Unknown (the default setting) or as a whole number greater than or equal to zero. If a value is specified, units for the value must also be specified.

On client computers, the specified value appears in Run Advertised Programs in the Control Panel.

Maximum allowed run time

Specifies the maximum time (in minutes) that the program is expected to run on the client computer. This can be specified as Unknown (the default setting) or as a whole number greater than zero.

By default, this value is set to 120 minutes.

Important
If you are using maintenance windows for the collection on which this program is run, a conflict may occur if the Maximum allowed run time is longer than the scheduled maintenance window. If the maximum run time is set to Unknown, it will start during the maintenance window, but will continue to run until it completes or fails after the maintenance window is closed. If the maximum run time is set by the user to a specific period (not set to Unknown) that exceeds the length of any available maintenance window, then that program will not be run. For more information, see About Maintenance Windows.

If the value is set as Unknown, Configuration Manager 2007 sets the maximum allowed run time as 12 hours (720 minutes).

Note
If the maximum run time (whether set by the user or as the default value) is exceeded, Configuration Manager 2007 will stop the program if it is set to run with administrative rights and the allow users to interact with this program setting is not selected.

If the program itself is not stopped, Configuration Manager 2007 stops monitoring the program after the maximum allowed run time is exceeded. This allows Configuration Manager 2007 to continue with other software distribution functions, such as running other advertised programs. As a result, Configuration Manager does not:

  • Stop the program.
  • Free up any drives that have been mapped for the advertised program.
  • Free up any network connections made for the advertised program.
  • Remove security rights granted to the Client Token account, if any.
  • Free up operating system resources used by Configuration Manager when running advertised programs.

On client computers, the specified value appears in Run Advertised Programs in Control Panel and helps the user decide if and when to run the advertised program.

This program can run on any platform

Specifies whether the program can run on any available operating system platforms. If this option is selected, Configuration Manager 2007 does not check the platform type when advertising the program to clients. By default, this option is selected.

This program can run only on specified client platforms

Specifies whether the program can be run only on specific processors, operating systems, or service packs. When this option is selected, at least one platform from the accompanying list must also be selected.

Additional requirements

Specifies any additional requirement information for clients, up to 127 characters. For example, you can notify users that they should shut down all other applications before running the program. This field is optional.

If specified, the text appears on client computers in Run Advertised Programs in Control Panel.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Environment Page

Use the Environment page in the Configuration Manager 2007 New Program Wizard to specify any conditions such as user interaction or necessary rights that are required for the program to run on client computers.

This page contains the elements described in the following table.

UI Element List

Name Description

Program can run

Specifies the logon conditions necessary for the program to run:

  • Only when a user is logged on: Prevents the program from running if no user is logged on to the client computer. This is the default setting.
  • Only when no user is logged on: Prevents the program from running until the user logs off the computer.
    Note
    If a user logs on while the installation is running, the program continues to run.

  • Whether or not a user is logged on: Enables the program to run with or without a user logged on the client computer.

Run Mode

Specifies the credentials required to run the program on the client computer. Two options are available:

  • Run with user's rights: Specifies whether the program runs with user credentials. This option is selected by default.
  • Run with administrative rights: Specifies whether the program runs with administrator credentials. If selected, this forces the program to run under the local administrator account on the client computer.
    If this option is selected, the following additional option is available:
    • Allow users to interact with this program: Specifies whether to allow users to interact with the program. This check box is available only when Only when no user is logged on is selected as a logon condition and Run with administrative rights is selected.
      Select this option only for programs that must run in an administrative context and that require the user to interact with the program. If you select this option, the user interface for the program is visible to the logged-on user, and that user can interact with the program.
      Leave this option clear for all programs that do not display any user interface or that display a user interface but do not require the user to interact with the program.
      Note
      If you advertise a program that is set to Run with administrative rights and you do not select Allow users to interact with this program, the program can fail if it displays a user interface that requires a user to make a selection or click a button. The program waits for user interaction until the program's configured Maximum allowed run time is exceeded, and then stops if no user interaction is received. If no Maximum allowed run time is specified, the program's process ends after 12 hours.

Runs with UNC name

Specifies that the program runs with a Universal Naming Convention (UNC) name. This is the default setting.

Requires drive letter

Indicates that the program requires a drive letter to fully qualify its location, but Configuration Manager 2007 can use any available drive letter on the client.

Requires specific drive letter

Indicates that the program requires a specific drive letter that you specify to fully qualify its location.

If the specified drive letter is already used on a given client, the program does not run.

Reconnect to distribution point at logon

Specifies that the client computer reconnects to the distribution point when the user logs on. By default, this check box is cleared.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


Advanced Page

Topic Last Updated—August 2008

Use the Advanced page in the Configuration Manager 2007 New Program Wizard to specify any special settings, such as program dependencies, that must be met for the program to install and run on the client computer.

This page contains the elements described in the following table.

UI Element List

Name Description

Run another program first

Specifies that this program requires another program to run before it. By default, this check box is cleared. If a program is run first and fails on a client, the dependent program will not run.

Note
The program that you specify to run first does not need to be advertised separately.

If this option is selected, the following fields must be completed:

  • Package: Specifies the package containing the program that must run before this program.
  • Program: Specifies the program that must run first.

In addition, the following option is available:

  • Always run this program first: Specifies whether the program that runs first should run every time the advertised program runs, regardless of previous run history.
    If the program that runs first has been run successfully, Configuration Manager 2007 does not automatically rerun it, even if the dependent program is on a recurring schedule.

When this program is assigned to a computer

Specifies how the program is assigned to users when Program can run (on the Environment tab) is set to Only when a user is logged on. The following options are available:

  • Run once for the computer: The program runs only once on the client computer. This is the default setting.
  • Run once for every user who logs on: The program runs once for each new user who logs on.

Suppress program notifications

Specifies that notification area icons and messages, as well as countdown notifications, will not be displayed for this program.

Disable this program on computers where it is advertised

Specifies whether all advertisements that contain this program are to be temporarily disabled. If this option is selected, the program is removed from the list of available programs for users to run and it will not be run through assignment until reenabled. This check box is cleared by default.

Allow this program to be installed from the Install Software task sequence without being advertised.

Specifies that the program is allowed to be installed on computers by using the Install Multiple option in the Install Software task sequence action. For more information, see the Install Software task sequence action.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Program

Reference

Install Software
Program Name Properties

Other Resources

How to Manage Programs


Windows Installer Page

Use the Windows Installer page in the Configuration Manager 2007 New Program Wizard to specify the Windows Installer product information used to enable installation source management of a product. This selection dynamically updates Windows Installer source locations with a list of distribution points that have the package available for that Configuration Manager 2007 client. The list of distribution points adheres to protected site system boundaries.

This page contains the elements described in the following table.

UI Element List

Name Description

Windows Installer product code

Specifies the Windows Installer product code (GUID) that is the principal identification of an application or product. This field is updated only by importing a Windows Installer file.

Windows Installer file

Specifies the name of the Windows Installer file contained among the package source files (if present). This field is updated only by importing a Windows Installer file.

To import a Windows Installer file, click the Import button. This opens the standard Open dialog box, allowing you to browse within the package source location for a Windows Installer file.

To clear the Windows Installer product code and the Windows Installer file fields and enable the Import button, click the Clear button.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Packages

Other Resources

How to Manage Packages
Packages Property Pages


MOM Page

Use the MOM page in the Configuration Manager 2007 New Program Wizard to specify the settings for Microsoft Operations Manager (MOM) when the program runs.

This page contains the elements described in the following table.

UI Element List

Name Description

Disable MOM alerts while this program runs

Specifies whether the computer running the program will be placed in maintenance mode for the duration of the program. When in maintenance mode, MOM alerts are disabled while the program runs.

The duration for which MOM does not generate alerts is specified by the Maximum allowed run time value on the Requirements page. If this value is greater than 12 hours or specified as Unknown, MOM does not generate alerts for 15 minutes.

Generate MOM alert if this program fails

Specifies whether MOM generates an application event log entry if the program fails. If generated, the log entry contains the package name, program name, advertisement ID, advertisement comment, and failure code or Management Information Format (MIF) failure description.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create a Program

Reference

Program Name Properties

Other Resources

How to Manage Programs


New Report Wizard

Use the New Report Wizard in Configuration Manager 2007 to create a new report. The user creating a report must have Create permission for the Reports security object class and a working knowledge of SQL. The New Report Wizard contains the pages and associated elements as described in the following table.

Name Description

General Page

Configure the following report settings:

  • Name: Specifies the name for the report. The report name is required and must be unique.
  • Category: Specifies the category for the report. Categories are case sensitive and, unless a new category is being created for the report, it is recommended that the category be selected from the Category drop-down list. If the category name is entered so that it is not identical to the name in the drop-down list, a new category will be created.
  • Display in Computer Details: Specifies whether the report will appear on the Computer Details page of Report Viewer. This setting is available only to reports that have one or no report prompts configured.
  • Comment: Specifies a description for the report. This is an optional field that helps to describe the purpose of the report.
  • SQL statement: Specifies the SQL statement used to retrieve the report data. Click Edit SQL Statement to modify the SQL statement.
  • Edit SQL Statement: Opens the Report SQL Statement dialog box, where the SQL statement can be modified and report prompts can be created or modified.

Display Page

Configure the following report settings:

  • Refresh the report automatically: Specifies whether the data in a report is automatically refreshed by running the report query at a configured interval. When this element is enabled, configure the following setting:
    • Refresh interval: Specifies the number of minutes between automatic updates. The refresh interval can be configured to be from 1 to 60 minutes.
  • Provide a chart for the report: Specifies whether a chart is created that can be displayed when the report is run. When this element is enabled, configure the following settings:
    • Default chart type: Specifies the default chart type that is displayed when the chart is opened. The available chart types are Column, Bar, Line, Area, Pie, Exploded Pie, Doughnut, Exploded Doughnut, and Scatter (X,Y). After the chart opens, a different chart type can be specified.
    • Chart title: Specifies the title displayed above the chart.
    • Category (X) axis column: Specifies the column number from the report that is used for the data that is presented along the horizontal axis (X axis) of the chart.
    • Category (X) axis label: Specifies the label for the horizontal axis (X axis) of the chart.
    • Value (Y) axis column: Specifies the column from the report that is used for the data that is presented along the vertical axis (Y axis) of the chart.
    • Value (Y) axis label: Specifies the label for the vertical axis (Y axis) of the chart.

Links Page

Configure the Link Type for the report, which specifies whether there is a link to a target resource. The following link types and associated properties are available:

  • No link: Specifies that this report does not link to a target resource.
  • Link to another report: Specifies that this report links to another report. The following properties must be configured:
    • Report: Specifies the target report. Click Select, choose from one of the reports in the Select Report dialog box, and then click OK.
    • Prompts: Specifies the prompts that are configured for the target report. Double-click a prompt, select the column number from this report that contains the data for the prompt, and then click OK.
  • Link to Computer Details: Specifies that this report links to the Computer Details page that provides more information about a specific computer. In the Computer name column text box, type the column number from this report that contains computer names.
  • Link to Status Message Details: Specifies that this report links to the Status Message Details page that provides more information about a specific status message. In the RecordID text box, type the column number from this report that contains the record ID value for status messages.
  • Link to URL: Specifies that this report links to a URL resource. In the URL text box, type the URL path.

Progress

Provides an update about the progress made in creating the report.

Confirmation

Provides a confirmation that the report was created successfully. When the wizard fails to create a report, an error will display on this page.

See Also

Tasks

How to Create or Modify Report Prompts
How to Modify Report Properties

Reference

Prompts Dialog Box
Report SQL Statement Dialog Box

Concepts

About Configuration Manager Reports
How to Modify the Report SQL Statement
SQL Query Statement Reference

Other Resources

Report Name Properties


New Windows Vista Deployment Collection Wizard

The New Windows Vista Deployment Collection Wizard allows you to create a Configuration Manager 2007 collection of computers that you can deploy the Windows Vista operating system to.

Click any link in the following section for more information:

In This Section

New Windows Vista Deployment Collection Wizard - General Page

New Windows Vista Deployment Collection Wizard - Selection Criteria Page


New Windows Vista Deployment Collection Wizard - General Page

Use the General page in the New Windows Vista Deployment Collection Wizard to specify a Name and Comment that will be associated with the new Configuration Manager 2007 Windows Vista deployment collection.

This page contains the elements described in the following table.

UI Element List

Name | Description
Name | Specifies a name that will be assigned to the new collection. The name must be unique and help describe the collection you are creating. The name cannot be longer than 127 characters.
Comment | Allows you to enter a descriptive comment that will be assigned to the new collection. The comment should help describe the collection. The collection you create will be static, so provide collection update and membership information in this field. The comment cannot be longer than 127 characters.
Last Update | Indicates when the collection was last updated with new selection information.
Last membership change | Indicates when the collection was last updated with new Configuration Manager 2007 computer membership information. You can add or remove computers form this collection as your deployment requirements change.
Next | Goes to the next page of the wizard.
Cancel | Allows you to cancel the wizard.

See Also

Other Resources

New Windows Vista Deployment Collection Wizard


New Windows Vista Deployment Collection Wizard - Selection Criteria Page

Use the Selection Criteria page in the New Windows Vista Deployment Collection Wizard to specify the selection criteria that will be used to create the new Windows Vista deployment collection

This page contains the following elements:

UI Element List

Name Description

Create Windows Vista Deployment collection in this collection

Specifies if Configuration Manager 2007 should create a sub collection of an existing collection. Click Browse to open the Browse Collection dialog box. Select the collection that should be evaluated for computers that will be included in the new Vista Deployment collection by selecting the desired collection and clicking OK to close the dialog box.

System Requirements

Select this option to filter the selection criteria system requirements for computers that will be added to the new collection.

Note
You do not need to specify any selection criteria to complete this wizard. However, if you do not specify any selection criteria the collection will initially contain no members. To add members you must update the associated collection membership rules after you create the collection. For more information about updating the collection membership rules use the following link: How to Update an Existing Windows Vista Custom Collection

Select Minimum System Requirements to only include computers that meet the Windows Vista minimum system requirements.

Select Recommended System Requirements to only include computers that meet the recommended Windows Vista system requirements.

Device Driver Availability

Select this option to configure how computers will determine device driver availability.

Select Available in Windows Vista to only include computers that require device drivers that are available in Windows Vista. If you select this option computers will only install device drivers available from the installation source location.

Select Available in the Driver Catalog or in Windows Vista to include computers that require device drivers that are available in the driver catalog or in Windows Vista installation source.

For more information about using the driver catalog use the following link: About the Driver Catalog

Application Compatibility Toolkit Status

Select this option to configure the ACT status level required for inclusion in the new collection.

Select Windows Vista Ready to include only computers that have a status level that meet Windows Vista application compatibility requirements.

Select Action Requireds to include computers that meet or have minor compatibility issues as determined by ACT to meet Windows Vista application compatibility requirements.

Next

Goes to the next page of the wizard.

Previous

Goes the previous page of the wizard.

Cancel

Allows you to Cancel the Wizard

See Also

Other Resources

New Windows Vista Deployment Collection Wizard


Secondary Site Creation Wizard

The Secondary Site Creation Wizard allows you to create a secondary site from a primary site Configuration Manager console.

In This Section

Secondary Site Creation Wizard: Welcome Page

Secondary Site Creation Wizard: Site Identity Page

Secondary Site Creation Wizard: Site Server Page

Secondary Site Creation Wizard: Installation Source Files Page

Secondary Site Creation Wizard: Address to Secondary Site Page

Secondary Site Creation Wizard: New Address to Secondary Site Page

Secondary Site Creation Wizard: New Address to Parent Site Page

Wizard - Summary Page

Wizard - Progress Page

Wizard - Completing the Wizard Page


Secondary Site Creation Wizard: Welcome Page

This wizard helps you create a secondary site underneath the primary site from which the wizard is run.

This page contains the elements described in the following table.

UI Element List

Name | Description
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Other Resources

Secondary Site Creation Wizard


Secondary Site Creation Wizard: Site Identity Page

This page is used to specify a unique identity for a new secondary site. Ensure that site information that you enter is not already in use within the hierarchy.

This page contains the elements described in the following table.

Name | Description
Site Code | Enter a three-character site code containing letters, numbers, or a combination of the two.
Site Name | Enter a descriptive name for this site to be displayed in the primary site's Configuration Manager console.
Comment | Optional. Enter any additional information about this site.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Other Resources

Secondary Site Creation Wizard


Secondary Site Creation Wizard: Site Server Page

This page is used to specify the site server system and installation directory that the secondary site components will be installed on.

This page contains the elements described in the following table.

Name | Description
Site Server | Enter the NetBIOS name of the server to install the secondary site server components.
Installation Directory | Specify the installation directory on the server to install the secondary site server components.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Other Resources

Secondary Site Creation Wizard


Secondary Site Creation Wizard: Installation Source Files Page

This page is used to specify the location of the secondary site installation source files.

This page contains the elements described in the following table.

Name Description

Copy installation source files over the network from the parent site server.

Select this option if you want to copy the installation files from the parent site server to the secondary site server computer before running the secondary site setup.

Install the source files from the local disk or removable media at the secondary site server.

Select this option if you have already copied the source files to a local disk on the remote server, or you have inserted the Configuration Manager installation media into a disk drive on the remote server.

Important
Using this option requires that the source installation files be located at the root of a drive.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Other Resources

Secondary Site Creation Wizard


Secondary Site Creation Wizard: Address to Secondary Site Page

This page is used to specify one or more addresses to be used to connect to the secondary site from the primary site.

This page contains the elements described in the following table.

Name Description

Addresses to <site code description>:

Lists the addresses currently created to connect to the secondary site. If an address has been created, the type and priority set for the address are displayed.

Do you want to create a new address?

If an existing address can be used to connect to the secondary site from the primary site, you can select No. Proceed with site creation to continue.

If there are no existing addresses to the secondary site, you must select Yes. Create a new address to proceed.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Other Resources

Secondary Site Creation Wizard


Secondary Site Creation Wizard: New Address to Secondary Site Page

This page is used to create an address used to connect to the secondary site from the primary site.

Important
The addresses to each site created during this process are open for all traffic 24 hours a day, seven days a week, using unlimited bandwidth between sites. You can adjust the address properties in the primary site's Configuration Manager console for each site after the secondary site installation has completed.

This page contains the elements described in the following table.

Name | Description
Address Type | Select the type of address to be used to connect to the secondary site. Address types on this page include Standard Sender Address and Asynchronous RAS Sender Address. If Asynchronous RAS Sender Address is selected, you must also enter a Phone book entry, the RAS account to be used, and the destination server's domain.
Secondary site server name | Verify that the correct name for the secondary site server computer is displayed.
Site connection account | Optional. Set a site connection account to be used to connect to the secondary site. If no account is specified, the site server computer account will be used.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Other Resources

Secondary Site Creation Wizard


Secondary Site Creation Wizard: New Address to Parent Site Page

This page is used to create an address used to connect to the primary site from the secondary site Because secondary sites must be in the same forest as their parent site, you cannot configure a Site Connection Account for a standard sender address between a secondary child site and a primary parent site. The secondary site server's computer account is always used. If required, you can configure the Site Connection Account for the secondary site to the primary site address to use a Windows user account from the parent site Configuration Manager console after the secondary site is installed.

Important
The addresses to each site created during this process are open for all traffic 24 hours a day, seven days a week, using unlimited bandwidth between sites. You can adjust the address properties in the primary site's Configuration Manager console for each site after the secondary site installation has completed.

This page contains the elements described in the following table.

Name | Description
Address Type | Select the type of address to be used to connect to the primary site from the secondary site. Address types on this page include Standard Sender Address and Asynchronous RAS Sender Address. If Asynchronous RAS Sender Address is selected, you must also enter a Phone book entry, the RAS account to be used, and the destination server's domain.
Parent site server name | Verify that the correct name for the primary site server computer is displayed.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Other Resources

Secondary Site Creation Wizard


New Site Role Wizard

The New Site Role Wizard is used to add new site roles to existing site systems.

In This Section

New Site Role Wizard: General Page

New Site System Wizard: System Role Selection Page

New Site System Wizard: Software Update Point Page

Specifies whether to use a proxy server when connecting to the upstream server or Microsoft Update during the synchronization process.

New Site System Wizard: Active Software Update Point Settings Page

Specifies whether the software update point is enabled.

New Site System Wizard: Sync Source Page

Specifies the synchronization source for the software update point and whether WSUS reporting events are created on client computers.

New Site System Wizard: Products Page

Specifies the products for which software updates will be synchronized.

New Site System Wizard: Languages Page

Specifies the languages that are downloaded for software update files and update summary information.


New Site Role Wizard: General Page

This page is used to specify the site server system general properties for the site server that the site server role components will be installed on.

This page contains the elements described in the following table.

Name Description

Name

Read only site system name selected to add site system roles to.

Specify a fully qualified domain name (FQDN) for this site system on the intranet. This is required for native mode and for publishing in DNS

Enables or cancels the intranet FQDN text box, which allows you to specify an intranet FQDN for the site system.

This option is recommended for native mode and if the site system is a management point that is publishing to Domain Name System (DNS).

If the site is in native mode, this requires public key infrastructure (PKI) certificates. Most PKI certificates use a FQDN as the subject name. If the certificate is using an intranet FQDN as the subject name, enter the same intranet FQDN in Configuration Manager. However, if the certificate is using a NetBIOS name for intranet communication, do not enter an intranet FQDN for site systems in Configuration Manager.

Specify an Internet-based fully qualified domain name for this site system

Enables or cancels the Internet FQDN text box, which allows you to specify an Internet FQDN for the site system if you are using Internet-based client management. This option is not required unless this site system will support Internet-based client management.

Use the site server's computer account to install this site system

The site server needs to authenticate on the site system to install, configure, and monitor site system roles. The most secure method of achieving this authentication is to use the site server's computer account if it is trusted by the site system. This trusted communication is automatically available in the following scenarios:

  • The site system is in the same Active Directory forest as the site server.
  • The site system is in a different Active Directory forest than the site server, but there is a forest trust in place.
  • There is an external trust in place between the site system's domain and the site server's domain (with the site system's domain trusting the site server's domain).

If there is no trust mechanism in place between the two servers, you must use and configure a Microsoft Windows user account that is trusted on the site system server.

Use another account for installing this site system

Use this option if you cannot use the site server's computer account to authenticate to the site system.

You must also specify this option if you also select the option Allow only site server initiated data transfers from this system site on this tab.

Set

Click to open the Windows User Account dialog box to specify the Windows user account and password to use to authenticate the site server to the site system server.

Note
Universal Principle Names (UPNs) are not supported in Configuration Manager 2007, so the name format must be specified as domain\user.

Enable this site system as a protected site system

Enables or cancels the option to prevent clients from accessing the site system unless they are located within the configured protected boundaries of the site system. If a site system is configured as a protected site system and no boundaries are specified, clients will be unable to access the site system. This option applies only to site systems that are configured as distribution points and state migration points.

Protected site systems cannot be configured for connections from clients over the Internet.

Allow only site server initiated data transfers from this site system

By default, site systems initiate connections to the site server to send status information to the site. Enabling this option results in the site server initiating the connection to site systems that are configured for site system roles that are supported across forests. This configuration might introduce some latency in sending status messages, with a decrease in performance on the site server.

The site system roles that support this option are the following:

  • Management point
  • Distribution point
  • Software update point
  • Fallback status point

Enable this option only if these site system servers are in different forests than the site server and you need to control the direction of connections between the servers. The most likely scenario for this requirement is when the site is configured for Internet-based client management and the site system is in the perimeter network with the site server on the intranet.

Important
You must use the Site System Installation Account with this option, and you cannot use the site server's computer account even if a trust exists.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Other Resources

New Site Role Wizard


New Site System Wizard: System Role Selection Page

This page is used to specify new site system roles to be installed on a site server.

This page contains the elements described in the following table.

Name | Description
Available roles | Lists the available site roles that can be installed on the site server. Only site server roles not previously assigned to the site system are available.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Other Resources

New Site Role Wizard


New Site System Wizard: Software Update Point Page

Use the Software Update Point page in the Configuration Manager 2007 New Site Role Wizard or New Site Server Wizard to specify whether to use a proxy server when synchronizing to the upstream server or Microsoft Update.

This page contains the elements as described in the following table.

Name | Description
Use a proxy server when synchronizing | Specifies whether to use a proxy server when connecting to the upstream server or Microsoft Update to synchronize software updates.
Server name | Specifies the name of the proxy server.
Port | Specifies the port used by the proxy server.
Use credentials to connect to the proxy server | Specifies whether to use specific security credentials when connecting to the proxy server.
Software update point proxy server account | Specifies the software update point proxy server account used when connecting to the proxy server. You can specify a user or domain user account, for example, username or domain\username.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Tasks

How to Configure Software Updates Synchronization
How to Create and Configure an Active Software Update Point
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


New Site System Wizard: Active Software Update Point Settings Page

Use the Active Software Update Point Settings page in the Configuration Manager 2007 New Site Role Wizard or New Site Server Wizard to enable and configure the active software update point for the site. Multiple site systems can be installed with the software update point site role, but only one or two software update points can be defined as active. The active software update point is installed on a computer running Windows Server Update Services (WSUS) and allows Configuration Manager to configure the WSUS server for what software updates will be synchronized and to initiate software updates metadata synchronization from the WSUS database to the to the site server database.

When there are Internet-based client computers, the active software update point can be configured to allow connectivity from both the intranet and Internet or an active Internet-based software update point can be installed on a remote site system to handle all communications from Internet-based client computers. When there is an active Internet-based software update point, the active software update point allows only connectivity from client computers on the intranet. The Internet-based software update point is configured on the Internet-based tab. For more information about creating an Internet-based software update point, see How to Create and Configure an Active Internet-Based Software Update Point.

This page contains the elements as described in the following table.

Element | Description
Use this server as the active software update point | Specifies that the site system server will be configured with the active software update point role.
Port number | Specifies the HTTP port number configured for the WSUS server. The site server uses this port when communicating with the WSUS server. The port number must be from 1 to 65535. For information about finding the port numbers used by WSUS, see How to Determine the Port Settings Used by WSUS.
SSL port number | Specifies the SSL (HTTPS) port number configured for the WSUS server. When the Enable SSL for this WSUS server setting is enabled, the software updates components use this port when synchronizing software updates with the WSUS server. When the site is in native mode, this setting is enabled and cannot be modified. The port number must be from 1 to 65535.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings, and exits the wizard.

See Also

Tasks

How to Configure Software Updates Synchronization
How to Create and Configure an Active Software Update Point
How to Add the Software Update Point Site Role to a Site System
How to Create and Configure an Active Internet-Based Software Update Point
How to Determine the Port Settings Used by WSUS

Concepts

About the Software Update Point
Administrator Checklist: Configuring the Software Update Point in a Mixed Mode Site
Administrator Checklist: Configuring the Software Update Point in a Native Mode Site
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


New Site System Wizard: Sync Source Page

Use the Sync Source page in the Configuration Manager 2007 New Site Role Wizard or New Site Server Wizard to configure the software update point synchronization settings and whether to create Windows Server Update Services (WSUS) reporting events.

The software update point will synchronize from Microsoft Update, from the upstream update server, or is not configured to synchronize. The software update point that is highest in the Configuration Manager 2007 hierarchy (most often the central site) synchronizes with Microsoft Update and all other software updates points synchronize with the software update point configured at the parent site.

Important
The software update point on the central site should always be configured to synchronize from Microsoft Update. When any other setting is selected, synchronization will not succeed on the central site.

Optionally, synchronization can be disabled and the Windows Server Update Services (WSUS) import/export tool can be used to export the software updates metadata from one site and import it at another site. Software update points are installed on WSUS servers and use site-to-site WSUS communication channels for synchronization.

When the software update point is configured to synchronize from an upstream update server or when synchronization is not enabled, the Classifications tab, Products tab, and the Summary Details column in the Languages tab are hidden and use the settings from the software update point that synchronizes with Microsoft Update, usually at the central site.

The Windows Update Agent (WUA) on client computers can be configured to create reporting event messages that are used in WSUS reporting. These reporting events are not used by Configuration Manager and can be disabled if WSUS reporting is not used.

This page contains the elements as described in the following table.

Name | Description
Synchronize from Microsoft Update | Specifies that the software update point synchronizes with Microsoft Update. This setting should be selected for only the software update point that is highest in the Configuration Manager 2007 hierarchy.
Synchronize from an upstream update server | Specifies that the software update point synchronizes with an upstream update server. The software update point at the parent Configuration Manager 2007 site is automatically configured to be the upstream update server.
Do not synchronize from Microsoft Update or an upstream update server. | Specifies that the software update point does not synchronize with any server. Select this option if using the WSUS export/import function to obtain software update definitions. For more information, see How to Synchronize Updates Using Export and Import.
Do not create WSUS reporting events | Specifies that the WUA on client computers will not create the WSUS reporting events. This is the default setting.
Create only WSUS status reporting events | Specifies that the WUA on client computers will create only WSUS status reporting events.
Create all WSUS reporting events | Specifies that the WUA on client computers will create all WSUS status reporting events.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
About the Software Updates Process
Determine the Software Update Point Infrastructure
How to Manage Software Updates Synchronization
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


New Site System Wizard: Sync Schedule Page

Use the Sync Schedule page in the Configuration Manager 2007 New Site Role Wizard or New Site Server Wizard to specify whether the software update point is configured for synchronization on a schedule. The synchronization schedule is a site-wide setting and the Sync Schedule page is available only at the highest site in the Configuration Manager 2007 hierarchy with an active software update point that synchronizes with Microsoft Update. If this software update point is configured to synchronize with an upstream server, this page is hidden and the synchronization schedule is based on the configured site-wide schedule settings.

This page contains the elements as described in the following table.

Name | Description
Enable synchronization on a schedule | Specifies whether software updates synchronization is runs on a schedule or is initiated manually from the Configuration Manager console.
Simple schedule | Specifies that synchronization is initiated on a specific interval based on number of hours, days, or weeks. You can specify from 1 to 23 hours, from 1 to 31 days, or from 1 to 4 weeks. By default, the simple schedule is selected and the interval is set to 7 days.
Custom schedule | Specifies that synchronization is initiated on a custom schedule. When the Custom option is selected, click the Customize button to open the Custom Schedule Dialog Box to configure the schedule.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


New Site System Wizard: Classifications Page

Use the Classifications page in the Configuration Manager 2007 New Site Role Wizard or New Site Server Wizard to specify the classifications for which the software updates are synchronized. The software updates classifications are as follows:

  • Critical Updates
  • Definition Updates
  • Drivers
  • Feature Packs
  • Security Updates
  • Service Packs
  • Tools
  • Update Rollups
  • Updates

The classifications can be configured only on the software update point that is highest in the hierarchy, which is configured to synchronize with Microsoft Updates. If this software update point is configured to synchronize with an upstream server, this page is hidden and the update classifications are based on the classifications configured at the software update point highest in the hierarchy, most often the central site.

This page contains the elements as described in the following table.

Name | Description
All Classifications | Specifies that software updates in all classifications are synchronized. Each classification is selected automatically when selecting the All Classifications option.
Classification name | Specifies that software updates in the selected classification are synchronized. One or more classifications can be selected.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


New Site System Wizard: Products Page

Use the Products page in the Configuration Manager 2007 New Site Role Wizard or New Site Server Wizard to specify the products for which the software updates are synchronized. The products can be configured only on the software update point that is highest in the hierarchy, which is configured to synchronize with Microsoft Updates. If this software update point is configured to synchronize with an upstream server, this page is hidden and the products are based on the products configured at the software update point highest in the hierarchy.

This page contains the elements as described in the following table.

Name | Description
All Products | Specifies that software updates for all products are synchronized.
Vendor Name | Specifies that all software updates for the selected vendor are synchronized. One or more vendors can be selected.
Product Family Name | Specifies that all software updates for the selected product family are synchronized. For example, if Office is selected, all office products, such as Office 2002/XP, Office 2003, and so on, are automatically selected. One or more product families can be selected.
Product Name | Specifies that all software updates for the selected product are synchronized. One or more products can be selected.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


New Site System Wizard: Languages Page

Use the Languages page in the Configuration Manager 2007 New Site Role Wizard or New Site Server Wizard to specify the languages for which the software updates files are downloaded and software updates summary information (metadata) is synchronized. The configured language settings are stored in the site control file.

Note
In Systems Management Server (SMS) 2003, the download.ini file stored the configuration settings for the languages that were used. The download.ini file is no longer used when synchronizing software updates.

This page contains the elements as described in the following table.

Name Description

Update File

Specifies the default set of languages that will be available when downloading software updates at the site. When on the Language Selection page of the Deploy Software Updates Wizard or Download Software Updates Wizard, the languages configured for the software update point are automatically selected, but they can be modified each time updates are downloaded or deployed. When the wizard completes, the software update files for the configured languages are downloaded, if update files are available in the selected language, to the site server and copied to the distribution points.

The update file language settings should be configured on the software update point with the languages that are most often used in your environment. For example, if client computers in the site use mostly English and Japanese languages for the operating system or applications, and there are very few other languages used at the site, select English and Japanese in the Update File column and clear the other languages. This allows you to most often use the default settings on the Language Selection page of the wizards and it also prevents unneeded update files from being downloaded. This setting is configured in the properties for the active software update point at each site in the Configuration Manager 2007 hierarchy.

Summary Details

Specifies the languages for which the metadata for the software updates is downloaded during synchronization. The metadata provides the information about the software update, such as name, description, products that the update supports, update classification, article ID, download URL, applicability rules, and so on.

The summary details settings are configured only on the active software update point on the central site server. The active software update point and Internet-based software update point, if configured, on child sites synchronize the software updates metadata from the upstream synchronization source for the languages configured at the central site. When selecting the summary details languages, you should select only the languages needed in your environment. The more languages that are selected, the longer it takes to synchronize the software updates metadata. The software updates metadata is displayed in the locale of the operating system where the Configuration Manager console is running. If the localized properties for the software updates are not available, the information displays in English.

Important
It is very important that you select all of the summary details languages that will be needed in your Configuration Manager hierarchy. When the active software update point on the central site is synchronized, the selected summary details languages determine what software updates metadata is retrieved. If the summary details languages are modified after the synchronization has run at least one time, the metadata is retrieved for the modified summary details languages for only new or updated software updates. The software updates that have already been synchronized will not retrieve metadata for different languages unless there is a change to the update on Microsoft Update.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Create and Configure an Active Software Update Point
How to Configure Software Updates Synchronization
How to Add the Software Update Point Site Role to a Site System

Concepts

About the Software Update Point
Determine the Software Update Point Infrastructure
Planning for the Software Update Point Installation
Planning for the Software Update Point Settings

Other Resources

Software Update Point Component Properties


New Site System Server Share Wizard

The New Site System Server Share Wizard allows you to create a new server share site system to host the distribution point site server role.

In This Section

New Site System Server Share Wizard: General Page

New Site System Server Share Wizard: System Share Role Selection Page

New Site System Server Share Wizard: Distribution Point Page

Wizard - Summary Page

Wizard - Progress Page

Wizard - Completing the Wizard Page


New Site System Server Share Wizard: General Page

This page contains the elements described in the following table.

Name Description

Name

Enter the share path of the server share site system to be created.

Specify a fully qualified domain name (FQDN) for this site system on the intranet.

Enables or cancels the intranet FQDN text box, which allows you to specify an intranet FQDN for the site system.

An FQDN is required for many scenarios in Configuration Manager including the following:

  • Automatic approval of trusted clients in mixed mode
  • Native mode if the site system PKI certificate uses an FQDN as specified in Certificate Requirements for Native Mode.
  • Environments that have multiple domains and do not use WINS.

Configuring an FQDN is also recommended if this site system will host the default management point that will publish to Domain Name System (DNS).

For more information, see Determine If You Will Use FQDN Server Names and Determine If You Need to Publish to DNS.

Intranet FQDN

Enter a fully qualified domain name (FQDN) for the site system on the intranet. This can be the same FQDN as the server's network configuration, or it can be a CNAME (alias) configured on the intranet DNS.

If the site is in native mode, the intranet FQDN you specify here must match the intranet FQDN specified in the server's certificate subject name (or subject alternative name). For more information about the certificates for native mode, see Certificate Requirements for Native Mode.

Enter an FQDN that adheres to RFC 1123:

  • ASCII letters, digits, and the `-' (hyphen or dash) character.
  • Labels cannot be all numbers, but can have a leading digit.
  • Labels must end and begin only with a letter or digit.
    Important
    Configuration Manager cannot validate that the name specified is configured on intranet DNS servers.

Enable this system as a protected site system

Select this option to configure the site system as a protected site system. If this option is selected, you must also click Select Boundaries to open the Boundaries dialog box and configure the boundaries to limit client connections to this site system.

This option applies only to site systems that are configured as distribution points and state migration points.

Protected site systems cannot be configured for connections from clients over the Internet.

Allow only site server initiated data transfers from this site system

By default, site systems initiate connections to the site server to send status information to the site. Enabling this option results in the site server initiating the connection to site systems that are configured for site system roles that are supported across forests. This configuration might introduce some latency in sending status messages, with a decrease in performance on the site server.

The site system roles that support this option are the following:

  • Management point
  • Distribution point
  • Software update point
  • Fallback status point

Enable this option only if these site system servers are in different forests than the site server and you need to control the direction of connections between the servers. The most likely scenario for this requirement is when the site is configured for Internet-based client management and the site system is in the perimeter network with the site server on the intranet. For more information, see Site System Roles that Support Internet-Based Client Management.

Important
You must use the Site System Installation Account with this option, and you cannot use the site server's computer account even if a trust exists.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Boundaries Dialog Box

Other Resources

New Site System Server Share Wizard


New Site System Server Share Wizard: System Share Role Selection Page

This page contains the elements described in the following table.

Name Description

Available Roles

Select Distribution point to specify this site system server share to host the distribution point role.

Note
Only the distribution point site system role is available for server share site systems.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Other Resources

New Site System Server Share Wizard


New Site System Server Share Wizard: Distribution Point Page

This page contains the elements described in the following table.

Name Description

Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS

Specifies whether clients connecting to this distribution point can transfer contents using Background Intelligent Transfer Service (BITS), HTTP, or HTTPS. This option must be selected to enable BITS network throttling on this distribution point.

Because Internet-based client management does not support distribution points that are site system shares, the option Allow intranet-only client connections is not configurable. For more information about Internet-based client management, see Prerequisites for Internet-Based Client Management and Deploying Configuration Manager Sites to Support Internet-Based Clients.

Allow clients to connect anonymously (Required for mobile device clients)

Mobile devices require this option to be configured when the site is in mixed mode. This option is not configurable when the site is in native mode. For more information about native mode in Configuration Manager 2007, see Benefits of Using Native Mode.

New Button

Used to create a new distribution point group.

Properties Button

Used to view the properties of a selected distribution group.

Delete Button

Used to delete a selected distribution group.

Group Membership Button

Used to add or remove the distribution point from selected distribution groups.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the summary page of the wizard

Cancel

Discards the settings, and exits the wizard.

See Also

Other Resources

New Site System Server Share Wizard


New Site System Server Wizard

The New Site System Server Share Wizard allows you to create a new server share site system to host the distribution point site server role.

In This Section

New Site System Server Wizard: General Page

New Site System Server Wizard: System Role Selection Page

Wizard - Summary Page

Wizard - Progress Page

Wizard - Completing the Wizard Page


New Site System Server Wizard: General Page

Topic Last Updated—August 2008

Use this page to specify the configuration of site systems in a Configuration Manager 2007 site. A site system is a server or share that provides functionality to the site, depending on the assigned role. A site system can perform one or more roles.

This tab applies to all site system types (such as server computers and server shares).

This tab contains the following elements:

Name

Enter the short name (NetBIOS or host name) of the computer to be used as a new site system server. Ensure that the computer name entered can be resolved over the network by the site server and clients. The computer name entered is not validated by the New Site System Server Wizard and cannot be changed after you have closed the wizard.

Specify a fully qualified domain name (FQDN) for this site system on the intranet.

Enables or cancels the intranet FQDN text box, which allows you to specify an intranet FQDN for the site system.

An FQDN is required for many scenarios in Configuration Manager including the following:

  • Automatic approval of trusted clients in mixed mode
  • Native mode if the site system PKI certificate uses an FQDN as specified in Certificate Requirements for Native Mode.
  • Environments that have multiple domains and do not use WINS.
Configuring an FQDN is also recommended if this site system will host the default management point that will publish to Domain Name System (DNS).

For more information, see Determine If You Will Use FQDN Server Names and Determine If You Need to Publish to DNS.

Intranet FQDN

Enter a fully qualified domain name (FQDN) for the site system on the intranet. This can be the same FQDN as the server's network configuration, or it can be a CNAME (alias) configured on the intranet DNS.

If the site is in native mode, the intranet FQDN you specify here must match the intranet FQDN specified in the server's certificate subject name (or subject alternative name). For more information about the certificates for native mode, see Certificate Requirements for Native Mode.

Enter an FQDN that adheres to RFC 1123:

  • ASCII letters, digits, and the `-' (hyphen or dash) character.
  • Labels cannot be all numbers, but can have a leading digit.
  • Labels must end and begin only with a letter or digit.
Important
Configuration Manager cannot validate that the name specified is configured on intranet DNS servers.

Specify an Internet-based fully qualified domain name for this site system

Enables or cancels the Internet FQDN text box, which allows you to specify an Internet FQDN for the site system if you are using Internet-based client management. This option is not required unless this site system will support Internet-based client management.

For more information about Internet-based client management, see Deploying Configuration Manager Sites to Support Internet-Based Clients.

Note
This name must be registered on public Internet DNS servers so that Internet-based clients can resolve the name when they are on the Internet.

Internet FQDN

Enter a fully qualified domain name (FQDN) for the site system on the Internet.

The Internet FQDN you specify here must match the Internet FQDN specified in the server's certificate subject name (or subject alternative name). For more information about the certificates for native mode, see Certificate Requirements for Native Mode.

Important
Configuration Manager cannot validate that the name specified is configured on Internet DNS servers.

Use the site server's computer account to install this site system

The site server needs to authenticate on the site system to install, configure, and monitor site system roles. The most secure method of achieving this authentication is to use the site server's computer account if it is trusted by the site system. This trusted communication is automatically available in the following scenarios:

  • The site system is in the same Active Directory forest as the site server.
  • The site system is in a different Active Directory forest than the site server, but there is a forest trust in place.
  • There is an external trust in place between the site system's domain and the site server's domain (with the site system's domain trusting the site server's domain).
If there is no trust mechanism in place between the two servers, you must use and configure a Microsoft Windows user account that is trusted on the site system server.

Use another account for installing this site system

Use this option if you cannot use the site server's computer account to authenticate to the site system.

You must also specify this option if you also select the option Allow only site server initiated data transfers from this site system on this tab.

Site System Installation Account

Displays the Windows user account that is specified to be used for site system installation.

Set

Click to open the Windows User Account dialog box to specify the Windows user account and password to use to authenticate the site server to the site system server.

Note
Universal Principle Names (UPNs) are not supported in Configuration Manager 2007, so the name format must be specified as domain\user.

Enable this site system as a protected site system

Enables or cancels the option to prevent clients from accessing the site system unless they are located within the configured protected boundaries of the site system. If a site system is configured as a protected site system and no boundaries are specified, clients will be unable to access the site system.

This option applies only to site systems that are configured as distribution points and state migration points.

Protected site systems cannot be configured for connections from clients over the Internet.

Select Boundaries

Click to open the Boundaries dialog box to specify protected boundaries for the site system.

Allow only site server initiated data transfers from this site system

By default, site systems initiate connections to the site server to send status information to the site. Enabling this option results in the site server initiating the connection to site systems that are configured for site system roles that are supported across forests. This configuration might introduce some latency in sending status messages, with a decrease in performance on the site server.

The site system roles that support this option are the following:

  • Management point
  • Distribution point
  • Software update point
  • Fallback status point
Enable this option only if these site system servers are in different forests than the site server and you need to control the direction of connections between the servers. The most likely scenario for this requirement is when the site is configured for Internet-based client management and the site system is in the perimeter network with the site server on the intranet. For more information, see Site System Roles that Support Internet-Based Client Management.

Important
You must use the Site System Installation Account with this option, and you cannot use the site server's computer account even if a trust exists.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

See Also

Tasks

Configuring DNS for Configuration Manager Site System Roles

Concepts

About the Site System Installation Account
Determine If You Will Use FQDN Server Names

Other Resources

Deploying Configuration Manager Sites to Support Internet-Based Clients
Site System Properties


New Site System Server Wizard: System Role Selection Page

This page contains the elements described in the following table.

Name Description

Available Roles

Select one or more available site system server roles to configure for the site server. Available site system roles include the following:

  • Distribution point
  • Management point
  • System health validator point
  • Server locator point
  • State migration point
  • PXE service point
  • Reporting point
  • Software update point
  • Fallback status point

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

New Site System Server Wizard


New Task Sequence Wizard

Use this wizard to create a new task sequence. You can select one of the following three task sequence options:

New Task Sequence Wizard - Install an existing image package

Use this option to create a task sequence that deploys an operating system image package that you have already created to a target computer.

New Task Sequence Wizard - Build and Capture a Reference Operating System image

Use this option to build a reference computer and capture an operating system image from that reference computer.

New Task Sequence Wizard - Create a new custom task sequence

Use this option to create a new empty task sequence to which you can add and modify task sequence steps using the Task Sequence Editor.

See Also

Reference

Operating System Deployment: Task Sequences Node


New Task Sequence Wizard - Install an existing image package

This option creates a task sequence that deploys an operating system image package that you have already created to a destination computer. The following wizard pages are displayed:

  • Install an existing image package - Task Sequence Information
  • Install an existing image package - Install Windows
  • Install an existing image package - Configure Network
  • Install an existing image package - Install the ConfigMgr Client
  • Install an existing image package - Configure State Migration
  • Install an existing image package - Include Updates
  • Install an existing image package - Install Software
  • New Task Sequence Wizard - Summary
  • New Task Sequence Wizard - Completing the New Task Sequence Wizard

See Also

Reference

New Task Sequence Wizard


Install an existing image package - Task Sequence Information

You can enter a name and a description for the task sequence you are creating on the Task Sequence Information wizard page. You can configure the following settings:

Task Sequence name

User-defined name for the task sequence. Enter up to 50 characters. This is a required field.

Description

More detailed user-defined information about the purpose of the task sequence. This information is used to help identify the task sequence and is used in reports. This field is optional.

Boot image

Specify the boot image to deploy with this task sequence. This field is required.

Note
The architecture of the boot image must be compatible with the hardware architecture of the computer being used as the reference computer.

See Also

Concepts

New Task Sequence Wizard - Install an existing image package


Install an existing image package - Install Windows

This Install Windows page allows you select the Configuration Manager 2007 image package containing the operating system you want to install.

This page contains the elements described in the following table.

Name | Description
Partition and format the target computer before installing the operating system | Allows you partition and format the target computer before you install the operating system. If you select this option you must save the user state to a state migration point. For more information about saving the user state use the following link: How to Manage the User State
Image Package and Image | Allows you to specify the image package you want to use. Click Browse to locate the image. If there are multiple images associated with the selected package, specify the image by selecting it from the drop-down list.
Product Key and Server Licensing Mode | Specifies the product key and mode of server licensing. You can specify both encoded volume license keys and standard product keys. If a non-encoded product key is used, each group of 5 characters must be separated by a dash (-), for example XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.
Disable local administrator account | Disables the local administrator account. This is the default selection.
Always use the same administrator password | Specifies the local administrator password that will be configured as part of the Operating System deployment. If this is specified, the local administrator account on all target computers will be enabled and will use this password.

See Also

Concepts

New Task Sequence Wizard - Install an existing image package


Install an existing image package - Configure Network

Enter configuration information for the domain or workgroup you plan to join.

Name Description

Join workgroup

Joins the computer to the specified workgroup. Enter the name of the workgroup in the space provided.

Join domain

Joins the computer to the specified domain. Click Browse to open the Select a Domain dialog box. The list of available domains is displayed in the Domains window.

Next, specify the Domain OU in the space provided, or click Browse to open the Browse for a Container dialog box. Expand the tree, and then specify the appropriate container.

Note
This is an optional setting. It specifies the Lightweight Directory Access Protocol (LDAP) X.500-distinguished name of the organizational unit (OU) in which the computer account is created if it does not already exist.

Enter the account which has permission to join the domain

Allows you to enter an account and password that has permissions to join the specified domain. Click Set to open the Windows User Account dialog box, and enter the account in the following format:

Domain\User or %Variable%

Important
You must enter the appropriate domain credentials if you plan to migrate either the domain settings or the workgroup settings.

See Also

Concepts

New Task Sequence Wizard - Install an existing image package


Install an existing image package - Install the ConfigMgr Client

This page of the wizard allows you to install the Configuration Manager 2007 client software. Configuration Manager 2007 installs and registers the Configuration Manager 2007 client GUID. The registration process is delayed until the registration is completed in the database. If the management point has a replicated server running Microsoft SQL Server,, the registration could take several hours to display.

This page contains the elements described in the following table.

Name | Description
Package | Allows you to select the Configuration Manager 2007 package that contains the Configuration Manager 2007 client installation files. Click Browse to open the Select a Package dialog box. The list of available packages is displayed in the Packages window.
Installation Properties | Specifies that the Configuration Manager 2007 client will be installed using the Configuration Manager 2007 site code setting. However, you can specify additional installation properties to run with this Configuration Manager 2007 client installation using the installation properties window. For more information about Configuration Manager 2007 client installation properties, see About Configuration Manager Client Installation Properties.

See Also

Concepts

New Task Sequence Wizard - Install an existing image package


Install an existing image package - Configure State Migration

If you are migrating settings from the destination computer as part of this task sequence, select the appropriate capture option(s) on this wizard page. You can select the following options:

Capture user settings

Select this option to have Configuration Manager 2007 use a specified Configuration Manager 2007 package that is configured to capture user settings. If you enable this option, you must identify a Configuration Manager 2007 package that can install and run the User State Migration Tool (USMT). Click Browse to launch the Select a Package dialog box and select from a list of available Configuration Manager 2007 packages.

Save user settings on a State Migration Point

Select this option to saver user settings to the state migration point. This is the default option if there is an existing state migration point.

Save user settings locally

Select this option to save the user settings locally. This option is not available if you have selected the option to partition and format the disk on the Install Windows page.

Capture network settings

Select this option to have Configuration Manager 2007 capture network settings from the destination computer. You can capture domain or workgroup membership as well as the network adapter settings. You can modify how Configuration Manager 2007 captures these settings using the Operating System Deployment: Task Sequence Editor.

Capture Microsoft Windows settings

Select this option to have Configuration Manager 2007 capture the Microsoft Windows settings from the target computer. You can capture the computer name, registered user and organization name, and the time zone settings by selecting the appropriate check boxes. You can modify how Configuration Manager 2007 captures these settings using the Operating System Deployment: Task Sequence Editor.

See Also

Concepts

New Task Sequence Wizard - Install an existing image package


Install an existing image package - Include Updates

Specify how software updates should be installed on a destination computer on this wizard page. You can select the following options:

Mandatory software updates

Select this option to install all software updates flagged in Configuration Manager 2007 as mandatory for the destination computers that will receive the task sequence. This option is selected by default.

All software updates

Select this option to install all software updates targeted for the destination computers in Configuration Manager 2007 that will receive the task sequence.

Don't install any software updates

Select this option to skip any software updates that might be targeted for the destination computers that will receive the task sequence.

See Also

Concepts

New Task Sequence Wizard - Install an existing image package


Install an existing image package - Install Software

You can include Configuration Manager 2007 software packages as part of the image deployment. For more information about creating packages for the destination computer, see About Creating the Operating System Deployment Packages. Specify a Configuration Manager 2007 package and program to install as part of the task sequence. Click the New button to configure the following options and display the package information in the Software packages window. You can delete an existing package by clicking the Delete button or change the package run order using the arrows.

Package

Click Browse to select the Configuration Manager 2007 package to use for this task step. The list of available packages is displayed in the Select a Package dialog box. Select a package from the list of existing packages and click Okay to add the package. Property information containing Package ID, Source version, Last refresh time, and Comment are listed at the bottom of the window.

Program

Select the program to run with this task step. The programs associated with the package you selected are displayed in the drop-down list. Select the program you want and click Okay.

Advantages and Disadvantages of Installing Applications and Tools using a Task Sequence

Applications and tools can be installed by being embedded in a captured operating system image, or they can be installed separately (either manually, by using Configuration Manager 2007 package distribution, or as a custom task step in a deployment task sequence). This table outlines the advantages and disadvantages for each.

Installation method | Advantage | Disadvantage
Install as part of operating system image | Potentially faster deployment to target computers No need to install the application separately | Need to create a new image when updates are required Need to create an image for each distinct set of installation or setup properties Potentially larger overall image sizes Not all applications can be part of an image. The applications must be able to be generalized by Sysprep to be part of the image.
Install separately from the image | Fewer images to maintain Fewer update images to create | Potentially longer deployment and installation times, using separate Configuration Manager 2007 packages.

See Also

Concepts

New Task Sequence Wizard - Install an existing image package


New Task Sequence Wizard - Build and Capture a Reference Operating System image

This option creates a task sequence that builds a reference computer and captures an operating system from that reference computer. The following wizard pages are displayed:

  • Build and Capture a Reference Operating System Image - Task Sequence Information
  • Build and Capture a Reference Operating System Image - Install Windows
  • Build and Capture a Reference Operating System Image - Configure Network
  • Build and Capture a Reference Operating System Image - Install ConfigMgr
  • Build and Capture a Reference Operating System Image - Include Updates
  • Build and Capture a Reference Operating System Image - Install Software
  • Build and Capture a Reference Operating System Image - System Preparation
  • Build and Capture a Reference Operating System Image - Image Properties
  • Build and Capture a Reference Operating System Image - Capture Image Settingss
  • New Task Sequence Wizard - Summary
  • New Task Sequence Wizard - Completing the New Task Sequence Wizard

See Also

Reference

New Task Sequence Wizard


Build and Capture a Reference Operating System Image - Task Sequence Information

Enter a name and a comment for the task sequence you are creating on this wizard page. You can configure the following settings:

Task Sequence name

User-defined name for the task sequence. Enter up to 50 characters. This is a required field.

Description

More detailed user-defined information about the purpose of the task sequence. This information is used to help identify the task sequence and is used in reports. This field is optional.

Boot image

Specify the boot image to deploy with this task sequence.

Note
The architecture of the boot image must match the architecture of the operating system being deployed.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - Install Windows

Use the Install Windows Operating System page in the Configuration Manager 2007 New Task Sequence Wizard to select the package that contains the installation source for the operating system edition, enter licensing information for installing the operating system, and specify the local administrator password that will be used.

This page contains the elements as described in the following table.

Name Description

Package

Specifies the package that contains the source for the operating system edition that will be installed. Click Browse to specify the package.

Edition

Specifies the Windows Vista Edition that should be used with this package. If the operating system install package contains multiple editions, then you must select the appropriate edition for the Windows product code specified by the associated Product Key.

Product Key

Specifies the product key. You can specify both encoded volume license keys and standard product keys. If a non-encoded product key is used, each group of 5 characters must be separated by a dash (-), for example XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.

Server Licensing Mode

Specifies the mode of server licensing. Use the drop-down list to select one of the following modes:

  • Do not specify
  • Per seat
  • Per server

Disable the local account

Disables the local administrator account. This is the default selection.

Always use the same administrator password

Specifies the local administrator password that Configuration Manager 2007 can use on the target computer. The account and password specified in this section will be used for all Windows installations.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - Configure Network

This page allows you to enter configuration information for the domain or workgroup you plan to join.

UI Element List

Name Description

Join workgroup

Joins the computer to the specified workgroup. Enter the name of the workgroup in the space provided.

Join domain

Joins the computer to the specified domain. Click Browse to open the Select a Domain dialog box. The list of available domains displays in the Domains window.

Next, specify the Domain OU in the space provided, or click Browse to open the Browse for a Container dialog box. Expand the tree, and then specify the appropriate container.

Note
This is an optional setting. It specifies the Lightweight Directory Access Protocol (LDAP) X.500-distinguished name of the organizational unit (OU) in which the computer account is created if it does not already exist.

Enter the account which has permission to join the domain

Allows you to enter an account and password that has permissions to join the specified domain by clicking Set to open the Windows User Account dialog box. The account must be entered in the following format:

Domain\User or %Variable%

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - Install ConfigMgr

This page of the wizard allows you to install the Configuration Manager 2007 client software. Configuration Manager 2007 installs and registers the Configuration Manager 2007 client GUID. The registration process is delayed until the registration is completed in the database. If the management point has a replicated Microsoft SQL Server, the registration could take several hours to become visible.

UI Element List

Name | Description
Package | Click the Browse button to launch the Select a Package dialog box and select the Configuration Manager 2007 package to use with this task sequence step. The list of available packages is displayed in the Packages window.
Installation Properties | Specifies that the Configuration Manager 2007 client will be installed using the Configuration Manager 2007 site code setting. However, you can specify additional installation properties to run with this Configuration Manager 2007 client installation using the installation properties window. For more information about Configuration Manager 2007 client installation properties, see About Configuration Manager Client Installation Properties.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - Include Updates

Specify how software updates should be installed on a target computer on this wizard page. You can select the following options:

Mandatory software updates

Select this option to install all software updates flagged in Configuration Manager 2007 as mandatory for the target computers that will receive the task sequence.

All software updates

Select this option to install all software updates targeted for the target computers in Configuration Manager 2007 that will receive the task sequence.

Don't install any software updates

Select this option to skip any software updates that might be specified for the target computers that will receive the task sequence. This option is selected by default.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - Install Software

There are several Configuration Manager 2007 packages that you can create to support the building of a reference computer. For more information about creating packages to support the reference computer, see About Creating the Operating System Deployment Packages. Specify a Configuration Manager 2007 package and program to install as part of the task sequence. Click the New button to configure the following options and display the package information in the Software packages window:

Package

Click Browse to select the Configuration Manager 2007 package to use for this task step.

Program

Select the program to run with this task step. The programs associated with the package you selected are displayed in the drop-down list.

Advantages and Disadvantages of Installing Applications and Tools using a Task Sequence

Applications and tools can be installed as part of a deployment task sequence, or they can be installed separately (either manually, by using Configuration Manager 2007 package distribution, or as a custom task step in a deployment task sequence). This table outlines the advantages and disadvantages for each.

Installation method | Advantage | Disadvantage
Install as part of operating system image | Potentially faster deployment to target computers No need to install the application separately | Need to create a new image when updates are required Need to create an image for each distinct set of installation or setup properties Potentially larger overall image sizes Not all applications can be part of an image. The applications must be able to be generalized by Sysprep to be part of the image.
Install separately from the image | Fewer images to maintain Fewer update images to create | Potentially longer deployment and installation times, using separate Configuration Manager 2007 packages.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - System Preparation

Specify the Configuration Manager 2007 package that contains the appropriate version of Sysprep to use with this operating system to capture the reference computer settings. Click Browse to select from a list of available Configuration Manager 2007 packages.

If the operating system version you are running is Windows Vista, Sysprep is already available on the computer and you do not need to specify a package. If the operating system version you are running is Windows XP or earlier or Windows Server 2003, you must specify a package that contains the version of Sysprep and its support files appropriate for that operating system version. This package does not require a program. Operating System Deployment uses the Sysprep files contained in the package.

For more information about Sysprep packages, see About Creating the Operating System Deployment Packages.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - Image Properties

Enter additional optional information about the operating system image that you are installing on the reference computer. These settings are stored in the Windows Image (WIM) file you are creating. You can configure the following settings:

Created by

The name of the user who created the image you are creating from the reference computer.

Version

A user-defined version number associated with the reference computer image.

Description

A user-defined description of the reference computer image.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


Build and Capture a Reference Operating System Image - Capture Image Settings

Specify how the operating system image should be captured. You can configure the following options:

Save to the following network location

Enter a network share where the .WIM file will be saved. If there is an existing .WIM file located there it will be overwritten.

Use the following account to access the output folder

Specify the Windows account that has permissions to the network share where the image will be stored. You must copy the image to the location specified. Click Set to specify the name of the Windows account.

See Also

Concepts

New Task Sequence Wizard - Build and Capture a Reference Operating System image


New Task Sequence Wizard - Create a new custom task sequence

This option creates a task sequence with no task steps. You can add steps to and customize this task sequence using the Task Sequence Editor. The following wizard pages are displayed:

  • Create a new custom task sequence - Task Sequence Information
  • New Task Sequence Wizard - Summary
  • New Task Sequence Wizard - Completing the New Task Sequence Wizard

See Also

Reference

New Task Sequence Wizard


Create a new custom task sequence - Task Sequence Information

Enter a name and a description for the task sequence you are creating on this wizard page. You can configure the following settings:

Task Sequence name

User-defined name for the task sequence. Enter up to 50 characters. This is a required field.

Description

More detailed user-defined information about the purpose of the task sequence. This information is used to help identify the task sequence and is used in reports. This field is optional.

Boot image

Specify the boot image to deploy with this task sequence. This field is optional.

See Also

Concepts

New Task Sequence Wizard - Create a new custom task sequence


New Task Sequence Wizard - Summary

The Summary wizard page displays the options and settings that you have selected for this wizard. Click Next to confirm these settings and apply them, or click Previous to change the wizard settings.


New Task Sequence Wizard - Completing the New Task Sequence Wizard

This wizard page lists the settings that were applied by the wizard. Click Close to close the wizard.

See Also

Reference

Operating System Deployment: Task Sequence Editor


New Virtual Application Package Wizard

The New Virtual Application Package Wizard allows you to import new virtual application packages into Configuration Manager 2007.

In This Section

New Virtual Application Package Wizard - Package Source Page

New Virtual Application Package Wizard - General Page

New Virtual Application Package Wizard - Data Source Page


New Virtual Application Package Wizard - Package Source Page

Topic last updated—January 2008

Use the Package Source page in the Configuration Manager 2007 New Virtual Application Package Wizard to specify package data source information for the sequenced application created using the Microsoft Application Virtualization platform. This is the location where the sequenced application is saved on the network. will import the sequenced application from the location specified. The specified network location must contain a valid manifest.XML file.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name Description

Specify the virtual application package manifest XML file

Specifies the network file location of the manifest XML file associated with the sequenced application file you want to import into Configuration Manager 2007. Specify the network path to the sequenced application. Alternatively, click Browse and select the directory that contains the sequenced application and associated manifest XML file.

This is the network location where Configuration Manager 2007 will import the sequenced application from.

Virtual applications referenced by this manifest

Displays the applications that are referenced and part of the selected sequenced package. This read-only section provides Name and Version information about each individual application.

Next

Goes to the next page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Other Resources

New Virtual Application Package Wizard


New Virtual Application Package Wizard - General Page

Topic last updated—January 2008

Use the General page in the Configuration Manager 2007 New Virtual Application Package Wizard to specify general information about the virtual application package.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name | Description
Name | Specifies the name that will be assigned to the virtual application package after it has been imported into Configuration Manager 2007, which can be up to 50 characters long. This field is required. This field is initially populated with the information specified when the application was sequenced using the Microsoft Application Virtualization Sequencer.
Version | The version number of the virtual application package, which can be up to 32 characters long. This information is useful if you plan to have more than one version of the same application. This field is initially populated with the information specified when the application was sequenced using the Microsoft Application Virtualization Sequencer.
Manufacturer | The software manufacturer of the virtual application package, which can be up to 32 characters long.
Language | The language version of the software package, which can be up to 32 characters long.
Comment | Optional text about the virtual application package, such as a description. You can use up to 127 characters.
Remove this package from clients when it is no longer advertised | Specifies if the virtual application package should be deleted from target computers when the associated advertisement is no longer available. You should not select this option if you plan to advertise the virtual application package to computers that are members of dynamic or query-based collections. If this option is selected and a target computer is a member of a collection that does not receive the advertisement the target computer will not be able to run the virtual application package. You must select this option if you plan to remove virtual application packages from target computers.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Other Resources

New Virtual Application Package Wizard


New Virtual Application Package Wizard - Data Source Page

Topic last updated—January 2008

Use the Data Source page of the New Virtual Application Package Wizard to specify information about how the package will be saved.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

Name Description

Specify the ConfigMgr data source for this package

Specifies the location on the Configuration Manager 2007 server where the virtual application package will be saved. You must have read/write access to the directory specified or the import will fail. All existing files in the directory you specify will be overwritten, and the Destination directory cannot be the same location as the Source directory. Click Browse and specify the directory that will be used to save the package.

Important
After the package has been created the specified data source for the virtual application package cannot be changed. If you have updated an existing sequenced application you can still use this location as the data source. However if you want to create a new version of an existing application you should create and import a new sequenced application and save the new application in a new directory.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Other Resources

New Virtual Application Package Wizard


New Program for Device Wizard

The New Program for Device Wizard allows you to create a program for mobile devices.

Click the related link below for detailed information about each wizard page in the New Program for Device Wizard.

General

Specifies information required for a program.

Requirements Page

Provides the program's requirements, which determine whether it is appropriate for a particular computer.

See Also

Concepts

New Program for Device Wizard


General

Use the General page of the New Program for Devices Wizard to specify the name, comments, download folder and of the program details of the new program.

This page contains the following elements:

Name

Specify the name of the program. This field is required.

Comment

Specify text about the program, such as a description of the program. This field is optional.

Download folder

Specify the folder that the new program is downloaded to on the mobile device. The default folder for downloads is \Temp\.

Command line

Use the Browse button to specify the command line file for the new program.

Note
If the command line file name includes spaces then the name must be enclosed in quotation marks.

Run command line in download folder

Specify that the command line is to be run in the download folder.

Run command line from this folder

Specify that the command line is to be run in the folder in the field.

Next

Navigates to the next page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

New Program for Device Wizard


Requirements

Use the Requirements page of the New Program for Devices Wizard to specify the requirements of the new program.

This page contains the following elements:

UI Element List

Estimated disk space

Specify the number of kilobytes (KB), megabytes (MB) or gigabytes (GB) of disk space the program requires.

Download program

Specify the time when the program should be downloaded.

Additional requirements

Specify additional requirements of the program.

Next

Navigates to the next page of the wizard.

Previous

Navigates to the previous page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

New Program for Device Wizard


New Mobile Device Configuration Item Wizard

Use the New Mobile Device Configuration Item Wizard to create new configuration items for mobile devices in Configuration Manager 2007. After the configuration item is created, it is displayed in the Administrator console in System Center Configuration Manager / Site Database / Computer Management / Mobile Device Management / Configuration Items node and available for use when creating or modifying configuration packages.

In This Section

Click the related link below for detailed information about each create configuration item wizard.

Name and Description

Specifies the name and description of the mobile device configuration item.

Select Configuration Type

Specifies the configuration type from the list of available types.

Wizard - Summary Page

Displays the options and settings that you have selected for this wizard.

Wizard - Progress Page

Displays the current task and progress of the wizard.

Wizard - Completing the Wizard Page

Lists the settings that were applied by the wizard.

See Also

Concepts

Distribute Software to Devices Wizard
About Configuration Items for Mobile Devices
About Configuration Packages for Mobile Devices

Other Resources

Create Configuration Package Wizard for Mobile Devices


Name and Description

Use the Name and Description page of the Device Management Configuration Item Wizard to specify the name and Description of the configuration item in Configuration Manager. After the configuration item is created, it is displayed in the Administrator console in System Center Configuration Manager / Site Database / Computer Management / Mobile Device Management / Configuration Items node and available for use when creating or modifying configuration packages.

This page contains the elements described in the following table.

Name

Specifies the name of the configuration item for mobile devices. The name should be unique and descriptive.

Description

Specifies the description of the configuration item for mobile devices. The description should give an overview of the configuration item and relevant information that helps identify it among other items displayed in the Configuration Items pane of the Configuration Manager 2007 Administrator console.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.


Select Configuration Type

Use the Select Configuration Type page of the New Configuration Item Wizard to specify the configuration type for configuration items for mobile devices. After selecting the configuration type, you will specify the settings of the configuration item.

Click the related link below for detailed information about each create configuration item wizard.

In This Section

Browser Favorite

Browser Favorite

Certificate Installation

Certificate Installation

Dial-up Network

Dial-up Network

Exchange ActiveSync (WM03)

Exchange ActiveSync (WM03)

Exchange ActiveSync (WM05)

Exchange ActiveSync (WM05)

Internet E-mail

Internet E-mail

GPRS Network

GPRS Network

Network Proxy

Network Proxy

Password Policy for MSFP

Password Policy for MSFP (Device Security)

Password Policy for Pocket PC 2003

Password Policy for Pocket PC 2003 (Password Policy)

Registry

Registry

Security Policies

Security Policies

VPN

VPN

WiFi Settings (Wireless Network)

WiFi Settings (Wireless Network)

Select the configuration type and then click Next to continue.


Browser Favorite

The New Configuration Item Wizard for browser favorites allows you to distribute browser favorites to mobile devices using Configuration Manager software distribution.

Use the link below to address the specific configuration item settings.

See Also

Reference

Browser Favorite Properties: Browser Favorite


Certificate Installation

The New Configuration Item Wizard for certificate installation allows you to distribute certificates to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

Certificate Installation Properties: Certificate Installation


Dial-up Network

The New Configuration Item Wizard for dial-up network allows you to distribute dial-up network settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

Dial-up Network Properties: Dial-up Network


Exchange ActiveSync (WM03)

The New Configuration Item Wizard for Exchange ActiveSync allows you to distribute ActiveSync settings to Windows Mobile 2003 mobile devices using Configuration Manager.

Use the links below to address the specific configuration item settings.

See Also

Reference

Exchange ActiveSync (WM03) Properties: Sync
Exchange ActiveSync (WM03) Properties: Calendar/Contacts
Exchange ActiveSync (WM03) Properties: E-mail
Exchange ActiveSync (WM03) Properties: Optional


Exchange ActiveSync (WM05)

The New Configuration Item Wizard for Exchange ActiveSync allows you to distribute ActiveSync settings to Windows Mobile 5.0 mobile devices using Configuration Manager.

Use the links below to address the specific configuration item settings.

See Also

Reference

Exchange ActiveSync (WM05) Properties: Sync
Exchange ActiveSync (WM05) Properties: Calendar/Contact
Exchange ActiveSync (WM05) Properties: E-mail
Exchange ActiveSync (WM05) Properties: Optional


Internet E-mail

The New Configuration Item Wizard for Internet e-mail allows you to distribute Internet e-mail settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

Internet E-mail Properties: Internet E-mail


GPRS Network

The New Configuration Item Wizard for General Packet Radio Service (GPRS) network allows you to distribute GPRS settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

GPRS Network Properties: GPRS Network


Network Proxy

The New Configuration Item Wizard for network proxy allows you to distribute network proxy settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

Network Proxy Properties: Network Proxy


Password Policy for MSFP (Device Security)

The New Configuration Item Wizard for password policy for messaging and security feature pack (MSFP) allows you to distribute password policy settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

Password Policy for MSFP Properties: Device Security


Password Policy for Pocket PC 2003 (Password Policy)

The New Configuration Item Wizard for password policy for Pocket PC 2003 allows you to distribute password policy settings to Pocket PC 2003 mobile devices using Configuration Manager.

Use the links below to address the specific configuration item settings.

See Also

Reference

Password Policy for Pocket PC 2003 Properties: Password Policy
Password Policy for Pocket PC 2003 Properties: Administrator Mode


Registry

The New Configuration Item Wizard for registry allows you to distribute registry settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

Registry Properties: Registry


Security Policies

The New Configuration Item Wizard for security policies allows you to distribute security policy settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

Security Policies Properties: Security Policies


VPN

The New Configuration Item Wizard for virtual private network (VPN) allows you to distribute VPN settings to mobile devices using Configuration Manager.

Use the link below to address the specific configuration item settings.

See Also

Reference

VPN Properties: VPN


WiFi Settings (Wireless Network)

The New Configuration Item Wizard for wireless network allows you to distribute WiFi policy settings to mobile devices using Configuration Manager.

Use the links below to address the specific configuration item settings.

See Also

Reference

WiFi Properties: Wireless Network Tab
WiFi Properties: Authentication


New Collection Wizard

Use the New Collection Wizard in Configuration Manager 2007 to specify information about a new collection, and to configure membership rules, security, and other information for that collection.

Click the related link below for detailed information about each wizard page in the New Collection Wizard.

In This Section

General Page

Specifies general information, including name and comments about the collection being created.

Membership Rules Page

Specifies information about membership rules that apply to this collection, including type, limitations, and whether the collection is updated with regard to the membership rules on a specified schedule.

Advertisements Page

Specifies information about programs and their advertisements currently being broadcast to members of the collection being created.

Security Page

Specifies the security rights individual users have on both this class and this specific collection.

Wizard - Progress Page

Provides the progress for new package creation.

Wizard - Completing the Wizard Page

Provides a summary of the created package properties or a list of issues that occurred during the package creation.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


General Page

Use the General page in the Configuration Manager 2007 New Collection Wizard to specify general information about the collection being created.

This page contains the elements described in the following table.

UI Element List

Name Description

Name

Specifies the name of the collection, up to a total of 127 characters. The collection name must be unique -- multiple collections of the same name are not allowed, including imported collections.

Note
If a collection uses direct membership rules for populating the collection, the name should strongly reflect those rules if possible.

Comment

Specifies an optional description of the collection, up to a total of 127 characters.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Membership Rules Page

Use the Membership Rules page in the Configuration Manager 2007 New Collection Wizard to define rules that you can use to evaluate membership in the new collection and set the research update schedule.

This page contains the elements as described in the following table.

UI Element List

Name Description

Membership rules

Indicates the membership rules that are currently defined for the new collection.

The following options are available for managing membership rules:

  • Computer icon: Click to start the Create Direct Membership Rule Wizard, which enables you to select a specific resource to include in this collection.
  • Query icon: Click to open the Query Rule Properties dialog box, which enables you to define a new query-based membership rule.
  • Properties icon: Click to modify the selected membership rule.
  • Delete icon: Click to delete the selected membership rule.

The following columns are displayed for each membership rule:

  • Rule: Specifies the name of the membership rule.
  • Type: Specifies the type of the membership rule, either Direct (for a specific resource) and/or Query (for a query-based rule).
  • Limit To: Indicates whether the rule is limited to a collection.
    If the rule is limited, the name of the collection that limits the rule appears. If the rule is not limited, <Unlimited> appears.

Update this collection on a schedule

Specifies if the collection membership will be updated on a specific schedule.

To set a specific schedule for updating the collection, click the Schedule button.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Advertisements Page

Use the Advertisements page in the Configuration Manager 2007 New Collection Wizard to view a list of the programs that are being advertised to clients in the new collection.

Note
The list on this page also includes advertisements that are defined for other collections in which this collection is a subcollection.

This page contains the elements described in the following table.

UI Element List

Name Description

Advertisements

Specifies the advertisements that are currently available to clients in the new collection.

The following columns are displayed for the advertisements currently available:

  • Name: Indicates the name of the advertisement.
  • Program: Indicates the program that is specified in the advertisement.
  • Package: Indicates the package that contains the specified program.
  • Collection: Indicates the name of the top-level collection that is specified in the advertisement.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Advertisements
About Collections

Other Resources

How to Manage Advertisements
Collection Name Properties


Security Page

Use the Security page in the Configuration Manager 2007 New Collection Wizard to specify security information about the new collection and allow administrators to change or update class or instance security rights.

This page contains the elements described in the following table.

UI Element List

Name Description

Class security rights

Specifies the user accounts and security permissions set for the collection object class. This applies to all collections within the Collections node.

It is important to note that any changes made here will be applied to the entire collection object class.

The following options are available for managing collection class security rights:

  • New icon: Click to open the Object Class Security Rights Properties dialog box and grant security rights to a user account for the collection object class.
  • Properties icon: Click to open the Object Class Security Rights Properties dialog box to view or modify the current security permissions granted for the collection object class.
  • Delete icon: Click to delete all security rights for a specific user account for the collection object class.
    Note
    Deleting a user's object class security rights will also delete those rights on all instances of this class.

The following columns are displayed for users who currently have security rights for this class:

  • Name: Specifies each user name that currently has security rights for the collection object class.
  • Permissions: Specifies the permissions that each user has been granted for the collection object class.

Instance security rights

Specifies the user accounts and security permissions set for this collection instance.

The following options are available for managing collection class security rights:

  • New icon: Click to open the Instance Security Rights Properties dialog box and grant security rights to a user account for this collection instance.
  • Properties icon: Click to open the Instance Security Rights Properties dialog box to view or modify the current security permissions granted for this collection instance.
  • Delete icon: Click to delete all security rights for a specific user account for this collection instance.

The following columns are displayed for users who currently have security rights for this collection:

  • Name: Specifies each user name that currently has security rights for this collection instance.
  • Permissions: Specifies the permissions that each user has been granted for this collection instance.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About Collections
About Membership Rules

Other Resources

Collection Name Properties


Site Repair Wizard

The Site Repair Wizard is used to recover failed Configuration Manager sites from backups created using the Backup ConfigMgr Site Server maintenance task. Objects created and settings changed after the site was backed up can also be recovered using the wizard.

In This Section

Welcome Page

Backup File Location Page

Site Backup Date Page

Progress Page

Parent Site Settings Page

Parent Connection Page

Address Properties

Parent Site Recovery Page

Verify Site Hierarchy Page

Site Properties

Add Site Dialog

Reference Site Connection Page

Reference Recovery Page

Objects Created After Backup Page

Package Recovery Page

Summary Page

Final Progress Page

Finished Page

Restart Services

See Also

Reference

Backup ConfigMgr Site Server Task Overview

Concepts

About the Site Repair Wizard


Welcome Page

The Site Repair Wizard is used to restore a primary or secondary site using a backup snapshot created by the Backup ConfigMgr Site Server maintenance task. The Site Repair Wizard can also recover lost settings or data that were changed or created after the failed site was last backed up.

The Welcome page of the Site Repair Wizard contains the following elements:

Site server to be repaired

The name of the site server to be repaired.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Reference

Backup ConfigMgr Site Server Task Overview

Concepts

Overview of Backup and Recovery
Site Repair Wizard


Backup File Location Page

The Backup File Location page is used to specify the location of the site backup to be used to restore the site. Configuration Manager 2007 sites can be repaired using the Site Repair Wizard with or without a backup snapshot. However, when sites are repaired without a backup snapshot, only default configuration settings can be applied and the site database is not restored.

The Backup File Location page of the Site Repair Wizard contains the following elements:

Restore a site from backup files.

Specify the location of the site backup files to be used to restore the site.

  • You can click Browse to browse to the location of the backup files or enter the backup files location manually.
  • To restore site settings only, select the Do not restore database checkbox.
Repair or reconfigure a site

Use this option if you do not have a valid backup snapshot for the site to be repaired. When this option is selected, site server files and the site database cannot be restored.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Overview of Backup and Recovery
Site Repair Wizard


Site Backup Date Page

The Backup Date page is used to specify the approximate date of the last site backup.

The Backup Date page of the Site Repair Wizard contains the following elements:

Site:

The site code of the site to be repaired.

Backup date:

The date control is used to specify the date of the latest site backup or the approximate date that the site was first installed.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Progress Page

The Progress page displays the actions being taken to repair the site and their completion status.

The Progress page of the Site Repair Wizard contains the following elements:

Progress display

Displays the current site repair action status.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Parent Site Settings Page

The Parent Site Settings page is used to configure parent site settings for the site to be repaired.

The Parent Site Settings page of the Site Repair Wizard contains the following elements:

This site is a central site

Select this option if the site to be repaired is a central site, or was made a central site after the last site backup snapshot was created.

This site is a child site of (site code):

Select this option and enter the parent site code of the site to be repaired. If the site was a child site when the latest backup snapshot was created, the parent site code is displayed.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Parent Connection Page

The Parent Connection page is used to confirm or configure existing parent site connection addresses recovered from the backup snapshot. If new parent site connection addresses were created after the site to be repaired was last backed up, you can add them.

The Parent Connection page of the Site Repair Wizard contains the following elements:

Parent Site Code

Displays the parent site code for the site to be repaired.

Addresses for parent site

Displays the addresses used by the site to be repaired to communicate with its parent site.

  • Click New to start the New Address dialog box to add a new parent site connection address. It may be necessary to add a new parent site connection address if any were created after the site was last backed up.
  • Click Properties to display the properties of an existing parent site connection address.
  • Click Delete to delete an existing parent site connection address.
Recover data from parent site

Recovers data from the site’s parent site that was created after the site was last backed up.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Address Properties

The Address Properties dialog is used to view the properties of an existing parent site connection address or to add a new parent site connection address if any new parent site connection addresses were created after the site to be repaired was last backed up.

The elements displayed depend on the type of address you are adding.

The Address Properties dialog of the Site Repair Wizard contains the following elements:

Address Type

Displays the address type being added or configured.

Standard Sender Address elements

Destination site server: Enter the site server name that this address will be used to connect to (can be either FQDN or shortname).

Account: By default, the originating site server computer account is used to connect to the destination site. If you prefer to use a domain user account for the address to use to connect to the destination site server, you can click Set.

Asynchronous RAS Sender Address elements

  • Phone book entry: The RAS phone book entry for the address.
    Note
    If you have a virtual private network (VPN) server, you can substitute a VPN phone book entry for the RAS phone book entry.

  • RAS account: The RAS user name for the address (required). This RAS-specific account connects to the destination site system that has RAS installed. To set or change the account, click Set.
  • Destination site server: The destination site server's name. The maximum server name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Destination Domain: The domain containing the destination site server. The maximum domain name length is 15 characters. The following characters are prohibited: " / \ [ ] ;: | = + * ? , < >.
  • Destination Account: The Windows User account used to log on to the domain of the destination site system that has RAS installed. To set or change the account, click Set. If no account is specified, the computer account will be used.
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Parent Site Recovery Page

The Parent Site Recovery page is used to recover any parent site configuration changes made after the site to be repaired was last backed up.

The Parent Site Recovery page of the Site Repair Wizard contains the following elements:

Recover data from site:

Displays the parent site code of the site to be recovered.

Progress display

Displays the current site repair actions and their status.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Verify Site Hierarchy Page

The Verify Site Hierarchy page is used to verify that site hierarchy information retrieved from the backup snapshot is correct and that any sites attached to the site to be recovered were not created or deleted after the site was last backed up.

The Verify Site Hierarchy page of the Site Repair Wizard contains the following elements:

Site Hierarchy

Displays the sites under the site to be recovered.

  • Click Add to open the New Site dialog box to add a site to the hierarchy information displayed if any were created after the site was last backed up.
  • Click Properties to display the properties of a selected site.
  • Click Remove to remove a site from the backup snapshot information if a site was removed from the hierarchy after the site was backed up.
Addresses for selected site:

Displays the addresses for the site selected in Site Hierarchy.

  • Click Add to add a new site connection address if any were created after the site was last backed up.
  • Click Properties to display the properties of a selected site address.
  • Click Delete to delete a site address from the backup snapshot information if a site address was deleted after the site was backed up
Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Site Properties

The Site Properties page displays the properties of a site selected on the Verify Site Hierarchy page.

The Site Properties Page contains the following elements:

Parent site:

Parent site description for the selected site.

Parent site type:

The type of site this site's parent site is.

Site code:

Site code for the selected site.

Site type:

The type of site for the selected site.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and does not close the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Concepts

Site Repair Wizard


Add Site Dialog

The Add Site dialog is used to add a site to the backup snapshot hierarchy information if any sites were created after the site was last backed up which are child sites of the site to be recovered.

The Add Site dialog of the Site Repair Wizard contains the following elements:

Parent site:

Displays the site name information for the site being recovered or repaired.

Parent site type:

Site type of the site being recovered or repaired.

Child site code:

Site code of the child site created after the site was last backed up.

Child site type:

Site type of the child site created after the site was last backed up.

OK

Saves settings information and closes the Add Site dialog.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Reference Site Connection Page

The Reference Site Connection page is used to select a reference site to recover site objects created after the site was last backed up. Collections, packages, advertisements, and other feature specific objects created by the site to be recovered after it was last backed up can be recovered from primary child sites.

The Reference Site Connection page of the Site Repair Wizard contains the following elements:

Recover data from reference site

Select this option to enable site objects to be recovered from a reference site.

Site selection control

Use this control to select the child primary site to recover site objects from.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Reference Recovery Page

The Reference Recovery Page is used to review the reference site data recovery repair steps.

The Reference Recovery Page contains the following elements:

Selected reference sites:

Displays the steps being taken to recover reference site configuration data.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Objects Created After Backup Page

The Objects Created After Backup page is used to approximate the number of collections, packages, and advertisements created at the site to be repaired after the site was last backed up. When approximating the number of objects created after the site was last backed up, it is important that the number specified is at least the number, or more, of the objects created after the site was last backed up to ensure that object IDs are not reused in the hierarchy. Duplicate object IDs can cause errors when clients process new objects created with the same ID as previously created objects.

The Objects Created After Backup page of the Site Repair Wizard contains the following elements:

Collections

Approximate number of collections created at the site to be repaired after it was last backed up.

Packages

Approximate number of software distribution packages created at the site to be repaired after it was last backed up

Advertisements

Approximate number of software distribution advertisements created at the site to be repaired after it was last backed up

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Package Recovery Page

The Package Recovery page is used to verify that software distribution package source files are accessible to the site to be repaired and that any local distribution points installed are up to date with software distribution package source file changes.

Note
If a distribution point is not installed locally on the site server to be repaired, this step can be skipped.

The Package Recovery page of the Site Repair Wizard contains the following elements:

Verify that all package source files are accessible

Select this option to verify that all software distribution package source files are accessible to the site server being repaired.

Update the distribution point on this site server

Select this option to update the distribution point on the site server being repaired if changes to package source files have occurred since the site was last backed up.

Skip package verification

Select this option to skip the software distribution source file verification process.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Summary Page

The Summary page is used to display the selected settings that will be used in the site repair process. If any of the displayed site repair settings are incorrect, click Previous to go back to the appropriate page in the wizard to make any necessary changes before continuing the site repair process.

The Summary page of the Site Repair Wizard contains the following elements:

Repair settings summary display

Displays the site repair settings that were selected on previous Site Repair Wizard pages.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Final Progress Page

The Final Progress page displays the current site repair actions and their status.

The Final Progress page of the Site Repair Wizard contains the following elements:

Repair actions summary display

Displays the current site repair actions and their status.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Finished Page

The Finished page is displayed when the Site Repair Wizard has completed.

The Finished page of the Site Repair Wizard contains the following elements:

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings, and exits the wizard.

See Also

Concepts

Site Repair Wizard


Restart Services

The Restart Services dialog is used to select whether or not to restart the site services that were stopped during the recovery process.

See Also

Concepts

Site Repair Wizard


Task Sequence - New Advertisement Wizard

The New Advertisement Wizard is used to advertise a task sequence to a collection of one or more target computers. You can configure information on the following wizard pages:

Task Sequence - New Advertisement Wizard - General

Enter general information about the advertisement and the computers that should receive it.

Task Sequence - New Advertisement Wizard - Schedule

Enter information about when the task sequence will be advertised to members of the target collection. You can create assignments to make the task sequence mandatory.

Task Sequence - New Advertisement Wizard - Advanced Client

Specify whether to locate images and run package programs from a distribution point as required when the task sequence runs, or to download all images and packages to the Configuration Manager 2007 client cache before running the task sequence.

See Also

Reference

New Task Sequence Wizard


Task Sequence - New Advertisement Wizard - General

Enter general information about the advertisement and the computers that should receive it. The following settings can be configured:

Name

User-defined name for this advertisement. This field is required.

Comments

Optional user-defined description about this advertisement.

Task Sequence

The name of the task sequence that is being advertised. This field is automatically filled with the task sequence that was highlighted when the wizard was started.

Collection

The name of the Configuration Manager 2007 collection that contains the destination computers that should receive this advertisement.

Important
Operating System Deployment does not distinguish Configuration Manager 2007 site servers, in particular branch distribution points, from other destination computers in the collection. If you are advertising the task sequence to a collection that contains an Configuration Manager 2007 site server, the site server will run the task sequence like any other computer in the collection. It is recommended that you remove the site system role from the site server before deploying an operating system image to it, and then assign the site system role back to the site server.

Include members of subcollections

Enable this option if computers contained in subcollections of the specified Collection should also receive this advertisement. This option is enabled by default.

Make this task sequence available to Boot Media and PXE

Enable this option to make the task sequence available for use by boot media and PXE servers.

Only advertisements that have this option checked will be available to run on a bare metal computer that is booted with boot media (CD or DVD) or via PXE.

If this option is not checked, then the advertisement is available to a destination computer only if the computer is an Configuration Manager 2007 client. If you try to use boot media, the advertisement will not be found.

See Also

Reference

Task Sequence - New Advertisement Wizard


Task Sequence - New Advertisement Wizard - Schedule

Enter information about when the task sequence will be advertised to members of the target collection. You can create assignments to make the task sequence mandatory. The following settings can be configured:

Advertisement start time

The date and time when the task sequence is advertised and available to run on clients. By default the current date and time is specified. To select another date from a calendar, click the arrows adjacent to the date and time fields.

Select UTC to set the date and time based on Coordinated Universal Time (UTC), which is independent of local time zones. For instance, if you select this option and set the time to 1:00 P.M., the task sequence will be advertised on all clients simultaneously—1:00 P.M. for clients in the UTC time zone, 8:00 A.M. for clients in the Eastern time zone, and 5:00 A.M. for clients in the Pacific time zone, and so on.

Note
This option is cleared by default, and Configuration Manager 2007 treats the specified time as a local time. If the time is set to 1:00 P.M., for example, the task sequence will be advertised on clients at 1:00 P.M. in each time zone.

Mandatory assignments

If you want to ensure that users cannot choose not to run the task sequence, define one or more mandatory assignments.

Click the New button to specify a time in the Assignment Schedule dialog box when the task sequence is to run on the destination computers.

Click the Edit button to modify the selected mandatory assignment in the Assignment Schedule dialog box.

Click the Delete button to remove the selected mandatory assignment.

Assignments are not mandatory over slow links

Suspends assignments for Configuration Manager 2007 clients on a slow link. This option is available and enabled by default when at least one mandatory assignment is defined.

Allow users to run the program independently of assignments

Enables user to run the task sequence independently of any mandatory assignments that are created. This option is available when at least one mandatory assignment is defined.

Advertisement will expire

Advertises the task sequence to destination computers for a limited time only. Be default, this option is cleared.

Priority

Specifies the advertisement's priority when it is sent to child Configuration Manager 2007 sites. The default priority is Medium.

See Also

Reference

Task Sequence - New Advertisement Wizard


Task Sequence - New Advertisement Wizard - Advanced Client

Specify how the task sequence references other packages when the task sequence runs. Other packages include the operating system image, the boot image, one or more software distribution packages, or one or more software update packages. The following settings can be configured:

Run program from a distribution point

When a distribution point is available locally for the destination computer, the task sequence begins running, and the packages are referenced on the distribution point as needed as the task sequence runs. The distribution point is referenced as a Windows file share using the network access account.

Download program from distribution point

When a distribution point is available locally for the destination computer, all images and packages referenced by the task sequence are downloaded to the Configuration Manager 2007 client cache before the task sequence is run. When all images and packages are in the client cache, the task sequence begins, and references the images and packages from the client cache on the local hard drive. If the distribution point supports Background Intelligent Transfer Service (BITS), then BITS is used to do the download. BITS resumes the download the next time the computer connects to the network, so disconnection from the network will not cause a problem. If the distribution point does not support BITS and the computer disconnects from the network, the download fails.

If the Make this task sequence available to Boot Media and PXE option is enabled on the General page of this wizard, then this option is not available.

Important
If this option is selected, and the task sequence contains a step to re-partition the hard drive, the re-partition step will fail because re-partitioning the hard drive erases the contents of the Configuration Manager 2007 client cache. A task sequence that re-partitions the hard drive must use the Run program from distribution point option when it is advertised.

Do not run program

When a distribution point is not available locally, select this option to prevent the task sequence from running. Destination computers must be within the boundaries of an Configuration Manager 2007 site and that site must have at least one distribution point with the images and packages referenced by the advertised task sequence. This option is selected by default.

Download program from a remote distribution point

When a distribution point is not available locally, select this option to allow the advertised task sequence to download and then run from a remote distribution point. This option can be helpful if the task sequence is small, or if the destination computers have fast network connections to the distribution point.

If the Make this task sequence available to Boot Media and PXE option is enabled on the General page of this wizard, then this option is not available.

Important
If this option is selected, and the task sequence contains a step to re-partition the hard drive, the re-partition step will fail because re-partitioning the hard drive erases the contents of the Configuration Manager 2007 client cache. A task sequence that re-partitions the hard drive must use the Run program from a remote distribution point option when it is advertised.

Run program from a remote distribution point

When a distribution point is not available locally, select this option to allow the advertised task sequence to run from the remote distribution point.

When no protected distribution point is available, use an unprotected distribution point

Specifies whether Configuration Manager 2007 will permit a client to use an unprotected distribution point if the images and packages references by the advertised task sequence are immediately available on its protected distribution point, or if it forces a client to use the protected local distribution point if it is within the boundaries for that point. This option is cleared by default.

If this checkbox is selected, a client will use distribution points based on the following criteria:

  • If a protected distribution point with the content provisioned exists, the client will not use unprotected distribution points.
  • If a protected distribution with the content provisioned does not exist, the client will use unprotected distribution points.
If the check box is cleared, then regardless of whether or not a protected distribution point with the content provisioned exists, the client will not use unprotected distribution points.


Transfer Site Settings Wizard

In This Section

Transfer Site Settings Wizard: Welcome Page

Transfer Site Settings Wizard: Gather Settings Page

Transfer Site Settings Wizard: Select Source Site Page

Transfer Site Settings Wizard: Select Site Settings Page

Transfer Site Settings Wizard: Select Package and Collection Source Page

Transfer Site Settings Wizard: Select Collection and Package Properties Page

Transfer Site Settings Wizard: Export or Transfer Settings Page

Transfer Site Settings Wizard: Target Sites Selection Page

Transfer Site Settings Wizard: Destination Collection and Package Page


Transfer Site Settings Wizard: Welcome Page

Before running this Microsoft System Center Configuration Manager 2007 wizard, you should know the following:

  • If you want to transfer settings from or to this site
  • If you want to push settings to a site that you can connect to or if you want to export the settings to apply later
  • If you want to transfer site settings or packages and collection properties
    Note
    This wizard copies the properties of packages and collections to other packages and collections, but does not transfer the actual packages or collections.

This page contains the elements as described in the following table.

Name | Description
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Gather Settings Page

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name | Description
Export settings | Takes settings from this site to transfer to a different site. Later in the wizard you can choose the destination site and whether to save the settings to a file or transfer to a site that is online.
Site settings | Transfers the site settings, such as the client agent properties and the discovery configuration.
Package and collection properties | Transfers the package and collection properties, but not the actual packages or collections.
Import settings | Applies settings you have already exported to a file from a different site.
Configuration file | Selects a file to import.
Browse | Brings up the Select a configuration file to import dialog box.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Select Source Site Page

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name | Description
Site hierarchy list | Specifies the source site with the settings you want to copy. If both sites are in the same hierarchy and you have permissions, you can run the wizard on either the source or the destination site server.
Connected site | Tells you the site from which you are running the wizard.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Select Site Settings Page

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name Description

Select the site settings to export or transfer

Selects the site settings to transfer. If you are exporting, select the site settings to transfer in real-time or export to an xml file.

If you are importing site settings from an existing .xml file, the wizard will display as checked any settings that are present in the .xml file. You can select additional settings in the list that were not included in the file, but the source and destination site must be in the same hierarchy and have network connectivity or the transfer of additional settings will fail.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Select Package and Collection Source Page

This page contains the Microsoft System Center Configuration Manager 2007 elements described in the following table.

Name | Description
Collections | Allows you to select one collection to transfer the properties from. If you do not want to transfer any collection properties, click the Collections icon. Only the refresh schedule of a collection is transferred. If you want to transfer the membership rules, use the Export Objects wizard to export the collection.
Packages | Allows you to select one package to transfer the properties from. If you do not want to transfer any package properties, click the Packages icon. The wizard transfers only properties of a package such as refresh schedule and sending priorities, but does not transfer the actual packages.
Connected site | Displays the site from which you are running the wizard.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Select Collection and Package Properties Page

If you selected only a Microsoft System Center Configuration Manager 2007 package object or only a collection object, the other object is disabled.

Collections

If you opted to transfer properties for a collection, the only property you can export is the collection refresh schedule.

Properties

If you opted to transfer properties for a package, you can select from the following properties to transfer:

  • Refresh schedule
  • Disconnect users from Windows
  • Number of retries
  • User grace period
  • Sending priority
  • Preferred sender
You must select at least one property if you opted to transfer package properties.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Export or Transfer Settings Page

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name Description

Transfer settings now

Transfers the settings in real-time. If you do not have a connection between the source and destination sites, this option is disabled.

Export settings for later use

Creates an .xml file with the settings you specified. Even if you are transferring settings in real-time, you can simultaneously export the settings to a file. If you are importing settings from an existing .xml, you can also export simultaneously.

Name

Enter a path and a filename with an .xml extension, for example c:\transfer\siteXYZ.xml or \\serverA\transfer\siteABC.xml.

Important
Configuration Manager 2007 does not secure the location of the exported file. Use appropriate access controls to prevent attackers from tampering with the file or using it to gain information about your network.

Create package definition

Automatically creates a package definition file in the same location as the .xml file and with the same file name but with a .sms extension. You can then use the package definition file to distribute settings to another site using Configuration Manager 2007 software distribution with the Replstcfg.exe command.

Include the current values for each setting

Select Include the current values for each setting if Configuration Manager 2007 will not have to have a connection to the source site when you import the .xml file. Clear this option if you are concerned about saving information in the .xml file.

For example, if you select the Organization Name to transfer, but you don't want the information stored in the .xml file, clear Include the current values for each setting and then complete the wizard. When you import the file at the destination site, the destination site must connect to the source site and retrieve the account value, but will not retrieve any other values. If you do not have a connection to the source site, the setting will not be transferred.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Target Sites Selection Page

This page contains the Configuration Manager 2007 elements described in the following table.

Name | Description
Site Hierarchy | Specifies a site in the hierarchy to receive the site settings. If you cannot connect to the destination site, when you click Next you will see a message telling you that you can only export settings. Click OK to continue to the Export or Transfer settings page.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Destination Collection and Package Page

This page specifies the Microsoft System Center Configuration Manager 2007 destination site to receive the collection or package properties you want to copy. If both sites are in the same hierarchy, you can select the destination collection or package in the wizard. If the destination site is in a different hierarchy with no network connection, you cannot initiate an immediate transfer between sites but you can export your settings to an XML file and import them later. To export, click Next without selecting anything. You will see a warning message telling you that you can only export settings.

This page contains the elements as described in the following table.

Name | Description
Collections | Select the destination collections to receive the selected properties.
Packages | Select the destination packages to receive the selected properties.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Transfer Site Settings Wizard: Destination Site Selection

This page contains the Microsoft System Center Configuration Manager 2007 elements as described in the following table.

Name | Description
Site Hierarchy | Specifies the destination site to receive the settings you want to copy. If both sites are in the same hierarchy, you can select the destination site in the wizard. If the destination site is in a different hierarchy with no network connection, you cannot initiate an immediate transfer between sites but you can export your settings to an XML file and import them later. To export to a site in a different hierarchy, click Next without selecting anything. You will see a warning message telling you that you can only export settings.
Previous | Goes to the previous page of the wizard.
Next | Goes to the next page of the wizard.
Finish | Goes to the Summary page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Copy Site Settings from One Site to Another

Other Resources

Transfer Site Settings Wizard


Update List Wizard

Use the Update List Wizard in Configuration Manager 2007 to add software updates to a new or existing update list. After the new update list is created, it is displayed in the Update List node of the Configuration Manager console. Update lists are used to initiate a deployment for the software updates defined in the list. For more information about using update lists to initiate deployments, see How to Deploy Software Updates Using an Update List.

Note
You might need to run the Refresh action before new update lists are displayed in the Update List node.

Click the related link for detailed information about each wizard page in the Update List Wizard.

In This Section

Update List Wizard: Update List Page

Specifies whether to add the selected software updates to a new or existing update list, and whether to download the specified software updates.

Deploy Software Updates Wizard: Deployment Package Page

Specifies the package that will be used to host the software updates in the deployment. The Deployment Package page only displays if the Download the files associated with the selected software updates setting is enabled on the Update List page.

Deploy Software Updates Wizard: Distribution Points Page

Displays the distribution points used to host the software update package defined in the deployment. The Distribution Points page only displays if a new deployment package is used to host the software updates in the update list.

Add Distribution Points Dialog Box

Specifies the distribution points used to host the software update packages defined in the deployment. The Add Distribution Points dialog box only displays when adding distribution points to the deployment package.

Deploy Software Updates Wizard: Download Location Page

Specifies whether the software updates in the deployment should be downloaded from the Internet or from the local network. The Download Location page only displays if the Download the files associated with the selected software updates setting is enabled on the Update List page.

Deploy Software Updates Wizard: Language Selection Page

Specifies the languages that are downloaded for the software updates in the deployment.

Properties - Security Tab

Specifies the class and instance security for the update list object.

Wizard - Summary Page

Provides a summary of the deployment template properties.

Wizard - Progress Page

Provides the progress for deployment template creation.

Wizard - Completing the Wizard Page

Provides a summary of the created deployment template properties or a list of issues that occurred during deployment template creation.

See Also

Tasks

How to Use an Update List to Deploy Software Updates

Concepts

About the Update List Wizard
About Update Lists in Software Updates
How to Manage Software Updates Metadata

Other Resources

Update List Name Properties


Update List Wizard: Update List Page

Use the Update List page in the Configuration Manager 2007 Update List Wizard to configure whether to add the selected software updates to a new or existing update list, and whether to download the specified software updates.

This page contains the elements as described in the following table.

UI Element List

Name Description

Select update list

Specifies that the selected software updates are added to an existing update list. Click Browse to open the Select an update list dialog box, which lists all previously created update lists. When an update list is highlighted, the description is displayed. Select the update list to be used and click OK.

Create a new update list

Specifies that the selected software updates are added to a new update list. The following properties are configured as part of the update list:

Name: Specifies the name for the update list. The name must be unique and should help to describe the software updates contained in the update list.

Description: Specifies the description for the update list. The description should provide an overview of what software updates are contained in the update list and information that helps to identify it among others in the Update List node of the Configuration Manager console.

Download the files associated with the selected software updates

Specifies whether the software updates that were selected prior to running the wizard should be downloaded to a package shared folder on the distribution points. By default, this setting is not enabled.

When enabled, the Deployment Package and Download Location pages are displayed in the wizard to configure the package information.

Previous

Goes to the previous page of the wizard.

Next

Goes to the next page of the wizard.

Finish

Goes to the Summary page of the wizard.

Cancel

Discards the settings and exits the wizard.

See Also

Concepts

About the Update List Wizard
About Update Lists in Software Updates
How to Manage Software Updates Metadata

Other Resources

Update List Name Properties


Upgrade Secondary Site Wizard

The Upgrade Secondary Site Wizard helps you to upgrade Microsoft Systems Management Server (SMS) 2003 sites or reinstall Configuration Manager 2007 secondary sites directly beneath the primary site that the wizard is started on.

Important
Secondary sites cannot be upgraded unless they have successfully completed the Configuration Manager Setup prerequisite check with no errors within the past seven days.

Upgrade Secondary Site Wizard Pages

The Upgrade Secondary Site Wizard consists of three pages and functions as described in the following table:

Page Description

Welcome Page

Welcomes you to the Upgrade Secondary Site Wizard.

Secondary Site Selection Page

Use this page to select a single site or multiple secondary sites beneath the current primary site to upgrade.

Installation Source Files Page

When upgrading a secondary site, you must choose one of the following installation source file options:

  • Copy installation source files over the network from the parent site server. Select this option to have the primary site server send installation source files to the secondary site server computer before initiating the upgrade process.
  • Install the source files from compact disc or a compact disc image on a local disk or removable media at the secondary site server. Select this option to reduce network bandwidth usage between site servers.
    Note
    This option requires that the installation source files be located at the root of a disk drive located on the secondary site server computer.

See Also

Concepts

Prerequisites for Installing Configuration Manager


Virtual Application Package Update Wizard

The topics in this section provide detailed information about each wizard page in the Virtual Application Package Update Wizard. Use the Virtual Application Package Update Wizard to update existing virtual application packages. Updating a virtual application package will change the source files contained in the existing virtual application package and create a new version. Do not use this wizard if you require multiple versions of the same virtual application. To maintain multiple versions of the same virtual application, you must create a new sequenced application using the Microsoft Application Virtualization Platform and import the sequenced application into Configuration Manager 2007.

In This Section

Virtual Application Package Update Wizard - Update Package Page

Specifies the network location that contains the updated Virtual Application Package Manifest XML file.

Virtual Application Package Update Wizard - General Page

Specifies the network location that contains the updated Virtual Application Package Manifest XML file.

External Resources

How to Import Virtual Application Packages into Configuration Manager


Virtual Application Package Update Wizard - Update Package Page

Topic Last Updated – May 2008

Use the Update Package page of the Virtual Application Package Update Wizard to specify the network location of the updated Mainifest XML file associated with upgraded sequenced application. The updated Manifest XML file is located in the directory specified when you upgraded the sequenced application using the Microsoft Application Virtualization Framework.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name | Description
Automated virtual application package update settings | Displays the name of the selected virtual application package that will be updated.
Specify the Upgraded Virtual Application Package Manifest XML file | Click Browse to specify the directory that contains the updated Manifest XML file. The updated Manifest XML file is created when you use the Microsoft Application Virtualization Framework to update or upgrade an existing sequenced package.
New Virtual Applications | Displays a list of application name and version information associated with the applications that will be contained in the updated version of the virtual application package.
Old Virtual Applications | Displays a list of application name and version information associated with the applications that are contained in the previous version of the virtual application package.
Next | Displays the next page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Tasks

How to Update an Existing Virtual Application Package


Virtual Application Package Update Wizard - General Page

Topic last updated - May 2008

Use the General page of the Virtual Application Package Update Wizard to specify general information about the updated virtual application package. You can also specify how associated Configuration Manager 2007 distribution points and advertisements will be managed.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This page contains the elements described in the following table.

Name | Description
Name | Specify the name that will be assigned to the updated virtual application package. The name assigned to the previous version of the virtual application package is also displayed.
Version | Specify the version number that will be assigned to the updated virtual application package. The version number assigned to the previous version of the virtual application package is also displayed. You should increment the version number that will be assigned to the updated virtual application package to help distinguish this version of the virtual application package from previous versions.
Manufacturer | You can specify the manufacturer of the applications contained in the virtual application package.
Language | You can specify the language version of the application contained in the virtual application package. This information can be useful if you plan to have multiple language versions of the same virtual application package.
Comment | You can specify a comment that will be associated with the updated virtual application package.
Update all distribution points with a new package source version | Specifies if distribution points should be updated with the updated version of the virtual application package. This option is selected by default. Target computers will continue to run previous versions of the virtual application package until an updated version has been made available on an accessible distribution point and the associated advertisement has been re-run.
Re-run advertisements with existing mandatory advertisements | Specifies if mandatory advertisements should be re-run so that the updated version of the virtual application package is advertised to Configuration Manager 2007 clients. If you do not select this option, target computers will continue to run the previous version of the virtual application package until you re-run the associated advertisement.
Next | Displays the next page of the wizard.
Previous | Displays the previous page of the wizard.
Cancel | Discards the settings and exits the wizard.

See Also

Other Resources

Virtual Application Package Update Wizard


Wizard - Summary Page

The Microsoft System Center Configuration Manager 2007 Summary wizard page displays the options and settings that you have selected for this wizard. Click Next to confirm these settings and apply them, or click Previous to change the wizard settings.

See Also

Other Resources

Wizard Pages


Wizard - Progress Page

The Microsoft System Center Configuration Manager 2007 Progress page displays the current task and progress of the wizard.

This page contains the following elements:

Status

Displays a description of the Configuration Manager 2007 task currently in process.

Processing

Displays the current percentage to completion.

Cancel

Discards the settings and exits the wizard.

See Also

Other Resources

Wizard Pages


Wizard - Completing the Wizard Page

This wizard page lists the settings that were applied by the Microsoft System Center Configuration Manager 2007 wizard. Click Close to close the wizard.

See Also

Other Resources

Wizard Pages


Dialog Pages

In This Section

Add Device Drivers to a Boot Image

Microsoft Windows device drivers that have been imported into the driver catalog can be added to one or more boot images. These drivers can be mass storage device drivers or network adapter device drivers.

Add Distribution Points Dialog Box

Use the Add Distribution Points dialog box in Configuration Manager 2007 to view a list of all known distribution points (both parent and child sites) that are not already being used in the deployment package to host the selected set of software updates.

Choose Configuration Items Dialog Box

Use this dialog box to choose configuration items and configuration baselines to be included in a configuration baseline rules.

Add Software Updates Dialog Box

Use the Configuration Manager 2007 Add Software Updates dialog box to add software updates to a configuration baseline rules. Only software updates which have been downloaded appear in this dialog box.

Add Software Update Dialog Box

Use the Configuration Manager 2007 Add Software Updates dialog box to add software updates to a configuration baseline rules.

Advanced Filter Options Dialog Box

Use the Configuration Manager 2007 Advanced Filter Options dialog box to specify advanced criteria for filtering status messages.

Advanced Find Options Dialog Box

Use the Configuration Manager 2007 Advanced Find Options dialog box to specify advanced criteria for finding status messages.

Assignment Schedule Dialog Box

Use the Assignment Schedule dialog box in Configuration Manager 2007 to specify a schedule for an advertised program that is mandatory for a specific collection.

Boundaries Dialog Box

Use the Boundaries dialog box to specify the protected site system boundaries for the selected site system.

Browse Active Directory Sites

Describes the dialog boxes of the Browse Active Directory Sites.

Browse Collection Dialog Box

Use the Browse Collection dialog box in Configuration Manager 2007 to link a collection or to specify a target collection when creating an advertisement.

Browse Distribution Point Group Dialog Box

Use the Browse Distribution Point Group dialog box in Configuration Manager 2007 to specify a distribution point group to which to apply a specific operation, such as distributing a software package.

Browse Query Dialog Box

Use the Browse Query dialog box in Configuration Manager 2007 to specify an existing query statement to use or import into a Configuration Manager query.

Clone Dashboard Dialog Box

Use the Clone Dashboard dialog box in Configuration Manager 2007 to clone, or make a copy of, an existing dashboard. Once a unique name is specified for the new dashboard, the dashboard is created with the same properties as the source dashboard.

Clone Report Dialog Box

Use the Clone Report dialog box in Configuration Manager 2007 to clone, or make a copy of, an existing report.

Clone ConfigMgr User Dialog Box

Use this dialog box to create new Microsoft System Center Configuration Manager 2007 security rights for a user or user group by copying the security rights of an existing user or user group and giving the copy a different name.

Collected File Properties Dialog Box

Use this dialog box to add or update search criteria that is used on clients during the software inventory collection process.

Collection Limiting Dialog Box

Use the Collection Limiting dialog box in Configuration Manager 2007 to specify whether a query is limited to a specific collection or will run against all available collections.

Column Values Dialog Box

Use the Column Values dialog box in Configuration Manager 2007 to select a value for a selected column that will be inserted into a SQL statement when creating the SQL statement for a report or report prompt.

Component Logging Control Dialog Box

Use this dialog box to enable logging for a component.

Configuration Baseline Assignment Properties Dialog Box

Use the Configuration Manager 2007 Configuration Baseline Assignment Properties dialog box to view the assigned collections, enable or disable subcollections, and configure an assignment schedule for this configuration baseline if you do not want to use the default schedule that is configured in the desired configuration management client agent properties.

Categories Dialog Box

Use this dialog box to assign configuration categories to configuration items and configuration baselines, create new categories and delete existing categories.

Configure Validation Dialog Box

Use the Configure Validation dialog box to configure the validation criteria and noncompliance severity level for a configuration item's objects and settings.

Confirm Deletion Dialog Box

Use the Configuration Manager 2007 Confirm Deletion dialog box to specify whether or not, after reviewing the effects, you want to keep or delete the configuration baseline or the configuration item.

Custom Schedule Dialog Box

Use the Custom Schedule dialog box in Configuration Manager 2007 to schedule the start, recurrence pattern, and duration of a Configuration Manager operation.

Default Limited Remote Tools Settings Dialog Box

Use this dialog box to specify Remote Tools Client Agent settings, if you select Limited Remote Tools access in the Policy tab.

Define XML Namespace Dialog Box

Use the Configuration Manager 2007 Define Xml Namespace dialog box to specify a new prefix and namespace to be used by the XML query in this configuration item.

Define XML Namespaces Dialog Box

Use the Configuration Manager 2007 Define Xml Namespace dialog box to specify a new prefix and namespace to be used by the XML query in this configuration item.

Delete Confirmation Dialog Box

Use the Delete Confirmation dialog box in Configuration Manager 2007 to verify that the resource record or records selected for deletion should, in fact, be deleted.

Delete Confirmation Dialog Box - Task Sequence

This dialog box warns you that deleting this task sequence item will affect all associated objects. Make sure that you know the effects of the deletion before confirming it.

Delete Confirmation Dialog Box - Operating System Deployment

This dialog box alerts you that deleting this operating system deployment item will affect all associated objects.

Delete Report Dialog Box

Use the Delete Report dialog box in Configuration Manager 2007 to confirm whether you really want to delete the specified report.

Disable Device Driver

When you disable a device driver, no Configuration Manager 2007 client computers can install the disabled device driver.

Disconnect from Sites Dialog Box

Select the site codes of the sites from which you want to disconnect ConfigMgr Service Manager.

Display Name Properties Dialog Box

Use this dialog box to specify a name to add to the Display name list on the Inventory Names tab, or to modify an existing display name.

Domain Properties Dialog Box

Use this dialog box to specify a domain to be searched by Network Discovery.

Enable Device Driver

When you enable a device driver, any Configuration Manager 2007 client computer can install the device driver until it has been disabled.

Enter Group or User Name Dialog Box

Use the Configuration Manager 2007 Enter Group or User Name dialog box to specify Windows user names or groups to include in the validation of object permissions.

Filter Status Messages Dialog Box

Use the Configuration Manager 2007 Filter Status Messages dialog box to filter the currently displayed status messages and display only those messages that meet the filter criteria.

Find Status Message Dialog Box

Use the Configuration Manager 2007 Find Status Message dialog box to find the next message in Status Message Viewer that meets the criteria you specify.

Folders Dialog Box

You can create standard folders and move objects into the folder, or you can create search folders, which are a virtual representation of all objects that meet your search criteria.

Generic Account Dialog Box

Use the Generic Account dialog box in Configuration Manager 2007 to specify a generic account that should be given to access a package on distribution points.

Input Query Value Dialog Box

Use the Input Query Value dialog box in Configuration Manager 2007 to specify the variable parts of a query that you want to run.

Inventoried File Properties Dialog Box

Use this dialog box to add or update the search criteria that are used to inventory files during software inventory.

Inventoried File Properties (Mobile Devices)

The Inventoried File Properties dialog box displays the file or set of files that will be inventoried and sent to the device management point..

Inventory Name Properties Dialog Box

Use this dialog box to specify a name to add to the Inventoried names list.

ISV Proxy Certificate Registration or Renewal Dialog Box

Use the Configuration Manager 2007 ISV Proxy Certificate Registration or Renewal dialog box to register or renew the certificate for the ISV Proxy.

Item Name Dialog Box

Use the Configuration Manager 2007 Item Name dialog box to specify a name for a duplicate configuration baseline or configuration item.

Move Items Dialog Box

Use this dialog box to move objects, folders, or subfolders to another folder.

Network Settings Dialog Box

You can configure the following network settings with the Apply Network Settings task sequence step, General, DNS, WINS and TCP/IP Filtering.

New Active Directory Container Dialog Box

Describes the items of the New Active Directory Container Dialog Box.

New Boundaries Dialog Box

Use the New Boundaries dialog box to assign an existing site boundary to a protected site system.

New Boundary Dialog Box

Configuration Manager 2007 sites are bounded by boundaries. Boundaries are defined by IP subnets, Active Directory site names, IPv6 prefixes or Internet Protocol (IP) ranges.

New Computer Association

The New Computer Association dialog box allows you to view the properties associated with a computer association.

New DHCP Server Dialog Box

Use this dialog box to specify a Microsoft dhcp server to be added to the table on the Network Discovery Properties: DHCP Tab tab of the Network Discovery Properties dialog box.

New Domain Dialog Box

Use this dialog box to specify a domain to add to the Domains list.

New File Dialog Box

Use this dialog box to specify a file that you add to the list of How to View Files Collected From Clients from clients during software inventory.

New Folder Dialog Box

Folders are used to group objects.

New Permitted Viewer Dialog Box

Use this dialog box to specify the administrators who are permitted to start Remote Tools sessions on client computers running operating systems in the Windows Server 2003 family, Windows XP, Windows 2000, or Windows NT 4.0 operating systems.

New Roaming Boundary Dialog Box

Use this dialog box to include IP subnets, IP address ranges, and Active Directory sites within the roaming boundaries of a site.

New Server Share Site System Dialog Box

Use this dialog box to identify the server share that you want to use as a site system.

New Boundary Dialog Box

Configuration Manager 2007 sites are bounded by boundaries. Boundaries are defined by IP subnets, Active Directory site names, IPv6 prefixes or Internet Protocol (IP) ranges.

New SNMP Community Name Dialog Box

Use this dialog box to specify a community name to be added to the list on the SNMP tab of the Network Discovery Properties dialog box.

New SNMP Device Dialog Box

Use this dialog box to specify an SNMP device to be added to the table on the SNMP Devices tab of the Network Discovery Properties dialog box.

New Subnet Assignment Dialog Box

Use this dialog box to specify a subnet to be searched by Network Discovery.

New Variable Dialog Box

Use the New Variable dialog box in Configuration Manager 2007 to define a new variable and specify its associated value.

Path Properties Dialog Box

Use this dialog box to add or update file path information used by the software inventory.

Path Properties Dialog Box

Use this dialog box to define the path on the mobile device client where files will be collected.

Port Detail Dialog Box

Use this dialog box to view and modify the service port selected in the Configuration Manager 2007 Site Properties: Ports Tab.

Program Select Dialog Box

You can use the Program Select Dialog box to specify the Configuration Manager 2007 package and associated program that should run with this task sequence.

Prompt Properties Dialog Box

Use the Prompt Properties dialog box in Configuration Manager 2007 to create or modify a prompt in a report.

Prompt SQL Statement Dialog Box

Use the Prompt SQL Statement dialog box in Configuration Manager 2007 to specify the SQL statement for a specified prompt in the report.

Prompted Status Message Query Dialog Box

Use the Configuration Manager 2007 Prompted Status Message Query dialog box to specify values for variables within a status message query before the query runs.

Prompts Dialog Box

Use the Prompts dialog box in Configuration Manager 2007 to specify the prompts in a report. Prompts are created to limit or target the data that a report retrieves.

Query Information Dialog Box

Use the Configuration Manager 2007 Query Information dialog box to view information about the status message query and filter (if any) being displayed in the status message viewer window.

Report Options Dialog Box

The Configuration Manager 2007 Report Options dialog box contains the following elements.

Report SQL Statement Dialog Box

Use the Report SQL Statement dialog box in Configuration Manager 2007 to specify the SQL statement for the report.

Review/Accept License Terms Dialog Box

The Review/Accept License Terms dialog box in Configuration Manager 2007 opens when creating a deployment for one or more software updates that require license terms approval.

Run Query Special Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to override the value set for Limit number of query result items on the General tab in the Queries Properties dialog box.

Search Computer Dialog Box

The search computer dialog box allows you to search the Configuration Manager 2007 site for computers matching a specific criterion as specified by the administrator.

Search Folder Criteria Dialog Box

Search folders are a way to gather Microsoft System Center Configuration Manager 2007 objects into a folder based on search criteria.

Search Text Dialog Box

The Search Text dialog box contains the following elements.

Select a Boot Image Dialog Box

Allows you to select an existing boot image to associate with this task sequence.

Select a Boot Image

You can add an existing boot image using the Select a Boot Image dialog box.

Select a Driver Dialog Box

The Select a driver dialog box allows you to add a device driver that has been imported into the driver catalog.

Select a Package Dialog Box

Use the Select a Package dialog box in Configuration Manager 2007 to specify the package used to host the selected software updates.

Select an Operating System Install Package Dialog Box

The Select an Operating System Install Package dialog box allows you to add an existing operating system install package.

Select a Task Sequence Dialog Box

Use the Select a Task Sequence dialog box to add an existing task sequence.

Select a Package

You can add a package using the Select a Package dialog box.

Select a Source Distribution Point Dialog Box

Use the Select a Source Distribution Point dialog box in Configuration Manager 2007 to specify the distribution point from which the packages will be copied to the destination distribution points.

Select a Task Sequence Dialog Box

Use the Select a Task Sequence dialog box to add an existing task sequence.

Select an Operating System Image Dialog Box

Use the Select a Package dialog box to add an existing operating system from a captured image.

Select Attribute Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to specify an attribute class and attribute.

Select Report Dialog Box

Use the Select Report dialog box in Configuration Manager 2007 to select a report in the list.

Set Backup Paths Dialog Box

The Set Backup Paths Dialog Box is used to select the paths used to store the site and database backup files.

Set Filter Dialog Box

Use the Set Filter dialog box in Configuration Manager 2007 to specify a filter that limits the column values displayed in the Values pane of the Column Values dialog box.

Set Parent Site Dialog Box

Use this dialog box to change a site's parent, which reconfigures your site hierarchy.

Set Root CA Certificate

Use the Set Root CA Certificates dialog box that is displayed when you click Specify Root CA Certificates on the Configuration Manager 2007 Site Properties: Site Mode tab to import, view, and delete root certification authority certificates for operating system deployment clients when the site is configured for native mode.

Set Source Directory Dialog Box

Use the Set Source Directory dialog box in Configuration Manager 2007 to specify the source folder for a package.

Specify Attribute Name Dialog Box

Use the Specify Attribute Name dialog box in Configuration Manager 2007 to specify the name of a custom Active Directory object attribute that you want to discovery.

Status Message Details Dialog Box

Use the Configuration Manager 2007 Status Message Details dialog box to view information about the selected status message.

Status Messages: Set Viewing Period Dialog Box

Use the Configuration Manager 2007 Status Messages: Set Viewing Period dialog box to display only those site system status messages that are received on or after a specified date and time.

Storage Folder Dialog Box

Use the Storage Folder dialog box to add a new folder to store user state migration data.

Target Report Prompt Properties Dialog Box

Use the Target Report Prompt Properties dialog box in Configuration Manager 2007 to specify the column number in this report that will provide the prompt value to a linked target report.

Values Dialog Box

Use this dialog box to enter a value for either the Criterion Properties (Simple Value Criterion Type) criterion type or the Criterion Properties (List of Values Criterion Type) criterion type.

Wake On LAN Advanced Properties Dialog Box

Use the Wake On LAN Advanced Properties dialog box from the site properties Wake On LAN tab to fine-tune how wake-up packets are sent from the site server when you have one or more of the following items enabled for Wake On LAN, Software update deployments configured with a deadline, Mandatory software distribution assignments and Mandatory task sequence advertisements.

Windows Account Dialog Box

Use this dialog box to specify a Windows account.

Windows User Account Dialog Box

Use this dialog box to specify a Windows User account.

Windows 2000 Remote Tools Dialog Box

Use this dialog box to specify a Remote Tool for a Windows 2000 computer.

Windows 2000 Remote Control Viewer Dialog Box

Use this dialog box to specify a Remote Control Viewer for a Windows 2000 computer. .


Add Device Drivers to a Boot Image

Microsoft Windows device drivers that have been imported into the driver catalog can be added to one or more boot images. These drivers can be mass storage device drivers or network adapter device drivers.

This dialog box contains the following elements.

Name | Description
Browse | Specifies a different device driver in a stored different directory. Select the boot images you want to associate the device driver with.
Select All | Adds the Windows device drivers to all existing boot images.
Clear All | Clears the selection of all boot images, so that the Windows device drivers will not be added to any boot images.
Update Distribution points when finished | Updates the distribution points immediately. To update distribution points later, right-click the driver package to be added, and then click Update Distribution Points. Device drivers must be available on a distribution point for computers to install them.

See Also

Tasks

How to Add Windows Device Drivers to a Boot Image


Add Distribution Points Dialog Box

Use the Add Distribution Points dialog box in Configuration Manager 2007 to view a list of all known distribution points (both parent and child sites) that are not already being used in the deployment package to host the selected set of software updates. The dialog box is used in the Deploy Software Updates Wizard, Download Updates Wizard, and Update List Wizard when at least one software update needs to be downloaded, packaged, and copied to the distribution point.

The Add Distribution Points dialog box contains the following elements:

Distribution Points

Displays all distribution points that are not already configured for the deployment package. Select the check box next to the distribution point name to add it to the deployment package. Clear the check box to remove distribution points from the deployment package.

Select All

Specifies to select all of the distribution points listed.

Clear All

Clears all selected distribution points.

Select Group

Opens the Browse Distribution Point Group dialog box where a predefined distribution point group is selected.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Concepts

About Distribution Points
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
Planning for a Software Update Deployment


Asset Intelligence Dialog Boxes

Topic last updated—January 2008

This section contains the help topics for the Asset Intelligence dialog boxes.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

In This Section

Asset Intelligence Reporting Class Settings Dialog

Software Details Conflict Resolution Dialog

See Also

Other Resources

Dialog Pages


Asset Intelligence Reporting Class Settings Dialog

Topic last updated—January 2008

To enable the Configuration Manager 2007 SP1 Asset Intelligence feature, select to enable at least one reporting class from the available Asset Intelligence hardware inventory reporting classes. If Asset Intelligence reporting classes are not enabled, reports based on those classes will not contain data.

Enabling Asset Intelligence reporting classes will increase computer resource usage during Configuration Manager client hardware inventory. To prevent unnecessary client computer resource usage, you should verify that only the reporting classes required to support the Asset Intelligence reports needed are selected.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This property page contains the following elements.

Enable all Asset Intelligence reporting classes

This option is used to select all available Asset Intelligence reporting classes.

Enable only the selected Asset Intelligence reporting classes

This option is used to selectively enable Asset Intelligence reporting classes.

SMS_InstalledSoftware

This class tracks information about installed software. The following reports are dependent on this class:

  • License 1C - Computers with a specific Microsoft License Ledger Item and Sales Channel
  • Software 1A - Summary of Installed Software in a Specific Collection
  • Software 2A - Software Families
  • Software 2B - Software Categories with a Family
  • Software 2C - Software by Category and Family
  • Software 2D - Computers with a Specific Software Product
  • Software 2E - Installed Software on a Specific Computer
  • Software 3A - Uncategorized Software
  • Software 6A - Search for Installed Software
SMS_InstalledSoftwareMS

This class tracks information specifically about installed Microsoft software. The following reports are dependent on this class:

  • License 1A - Microsoft License Ledger for Microsoft License Statements
  • License 1B - Microsoft License Ledger Item by Sales Channel
  • License 1C - Computers with a specific Microsoft License Ledger Item and Sales Channel
  • License 1D - Microsoft License Ledger products on a specific computer
SMS_SystemConsoleUsage

This class polls the System Security Event Log for information about all console usage. The following reports are dependent on this class:

  • Hardware 1A - Summary of Computers in a Specific Collection
  • Hardware 2B - Computers within an age range with a collection
  • Hardware 3A - Primary computer users
  • Hardware 3B - Computers for a Specific Primary Console User
  • Hardware 4A - Shared (multi-user) Computers
  • Hardware 5A - Console Users on a Specific Computer
  • Hardware 6A - Computers for Which Console Users Could not be Determined
  • Hardware 7C - Computers with a Specific USB Device
  • Hardware 8A - Hardware that is Not Ready for a Software Upgrade
  • Hardware 9A - Search for computers
  • License 1C - Computers with a specific Microsoft License Ledger Item and Sales Channel
  • License 2B - Computers with Licenses Nearing Expiration
  • License 3B - Computers with a Specific License Status
  • License 4B - Computers with a Specific Product Managed by Software Licensing Service
  • Software 2D - Computers with a Specific Software Product
  • Software 4B - Computers with a Specific Auto-Start Software
  • Software 5B - Computers with a Specific Browser Helper Object
SMS_SystemConsoleUser

This class polls the System Security Event Log for information about specific console users. The following reports are dependent on this class:

  • Hardware 3A - Primary computer users
  • Hardware 3B - Computers for a Specific Primary Console User
  • Hardware 4A - Shared (multi-user) Computers
  • Hardware 5A - Console Users on a Specific Computer
Important
This class requires that the security event log on client computers has been configured to record success log on events.

This class will retain data for only the previous 90 days of the event log, regardless of the length of the log. If the log has less than 90 days of data, the entire log is read.

SMS_AutoStartSoftware

This class tracks information about software that starts automatically with the operating system. The following reports are dependent on this class:

  • Software 4A - Auto-Start Software
  • Software 4B - Computers with a Specific Auto-Start Software
  • Software 4C - Auto-Start Software on a Specific Computer
SMS_BrowserHelperObject

This class tracks browser helper objects. While some browser helper objects are beneficial, most software considered "malware" is in the form of browser helper objects. The following reports are dependent upon this class:

  • Software 5A - Browser Helper Objects
  • Software 5B - Computers with a Specific Browser Helper Object
  • Software 5C - Browser Helper Objects on a Specific Computer
Win32_USBDevice

This class tracks devices connected to USB ports. The following reports are dependent upon this class:

  • Hardware 7A - USB Devices by Manufacturer
  • Hardware 7B - USB Devices by Manufacturer and Description
  • Hardware 7C - Computers with a Specific USB Device
  • Hardware 7D - USB Devices on a Specific Computer
SMS_Processor

This is an existing SMS class to which new properties have been added to provide more complete data about processors. The following reports are dependent upon this class:

  • Hardware 1A - Summary of Computers in a Specific Collection
  • Hardware 2A - Estimated Computer Age by Ranges within a Collection
  • Hardware 2B - Computers within an age range with a collection
  • Hardware 8A - Hardware that is Not Ready for a Software Upgrade
  • Hardware 9A - Search for computers
SoftwareLicensingService

This class is specific to Windows Vista. For more information, see the Microsoft TechNet article titled Windows Vista Volume Activation 2.0 Technical Attributes, at http://go.microsoft.com/fwlink/?LinkId=87205. The following reports are dependent upon this class:

  • License 2C - License Information on a Specific Computer
  • License 5A - Computers Acting as a Key Management Service
SoftwareLicensingProduct

This class is specific to Windows Vista. For more information, see the Microsoft TechNet article titled Windows Vista Volume Activation 2.0 Technical Attributes, at http://go.microsoft.com/fwlink/?LinkId=87205. The following reports are dependent upon this class:

  • License 2A - Count of Licenses Nearing Expiration by Time Ranges
  • License 2B - Computers with Licenses Nearing Expiration
  • License 2C - License Information on a Specific Computer
  • License 3A - Count of Licenses by License Status
  • License 3B - Computers with a Specific License Status
  • License 4A - Count of Products Managed by Software Licensing
  • License 4B - Computers with a Specific Product Managed by Software Licensing Service
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Other Resources

Dialog Pages


Software Details Conflict Resolution Dialog

Topic last updated—January 2008

If an Asset Intelligence catalog categorization value conflicts with information downloaded from System Center Online, a software details conflict occurs.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

The Software Details Conflict Resolution dialog box can be used to resolve this type of conflict.

Note
After a software details conflict has been resolved, the software categorization information will be retained in the Asset Intelligence catalog according to the setting you specify. A software details conflict will not occur for the same software categorization value again unless the System Center Online value changes after the conflict has been resolved.

This dialog box contains the following elements.

Local value

Specifies the existing software categorization information in the Asset Intelligence catalog that conflicts with newer System Center Online software categorization details.

Downloaded value

Specifies the new System Center Online software categorization information for conflicting Asset Intelligence catalog software categorization information.

Do not change the locally edited catalog information value

Resolves the software details conflict by retaining the existing Asset Intelligence catalog software categorization information.

Overwrite the locally edited catalog information value with the downloaded System Center Online value

Resolves the software details conflict by overwriting the existing Asset Intelligence catalog software categorization information with new information obtained from System Center Online.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Other Resources

Dialog Pages


Choose Configuration Items Dialog Box

Use this dialog box to choose configuration items and configuration baselines to be included in a configuration baseline rules. The following items can be selected in this dialog box:

  • Operating system configuration items
  • Application configuration items
  • General configuration items
  • Configuration baselines

This dialog box contains the following elements:

Look for

Uses the text that was entered to filter the list of results displayed. This can be a partial or full text string. Only items that contain the text will be displayed in the configuration items list.

Find Now

Initiates the filter and displays the results in the configuration items list.

Clear

Clears the filter and displays all possible results in the configuration items list.

Configuration items list

Displays a list of available configuration items or configuration baselines for the site. Select the check box next to the configuration item or configuration baseline name to add it to the configuration baseline rules.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Add a Configuration Item to a Configuration Baseline in Desired Configuration Management
How to Add an Existing Configuration Baseline to a Configuration Baseline in Desired Configuration Management

Concepts

About Configuration Baselines in Desired Configuration Management


Add Software Update Dialog Box

Use the Configuration Manager 2007 Add Software Updates dialog box to add downloaded software updates to a deployment. Only software updates that meet the following criteria appear in this dialog box:

  • The software update is has not been expired.
  • The Microsoft Software License Terms has been accepted, if one is associated with the software update.
  • The software update file has been downloaded.

To select software update updates that have not been previously downloaded, exit the deployment properties, follow the steps in How to Download Software Updates, and then open the dialog box. The software updates displayed in the results pane can be filtered by using the Look for text box or by navigating to the product name node of the catalog tree. The selected software updates are added to the deployment.

When a software update is added to a deployment that targets both Configuration Manager and SMS 2003 client computers the package source will be updated, the deployment package version will be incremented, and the distribution points configured for the package will be updated. Adding software updates to a deployment that does not deploy software updates to SMS 2003 clients will use the update source files from a deployment package that contains the software updates and the package is not refreshed.

The Add Software Updates dialog box contains the following elements:

Look for

Specifies the filter criteria for the software updates that are displayed. The downloaded updates display that are within the selected catalogs tree node and subnodes, and contain the Look for value for any of the following software update properties:

  • Name
  • Description
  • Category
  • Article ID
  • Bulletin ID
  • Vendor
  • Product
  • Update Classification
  • Unique Update ID
Click Find Now to display the software updates that have properties containing the text entered in the Look for control. Click Find Now without any text to display all downloaded software updates within the selected node and subnodes.

Results pane

Displays the downloaded software updates that are not currently in the deployment and that meet the Look for criteria. The software updates that are selected will be added to the deployment. Highlight the classification, vendor, or the product to display the available updates for the highlighted node and subnodes or use the Look for control to filter the software updates within the selected classifications tree node and subnodes. Select the updates to add to the deployment, and then click OK. There is no limit to the number of software updates that can be in a deployment.

Click the Selected Updates node to display the software updates that have been selected.

Note
You might need to refresh the Software Updates / Update Repository node before the latest updates are shown in the results pane.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Tasks

How to Add Software Updates to a Deployment Package
How to Deploy Software Updates
How to Download Software Updates

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

Deployment Name Properties


Add Software Updates Dialog Box

Use the Configuration Manager 2007 Add Software Updates dialog box to add software updates to a configuration baseline rules. Only software updates which have been downloaded appear in this dialog box. The software updates displayed in the results pane can be filtered by using the Look for text box or by navigating to the product name node of the catalog tree. The selected software updates are added to the configuration baseline rules.

This dialog box contains the following elements:

Look for

Specifies the filter criteria for the software updates that are displayed. You can perform a search on any of the following categories:

  • Name
  • Description
  • Category
  • Article ID
  • Bulletin ID
  • Vendor
  • Product
  • Update Classification
  • Unique Update ID
Find Now

Click Find Now to display the software updates that have properties containing the text entered in the Look for control.

Update name

Specify the downloaded software updates to include in the configuration baseline rules. You can expand the classification, vendor and product to display the available software updates or use the Look for control to search for specific updates. Select the updates to add to the configuration baseline rules and then click OK. The Selected Updates node shows all software updates you have currently selected.

Note
The Selected Updates node shows only software updates you have selected while the Add Software Updates dialog box has been open. It is reset each time you reopen the dialog box.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Displays the help topic for this dialog box.

See Also

Other Resources

Software Updates in Configuration Manager
Overview of Desired Configuration Management


AMT Certificate Configuration Dialog Box

Topic last updated—May 2008

Use the AMT Certificate Configuration dialog box to configure details related to the certificate template that will be used by Configuration Manager 2007 SP1 for AMT provisioning.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

This dialog box contains the following elements.

Issuing CA

Specifies the fully qualified domain name (FQDN) of an online issuing Microsoft enterprise certification authority (CA) that can automatically approve certificate requests from the site server.

The available enterprise CAs are queried and displayed from Active Directory Domain Services.

There is no default for this setting.

CA Name

Displays the name of the certification authority selected above.

This field is read-only and has no default setting.

AMT Certificate template

Displays the Microsoft enterprise CA certificate template that the site server uses when requesting Web server certificates on behalf of AMT-based computers.

Click Select to choose the template to use.

For more information about creating the Web server certificate template for AMT provisioning, see the following topics:

  • How to Configure AMT Provisioning
  • Step-by-Step Example Deployment of the PKI Certificates Required for AMT and Out of Band Management
There is no default for this setting.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Concepts

About AMT Provisioning for Out of Band Management
Certificate Requirements for Out of Band Management


AMT User Account Settings Dialog Box

Topic last updated—May 2008

Use the AMT User Account Setting dialog box to specify a Windows user account or domain global security group that has permissions to perform the selected management activities on AMT-based computers, by using the out of band management console.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

These management activities are specific to AMT. For more information, see the manufacturer's documentation.

This dialog box contains the following elements.

Account or security group

Specifies the Windows user account or domain global security group that will manage computers that are provisioning for AMT with Configuration Manager 2007 SP1, using the selected management activities.

Click Browse, or type in the account using the syntax <domain>\<name>.

This option is not selected by default.

Media Redirection

Selects or cancels the administrative permission to redirect the computer to boot from media.

This option is not selected by default.

Hardware Information

Selects or cancels this administrative permission to enumerate the names of hardware asset types supported by AMT-based computers.

This option is not selected by default.

Data Storage

Selects or cancels this administrative permission to allocate, use, and manage blocks of nonvolatile storage in the management controller.

This option is not selected by default.

Data Storage Administration

Selects or cancels this administrative permission to reconfigure the global parameters that govern allocation and use of nonvolatile storage in the management controller.

This option is not selected by default.

Agent Presence Remote

Selects or cancels this administrative permission to register services that allow tracking of heartbeat events and agent states.

This option is not selected by default.

Network Time

Selects or cancels this administrative permission to configure the time on AMT-based computers.

This option is not selected by default.

Firmware Update

Selects or cancels this administrative permission to enable firmware updates with tools supplied by Intel or your computer manufacturer.

This option is not selected by default.

PT Administration

Selects or cancels this administrative permission to all AMT-based services.

This option is not selected by default.

Remote Control

Selects or cancels the administrative permission to use power control options such as power on and power off.

This option is not selected by default.

Event Log Manager

Selects or cancels the administrative permission to manage AMT event logs that you can view by using the out of band management console.

This option is not selected by default.

Agent Presence Local

Selects or cancels this administrative permission to report the presence of a registered application.

This option is not selected by default.

Circuit Breaker

Selects or cancels this administrative permission for AMT System Defense to apply filters to the network packets.

This option is not selected by default.

General Information

Selects or cancels this administrative permission to display read-only information.

This option is not selected by default.

Event Log Reader

Selects or cancels the administrative permission to read AMT event logs that you can view by using the out of band management console.

This option is not selected by default.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About the AMT User Accounts

Other Resources

Out of Band Management in Configuration Manager 2007 SP1


Advanced Filter Options Dialog Box

Topic Last Updated—August 2008

Use the Configuration Manager 2007 Advanced Filter Options dialog box to specify advanced criteria for filtering status messages.

This dialog box contains the following elements:

Process ID

Specifies the process ID of a process that generated the message.

Thread ID

Specifies the thread ID of a thread within a process that generated the message.

Attached message property

Specifies further properties and values on which to search.

Property

Specifies the property of the status message. Depending on the Configuration Manager 2007 features you are using, one or more of the following items might be displayed:

  • Advertisement ID
  • CI Assignment ID
  • Client SMS Unique ID
  • Collection ID
  • Package ID
  • Policy Assignment ID
  • Policy ID
  • Sdm Type Id
  • Sdm Type Version
  • Software Metering Rule ID
  • User Name
Note
Sdm Type Id refers to the CI Unique ID in the desired configuration management feature, and Sdm Type Version refers to the configuration data content version in the desired configuration management feature.

Property value

Specifies the value to search for on the selected property.

View from

Specifies the date and time of the first message to display.

First message

Specifies the first message that matches the filter criteria is the first message displayed.

Messages on

Specifies the first message that matches the filter criteria, and was generated after the specified date and time, is the first message displayed.

View through

Specifies the date and time of the last message to display.

Last message

Specifies the last message that matches the filter criteria is the last message displayed.

Messages on

Specifies the last message that matches the filter criteria, and was generated before the specified date and time, is the last message displayed.

OK

Exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Reference

Filter Status Messages Dialog Box

Concepts

ConfigMgr Status Message Viewer Overview


Advanced Find Options Dialog Box

Topic Last Updated—August 2008

Use the Configuration Manager 2007 Advanced Find Options dialog box to specify advanced criteria for finding status messages.

This dialog box contains the following elements:

Process ID

Specifies the process ID of a process that generated the message.

Thread ID

Specifies the thread ID of a thread within a process that generated the message.

Attached message property

Allows you to specify further properties and values on which to search.

Property

The property of the status message. Depending on the Configuration Manager 2007 features you are using, one or more of the following items might be displayed:

  • Advertisement ID
  • CI Assignment ID
  • Client SMS Unique ID
  • Collection ID
  • Package ID
  • Policy Assignment ID
  • Policy ID
  • Sdm Type Id
  • Sdm Type Version
  • Software Metering Rule ID
  • User Name
Note
Sdm Type Id refers to the CI Unique ID in the desired configuration management feature, and Sdm Type Version refers to the configuration data content version in the desired configuration management feature.

Property value

Specifies the value to search for on the selected property.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Reference

Find Status Message Dialog Box

Concepts

About Status Message Properties and Property Values
ConfigMgr Status Message Viewer Overview


Assignment Schedule Dialog Box

Use the Assignment Schedule dialog box in Configuration Manager 2007 to specify a schedule for an advertised program that is mandatory for a specific collection. If the program has not been run on individual clients within the collection by the scheduled time specified in this dialog box, it will automatically run at that time.

The Assignment Schedule dialog box contains the following elements:

UI Element List

Assign to the following schedule

Specifies whether there is a specific schedule for the program assignment. If this option is selected, the advertised program is assigned according to the specified dates and times. This option is selected and scheduled to the current date and time with no recurrence by default.

To set a specific schedule for the assigned program, click the Schedule button. This opens the Custom Schedule dialog box and allows you to specify the schedule and recurrence pattern for the assignment. For more information about this dialog box, see Custom Schedule Dialog Box.

Note
If the advertised program is dependent on another program (that is, it is configured to run another program first), Configuration Manager 2007 will not automatically rerun the first program, even if the advertised program is on a recurring schedule.

Assign immediately after this event

Specifies that a specific event that must occur before the advertised program automatically runs on clients.

The following events are available if this option is selected:

  • As soon as possible: Specifies that the program will automatically run as soon as it reaches the client and all program requirements are met. This value is specified by default.
  • Logon: Specifies that the program will automatically run the next time a user logs on to the client.
  • Logoff: Specifies that the program will automatically run the next time a user logs off the client.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Tasks

How to Assign a Mandatory Advertisement

Concepts

About Advertisements

Other Resources

How to Manage Advertisements


Boundaries Dialog Box

Use the Boundaries dialog box to specify the protected site system boundaries for the selected site system. When a site system has been enabled as a protected site system, only clients located with the boundaries specified on this tab can access it.

Note
The site boundaries displayed in this dialog box only affect client communications to the distribution point and state migration point site system roles. Protected site system boundaries do not affect Configuration Manager client site assignment.

The Boundaries dialog box contains the following elements:

UI Element List

Boundaries

Displays the boundaries currently specified for this site system.

The following options are available for managing the boundaries of this site system:

  • New icon: Click to open the New Boundaries dialog box, which enables you to add a site boundary or roaming boundary for this distribution point.
  • Delete icon: Click to delete the selected boundary for this distribution point.
The following columns are displayed for each boundary currently specified for this protected site system:

  • Boundary: Specifies the boundaries currently utilized by this distribution point.
  • Type: Specifies the type of boundary being utilized.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Concepts

About Distribution Points
New Boundaries Dialog Box


Browse Active Directory Sites

This Microsoft System Center Configuration Manager 2007 dialog box contains the following elements.

Site Name

Specifies the name of the Active Directory Domain Services site that you want to include in the Configuration Manager 2007 boundaries.

Description

Specifies the description of the Active Directory Domain Services site, as defined in Active Directory Sites and Services.

Note
If you have not yet created additional sites in Active Directory Sites and Services, you have only one site called Default-First-Site-Name.

See Also

Concepts

Choose Configuration Manager Boundaries

Other Resources

Dialog Pages


Browse Collection Dialog Box

Use the Browse Collection dialog box in Configuration Manager 2007 to link a collection or to specify a target collection when creating an advertisement. This dialog box displays all the collections defined for a site.

The Browse Collection dialog box contains the following elements:

UI Element List

Collection

Specifies the name of the collection that you want to select for this operation, whether adding it as a linked collection or as a target collection.

To specify the collection, select the collection you want from the displayed list. Subcollections can be displayed by expanding the parent collection.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Tasks

How to Create a Subcollection

Reference

Advertisement Name Properties: General Tab

Concepts

About Collections
About Advertisements


Browse Distribution Point Group Dialog Box

Use the Browse Distribution Point Group dialog box in Configuration Manager 2007 to specify a distribution point group to which to apply a specific operation, such as distributing a software package.

The Browse Distribution Point Group dialog box contains the following elements:

UI Element List

Group

Specifies the distribution point group to which to apply the operation.

To specify a distribution group, select a group from the drop-down list of existing distribution group.

Members

Specifies the distribution points that belong to the selected group.

The following columns are displayed for users who currently have security rights for this class:

  • Site: Specifies the site code and server name where the distribution point exists.
  • Name: Specifies the server or volume name where the distribution point exists.
  • Type: Specifies the type of distribution point.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Concepts

About Distribution Points

Other Resources

Distribute Software Wizard
How to Manage Distribution Points


Browse Query Dialog Box

Use the Browse Query dialog box in Configuration Manager 2007 to specify an existing query statement to use or import into a Configuration Manager query. This is commonly used for operations such as importing a query into a query-based collection rule using the Query Rule Properties dialog box.

The Browse Query dialog box contains the following elements:

Query

Specifies the query to use or import. To specify a query, select the query you want from the displayed list. Only one query may be selected at a time.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Reference

Query Rule Properties Dialog Box

Concepts

Overview of Queries
Queries in Configuration Manager


Clone Dashboard Dialog Box

Use the Clone Dashboard dialog box in Configuration Manager 2007 to clone, or make a copy of, an existing dashboard. Once a unique name is specified for the new dashboard, the dashboard is created with the same properties as the source dashboard. The properties can then be modified to customize the dashboard to fit your needs. The Clone Dashboard dialog box contains the following elements:

Existing dashboard name

Specifies the name of the dashboard that is being cloned. This setting is read-only.

New dashboard name

Specifies the name of the new dashboard. The name must be unique. This is a required setting.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Modify Dashboard Properties

Concepts

About Configuration Manager Dashboards


Clone Report Dialog Box

Use the Clone Report dialog box in Configuration Manager 2007 to clone, or make a copy of, an existing report. Once a unique name is specified for the new report, the report is created with the same properties as the source report. The properties can then be modified to customize the report to fit your needs. The Clone Report dialog box contains the following elements:

Existing report name

Specifies the name of the report that is being cloned. This setting is read-only.

New report name

Specifies the name of the new report. The name must be unique within the report category. This is a required setting.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Modify Report Properties

Concepts

About Configuration Manager Reports


Clone ConfigMgr User Dialog Box

Use this dialog box to create new Microsoft System Center Configuration Manager 2007 security rights for a user or user group by copying the security rights of an existing user or user group and giving the copy a different name.

Important
All users of the Configuration Manager 2007 console must be members of the SMS Admins group, either directly or through group membership. Cloning existing users does not automatically add the new users to the SMS Admins group.

Existing user

The user or user group whose security rights you want to copy.

New user

The user or user group that will have the identical security rights as the user or user group in Existing user.

Class security rights

Gives the new user all the class security rights of the existing user.

Instance security rights

Gives the new user all the instance security rights of the existing user.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Note
If you specify instance rights only and instance rights do not exist for the original user, then the new user is not created.

See Also

Tasks

How to Assign Rights for Objects to Users and Groups

Concepts

Classes and Instances for Object Security in Configuration Manager
Overview of Configuration Manager Object Security and WMI


Collected File Properties Dialog Box

Use this dialog box to add or update search criteria that is used on clients during the software inventory collection process.

Name

Specify a complete file name. You can also specify a partial file name, and you can use the "?" and "*" wildcards as follows:

  • Use "?" to replace any one character.
  • Use "*" to replace zero or more characters.
Path

The client hard disk location where files are collected from. Path also determines whether subdirectories are searched. Click Set to open the Path Properties Dialog Box dialog box to set the disk locations to collect files from.

Location

Displays file collection locations. Locations include all client hard disks, a single path variable, or a path name. By default, All client hard disks is selected.

Search subdirectories

Indicates whether Location subdirectories are searched.

Exclude encrypted and compressed files

Indicates whether to collect encrypted and/or compressed files.

Maximum size (KB)

Specify the maximum file size, in KB, that Configuration Manager will collect. This is the maximum size of the file or files collected for this rule. If the total size of all the files that match this rule exceeds the specified limit, none of the files will be collected.

Note
Collecting large or numerous files can cause excessive network traffic.


Collection Limiting Dialog Box

Use the Collection Limiting dialog box in Configuration Manager 2007 to specify whether a query is limited to a specific collection or will run against all available collections. This dialog box is usually displayed when you run a query that has the Prompt for collection option.

The Collection Limiting dialog box contains the following elements:

Not Collection Limited

Specifies that the query will run without being limited to a specific collection.

Limit to Collection

Specifies that the query will run against only the given collection. If this option is selected, a collection must be specified.

To specify a given collection, type the collection name or click Browse to select a collection using the Browse Collection dialog box. For more information about this dialog box, see Browse Collection Dialog Box.

Note
When you limit a query to a collection, that query is limited only to the collection that you specify. Subcollections are not included in this collection, as they are actually separate collections that are simply linked to a parent collection.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Concepts

About Collections
About Subcollections
Overview of Queries
Browse Collection Dialog Box


Column Values Dialog Box

Use the Column Values dialog box in Configuration Manager 2007 to select a value for a selected column that will be inserted into a SQL statement when creating the SQL statement for a report or report prompt.

The Column Values dialog box contains the following elements:

View

Specifies the highlighted view. This is a read-only setting.

Column

Specifies the highlighted column. This is a read-only setting.

Values

Specifies the values that are currently available for the highlighted view and column. Select a value from the list to insert into the SQL statement.

Values shown

Specifies the number of values that are available in the Values list.

Filter

Specifies whether a filter has been configured to limit the values that are displayed in the Values list.

Set

Opens the Set Filter dialog box, where a filter can be configured to limit the values that are displayed in the Values list. For more information, see Set Filter Dialog Box.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Prompt SQL Statement Dialog Box
Report SQL Statement Dialog Box


Component Logging Control Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to enable logging for a component.

Logging enabled

Use to enable or disable logging.

Use same file for all selected components

This option is only available if multiple components are selected. Use this option to allow all selected components to log to the same file specified in Log filename.

Log filename

Path and file name that are used to specify where the log file is written.

Log size

Maximum size of the log file. When a log file grows larger than the specified value, older logging information is copied to a backup file in the same folder such as filename.lo~. New logging information continues to log to the file specified by Log filename.

See Also

Tasks

How to Enable Logging for a Component

Concepts

Using Configuration Manager Service Manager


Configuration Baseline Assignment Properties Dialog Box

Use the Configuration Manager 2007 Configuration Baseline Assignment Properties dialog box to view the assigned collections, enable or disable subcollections, and configure an assignment schedule for this configuration baseline if you do not want to use the default schedule that is configured in the desired configuration management client agent properties.

This tab contains the following elements:

Baseline name

Displays the name of the assigned configuration baseline.

Collection

Displays the collection name to which this configuration baseline has been assigned.

Include subcollections

Specifies whether the configuration baseline should also be assigned to subcollections of the specified collection.

Simple schedule

Specifies a simple schedule for this assigned configuration baseline, which will override the default schedule specified in the desired configuration management client agent properties. An example of a simple schedule is every 6 hours.

Run every

When the Simple schedule is specified, specifies the setting of the simple schedule. The default value is 7 days.

Custom schedule

Specifies a custom schedule for this assigned configuration baseline, which will override the default schedule specified in the desired configuration management client agent properties. An example of a custom schedule includes the start date and time, the duration, and the recurrence, such as every 12 hours. Use the Customize button to define the custom schedule.

Customize

Opens the Custom Schedule dialog box to specify the custom schedule for this assigned configuration baseline.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Configuration Baselines in Desired Configuration Management


Categories Dialog Box

Topic last updated -- November 2007

Use this dialog box to assign categories to Configuration Manager 2007 items, create new categories and delete existing categories.

This tab contains the following elements:

Add a new category

Use this box to specify the name of a new category to be added. You can create multiple categories by entering each on a separate line.

Available categories

Displays the available categories. You can select the categories you want to be assigned to an item.

Add

Adds new categories with the names specified in the Add a new category list box.

Delete

Deletes the selected category.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any category assignments that have been created. Any new categories that have been created are retained.

Help

Opens the associated help topic.

See Also

Tasks

How to Create Configuration Categories in Desired Configuration Management
How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management
How to Delete Configuration Categories in Desired Configuration Management
How to Use Assigned Configuration Categories in Desired Configuration Management

Concepts

About Configuration Categories in Desired Configuration Management
About the Driver Catalog


Configuration Manager Remote Control Dialog Box

You can use this dialog box to configure the Configuration Manager 2007 remote control settings.

  • Remote Control Properties: General Tab
  • Remote Control Properties: Notification Tab


Configure Validation Dialog Box

Use the Configure Validation dialog box to configure the validation criteria and noncompliance severity level for a configuration item's objects and settings.

This tab contains the following elements:

Name

Specifies the name of the validation. A unique name will be generated automatically. You can overwrite this with a name you choose. The name should be unique and descriptive.

Description

Specifies the description for the validation. The description should give an overview of the validation criteria and other relevant information that helps identify it among other validations in the Configuration Manager 2007 console.

Setting/Property

Displays the name of the setting or object property for which the validation rule is being configured.

Operator

Specifies one of the following operators. The available operators depend on the data type of the setting/property and might include:

  • Equals
  • Not equals
  • One of
  • Greater than
  • Less than
  • Between
  • None of
  • Greater than or equal to
  • Less than or equal to
The default value is Equals.

Value

Specifies the value to use with the selected Operator.

Note
You cannot include Windows environment variables in the validation criteria.

AND

Specifies an optional additional value to use with the selected Operator. This item is only displayed if the operator is set to Between.

Expression

Displays the complete validation rule expression by concatenating the contents of the following fields:

  • Setting/Property
  • Operator
  • Value
  • And (if operator is set to Between)
  • Second Value (if operator is set to Between)
Severity

Specifies the severity value if validation fails on client computers. This severity level will be displayed in conjunction with the non-compliance status.

Available severity levels:

Information - no Windows event message: Client computers that are out of compliance with this validation will not raise Windows events to record this event but will still report a non-compliance status in Configuration Manager 2007.

Information: Client computers that are out of compliance with this validation will raise the Windows event type of Information. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.

Warning: Client computers that are out of compliance with this validation will raise the Windows event type of Warning. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.

Error: Client computers that are out of compliance with this validation will raise the Windows event type of Error. In addition, these computers will record this severity status in conjunction with their noncompliance status in Configuration Manager 2007.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About the Non-Compliance Severity Level in Desired Configuration Management


Confirm Deletion Dialog Box

Use the Configuration Manager 2007 Confirm Deletion dialog box to specify whether or not, after reviewing the effects, you want to keep or delete the configuration baseline or the configuration item.

This dialog box contains the following elements:

Name

Displays the name of the selected configuration baseline or configuration item.

Version

Displays the version number of the selected configuration baseline or configuration item.

Description

Displays the description of the selected configuration baseline or configuration item.

Show/Hide

Specifies whether or not to display the effects of deleting the selected configuration baseline or configuration item.

Assignments

Displays any assignments that will be deleted if you delete the selected configuration baseline.

This tab is visible if the Show button has been pressed and you are reviewing the effects of deleting a configuration baseline.

Dependent Baselines

Displays any configuration baselines that have dependencies to the selected configuration baseline and will be updated if you delete the selected configuration baseline or configuration item.

This tab is visible if the Show button has been pressed and you are reviewing the effects of deleting a configuration baseline or a configuration item.

Child Items

Displays any child configuration items which will also be deleted if you delete the selected configuration item.

This tab is visible if the Show button has been pressed and you are reviewing the effects of deleting a configuration item.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Delete a Configuration Baseline in Desired Configuration Management
How to Delete a Configuration Item in Desired Configuration Management


Connect to Site Dialog Box

Site Server

Specify the NetBIOS name of the computer that is performing the Microsoft System Center Configuration Manager 2007 site server role for the site to which you want to connect ConfigMgr Service Manager.

See Also

Concepts

How to Connect to a Site
Using Configuration Manager Service Manager


Custom Schedule Dialog Box

Use the Custom Schedule dialog box in Configuration Manager 2007 to schedule the start, recurrence pattern, and duration of a Configuration Manager operation.

Depending on the feature from which it is launched, the Custom Schedule dialog may vary significantly in the details displayed. In some cases, recurrence pattern options may not be displayed, in others, the Time option displays the duration of the operation, rather than the start date and time.

The Custom Schedule dialog box contains the following elements:

UI Element List

Name Description

Name

Specifies the name of the specific instance of this operation. For example, if the operation is a maintenance window, it will indicate the name of that particular instance (or recurring series) of the maintenance window.

Time

Specifies the start date and time or duration of the operation.

The specific controls displayed will vary considerably, depending on the operation from which it is launched. In some cases, a duration field will be displayed, and will allow for direct configuration; in other cases, it will only reflect fields being changed elsewhere in the dialog box, or will not be displayed at all.

Depending on the type of operation, the option to set the start date and time to UTC time might be available. If this option is present and selected, the start date will be set according to Coordinated Universal Time instead of local time.

Recurrence Pattern

Specifies how often this operation recurs.

The following options are some of those that might be available for setting a recurrence pattern:

  • None: Specifies that the operation does not recur.
  • Weekly: Specifies that the operation recurs every N weeks. If this option is selected, you must specify the day of the week on which the operation will occur.
  • Monthly: Specifies that the operation recurs every N months. If this option is selected, you must specify the day of the month on which the operation will occur.
  • Custom interval (varies depending on the recurrence pattern selected): Specifies the frequency with which the operation will recur. You may set this in terms of minutes, hours, or days, with the following available values:
    • Minutes: Values from 1 to 59 minutes, inclusive.
    • Hours: Values from 1 to 23 hours, inclusive.
    • Days: Values from 1 to 31 days, inclusive.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.


Default Limited Remote Tools Settings Dialog Box

Use this dialog box to specify Remote Tools Client Agent settings, if you select Limited Remote Tools access in the Policy tab.

View client screen and control its keyboard and mouse

Specifies that administrators can view the client screen and control the client keyboard and mouse.

Run commands on client computer

Specifies that administrators can run commands on clients. Run commands by using the client's default path, which is specified in the client's Control Panel.

Transfer files to and from client computer

Specifies that administrators can transfer files to and from clients.

Restart client computer

Specifies that administrators can restart clients.

Exchange text messages with client (chat)

Specifies that administrators can initiate chat sessions with clients.

View client computer configuration

Specifies that administrators can view diagnostic information and ping clients.

See Also

Tasks

How to Configure the Configuration Manager 2007 Remote Tools Client Agent


Define XML Namespace Dialog Box

Use the Configuration Manager 2007 Define Xml Namespace dialog box to specify a new prefix and namespace to be used by the XML query in this configuration item.

This dialog box contains the following elements:

Prefix

Specify a valid XML prefix name.

Namespace

Specify the name of a valid XML namespace.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.


Define XML Namespaces Dialog Box

Use the Configuration Manager 2007 Define Xml Namespaces dialog box to view, add and edit prefix and namespace declarations for the XML query being used in the configuration item setting.

This dialog box contains the following elements:

Prefix and namespace list

Displays a list of XML prefixes and namespaces specified for this configuration item setting.

Add

Opens the Define Xml Namespace dialog box which allows you to specify a new XML prefix and namespace for the configuration item setting.

Edit

Opens the Define Xml Namespace dialog box which allows you to edit an existing XML prefix and namespace for the configuration item setting

Remove

Deletes the selected prefix and namespace.

Note
You are not asked to confirm this deletion.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.


Delete Confirmation Dialog Box

Topic Last Updated—August 2008

Use the Delete Confirmation dialog box in Configuration Manager 2007 to verify that the resource record or records selected for deletion should, in fact, be deleted. This does not affect the resource itself, but removes the data discovery record (DDR) for that resource from the Configuration Manager site database.

Note
If the resource is one that would be detected by one of the enabled discovery methods running in Configuration Manager, this resource DDR will reappear the next time that discovery method runs.

The Delete Confirmation dialog box contains the following elements:

System Resources

Specifies the specific system resources that are set to be deleted.

The following columns are displayed, showing system resource information:

  • Name: Specifies the name of the system resource.
  • Active Computer Association: Specifies whether the resource has any active computer associations attached to it.
  • Migration Complete: Specifies whether the operating system deployment migration is complete, if that deployment has been started. This value defaults to No if no migration deployment has been triggered.
Delete

Deletes all listed system resources and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

About Resources


Delete Confirmation Dialog Box - Operating System Deployment

This dialog box alerts you that deleting this operating system deployment item will affect all associated objects. You should review the effects of this deletion before committing this action.

Name | Description
Show Detail | Displays the references that are associated with this object. The associated Name, Comment, and Creation Date are also displayed.


Delete Confirmation Dialog Box - Task Sequence

This dialog box warns you that deleting this task sequence item will affect all associated objects. Make sure that you know the effects of the deletion before confirming it.

Name | Description
Show Detail | Displays the references that are associated with this object. The Name, Comment, and Creation Date associated with the object also display.


Delete Report Dialog Box

Use the Delete Report dialog box in Configuration Manager 2007 to confirm whether you really want to delete the specified report. The dialog box displays the reports that use the specified report as a link target or as a report in a dashboard. Other reports or dashboards that are not listed might use this report, but they are displayed because the user does not have Read rights to those objects.

When a report is deleted, the report object is removed from the site database, resulting in the following changes to the report's status:

  • It no longer appears in the report list in the Configuration Manager console or Report Viewer.
  • It no longer appears in dashboards in which it was included.
  • It is no longer available to source reports that use the deleted report as the target for a link. The report link in the source report no longer works when the target report is deleted, and the link should be removed or reconfigured.

When deleting a report that is used as a link target in another report, you must change the link target in the report to a valid resource. Otherwise, the link will open a Web browser and display an error when attempting to load the deleted report.

When deleting a report that has been added to a dashboard, the dashboard properties must be modified or the position in the dashboard that lists the deleted report appear blank.

The Delete Report dialog box contains the following elements:

Objects

Specifies the reports that use this report as a link target and dashboards that display this report. The following properties are displayed:

  • Name: Specifies the name for the report or dashboard.
  • Type: Specifies whether the object is a report or dashboard.
  • ID: Specifies the ID for the report or dashboard.
Yes

Deletes the report, and exits the dialog box.

No

Exits the dialog box without deleting the report.

See Also

Tasks

How to Modify Dashboard Properties
How to Modify Report Properties


Disable Device Driver

When you disable a device driver, no Configuration Manager 2007 client computers can install the disabled device driver. You can disable a device driver if a newer version is available or if you want to temporarily suspend the device driver's availability.

Important
If a current operating system deployment is in progress, some of the target computers may still be able to install the device driver after the device driver has been disabled.

The driver that will be disabled is displayed in the window as well as its associated Name, Provider, and Class information.

See Also

Concepts

Enable Device Driver


Disconnect from Sites Dialog Box

Disconnect from sites

Select the Microsoft System Center Configuration Manager 2007 site codes of the sites from which you want to disconnect ConfigMgr Service Manager.

See Also

Tasks

How to Disconnect a Site

Concepts

Using Configuration Manager Service Manager


Display Name Properties Dialog Box

Use this dialog box to specify a name to add to the Display name list on the Inventory Names tab, or to modify an existing display name. All associated inventoried names in the Inventoried names list will then be changed to this display name.

The Display Name Properties dialog box contains the following elements:

Display name

Specifies the manufacturer name or product name to change inventoried names to, up to 50 characters.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Software Inventory Client Agent Properties: Inventory Names Tab


Domain Properties Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to specify a domain to be searched by Network Discovery.

Domain information

Specifies a domain.

Domain

A domain to be searched by Network Discovery. You can use up to 15 characters, but these characters are prohibited: " / \ [ ] : ; | = , + * ? < > Also, you cannot use spaces or use a period (.) as the first character.

Enable domain search

Enables Network Discovery in this domain. This domain's status (enabled or disabled) is shown on the Network Discovery Properties: Domains Tab tab of the Network Discovery dialog box. By default, this check box is selected.

See Also

Tasks

How to Configure Network Discovery

Reference

Network Discovery Properties: Domains Tab


Enable Device Driver

When you enable a device driver, any Configuration Manager 2007 client computer can install the device driver until it has been disabled. The device driver that will be enabled displays in the Enable Device Driver dialog box along with the associated Name, Provider, and Class information.

To enable the device driver, click Yes.

See Also

Concepts

Disable Device Driver


Enter Group or User Name Dialog Box

Use the Configuration Manager 2007 Enter Group or User Name dialog box to specify Windows user names or groups to include in the validation of object permissions.

This dialog box contains the following elements:

Enter the Group or User Name

Specify the Windows user or group name you want to configure security permissions for in the form DOMAIN\USER.

Note
If you are specifying the name of a built in group or user, use the form BUILTIN\USER.

Select the type of access control for this group or user

Specify whether you want to configure Allow or Deny permissions for this group or user:

Allow specifies that the selected group or user is configured to allow the security permission.

Deny specifies that the selected group or user is configured to deny the security permission.

See Also

Reference

Object Properties: Permissions Tab

Other Resources

Overview of Desired Configuration Management


Filter Status Messages Dialog Box

Use the Configuration Manager 2007 Filter Status Messages dialog box to filter the currently displayed status messages and display only those messages that meet the filter criteria. Note that status message filters cannot be saved for reuse. However, status message queries can be saved for reuse.

This dialog box contains the following elements:

Filter

Specifies the search criteria. Matches are made by string comparisons in the corresponding status message fields except Severity and Type. The asterisk (*) wildcard character is allowed in all fields and is especially useful in the Description field. Without wildcards, you would have to type the complete description to get a match.

An empty field matches all status message values for that field.

Severity

Specifies the severity of the message to find from the drop-down list. The following items are available:

  • <Any>
  • Information
  • Warning
  • Error
The default value is <Any>.

Type

Specifies the type of message to find from the drop-down list. The following items are available:

  • Any
  • Milestone
  • Detail
  • Audit
The default value is <Any>.

Site code

Specifies the Configuration Manager 2007 or SMS 2003 site code of the site where the status message was generated.

Component

Specifies the component that generated the status message (for example, SMS_SCHEDULER).

System

Specifies the name of the computer that generated the status message.

Message ID

Specifies the status message ID you want to find.

Description

Specifies the text of the status message you want to find. The maximum length of this field is 255 characters. When displaying results, the viewer displays only the first 12 characters of the string that is being used as a filter.

Advanced

Opens the Advanced Filter Options dialog box, which enables you to specify additional filter criteria.

Clear All

Resets all fields.

OK

Exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Reference

Advanced Filter Options Dialog Box

Concepts

About the Difference Between Filters and Queries
ConfigMgr Status Message Viewer Overview


Find Status Message Dialog Box

Use the Configuration Manager 2007 Find Status Message dialog box to find the next message in Status Message Viewer that meets the criteria you specify. The search starts from the currently selected message (or the last message in a multiple selection). Only the status messages which are currently displayed in the status message viewer window are searched.

This dialog box contains the following elements:

Find

Specifies the search criteria. Matches are made by string comparisons in the corresponding status message fields except Severity and Type. The asterisk (*) wildcard character is allowed in all fields and is especially useful in the Description field. Without wildcards, you would have to type the complete description to get a match.

An empty field matches all status message values for that field.

Severity

Specifies the severity of the message to find from the drop-down list. The following items are available:

  • <Any>
  • Information
  • Warning
  • Error
The default value is <Any>.

Type

Specifies the type of message to find from the drop-down list. The following items are available:

  • Any
  • Milestone
  • Detail
  • Audit
The default value is <Any>.

Site code

Specifies the Configuration Manager 2007 site code of the site where the status message was generated.

Component

Specifies the component that generated the status message (for example, SMS_SCHEDULER).

System

Specifies the name of the computer that generated the status message.

Message ID

Specifies the status message ID you want to find.

Description

Specifies the text of the status message you want to find. You can use the asterisk wildcard for partial matches (for example, "updat*" matches any message with "update", "updated", or "updating" in its description).

Search

Specifies the direction in which to search when Find Next is clicked.

Up

Searches up from the current message.

Down

Searches down from the current message.

All

Searches down from the first message.

Advanced

Opens the Advanced Find Options dialog box, which enables you to specify additional search criteria.

Find Next

Finds the next status message that matches all the criteria (uses the direction specified in the Search box).

Clear All

Resets all fields.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Find Status Messages

Concepts

ConfigMgr Status Message Viewer Overview


Folders Dialog Box

Folders are used to Microsoft System Center Configuration Manager 2007 group objects. You can create standard folders and move objects into the folder, or you can create search folders, which are a virtual representation of all objects that meet your search criteria.

The following types of objects can be grouped within folders:

  • Packages
  • Advertisements
  • Software metering rules
  • Reports
  • Queries
  • Boot images
  • Computer associations
  • Operating system images
  • Task sequences
  • Drivers
  • Driver packages
  • Configuration packages

The Folders dialog box contains the following element:

Name

The name of the folder. Folder names must be less than 127 characters and must not contain any of the following characters:

/ | \ : * ? " < >

See Also

Tasks

How to Manage Folders

Concepts

About Folders and Search Folders


Generic Account Dialog Box

Use the Generic Account dialog box in Configuration Manager 2007 to specify a generic account that should be given to access a package on distribution points.

Generic access accounts are mapped to actual user or group accounts specific to the network operating systems of individual distribution points.

The following generic accounts are available for use:

Name | Description
Users | Specifies that the generic account is a user account with read-only rights. The Users account is mapped to the local Users account. A generic Users account is created for each package by default.
Guests | Specifies that the generic account is a guest account with read-only rights. The Guests account is mapped to the local Guests account. A generic Guests account is created for each package by default.
Administrators | Specifies that the generic account is an administrator account with full control rights. The Administrators account is mapped to the local Administrators account. A generic Administrators account is created by default.
Caution
Do not remove the generic Administrators account without specifying one or more package access accounts that provide the Configuration Manager service account full control on all necessary distribution points. Failure to do so will mean that the Distribution Manager component will be unable to install, update, or remove the package on distribution points.

See Also

Concepts

About Package Access Accounts

Other Resources

How to Manage Packages


Input Query Value Dialog Box

Use the Input Query Value dialog box in Configuration Manager 2007 to specify the variable parts of a query that you want to run.

Although there can be any number of user-defined variables, the following query variables are defined by Configuration Manager:

Software Files.File Name

Specifies the software file name.

Software Files.File Size

Specifies the files size in number of bytes. Matching files will be exactly this size.

Software Products.Product Name

Specifies the software product name.

Software Products.Product Version

Specifies the software product version.

System.TimeStamp

Specifies a date and time timestamp.

System Resource.Last Logon User Name

Specifies the user account last used to log on the system resource.

System Resource.Name

Specifies the name of the system resource.

See Also

Concepts

Overview of Queries
About Query Criterion Values


Inventoried File Properties Dialog Box

Use this dialog box to add or update the search criteria that are used to inventory files during software inventory.

Name

Specify one complete file name. You can also specify one partial file name and use the '?' and '*' wildcards as follows:

  • Use '?' to replace any one character.
  • Use '*' to replace zero or more characters.
Examples:

Winword.exe

Winwor?.exe

Winword*

Path

The client hard disk location where files are inventoried from. Path also determines whether subdirectories are searched. Click Set to open the path properties dialog box so that you can update file path settings.

Location

Displays inventoried file location. Locations include all client hard disks, a single path variable, or path name. By default, All client hard disks is selected.

Search subdirectories

Indicates whether Location subdirectories are searched.

Exclude encrypted and compressed files

Indicates whether to search for encrypted and/or compressed files.

Note
While software inventory is capable of inventorying encrypted and compressed files, software inventory may run much slower due to the additional processing required. When encrypted files are inventoried, an unencrypted copy of the file must be created to inventory. In addition, if antivirus software is running on the client machine, the antivirus software will detect the inventory agent opening the files scanned by software inventory and will rescan them to ensure they are not infected with a virus.

Exclude files in the Windows directory

Indicates whether to search for files in the Windows directory. If you select this option, the Search subdirectories option is ignored.

See Also

Tasks

How to Configure Software Inventory for a Site


Inventoried File Properties (Mobile Devices)

The Inventoried File Properties dialog box displays the file or set of files that will be inventoried and sent to the device management point. Wildcard characters may be used to inventory sets of files. For example, *.exe will inventory all file names ending in .exe on the mobile device. Hello?World.dll will inventory all files whose name includes any single character in place of the '?'.

Name

The name of the collected file or files to be inventoried. Wildcard characters can be used to inventory sets of files.

Location

The directory on the client mobile device of the files to be inventoried. To select a location other than the root directory of the mobile device click Set… and specify the directory.

Search subdirectories

Defines whether files in subdirectories of the Location directory will be inventoried. To specify that subdirectories should not be searched click Set… and clear the Search subdirectories checkbox.

Exclude encrypted and compressed files

Defines whether encrypted and compressed files will be included in the inventory of files.

See Also

Concepts

Path Properties Dialog Box


Inventory Name Properties Dialog Box

Use this dialog box to specify a name to add to the Inventoried names list. You can add a new entry to the Inventoried names list up to 50 characters long. Wildcard characters can be used to match variations of a name.

The Inventory Name Properties dialog box contains the following elements:

Inventory Name

Allows you to add a new entry to the Inventoried names list up to 50 characters long. You can use wildcard characters to match variations of a name.

OK

Saves any changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

Using Wildcard Characters

You can use the following wildcard characters:

Wildcard | Searches for
% (percent sign) | Any string of zero or more characters. For example: Mo% searches for all names that begin with the letters mo (Mom, Morgan), %mo searches for all names that end with mo (Satchmo), and %mo% searches for all names that include mo (Mom, Satchmo, tomorrow).
_ (underscore) | Any single character. For example: _ill searches for any four-letter names ending with the letters ill (Mill, Will)
[] (brackets) | Any single character within the specified range. For example: [HD]an[eo]n searches for all names that begin with H or D, then an, then e or o, and then end with n (Hanson, Hansen, Danson, Dansen); [B-K]enson searches for all names ending with enson that begin with any single letter from B through K (Benson, Jenson)
[^] (caret) | Any single character not within the specified range. For example: M[^c]% searches for all names beginning with the letter M that do not have the letter c as the second letter (MacPherson)

To use the %, _, [], or [^] characters as literal characters instead of wildcard characters, do the following:

Use square brackets around the percent sign, the underscore, and the open bracket [%], [_], and [[].

For example:

  • 5[%] searches for 5%
  • [_]n searches for _n
  • [[] searches for [

Use the close bracket by itself.

For example:

  • ] searches for ]

Use the dash as the first character inside a set of square brackets.

For example:

  • [-acdf] searches for -, a, c, d, or f

See Also

Reference

Software Inventory Client Agent Properties: Inventory Names Tab


ISV Proxy Certificate Registration or Renewal Dialog Box

Use the Configuration Manager 2007 ISV Proxy Certificate Registration or Renewal dialog box to register or renew the certificate for the ISV Proxy.

Independent software vendor (ISV) solutions might have specific requirements. Register or renew an ISV Proxy certificate only after you consult the appropriate ISV documentation.

In general, the ISV Proxy certificate and the related Configuration Manager 2007 infrastructure allow an ISV to develop solutions for client platforms that are not directly supported by Configuration Manager 2007. Detailed information regarding the ISV Proxy certificate and its use in client communications can be found in the System Center Configuration Manager 2007 Software Development Kit (SDK).

This dialog box contains the following elements:

Register Certificate for a New ISV Proxy

Specifies the action of registering a certificate for a new ISV Proxy.

Renew Certificate for an Existing ISV Proxy

Specifies the action of renewing a certificate for an existing ISV Proxy.

Certificate Issued To

Lists the ISV Proxy certificates that are available for renewal from the certificate store on the site server so that you can select the certificate to be renewed from the list of certificates displayed.

Certificate

Specifies the signing certificate for the ISV Proxy.

If you have selected the certificate, the dialog box displays either the friendly name of the certificate if the certificate has a friendly name, or <No friendly name> if the selected certificate does not have a friendly name.

If you have not yet selected the certificate, click Browse to select it.

This certificate is used by the ISV Proxy to sign client communications.

Browse

Browses to a specified location so that you can select the ISV Proxy signing certificate.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Concepts

Overview of Configuration Manager Cryptographic Controls


Item Name Dialog Box

Use the Configuration Manager 2007 Item Name dialog box to specify a name for a duplicate configuration baseline or configuration item.

This dialog box contains the following elements:

Name

Specify a name for the duplicated configuration baseline or configuration item. The default value is the original name with a sequential number in parentheses as the suffix.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Tasks

How to Use Meaningful Names in Desired Configuration Management

Other Resources

Overview of Desired Configuration Management


Move Items Dialog Box

Use this dialog box to move objects, folders, or subfolders to another folder.

Move item into container

Name of the folder to where you want the objects moved.

Move

Moves the folder.

Cancel

Exits the dialog box without saving any changes.

See Also

Tasks

How to Move Folder Objects


Network Settings Dialog Box

You can configure the following network settings with the Apply Network Settings task sequence step:

  • General
  • DNS
  • WINS
  • TCP/IP Filtering

In this Section

Network Settings - General

Network Settings - DNS

Network Settings - WINS

Network Settings - TCP/IP Filtering

See Also

Concepts

Network Settings - General
Network Settings - DNS
Network Settings - WINS
Network Settings - TCP/IP Filtering


Network Settings - General

You can configure how the Configuration Manager 2007 client will obtain an IP address on the General tab. There is no limit to how many IP addresses that can be configured. This setting is useful if this computer connects to a single physical network but requires advanced IP addressing because of either of the following reasons:

  • A single logical IP network is in use and the computer needs to use more than one IP address to communicate on that network.
  • Multiple logical IP networks are in use and the computer needs a different IP address to communicate with each of the different logical IP networks.

You can configure the following settings:

Setting |
Name | Specify a name for the network connection.
Obtain an IP address automatically | Select this option to configure the Configuration Manager 2007 client to obtain an IP address from a DHCP server.
Use the following IP address | Select this option to assign a static IP address to the Configuration Manager 2007 client computer. You can assign as many IP addresses as you want.

To add a new IP address or Gateway, click the New button to launch the dialog box and enter the IP address or subnet information. When entering a new IP address you must also specify the appropriate subnet mask.


Network Settings - DNS

You can specify the Domain Name Servers (DNS) that the Configuration Manager 2007 client computer will query to resolve DNS domain names on the DNS tab. The DNS servers will be queried in the order that they are listed. The local setting will only be used if the associated Group Policy is disabled or unspecified.

You can configure the following settings:

Setting | Description
Obtain DNS servers automatically | Select this option to configure the Configuration Manager 2007 client to obtain DNS server information automatically from a DHCP server.
Use the following DNS servers | Select this option to manually configure the DNS servers that the Configuration Manager 2007 client computer will use. The Configuration Manager Client will query the DNS servers in the order they are specified. To add a new DNS server, click the New button and enter the IP address.
DNS Suffix | Specify the DNS suffix that should be used by the Configuration Manager 2007 client computer's connection.
Register this connection's addresses in DNS | Select this option to specify if the computer should register the connection IP addresses in DNS.
Use this connections DNS suffix in DNS registration | Select this option if the connection's DNS suffix should be registered in DNS.


Network Settings - WINS

You can specify the WINS servers that will be used by the Configuration Manager 2007 client to resolve NetBIOS names on the WINS tab. The WINS servers will be queried in the order that they are specified.

To add a new WINS server IP address, click the New button to launch the TCP/IP WINS server dialog box. Enter the IP address of the WINS server.

You can configure the following settings:

Setting | Description
Enable LMHOSTS lookup | Select this option to allow the Configuration Manager 2007 client to use an LMHOSTS file. The LMHOSTS file is one method of name resolution for NetBIOS name resolution for TCP/IP networks.
Enable NetBIOS over TCP/IP | Select this option to allow NETBIOS over TCP/IP. This setting will allow NetBIOS traffic, regardless of any DHCP settings. This is the default setting for remote connections (dial-up or virtual private network).
Disable NetBIOS over TCP/IP | Select this option to disable NetBIOS traffic over a TCP/IP network regardless of the DHCP settings specified.


Network Settings - TCP/IP Filtering

You can specify whether TCP/IP filtering is enabled for this adapter on the TCP/IP filtering tab. TCP/IP filtering specifies the types of incoming traffic destined for this computer.

You can configure the following settings:

Setting | Description
Enable TCP/IP filtering | Select this option to enable TCP/IP filtering for this network adapter. This setting is not selected by default.
All TCP ports | Select this option to filter traffic on all TCP ports.
Some TCP ports | Select this option to filter traffic on specific TCP ports. To add a new port for filtering, click the Add button and enter the port number. To remove a port number, click the port you want to remove and then click the Remove button.
All UDP ports | Select this option to filter traffic on all UDP ports.
Some UDP ports | Select this option to filter traffic on specific UDP ports. To add a new port for filtering, click the Add button and enter the port number. To remove a port number, click the port you want to remove and then click the Remove button.
All IP protocols | Select this option to filter traffic on all IP protocols.
Some IP protocols | Select this option to filter traffic for specific IP protocols. To add a new protocol for filtering, click the Add button and enter the protocol. To remove a protocol, click the protocol you want to remove and then click the Remove button.


New Active Directory Container Dialog Box

This is a common dialog box, we cannot provide help topics for it.

Location

The location to browse for an Active Directory container.

Local Domain

Indicates that you want to browse for Active Directory containers in the domain where the computer running the Configuration Manager 2007 console resides.

Local Forest

Indicates that you want to browse for Active Directory containers in the forest where the computer running the Configuration Manager 2007 console resides.

Custom LDAP or GC query

Indicates that you want to browse for Active Directory containers using a Lightweight Directory Access Protocol (LDAP) query or global catalog (GC) query. This option activates Browse.

Path

Enter an LDAP query command to find an Active Directory container within a particular domain, or enter a GC query command to find an Active Directory container within multiple domains.

Browse

Opens the Select New Container dialog box, where you can select a single Active Directory container.

Search options

Allows you to specify whether to use recursive searches and whether Active Directory groups are searched.

Recursive

Default. When selected, indicates that Active Directory discovery searches child containers. Otherwise, child containers are not searched.

Include groups

When selected, Active Directory discovery discovers objects within groups. The consequence of discovering objects within groups is that the likelihood of discovering the same object more than once is increased. Also, when include groups is selected, you can discover objects in other domains. When include groups is not selected, duplicate objects and objects in other domains are less likely to be found. This results in the discovery process completing more quickly.

See Also

Concepts

About Active Directory System Discovery
About Active Directory User Discovery
About Active Directory System Group Discovery


New Boundaries Dialog Box

Use the New Boundaries dialog box to assign an existing boundary to a protected site system.

The New Boundaries dialog box contains the following elements:

UI Element List

Boundaries

Displays the boundaries currently available to be selected for this protected site system.

To specify a boundary for the site system, select a boundary and then click OK.

The following columns are displayed for each boundary available to be selected for the site system:

  • Boundary: Specifies the boundaries available to be utilized by this site system.
  • Type: Specifies the type of boundary.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Concepts

Boundaries Dialog Box


New Computer Association

The New Computer Association dialog box allows you to view the properties associated with a computer association.

Computer Association

Adds a new computer association to the current folder.

To search within existing collections for a source or destination computer, click Search to open the Search Computer dialog box. To search in a specific collection, click Browse. To perform an advanced search click Advanced and specify the additional search criteria. The optional criteria can include the following information: Resource class, Attribute name, and Value. To start the search, click Search.

User Accounts

Specifies which source computer user accounts should be migrated to the destination computer. If no user accounts are specified, all accounts on the source computer will be migrated.

Click New to open the Add user account dialog box. Type in the user account that should be migrated or click Search to search for a user. To remove a user account, click Delete.

See Also

Reference

Multiple Matches - Confirm
Operating System Deployment: Computer Association Node


Multiple Matches - Confirm

More than one computer has matched the information you have entered. Use the Multiple Matches - Confirm dialog box to select the individual computer you want to create the association with.


New DHCP Server Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to specify a Microsoft DHCP server to be added to the table on the DHCP tab of the Network Discovery Properties dialog box. For more information, see About DHCP Servers and Network Discovery.)

IP address

The IP address (for example, 131.24.10.3) of a Microsoft DHCP server on your network. If a name is specified, it must resolve to an IP address.

See Also

Tasks

How to Configure Network Discovery


New Domain Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to specify a domain to add to the Domains list.

Domain name

The name of a domain, up to 15 characters.

The following characters are prohibited: " / \ [ ] ; : | = + * ? , < >


New File Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to specify a file that you add to the list of How to View Files Collected From Clients from clients during software inventory.

Name

Specify a complete file name. By default, no files or file types are listed. You can also specify a partial file name, and use the '?' and '*' wildcard characters (except *.*), as follows:

  • Use '?' to replace any one character.
  • Use '*' to replace zero or more characters.
Important
Be careful when using wildcard characters in a file name. Collected files, especially large ones, require a lot of disk space to process on clients, take longer to process, and use up disk space on the site server. Collecting multiple files amplifies these issues. You can specify a long file name (the maximum name length is 255 characters). However, file names are not case-sensitive, and the following characters are prohibited: \ / : " < > |

Path

The full file path or system environment variable searched.

Subdirectories

Indicates whether Path subdirectories are searched.

Size (KB)

The maximum size allowed for collected files, in KB, that Configuration Manager 2007 collects from a client during a software inventory cycle. The value is determined by Maximum size (KB) in the Collected File Properties Dialog Box dialog box.

Exclude

Indicates whether to collect encrypted and compressed files are excluded from collection. You can change this value in the Collected File Properties Dialog Box dialog box.

Note
Configuration Manager 2007 collects files as large as 20 MB. However, large files adversely affect inventory collection performance, particularly when they are collected from many clients in a site.


New Folder Dialog Box

Folders are used to group Microsoft System Center Configuration Manager 2007 objects. The following types of Microsoft System Center Configuration Manager 2007 objects can be grouped with folders:

  • Packages
  • Advertisements
  • Software metering rules
  • Reports
  • Queries
  • Boot images
  • Computer associations
  • Operating system images
  • Task sequences
  • Drivers
  • Driver packages
  • Configuration packages

The Folders dialog box contains the following element:

Name

The name of the folder. Folder names must be less than or equal to 126 characters and must not contain any of the following characters:

/ | \ : * ? " < >

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Concepts

About Folders and Search Folders


New Permitted Viewer Dialog Box

Use this dialog box to specify the administrators who are permitted to start Remote Tools sessions on client computers running operating systems in the Windows Server 2003 family, Windows XP, Windows 2000, or Windows NT 4.0 operating systems.

User or group name

Users and user groups who can initiate Remote Tools sessions. These groups are global, not local. You can add these names to the Permitted viewers table. Specify the information in a domain_name\user_name or domain_name\group_name format, or just type the user or group name. The account name is not verified at this point, so ensure that it is typed correctly.

See Also

Tasks

How to Configure the Configuration Manager 2007 Remote Tools Client Agent

Reference

Remote Tools Client Agent Properties: Security Tab


New Roaming Boundary Dialog Box

Use this dialog box to include IP subnets, IP address ranges, and Active Directory sites within the roaming boundaries of a site.

UI Element List

This dialog box contains the following elements:

Boundary type

Specifies the area of the network that provides distribution point access for roaming clients.

The following options are available:

  • IP subnet: Specifies an Internet Protocol subnet. You must specify the IP subnet in the Subnet ID field.
  • Active Directory site: Specifies an Active Directory Domain Service site. You must specify the Active Directory site name in the Site name field.
  • IP address range: Specifies the range of IP addresses that you want to include in the site boundary. You must specify the starting and ending IP address in the Starting IP address and Ending IP address fields.
    IP address ranges are most useful for clients that access RAS or VPN servers. Because clients connecting to RAS and VPN servers typically have an IP subnet mask of 255.255.255.255, every address is equivalent to a subnet.
Subnet ID

Specifies the subnet providing distribution point access. This option is available only when the IP subnet option is selected.

Site name

Specifies the name of the Active Directory Domain Services site providing distribution point access (maximum 63 characters). This option is available only when the Active Directory site option is selected.

Starting IP address

Specifies the IP address that represents the beginning of the range you want to set for the site boundary. This option is available only when the IP address range option is selected.

Ending IP address

Specifies the IP address that represents the end of the range you want to set for the site boundary. This option is available only when the IP address range option is selected.

Designate this boundary as a local roaming boundary

Specifies whether this boundary will be considered as a local roaming boundary by Configuration Manager.

Designate this boundary as a remote roaming boundary

Specifies whether this boundary will be considered as a remote roaming boundary by Configuration Manager.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Concepts

About Client Roaming in Configuration Manager


New Server Share Site System Dialog Box

Use the New Server Share Site System dialog box in Configuration Manager 2007 to identify the server share you want to use as a site system.

The New Server Share Site System dialog box contains the following elements:

Name

Displays the name of the server share.

An example of a server share is: \\MyServer\MyShare

You can use up to 15 characters for the server name, but the following characters are not allowed:

/ \ [ ] : ; | = , + * ? " < >

You can use up to 255 characters for the share name, but the following characters are not allowed:

/ \ : | * ? " < >

See Also

Tasks

How to Add a New Site System

Other Resources

New Site System Server Share Wizard


New Boundary Dialog Box

Configuration Manager 2007 sites are defined by boundaries. Boundaries are defined by IP subnets, Active Directory site names, IPv6 prefixes or Internet Protocol (IP) ranges. Clients are assigned to a specific Configuration Manager 2007 site based on the boundaries you specify.

When adding boundaries to a site, you should ensure that each site has been assigned a unique set of boundaries. When more than one Configuration Manager site has been assigned the same boundary a situation known as overlapping boundaries occurs. Overlapping boundaries can cause errors in Configuration Manager client operations, and should be avoided.

Description

Used to enter a description for the new boundary.

Site Code

Used to select the site code that the new boundary will apply to.

Type

Select the type of boundary to create. Available options are: IP Subnet, Active Directory Site, IP v6 Prefix, and IP Address Range:

  • IP Subnet.
    • Network:
    • Subnet mask:
    • Subnet ID:

  • Active Directory Site. Maximum 63 characters.
    • Site name:
    • Browse button.

  • IP v6 Prefix
    • Prefix:
When configuring IPv6 prefixes as boundaries for Configuration Manager sites, prefixes entered using IPv6 zero compression are converted to the full IPv6 subnet format. For example, an IPv6 prefix entered as "aa::bb" would need to be translated into "00AA:0000:0000:00BB".

  • IP Address Range
    • Starting address:
    • Ending address:
When an IP address range is used to specify a Configuration Manager boundary, the IP range used for client assignment will include the starting address and ending address specified.

For example, if you configure an IP address range as a boundary with a starting address of 10.0.0.6 and an ending address of 10.0.0.8, clients assigned IP addresses of 10.0.0.6, 10.0.0.7, and 10.0.0.8 will be assigned to the site.

Network Connection

Specify how the clients in this boundary will communicate with the site. You must specify whether the network connection is one of the following options:

  • Slow or unreliable.
  • Fast (LAN).

See Also

Concepts

Planning Configuration Manager Boundaries
Choose Configuration Manager Boundaries


New SNMP Community Name Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to specify a community name to be added to the list on the Network Discovery Properties: SNMP Tab of the Network Discovery Properties dialog box.

Name

The read SNMP community name you want to add. You can use as many as 255 ASCII 2 characters. Community names are case-sensitive.

See Also

Tasks

How to Configure Network Discovery


New SNMP Device Dialog Box

Use this dialog box to specify an SNMP device to be added to the table on the SNMP Devices tab of the Network Discovery Properties dialog box.

IP address or device name

The IP address (for example, 131.24.10.3) or name of an SNMP device on your network. If a name is specified, it must resolve to an IP address.

See Also

Tasks

How to Configure Network Discovery

Concepts

About Network Discovery


New Source Dialog Box

Use the New Source dialog box in Configuration Manager 2007 to specify the location of the virtual application you are importing into Configuration Manager 2007.

The New Source dialog box contains the following elements:

Source directory

Specifies the network file location of the virtual application you want to import into Configuration Manager 2007. Enter the network path to the virtual application. Alternatively, click Browse and select the directory.

This location is where Configuration Manager 2007 will import the virtual application from.

Destination directory

Specifies the directory that Configuration Manager 2007 clients will use to access the virtual application package. This field cannot be edited because, by default, new virtual application package source versions will replace the existing virtual application packages with the updated virtual application package specified on the Source directory line.

This network location is specified when you initially import a new virtual application package.


New Subnet Assignment Dialog Box

Use this dialog box to specify a subnet to be searched by Network Discovery.

Subnet information

Specifies a subnet to use for Network Discovery.

Subnet

A subnet number in IP format (for example, 131.24.10.0) to be searched by Network Discovery.

Mask

The subnet mask for the subnet number (for example, 255.255.255.0).

Enable subnet search

Enables Network Discovery in the specified subnet. This subnet's status (enabled or disabled) is shown in the Search column in the Subnets tab of the Network Discovery dialog box.

See Also

Tasks

How to Configure Network Discovery

Concepts

About Network Discovery


New Variable Dialog Box

Use the New Variable dialog box in Configuration Manager 2007 to define a new variable and specify its associated value.

The New Variable dialog box contains the following elements:

Name

Specifies the name of the new variable. This field is required.

Do not display this value in the ConfigMgr console

Indicates whether the value of this variable is displayed or masked so that it is not visible to users from the Configuration Manager console. By default, this check box is selected so that the variable value is not displayed.

Value

Specifies the value of this variable. This field is required.

Confirm Value

Confirms the value of this variable by comparing the entered text with the Value previously entered. This field is required.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.


Out of Band Management Console

Topic last updated—May 2008

The out of band management console in Configuration Manager 2007 SP1 provides powerful administrative control for AMT-based computers, including tasks such as power on and off, check system information and status, boot from an alternative location, reconfigure BIOS settings, and run commands and character-based diagnostic applications.

Note
The information in this topic applies only to Configuration Manager 2007 SP1.

You can perform these tasks even if computers have not loaded the operating system, the hard disk is not functioning, or the operating system is not responding. A computer must be provisioned for AMT before you can connect to it using the out of band management console, and you must be logged on using one of the AMT user accounts that are configured in the following location: Out of Band Management Properties: AMT Settings Tab.

To use the out of band management console, you must have the Manage management controllers security right for the collection that contains the computer that you want to manage, which allows you to view and manage computer options in the out of band management console.

For more information about configuring security rights in the Configuration Manager console, see Overview of Configuration Manager Object Security and WMI.

Important
Some management options, such as IDE redirection and a serial connection, might not be available on computers if they are not enabled in the AMT firmware or on the Out of Band Management Component Configuration Properties: AMT Settings tab. For more information about the AMT options that can be configured in the firmware, see Decide Whether You Need a Customized Firmware Image From Your Computer Manufacturer. For more information about enabling AMT settings in Configuration Manager, see How to Configure AMT Settings and AMT User Accounts.

When you run the out of band management console, the following options are available.

Menus

File

Displays the following option:

  • Exit: Disconnects from a connected computer and closes the out of band management console.
Connection

Displays the following options:

  • Connect: Reconnect to the computer so that you can manage it with the out of band management console. This option is not available if the out of band management console is already connected to a computer.
    To connect to another computer, you must first close the out of band management console, select the new computer, and then launch the out of band management console.
  • Disconnect: Disconnects the currently connected computer from the out of band management console. This option is not available if the out of band management console is not currently connected to a computer.
Tools

Displays the following option:

  • Options: Select the terminal emulation type of ANSI or VT-100 to match the terminal emulation settings in the target computer's BIOS for when you use the option Serial Connection.
Help

Displays the following options:

  • About: Displays the copyright and version information for the out of band management console.
  • Contents F1: Opens the help topic for the out of band management console.

Button Bar

Connect

Select a computer for connection so that you can manage it with the out of band management console.

This button is not available if the out of band management console is already connected to a computer.

Disconnect

Disconnects the currently connected computer from the out of band management console.

This button is not available if the out of band management console is not currently connected to a computer.

Options

Select the terminal emulation type of ANSI or VT-100 to match the terminal emulation settings in the target computer's BIOS. The terminal emulation type is applied when you use the option Serial Connection.

Refresh

Refreshes the display for the current page, to update the values returned from the selected computer.

Buttons

System Status

Displays the following for the connected computer:

  • The power state
  • IP address
  • Host name
  • Domain suffix
  • System ID
  • Date of last refresh
  • Time of last refresh
Some actions in the console might automatically refresh the time value. However, to obtain the latest time retrieved from the AMT-based computer, click Refresh on the button bar. Both the time and the date displayed are in the local time zone for the computer running the out of band management controller.

System Information

Displays the hardware inventory information retrieved out of band for the connected computer. The information that is displayed can vary for different manufacturers.

Power Control

Initiates one of the following power control actions:

  • Power on
  • Power off
  • Restart the computer
If you power on or restart the computer, select one of the supported boot options that is retrieved from the computer. These can typically include the following:

  • Normal boot
  • Boot from local CD/DVD drive
  • Boot from local hard drive
  • Boot from alternative media (and select Boot from local drive or specify the image file for the option Boot from file)
  • Boot from the network
  • Boot to BIOS
Refer to your computer documentation for more information about the supported boot options.

Note
When you boot from alternative media to use the IDE redirection function, you must have the following security permissions to the path that contains the image file: Read, Read & Execute, Write, List Folder Contents.

When you power on or restart a computer, the following options also apply:

  • Bypass BIOS password: Enables or disables the ability to bypass a BIOS prompt for a configured password if it is supported by the AMT firmware.
  • Lock remote keyboard: When enabled, prevents local access to the AMT-based computer keyboard. However, some manufacturers might automatically enable the keyboard lock function even if this option is not enabled.
System Event Log

Displays activity for the management controller on the selected computer with the following buttons:

  • Clear Log
  • Set Log Level
The log level can be set to one of the following:

  • Errors
  • Warning
  • Verbose
System Audit Log

Displays a list of the IDE redirection sessions for the computer.

Serial Connection

Starts a terminal emulation session so that you can run commands and character-based applications.

See Also

Tasks

How to Identify Computers That Are Provisioned for AMT
How to Power Off a Computer Using Out of Band Management
How to Power On or Restart a Computer Using Out of Band Management
How to Run Commands, Repair Utilities, and Diagnostic Applications for a Computer Using Out of Band Management
How to Run the Out of Band Management Console

Concepts

Example Scenarios for Using Out of Band Management
Overview of Out of Band Management


Path Properties Dialog Box

Use this dialog box to add or update file path information used by the software inventory.

Path

Displays the path name or path variable for the selected file.

All client hard disks

Indicates that Configuration Manager searches for the selected file name, partial file name, or file extension on all client hard disks.

Variable or path name

Enables use of the Location field to search for files in a specified folder.

Location

When available, enter a full or variable path name, such as %windir% or C:\<folder>. You can also use the '?' and '*' wildcards in the last part of the path, such as C:\<folder>*.

Search subdirectories

Select to allow Configuration Manager to search subdirectories under Location. This field is available when Variable or path name is selected.

Note
It is possible to prevent computer clients from being inventoried by software inventory. For more information about excluding files from software inventory, see How to Exclude Files From Software Inventory.

See Also

Tasks

How to Exclude Files From Software Inventory


Path Properties Dialog Box

Use this dialog box to define the path on the mobile device client where files will be collected. You can also specify whether subdirectories will be searched for collected files.

UI Element | Description
Location | The directory on the mobile client device to be searched for collected files. By default the path location is the root directory (\).
Search subdirectories | The checkbox defines whether subdirectories of the Path will be searched for collected files.


Port Detail Dialog Box

Use this dialog box to view and modify the service port selected in the Configuration Manager 2007 Site Properties: Ports Tab. You cannot modify ports that are not enabled in the Ports Properties dialog box.

The Port Detail dialog box contains the following elements:

Service

Displays the service provided by each of the ports specified:

  • Client Requests-HTTP (TCP)
  • Client Requests-HTTPS (TCP)
  • Wake On LAN (UDP)
Description

Specifies the user-defined name of the Client Requests services (maximum 50 characters).

This option is not applicable to the Wake On LAN service.

Port number

Specifies the port number used by Configuration Manager 2007. Select a valid TCP port for client requests using http and https, and a valid UDP port for Wake on LAN transmissions.

Default client port

Specifies the client request service is the default port. You must have a default client request port specified for the site and, optionally, an alternate port. Alternate ports are required if you are migrating clients to a custom Web site.

This option is not applicable to the Wake On LAN service.

See Also

Concepts

Configuration Manager Tasks for Configuring a Single Site


Program Select Dialog Box

You can use the Program Select Dialog box to specify the Configuration Manager 2007 package and associated program that should run with this task sequence. Configuration Manager 2007 will filter out any disabled programs or programs by using the following settings and render the programs unavailable:

  • Only when a user is logged on
  • Run with user rights

See Also

Reference

Program Name Properties: Environment Tab


Prompt Properties Dialog Box

Use the Prompt Properties dialog box in Configuration Manager 2007 to create or modify a prompt in a report. Prompts are created to limit or target the data that a report retrieves. A report can contain more than one prompt as long as the prompt names are unique, and it can contain only alphanumeric characters that conform to the SQL rules for identifiers. After a prompt is created in a report, it must be integrated into the SQL statement. For information about how to create a prompt and integrate it into the SQL statement, see How to Create or Modify Report Prompts.

The Prompt Properties dialog box contains the following elements:

Name

Specifies the name for the prompt. This is a required setting.

Prompt Text

Specifies the prompt text that is displayed when the report runs. This is a required setting.

Default value

Specifies the default value that is automatically inserted into the prompt text box when a report runs. This is an optional setting.

Allow an empty value

Specifies whether the prompt value is required or if it is optional. By default, this setting is not enabled and the prompt value is required.

Provide a SQL statement

Specifies whether a list of possible values will be retrieved for the prompt based on a SQL statement. When this element is enabled, click Edit SQL Statement to specify the SQL statement for the prompt.

Edit SQL Statement

Opens the Prompt SQL Statement dialog box, where the SQL statement for the prompt is created or modified.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create or Modify Report Prompts

Reference

Prompt SQL Statement Dialog Box
Prompts Dialog Box

Concepts

About Report Prompts


Prompt SQL Statement Dialog Box

Use the Prompt SQL Statement dialog box in Configuration Manager 2007 to specify the SQL statement for a specified prompt in the report. When the prompt displays and the user clicks Values, Configuration Manager retrieves a list of values from the site server database using the configured SQL statement for the prompt.

The Prompt SQL Statement dialog box contains the following elements:

Views

Displays the Configuration Manager SQL views that can be added to the SQL statement. To insert a view into the SQL statement, click the location to insert the SQL view within the SQL statement, select the view from the Views list, and then click Insert.

Columns

Displays the columns for a view that is highlighted in the Views list. To add a filter to the SQL statement with a column value, click the location to insert the SQL view within the SQL statement, select the view from the Views list, select the column from the Columns list, and then click Values. Choose the values from the Column Values dialog box and click OK.

SQL statement

Specifies the SQL statement for the prompt. The SQL statement can be modified within the text box, views and column values can be added to the SQL statement by using the Views and Columns lists, or the SQL statement can be modified by using Query Designer in SQL Server 2005. For more information, see How to Use Query Designer to Create or Modify Report Queries and SQL Query Statement Reference.

Insert

Specifies that the SQL view highlighted in the Views list is inserted into the SQL statement at the last position of the cursor. The SQL view is inserted at the start of the SQL statement if the cursor position was not selected.

Values

Opens the Column Values dialog box, where a value for the column highlighted in the Columns list can be selected. For more information about selecting a column value, see Column Values Dialog Box.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Report
How to Use Query Designer to Create or Modify Report Queries

Reference

Column Values Dialog Box

Concepts

About Report Prompts
How to Modify the Report SQL Statement
SQL Query Statement Reference

Other Resources

Report Name Properties


Prompted Status Message Query Dialog Box

Use the Configuration Manager 2007 Prompted Status Message Query dialog box to specify values for variables within a status message query before the query runs.

This dialog box contains the following elements:

Prompted value

Lists the variables within the current status message query that must be assigned a value before the query can run.

Value

Specifies a value for the currently highlighted prompted value. There are two methods of specifying this value:

  • Specify: Specify the value by typing it into this field.
  • Load existing: Select a value for this prompt from existing entries contained in the Configuration Manager 2007 database. This might take a long time where there are many values available with which to populate this field.
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to View Status Message Details
How to Query Status Messages

Concepts

ConfigMgr Status Message Viewer Overview


Prompts Dialog Box

Use the Prompts dialog box in Configuration Manager 2007 to specify the prompts in a report. Prompts are created to limit or target the data that a report retrieves. A report can contain more than one prompt as long as the prompt names are unique and contain only alphanumeric characters that conform to the SQL rules for identifiers. After a prompt is created in a report, it must be integrated into the SQL statement. For information about how to create a prompt and integrate it into the SQL statement, see How to Create or Modify Report Prompts.

The Prompts dialog box contains the following elements:

Prompts

Displays the prompts that have been created for the report. The following prompt properties are displayed:

  • Name: Specifies the name for the prompt.
  • Prompt text: Specifies the prompt text that is displayed when the report runs.
  • Default value: Specifies the default value that is automatically inserted into the prompt text box when a report runs.
  • Allow an empty value: Specifies whether the prompt value is required or if it is optional.
  • Provide a SQL statement: Specifies whether a list of possible values will be retrieved for the prompt based on a SQL statement.
Create Object icon

Opens the Prompt Properties dialog box, where a new prompt is created.

Edit Object icon

Opens the Prompt Properties dialog box, where the properties for the prompt that is highlighted in the Prompts section is displayed and can be modified.

Delete Object icon

Deletes the prompt that is highlighted in the Prompts section. Prompts are permanently deleted when you click OK. To restore deleted prompts, click Cancel.

Report SQL statement

Displays the SQL statement for the report.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create or Modify Report Prompts

Reference

Prompt Properties Dialog Box

Concepts

About Report Prompts


Query Information Dialog Box

Use the Configuration Manager 2007 Query Information dialog box to view information about the status message query and filter (if any) being displayed in the status message viewer window.

This dialog box contains the following elements:

Total records in database

Displays the total number of status message records contained in the Configuration Manager 2007 database.

Current Query

Displays the WQL query being used to generate the results shown in the status message viewer window.

Current Filter

Displays the filter being used (if any) to limit the results shown in the status message viewer window.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Filter Status Messages
How to Query Status Messages

Concepts

ConfigMgr Status Message Viewer Overview


Report Options Dialog Box

The Microsoft System Center Configuration Manager 2007 Report Options dialog box contains the following elements.

Select the default reporting point for reports run from the home page

Specifies the default reporting point that is used for the site. If there are no reporting point site systems at the site, you must configure one before completing this dialog box.

Open a new window when running reports from the home page

Specifies whether Configuration Manager standard reports are opened in the Configuration Manager console or a new window in a Web browser. By default, this setting is not enabled and standard reports are run in the Configuration Manager console.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Change Options for Running Reports in the Console

Concepts

Reporting in Configuration Manager


Report SQL Statement Dialog Box

Use the Report SQL Statement dialog box in Configuration Manager 2007 to specify the SQL statement for the report. When the report runs, Configuration Manager retrieves data from the site server database using the configured SQL statement. Reports can have simple SQL statements or very complex ones that prompt the user for information, join several Microsoft SQL Server views, and use filters to limit the results.

The Report SQL Statement dialog box contains the following elements:

Views

Displays the Configuration Manager SQL views that can be added to the SQL statement. To insert a view into the SQL statement, click the location to insert the SQL view within the SQL statement, select the view from the Views list, and then click Insert.

Columns

Displays the columns for a view that is highlighted in the Views list. To add a filter to the SQL statement with a column value, click the location to insert the SQL view within the SQL statement, select the view from the Views list, select the column from the Columns list, and then click Values. Choose the values from the Column Values dialog box, and click OK.

SQL statement

Specifies the SQL statement for the report. The SQL statement can be modified within the text box, views and column values can be added to the SQL statement by using the Views and Columns lists, or the SQL statement can be modified by using Query Designer in SQL Server 2005. For more information, see How to Modify the Report SQL Statement.

Insert

Specifies that the SQL view highlighted in the Views list is inserted into the SQL statement at the last position of the cursor. The SQL view is inserted at the start of the SQL statement if the cursor position was not selected.

Values

Opens the Column Values dialog box, where a value for the column highlighted in the Columns list can be selected. For more information about selecting a column value, see Column Values Dialog Box.

Prompts

Opens the Prompts dialog box, where prompts can be specified for the report. When a report runs, the prompt will request a value from the user and then use that value to limit the retrieved data. For more information, see About Report Prompts.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a Report

Reference

Column Values Dialog Box

Concepts

About Report Prompts
How to Modify the Report SQL Statement
SQL Query Statement Reference

Other Resources

Report Name Properties


Review/Accept License Terms Dialog Box

The Review/Accept License Terms dialog box in Configuration Manager 2007 opens when creating a deployment for one or more software updates that require license terms approval. The dialog box opens before the Deploy Software Updates Wizard and allows you to review the Microsoft software license terms for the selected software updates, and provides the option to accept or decline the agreement. The dialog box can also be opened by selecting one or more software updates in the Configuration Manager console that require license terms approval, and then initiating the Review/Accept License Terms action.

Note
You must have Create rights on the Configuration items class for the Review/Accept License Terms action to be available in the Configuration Manager console.

The Review/Accept License Terms dialog box contains the following elements:

Decline License Terms

Declines the license terms. The Accept License Terms button remains active, and the license terms can be accepted at a later time.

Accept License Terms

Accepts the license terms. Once accepted, the deployment can be created with the software updates. When a License Terms is accepted and OK is clicked, the Decline License Terms option is no longer available.

Export

Opens a copy of the License Terms in Notepad. This allows you to read the text in a larger window, format the text, and send the text to a printer.

OK

Exits the dialog box and saves the settings.

Cancel

Exits the dialog box without saving the settings.

Help

Opens the help topic for this dialog box.

See Also

Concepts

About Software Update Deployments
About Software Update Files
About Software Updates Metadata
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment


Search Computer Dialog Box

The search computer dialog box allows you to search the Microsoft System Center Configuration Manager 2007 site for computers matching a specific criterion as specified by the administrator. Computers that match the specified criterion are displayed with the following information:

  • Name - The name of the computer.
  • Last User - The last user account that logged onto the computer.
  • OS - The version of the computer's operating system.
  • MAC Address - The MAC address of the computer.

You can configure the following settings:

Browse

Specify the collection you want to search by clicking Browse to launch the Browse Collection dialog box. Specify the collection you want to search in the list, and click OK to select.

Computer Contains

Specify unique, identifying information about the computer you are searching for.

User Contains

Specify unique, identifying information about a specific user you are searching for.

Advanced

Click Advanced to perform an advanced search. You can specify the following additional search criteria:

  • Resource class - Use the drop-down list to specify the resource class.
  • Attribute name - Use the drop-down list to specify the Attribute name.
  • Value - Enter the value that should be used to search with.


Search Folder Criteria Dialog Box

Search folders are a way to gather Microsoft System Center Configuration Manager 2007 objects into a folder based on search criteria. For example, you might want to see all packages with the word "application" in their name. The packages can be viewed from but are not stored in the search folder. Search folders are virtual folders that contain views of objects that exist in the tree.

The Search Folder Criteria dialog box contains the following elements:

Step 1: Select object properties to search

The object properties vary depending on the class of object for which you are creating the search folder. Select an object property to add it to the search criteria.

Step 2: Edit the property's search criteria (click an underlined value)

For every object property you select in Step 1, you see a corresponding search criteria. Click <criteria to find> to specify the search criteria. To remove a search criteria, clear the object properties check box. To modify the search criteria, click the underlined value.

Step 3: Search all folders under this feature

By default, Configuration Manager 2007 searches only the current folder. If you select Step 3: Search all folders under this feature, Configuration Manager 2007 searches everywhere in that feature node.

Step 4: Enter a name for the search folder

The name of the folder. Folder names must be less than 127 characters and must not contain any of the following characters:

/ | \ : * ? " < >

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Manage Search Folders

Reference

Search Text Dialog Box

Concepts

About Folders and Search Folders


Search Text Dialog Box

The Microsoft System Center Configuration Manager 2007 Search Text dialog box contains the following elements.

Specify words or phrases to search for. Use quotation marks ("") to indicate exact match

Specifies the search criteria to match.

Search list

Specifies which words or phrases to match. Configuration Manager 2007 matches all terms in the search list as OR searches.

Add

Adds a new search criteria as an OR search.

Remove

Removes a search criteria.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Manage Search Folders

Reference

Search Text Dialog Box

Concepts

About Folders and Search Folders


Select a Boot Image Dialog Box

Allows you to select an existing boot image to associate with this task sequence. The Image ID, Architecture, and Comment associated with the boot image also display.

After you select the boot image, click OK.

See Also

Tasks

How to Add a Boot Image to Configuration Manager


Select a Boot Image

You can add an existing boot image using the Select a Boot Image dialog box.

Important
You can only add a boot image that has already been imported into Configuration Manager 2007. You can add a new boot image by right-clicking the Boot Images node and selecting Add Boot Image from the menu.

The available boot images are displayed in the Boot Images window. Select the boot image you want to add, and click OK to add the boot image.

The Select a Boot Image dialog box contains the following elements:

Name | Description
Image ID | Displays the image identification number associated with the selected boot image.
Architecture | Displays the architecture of the selected boot image. The architecture of the selected boot image must match the boot image on the target computer or the operating system deployment will fail.
Comment | Displays the comment associated with the boot image. You can add an optional comment when you import a boot image, or by right-clicking an existing boot image and selecting the General tab and adding a comment.

See Also

Tasks

How to Add a Boot Image to Configuration Manager


Select a Driver Dialog Box

The Select a driver dialog box allows you to add a device driver that has been imported into the driver catalog. The device drivers that have been imported into the driver catalog display in the Drivers window.

To select a device driver, select the device driver in the list, and then click OK.

The Select a Driver dialog box contains the following elements:

Name | Description
Name | Displays the name of the selected device driver.
Provider | Displays the provider associated with selected device driver.
Class | Displays the class associated with the selected device driver.
Digital Signer | Displays the digital signer information for the selected device driver.
INF file | Displays the INF file that will be used with the selected device driver.

See Also

Other Resources

How to Manage the Driver Catalog


Select a Package Dialog Box

Use the Select a Package dialog box in Configuration Manager 2007 to specify the package used to host the selected software updates. The updates are downloaded and then copied to the package shared folder on all distribution points configured for the package. Software updates can be downloaded from the Download Updates Wizard, Deploy Software Updates Wizard, or Update List Wizard.

The Select a Package dialog box contains the following elements:

Packages

Displays all deployment packages for the site. Specify the package that will host the software updates. When a package is selected, the following information is displayed:

  • Name
  • Manufacturer
  • Version
  • Language
  • Package ID
  • Description
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

See Also

Concepts

About Software Update Deployment Packages
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
Planning for a Software Update Deployment


Select a Package

You can add a package using the Select a Package dialog box. The available packages are visible in the Packages window.

To add a package select the package you want to add and click OK.

The Select a Package dialog box displays the following elements:

Name | Description
Package ID | Displays the Configuration Manager 2007 package identification for the selected package.
Source Version | Displays the version and last refresh date associated with the selected package.
Last refresh time | Displays the last time and date that the package was updated.
Comment | Displays the comment associated with the selected package.

See Also

Reference

Apply Data Image


Select a Source Distribution Point Dialog Box

Use the Select a Source Distribution Point dialog box in Configuration Manager 2007 to specify the distribution point from which the packages will be copied to the destination distribution points.

The Select a Package dialog box contains the following elements:

Distribution Points

Specifies the distribution points from which packages can be copied to the destination distribution point from, along with the option to select one or more of these distribution points.

The following columns are displayed for each distribution point listed:

  • Name: Specifies the name of the distribution point.
  • Site: Specifies the site on which the distribution point is located.
  • Type: Specifies the type of distribution point, whether server, server share, or branch distribution point.
Select All

Selects all distribution points displayed in the list.

Clear All

Clears all selected distribution points displayed in the list.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Concepts

Select Packages Page

Other Resources

Copy Packages Wizard


Select a Task Sequence Dialog Box

Use the Select a Task Sequence dialog box to add an existing task sequence.

Important
You can add only an existing task sequence that already exists in the Configuration Manager 2007 site.

The available task sequences are displayed in the Task sequences window. Select the task sequence you want to add and click OK to add the task sequence.

The following elements are displayed:

Name | Description
Task ID | Displays the identification information associated with the selected task sequence.
Last Refresh Time | Displays the last time the task sequence was updated with new or refreshed content. The date and time of the last update is displayed.
Comment | Displays the administrator defined comment associated with the task sequence.


Select an Operating System Image Dialog Box

Use the Select a Package dialog box to add an existing operating system from a captured image.

Important
You can add only an operating system image that has already been captured and imported into Configuration Manager 2007. To add a new operating system image, right-click the Operating System Images node, and then click Add Operating Image.

The available operating system images are displayed in the Packages window. Select the package you want to add, and then click OK.

The following elements are displayed:

Name | Description
Image ID | Displays the Configuration Manager 2007 package identification information for the selected package.
Comment | Displays the comment associated with the selected package.


Select an Operating System Install Package Dialog Box

The Select an Operating System Install Package dialog box allows you to add an existing operating system install package.

Important
You can add only an operating system install package that has already been imported into Configuration Manager 2007. You can add a new operating system install package by right-clicking the Operating System Install Packages node, and then clicking Add Operating System Install Package.

The available operating system install packages are displayed in the OS Install Packages window. Select the package you want to add, and then click OK.

Name | Description
Image ID | Displays the Configuration Manager 2007 package identification information associated with the selected operating system install package.
Comment | Displays the comment associated with the selected operating system install package.


Select Attribute Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to specify an attribute class and attribute. You can also use this dialog box to assign an alias name to an attribute class.

The Select Attribute Dialog Box contains the following elements:

Attribute class

The class for this attribute reference. You can select an attribute class from the drop-down list. This setting might be unavailable (it will appear dimmed), depending on the dialog box that this dialog box was opened from.

Alias as

The name of the alias for the attribute class. This setting might appear as a list, depending on the dialog box that this dialog box was opened from. You can select an alias name from the list, or you can assign or modify an alias name by typing the name in the edit box.

The alias name must be a valid SQL alias. It cannot begin with a number or contain any spaces. The alias name can contain letters, numbers, and any of these characters: @ $ # _

Attribute

The attribute for the attribute class that is specified in Attribute class. The options in this list vary depending on the attribute class that is selected. Additionally, the All attributes value is available only if this dialog box is opened from the Query Result Properties dialog box.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Query Result Properties: General Tab

Concepts

Overview of Queries
Queries in Configuration Manager


Select Report Dialog Box

Use the Select Report dialog box in Configuration Manager 2007 to select a report in the list. The dialog box can be accessed when creating a link to another report or when adding a report to a dashboard. When you are creating a link to another report, the list displays all reports that are accessible by the user. When you are adding a report to a dashboard, the list displays reports that do not have any prompts and that are accessible by the user.

The Select Report dialog box contains the following elements:

Reports

Displays a list of all applicable reports. The following report properties are listed:

  • Name: Specifies the name for the report.
  • Category: Specifies the category for the report.
  • ID: Specifies the ID number for the report.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Add Reports to a Dashboard
How to Create a Dashboard
How to Create a Report
How to Modify Dashboard Properties
How to Modify Report Properties

Concepts

About Report Links


Set Backup Paths Dialog Box

The Set Backup Paths Dialog Box is used to select the paths used to store the site and database backup files.

This dialog contains the following elements:

Note
When setting the backup path for backing up a secondary site, SQL Server and site database back up options are not visible.

Destination Options

Contains the backup destination option selections.

Local drive on site server for site data and database

Select this option to store the site and site database backup files to a local drive on the site server computer. This option stores the site and site database backup files to the same location.

Network path (UNC name) for site data and database

Select this option to store the site and site database backup files to a network path location. This option stores the site and site database backup files to the same shared network drive location.

Local drives on site server and SQL Server

Select this option to store the site backup files on a local drive of the site server and the site database backup files to a local drive on the site database server.

Note
This option is unavailable if the site database is hosted by the site server computer.

Site and SQL backup destination:

Displays the selected site and site database backup destination location.

Browse

Used to browse to a backup destination location (either a local drive or UNC path location).

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Reference

Backup ConfigMgr Site Server Task Overview


Set Filter Dialog Box

Use the Set Filter dialog box in Configuration Manager 2007 to specify a filter that limits the column values displayed in the Values pane of the Column Values dialog box.

The Set Filter dialog box contains the following elements:

No filter

Specifies that no filter is applied when displaying the column values.

Apply a filter

Specifies that a filter is applied that limits the values displayed. When this option is selected, configure the following setting:

  • Filter Criterion: Specifies the filter criterion that is used to limit the column values that are displayed. Type the criterion using alphanumeric characters. The percent sign (%) can be used as a wildcard for multiple characters, and the underscore (_) can be used as a wildcard for a single character.
OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Reference

Column Values Dialog Box


Set Parent Site Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to change a site's parent, which reconfigures your site hierarchy.

Note
Before changing the site's parent, ensure that an address to the new parent site is specified.

Central site

Makes the current site a central site (a site with no parent site).

Report to parent site

Makes the current site a child site of the site you specify. Type a site code or select one from the drop-down list.

Caution
If the site being added to the hierarchy uses the same site code that was previously used in the hierarchy, and if software distribution objects were modified since detachment, then software distribution objects might be overwritten or corrupted. For example, parent and child sites might have different definitions for the same package IDs. Carefully inspect any duplicates. After inspection, consider deleting packages that are no longer valid.

See Also

Tasks

How to Change a Site's Parent Site

Concepts

Plan the Configuration Manager Site Hierarchy

Other Resources

Configuration Manager Tasks for Deploying Multiple Sites


Set Root CA Certificate

Use the Set Root CA Certificates dialog box that is displayed when you click Specify Root CA Certificates on the Configuration Manager 2007 Site Properties: Site Mode tab to import, view, and delete root certification authority certificates for operating system deployment clients when the site is configured for native mode.

The Set Root CA Certificates dialog box contains the following elements:

Root CA Certificates

Displays the root certification authority (CA) certificates configured for use with operating system deployment.

The following options are available for managing root certification authority certificates:

  • New icon: Click to open the Open dialog box and select a file that contains an exported root authority certification certificate formatted as DER encoded binary X.509 (.CER).
    Note
    Importing certificates with file formats other than DER encoded binary X.509 (.CER) are not supported with Configuration Manager 2007.

  • Properties icon: Click to open the selected certificate to view its properties.
  • Delete icon: Click to delete the selected root certification authority certificate so that it is not used by operating system deployment clients.
OK

Saves any changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves any changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Prepare the Root Certification Authority Certificates for Operating System Deployment Clients

Concepts

Certificate Requirements for Native Mode
Configuration Manager Site Modes


Set Source Directory Dialog Box

Use the Set Source Directory dialog box in Configuration Manager 2007 to specify the source folder for a package. If you modify the package source folder specified in this dialog box, Configuration Manager 2007 will update all distribution points currently assigned to the package.

The Set Source Directory dialog box contains the following elements:

UI Element List

Source directory location

Specifies the type of location for the package source files. The following options are available:

  • Network path (UNC name): Specifies that the source folder is a network path (for example, \\Green3\Apps\Microsoft\Office97).
    Note
    A mapped network drive should not be used as a source for a package source folder. A mapped network drive is usually created using a different account than the system account being used by the Configuration Manager 2007 Distribution Manager, and this will result in the package source folder being unable to be replicated to the distribution point.

  • Local drive on site server: Specifies that the source folder is a logical drive location (for example, C:\Office97). This option is only available if you are running the Configuration Manager console on the site server.
Source directory

Specifies the path to the package source files, up to 127 characters in length.

To set a source directory path, type the path or click Browse to navigate to the package source files.

Note
You cannot specify a logical drive that is mapped to a share on another computer. Specify such source directories as a network path.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Reference

Package Name Properties: Data Source Tab

Concepts

About Packages


Specify Attribute Name Dialog Box

Use the Specify Attribute Name dialog box in Configuration Manager 2007 to specify the name of a custom Active Directory object attribute that you want to discover. This dialog box is displayed when you click the New icon on the Active Directory attribute tab of either the Active Directory System Discovery or the Active Directory User Discovery method.

The Specify Attribute Name dialog box contains the following elements:

Attribute name

Specifies the name of the Active Directory object attribute that you want to discover. This can be the name of a custom Active Directory attribute that is specific to your enterprise.

The following attribute types are supported for Active Directory discovery:

  • ADSTYPE_DN_STRING
  • ADSTYPE_CASE_EXACT_STRING
  • ADSTYPE_CASE_IGNORE_STRING
  • ADSTYPE_PRINTABLE_STRING
  • ADSTYPE_NUMERIC_STRING
  • ADSTYPE_BOOLEAN
  • ADSTYPE_INTEGER
  • ADSTYPE_UTC_TIME
  • ADSTYPE_LARGE_INTEGER
  • ADSTYPE_DN_WITH_STRING
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for the dialog box.

See Also

Tasks

How to Configure Active Directory System Discovery
How to Configure Active Directory User Discovery


Status Message Details Dialog Box

Use the Configuration Manager 2007 Status Message Details dialog box to view information about the selected status message. All fields in this dialog box are read-only.

This dialog box contains the following elements:

Date

Displays the date on which the status message was generated.

Time

Displays the time at which the status message was generated.

Site code

Displays the site code of the Configuration Manager 2007 site where the status message was generated.

System

Displays the name of the computer that generated the status message.

Source

Displays the type of system that generated the status message. The following values for this field are possible:

  • SMS Server
  • SMS Client
  • SMS Provider
Component

Displays the name of the Configuration Manager 2007 component that generated the status message.

Type

Displays the status message type. The following values for this field are possible:

  • Milestone
  • Detail
  • Audit
Severity

Displays the severity of the status message. The following values for this field are possible:

  • Error
  • Warning
  • Informational
Message ID

Displays the ID number of the status message.

Process ID

Displays the process ID of the process that generated the status message.

Thread ID

Displays the thread ID of the process thread that generated the status message.

Description

Displays the description text of the selected status message.

Properties

Displays any further properties contained in the status message.

Previous

Displays the previous status message in the Status Message Viewer window.

Next

Displays the next status message in the Status Message Viewer window.

OK

Exits the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to View Status Message Details

Concepts

ConfigMgr Status Message Viewer Overview


Status Messages: Set Viewing Period Dialog Box

Use the Configuration Manager 2007 Status Messages: Set Viewing Period dialog box to display only those site system status messages that are received on or after a specified date and time. You can set a date and time or select a preset date and time. The status message viewer main window will display only those status messages received on or after the specified time.

This dialog box contains the following elements:

Specify date and time

Status messages received after the specified date and time, in the specified time zone will appear in the status message viewer main window.

By default, the current date, time, and time zone are specified.

Select date and time

Status messages received during the specified range will appear in the status message viewer main window.

The following values are available:

  • 1 hour ago
  • 6 hours ago
  • 12 hours ago
  • 1 day ago
  • 2 days ago
  • 1 week ago
  • 2 weeks ago
  • 1 month ago
  • 3 months ago
  • 6 months ago
  • 1 year ago
OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Skip

Exits the dialog box and displays all status messages for the selected site system in the status message viewer main window, without limiting these to a specific time period.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to View the Status of Site Systems
How to View the Status of Storage Objects

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Storage Folder Dialog Box

Use the Storage Folder dialog box to add a new folder to store user state migration data.

This page contains the elements described in the following table.

Name | Description
Storage Folder | Specifies the local folder path that should be used to store the user state migration data in the space provided. This path is not entered in the UNC format.
Maximum Clients | Limits the number of clients that can be saved to the new folder.
Minimum Free Space | Specifies the minimum free space that must be maintained to continue storing user state migration data.


Target Report Prompt Properties Dialog Box

Use the Target Report Prompt Properties dialog box in Configuration Manager 2007 to specify the column number in this report that will provide the prompt value to a linked target report.

The Target Report Prompt Properties dialog box contains the following elements:

UI Element List

Name

Specifies the name for the prompt in the linked target report.

Prompt text

Specifies the prompt text that is displayed when the report runs.

Column

Specifies the column number from this report that will provide the prompt value to the linked target report.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create or Modify Report Prompts
How to Modify Report Properties

Other Resources

Report Name Properties


Values Dialog Box

Use this Microsoft System Center Configuration Manager 2007 dialog box to enter a value for either the Criterion Properties (Simple Value Criterion Type) criterion type or the Criterion Properties (List of Values Criterion Type) criterion type.

For more information about valid values for criterion types, see About Query Criterion Values.

Value

Either select a value from the Values list or enter a value in the Value box.

Note
The SMS Provider can run out of memory while caching a large result set. To avoid this and to maintain performance, Query Builder limits the number of values that are displayed in the Values dialog box to the first 2,000. You can override this by changing registry settings. For more information, see Microsoft Knowledge Base article Q269201.

See Also

Concepts

About Criterion Types


Wake On LAN Advanced Properties Dialog Box

Use the Wake On LAN Advanced Properties dialog box from the Site Properties: Wake On LAN tab to fine-tune how wake-up packets are sent from the site server when you have one or more of the following items enabled for Wake On LAN:

  • Software update deployments configured with a deadline
  • Mandatory software distribution advertisements
  • Mandatory task sequence advertisements

The Wake On LAN Advanced Properties dialog box contains the following elements that help you control the network bandwidth used by wake-up transmissions:

Retries

The number of times a wake-up packet will be sent to a target computer.

After a wake-up packet is sent to all computers targeted by a scheduled activity (a mandatory advertisement or software update deployment with a deadline), the transmission is paused for the Delay period. If this retry value is greater than 1, a second wake-up packet is then sent to the same computers and the process is repeated until the retry value is reached. The second and subsequent wake-up packets are sent whether or not any errors occur.

It is more likely that a computer will successfully wake up if it is sent a number of wake-up packets, rather than just one. However, if you set this value higher than computers need, network bandwidth and processing capabilities on network devices is consumed unnecessarily.

The default setting is 3 retries. Values can range from 1 to 5.

Delay

The amount of time in minutes that a wake-up transmission is paused between retries.

The default setting is a 1-minute delay. Values can range from 1 to 5 minutes.

Maximum

The maximum number of wake-up packets to be transmitted by the site server to the target computers before pausing for the Wait period.

The pause avoids potentially saturating the network for an extended period of time. At the end of the configured Wait period, the transmission of wake-up packets resumes for the remaining targeted computers until the Maximum value is reached again, and the process is repeated.

The default setting is 10000 wake-up packets. Values can range from 1000 to 99999 maximum packets.

Wait

The amount of time in seconds in between sending batches of wake-up packets to target computers.

The default setting is 10 seconds. Values can range from 0 seconds to 100 seconds.

Transmission Threads

The number of threads the site server uses when sending wake-up packets.

Increasing the number of threads increases the likelihood of making full use of available network bandwidth, particularly when the site server computer has multiple cores or processors. Increasing the number of threads might also produce a significant increase in CPU utilization.

The default setting is 3 transmission threads. Values can range from 1 to 9 threads.

Transmission Offset

The amount of time in minutes that wake-up packets will be sent prior to a scheduled activity that is enabled for Wake On LAN.

Set a value that is sufficiently in advance of the scheduled activity so that computers have completed startup, but not so far in advance that the computer returns to a sleep state before the scheduled activity.

The default setting is 3 minutes. Values can range from 1 to 60 minutes.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Other Resources

Wake On LAN in Configuration Manager


Windows Account Dialog Box

Use this dialog box to specify a Windows account for Microsoft System Center Configuration Manager 2007 .

User name

The account name. You can use up to 15+1+20 uppercase or lowercase characters to specify a fully qualified domain user name in the following form: domain\name.

The following characters are prohibited: " / \ [ ] : ; | = , + * ? < >

Also, a domain name cannot contain any spaces or start with a period. A user name cannot consist solely of periods and/or spaces.

Account type

The type of account to add

See Also

Concepts

Accounts Properties

Other Resources

Accounts and Groups in Configuration Manager


Windows User Account Dialog Box

Use this dialog box to specify a Windows User account.

Note
Universal Principle Names (UPNs) are not supported in Configuration Manager 2007, so the name format must be specified as domain\user.

User name

The account name. You can use up to 20 uppercase or lowercase characters to specify the name of the account, or up to 15+1+20 characters to specify a fully qualified domain user name of the form: domain\username. These forms are distinguished by the absence or presence of exactly one backslash (\) character.

The following characters are prohibited: / \ [ ] : ; | = , + " * ? < >

Also, a domain name cannot contain any spaces or start with a period. A user name cannot consist solely of periods and/or spaces.

Password

The password for the new account, up to 127 characters.

Confirm password

Repeat the password.

See Also

Concepts

Accounts Properties

Other Resources

Accounts and Groups in Configuration Manager


Windows 2000 Remote Tools Dialog Box

You can use this dialog box to configure the Configuration Manager 2007 remote control settings.


Windows 2000 Remote Control Viewer Dialog Box

Use the General tab to specify the level of remote control that you want a remote administrator to have on your computer.

When Remote Control is enabled on your computer, your administrator provides default settings that determine the level of remote access allowed to this computer. If your administrator selects the Use administrator settings check box, the options on the General tab are unavailable and you cannot change these settings.

Level of remote access allowed

Specify the level of remote control that you will allow a remote administrator to have.

When a remote administrator tries to control this computer

When a remote administrator tries to control your computer, you can specify either that a message is displayed that asks you for permission each time or that no message is displayed.

Use administrator settings

When enabled, the default values that were set by your remote administrator for the remote control session are used. All the other controls in the dialog box are changed to reflect the settings that were set by your remote administrator and are unavailable.

If your administrator has set this control on a site-wide basis, you might not be able to change the controls on this tab.

Show Status

Click to view the status of remote control on your computer. Details include the version of Configuration Manager remote control that is installed, the protocol that is used, your network address, your local computer name, whether accelerated screen transfer is used, and the compression type in use (if any).

Note
This button appears on Windows 2000 client computers only.


MAC Address Settings

Use the MAC Address Settings dialog box to specify the MAC address of the network adapter that will respond to PXE requests on the network.

UI Element List

MAC Address Settings

Specifies the MAC address of the network adapter installed on PXE service point that will respond to Configuration Manager 2007 network PXE boot requests. Enter the MAC address, and then click OK to save the setting.

You can specify more than one network adapter to respond to network PXE boot requests. The network adapters specified are displayed in the PXE - General page of the New Site Role Wizard. To review the network adapters that have been configured for existing PXE service points, right-click the existing PXE service point, and then click Properties.

The network adapters that have been configured are displayed on the General tab.


SQL Reporting Services Dialog Boxes

Topic Last Updated—August 2008

This section contains the help topics for the SQL Reporting Services dialog boxes.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

In This Section

Reporting Services Folder Properties: General Tab

Reporting Services Properties: Security Tab

Report Options Dialog Box

Reporting Services Node

Report Server Properties: General Tab

Report Server Properties: Data Source Settings Tab

Report Server Properties: Data Source Authentication Tab

Report Link Dialog Box

Command Text Dialog Box

Report Parameters Dialog Box

Report Properties: General Tab

Report Properties: Datasets Tab

Report Properties: Subscriptions Tab

Report Subscription Dialog Box: Subscription Delivery Tab

Report Subscription Dialog Box: Subscription Schedule Tab

Report Subscription Dialog Box: Subscription Parameters Tab

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Reporting Services Folder Properties: General Tab

Topic Last Updated—August 2008

Use the General tab of the Configuration Manager 2007 R2 Reporting Services Folder Properties dialog box to view information about the selected report folder.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements.

Folder name

Displays the name of the folder. You can modify this name and then click Apply to save your changes.

Description

Displays the description of this folder. You can modify this name and then click Apply to save your changes.

Modified date

Displays the date and time that this folder was last modified.

Modified by

Displays the Windows user name of the user who last modified this folder.

Creation date

Displays the date and time that this folder was created.

Created by

Displays the Windows user name of the user who created this folder.

Size

Displays the size of this folder.

Contains

Displays the number of reports and the number of folders contained in this folder.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Create Report Folders in SQL Reporting Services
How to Delete Report Folders in SQL Reporting Services
How to Modify Report Folders in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Reporting Services Properties: Security Tab

Topic Last Updated—August 2008

Use the Security tab of the Configuration Manager 2007 R2 Reporting Services Properties dialog box to add, view, and edit security rights for users of the feature.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements.

Name

Displays the name of the object you are configuring security rights for.

Inheriting rights from parent object

Specifies that permissions to this object are inherited from the objects parent.

Note
If this box is checked, the new, properties, and delete buttons will not be available.

New

Click to open the User Properties dialog box, where you can specify the Windows user name and permissions for a user of this object.

Properties

Click to open the User Properties dialog box for the selected user, to allow you to modify the users rights to this object. For more information about the options in the User Properties dialog box, see About Security in SQL Reporting Services.

Delete

Click to delete the currently selected user from the permissions list.

Permissions

Displays a list of users and their permissions to this object.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Concepts

About Security in SQL Reporting Services
Administrator Checklist for SQL Reporting Services
Planning for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Options Dialog Box

Topic Last Updated—August 2008

Use the Configuration Manager 2007 R2 Report Options Dialog Box to select the default report server when running SQL Reporting Services reports and the default reporting point when running standard Configuration Manager reports.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

The Configuration Manager 2007 Report Options dialog box contains the following elements:

Select the default report server for running reports

Specifies the default Reporting Services server that is used when running Reporting Services reports in Configuration Manager.

Use Reporting Services reports for Admin console report links

Specifies whether to use Reporting Services reports instead of standard Configuration Manager reports when opening a report from a link in the Configuration Manager console.

Select the default reporting point for running reports

Specifies the default reporting point that is used for the site. If there are no reporting point site systems at the site, you must configure one before completing this dialog box.

Open reports in a new window

Specifies whether Configuration Manager standard reports are opened in the Configuration Manager console or in a new window in a Web browser. By default, this setting is not enabled and standard reports are run in the Configuration Manager console.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Change Options for Running Reports in the Console

Concepts

Reporting in Configuration Manager

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Reporting Services Node

Topic Last Updated—August 2008

The Reporting Services node in the Configuration Manager 2007 R2 console displays all reporting services points configured for your site. Selecting any reporting services point provides further options.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This node contains the following element.

Reporting services point list

Displays a list of all reporting services points configured on your site. To add a new reporting services point, see How to Create a Reporting Services Point for SQL Reporting Services.

The actions described in the following table are available on the reporting services reporting node.

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove Columns: Opens the Add/Remove Columns dialog box, which allows you to add or remove information from the reporting services point list.
  • Large Icons: Displays the configured reporting services points using large icons.
  • Small Icons: Displays the configured reporting services points using large icons.
  • List: Displays the configured reporting services points as a list.
  • Details: Displays the configured reporting services points as a list and shows further details about each item.
  • Customize: Opens the Customize View dialog box, where you can specify which items are displayed in the Configuration Manager console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Export list

Opens the Export List dialog box, which allows you to save the contents of the results pane as a text file.

Help

Opens the associated help topic.

Selecting an existing reporting services point will cause the additional actions described in the following table to be displayed.

Action Description

Create Report

Opens the Create Report wizard, which allows you to create a new SQL Reporting Services report.

Copy Reports to Reporting Services

Opens the Copy Reports to Reporting Services wizard, which allows you to copy existing Configuration Manager 2007 reports to SQL Reporting Services.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove Columns: Opens the Add/Remove Columns dialog box, which allows you to add or remove information from the reporting services point list.
  • Large Icons: Displays the configured reporting services points using large icons.
  • Small Icons: Displays the configured reporting services points using large icons.
  • List: Displays the configured reporting services points as a list.
  • Details: Displays the configured reporting services points as a list and shows further details about each item.
  • Customize: Opens the Customize View dialog box, where you can specify which items are displayed in the Configuration Manager console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Export list

Opens the Export List dialog box, which allows you save the contents of the results pane as a text file.

Properties

Opens the Report Server Properties dialog box, which allows you to modify the properties of the currently selected reporting services point.

Help

Opens the associated help topic.

See Also

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Server Properties: General Tab

Topic Last Updated—August 2008

Use the General tab of the Configuration Manager 2007 R2 Report Server Properties dialog box to view details about the report folder on the selected reporting server.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements.

Server Name

Displays the name of the report server for which you are viewing properties.

Report Folder

Displays the name of the report folder on the selected report server.

Status

Displays the status of the report folder on the selected report server.

Size

Displays the size of the report folder on the selected report server.

Contains

Displays the number of reports and the number of folders on the selected report server.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Configure Properties for the Reporting Services Point
How to Create a Reporting Services Point for SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Server Properties: Data Source Settings Tab

Topic Last Updated—August 2008

Use the Data Source Settings tab of the Configuration Manager 2007 Report Server Properties dialog box to specify the name of the Configuration Manager 2007 server and database to be used as the data source for SQL Reporting Services reports.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements.

Server Name

Specify the name of the Configuration Manager 2007 database server to be used as the data source for SQL Reporting Services reports. To specify a database instance, use the format <Server Name>\<Instance Name>.

Database Name

Specify the name of the Configuration Manager 2007 database to be used as the data source for SQL Reporting Services reports.

Test

Click to test the connection to the Configuration Manager 2007 database.

Note
If the connection test fails, a red warning symbol will be displayed. Move the cursor over this symbol to read details of the failure. Correct the failure, and then click Test again.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Configure Properties for the Reporting Services Point
How to Create a Reporting Services Point for SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Server Properties: Data Source Authentication Tab

Topic Last Updated—August 2008

Use the Data Source Authentication tab of the Configuration Manager 2007 Report Server Properties dialog box to specify details about the Windows account used to run reports on the selected Reporting Services point.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements.

Credentials supplied by the user running the report

This option is not currently supported by SQL Reporting Services in Configuration Manager 2007 R2.

Display the following text to prompt the user for a username and password

This option is not currently supported by SQL Reporting Services in Configuration Manager 2007 R2.

Credentials stored securely in the report server

Select this option if you want to store an encrypted user name and password for users to use to access reports on the report server. This option is typically used when you need to run reports unattended—for example, a report initiated by a subscription.

User name

If the option Credentials stored securely in the report server is selected, specify the user name that users must specify to access reports.

Password

If the option Credentials stored securely in the report server is selected, specify the password that users must use to access reports.

Use as Windows credentials when connecting to the data source

Check this box if the specified credentials are Windows authentication credentials. Do not check this box if you are using database authentication (for example, SQL Server authentication).

Impersonate the authenticated user after a connection has been made to the data source

If the option Credentials stored securely in the report server is selected, this option can be used to allow delegation of credentials if the data source supports it. For more information about this option, refer to your SQL Server documentation.

Windows integrated security

If selected, the credentials of the logged-on user will be used to access the data source.

Credentials are not required

If selected, no credentials are required or used when connecting to the data source.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Configure Properties for the Reporting Services Point
How to Create a Reporting Services Point for SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Link Dialog Box

Topic Last Updated—August 2008

Use the Configuration Manager 2007 R2 Report Link dialog box to specify parameters to use when configuring links to other SQL Reporting Services reports.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This dialog box contains the following elements:

Report name

Displays the name of the report you want to link to. Click the browse button to specify a new report.

Report path

Displays the path of the report in the Report name field.

Parameter

Selects the parameter that will be used to link the two reports from the drop-down list.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Command Text Dialog Box

Topic Last Updated—August 2008

Use the Configuration Manager 2007 R2 Command Text dialog box to specify and edit the SQL statement used by a SQL Reporting Services report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This dialog box contains the following elements.

Views

Displays the list of available views in the Configuration Manager 2007 database. Select any view to see its available columns in the Columns field. Double-click any view to insert it into the SQL statement displayed in the Command Text field.

Columns

Displays the available database columns for the view selected in the Views field. Double-click any column to insert it into the SQL statement in the Command Text field.

Command Text

Specifies the SQL statement for this report dataset.

OK

Saves the changes and exits the dialog box.

Note
The SQL query will be checked for errors when you click OK. If errors are found, you must correct them and then click OK again.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Parameters Dialog Box

Topic Last Updated—August 2008

Use the Configuration Manager 2007 R2 Report Parameters dialog box to specify or edit the parameters used by the report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This dialog box contains the following elements:

Parameters window

Displays the report parameters currently configured for the report.

Add

Click to add a new report parameter to this report.

Delete

Click to delete the currently selected report parameter.

Parameter Name

Displays the name of the currently selected report parameter.

Prompt Text

Specifies the text displayed to the user to prompt for a value for this report parameter.

Valid Values

Select this check box if you want to define valid values for this report parameter in the Valid Values section of the Report Parameters dialog box.

Allow Blank

Select this check box if you want to allow the user to supply a blank value for this report parameter.

Query Based

Select this check box if you want to use the results from a SQL query to specify the valid values for this report parameter.

Static List

Select this check box if you want to specify a list of possible values for this report parameter.

Dataset Name

Specifies the dataset name to use to return the list of possible values for this report parameter. This option is available if you have specified to use a SQL query to return valid values for this report parameter.

Value field

Specifies the value field to use to return the list of possible values for this report parameter. This option is available if you have specified to use a SQL query to return valid values for this report parameter.

Label field

Specifies the label field to use to return the list of possible values for this report parameter. This option is available if you have specified to use a SQL query to return valid values for this report parameter.

Value and label list

Specify a list of labels and values to use as values for the report parameter. This option is available if you have specified to use a static list for this report parameter.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Help

Opens the help topic for this dialog box.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Properties: General Tab

Topic Last Updated—August 2008

Use the General tab of the Configuration Manager 2007 R2 Report Properties dialog box to view and modify properties for the selected report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements.

Report name

Specifies the name of this report. Type a new name for the report, and then click Apply to save the changes.

Description

Specifies the description for this report. Type a new description for the report, and then click Apply to save the changes. The description field holds a maximum of 512 characters.

Modified date

Displays the date and time when this report was last modified.

Modified by

Displays the Windows user name of the last user who last modified this report.

Creation date

Displays the date and time when this report was created.

Created by

Displays the Windows user name of the user who created this report.

Size

Displays the size in bytes of this report.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New Model-Based Report in SQL Reporting Services
How to Create a New SQL-Based Report in SQL Reporting Services
How to Modify an Existing SQL Reporting Services Report

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Properties: Datasets Tab

Topic Last Updated—August 2008

Use the Datasets tab of the Configuration Manager 2007 R2 Report Properties dialog box to create and modify the datasets used by the report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements.

New

Click to create a new dataset.

Edit Command Text

Click to open the Command Text dialog box to edit the SQL statement for the currently selected dataset.

Report Parameters

Click to open the Report Parameters dialog box to modify the parameters used by this report.

Delete Dataset

Click to delete the currently selected dataset.

Dataset Name

Choose the dataset you want to view or edit from the drop-down list.

Timeout

Specify the time in seconds after which processing of this query will fail if data cannot be retrieved from the data source. The default value is 30 seconds.

Display dataset on report

Check this box to display the results of this dataset in the report.

SQL Statement

Displays the SQL statement for the currently selected dataset. Click the edit button to modify the SQL statement.

Fields

Displays the rows that will be returned by the currently selected dataset.

OK

Saves the changes and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Create a New SQL-Based Report in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Properties: Subscriptions Tab

Topic Last Updated—August 2008

Use the Subscriptions tab of the Configuration Manager 2007 R2 Report Properties dialog box to view and modify subscriptions configured for the selected report.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements:

New

Opens the Create Subscription Wizard to create a new subscription for this report.

Edit

Click this button to edit the currently selected subscription.

Delete

Click this button to delete the currently selected subscription.

Subscriptions in use

Displays the ID and description of each subscription configured for the currently selected report.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Subscription Dialog Box: Subscription Delivery Tab

Topic Last Updated—August 2008

Use the Subscription Delivery tab of the Configuration Manager 2007 R2 Report Subscription dialog box to configure the delivery method and properties for this report subscription.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements:

Report delivered by:

Choose a delivery method for this subscription from the drop-down list. The available delivery methods are E-mail and Windows File Share.

If you choose E-mail from the Report delivered by drop-down list, this tab will contain the following elements:

To:

Enter a valid e-mail address to send this report to.

Note
You can enter multiple e-mail recipients by separating each e-mail address with a semi-colon.

Cc:

Optionally, specify an e-mail address to copy this report to.

Bcc:

Optionally, specify an e-mail address to send a blind copy of this report to.

Reply-To:

Specify the reply address to use if the recipient replies to the e-mail message.

Subject:

Specify a subject line for the subscription e-mail message.

Priority:

Select the priority flag for this e-mail message. Choose from Low, Normal, or High. The priority setting is used by Microsoft Exchange to set a flag indicating the importance of the e-mail message.

Comment:

Specify text to be added to the body of the subscription e-mail message.

Description:

Specify a description for this report subscription.

Include Report:

Specify that the report should be attached to the e-mail message. The format in which the report will be attached is specified in the Render Format drop-down list.

Render Format:

Choose a format for the attached report from the drop-down list. The following options are available:

  • Web archive—Embeds the report in the body of the e-mail message.
  • XML file with report data—Attaches the report in Extensible Markup Language format.
  • CSV (comma delimited)Attaches the report in comma-separated value format.
  • TIFF fileAttaches the report in Tagged Image File Format.
  • Acrobat (PDF) fileAttaches the report in Acrobat Portable Document Format.
  • ExcelAttaches the report as a Microsoft Office Excel spreadsheet.
Include Link:

Includes a URL to the subscribed report in the body of the e-mail message.

Important
If both Include Report and Include Link are cleared, only the text in the e-mail subject line is sent.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Displays the help topic for this tab of the dialog box.

If you choose Windows File Share from the Report delivered by drop-down list, this tab will contain the following elements:

File Name:

Specify a file name for this report.

Add file extension when the file is created

Select this box to automatically add a file extension to this report based on the render format.

Path:

Specify a Universal Naming Convention (UNC) path to an existing folder where you want to deliver this report (for example, \\<server name>\<report folder>).

Render Format:

Choose a format for the report from the drop-down list. The following options are available:

  • XML file with report data—Saves the report in Extensible Markup Language format.
  • CSV (comma delimited)Saves the report in comma-separated-value format.
  • TIFF file—Saves the report in Tagged Image File Format.
  • Acrobat (PDF) file—Saves the report in Acrobat Portable Document Format.
  • Web page for IE 5.0 or later (.htm)—Saves the report as a Web page viewable only in browsers running Internet Explorer 5 or later.
  • Web page for most web browsers (.htm)—Saves the report as a Web page viewable in most Web browsers.
  • Web archive—Saves the report in MIME HTML format (mhtml), which is viewable in many Web browsers.
  • Excel—Saves the report as a Microsoft Office Excel spreadsheet.
User Name:

Specify a Microsoft Windows user name with permissions to access the destination file share.

Password:

Specify the password for the Windows user name.

Overwrite an existing file with a newer version

If the report file already exists, it will be overwritten with the new version.

Do not overwrite an existing file

If the report file already exists, no action will be taken.

Increment file names as newer versions are added

If the report file already exists, the new report will have a number added to the file name to distinguish it from other versions.

Description:

Specify a description for this report subscription.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Displays the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Subscription Dialog Box: Subscription Schedule Tab

Topic Last Updated—August 2008

Use the Subscription Schedule tab of the Configuration Manager 2007 R2 Report Subscription Properties dialog box to configure the schedule by which a subscribed report will be run and delivered.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements:

Use shared schedule:

A shared schedule is a previously defined schedule that can be used by other report subscriptions. Select this check box, and then select a shared schedule from the drop-down list if any have been specified.

Create new schedule:

Configure the schedule on which this report will run and the start and end dates for this subscription.

Note
The options to create a schedule will vary depending on the schedule type you choose.

Start time:

Specify the time of day to run this report subscription.

Begin on:

Specify the start date for this report subscription.

Stop on:

Select this box to specify an end date for this report subscription, and then specify the date from the drop-down list.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Report Subscription Dialog Box: Subscription Parameters Tab

Topic Last Updated—August 2008

Use the Subscription Parameters tab of the Configuration Manager 2007 R2 Report Subscription Properties dialog box to configure the parameters that this report requires when it is run unattended.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

This tab contains the following elements:

Specify the report parameters to use with this subscription.

For each report parameter in the list, click Values to open the Parameter Value dialog box. In the Parameter Value dialog box, type in the value for the report parameter, or select it from the list.

OK

Saves the changes, and exits the dialog box.

Cancel

Exits the dialog box without saving any changes.

Apply

Saves the changes, and remains in the dialog box.

Help

Opens the help topic for this tab of the dialog box.

See Also

Tasks

How to Configure Report Subscriptions in SQL Reporting Services
How to Modify a Report Subscription in SQL Reporting Services

Concepts

Administrator Checklist for SQL Reporting Services

Other Resources

SQL Reporting Services in Configuration Manager 2007 R2


Home Pages

Use the following sections to learn more about the Configuration Manager Client home pages.

In This Section

Desired Configuration Management Home Pages

Network Access Protection Home Pages

Operating System Deployment Home Page

Queries Home Page

System Status Home Pages

Software Distribution Home Pages

Software Updates Home Pages

Application Compatibility Connector Toolkit Home Page


Application Compatibility Connector Toolkit Home Page

The Application Compatibility Toolkit (ACT) Connector home page displays information that will assist administrators with determining device driver and application compatibility status.

Application Compatibility Toolkit Connector Summary Window

The ACT Connector Summary window displays the compatibility assessment information for Devices and Computers and associated device drivers. For each device and computer, the ACT Connector Summary window displays the following information:

  • Name - The name of the type of object that was assessed.
  • Total - The total number of computers or devices that have been summarized.
  • Action Required - Displays the computers or devices that require administrator action to be compatible with Windows Vista.
  • Windows Vista Ready - Displays the computers or devices that are compatible with Windows Vista.
  • Device Driver Availability - Displays a graph that indicates what portion of computers and devices meet Windows Vista system device driver requirements. The graph displays the following status categories:
    1. Windows Vista Ready - Indicates the required device driver is available with Windows Vista or in the Configuration Manager 2007 driver catalog.
    2. Action Required - Indicates the required device drivers are not available with Windows Vista or in the Configuration Manager 2007 driver catalog. You can use associated reports to determine location of required device drivers if known.
    3. Unknown - Indicates Configuration Manager 2007 and ACT are unable to determine the device driver status for this device.
  • Application Compatibility - Displays a graph that indicates what portion of computers and devices meet Windows Vista system application requirements. The graph displays the following status categories:
    1. Action Required – Indicates the ACT My Assessment status is either the yellow exclamation point which means there are minor issues, or the red "X" icon which means there are major issues.
    2. Unknown - Indicates that no ACT My Assessment status is selected. This value is blank in ACT.
    3. Windows Vista Ready - Indicates the ACT My Assessment status is a green check mark icon which means all applications work properly and function as expected.
  • Recommended System Requirements - Displays a graph that indicates what portion of computers and devices meet Windows Vista recommended system requirements. The graph displays the following status categories:
    1. Action Required - Indicates the computer does not meet Windows Vista recommended system requirements for processor speed, drive space, or memory.
    2. Unknown - Indicates that no ACT My Assessment status is selected. This value is blank in ACT.
    3. Windows Vista Ready - Indicates the ACT My Assessment status is a green check mark icon which means all applications work properly and function as expected.

Links and Resources Window

The Links and Resources window displays a list of Navigation links, Web Reports, and Resources that can assist you to find additional information about operating system deployments in your Configuration Manager 2007 site.

You can select the following default actions grouped under ACT Connector in the Actions pane. You can collapse the default actions by clicking the up arrow in the Boot Images section header.

UI Element List

Run Device Driver Synchronization

Initiates the Device Driver Synchronization dialog box. This action will synchronize device driver compatibility information with the Microsoft Corporation and the ACT community.

New Windows Vista Deployment Collection

Launches the New Windows Vista Deployment Collection Wizard which will allow you to crate a new Configuration Manager 2007 collection based on administrator defined criteria.

Refresh

Refreshes the information displayed in the Results pane.

Properties

Launches the properties associated with the Application Compatibility Toolkit (ACT) Connector node in the administrator console.


Desired Configuration Management Home Pages

The desired configuration management home pages in the Configuration Manager 2007 console tree display summary information, links, and resources related to the desired configuration management feature in Configuration Manager 2007.

Click the related link below for detailed information about each desired configuration management home page.

In This Section

Desired Configuration Management Home Page

Displays the desired configuration management main home page, which provides summary information, links, and resources for the desired configuration management feature, and also provides the actions that are available from this home page.

Configuration Baselines Home Page

Displays the configuration baselines that are stored at the site, and also displays the actions that are available from this home page.

Configuration Items Home Page

Displays the configuration items that are stored at the site, and also displays the actions that are available from this home page.

See Also

Tasks

Problems Editing Configuration Data in the Configuration Manager Console

Other Resources

Overview of Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


Desired Configuration Management Home Page

Desired configuration management in Microsoft System Center Configuration Manager 2007 allows you to assess the compliance of computers against defined configuration baselines.

When desired configuration management is enabled on a Configuration Manager 2007 site, the information shown in the desired configuration management home page shows a snapshot of configuration baselines that are reporting out of compliance. It also shows the severity level and numbers of compliant and noncompliant client computers.

UI Element List

The desired configuration management home page contains the following elements:

Desired Configuration Compliance Summary

This section displays an overview of configuration baselines that are reporting non-compliance. It also displays counts of compliant and non-compliant client computers. This information can be filtered by non-compliance severity and configuration baseline category. For more information about the non-compliance severity level, see About the Non-Compliance Severity Level in Desired Configuration Management. For more information about configuration baseline categories, see About Configuration Categories in Desired Configuration Management.

By default, only configuration baselines that are reporting non-compliance with the non-compliance severity of Error are displayed. Change the Minimum severity value or run reports to display non-compliant configuration baselines with other non-compliance severity levels, and compliant configuration baselines. For more information about desired configuration management reports, see About Reports for Desired Configuration Management.

Note
All configuration baselines with an evaluation failure because the data could not be found (discovery error) will report a non-compliance severity level of Warning. All configuration baselines that have an evaluation failure because of an infrastructure failure will report a non-compliance severity level of Information.

Links and Resources

This section displays the following:

  • Navigation links to nodes in the Configuration Manager console that are related to desired configuration management.
  • Web reports that provide further information about desired configuration management.
  • Resources to help topics and information related to desired configuration management.

Actions for the Desired Configuration Management Home Page

The following actions are available on the desired configuration management home page:

Action Description

Schedule Home Page Summarization

Specifies the schedule for the desired configuration management home page summarization, which is how often the home page summarization information is updated in the Configuration Manager 2007 database.
You can configure summarization to occur every x days, hours or minutes. The default summarization interval is 2 hours.

Note
You might need to click Refresh on the desired configuration management home page to view the latest information from the Configuration Manager 2007 database.

Run Home Page Summarization

Specifies that the desired configuration management home page summarization occurs as soon as possible. The data in the Configuration Manager 2007 database is updated to reflect the latest values.

Note
You might need to click Refresh on the desired configuration management home page to view the view the latest information from the Configuration Manager 2007 database.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Properties

Opens the desired configuration management properties dialog box which allows you to manage class security rights for desired configuration management.

Help

Opens the associated help topic.

See Also

Tasks

How to Use Meaningful Names in Desired Configuration Management
How to Create a New Configuration Baseline in Desired Configuration Management
How to Create a New Configuration Item in Desired Configuration Management
How to Use the Desired Configuration Management Home Page

Other Resources

Overview of Desired Configuration Management
Planning for Desired Configuration Management
Configuring Desired Configuration Management
Tasks for Desired Configuration Management
Technical Reference for Desired Configuration Management
Troubleshooting Desired Configuration Management
How to Manage Configuration Baselines and Configuration Items for Desired Configuration Management


Configuration Baselines Home Page

The Configuration Baselines node in the Configuration Manager console appears under the Desired Configuration Management node. This node displays any desired configuration management configuration baselines that have been created, imported, or replicated from a parent site. For each configuration baseline, the following information is displayed by default:

  • Name: Specifies the name of the configuration baseline.
  • CI Version: Specifies the version number of the configuration baseline.
  • Content Version: Specifies the version number of the XML content contained in this configuration baseline.
  • Categories: Specifies the categories that have been assigned to the configuration baseline.
  • Status: Specifies whether the configuration baseline is enabled, or disabled for compliance monitoring.
  • Created (UTC): Specifies the date in Coordinated Universal Time when the configuration baseline was created.
  • Last Modified (UTC): Specifies the date in Coordinated Universal Time when the configuration baseline was last modified.
  • Last Modified By: Specifies the Windows user account that was logged on when the configuration baseline was last modified.
  • Site Code: Specifies the Configuration Manager 2007 site code where the configuration baseline was created.

You can use View, Add/Remove columns to add further information to this window.

Actions for the Configuration Baselines Home Page

The following actions are available on the Configuration Baselines home page:

Action Description

New Configuration Baseline

Opens the Create Configuration Baseline Wizard, which allows you to create a new configuration baseline.

Import Configuration Data

Opens the Import Configuration Data Wizard, which allows you to import configuration items and configuration baselines from files.

New Folder

Opens the New Folder dialog box, which allows you to create a folder to group configuration baselines together.

New Search Folder

Opens the Search Folder Criteria dialog box, which allows you to gather configuration baselines into a folder based on search criteria.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the display pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the display pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting an existing configuration baseline will cause the following additional actions to be displayed:

Action Description

Assign to a Collection

Opens the Assign Configuration Baseline Wizard, which allows you to assign configuration baselines to collections.

Export Configuration Data

Allows you to export the selected configuration baselines and related configuration items to a file.

Duplicate

Creates a copy of the selected configuration baseline.

Disable/Enable Baseline

Toggles the status of a configuration baseline between enabled and disabled for compliance monitoring.

View XML Definition

Displays the XML definition for the configuration baseline in a new window.

Manage Categories

Opens the Categories dialog box from where you can assign, modify or remove a category for this configuration baseline and also create new categories and delete existing categories.

Add

Allows you to add the following types of configuration item to this configuration baseline:

  • Operating System configuration item
  • Required Application or General configuration item
  • Optional Application configuration item
  • Software Update configuration item
  • Prohibited application configuration item
  • Configuration Baseline

Cut

Moves the selected configuration baseline to the Windows clipboard.

Copy

Copies the selected configuration baseline to the Windows clipboard.

Paste

Pastes a configuration baseline from the Windows clipboard into the currently selected folder.

Note
This option is only visible if you have cut or copied a configuration baseline to the Windows clipboard.

Delete

Opens the Confirm Deletion dialog box, which allows you to review the effects of the deletion before deleting the configuration baseline.

Refresh

Refreshes the display with the most current information.

Properties

Opens the Properties dialog box, which allows you to review and change the properties of the selected configuration baseline.

Help

Opens the associated help topic.

See Also

Tasks

How to Import a Configuration Baseline in Desired Configuration Management
How to Assign Configuration Baselines in Desired Configuration Management
How to Export a Configuration Baseline in Desired Configuration Management
How to Create a Duplicate Configuration Baseline in Desired Configuration Management
How to View XML Definitions of Configuration Items and Configuration Baselines in Desired Configuration Management
How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management
How to Delete a Configuration Baseline in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Baselines in Desired Configuration Management
About Folders and Search Folders

Other Resources

How to Configure Configuration Baselines for Desired Configuration Management


Configuration Items Home Page

The Configuration Items node in the Configuration Manager console appears under the Desired Configuration Management node. This node displays any desired configuration management configuration items that have been created, imported, or inherited from a parent site. For each configuration item, the following information is displayed:

  • Name: Specifies the name of the configuration item.
  • Type: Specifies the type of configuration item: Application, General, or Operating System.
  • CI Version: Specifies the version number of the configuration item.
  • Content Version: Specifies the version number of the XML content contained in this configuration item.
  • Categories: Specifies the categories that have been assigned to the configuration item.
  • Created (UTC): Specifies the date in Coordinated Universal Time when the configuration item was created.
  • Last Modified (UTC): Specifies the date in Coordinated Universal Time when the configuration item was last modified.
  • Last Modified By: Specifies the Windows user account that was logged on when the configuration item was last modified.
  • Site Code: Specifies the Configuration Manager 2007 site code where the configuration item was created.

You can use View, Add/Remove columns to add further information to this window.

Actions for the Configuration Items Home Page

The following actions are available on the Configuration Items home page:

Action Description

Import Configuration Data

Opens the Import Configuration Data Wizard that allows you to import configuration items and baselines from files.

New

Provides the following options:

  • Application Configuration Item: Opens the Create Application Configuration Item Wizard.
  • General Configuration Item: Opens the Create General Configuration Item Wizard.
  • Operating System Configuration Item: Opens the Create Operating System Configuration Item Wizard.
  • Folder: Opens the New Folder dialog box, which allows you to create a folder to group configuration baselines together.
  • Search Folder: Opens the Search Folder Criteria dialog box, which allows you to gather configuration baselines into a folder based on search criteria.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting an existing configuration item will cause the following additional actions to be displayed:

Action Description

Export Configuration Data

Allows you to export a configuration item to a file.

Duplicate

Creates a copy of the selected configuration baseline.

Create Child Configuration Item

Creates a new child configuration item from the selected configuration item.

View Xml Definition

Displays the XML definition for the configuration item in a new window.

Manage Categories

Opens the Categories dialog box from where you can assign, modify or remove a category for this configuration item and also create new categories and delete existing categories.

Move Items

Opens the Move Items dialog box which allows you to move the selected configuration item into a folder.

Cut

Moves the selected configuration item to the Windows clipboard.

Paste

Pastes a configuration item from the Windows clipboard into the currently selected folder.

Note
This option is only visible if you have used Cut to move a configuration item to the Windows clipboard.

Delete

Opens the Confirm Deletion dialog box that allows you to review the effects of the deletion before deleting the configuration item.

Refresh

Refreshes the display with the most current information.

Properties

Opens the configuration item properties dialog box, which allows you to review and change the properties of the selected configuration item.

Help

Opens the associated help topic.

See Also

Tasks

How to Import Configuration Items in Desired Configuration Management
How to Export Configuration Items in Desired Configuration Management
How to Create a Duplicate Configuration Item in Desired Configuration Management
How to View XML Definitions of Configuration Items and Configuration Baselines in Desired Configuration Management
How to Assign Configuration Categories to Configuration Items and Configuration Baselines in Desired Configuration Management
How to Delete a Configuration Item in Desired Configuration Management
How to Create a Child Configuration Item in Desired Configuration Management
Problems Editing Configuration Data in the Configuration Manager Console

Concepts

About Configuration Items in Desired Configuration Management


Network Access Protection Home Pages

The Network Access Protection home pages in the Configuration Manager 2007 console tree display summary information, links, and resources related to the Network Access Protection feature in Configuration Manager 2007. Click the related link below for detailed information about each Network Access Protection home page.

In This Section

Network Access Protection Home Page

Displays the Network Access Protection main home page, which provides summary information, provides links and resources for the Network Access Protection feature, and also provides the actions that are available from this home page.

Policies Home Page

Displays the Network Access Protection policies that are configured for the site, and also displays the actions that are available from this home page.


Network Access Protection Home Page

Network Access Protection (NAP) in Configuration Manager 2007 works with health policies, connection request policies, and network policies on a Windows Network Policy Server, allowing you to select which software updates will be evaluated for compliance. The Configuration Manager 2007 System Health Validator point determines whether a client is compliant or non-compliant and passes this information to the Windows Network Policy Server. The policies on the Windows Network Policy Server then determine whether clients are granted full or limited network access, and whether non-compliant clients are made compliant (remediated).

When Network Access Protection is enabled on a Configuration Manager 2007 site, the information shown in the Network Access Protection node provides a snapshot of how this affects clients in the Configuration Manager 2007 site. It shows how many of the NAP-capable clients are in remediation and the five software updates most frequently required for remediation. It also provides a summary of any problems encountered while remediating clients.

UI Element List

The Network Access Protection home page contains the following elements:

NAP Remediation Statistics

This section displays remediation information that includes how many clients are NAP-capable (derived from hardware inventory), and how many clients were in remediation during the last summarization interval. It also displays the five most frequently requested software updates that were required during remediation.

Note
Remediation can be triggered for system health agents other than Configuration Manager 2007, so the Computers in remediation count can include computers that have not undergone Configuration Manager 2007 remediation.

Error Summary

This section displays the five most frequently encountered Configuration Manager 2007 remediation errors.

Links and Resources

This section displays the following:

  • Navigation links to nodes in the Configuration Manager console that are related to Network Access Protection.
  • List of reports that provide more detailed information about Network Access Protection in Configuration Manager 2007.
  • Resources to related help topics and information related to Network Access Protection.

Actions for the Network Access Protection Home Page

The following actions are available on the home page.

Action Description

Schedule home page summarization

Specifies the schedule for the Network Access Protection home page summarization, which is how often the data displayed on the home page is updated with the most recent data in the site database. Configure summarization to occur every x days, hours, or minutes. By default, summarization is scheduled for every 30 minutes.

Run home page summarization

Specifies that the home page summarization occurs as soon as possible. The data displayed on the home page is updated with the most recent data in the site database. The scheduled summarization will still occur on its scheduled interval.

Give feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New windows from here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Tasks

How to Enable the Network Access Protection Client Agent
How to Create a Configuration Manager NAP Policy for Network Access Protection
How to Install the System Health Validator Point

Concepts

About the Network Access Protection Process
About Network Access Protection Remediation
About the Statement of Health (SoH) in Network Access Protection
About Enforcing Compliance with Network Access Protection
About the NAP Client Status in Network Access Protection
About Enabling and Disabling Network Access Protection
About System Health Validator Points in Network Access Protection
About Compliance for Network Access Protection in Configuration Manager


Policies Home Page

The Policies node in the Configuration Manager console appears under Network Access Protection after the Network Access Protection (NAP) client agent is enabled for the site. This node displays software updates that have been selected to be included in NAP evaluation, and the date that evaluation will be effective (the Effective Date).

Refresh the Configuration Manager console to display the latest Network Access Protection information, for example:

  • If you have just enabled the Network Access Protection client agent, refresh the Network Access Protection node to display the Policies node.
  • If another administrator is defining Configuration Manager 2007 NAP policies (for example, when using the software updates feature) or the site is inheriting policies from a parent site, refresh the Policies node. This will ensure the latest Configuration Manager 2007 NAP policies are displayed.

Software updates can be configured for NAP evaluation with the New Policies Wizard. You can run this wizard by right-clicking the Policies node and then selecting New Policies. Configuration Manager 2007 NAP policies can also be created by configuring a software update to be evaluated for NAP under the Software Updates node as part of the Deploy Software Updates Wizard or by configuring the software update's property under the Software Updates node.

When you configure a software update for NAP evaluation in either the Software Updates node or in the Network Access Protection node, the resulting Configuration Manager 2007 NAP policy is always displayed in the NAP Policies node.

To modify the Effective Date, edit the policy properties. This setting can also be modified in the software update properties in the Software Updates node.

To stop a software update from being evaluated for NAP, delete the NAP policy by selecting it and pressing the Delete key. This is the same as canceling the selection Include in NAP evaluation in the software update properties in the Software Updates node.

Actions for the Policies Home Page

The following actions are available on the Policies home page.

Action Description

Give feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New windows from here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Properties

Opens the properties of the policy so that you can modify the Effective Date.

You can configure the same Effective Date for multiple policies by selecting the policies and then selecting Properties.

Help

Opens the associated help topic.

See Also

Tasks

How to Set the Effective Date and Time to Begin NAP Evaluation for Network Access Protection
How to Create a Configuration Manager NAP Policy for Network Access Protection
How to View Configuration Manager NAP Policies for Network Access Protection
How to Enable the Network Access Protection Client Agent

Concepts

About Configuration Manager NAP Policies in Network Access Protection
About the NAP Effective Date in Network Access Protection
About NAP Evaluation in Network Access Protection
About Network Access Protection in Configuration Manager Hierarchies


Operating System Deployment Home Page

The Operating System Deployment home page displays Advertisement Status information and links to resources.

Advertisement Status Window

The Advertisement Status window displays a list of the ten most active advertisements of task sequences over the specified period of time. The default time period is seven days, but you can select one day or thirty days as the display period from the list box. For each advertisement, the Advertisement Status window displays the following information:

  • Advertisement - The name of the advertisement.
  • Total - The total number of computers that have received the advertised task sequence.
  • Not Started - The number of computers that have not yet run the advertisement.
  • Waiting - The number of computers that have scheduled the advertisement to run
  • Running - The number of computers running the advertisement (as of the last time that information was reported by the computer to Configuration Manager 2007).
  • Succeeded - The number of computers that returned a success code after running the advertisement.
  • Failed - The number of computers that returned a failure code after running the advertisement.
  • Retrying - The number of computers that have restarted the advertisement.
  • Percent Completed - The percentage of computers that ran the advertisement and reported either a success or failure.
  • Percent Completed - Using a progress bar displays the percentage of computers that ran the advertisement and reported either a success or failure.

If you have enabled a reporting point for your Configuration Manager 2007 site, you can click the advertisement in the Advertisement Status window to run a report that provides additional details about the advertisement.

Links and Resources Window

The Links and Resources window displays a list of Navigation links, Web Reports, and Resources that can assist you to find additional information about operating system deployments in your Configuration Manager 2007 site.


Operating System Deployment - Access Accounts

Access accounts allows you to grant, limit, or revoke access to package source files on distribution points, per user or per group. If you add or modify an existing Generic or Windows access account you must refresh all associated distribution points with the new permissions.

To specify a package access account

  1. Navigate to Access Accounts.

  2. Right-click Access Accounts, point to New, and then click the type of access account you want (Windows or Generic).

  3. In the new Access Account dialog box, specify the user or user group account that can access the package on the distribution point.

New Generic Access Account

Setting | Description
Package access account | Specify the type of account by clicking the Set button to load the New Generic Access Account dialog box.
Permissions | Specify the permissions that should be assigned to the account specified using the drop down. You can specify Read, Change, Full Control, or No Access.

New Windows User Access Account

Setting | Description
Package access account | Specify the type of account by clicking the Set button to load the New Windows User Access Account dialog box. Specify the access account by typing the account name on the User name line using the following format: Domain\User. Specify if this account will be a User or Group in the Account type section.
Permissions | Specify the permissions that should be assigned to the account selected using the drop down. You can specify Read, Change, Full Control, or No Access.


Operating System Deployment - Distribution Points

The Distribution Points node allows you to copy a new package to a distribution point, update an existing package on a distribution point, or manage a distribution point.

The distribution points that have been created are displayed in a list in the Distribution Points results pane. The Name column is used as the default sort order. The following columns are displayed by default:

  • Name: The name of the distribution point.
  • Site: The site that the distribution point has been assigned to.
  • Type: The site system type of the distribution point.

You can filter the distribution points that are displayed in the Distribution Points pane using the four filter actions located above the list.

Look For

Enter all or part of an operating system image package name, or use the drop-down list to select from existing filter criteria.

Search In

Select the column to use when applying the filter criteria.

Find Now

Click Find Now to run the filter.

Clear

Click Clear to remove the filter and display the entire list.

You can select the following default actions grouped under Distribution Points in the Actions pane. You can collapse the default actions by clicking the up arrow in the Operating System Images section header

Name | Description
New Distribution Points | Starts the New Distribution Point Wizard, which allows you to copy a new package to a distribution point. Select this option if this is the first time you have copied this package to the distribution point.
Update Distribution Points | Replaces an existing package version with an updated package version. This option is helpful when an existing package has been modified. Click Yes to confirm the package update.
Manage Distribution Points | Starts the Manage Distribution Points Wizard, which allows you to copy, remove, update, or refresh packages on a distribution point or points. This wizard combines the functionality of the other two wizards, but it also allows for deletion of unneeded packages and the refreshing of packages that are no longer functional.
Refresh Distribution Points | Select this option to resend this package to the distribution point.
Delete | Select this item to delete the distribution point.
Properties | Select this item to display general properties for the distribution point, and to set class security on that node.


Asset Intelligence Home Page

Topic Last Updated—August 2008

The Asset Intelligence Configuration Manager 2007 console tree node is the home page for the Asset Intelligence feature in Configuration Manager 2007 SP1. To access the Asset Intelligence home page, in the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Computer Management / Asset Intelligence.

The Asset Intelligence home page displays a summary dashboard of Asset Intelligence catalog information.

Note
The Asset Intelligence home page does not automatically update while it is being viewed. To refresh the Asset Intelligence home page information while viewing it, click F5.

  • The Asset Intelligence home page is divided into the following sections:
  • Asset Intelligence summary
  • Asset Intelligence catalog summary
  • Asset Intelligence catalog synchronization status summary
  • Links and resources
Note
The information in this topic applies only to Configuration Manager 2007 SP1.

Asset Intelligence Summary

The Asset Intelligence summary section of the Asset Intelligence home page contains the following elements.

Asset Intelligence feature state

Specifies whether or not the Asset Intelligence feature has been enabled.

System Center Online service connection status

Specifies the connection status to System Center Online.

Note
An Asset Intelligence Synchronization point site system role is required to connect to System Center Online. For information about installing an Asset Intelligence Synchronization point, see How to Install an Asset Intelligence Synchronization Point.

Asset Intelligence catalog last updated

Specifies the time and date of the last Asset Intelligence catalog update.

Asset Intelligence Catalog Summary

The Asset Intelligence catalog summary section of the Asset Intelligence home page contains the following elements.

Asset Intelligence catalog summary information tables

Displays Asset Intelligence catalog summary information in table format. The following information is displayed in number format:

  • Inventoried software titles
  • Software categories
  • Software families
In addition, the numbers of each are displayed according to one of the following identification states:

  • Identified by Microsoft
  • Identified by administrator
  • Pending online identification
Asset Intelligence catalog summary information chart

Displays Asset Intelligence catalog summary information in bar chart format. The following information is displayed in percentage format:

  • Inventoried software titles
  • Software categories
  • Software families
The information is displayed using opaque colors according to one of the following identification states:

  • Identified by Microsoft (green)
  • Identified by administrator (blue)
  • Pending online identification (yellow)
  • Unidentified and not pending online identification (red)

Asset Intelligence Catalog Synchronization Status Summary

Note
The Asset Intelligence catalog synchronization status section of the Asset Intelligence home page is only displayed if an Asset Intelligence synchronization point site system role has been installed. For more information about installing an Asset Intelligence synchronization point see How to Install an Asset Intelligence Synchronization Point.

The Asset Intelligence catalog synchronization summary section of the Asset Intelligence home page contains the following elements.

Last download time

Displays the date and time of the last Asset Intelligence catalog synchronization with System Center Online.

Changes to Categories/Families

Displays the number of new software categories added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Changes to Software Titles

Displays the number of new software titles added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Changes to CPU

Displays the number of new processor properties added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Changes to Hardware Requirements

Displays the number of new software title hardware requirements added to the Asset Intelligence catalog after the Asset Intelligence synchronization point site system was installed.

Links and Resources

The Links and Resources section of the Asset Intelligence home page contains the following elements.

Navigation

Provides links to Configuration Manager 2007 SP1 console items where Asset Intelligence components can be configured.

Web Reports

Provides links to common Asset Intelligence reports.

Resources

Provides links to external resource information.

See Also

Other Resources

Home Pages


Queries Home Page

The Queries console tree node in Microsoft System Center Configuration Manager 2007 displays the default queries created during Setup and any custom queries created by the Configuration Manager 2007 administrators. The Queries console tree node is located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Queries.

If you expand the Queries node, you see the list of queries available for the site. You can export queries from this site and import queries created in other sites. You can also group your queries with folders and search folders.

For more information, see Queries in Configuration Manager.

UI Element List

Upon clicking the Queries console tree node, the Configuration Manager 2007 console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

Queries

The Queries console tree node in Configuration Manager 2007, when highlighted, displays the following information about each query:

  • Name: Specifies the name of the query.
  • Resource Class: Displays the Object Type set on the General tab of the <query name> properties.
  • Query ID: Specifies the ID assigned by Configuration Manager 2007 to the given query.

If you double-click each query, Configuration Manager 2007 changes the focus to the query name in the tree node and then in the results pane displays the query results as specified on the <query name> Statement Properties General tab.

See Also

Tasks

How to Create a Query
How to Run or Update a Query
How to Modify How Query Results Are Displayed

Reference

Query Name Properties: General Tab
Query Statement Properties: General Tab


System Status Home Pages

The System Status home pages in the Configuration Manager 2007 console tree display summary information and resources related to the status of various site functions in Configuration Manager 2007. Click the related link below for detailed information about each system status home page.

In This Section

Advertisement Status Home Page

Displays the advertisements that are running at the site, and also displays the actions that are available from this home page.

Package Status Home Page

Displays the packages that are stored at the site, and also displays the actions that are available from this home page.

Site Status Home Page

Displays the status of the Configuration Manager 2007 site and any child sites, and also lists the actions that are available from this home page.

Component Status Home Page

Displays the status of all components of the Configuration Manager 2007 site, and also lists the actions that are available from this home page.

Site System Status Home Page

Displays the status of all site systems that are part of the Configuration Manager 2007 site, and also displays the actions that are available from this home page.

Status Message Queries Home Page

Displays the status message queries that are stored at the site and also displays the actions that are available from this home page.


Site Status Home Page

When you click the Site Status node of the Configuration Manager console, you can view the status of the current Configuration Manager 2007 site and any other sites in the Configuration Manager 2007 hierarchy in the display pane of the Configuration Manager console window.

UI Element List

For each Configuration Manager 2007 site in the list, the following information is shown by default:

Action Description

Status

Displays the status of the Configuration Manager 2007 site and any child sites. The status will be one of the following:

  • OK
  • Warning
  • Critical

Site

Displays the name of the Configuration Manager 2007 site.

Version

Displays the version number of Configuration Manager 2007 installed on the site.

Errors

Displays the total number of error status messages reported by all site components during the display interval.

Warnings

Displays the total number of warning status messages reported by all site components during the display interval.

Information

Displays the total number of informational status messages reported by all site components during the display interval.

ConfigMgr DB % Free

Displays the percentage of free storage space available for the Configuration Manager 2007 site database.

Trans. Log % Free

Displays the percentage of free disk space available for the Configuration Manager 2007 database transaction log.

Availability

Displays the availability of the Configuration Manager 2007 site. This can be one of the following:

  • Online
  • Failed
  • Degraded
  • Offline
  • Unknown

Actions for the Site Status Home Page

The following actions are available on the site status home page:

Action Description

Display Interval

Allows you to filter the displayed component status by date and time. The following values are available:

  • Since 12:00:00 AM
  • Since 6:00:00 AM
  • Since 12:00:00 PM
  • Since 6:00:00 PM
  • Since Sunday
  • Since Monday
  • Since Tuesday
  • Since Wednesday
  • Since Thursday
  • Since Friday
  • Since Saturday
  • Since the 1st of the Month
  • Since the 15th of the Month
  • Since Site Installation

The default value is Since Site Installation.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the display pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the display pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting a site from the list will cause the following additional actions to be displayed:

Action Description

Reset Counts

Allows you to reset the message counts on the selected component. This can be used to clear a Critical or Warning status. You can clear the following types of message:

  • All
  • Error
  • Warnings
  • Info

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Tasks

How to Reset Status Message Counts
How to Configure the Status Message Display Interval

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Package Status Home Page

The Package Status home page in Configuration Manager 2007 displays a snapshot of all packages currently defined for the Configuration Manager 2007 site.

For each package in the list, the following information is shown by default:

  • Name: Displays the name of the package.
  • Source Version: Displays the version number of the package source files. This is incremented each time you revise the package and can be used to determine whether a distribution point has the latest version of the package source.
  • Version Date: Displays the time and date when the package was last changed.
  • Targeted: Displays the total number of distribution points, including child sites that have a copy of the package.
  • Installed: Displays the total number of distribution points to which the current version of the package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Source Site: Displays the Configuration Manager 2007 site where the package was created.
  • Size: Displays the size of the package source folder.
  • Compressed Size: Displays the size of the compressed version of the package source folder. This is only displayed if creation of a compressed copy is specified in the package properties or if the package is targeted to a distribution point in a child site.
  • Package ID: Displays the internally assigned identifier for this package. The first three characters of this ID correspond to the site code of the originating Configuration Manager 2007 site.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Package Status Home Page

The following actions are available on the package status home page:

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting a package from the list will cause the following additional actions to be displayed:

Action Description

Show Messages

Opens the SMS Status Message Viewer window, allowing you to view a more detailed status from the selected package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to Manage Packages


Advertisement Status Home Page

The Advertisement Status home page in Configuration Manager 2007 displays a snapshot of all advertisements currently running on the Configuration Manager 2007 site.

For each advertisement in the list, the following information is shown by default:

  • Name: Displays the name of the advertisement.
  • Received: Displays the number of client computers that have received the advertisement.
  • Failures: Displays the number of client computers that have reported a failure to process the advertisement.
  • Programs Started: Displays the total number of times that client computers have started the advertised program. This total includes programs which may have started more than once on client computers; for example, those set to run on a recurring schedule.
  • Program Errors: Displays the total number of programs that have failed to run successfully on client computers.
  • Program Success: Displays the total number of programs that have run successfully on client computers.
  • Program Errors (MIF): If the advertised program generates status Management Information Format (MIF) files, then this column displays the total number of programs that have failed to run successfully by examining this MIF file.
  • Program Success (MIF): If the advertised program generates status Management Information Format (MIF) files, then this column displays the total number of programs that have run successfully by examining this MIF file.
  • Package: Displays the name of the package being advertised.
  • Program: Displays the name of the program being advertised.
  • Target Collection: Displays the name of the collection to which the advertisement is being targeted.
  • Available After: Displays the advertisement start time and date.
  • Expires After: Displays the advertisement expiration time and date if this has been specified.
  • Advertisement ID: Displays the internal Configuration Manager 2007 identification for the advertisement.

You can use View, Add/Remove columns to add further information to this list.

Actions for the Advertisement Status Home Page

The following actions are available on the advertisement status home page:

Action Description

Display Interval

Allows you to filter the displayed advertisements by date and time. The following values are available:

  • Since 12:00:00 AM
  • Since 6:00:00 AM
  • Since 12:00:00 PM
  • Since 6:00:00 PM
  • Since Sunday
  • Since Monday
  • Since Tuesday
  • Since Wednesday
  • Since Thursday
  • Since Friday
  • Since Saturday
  • Since the 1st of the Month
  • Since the 15th of the Month
  • Since Advertised

The default value is Since Advertised.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting an advertisement from the list will cause the following additional actions to be displayed:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected advertisement. You can filter the results to show only items with a status count in the following columns:

  • All
  • Received
  • Failures
  • Program started
  • Program errors
  • Program success
  • Program errors (MIF)
  • Program success (MIF)

Reset Counts

Allows you to reset the counts to zero for any of the following columns:

  • All
  • Received
  • Failures
  • Program started
  • Program errors
  • Program success
  • Program errors (MIF)
  • Program success (MIF)

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to Manage Advertisements


Component Status Home Page

When you click the Component Status node of the Configuration Manager console, you can view the status of all components in the Configuration Manager 2007 site in the results pane of the Configuration Manager console window.

UI Element List

For each component in the list, the following information is shown by default:

Action Description

Status

Displays the status of the Configuration Manager 2007 component. The status will be one of the following:

  • OK The number of status messages generated by the component has not crossed a Warning or Critical threshold as set in the Thresholds tab of the Component Status Summarizer Properties dialog box.
  • Warning The number of status messages generated by the component has crossed a Warning threshold as set in the Thresholds tab of the Component Status Summarizer Properties dialog box.
  • Critical The number of status messages generated by the component has crossed a Critical threshold as set in the Thresholds tab of the Component Status Summarizer Properties dialog box.

Site System

Displays the Configuration Manager 2007 site system running the component.

Component

Displays the name of the Configuration Manager 2007 component.

Thread State

Displays the status of the thread running the Configuration Manager 2007 component. This can be one of the following:

  • Started
  • Stopped
  • Paused
  • Installing
  • Reinstalling
  • Deinstalling

Errors

Displays the number of error messages generated by the component since it was last started.

Warnings

Displays the number of warning messages generated by the component since it was last started.

Information

Displays the number of informational messages generated by the component since it was last started.

Startup Type

Displays the method used to start the component. This can be one of the following:

Scheduled The component runs periodically, according to a defined schedule.

Autostarting The component runs automatically each time its site system is restarted.

Manual The component must be manually started by the Configuration Manager 2007 administrator.

Availability

Displays the availability of the component. This can be one of the following:

  • Online
  • Failed
  • Degraded
  • Offline
  • Unknown

Next Scheduled

Displays the time and date when the component is next scheduled to start.

Last Started

Displays the time and date when the component last started.

Last Status Message

Displays the time and date when the component last generated a status message.

Last Heartbeat

Displays the last time that the component generated a heartbeat to indicate its status.

Heartbeat Interval

Displays the defined heartbeat interval (if any) for the component. If a component fails to report a heartbeat within this interval, then its status will be reported as failure.

Type

Displays the component type. The following values are possible:

  • Unknown
  • Monitored Thread Component
  • Unmonitored Thread Component
  • Monitored Service Component
  • Unmonitored Service Component
  • Component Not Installed by Site Component Manager

Actions for the Component Status Home Page

The following actions are available on the package status home page:

Action Description

Display Interval

Allows you to filter the displayed component status by date and time. The following values are available:

  • Since 12:00:00 AM
  • Since 6:00:00 AM
  • Since 12:00:00 PM
  • Since 6:00:00 PM
  • Since Sunday
  • Since Monday
  • Since Tuesday
  • Since Wednesday
  • Since Thursday
  • Since Friday
  • Since Saturday
  • Since the 1st of the Month
  • Since the 15th of the Month
  • Since Site Installtion

The default value is Since Site Installation.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting a component from the list will cause the following additional actions to be displayed:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the component. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Start

Allows you to start further tools to assist you in troubleshooting. The following tools are available:

  • Resource Explorer
  • ConfigMgr Service Manager
  • Windows Event Viewer
  • Windows Diagnostics
  • Windows Performance Monitor

Reset Counts

Allows you to reset the message counts on the selected component. This can be used to clear a critical or warning status. You can clear the following types of message:

  • All
  • Error
  • Warnings
  • Info

Refresh

Refreshes the display with the most current information.

Properties

Opens the General tab of the Component Status Properties dialog box, allowing you to view status message threshold information for the selected Configuration Manager 2007 component.

Help

Opens the associated help topic.

See Also

Tasks

How to Reset Status Message Counts
How to Configure the Status Message Display Interval
How to View the Status of a Component

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Site System Status Home Page

When you click the Site System Status node of the Configuration Manager console, you can view the status of all site systems in the Configuration Manager 2007 site in the results pane of the Configuration Manager console window.

UI Element List

The details pane contains the following elements:

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only site systems that contain that text in any column.

In

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible values in the results pane.

Status

Displays the status of the site system storage object. The following values are possible:

  • OK
  • Warning
  • Critical
The status is derived from the free disk space thresholds, which are specified in Site System Status Summarizer Properties: Thresholds Tab

Site System

Displays the NetBIOS name of the site system containing the storage object.

Role

Displays the role assigned to the site system containing the storage object.

Storage Object

Displays the name and location of the storage object.

Total

Displays the total disk space of the storage object.

Free

Displays the total available disk space on the storage object.

% Free

Displays the percentage of space on the storage object that is free.

Down Since

Displays the first time that a connection could not be made if the Configuration Manager 2007 can no longer connect to a site system.

Availability

Displays whether a site system is currently online or offline.

Actions for the Site System Status Home Page

The following actions are available on the site system status home page:

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting a component from the list will cause the following additional actions to be displayed:

Action Description

Show Messages

Opens the SMS Status Message Viewer window, allowing you to view a more detailed status from the component. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Start

Allows you to start further tools to assist you in troubleshooting. The following tools are available:

  • Resource Explorer
  • ConfigMgr Service Manager
  • Windows Event Viewer
  • Windows Diagnostics
  • Windows Performance Monitor

Refresh

Refreshes the display with the most current information.

Properties

Opens the General tab of the Site System Status Properties dialog box, allowing you to view status message threshold information for the selected Configuration Manager 2007 component.

Help

Opens the associated help topic.

See Also

Tasks

How to View the Status of Site Systems
How to View the Status of Storage Objects

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Status Message Queries Home Page

The Status Message Queries home page in Configuration Manager 2007 displays a list of all status message queries defined for the Configuration Manager 2007 site. You can create new status message queries and edit or run existing status message queries.

Actions for the Status Message Queries Home Page

The following actions are available on the status message queries home page:

Action Description

New Status Message Query

Opens the New Status Message Query Wizard, which allows you to create a new status message query.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Selecting a status message query from the list will cause the following additional actions to be displayed:

Action | Description
Show Messages | Opens the Prompted Status Message Query dialog box, which allows you to specify values for the status message query before the query runs.
Delete Messages | Opens the Prompted Status Message Query dialog box, which allows you to specify values for the status messages you want to delete.
Delete | Opens the Confirm Object Delete dialog box, which allows you to confirm that you want to delete the selected status message query.
Refresh | Refreshes the display with the most current information.
Properties | Opens the Status Message Query Properties dialog box for the selected status message query.
Help | Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting


Software Distribution Home Pages

The Software Distribution home page in the Configuration Manager 2007 console tree displays summary information, links, and resources distributing packages to clients. It contains two subnodes that contain information specific to distribution packages, and advertisements for the programs within the packages.

Click the related link below for detailed information about each Software Distribution console tree node.

In This Section

Software Distribution Home Page

Specifies the software distribution home page that displays summary information, provides links and resources for the software distribution feature, and provides the actions that are available from the home page.

Packages Home Page

Specifies the console tree nodes where all software distribution packages are located, and provides the actions that are available at each node.

Advertisements Home Page

Specifies the console tree nodes where all software distribution advertisements are located, and provides the actions that are available at each node.

See Also

Other Resources

How to Manage Packages
How to Manage Advertisements


Software Distribution Home Page

The Software Distribution console tree node is the home page for the software distribution feature in Configuration Manager 2007. It displays a summary of recent software distribution advertisements and contains the Packages and Advertisements subnodes. It is located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages / Advertisements.

The status of advertisements to destination computers is shown in the Software Distribution Status Summary results pane, which displays the 10 most active advertisements for the specified period of the last day, the last 7 days, or the last 30 days. This status is viewable in both table and chart form. The data displayed is updated based on the home page summarization schedule, which is once per hour by default or by manually using the Run Homepage Summarization action.

Note
The chart can be changed by selecting specific advertisements to display. You can also select multiple advertisements or use the Ctrl key to select individual advertisements. Using Ctrl on the last selected advertisement will clear all selections and shows a pie chart.

The 10 most active advertisements are displayed with the following information:

  • Advertisement: Specifies the name of the given advertisement.
  • Total: Specifies the total number of clients to which the program is being advertised.
  • Not Started: Specifies the number of clients to which the program is being advertised and which have not started to run the program.
  • Waiting: Specifies the number of clients that are currently waiting to run the advertised program. The cause of this waiting is not specified, but may be due to program or advertisement conditions.
  • Running: Specifies the number of clients on which the advertised program is currently running.
  • Succeeded: Specifies the number of clients that have successfully installed the advertised package as a result of this advertisement.
  • Failed: Specifies the number of clients that have attempted to run the advertised package and have failed for any reason.
  • Retrying: Specifies the number of clients that have attempted to run the advertised package and failed, and are currently retrying the attempt.
  • % Completed: Specifies the percentage of clients on which the advertised program is installed over the total number of clients in the designated collection.

UI Element List

The Software Distribution home page displays data for the 10 most active software distribution advertisements based on a time period that is configured in the Software Distribution Status Summary, which contains the following element:

View the top ten most active advertisements over the period of

Specifies the time period covered by the table and chart summaries for the most active advertisements. The displayed table and chart are automatically refreshed to reflect the time period option chosen.

Three options are available when configuring the time period:

  • Last day
  • Last 7 days
  • Last 30 days.

Links and Resources

The Links and Resources section of the Software Distribution home page provides links to Configuration Manager 2007 console items where Software Distribution components can be configured, along with links to common software distribution reports and links to help and external resource information.

The following links and resource information is available:

Navigation

Provides links to other sections of the Configuration Manager 2007 console where Software Distribution components are configured. The following links are available:

  • Manage Programs: Navigates to the Packages node in the console tree. Expand Packages to view the packages on the site and expand a specific package to add a program or manage existing ones, manage associated distribution points, or set access accounts for the package. For more information, see Packages Property Pages.
  • Advertisements: Navigates to the Advertisements node in the console tree. Right-click Advertisements to create a new advertisement, or right-click a specific advertisement to disable, rerun, or otherwise manage the advertisement. For more information, see Advertisements Property Pages.
  • Manage Maintenance Windows: Navigates to the Collections node in the console tree. Maintenance windows are managed on a per collection basis. Right-click a specific collection, and then click Modify Collection Settings to manage the maintenance windows for that collection.
Web Reports

Provides links to common software distribution Web reports. Click the link to open the specified report.

Resources

Provides links to common software distribution resources. Click the link to open the specified resource.

General Actions for the Software Distribution Home Page

The following general actions are available on the Software Distribution home page.

Action | Description
Schedule home page summarization | Specifies the schedule for the Software Distribution home page summarization, which is how often the data displayed on the home page is updated with the most recent data in the site database. Configure summarization to occur every x days, hours, or minutes. By default, summarization is scheduled for once per hour.
Run home page summarization | Specifies that the Software Distribution home page summarization occurs as soon as possible. The data displayed on the home page is updated with the most recent data in the site database. The scheduled summarization will still occur on its scheduled interval.
Give feedback | Opens a Configuration Manager 2007 Web site where feedback can be given.
View | Opens the Customize view dialog box, which allows you to specify which items are displayed in the Configuration Manager 2007 console window.
New windows from here | Opens a new console window using the current node as the root node.
Refresh | Refreshes the display with the most current information.
Help | Opens the associated help topic.

See Also

Other Resources

Software Distribution Home Pages


Packages Home Page

The Packages console tree node in Microsoft System Center Configuration Manager 2007 displays packages, and the programs, distribution points, and access accounts associated with them. The Packages console tree node and subnodes are located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Packages / <Package name>.

Within the Packages node, the New Package Wizard is used to create new software distribution packages. For more information, see How to Create a Package and How to Create a Package from a Package Definition File.

Existing or new packages can then be distributed to client computers using the Distribute Software Wizard. For more information, see Distribute Software Wizard.

UI Element List

Upon clicking the Packages console tree node or subnodes, the Configuration Manager console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The following sections describe the Packages console tree node and subnodes.

Packages

The Packages console tree node in Configuration Manager 2007, when highlighted, displays the following information about each package:

  • Name: Specifies the name of the package.
  • Manufacturer: Specifies the publisher of the package, as given in the package properties. When a package was created using a package definition, this information is based on the definition information.
  • Version: Specifies the version of the package, as given in the package properties.
  • Language: Displays the language specified for the package, as given in the package properties.
  • Package ID: Specifies the ID assigned by Configuration Manager 2007 to the given package.

<Package Name>

The <package name> console tree nodes display by name the individual packages that are defined in the packages list. Information specific to each package can be modified at this location. This data is sorted for each package by access accounts, distribution points, and programs. The following information is displayed for each package in the Packages node:

  • Access Accounts: Specifies the package access accounts that have been set for the given package. Additional data for each account can be seen by right-clicking the account and then clicking Properties. For more information, see Access Account Properties: General Tab.
    • Name: Specifies the name of the access account. If a Windows User Access Account is displayed, it will be in the following form: domain\username.
    • Type: Specifies the type of account, whether a Generic Access Account or Windows User Access Account.
    • Access: Specifies the access permissions of the displayed access account for this package.
  • Distribution Points: Specifies the distribution points to which this package has been copied, so as to be available for download by client computers. Additional data for each distribution point can be seen by right-clicking the distribution point and then clicking Properties. For more information, see Distribution Point Properties: General Tab.
    • Name: Specifies the name of the distribution point.
    • Site: Specifies the site code and name of the site on which the distribution point is located.
    • Type: Specifies the site system type for the distribution point.
  • Programs: Specifies the individual programs that are contained in this package for running on client computers. Additional data for each program can be seen by right-clicking the program and then clicking Properties. For more information, see Program Name Properties.
    • Name: Specifies the name of the program.
    • Run Time: Specifies the maximum allowed run time of the program as given in the program properties. This is specified in hours and minutes in the format hh:mm.
    • Disk Space Requirement: Specifies the disk space required as given in the program properties.
    • Comment: Displays any comment associated with the program as specified in the program properties.

Actions for the Packages Nodes

Different actions are available depending on where you are in the console tree. The following table lists the general and specific actions for the Packages console tree node and subnodes.

General Actions

The following actions are available on several Packages console tree nodes.

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View (all nodes except <Package Name> nodes)

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New Windows from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Packages

The following actions are available from the Packages console tree node.

Action Description

New

Provides the following options:

  • Package: Opens the New Package Wizard, where you can manually create a new package. For more information, see New Package Wizard.
  • Package from definition: Opens the Create Package from Definition Wizard, where you can create a new package based on an existing package definition file. For more information, see Create Package From Definition Wizard.
  • Folder: Creates a new folder beneath the Packages node.
  • Search Folder: Opens the Search Folder Criterion dialog box, where you can design a query to search package folders on the site. For more information, see Search Folder Criteria Dialog Box.

Distribute

Provides the following distribution options:

  • Software: Opens the Distribute Software Wizard, where you can distribute software packages to client computers. For more information, see Distribute Software Wizard.
  • Software to Device: Opens the Distribute Software to Device Wizard, where you can distribute software to client devices.

Transfer Site Settings

Opens the Transfer Site Settings Wizard, where you can transfer site settings or package and collection properties from a source site to one or more distribution points. For more information, see Transfer Site Settings Wizard.

Copy Packages

Opens the Copy Package Wizard, where you can copy one or more packages from one distribution point to another. For more information, see Copy Packages Wizard.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Large icons: Displays the results pane in Windows large icon configuration.
  • Small icons: Displays the results pane in Windows small icon configuration.
  • List: Displays the results pane in Windows list configuration.
  • Details: Displays the results pane in Windows detail configuration. The Add/Remove columns option is available only in this view configuration.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

Properties

Opens the Packages Properties dialog box, where general package information and class security rights can be set on the object. For more information, see Packages Properties.

<Package Name>

The following actions are available from the <package name> console tree node.

Action Description

Manage Distribution Points

Opens the Manage Distribution Point Wizard, where you can manage the package on distribution points. For more information, see Manage Distribution Points Wizard.

Update Distribution Points

Updates all sites and distribution points with the latest version of the package.

Distribute

Provides the following distribution options:

  • Software: Opens the Distribute Software Wizard, where you can distribute software packages to client computers. For more information, see Distribute Software Wizard.
  • Software to Device: Opens the Distribute Software to Device Wizard, where you can distribute software to client devices.

Move Items

Opens the Move Items dialog box, allowing you to select the folder within the Packages node where you can move the selected package. Once moved, refresh the console tree to view the relocated package.

Cut

Cuts the selected package in preparation to move it to a folder in the Package node. The cut package is not removed or relocated until it is pasted in a new location and the new location must be a folder within the node, not another package.

Paste

Pastes a previously cut package in a new location within the Package node.

Delete

Opens the Delete Package Wizard, where you can view the results of deleting this package and then choose whether to remove it. For more information, see Delete Package Wizard.

Export List

Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.

Properties

Opens the Package Name Properties dialog box, where package properties and other information specific to this package only can be set for the object. For more information, see Package Name Properties.

Access Accounts

The following actions are available from the Access Accounts console tree node.

Action Description

New

Provides the following options:

  • Generic Access Account: Creates a package access account mapped to a generic Windows access account. For more information, see Windows Account Dialog Box.
  • Windows User Access Account: Creates a package access account mapped to a specific Windows user access account. For more information, see Windows Account Dialog Box.

Delete

Removes the package access account and associated security rights. The Windows account to which the package access account is mapped is not affected.

Properties

Opens the Access Account Properties dialog box, where security rights can be set for individual access accounts on the object.

For more information, see Access Account Properties: General Tab.

Distribution Points

The following actions are available from the Distribution Points console tree node.

Action | Description
New Distribution Points | Opens the New Distribution Point Wizard, where you can copy the package to a new distribution point for client download. For more information, see New Distribution Points Wizard.
Update Distribution Points | Updates all sites and distribution points with the latest version of the package.
Manage Distribution Points | Opens the Manage Distribution Point Wizard, where you can manage the package on distribution points. For more information, see Manage Distribution Points Wizard.
Refresh Distribution Point | Resends the package to the selected distribution point.
Delete | Removes the package from the selected distribution point and deletes the point from the list of distribution points associated with the package. For more information, see How to Remove a Package from a Distribution Point.
Properties | Opens the Distribution Points Properties dialog box, where general distribution point information is displayed. For more information about this dialog box, see Distribution Point Properties: General Tab.

Programs

The following actions are available from the Programs console tree node.

Action Description

New

Provides the following options:

  • Program: Opens the New Program Wizard, where you can create a new program for the selected package. For more information, see New Program Wizard.
  • Program for Device: Opens the New Program for Device Wizard, where you can create a new program for the selected package that will be run on a device. For more information, see New Program for Device Wizard.

Distribute

Provides the following distribution options:

  • Software: Opens the Distribute Software Wizard, where you can distribute software packages to client computers. For more information, see Distribute Software Wizard.
  • Software to Device: Opens the Distribute Software to Device Wizard, where you can distribute software to client devices.

Delete

Opens the Delete Program Wizard, where you can view the results of deleting this program from the package and choose whether to remove it. For more information about this wizard, see Delete Program Wizard.

Properties

Opens the Program Name Properties dialog box, where program properties and other information specific to this program only can be set for the object.

For more information about this dialog box, see Package Name Properties.

See Also

Concepts

About Packages

Other Resources

Software Distribution Home Pages
How to Manage Packages
How to Manage Programs
How to Manage Distribution Points


Software Distribution Package Status Home Page

The Software Distribution Package Status Home page in the Configuration Manager 2007 console tree displays summary information for each package on the Configuration Manager 2007 site.

For each site to which the package is targeted, the following information is shown by default:

  • Site: Displays the name of the Configuration Manager 2007 site to which the package is targeted.
  • Source Version: Displays the version number of the package source files. This is incremented each time you revise the package and can be used to determine whether a distribution point has the latest version of the package source.
  • Targeted: Displays the total number of distribution points, including child sites that have been targeted with a copy of the package.
  • Installed: Displays the total number of distribution points to which the current version of the package has been successfully copied.
  • Retrying: Displays the total number of distribution points that have experienced a failure copying this package, but that have not yet exceeded the number of retries allowed and are currently in an installation retrying or a removal retrying state.
  • Failed: Displays the total number of distribution points that have exceeded the number of retries allowed during an install or removal operation and are currently in an installation failed or retry failed state.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

Selecting any site from the Package Status node displays the following information by default:

  • Distribution Point: Displays the name of each distribution point to which this package has been targeted.
  • Source Version: Displays the version number of the package source files. This is incremented each time you revise the package and can be used to determine whether a distribution point has the latest version of the package source.
  • State: Displays the current status of the package on the distribution point.
  • Last Copied: Displays the date and time when the package was last copied to the distribution point.
  • Path: Displays the location of the package files on the distribution point.
  • Summary Date: Displays the date and time when the Configuration Manager 2007 component status summarizer last updated the values displayed on this home page.

You can use View, Add/Remove columns to add or remove information from this list.

Actions for the Software Distribution Package Status Home Page

The following actions are available from the software distribution package status home page:

Action Description

Show Messages

Opens the ConfigMgr Status Message Viewer window, allowing you to view a more detailed status from the selected package. You can filter the results to show only items with the following severity:

  • All
  • Error
  • Warnings
  • Info

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns list, and then click Add to add the column to the Displayed Columns list. Select the column name from the Displayed Columns list, and then click Remove to remove the column from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console.

New Window from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

See Also

Concepts

Using Status Messages for Configuration Manager Troubleshooting

Other Resources

How to Manage Packages


Advertisements Home Page

The Advertisements console tree node in Configuration Manager 2007 displays advertisements and information about the programs that are being advertised. The Advertising console tree node and subnodes are located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

Within the Advertisements node, the New Advertisement Wizard is used to create advertisements for existing programs. For more information, see New Advertisement Wizard.

These advertisements can then be used to distribute new or existing packages to client computers using the Distribute Software Wizard. For more information, see Distribute Software Wizard.

UI Element List

Upon clicking the Advertisements console tree node or subnodes, the Configuration Manager console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The following sections describe the Advertisements console tree node and subnodes.

Advertisements

The Advertisements console tree node in Configuration Manager 2007, when highlighted, displays the following information about each advertisement by default:

  • Name: Specifies the name of the advertisement.
  • Package: Specifies the package with which the advertisement is associated.
  • Program: Specifies the specific program being advertised to clients by the advertisement.
  • Collection: Specifies the collection to which the given program is being advertised.
  • Available After: Specifies the date and time after which the advertised program will be available for running on clients.
  • Expires After: Specifies the date and time after which the advertised program will no longer be available for running on clients.
  • Advertisement ID: Specifies the ID assigned by Configuration Manager 2007 to the given advertisement.
  • Status: Specifies the version of the package, as given in the package properties.

Additional columns may be added to the result pane by right-clicking the Advertisements node, pointing to View, and then clicking Add/Remove Columns.

Actions for the Advertisements Nodes

Different actions are available depending on where you are in the console tree. Within the Advertisements node, however, only two variations exist—the Advertisements node and the folders specifically created under that node for organizational purposes. The following table lists the general actions for the Advertisements console tree node and those specific to any folders under that node.

General Actions

The following actions are available on the Advertisements console tree node and any folders beneath it.

Action Description

New

Provides the following options:

  • Advertisement: Opens the New Advertisement Wizard, where you can create a new advertisement for a program. For more information, see New Advertisement Wizard.
  • Advertisement for Device: Opens the New Advertisement for Device Wizard, where you can create a new advertisement to distribute a program to a device client. For more information, see Advertisement for Mobile Devices Properties.
  • Folder: Creates a new folder beneath the Packages node.
  • Search Folder: Opens the Search Folder Criteria dialog box, where you can design a query to search package folders on the site. For more information, see Search Folder Criteria Dialog Box.

Distribute

Provides the following distribution options:

  • Software: Opens the Distribute Software Wizard, where you can distribute advertised programs to client computers. For more information, see Distribute Software Wizard.
  • Software to Device: Opens the Distribute Software to Device Wizard, where you can distribute advertised programs to client devices.

Advertise Task Sequence

Opens the task sequence version of the New Advertisement Wizard, where you can create a new advertisement for a task sequence. For more information, see Advertise Task Sequence Wizard.

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New Windows from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Properties

Opens the Advertisements Properties dialog box, where general advertisement information and class security rights can be set on the object. For more information, see Advertisements Properties.

Help

Opens the associated help topic.

<Folder Name>

The following actions are available from the <folder name> console tree node.

Action | Description
Cut | Cuts the selected advertisement in preparation to move it to a folder in the Advertisement node. The cut advertisement is not removed or relocated until it is pasted in a new location and the new location must be a folder within the node, not another advertisement.
Paste | Pastes a previously cut advertisement in a new location within the Advertisement node.
Delete | Deletes the specified folder.
Rename | Renames the specified folder.

See Also

Concepts

About Advertisements

Other Resources

Software Distribution Home Pages
How to Manage Advertisements


Software Updates Home Pages

The software updates home page in the Configuration Manager 2007 console tree displays summary information, links, and resources, and contains several sub nodes that contain information specific to update lists, software updates, deployments, deployment templates, and deployment packages. Click the related link for detailed information about each software updates console tree node.

In This Section

Software Updates Home Page

Specifies the software updates home page that displays summary information, provides links and resources for the software updates feature, and provides the actions that are available from the home page.

Update Repository Home Page

Specifies the console tree nodes where all of the synchronized software updates are located and provides the actions that are available at each node.

Update Lists Home Page

Specifies the console tree nodes where all of the update lists are located and provides the actions that are available at each node.

Deployment Templates Home Page

Specifies the console tree nodes where all of the deployment templates are located and provides the actions that are available at each node.

Deployment Management Home Page

Specifies the console tree nodes where all of the deployments are located, identifies the software updates in the deployments that are displayed, and provides the actions that are available at each node.

Deployment Packages Home Page

Specifies the console tree nodes where all of the deployment packages used to host software updates are located, identifies the software updates in each deployment package that are displayed, and provides the actions that are available at each node.

See Also

Concepts

Administrator Workflows for Software Updates
How to Manage Software Update Files
How to Manage Software Updates Metadata

Other Resources

Administrator Checklists for Software Updates
Configuring Software Updates
How to Manage Software Update Deployments
Planning for Software Updates


Software Updates Home Page

The Software Updates console tree node is the home page for the software updates feature in Configuration Manager 2007. It displays a summary of software updates compliance, contains the Update Repository, Update Lists, Deployment Templates, Deployment Management, and Deployment Packages sub nodes, and is located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Updates.

The software update status is displayed in the Software Update Installation Status Summary results pane and is based on specified values for vendor, update classification, and month and year. The data displayed is updated based on the home page summarization schedule, which is 4 hours by default, or by manually using the Run Homepage Summarization action.

The software updates are displayed with the following information:

  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update. Click the link to open a Web page with more information about the specific software update.
  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Title: Specifies the title for the software update.
  • Severity: Specifies the predefined vendor severity rating for the software update. The severity can range from low to critical and cannot be modified.
  • Deployed: Specifies whether the software update has been deployed to clients.
  • Total: Specifies the total number of clients that are in the All Systems collection.
  • Installed: Specifies the number of systems that have installed the software update and no longer require it.
  • Required: Specifies the number of systems that require the software update.
  • Not Required: Specifies the number of systems that do not require the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • % Compliant: Specifies the percentage of clients on which the software update is installed or not required over the total number of clients in the All Systems Collection.
  • % Compliant (graph): Specifies in a bar graph the percentage of clients on which the software update is installed or not required over the total number of systems in the All Systems Collection.

Before information is available in any of the update repository console tree nodes, the following steps must be taken:

  1. Enable the Software Updates Client Agent (enabled by default).
  2. Enable and configure the Software Update Point.
  3. Specify at least one update classification, product, and language, and initiate update synchronization. Depending on how many updates are synchronized, this process might take a long time to complete.

For details about configuring Software Updates, see Administrator Checklist: Configuring Software Updates.

UI Element List

The Software Updates home page displays data for software updates based on defined criteria that is configured in the Software Update Installation Status Summary pane, which contains the following elements:

Vendor

Specifies the vendor that created the software updates, for example, Microsoft. Select a vendor from the list to limit the software updates displayed on the home page to only the updates that are from the specified vendor.

Month and year

Specifies that software updates created or revised in the configured month and year are displayed. The software updates displayed on the home page are limited to the updates last revised within the specified month and year.

Update classification

Specifies the classification for software updates, for example, Security Updates, Service Packs, Applications, and so on. Select a classification from the list to limit the software updates displayed on the home page to only the updates that are in the classification.

Go

Retrieves the software updates that meet the defined Vendor, Month and year, and Update classification criteria.

Links and Resources

The Links and Resources section of the Software Updates home page provides links to Configuration Manager 2007 console items where Software Updates components can be configured, along with links to common Software Updates reports and links to help and external resource information.

The following links and resource information is available:

Navigation

Provides links to other sections of the Configuration Manager 2007 console where software updates components are configured.

Web Reports

Provides links to common Software Updates Web reports. For any of the following reports, click the link on this page to open the specified report:

  • Compliance 1 - Overall compliance: Returns the overall compliance for the set of software updates in a specific update list and collection.
  • States 1 - Enforcement states for a deployment: Returns the enforcement states for a specific software update deployment.
  • Scan 1 - Last scan states by collection: Returns the count of computers in each of the compliance scan states returned by client computers in a specific collection during their last scan for software updates compliance.
  • Management 1 - Updates required but not deployed: Returns all vendor-specific software updates that have been detected as required on clients but that have not been deployed to a specific collection.
Resources

Provides links to software updates resources. Click the link to open the specified resource.

  • Software Updates Checklists: Opens the administrator checklists in the local help file. The checklists provide the steps necessary to plan for and prepare the software updates components, configure the software updates components, assess software updates for compliance, deploy software updates, and monitor deployment progress.
  • Software Updates Troubleshooting: Opens the software updates troubleshooting content in the local help file.
  • Microsoft Update Catalog on Microsoft.com: Opens the Microsoft Update Catalog external Web site (http://go.microsoft.com/fwlink/?LinkId=99032). This Web site is a service from Microsoft that provides a listing of updates that can be distributed over a corporate network. You can use it as a one-stop location for finding Microsoft software updates, drivers, and hotfixes.
  • ConfigMgr TechCenter on Microsoft.com: Opens the System Center Configuration Manager TechCenter Web site on TechNet (http://go.microsoft.com/fwlink/?LinkId=74317).

Actions for the Software Updates Home Page

General actions are available from the software updates home page and specific actions are available for software updates when they are selected from the Software Update Compliance Status Summary pane. The following tables list the actions that are available on the software updates home page.

General Software Updates Home Page Actions

The following actions are available from the software updates home page.

Action Description

Schedule home page summarization

Specifies the schedule for the software updates home page summarization, which is how often the data displayed on the home page is updated with the most recent data in the site database. Configure summarization to occur every x days, hours, or minutes. By default, summarization is scheduled for every 4 hours.

Run home page summarization

Specifies that the software updates home page summarization occurs as soon as possible. The data displayed on the home page is updated with the most recent data in the site database. The scheduled summarization will still occur on its schedule interval.

Give feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New windows from here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Software Updates

The following actions are available from the software updates displayed in the Software Update Compliance Status Summary pane.

Action | Description
Download Software Updates | Opens the Download Updates Wizard to download the software update source files.
Deploy Software Updates | Opens the Deploy Software Updates Wizard to create a deployment for the selected software updates.
Update List | Opens the Update List Wizard where the software update can be added to a new or existing authorization list.
Properties | Opens the Software Update Name Properties page for the selected software update.

The following actions are also available by using the drag-and-drop functionality. One or more software updates can be dragged and dropped onto an existing deployment or deployment template.

Name | Description
Drag-and-drop a software update onto an update list | Open the Update List Wizard to add the software update to the selected update list.
Drag-and-drop a software update onto a deployment template | Opens the Deploy Software Updates Wizard to create a deployment, using the selected template, for the selected software update.
Drag-and-drop a software update onto a deployment | Opens the Deploy Software Updates Wizard to add the software updates to the selected deployment.

See Also

Concepts

About Software Update Deployment Packages
About Deployment Templates in Software Updates
About Software Update Deployments
About Update Lists in Software Updates
Administrator Checklist: Configuring Software Updates
How to Manage Software Update Files
How to Manage Software Updates Metadata

Other Resources

How to Manage Software Update Deployments
Software Updates Home Pages


Update Repository Home Page

The Update Repository console tree node and subnodes in the Microsoft System Center Configuration Manager 2007 console are where all of the synchronized software updates are located. As the console tree node is expanded, the Search Folders, update classifications, vendors, and product subnodes are displayed. You can navigate to the Update Repository console tree node and subnodes as follows: System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository.

Before information is available in any of the Update Repository console tree nodes, the following steps must be taken:

  1. Enable the Software Updates Client Agent (enabled by default).
  2. Enable and configure the active software update point.
  3. Specify at least one update classification, product, and language; and initiate update synchronization. Depending on how many updates are synchronized, this process might take a long time to complete.

For details about configuring software updates, see Administrator Checklist: Configuring Software Updates.

After you click the Update Repository console tree node or subnodes, the Configuration Manager console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The following sections describe the Update Repository console tree node and subnodes.

Update Repository

The Update Repository console tree node in Configuration Manager 2007 displays the update classifications for which software updates have been synchronized, such as security updates, critical updates, service packs, tools, and so on, as well as Search Folders.

Search Folders

The Search Folders console tree node displays the available search folders, which are configured with specific search criteria and display the synchronized software updates that meet these criteria. Search folders created at a parent site are replicated down the hierarchy. The properties for replicated search folders cannot be modified at child sites, but unlike other objects in Configuration Manager, search folder objects at child sites do not display with a lock symbol. For more information about Search Folders, see How to Configure Search Folders for Software Updates.

Classification Name

The update classification console tree nodes in Configuration Manager 2007 display the vendors for which software updates have been synchronized, such as Microsoft, as well as the All Updates node. Click the All Updates node to show all the software updates that are associated with the selected classification.

Vendor Name

The vendor console tree nodes display the vendor products for which software updates have been synchronized, such as Office 2003 or Windows Vista, as well as All Updates. Click All Updates to show all the software updates that are associated with the selected vendor within the update classification.

Product Name

The product console tree nodes display the software updates associated with the selected vendor product for which software updates have been synchronized.

Software Updates

The software updates that have been synchronized are displayed when clicking a configured search folder, the All Updates console tree node, or a vendor product console tree node. The software updates are displayed with the most recent updates listed first. The following columns are displayed by default:

  • <Software update icon>: An icon is displayed for each software update indicating the status of the update. An icon with a green arrow indicates a typical software update, an icon with a yellow arrow indicates that the software update has been superseded by another update, an icon with a gray arrow indicates that the software update is expired, an icon with a red arrow indicates an invalid software update, and an icon with a blue arrow indicates a metadata-only software update. For more information about the icons used by software updates, see About the Icons for Software Updates.
  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Title: Specifies the title for the software update.
  • Language: Specifies the supported language for the software update.
  • % Compliant: Lists the percentage of clients on which the software update is installed or not required over the total number of clients in the All Systems Collection.
  • Installed: Specifies the number of systems that have installed the software update and no longer require it.
  • Required: Specifies the number of systems that require the software update.
  • Not Required: Specifies the number of systems that do not require the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • Total: Specifies the total number of clients that are in the All Systems collection.
  • Severity: Specifies the predefined vendor severity rating for the software update. The severity can range from low to critical and cannot be modified.
  • License Terms: Specifies whether the software update has an associated Microsoft Software License Terms (License Terms) and, if so, whether it is required or has already been accepted. The License Terms Wizard appears before opening the Deploy Software Updates Wizard when deploying software updates with a Required value in this column.
  • Deployed: Specifies whether the software update is part of a deployment.
  • NAP Evaluation: Specifies whether the software update is included in a NAP evaluation.
  • Downloaded: Specifies whether the software update has been downloaded.
  • Custom Severity: Specifies the custom severity that was configured for the software update. The custom severity value can be Critical, Important, Moderate, Low, or blank. By default, the value is left blank.
  • Date Released: Specifies the date that the software update was released.
  • Date Revised: Specifies the date that the software update was last modified.
  • Deployable to SMS 2003: Specifies whether the software update can be deployed to SMS 2003 clients.
  • Exclusive Handling Required: Specifies whether the software update must be installed independent from other updates.
  • Expired: Specifies whether the software update has expired. Expired software updates are not available for deployment.
  • Superseded: Specifies whether the software update is superseded by another update. This setting displays Yes when another update, which is more recent, contains the same fixes as this update.

When you click a configured search folder, the All Updates console tree node or a product console tree node and the synchronized software updates are displayed and the Configuration Manager console contains the following additional elements:
Update Details tab

Specifies summary information about the software update. The Update Details tab is visible when a software update is highlighted and displays the following information:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Date Revised: Specifies the date that the software update was last modified.
  • Maximum severity rating: Specifies the vendor-defined severity rating for the software update.
  • Description: Presents an overview of why the software update should be installed and which condition it fixes.
  • Applicable Languages: Specifies the supported languages for the software update.
  • Affected Products: Specifies the products that are affected by the software update.
When more than one software update is selected, the Update Results pane does not display.

Deployment Status tab

Visible after a software update is highlighted and, based on the collections targeted, displays the following deployment status information:

  • Deployment Name: Specifies the name of the software update deployment. This is the default sort order.
  • Targeted: Specifies the number of systems in the target collection for the deployment.
  • Installed: Specifies the number of systems that have installed the software update.
  • Not required: Specifies the number of systems that do not require the software update.
  • Required: Specifies the number of systems that require the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • Assignment Unique ID: Specifies a unique ID for the deployment.
When more than one software update is selected, the Deployment Status tab does not display.

Content Information

Visible after a software update is highlighted and displays the following content information associated with the update:

  • Content ID: Specifies the content ID for the software update.
  • Downloaded: Specifies whether the software update binaries have been downloaded.
  • Affected Language: Specifies the language for the software update.
  • Bin Path: Specifies the path to the software update binaries.
  • Size (Mb): Specifies the size of the software update binaries.
When more than one software update is selected, the Deployment Status tab does not display.

Supersedence Information

Visible after a software update is highlighted and displays the following information about the supersedence of the update:

  • This update has been superseded by the following updates: Specifies the software updates that supersede this update, which means the updates listed are newer and, in most cases, should be deployed instead of this update. The software updates that are listed contain a hyperlink to the Web page that provides more information about the update. When this update is not superseded, None displays.
  • This update supersedes the following updates: Specifies what software updates have been superseded by this update, which means this update is newer and, in most cases, should be deployed to replace the outdated updates. The software updates that are listed contain a hyperlink to the Web page that provides more information about the update. When this update is not superseded, None displays.
Custom Bundle Information

Note
Applies only to Configuration Manager 2007 SP1.

Visible after a software update is highlighted and displays custom bundle information for the update. When the highlighted software update is a bundle that contains visible software updates, updates that are not listed on the Content tab, the visible software updates are listed. For example, if a software update bundle that contains driver updates is highlighted, the driver updates are listed in the Custom Bundle Information tab.

Actions for the Update Repository Nodes

Different actions are available depending on where you are in the console tree. The following tables list the general and specific actions for the Update Repository console tree node and subnodes.

General Actions

The following actions are available on several Update Repository console tree nodes.

Action | Description
Give Feedback | Opens a Configuration Manager 2007 Web site where feedback can be given.
New Windows from Here | Opens a new console window using the current node as the root node.
Refresh | Refreshes the display with the most current information.
Help | Opens the associated help topic.

Update Repository

The following actions are available from the Update Repository console tree node.

Action Description

Run Synchronization

Initiates delta software update synchronization. For information about synchronization, see About Software Updates Synchronization.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a text or Unicode text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

Properties

Opens the Update Repository Properties dialog box, where class security rights can be set on the object.

Search Folders

The following actions are available from the Search Folders console tree node.

Action | Description
New Folder | Opens the New Folder Dialog Box dialog box. Specify the name of the folder, and click OK to create a new folder under the selected node.
New Search Folder | Opens the Search Folder Criteria Dialog Box. Specify the properties, search criteria, search options, and name, and then click OK to create the new search folder under the selected node.
Export List | Specifies to export the list of search folders to a text file.

Search Folder Name

The following actions are available from the search folders displayed in the console.

Action | Description
Move Folder | Opens the Move Folder Wizard, where the specified search folder can be moved to a folder.
Modify Search Folder Criteria | Opens the Search Folder Criteria Dialog Box, where the search criteria properties can be configured.
Delete | Deletes the specified search folder from the console.
Rename | Renames the specified search folder.

Folder Name

The following actions are available from the folders displayed in the console.

Action | Description
New Folder | Opens the New Folder Dialog Box. Specify the name of the folder, and click OK to create a new folder under the selected node.
New Search Folder | Opens the Search Folder Criteria Dialog Box. Specify the properties, search criteria, search options, and name, and then click OK to create the new search folder under the selected node.
Move Folder | Opens the Move Folder Wizard, where the specified folder can be moved to another folder.
Delete | Deletes the specified search folder from the console.
Rename | Renames the specified search folder.

Software Updates

The following actions are available from the software updates displayed in the console.

Action | Description
Download Software Updates | Opens the Download Updates Wizard, to download the software update source files.
Deploy Software Updates | Opens the Deploy Software Updates Wizard, to create a deployment for the selected software updates.
Add to Update List | Opens the Update List Wizard, where the software update can be added to a new or existing authorization list.
Properties | Opens the Software Update Name Properties page for the selected software update.

The following actions are also available by using drag-and-drop functionality. One or more software updates can be dragged and dropped onto an existing deployment or deployment template.

Name Description

Drag-and-drop a software update onto an update list

Open the Update List Wizard, to add the software update to the selected update list.

Drag-and-drop a software update onto a deployment template

Opens the Deploy Software Updates Wizard, to create a deployment, using the selected template, for the selected software update.

Note
The deployment template might need to be refreshed before this action is allowed.

Drag-and-drop a software update onto a deployment

Opens the Deploy Software Updates Wizard, to add the software updates to the selected deployment.

See Also

Concepts

About Software Updates Metadata
About Software Updates Synchronization
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Icons for Software Updates
About the Update List Wizard
Administrator Workflows for Software Updates
How to Manage Software Updates Metadata
Icon Glossary for Software Updates

Other Resources

Administrator Checklists for Software Updates
Configuring Software Updates
Planning for Software Updates
Software Updates Home Pages


Update Lists Home Page

The Update Lists console tree node in Configuration Manager 2007 displays update lists and the software updates that are defined within the update list. The Update Lists console tree node and sub nodes are located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Lists

The Update List Wizard is used to create new deployments. For more information, see How to Create an Update List.

Upon clicking the Update Lists console tree node or sub nodes, the Configuration Manager console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The following sections describe the Update Lists console tree node and sub nodes.

Update Lists

The Update Lists console tree node in Configuration Manager 2007, when highlighted, displays the following information about each update list:

  • Name: Specifies the name of the update list.
  • Last Modified: Specifies the date when the update list was last modified.
  • Modified By: Specifies the user account that was logged on when the update list was last modified.
  • Source Site: Specifies the site where the update list was created.

Update List Name

The update list name console tree nodes display the software updates that are defined in the update list. The properties for the software updates can be modified and updates can be removed from the update list at this location. To add software updates to an update list, see How to Add Software Updates to an Update List. The following information is displayed for each software update that is in the deployment package:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Name: Specifies the name of the software update.
  • Language: Specifies the supported language for the software update.
  • % Compliant: Lists the percentage of clients on which the software update is installed or not required over the total number of clients in the All Systems Collection.
  • Installed: Specifies the number of systems that have installed the software update.
  • Required: Specifies the number of systems that need the software update or where the status is unknown.
  • Not Required: Specifies the number of systems that do not need the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • Total: Specifies the total number of clients that are in the All Systems collection.
  • Severity: Specifies the predefined Vendor severity rating for the software update. The severity can range from low to critical and cannot be modified.
  • License Terms: Specifies whether the software update has an associated Microsoft Software License Terms (License Terms), and if so, whether it is required or has already been accepted. The License Terms Wizard appears before opening the Deploy Software Updates Wizard when deploying software updates with a Required value in this column.
  • Deployed: Specifies whether the software update has been deployed to clients.
  • NAP Evaluation: Specifies whether the software update is included in a NAP mandatory evaluation.
  • Downloaded: Specifies whether the software update was downloaded.
  • Custom Severity: Specifies the custom severity that was configured for the software update. The custom severity value can be Critical, Important, Moderate, Low, or blank. By default, the value is left blank.
  • Date Released: Specifies the date that the software update was released.
  • Date Revised: Specifies the date that the software update was last modified.
  • Deployable to SMS 2003: Specifies whether the software update can be deployed to SMS 2003 clients.
  • Exclusive Handling Required: Specifies whether the software update must be installed independent of other updates.
  • Expired: Specifies whether the software update has expired. Expired software updates are not available for deployment.
  • Superseded: Specifies whether the software update is superseded by another update. This setting displays Yes when another update must be installed prior to the client installing this update.

Upon clicking one of the update list name console tree nodes, the software updates are displayed and the Configuration Manager console contains the following additional elements:

UI Element List

Update Details tab

Specifies summary information about the software update. The Update Details tab is visible when a software update is highlighted and displays the following information:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Date Revised: Specifies the date that the software update was last modified.
  • Maximum severity rating: Specifies the vendor-defined severity rating for the software update.
  • Description: Presents an overview of why the software update should be installed and which condition it fixes.
  • Applicable Languages: Specifies the supported languages for the software update.
  • Affected Products: Specifies the products that are affected by the software update.
When more than one software update is selected, the Update Results pane does not display.

Deployment Status tab

Visible after a software update is highlighted and, based on the collections targeted, displays the following deployment status information:

  • Deployment Name: Specifies the name of the software update deployment. This is the default sort order.
  • Targeted: Specifies the number of systems in the target collection for the deployment.
  • Installed: Specifies the number of systems that have installed the software update.
  • Not required: Specifies the number of systems that do not require the software update.
  • Required: Specifies the number of systems that require the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • Assignment Unique ID: Specifies a unique ID for the deployment.
When more than one software update is selected, the Deployment Status tab does not display.

Content Information

Visible after a software update is highlighted and displays the following content information associated with the update:

  • Content ID: Specifies the content ID for the software update.
  • Downloaded: Specifies whether the software update binaries have been downloaded.
  • Affected Language: Specifies the language for the software update.
  • Bin Path: Specifies the path to the software update binaries.
  • Size (Mb): Specifies the size of the software update binaries.
When more than one software update is selected, the Deployment Status tab does not display.

Supersedence Information

Visible after a software update is highlighted and displays the following information about the supersedence of the update:

  • This update has been superseded by the following updates: Specifies the software updates that supersede this update, which means the updates listed are newer, and in most cases, should be deployed instead of this update. The software updates that are listed contain a hyperlink to the Web page that provides more information about the update. When this update is not superseded, None displays.
  • This update supersedes the following updates: Specifies what software updates have been superseded by this update, which means this update is newer, and in most cases, should be deployed to replace the outdated updates. The software updates that are listed contain a hyperlink to the Web page that provides more information about the update. When this update is not superseded, None displays.

Actions for the Update Lists Nodes

Different actions are available depending on where you are in the console tree. The following table lists the general and specific actions for the Update Lists console tree node and sub nodes.

General Actions

The following actions are available on several Update Lists console tree nodes.

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New Windows from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Update Lists

The following actions are available from the Update Lists console tree node.

Action | Description
Properties | Opens the Update Lists Properties dialog box where class security rights can be set on the object.

Update list name

The following actions are available from the update lists displayed in the console.

Action Description

Deploy Software Updates

Opens the Deploy Software Updates Wizard to create a deployment for the software updates in one or more specified update lists.

Download Software Updates

Opens the Download Updates Wizard to download the source files for the software updates in one or more specified update lists.

Delete

Removes the specified update lists.

Note
Deleting an update list that was used to create a deployment does not impact the deployment.

Properties

Opens the Update List Name Properties dialog box for the selected update list where the update list name, description, and security settings can be configured.

The following actions are also available by using the drag-and-drop functionality. One or more update lists can be dragged and dropped onto an existing deployment or deployment template.

Name Description

Drag-and-drop an update list onto a deployment template

Opens the Deploy Software Updates Wizard to create a deployment, using the selected template, for the software updates defined in the update list.

Note
The deployment template might need to be refreshed before this action is allowed.

Drag-and-drop a software update onto a deployment

Opens the Deploy Software Updates Wizard to create a deployment for the software updates defined in the update list.

See Also

Tasks

How to Deploy Software Updates

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About Update Lists in Software Updates
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
How to Manage Software Updates Metadata
Planning for a Software Update Deployment

Other Resources

How to Manage Software Update Deployments


Deployment Templates Home Page

The Deployment Templates console tree node in Configuration Manager 2007 displays deployment templates that have been created. As the console tree is expanded, the deployment templates are listed in the tree. The Deployment Templates console tree node and sub nodes are located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Templates

The Software Update Deployment Template Wizard and Deploy Software Updates Wizard can be used to create deployment templates. For more information, see How to Create a Deployment Template.

UI Element List

Upon clicking the Deployment Templates console tree node or sub nodes, the Configuration Manager console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The following sections describe the Deployment Templates console tree node and sub nodes.

Deployment Templates

The Deployment Templates console tree node in Configuration Manager 2007, when highlighted, displays the name and description for the template. It is highly recommended to create a name and description that provides an overview of the deployment template configuration and other relevant information that helps to identify it among other templates listed in this location.

Deployment Template Name

The deployment template name console tree nodes display the name and description of the specified template and allow the properties for the template to be modified. For more information, see Deployment Template Name Properties.

General Actions

The following actions are available on all Deployment Template console tree nodes.

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New Windows from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Deployment Templates

The following actions are available from the Deployment Templates console tree node.

Action | Description
New Deployment Template | Opens the Deployment Template Wizard where the new template is created.
Properties | Opens the Deployment Templates Properties dialog box where class security rights can be set on the object.

Deployment Template Name

The following actions are available from the deployment templates displayed in the console.

Action | Description
Delete | Deletes the selected deployment template. One or more templates can be deleted at the same time.
Properties | Opens the Deployment Template Name Properties dialog box where the template settings can be configured.

See Also

Tasks

How to Deploy Software Updates

Concepts

About Software Update Deployments
About the Deploy Software Updates Wizard
Planning for a Software Update Deployment

Other Resources

How to Manage Software Update Deployments
Software Updates Home Pages


Deployment Management Home Page

The Deployment Management console tree node in Configuration Manager 2007 displays active software update deployments. As the console tree node is expanded, all deployments that have been created are displayed, which can then be expanded further to display the Software Updates console tree node. The Deployment Management console tree node and sub nodes are located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Management

The Deploy Software Updates Wizard is used to create new deployments. For more information, see How to Deploy Software Updates

Upon clicking the Deployment Management console tree node or sub nodes, the Configuration Manager console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The following sections describe the Deployment Management console tree node and sub nodes.

Deployment Management

The Deployment Management console tree node in Configuration Manager 2007, when highlighted, displays the following information about each software update deployment:

  • Deployment Name: Specifies the name of the deployment.
  • Deployment ID: Specifies a unique ID for the deployment, starting at 1 and incremented by 1 for each new deployment.
  • Deadline: Specifies the time when the software update installation will be enforced on clients.
  • Deployment Start Time: Specifies the time when the deployment was made active and software updates were made available for installation on clients.
  • Client Time / UTC: Specifies the time format in which clients evaluate the deployment schedule.

SMS2003 Advertisements

The SMS2003 Advertisements console tree node in Configuration Manager 2007 displays the advertisements that were active when upgrading a site from SMS 2003 to Configuration Manager 2007 and the advertisements that were created as part of a deployment that target SMS 2003 clients. When this console tree node is highlighted, the following information about the SMS 2003 advertisements is available:

  • Name: Specifies the name of the SMS 2003 advertisement.
  • Package: Specifies the package used by the advertisement.
  • Program: Specifies the program used by the advertisement.
  • Collection: Specifies the target collection used by the advertisement.
  • Available After: Specifies the time that the advertisement will become available to SMS 2003 clients.
  • Expires After: Specifies the time that the advertisement will expire.
  • Advertisement ID: Specifies the ID for the advertisement.
  • Status: Specifies the status for the SMS 2003 advertisement.

Deployment Name

The deployment name console tree nodes display the Software Updates sub nodes and, when a deployment name is highlighted, display the same information listed in the previous section for the specified deployment. The deployment properties can be modified at this location. For more information, see Deployment Name Properties. Updates can be added to the deployment from within the Software Updates tab in the Deployment name properties, but removed from the Software Updates console tree node.

Software Updates

The Software Updates console tree node specifies which software updates are in the deployment. The updates can be removed from the deployment or the properties for the software updates can be modified at this location. The following information is displayed for each software update that is in the deployment package:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Title: Specifies the name of the software update.

Upon clicking the Software Updates console tree node, the software updates are displayed and the Configuration Manager console contains the following additional elements:

UI Element List

Update Details tab

Specifies summary information about the software update. The Update Details tab is visible when a software update is highlighted and displays the following information:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Date Revised: Specifies the date that the software update was last modified.
  • Maximum severity rating: Specifies the vendor-defined severity rating for the software update.
  • Description: Presents an overview of why the software update should be installed and which condition it fixes.
  • Applicable Languages: Specifies the supported languages for the software update.
  • Affected Products: Specifies the products that are affected by the software update.
When more than one software update is selected, the Update Details pane does not display.

Deployment Status tab

Visible after a software update is highlighted and, based on the collections targeted, displays the following deployment status information:

  • Deployment Name: Specifies the name of the software update deployment. This is the default sort order.
  • Targeted: Specifies the number of systems in the target collection for the deployment.
  • Installed: Specifies the number of systems that have installed the software update.
  • Not required: Specifies the number of systems that do not require the software update.
  • Required: Specifies the number of systems that require the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • Assignment Unique ID: Specifies a unique ID for the deployment.
When more than one software update is selected, the Deployment Status tab does not display.

Content Information

Visible after a software update is highlighted and displays the following content information associated with the update:

  • Content ID: Specifies the content ID for the software update.
  • Downloaded: Specifies whether the software update binaries have been downloaded.
  • Affected Language: Specifies the language for the software update.
  • Bin Path: Specifies the path to the software update binaries.
  • Size (Mb): Specifies the size of the software update binaries.
When more than one software update is selected, the Deployment Status tab does not display.

Supersedence Information

Visible after a software update is highlighted and displays the following information about the supersedence of the update:

  • This update has been superseded by the following updates: Specifies the software updates that supersede this update, which means the updates listed are newer, and in most cases, should be deployed instead of this update. The software updates that are listed contain a hyperlink to the Web page that provides more information about the update. When this update is not superseded, None displays.
  • This update supersedes the following updates: Specifies what software updates have been superseded by this update, which means this update is newer, and in most cases, should be deployed to replace the outdated updates. The software updates that are listed contain a hyperlink to the Web page that provides more information about the update. When this update is not superseded, None displays.

Actions for the Deployment Management Nodes

Different actions are available depending on where you are in the console tree. The following table lists the general and specific actions for the Deployment Management console tree node and sub nodes.

General Actions

The following actions are available on several Deployment Management console tree nodes.

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New Windows from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Deployment Management

The following actions are available from the Deployment Management console tree node.

Action | Description
Properties | Opens the Deployment Management Properties dialog box where class security rights can be set on the object.

Deployment Name

The following actions are available from the deployments displayed in the console.

Action | Description
Delete | Removes the selected deployments. After the deletion is confirmed, the deployment objects are deleted for the Configuration Manager Client and associated advertisements and package files are deleted for SMS 2003 clients.
Properties | Opens the Deployment Name Properties dialog box for the selected deployment where the deployment settings can be configured.
Note
Property changes can be made to multiple deployments at the same time, with the exception of the deployment name and description properties.

Software Updates

The following actions are available from the software updates displayed in the console.

Action | Description
Download Software Updates | Opens the Download Updates Wizard to download the software update source files.
Deploy Software Updates | Opens the Deploy Software Updates Wizard to create a deployment for the selected software updates.
Add to Update List | Opens the Update List Wizard where the software update can be added to a new or existing authorization list.
Properties | Opens the Software Update Properties page for the selected software update.

The following actions are also available by using the drag-and-drop functionality. One or more software updates can be dragged and dropped onto an existing deployment or deployment template.

Name | Description
Drag-and-drop a software update onto a deployment template | Opens the Deploy Software Updates Wizard to create a deployment, using the selected template, for the selected software update.
Drag-and-drop a software update onto a deployment | Opens the Deploy Software Updates Wizard to create a deployment for the selected software updates.

See Also

Tasks

How to Deploy Software Updates

Concepts

About Software Update Deployment Packages
About Software Update Deployments
About Update Lists in Software Updates
About the Deploy Software Updates Wizard
About the Download Updates Wizard
About the Update List Wizard
Planning for a Software Update Deployment

Other Resources

How to Manage Software Update Deployments


Deployment Packages Home Page

The Deployment Packages console tree node in Configuration Manager 2007 displays packages that have been used to host software updates. As the console tree node is expanded, all deployment packages that have been created are displayed, which can then be expanded further to display the Access Accounts, Distribution Points, and Software Updates console tree nodes. The Deployment Packages console tree node and sub nodes are located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployment Packages

Note
Before information is available in any of the deployment package console tree nodes, software updates must be downloaded, packaged, and copied to the distribution point by using the Deploy Software Updates Wizard, Download Updates Wizard, or Update List Wizard. For more information, see How to Create a Deployment Package.

UI Element List

Upon clicking the Deployment Packages console tree node or sub nodes, the Configuration Manager console contains the following elements:

Look for:/Search in:

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

Look for

Looks for text that was entered to filter on. This could be a partial or full text string. Only items that contain the text will be displayed in the results pane. For example, the text English could be entered in the Look for: text box to display only software updates that contain that text in any column.

Search in

Searches a specific column for the text that was entered in the Look for: text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The following sections describe the Deployment Packages console tree node and sub nodes.

Deployment Packages

The Deployment Packages console tree node in Configuration Manager 2007, when highlighted, displays the following information about all software update deployment packages:

  • Package Name: Specifies the name for the deployment package.
  • Package ID: Specifies the unique ID for the deployment package that is generated by Configuration Manager.

Deployment Package Name

The deployment package name console tree nodes display the Access Accounts, Distribution Points, and Software Updates sub nodes, and allow the deployment package property settings to be modified, such as package name, data access settings, distribution settings, and security settings. For more information, Deployment Package Name Properties

Access Accounts

The Access Accounts console tree node specifies which accounts can access the deployment package folder on the distribution point. By default, the Administrators account has Full Control and Users have Read access. The access accounts for each deployment package are managed at this location.

Distribution Points

The Distribution Points console tree node specifies the distribution points that store the software updates contained in the deployment package. Clients must have access to at least one distribution point to install deployed software updates. Therefore, you should specify for each deployment package a group of distribution points that can be accessed by clients that have been targeted for deployment. The distribution points for each deployment package are managed at this location.

Software Updates

The Software Updates console tree node specifies which software updates are in the deployment package. The updates can be removed from the package, the properties for the software updates can be modified, or the update content can be refreshed by retrieving them from the update source location and updating the content on the distribution points. For information about adding software updates to deployment packages, see How to Add Software Updates to a Deployment Package. The following information is displayed for each software update that is in the deployment package:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at the Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Name: Specifies the name of the software update.
  • Language: Specifies the supported language for the software update.
  • % Compliant: Lists the percentage of clients on which the software update is installed or not required over the total number of clients in the All Systems Collection.
  • Installed: Specifies the number of systems that have installed the software update.
  • Required: Specifies the number of systems that need the software update or where the status is unknown.
  • Not Required: Specifies the number of systems that do not need the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • Total: Specifies the total number of clients that are in the All Systems collection.
  • Severity: Specifies the predefined vendor severity rating for the software update. The severity can range from low to critical and cannot be modified.
  • License Terms: Specifies whether the software update has an associated Microsoft Software License Terms (License Terms), and if so, whether it is required or has already been accepted. The License Terms Wizard appears before opening the Deploy Software Updates Wizard when deploying software updates with a Required value in this column.
  • Deployed: Specifies whether the software update has been deployed to clients.
  • NAP Evaluation: Specifies whether the software update is included in a NAP mandatory evaluation.
  • Downloaded: Specifies whether the software update was downloaded.
  • Custom Severity: Specifies the custom severity that was configured for the software update. The custom severity value can be Critical, Important, Moderate, Low, or blank. By default, the value is left blank.
  • Date Released: Specifies the date that the software update was released.
  • Date Revised: Specifies the date that the software update was last modified.
  • Deployable to SMS 2003: Specifies whether the software update can be deployed to SMS 2003 clients.
  • Exclusive Handling Required: Specifies whether the software update must be installed independent from other updates.
  • Expired: Specifies whether the software update has expired. Expired software updates are not available for deployment.
  • Superseded: Specifies whether the software update is superseded by another update. This setting displays Yes when another update must be installed prior to the client installing this update.

Upon clicking the Software Updates console tree node and the software updates are displayed, the Configuration Manager console contains the following additional elements:

UI Element List

Update Details tab

Specifies summary information about the software update. The Update Details tab is visible when a software update is highlighted and displays the following information:

  • Bulletin ID: Specifies the bulletin ID associated with security software updates. Security bulletin details can be found by searching on the bulletin ID at Microsoft Security Bulletin Search Web page (http://go.microsoft.com/fwlink/?LinkId=58313).
  • Article ID: Specifies the article ID associated with the software update. The article contains detailed information about the software update.
  • Date Revised: Specifies the date that the software update was last modified.
  • Maximum severity rating: Specifies the vendor-defined severity rating for the software update.
  • Description: Presents an overview of why the software update should be installed and what condition it fixes.
  • Applicable Languages: Specifies the supported languages for the software update.
  • Affected Products: Specifies the products that are affected by the software update.
When more than one software update is selected, the Update Details pane does not display.

Deployment Status tab

Visible after a software update is highlighted and, based on the collections targeted, displays the following deployment status information:

  • Deployment Name: Specifies the name of the software update deployment. This is the default sort order.
  • Targeted: Specifies the number of systems in the target collection for the deployment.
  • Installed: Specifies the number of systems that have installed the software update.
  • Not required: Specifies the number of systems that do not require the software update.
  • Required: Specifies the number of systems that require the software update.
  • Unknown: Specifies the number of systems in which the software update state is unknown.
  • Assignment Unique ID: Specifies a unique ID for the deployment.
When more than one software update is selected, the Deployment Status tab does not display.

Content Information

Visible after a software update is highlighted and displays the following content information associated with the update:

  • Content ID: Specifies the content ID for the software update.
  • Downloaded: Specifies whether the software update binaries have been downloaded.
  • Affected Language: Specifies the language for the software update.
  • Bin Path: Specifies the path to the software update binaries.
  • Size (Mb): Specifies the size of the software update binaries.
When more than one software update is selected, the Deployment Status tab does not display.

Actions for the Deployment Packages Nodes

Different actions are available depending on where you are in the console tree. The following table lists the general and specific actions for the Deployment Packages console tree node and sub nodes.

General Actions

The following actions are available on several deployment package console tree nodes.

Action Description

Give Feedback

Opens a Configuration Manager 2007 Web site where feedback can be given.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export list: Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.
  • Hide search bar: Specifies to hide the search bar located above the results pane.

Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

New Windows from Here

Opens a new console window using the current node as the root node.

Refresh

Refreshes the display with the most current information.

Help

Opens the associated help topic.

Deployment Packages

The following actions are available from the Deployment Packages console tree node.

Action | Description
Properties | Opens the Deployment Packages Properties dialog box where class security rights can be set on the object.

Deployment Package Name

The following actions are available from the deployment packages displayed in the console.

Action Description

Delete

Deletes the selected packages. After the deletion is confirmed, the selected package objects are removed from the SMS database and the package is no longer available for selection in new deployments. The source files are also deleted from the associated distribution points for the package.

Note
To select multiple packages for deletion, hold down the CTRL key, click the selected packages, right-click one of the highlighted packages, and then click Delete.

Caution
If the deployment package is being used by other deployments, the package should not be deleted or the source files might not be available for those deployments.

Properties

Opens the Deployment Package Name Properties dialog box where the package settings can be configured.

Access Accounts

The following actions are available from the Access Accounts console tree node.

Action | Description
New | Specifies whether to create a new Generic Access Account or Windows User Access Account. For more information about access accounts, see About Package Access Accounts.

Access Account Name

The following actions are available from the access accounts displayed in the console.

Action | Description
Delete | Deletes the access account.
Properties | Opens the Access Account Properties: General Tab dialog box.

Distribution Points

The following actions are available from the Distribution Points console tree node.

Action | Description
New Distribution Points | Opens the New Distribution Point Wizard where distribution points that are not currently storing the deployment package contents are listed. Specify the distribution points to add and click Finish.
Update Distribution Points | Specifies that all sites and distribution points are updated with the latest version of the deployment package.
Manage Distribution Points | Opens the Manage Distribution Points Wizard where you can copy the deployment package to new distribution points, refresh the deployment package on selected or all distribution points, or remove the deployment package from selected distribution points.

Distribution Point Name

The following actions are available from the distribution points displayed in the console.

Action | Description
Refresh Distribution Point | Specifies that the software updates in the deployment package will be copied from the source folder to the specified distribution point.
Delete | Deletes the distribution point from the deployment package.

Software Updates

The following actions are available from the software updates displayed in the console.

Action Description

Content Refresh

Opens the Deploy Software Updates Wizard: Download Location Page in the Download Updates Wizard to download the selected software updates, replace the current package source files for the selected software updates, and update the distribution points for the package.

Delete

Deletes the specified software updates from the deployment package. By default, Refresh Distribution Points is selected and the updates will be removed from the shared folder on all distribution points for the deployment package.

Important
When deleting a software update from a deployment package, the Delete Updates dialog box appears to allow you to cancel the process or confirm it and choose whether to remove the update file from the distribution points configured for the package. If the software update is in an active deployment and no other deployment packages contain the update, the Software Update Deployment Deletion Confirmation dialog box is displayed. When a NAP enabled software update is deleted from a deployment package and no other deployment packages contain the update, a warning dialog box is displayed.

Properties

Opens the Software Update Name Properties dialog box.

See Also

Tasks

How to Create a Deployment Package
How to Add Software Updates to a Deployment Package

Reference

Access Account Properties: General Tab
Deployment Packages Properties

Concepts

About Software Update Deployment Packages
About Package Access Accounts
Download Updates Wizard: Download Location Page
How to Manage Software Update Files
Planning for a Software Update Deployment

Other Resources

Deployment Package Name Properties
Manage Distribution Points Wizard
Software Updates Home Pages
Software Update Name Properties


Client Help

Client help is installed on Microsoft System Center Configuration Manager 2007 client computers. Configuration Manager 2007 Remote Control help is provided for Windows 2000 client computers with remote tools installed. Configuration Manager Help is for all other Configuration Manager 2007 components on the client computer. The following content is included in the Configuration Manager 2007 server documentation to allow you to search across all help topics.

In This Section

Configuration Manager

Configuration Manager Remote Control

See Also

Concepts

Technical Reference for Configuration Manager 2007


Configuration Manager

The Configuration Manager Control Panel is used by Microsoft System Center Configuration Manager 2007 to configure client options. Configuration Manager is an application that makes it easier for administrators to manage large networks of computers.

Run Advertised Programs and Program Download Monitor help your administrator download and run programs on your computer. These programs might be productivity applications such as word processors and spreadsheets, or they might be programs that help protect your computer such as antivirus or antispyware programs.

Configuration Manager controls the configuration of the Configuration Manager client. Most of these options should be configured only by the Configuration Manager administrator. The Configuration Manager administrator can restrict which options nonadministrators are permitted to configure.

In This Section

Run Advertised Programs Overview

Program Download Monitor Overview

Configuration Manager Overview

Configuration Manager Technical Reference

See Also

Other Resources

Client Help


Run Advertised Programs Overview

You can access the advertised programs that the System Center Configuration Manager 2007 client makes available to network computers by clicking Run Advertised Programs in Control Panel. You can also filter the list of programs to display those that belong to a specific category only.

In This Section

How To Download a Program

How To Check the Download Status of a Program

How To Cancel a Program Download

How To Run a Program Automatically

How To Run a Program After Downloading

See Also

Reference

Run Advertised Programs Dialog Box


How To Download a Program

System Center Configuration Manager 2007 distributes new software over a network by advertising its availability on your computer. You can download advertised programs by clicking Add or Remove Programs in Control Panel.

Downloads started from Add or Remove Programs appear in the Program Download Monitor. The Program Download Monitor displays information about the size, status, and estimated time remaining for each download. It also allows you to cancel a download or change whether the program runs automatically after the download finishes.

To download advertised programs

  1. Click Start, point to Settings, click Control Panel, and then double-click Add or Remove Programs. (If you are using a Windows Vista client, click Programs and Features.)

  2. Click Add New Programs.

  3. Select an item from the Category list to search within a specific group of programs. (This list is not available if you are using a Windows Vista client).

  4. In the Add programs from your network list, select the program that you want to download and install, and then click Add.

Note
You might need to install prerequisite software first.

If your computer is disconnected from the network during the download, Configuration Manager 2007 can resume the download later, after the computer is reconnected. If you need to monitor and manage multiple program downloads, see Program Download Monitor Overview.

You can also access advertised programs by double-clicking the Run Advertised Programs icon in Control Panel.

See Also

Tasks

How To Run a Program Automatically
How To Check the Download Status of a Program
How To Run a Program After Downloading


How To Check the Download Status of a Program

The Program Download Status window should automatically appear when a program starts downloading to your computer. It displays the status of a program download in one of several ways:

  • Download in progress: program files needed for installation are downloaded to the computer.
  • Download complete: the program is ready to install.
  • Program download failed: some or all parts of the program could not be downloaded. The Program Download Failed dialog box provides details about the cause of the failure and possible solutions.

To display the Program Download Status window

  • If the Program Download Status window does not appear when the download starts, double-click the Download Status icon on the download status bar.

To conceal the Program Download Status window

  • In the Program Download Status window, click Hide.

To display program download status in the Program Download Monitor

  • In the Program Download Monitor, point to Download in the menu, and then click Show Status.

See Also

Tasks

How To Cancel a Program Download
How To Run a Program After Downloading


How To Cancel a Program Download

If you need to cancel a program while it is in the process of downloading, this can be done using Program Download Monitor. If a download is canceled, it will start from the beginning of the download if it is restarted later.

To cancel a program download

  1. Click Start, point to Settings, click Control Panel, and then double-click Program Download Monitor.

  2. In Program Download Monitor, select the download program from the list.

  3. Click Cancel.

  4. In Program Download, click Yes to confirm the cancellation.

Note
To cancel a program download immediately, click Cancel in the Program Download Status window.

See Also

Tasks

How To Run a Program Automatically
How To Check the Download Status of a Program
How To Run a Program After Downloading


How To Run a Program Automatically

This option can be used to avoid waiting for long downloads to finish.

Some installation programs also require that your computer restart afterwards. When this option is set, the program will display a Restart Countdown, and at the end of the countdown period, the program shuts down and restarts the computer automatically, even if other programs are still running or you have unsaved documents open. If you have chosen to run downloaded programs automatically, and you do not think that you will be present when the download finishes, save all your open documents and close all running programs before you leave the computer to prevent possible data loss.

To run a program automatically

  • In the Program Download Status window, select the Run program automatically when download completes box either before starting the download or at any time during the download.

See Also

Tasks

How To Change Automatic Run Settings
How To Run a Program After Downloading


How To Run a Program After Downloading

If you do not choose to run the program automatically after downloading, the Program Ready to Run dialog box opens when a program download is complete, depending on the type of program you have downloaded.

If you do not start the downloaded program within a certain period of time specified by your system administrator, other programs waiting to run might be started, and you will need to wait until they are complete. If you do not expect to be present when the download finishes and the program is ready to run or install, see How To Run a Program Automatically.

To start the downloaded program

  • If the files are for copying and setting up a program on your computer, the Program Ready to Run title is shown. Click Run to start the downloaded program.

See Also

Tasks

How To Change Automatic Run Settings
How To Download a Program
How To Run a Program Automatically


Program Download Monitor Overview

You can use the System Center Configuration Manager 2007 Program Download Monitor in Control Panel to view and manage all downloading programs from a single location.

Downloads that are started from either Add or Remove Programs or Run Advertised Programs in Control Panel appear in the Program Download Monitor.

Program Download Monitor displays information about the size, status, and download start time for each download. It also allows you to cancel a download or change whether the program runs automatically after the download finishes.

See Also

Tasks

How To Start Program Download Monitor
How To Change Automatic Run Settings
How To Cancel a Program Download


How To Start Program Download Monitor

Program Download Monitor is used within Configuration Manager 2007 to view and manage all downloading programs from a single location.

To start Program Download Monitor

  1. Click Start, point to Settings, and then click Control Panel.

  2. Right-click the Program Download Monitor icon, and then click Open.

See Also

Concepts

Program Download Monitor Overview


How To Change Automatic Run Settings

You can use Program Download Monitor to change whether or not to run a program automatically after the download is complete.

Note
Run settings can also be set or changed from the Program Download Required or Program Download Status dialog boxes.

To set a program to run automatically after the download is complete

  1. Open Program Download Monitor, and then select the program from the list.

  2. Click Download, and then click Start Automatically.

See Also

Tasks

How To Run a Program After Downloading
How To Run a Program Automatically
How To Start Program Download Monitor


Configuration Manager Overview

In most cases, the site-wide default System Center Configuration Manager 2007 client settings are configured by your system administrator to suit your company's computer hardware and software.

When the standard settings are not suitable, your system administrator can grant permissions for you to modify these settings from a client computer. Changes must be made by using Configuration Manager in Control Panel.

Tasks that can be performed from Configuration Manager include:

  • Repair an installation.
  • Start an action.
  • Configure advanced systems management settings.

See Also

Tasks

How To Initiate an Action
How To Repair a Client Installation

Other Resources

How to Configure Advanced Configuration Manager Settings


How To Initiate an Action

Use the Actions tab of the Configuration Manager 2007 Configuration Manager Properties dialog box to initiate actions on the Configuration Manager 2007 components installed on this client computer.

Note
In most cases, your system administrator configures actions to run automatically.

To force an action to run immediately

  1. On the client computer, open the Windows control panel.

  2. Right-click the Configuration Management icon, and then click Open.

  3. Click the Actions tab.

  4. In the Actions list, select an item, and then click Initiate Action.


How To Repair a Client Installation

You can use the Repair button on the Components tab of the Configuration Manager 2007 Configuration Manager Properties dialog box to initiate a reinstallation of the Configuration Manager 2007 client components.

Note
Only a system administrator can initiate a repair.

To repair a client installation

  1. On the client computer, open the Windows control panel.

  2. Right-click Configuration Management, and then click Open.

  3. Click the Components tab, and then click Repair.


How to Configure Advanced Configuration Manager Settings

Click any link in the following section for detailed information on how to configure advanced settings for the Configuration Manager 2007 client computer.

Note
These options can only be configured by computer administrators.

In This Section

How To Assign the Client to a New Site

How To Set the Size of the Program Download Folder

How To Set the Location of the Program Download Folder

How To Clear Downloaded Programs and Files


How To Assign the Client to a New Site

You can change the assigned site code of a Configuration Manager 2007 client or automatically discover a site from the Windows control panel.

Note
Advanced settings on the Configuration Manager 2007 client are visible only to local administrators.

Use the following procedure to assign the Configuration Manager 2007 client to a new site code:

To assign the client to a new site code:

  1. On the client computer, open the Windows control panel.

  2. Right-click Configuration Manager, and then click Open.

  3. Click the Advanced tab.

  4. In the SMS Site box, type the three-character site code for the SMS site that you want to use or click Discover to automatically find the local site code.

  5. Click OK to save your changes and close the window.


How To Set the Size of the Program Download Folder

You can change the amount of disk space that the Configuration Manager 2007 client can use to store downloaded packages. The default size of the temporary program download folder is 5120MB.

Note
Advanced settings on the Configuration Manager 2007 client are visible only to local administrators.

Use the following procedure to change amount of disk space allocated to the temporary program download folder:

To set the size of the temporary program download folder:

  1. On the client computer, open the Windows control panel.

  2. Right-click Configuration Manager, and then click Open.

  3. Click the Advanced tab.

  4. In the Temporary Program Download Folder box, move the Amount of disk space to use (MB): slider or type in the desired size in MB to adjust the temporary download storage capacity.

  5. Click OK to save your changes and close the window.

See Also

Tasks

How To Set the Location of the Program Download Folder
How To Clear Downloaded Programs and Files


How To Set the Location of the Program Download Folder

You can change the location that Configuration Manager 2007 uses to store downloaded packages on client computers. The default location is %windir%\system32\CCM\Cache.

Note
Advanced settings on the Configuration Manager 2007 client are visible only to local administrators.

Use the following procedure to set the location of the program download folder on a client computer:

To set the location of the Program Download folder:

  1. On the client computer, open the Windows control panel.

  2. Right-click Configuration Manager, and then click Open.

  3. Click the Advanced tab.

  4. In the Temporary Program Download Folder box, click Change Location.

  5. Browse to a folder, and then click OK.

  6. Click OK to save your changes and close the window.

See Also

Tasks

How To Set the Size of the Program Download Folder
How To Clear Downloaded Programs and Files


How To Clear Downloaded Programs and Files

Files and programs that have been downloaded using Configuration Manager are usually deleted automatically whenever space is needed within the cache. Because of this, it will be rare that you will need to manually delete files from the cache. If it is necessary, the following procedure will help you clear the downloaded programs and files from the cache.

Note
Advanced settings are visible only to local administrators.

To clear downloaded programs and files

  1. Click Start, point to Settings, and then click Control Panel.

  2. Right-click Configuration Manager, and then click Open.

  3. Click the Advanced tab.

  4. In the Temporary Program Download Folder box, click Delete Files, and then click Yes.

  5. Click OK to close the window.

See Also

Tasks

How To Set the Location of the Program Download Folder
How To Set the Size of the Program Download Folder


Configuration Manager Technical Reference

In This Section

Configuration Manager Properties

Advertised Programs Properties

Program Download Failed Dialog Box

Cannot Run Program

Run Advertised Programs Dialog Box

System Restart Required Dialog Box on Client

Program Countdown Status Dialog Box

Available Software Updates Dialog Box on Clients

Software Update Management Dialog Box on Client

Delete Files Dialog Box

Software Updates Installation Progress Dialog Box on Client

Program Download Required Dialog Box

Operating System Deployment

Software Distribution


Configuration Manager Properties

The Configuration Manager 2007 Configuration Manager Properties allows an administrator to view and configure settings for the Configuration Manager 2007 client on this computer.

Click any link in the following section for detailed information about its associated tab in the Configuration Manager Properties.

In This Section

Term Definition

Configuration Manager Properties: General Tab

Displays general information about this client computer and its configuration.

Configuration Manager Properties: Components Tab

Displays information about the Configuration Manager 2007 components installed on this client computer, and allows an administrator to initiate a repair of the client.

Configuration Manager Properties: Actions Tab

Allows an administrator to initiate client actions outside their normal schedule.

Configuration Manager Properties: Advanced Tab

Allows an administrator to configure the Configuration Manager 2007 site code to which this computer is assigned, and to configure the folder in which downloaded programs are stored.

Configuration Manager Properties: Updates Tab

Allows an administrator to set a schedule of when required software updates will be installed on this computer.

Configuration Manager Properties: Configurations Tab

Allows an administrator to view configuration baselines that have been assigned to this computer, and to initiate and view the results of a compliance evaluation of these configuration baselines.

Note
This tab does not display if the desired configuration management client agent is disabled on this client's assigned Configuration Manager 2007 site.

Configuration Manager Properties: Internet Tab

Allows an administrator to configure this computer to be managed over the Internet.

Note
This tab does not display if the client's assigned Configuration Manager 2007 site is operating in mixed mode.


Configuration Manager Properties: General Tab

Use the General tab of the Configuration Manager 2007 Configuration Manager Properties dialog box to display general information about the Configuration Manager 2007 client installed on this computer.

This tab contains the following elements:

System Properties

Displays current system properties and values such as operating system versions, logged-on users, Configuration Manager information, and IP information. Click Property or Value to sort list information in either ascending or descending order.

OK

Saves the changes, and exits the dialog box.

Cancel

Exists the changes, and remains in the dialog box.

Apply

Saves the changes, and remains in the dialog box.

See Also

Reference

Configuration Manager Properties: Components Tab
Configuration Manager Properties: Actions Tab
Configuration Manager Properties: Advanced Tab
Configuration Manager Properties: Configurations Tab
Configuration Manager Properties: Internet Tab


Configuration Manager Properties: Components Tab

Use the Components tab of the Configuration Manager 2007 Configuration Manager Properties dialog box to view the installed and enabled Configuration Manager 2007 components on this computer and to initiate a repair of these components.

Note
Only a system administrator can use the Repair Installation option.

This tab contains the following elements:

Components

Displays the status and version of the components that Configuration Manager uses to manage your computer.

Repair

If any client files are missing or damaged, click this button to reinstall the Configuration Manager client.

OK

Saves the changes, and exits the dialog box.

Cancel

Exists the changes, and remains in the dialog box.

Apply

Saves the changes, and remains in the dialog box.

See Also

Reference

Configuration Manager Properties: General Tab
Configuration Manager Properties: Actions Tab
Configuration Manager Properties: Advanced Tab
Configuration Manager Properties: Configurations Tab
Configuration Manager Properties: Internet Tab


Configuration Manager Properties: Actions Tab

Use the Actions tab of the Configuration Manager 2007 Configuration Manager Properties dialog box to immediately initiate Configuration Manager actions on this computer:

Note
Only users with administrator rights to this computer can initiate actions.

This tab contains the following elements:

Actions

Displays a list of Configuration Manager 2007 client actions that an administrator can perform on this computer.

Initiate Action

Click this button to initiate the selected action.

OK

Saves the changes, and exits the dialog box.

Cancel

Exists the changes, and remains in the dialog box.

Apply

Saves the changes, and remains in the dialog box.

See Also

Tasks

How To Initiate an Action


Configuration Manager Properties: Advanced Tab

Topic last updated—January 2008

Use the Advanced tab of the Configuration Manager 2007 Configuration Manager Properties dialog box to configure settings for this client's assigned site and to specify the size and location of the temporary program download folder.

Note
Settings on this tab can be configured only by a user with administrative rights. Configured settings might not be visible to low-rights users.

This tab contains the following elements:

Currently assigned to site code

Specify the name of the Configuration Manager 2007 site that this client is assigned to.

You can enter a new site code or click Discover to automatically search for a Configuration Manager 2007 site to assign to.

Note
The site code cannot be modified if the client is configured for Internet-based client management and is currently on the Internet.

Discover

Click this button to search for a Configuration Manager 2007 site to assign this client to.

If the client is configured with an Internet-based management point, this functionality is not supported, even if the button is available.

Specify or modify a DNS suffix for site assignment below

Displays the DNS suffix of the default management point, which is required if Configuration Manager is publishing the default management point to DNS.

If no value is displayed, or you want to change the currently specified value for this client, type it in.

For example, if the client's default management point for its assigned site is server1.contoso.com, the DNS suffix is contoso.com.

Amount of disk space to use (MB)

Specify the amount of disk space in MB to use for the temporary program download folder. The default value is 5120 MB

Change Location

Click to choose an existing folder to use as the temporary program download folder.

Note
On Windows Vista or Windows Server 2008 computers, the location of the temporary program download folder might be displayed incorrectly. If you click Change Location and accept the prompt to elevate the user rights to administrator, the location of the temporary program download folder will be displayed correctly.

Delete files

Click to delete files from the temporary program download folder. Older files are deleted automatically when space is needed in the cache.

OK

Saves the changes, and exits the dialog box.

Cancel

Exists the changes, and remains in the dialog box.

Apply

Saves the changes, and remains in the dialog box.

See Also

Reference

Configuration Manager Properties: General Tab
Configuration Manager Properties: Components Tab
Configuration Manager Properties: Actions Tab
Configuration Manager Properties: Configurations Tab
Configuration Manager Properties: Internet Tab


Configuration Manager Properties: Updates Tab

Use the Updates tab in the Configuration Manager 2007 Configuration Manager Properties dialog box to specify whether there is a configured schedule for installing software updates that are required on this computer. When this setting is not enabled, mandatory software updates will be installed at the deadline date and time scheduled by the Configuration Manager administrator or manually installed prior to the deadline.

When this setting is enabled, it allows you to schedule software update installation at a time that is convenient (for example, every day at 2 AM). Some software updates might require a computer restart for the installation to complete.

The Updates tab contains the following elements:

Install required updates on a schedule

Specifies whether required software updates that have been deployed to this client computer will install on a specified schedule.

When it is enabled, you can specify a recurrence pattern of every day or a specific day of the week and a specific time.

OK

Saves the changes, and exits the dialog box.

Cancel

Exists the changes, and remains in the dialog box.

Apply

Saves the changes, and remains in the dialog box.

See Also

Other Resources

Configuration Manager Properties


Configuration Manager Properties: Configurations Tab

Use the Configurations tab of the Configuration Manager Properties to see which configuration baselines are assigned to a computer, and the properties of each assigned configuration baseline. You can also initiate a compliance evaluation with assigned configuration baselines, view a report of compliance, and refresh the display of the listed configuration baselines.

Note
The Configurations tab does not display if the desired configuration management client agent is disabled on the client's assigned site.

This tab contains the following elements:

These configuration baselines are assigned to this machine.

Displays the configuration baselines assigned by the administrator to this computer. For each configuration baseline displayed, the following properties are displayed:

  • Name of the configuration baseline provided by the administrator. The configuration baseline name is displayed in the language used to create it and is not translated into the client computer's locale.
  • Version of the configuration baseline, identifying how often it has been modified.
  • Last Evaluation displays the date and time in the client's local time that the configuration baseline was last evaluated for compliance.
  • Compliance Status of the computer with the configuration baseline, which will be either compliant or non-compliant.
  • Evaluation Status indicates if a configuration baseline is being evaluated for compliance.
    When the client is not evaluating compliance, all configuration baselines will display Idle. When a configuration baseline is being evaluated, the status displays In Progress.
    When evaluating multiple configuration baselines, they are processed sequentially and the configuration baselines that are queued will display In queue.
Evaluate

Initiates an ad-hoc compliance evaluation on the computer with the selected configuration baselines. This option is available to low-rights users.

Important
The evaluation results are cached on the client for 15 minutes. If you initiate a re-evaluation within the 15 minute period, the compliance results will be returned from this cache rather than a new evaluation. Therefore, if you make a change on the client that might affect the compliance evaluation results, wait until the 15 minutes have elapsed before initiating a re-evaluation.

View Report

Opens the compliance evaluation report as a Web report that displays the compliance results of all configuration baselines assigned to the client.

This option is not available to low-rights users.

Refresh

Refreshes the list of configuration baselines and their properties.

OK

Saves the changes and exits the dialog box.

Cancel

Exists the changes and remains in the dialog box.

Apply

Saves the changes and remains in the dialog box.


Configuration Manager Properties: Internet Tab

Use the Internet tab of the Configuration Manager 2007 Configuration Manager Properties dialog box to specify the fully qualified domain name (FQDN) of the management point that is configured to accept client connections across the Internet.

Additionally, if your computer uses a proxy server with user authentication to access the Internet, specify the proxy server details. If your computer uses a proxy server without user authentication, and the proxy server details are specified in the default Web browser, you do not need to specify the proxy server settings here.

The Internet tab does not display if the client is communicating in mixed mode. Internet-based client management requires that clients connect to their assigned site using native mode communication.

Note
Settings on this tab can be configured only by a user with administrative rights. Configured settings might not be visible to low-rights users.

This tab contains the following elements:

Internet based management point (FQDN):

Specifies the fully qualified domain name of the management point (or the network load balanced management point) that is configured to accept client connections over the Internet.

This is required if the computer is managed over the Internet.

Note
If you configure this option, or remove the value for this option so that no Internet-based management point is specified, the ConfigMgr connection type displayed on the General tab will not update until the client is restarted

Additionally, if you remove this option when the client is on the Internet, you must restart the client (SMS Agent Host) or restart the computer before the client will communicate with its default management point on the intranet.

Proxy server

Specifies the name of the proxy server to use for Internet access. Specify a fully qualified domain name, a short name, or an IP address.

If you are using an IP address, both IPv4 and IPv6 formats are supported.

Examples:

  • webproxy.contoso.com
  • webproxy
  • 123.456.123.456
  • [1234:b44:3013:301:203:ffff:fec2:db89]
Proxy server port: (HTTP and HTTPS)

Specifies the port to use to connect to the proxy server for Internet access, with a number between 1 and 65535.

Although the same port number is used for both HTTP and HTTPS connections, most proxy servers will be able to automatically determine the different ports to use for outbound Internet connections. However, if you must specify separate port numbers for HTTP and HTTPs, use alternative configuration methods such as the advanced proxy server settings in Windows Internet Explorer.

Examples:

  • 8080
  • 80
Proxy server user name

Specifies the Microsoft Windows user name for authentication if the proxy server is configured to authenticate users for Internet access.

Example:

  • Contoso\user1
Note
Specifying the user name in the format of a universal principle name (UPN) is not supported.

Proxy server password

Specifies the password associated with the specified Proxy server user name to complete authentication for Internet access.

OK

Saves the changes, and exits the dialog box.

Cancel

Exists the changes, and remains in the dialog box.

Apply

Saves the changes, and remains in the dialog box.


Advertised Programs Properties

The Configuration Manager 2007 Advertised Programs Properties dialog box displays information about the advertised programs being advertised to this client computer.

Click any link in the following section for detailed information about its associated tab in the dialog box:

In This Section

Advertised Programs Properties: General Tab

Advertised Programs Properties: Advanced Tab


Advertised Programs Properties: General Tab

Use the General tab of the Configuration Manager 2007 Advertised Programs properties dialog box to view the category and any comments associated with the advertised program.

The General tab contains the following elements:

Categories

Displays the category to which this advertised program has been added.

Comment

Displays the comment for the program.

See Also

Reference

Advertised Programs Properties: Advanced Tab


Advertised Programs Properties: Advanced Tab

Use the Advanced tab of the Configuration Manager 2007 Advertised Programs properties dialog box to view the input requirements of the program, as well as estimated disk space, program run sequence, and other requirements associated with the advertised program.

The Advanced tab contains the following elements:

User input required

Indicates whether you must provide information while the advertised program runs.

Estimated disk space

Provides an estimate of the amount of disk space that is used by the program after it is installed.

After program runs

Indicates an action that might occur after the program runs. For example, Configuration Manager might restart your computer.

This program must run first

Displays the name of the program that must run before the advertised program starts.

Additional requirements

Displays additional system or security requirements for the advertised program.

See Also

Reference

Advertised Programs Properties: General Tab


Program Download Failed Dialog Box

The Configuration Manager 2007 Program Download Failed dialog box is displayed when you or your system administrator attempts to download and run a program using Configuration Manager and the program download fails.

When a download fails, try to restart the installation again.

See Also

Tasks

How To Download a Program


Cannot Run Program

Try to run the program again by clicking either Run Advertised Programs or Add or Remove Programs in Control Panel.

See Also

Tasks

How To Run a Program After Downloading


Run Advertised Programs Dialog Box

The Configuration Manager 2007 Run Advertised Programs dialog box displays information about the programs currently advertised to the client computer.

The Run Advertised Programs dialog box contains the following elements.

Area

Select a type of program to view, such as Software Distribution or Operating System Deployment programs, or view all advertised programs using the All Areas option.

Category

Select a category to show programs belonging only to a certain group within the selected Area list.

Program list

Displays a list of programs matching the criteria used in the Area and Category drop-down list boxes.

Next Run Time

Indicates the next time each program in the list is scheduled to run automatically. Clicking Next Run Time sorts the list in either ascending or descending order.

Last Run Time

Indicates the last time each program in the Program Name list ran. Clicking Last Run Time sorts the list in either ascending or descending order.

Last Status

Indicates the most recently reported state of a running program, whether a program ran previously, and the outcome of a program previously run. Clicking Last Status displays program status in either ascending or descending order.

Details button

Displays the estimated disk space and other detailed information about the selected program.

Run button

Downloads and runs the selected program.

Close button

Closes the Run Advertised Programs dialog box. Programs already selected to run will not be affected by closing this box.

See Also

Other Resources

Run Advertised Programs Overview


System Restart Required Dialog Box on Client

The System Restart Required dialog box in Configuration Manager 2007 indicates that a software update or software distribution installation has finished on a client computer, but a mandatory system restart is necessary for it to complete. The countdown value indicates the amount of time before the mandatory system restart will be initiated. The computer can be manually restarted at any time prior to the enforced system restart.

Important
Save your work and close all programs before restarting the computer.

This dialog box contains the following elements:

Restart Now

Initiates a system restart on the computer. Be sure to save your work prior to the system restart.

Close

Closes the System Restart Required dialog box. The restart countdown will continue. The dialog box will display again prior to the mandatory system restart to remind you of the pending restart and allow you time to save your work. After closing the dialog box, you can view it at any time by clicking the Restart Manager icon in the notification area.


Program Countdown Status Dialog Box

When an assigned program is about to run, a status icon is displayed in the status tray of the taskbar to provide a countdown. This icon remains in the status tray until the countdown is completed or until you click Run. You can double-click the status icon to display the Program Countdown Status dialog box.

The Program Countdown Status dialog box contains the following elements:

Properties

Opens the Program Properties dialog box for the program that is about to run.

Run

Starts running the assigned program. Depending on the setting assigned by the administrator, this will start running the program directly from network or from cache. If the program is not present in cache then it will be downloaded and then run.

Hide

Removes the Program Countdown Status dialog from view. This will not interrupt a pending program download or prevent an assigned program from running on schedule.

See Also

Tasks

How To Download a Program

Reference

Advertised Programs Properties: General Tab
Advertised Programs Properties: Advanced Tab

Other Resources

Run Advertised Programs Overview


Available Software Updates Dialog Box on Clients

The Available Software Updates dialog box in Configuration Manager 2007 displays all software updates that are available for installation on client computers. The following information is displayed:

  • Vendor: Specifies the vendor whose catalog contains the software update.
  • Name: Specifies the name of the software update.
  • Deadline: Specifies the deadline date and time for mandatory software updates. If the deadline is reached and the software update deployment has not yet run on the client, the installation starts automatically. Optional software updates have a deadline value of N/A.
  • Status: Specifies the current status of the software update. The possible values are Available, Restart Pending, and Failed.
  • Update summary: Specifies additional information about a selected software update. Information is listed only when a software update is selected.
  • More information: Specifies a URL that links to more information for the software update. A URL is listed only when a software update is selected.
  • This dialog box contains the following elements:
<Software update name>

Specifies the software updates that are available for installation. Select the updates to install. Multiple software updates can be selected. By default, all mandatory software updates are automatically selected.

Schedule Installation

Opens the Updates tab of the Systems Management Properties where you can specify whether to install required software updates on a recurring schedule.

Install

Initiates the installation for all software updates that have been selected. The Available Software Updates dialog box closes, and a software updates installation progress dialog box appears.

The Install button is enabled when a software update has been selected for install.

Restart Now

Specifies that a system restart should be initiated. This option is available only when a software update is in the Pending restart state.

Close

Closes the Available Software Updates dialog box. Any installs that have been previously initiated will not be interrupted by closing the dialog box.

See Also

Reference

Configuration Manager Properties: Updates Tab


Software Update Management Dialog Box on Client

The Software Update Management dialog box in Configuration Manager 2007 displays on client computers when at least one required software update has been deployed to the computer and is available for installation. You can choose to install all required software updates, select from a list of available software updates and then initiate the installation, or close the dialog box and install the software updates at a later time.

Note
The installation for required software updates will automatically initiate at the configured deadline, which is displayed in the Available Software Updates dialog box. If a system restart is required after the installation completes, it will automatically be initiated.

The Software Update Management dialog box contains the following elements:

Express (Recommended)

Specifies that all required software updates will be installed. Click Install to initiate the installation.

Custom (Advanced)

Specifies that the Available Software Updates dialog box will be opened where both mandatory and optional software updates are displayed. This dialog box allows you to select which software updates to install from the list of required and optional updates, as well as schedule software update installation at a specific date and time.

Click Next to open the Available Software Updates dialog box.

Install

Initiates the installation for all required software updates.

Next

Opens the Available Software Updates dialog box. This option is available when the Custom (Advanced) setting is selected.

Close

Exits the dialog box without installing software updates.

See Also

Reference

Available Software Updates Dialog Box on Clients


Delete Files Dialog Box

Use the Configuration Manager 2007 Delete Files dialog box to confirm that you want to delete the contents of the temporary program download folder on a client computer. You can also specify that you want to delete any content from Configuration Manager 2007 packages that have been configured to persist content in the temporary program download folder.

This dialog box contains the following elements:

Yes

Deletes all files that have been configured to download before running. Downloaded files and programs are automatically deleted whenever the cache reaches the maximum size that you have specified. Usually, you do not need to manually delete files from the cache, but if you do not have enough disk space in the cache for a program to download, you can manually clear the cache.

Delete persisted cache content

The administrator can configure packages to Persist content in client cache instead of being deleted automatically. If you select Delete persisted cache content you override the Persist content in client cache option.

See Also

Tasks

How To Clear Downloaded Programs and Files
How To Set the Size of the Program Download Folder
How To Set the Location of the Program Download Folder


Software Updates Installation Progress Dialog Box on Client

The Software Updates Installation Progress dialog box in Configuration Manager 2007 shows the progress for the installation of software updates on client computers. The following information is displayed:

  • Vendor: Specifies the vendor whose catalog contains the software update.
  • Name: Specifies the name of the software update.
  • Deadline: Specifies the deadline date and time for mandatory software updates. If the deadline is reached and the software update deployment has not yet run on the client, the installation starts automatically. Optional software updates have a deadline value of N/A.
  • Status: Specifies the current status of the software update. The possible values during the installation are Preparing for download, Downloading, and Installing. When the installation completes, the status displays either Succeeded or Failed.

When a software update was successfully installed, it will no longer appear in the Available Software Updates dialog box after it is closed and reopened.

The Software Updates Installation Progress dialog box contains the following elements:

Cancel

Cancels the software update installation.

Close

Closes the dialog box. The software update installation continues if it is still in progress.

See Also

Reference

Available Software Updates Dialog Box on Clients


Program Download Required Dialog Box

The Configuration Manager 2007 Program Download Required dialog box is displayed when your client computer receives an advertisement that requires you to download a program before running it.

Properties button

Opens the Program Properties dialog box for the program.

The following programs will be downloaded and run first

Specifies any programs that the program to be downloaded must run on your client computer before it will run. This list will only be visible if the program has any child programs upon which it is dependent.

Run all programs automatically when downloads complete

Specifies whether the program and all child programs that must be run first will be automatically run as soon as they are downloaded. If this check box is cleared, you will be asked to run each individual program. This check box is cleared by default.

Download button

Starts the download of the advertised program. If it requires other programs to be downloaded and run, this will be done automatically when this button is clicked.

Cancel button

Cancels any download options selected and closes the dialog box.

See Also

Reference

Run Advertised Programs Dialog Box
Program Download Failed Dialog Box


Operating System Deployment

Operating System Deployment allows you to create operating system images and deploy those images to target computers. Operating System Deployment also provides task sequences which help facilitate the deployment of operating system images, and other Configuration Manager 2007 software packages.


Software Distribution

The Microsoft System Center Configuration Manager 2007 software distribution functionality allows system administrators to create packages for distributing software to client computers. A package generally represents a software application that will be installed on a client computer, but it might also contain individual files, updates, or even an individual command.

Using packages, your administrator can deliver, install, and configure software to meet the individual needs of you and your client computer. This is done using programs, which identify the actions that must occur on your computer once the package is received. Each program defines the client platform and environment within which the package can run, and includes any and all commands or files needed.

After programs have been defined for a package, the administrator creates an advertisement, which is sent to the client. The client user can then decide whether or not to download and run the program that's being advertised. In some cases, however, it's necessary for an administrator to create an assigned program, which is mandatory and must be installed on the client computer. Assigned programs are usually things like service packs, virus detection software, and other software that must be installed on the client because of network policy or security concerns. In most cases, when an assigned (mandatory) program is advertised, you will have the opportunity to download and run the program when it's convenient to you, but if it hasn't been done by a specific time set by the administrator, the program will automatically be run.

See Also

Reference

Run Advertised Programs Dialog Box

Other Resources

Advertised Programs Properties


Configuration Manager Remote Control

In This Section

Remote Control Overview

How to Determine Available Remote Tasks

How to Set Remote Control Notification Options

How to Monitor Remote Control Progress

How to Access Remote Control Properties

How to Disconnect a Remote Control Session

Remote Control Properties: General Tab

Remote Control Properties: Notification Tab


Remote Control Properties: Notification Tab

Use the Notification tab to specify the type of notification that you receive during a remote control session. These notification settings are applied only when an administrator views your screen and controls your keyboard and mouse.

Note
If your administrator sets this control on a site-wide basis, you might not be able to change the controls on this tab.

Display a visual indicator

Select this check box to display a remote control visual indicator. Then, specify whether to display a status icon on the taskbar or to display a high security indicator on the desktop.

Play a sound

Select this check box to play a sound when a remote control session is in progress. Choose to play the sound when the session begins and ends or repeatedly (every 15 seconds) during the remote control session.

Use Administrator settings

When enabled, the default values that were set by your remote administrator for the remote control session are used. All other controls in the dialog box are changed to reflect the settings that were set by your remote administrator and are unavailable.

See Also

Concepts

Remote Control Overview


Remote Control Properties: General Tab

Use the General tab to specify the level of remote control that you want a remote administrator to have on your computer.

When Remote Control is enabled on your computer, your administrator provides default settings that determine the level of remote access allowed to this computer. If your administrator selects the Use administrator settings check box, the options on the General tab are unavailable and you cannot change these settings.

Level of remote access allowed

Specify the level of remote control that you will allow a remote administrator to have.

When a remote administrator tries to control this computer

When a remote administrator tries to control your computer, you can specify either that a message is displayed that asks you for permission each time or that no message is displayed.

Use administrator settings

When enabled, the default values that were set by your remote administrator for the remote control session are used. All the other controls in the dialog box are changed to reflect the settings that were set by your remote administrator and are unavailable.

If your administrator has set this control on a site-wide basis, you might not be able to change the controls on this tab.

Show Status

Click to view the status of remote control on your computer. Details include the version of Configuration Manager remote control that is installed, the protocol that is used, your network address, your local computer name, whether accelerated screen transfer is used, and the compression type in use (if any).

Note
This button appears on Windows 2000 client computers only.

See Also

Concepts

Remote Control Overview


How to Disconnect a Remote Control Session

You can stop a remote control session at any time.

To disconnect a remote control session

  1. In the notification area, right-click the Remote Control icon.

  2. Click Close Session.

See Also

Tasks

How to Access Remote Control Properties
How to Determine Available Remote Tasks
How to Monitor Remote Control Progress
How to Set Remote Control Notification Options

Concepts

Remote Control Overview


How to Access Remote Control Properties

By using remote control properties, you can:

  • Specify the level of control that the administrator has over your computer by selecting which tasks, such as file transfer, that you want your administrator to perform.
  • Specify that you are notified with a message requesting your permission whenever an administrator attempts to operate your computer remotely.
  • Specify that you are notified with a visual indicator or with a sound when an administrator is controlling your computer.
Note
If your administrator locks down these settings for your computer, you cannot modify them.

To access Remote Control properties

  1. In Windows, open control panel.

  2. In control panel, select Remote Control.

See Also

Tasks

How to Determine Available Remote Tasks
How to Monitor Remote Control Progress
How to Set Remote Control Notification Options

Concepts

Remote Control Overview


How to Monitor Remote Control Progress

You have the option of being notified whenever your computer is accessed for a remote control session. If you choose to be notified when your computer is being remotely accessed, a status icon appears on your desktop or in the notification area, and a sound can be played. These settings are enabled on the Notification tab in the Remote Control Properties dialog box.

To view remote control progress, right-click the Remote Control icon and select Status. The status window that opens indicates the following:

  • The version of Configuration Manager Remote Control that is installed
  • The protocol that is used
  • Your network address
  • Your local computer name
  • Whether accelerated screen transfer is used
  • The compression type in use (if any)
  • Who is currently remotely controlling your computer

To view remote control progress

  1. In the notification area, right-click the Remote Control icon.

  2. Click Status.

The status window that opens indicates the following:

  • The version of SMS Remote Control that is installed
  • The protocol that is used
  • Your network address
  • Your local computer name
  • Whether accelerated screen transfer is used
  • The compression type in use (if any)
  • Who is currently remotely controlling your computer

See Also

Tasks

How to Access Remote Control Properties
How to Disconnect a Remote Control Session
How to Determine Available Remote Tasks
How to Set Remote Control Notification Options

Concepts

Remote Control Overview


How to Set Remote Control Notification Options

You can choose the type of notification that you receive when an administrator tries to gain access to your computer. If you select a visual indicator, you can choose the indicator type and the frequency of display. You can also choose a sound indicator. In addition, you can choose to receive a message that asks if you want to grant permission each time a remote administrator attempts to gain access to your computer.

To set remote control notification options

  1. On a client computer, open Windows control panel.

  2. Click Remote Control.

  3. In the Remote Control Properties dialog box, click the Notification tab.

  4. Select or clear the appropriate options.

  5. Click OK to save your settings.

See Also

Tasks

How to Determine Available Remote Tasks
How to Monitor Remote Control Progress

Reference

Remote Control Properties: Notification Tab

Concepts

Remote Control Overview


How to Determine Available Remote Tasks

When Remote Control is enabled on your computer, your administrator provides default settings that determine which remote control tasks can be performed. Unless your administrator has specified that your computer use the default administrator settings, you can modify these settings.

To determine the remote tasks that can be performed

  1. In Windows, open Control Panel.

  2. In Control Panel, select Remote Control.

  3. On the General tab in the Remote Control Properties dialog box, select the appropriate level of remote control allowed: no remote control, limited remote control, or full remote control.

    Note
    If your administrator selected Use administrator settings, you cannot change any of these settings in this area.

  4. Click OK.

See Also

Reference

Remote Control Properties: General Tab
Remote Control Properties: Notification Tab

Concepts

Remote Control Overview


Remote Control Overview

Your remote administrator uses remote tools to diagnose and correct problems on your computer. Remote control greatly reduces the time that is required to resolve computer problems because your administrator can perform many troubleshooting tasks without physically visiting your computer.

Your administrator assigns default settings for remote control on your computer and specifies whether you can modify them.

Remote control settings are accessed through remote control properties and include the following configurable settings:

  • The level of control that your administrator has on your computer
  • Whether your permission is required
  • How you are notified when an administrator controls your computer

See Also

Tasks

How to Access Remote Control Properties
How to Disconnect a Remote Control Session
How to Determine Available Remote Tasks
How to Monitor Remote Control Progress
How to Set Remote Control Notification Options


Appendixes

In This Section

LDIF File for Extending the Active Directory Domain Services Schema for Configuration Manager

Scripted Installation Examples

Command Line Options for Running the Configuration Manager Console

Ports Used by Configuration Manager

Custom Error Codes for Configuration Manager 2007

Configuration Manager 2007 Accessibility Features

See Also

Concepts

Configuration Manager Icons
Technical Reference for Configuration Manager 2007


LDIF File for Extending the Active Directory Domain Services Schema for Configuration Manager

Configuration Manager 2007 includes additional extensions to the Active Directory schema. If you previously extended your SMS 2003 schema, you should apply the Configuration Manager 2007 schema extensions. If you have not previously extended your schema, you should consider the benefits.

For more information about the benefits of extending the Active Directory schema for Configuration Manager 2007, see Decide If You Should Extend the Active Directory Schema.

For more information about extending the Active Directory schema for Configuration Manager 2007, see How to Extend the Active Directory Schema for Configuration Manager.

Configuration Manager Active Directory Schema Extensions LDIF File

If you prefer to extend your schema using an LDIF file, the file is included here. To extend the Active Directory schema using an LDIF file, you can use the ConfigMgr_ad_schema.ldf file located in the <DVD root directory>\SMSSETUP\BIN\I386 directory of the Configuration Manager 2007 installation media.

Copy Code
# ----------------------------------------------------------------------
# SMS Schema Extensions LDIF file for Microsoft Active Directory
#
# Copyright 2005, Microsoft Corporation
#
# This file extends the Active Directory Schema for SMS V4.
#
# This LDIF file performs a schema extensions compatible with SMS 2003 and
# SMS V4.  The extensions will be added for SMS 2003 and then updated for
# SMS V4, so the LDIF can be used for both new installations of SMS V4 as
# well as upgrades to existing SMS 2003 schemas.
#
# Change Log:
#
# VersionDateReason
# ------------- --------------- -----------------------------
# Version 1.0 9/7/2005Initial File Creation
# Version 1.1   9/8/2005Added possSuperiors: container to Classes
#MS-SMS-Site, MS-SMS-Roaming-Boundary-Range
#
# ----------------------------------------------------------------------

# =========================================================================
#                       SMS Schema Attributes - Additions for SMS V4
# =========================================================================

# ----------------------------------------------------------------------
# This section adds a new attribute for SMS Capabilities information.  This is a
# new attribute for SMS V4.
#
# This attribute updates the MS-SMS-Management-Point class.
# ----------------------------------------------------------------------

dn: CN=mS-SMS-Capabilities,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: mS-SMS-Capabilities
attributeID: 1.2.840.113556.1.6.29.2.1.14
attributeSyntax: 2.5.5.4
isSingleValued: TRUE
oMSyntax: 20
searchFlags: 0
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# This section adds a new attribute for SMS Version information.  This is a
# new attribute for SMS V4.
#
# This attribute updates the MS-SMS-Management-Point class.
# ----------------------------------------------------------------------

dn: CN=mS-SMS-Version,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: mS-SMS-Version
attributeID: 1.2.840.113556.1.6.29.2.1.15
attributeSyntax: 2.5.5.9
isSingleValued: TRUE
oMSyntax: 10
searchFlags: 0
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# This section adds a new attribute for SMS Source Forest information.
# This is a new attribute for SMS V4.
#
# This attribute updates the MS-SMS-Management-Point class.
# ----------------------------------------------------------------------

dn: CN=mS-SMS-Source-Forest,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: mS-SMS-Source-Forest
attributeID: 1.2.840.113556.1.6.29.2.1.12
attributeSyntax: 2.5.5.4
isSingleValued: TRUE
oMSyntax: 20
searchFlags: 0
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# This section adds a new attribute for SMS Health State information.
# This is a new attribute for SMS V4.
#
# This attribute updates the MS-SMS-Site class.
# ----------------------------------------------------------------------

dn: CN=mS-SMS-Health-State,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: mS-SMS-Health-State
attributeID: 1.2.840.113556.1.6.29.2.1.11
attributeSyntax: 2.5.5.4
isSingleValued: TRUE
oMSyntax: 20
searchFlags: 0
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# =========================================================================
#           SMS Schema Attributes - Additions for SMS 2003 or SMS V4
# =========================================================================

# ----------------------------------------------------------------------
# SMS Assignment Site Code Attribute
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.
# ----------------------------------------------------------------------

dn: CN=mS-SMS-Assignment-Site-Code,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: mS-SMS-Assignment-Site-Code
attributeID: 1.2.840.113556.1.6.29.2.1.9
attributeSyntax: 2.5.5.4
isSingleValued: TRUE
oMSyntax: 20
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS Default MP Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Default-MP,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-Default-MP
attributeID: 1.2.840.113556.1.6.29.2.1.4
attributeSyntax: 2.5.5.8
isSingleValued: TRUE
oMSyntax: 1
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS MP Address Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-MP-Address,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-MP-Address
attributeID: 1.2.840.113556.1.6.29.2.1.6
attributeSyntax: 2.5.5.4
isSingleValued: TRUE
oMSyntax: 20
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS MP Name Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-MP-Name,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-MP-Name
attributeID: 1.2.840.113556.1.6.29.2.1.5
attributeSyntax: 2.5.5.4
isSingleValued: TRUE
oMSyntax: 20
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS IP Address Range - HIGH Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Ranged-IP-High,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-Ranged-IP-High
attributeID: 1.2.840.113556.1.6.29.2.1.8
attributeSyntax: 2.5.5.9
isSingleValued: TRUE
oMSyntax: 10
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS IP Address Range - LOW Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Ranged-IP-Low,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-Ranged-IP-Low
attributeID: 1.2.840.113556.1.6.29.2.1.7
attributeSyntax: 2.5.5.9
isSingleValued: TRUE
oMSyntax: 10
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS Roaming Boundaries Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Roaming-Boundaries,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-Roaming-Boundaries
attributeID: 1.2.840.113556.1.6.29.2.1.3
attributeSyntax: 2.5.5.4
isSingleValued: FALSE
oMSyntax: 20
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS Site Boundaries Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Site-Boundaries,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-Site-Boundaries
attributeID: 1.2.840.113556.1.6.29.2.1.2
attributeSyntax: 2.5.5.4
isSingleValued: FALSE
oMSyntax: 20
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS Site Code Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Site-Code,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: MS-SMS-Site-Code
attributeID: 1.2.840.113556.1.6.29.2.1.1
attributeSyntax: 2.5.5.4
isSingleValued: TRUE
oMSyntax: 20
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS Device Management Point Attribute
#
# This section adds the SMS 2003 compatible attribute for SMS Sites
# This attribute will fail to be added if the AD schema has already been
# extended for SMS 2003.  This attribute will be added if the schema has
# not yet been extended for SMS 2003 or SMS V4.
# ----------------------------------------------------------------------

dn: CN=mS-SMS-Device-Management-Point,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: attributeSchema
cn: mS-SMS-Device-Management-Point
attributeID: 1.2.840.113556.1.6.29.2.1.10
attributeSyntax: 2.5.5.8
isSingleValued: TRUE
oMSyntax: 1
searchFlags: 1
isMemberOfPartialAttributeSet: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# =========================================================================
#                       SMS Schema Classes - Additions
# =========================================================================

# =========================================================================
# SMS Management Point Class
# This section adds the SMS 2003 compatible class for SMS Management Points
# This class will fail to be added if the AD schema has already been
# extended for SMS 2003.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Management-Point,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: classSchema
cn: MS-SMS-Management-Point
subClassOf: serviceConnectionPoint
governsID: 1.2.840.113556.1.6.29.2.2.1
mayContain: cn
mayContain: mSSMSDeviceManagementPoint
mayContain: mSSMSMPAddress
mayContain: mSSMSMPName
mayContain: mSSMSDefaultMP
mayContain: mSSMSSiteCode
objectClassCategory: 1
defaultSecurityDescriptor:
 D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;
 RPLCLORC;;;AU)S:(AU;SAFA;WDWOSDDTWPCRCCDCSW;;;WD)
defaultHidingValue: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# =========================================================================
# SMS Server Locator Point Class
# This section adds the SMS 2003 compatible class for SMS Server Locator Points
# This class will fail to be added if the AD schema has already been
# extended for SMS 2003.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Server-Locator-Point,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: classSchema
cn: MS-SMS-Server-Locator-Point
subClassOf: serviceConnectionPoint
governsID: 1.2.840.113556.1.6.29.2.2.3
mayContain: mSSMSMPName
mayContain: cn
mayContain: mSSMSSiteCode
objectClassCategory: 1
defaultSecurityDescriptor:
 D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;
 RPLCLORC;;;AU)S:(AU;SAFA;WDWOSDDTWPCRCCDCSW;;;WD)
defaultHidingValue: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS Roaming Boundary Range Class
# This section adds the SMS 2003 compatible class for SMS Roaming Boundaries
# This class will fail to be added if the AD schema has already been
# extended for SMS 2003.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Roaming-Boundary-Range,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: classSchema
cn: MS-SMS-Roaming-Boundary-Range
subClassOf: top
governsID: 1.2.840.113556.1.6.29.2.2.4
possSuperiors: container
mayContain: cn
mayContain: mSSMSRangedIPHigh
mayContain: mSSMSRangedIPLow
mayContain: mSSMSAssignmentSiteCode
mayContain: mSSMSSiteCode
objectClassCategory: 1
defaultSecurityDescriptor:
 D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;
 RPLCLORC;;;AU)S:(AU;SAFA;WDWOSDDTWPCRCCDCSW;;;WD)
defaultHidingValue: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# SMS Site Class
# This section adds the SMS 2003 compatible class for SMS Sites
# This class will fail to be added if the AD schema has already been
# extended for SMS 2003.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Site,CN=Schema,CN=Configuration,DC=x
changetype: add
objectClass: top
objectClass: classSchema
cn: MS-SMS-Site
subClassOf: top
governsID: 1.2.840.113556.1.6.29.2.2.2
possSuperiors: container
mayContain: serviceBindingInformation
mayContain: cn
mayContain: mSSMSRoamingBoundaries
mayContain: mSSMSSiteBoundaries
mayContain: mSSMSAssignmentSiteCode
mayContain: mSSMSSiteCode
objectClassCategory: 1
defaultSecurityDescriptor:
 D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;
 RPLCLORC;;;AU)S:(AU;SAFA;WDWOSDDTWPCRCCDCSW;;;WD)
defaultHidingValue: TRUE

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# =========================================================================
#                       SMS Schema Classes - Modifications
# =========================================================================

# ----------------------------------------------------------------------
# This section updates an existing  MS-SMS-Roaming-Boundary-Range class
# by adding one new attribute to the class.  This section
# should always succeed whether the Schema is already extended for SMS 2003
# or if it is updated using this file.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Roaming-Boundary-Range,CN=Schema,CN=Configuration,DC=x
changetype: modify
add: mayContain
mayContain: mSSMSSourceForest
-

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# This section updates an existing MS-SMS-Server-Locator-Point class
# by adding two new attributes to the class.  This section
# should always succeed whether the Schema is already extended for SMS 2003
# or if it is updated using this file.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Server-Locator-Point,CN=Schema,CN=Configuration,DC=x
changetype: modify
add: mayContain
mayContain: mSSMSSourceForest
mayContain: dNSHostName
-

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# This section updates an existing MS-SMS-Management-Point class
# by adding four new attributes to the class.  This section
# should always succeed whether the Schema is already extended for SMS 2003
# or if it is updated using this file.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Management-Point,CN=Schema,CN=Configuration,DC=x
changetype: modify
add: mayContain
mayContain: mSSMSCapabilities
mayContain: mSSMSVersion
mayContain: mSSMSSourceForest
mayContain: dNSHostName
-

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-

# ----------------------------------------------------------------------
# This section updates an existing MS-SMS-Site class
# by adding two new attributes to the class.  This section
# should always succeed whether the Schema is already extended for SMS 2003
# or if it is updated using this file.
# ----------------------------------------------------------------------

dn: CN=MS-SMS-Site,CN=Schema,CN=Configuration,DC=x
changetype: modify
add: mayContain
mayContain: mSSMSSourceForest
mayContain: mSSMSHealthState
-

dn:
changetype: modify
replace: schemaupdatenow
schemaupdatenow: 1
-


Scripted Installation Examples

When performing an unattended Configuration Manager 2007 Setup, you must create a setup initialization file (<filename.ini>) that will be used to pass installation setting instructions to Setup.exe. Depending on the type of setup you are performing (primary site, secondary site, or Configuration Manager console installation) the setup initialization file required sections and settings specified will vary.

To perform an unattended installation, run Setup.exe using the /script option. To perform the unattended installation with no user input, also use the /nouserinput command line option. For example, to perform an unattended installation with no user input, the command line would be:

<Configuration Manager setup files>\SMSSETUP\BIN\I386\Setup.exe /script <location and name of initialization file> /nouserinput

In This Section

Scripted Primary Site Installation Example

Scripted Secondary Site Installation Example

Scripted Configuration Manager Console Installation Example


Scripted Primary Site Installation Example

Topic last updated -- November 2007

The following example demonstrates installation settings used to perform an unattended primary site installation. Setting placeholders are used for setting information. For more information about settings details, see Unattended Setup Overview.

Note
Although it is not a required setting, the ManagementPoint setting is shown in this example to enable full intranet client support when Configuration Manager Setup has completed. Do not specify this setting if the site will manage clients on the Internet only.

Example

When used with the /script setup command-line option, this setup initialization file example will install a mixed mode, primary site with a default management point and the default client agents enabled:

[Identification]

Action=InstallPrimarySite

[Options]

ProductID=[Product ID (with dashes)]

PrerequisiteComp=[0 or 1 (0 for no, 1 for yes)]

PrerequisitePath=[Path to prerequisite files]

SiteCode=[Site Code]

SiteName=[Site Name]

SMSInstallDir=[Installation directory]

ManagementPoint=[Management point site server name (can be local or remote)]

SDKServer=[SMS Provider computer name]

[SQLConfigOptions]

SQLServerName=[SQL Server name]

CreateSQLDevice=[0 or 1 (0 for no, 1 for yes)]

DatabaseName=[SMS_<site code>]

Important
When using a scripted installation method, Configuration Manager Setup will fail if the client prerequisite files cannot be downloaded.

See Also

Concepts

Unattended Setup Overview


Scripted Secondary Site Installation Example

Topic last updated -- November 2007

The following example demonstrates installation settings used to perform an unattended secondary site installation. Setting placeholders are used for setting information. For more information about settings details, see Unattended Setup Overview.

Example

When used with the /script setup command-line option, this setup initialization file example will install a secondary site:

[Identification]

Action=InstallSecondarySite

[Options]

SiteCode=[Site Code]

PrerequisiteComp=[0 or 1 (0 for no, 1 for yes)]

PrerequisitePath=[Path to prerequisite files]

SiteName=[Site Name]

SMSInstallDir=[Installation directory]

AddressType=MS_LAN

ParentSiteCode=[Parent Site's Site Code]

ParentSiteServer=[Parent Site's Server Name]

Important
When using a scripted installation method, Configuration Manager Setup will fail if the client prerequisite files cannot be downloaded.

See Also

Concepts

Unattended Setup Overview


Scripted Configuration Manager Console Installation Example

The following example demonstrates installation settings used to perform an unattended Configuration Manager console installation. Setting placeholders are used for setting information. For more information about settings details, see Unattended Setup Overview.

Example

When used with the /script setup command-line option, this setup initialization file example will install a Configuration Manager console:

[Identification]

Action=InstallAdminUI

[Options]

SMSInstallDir=<Installation directory>

ParentSiteServer=<Primary Site the console will connect to>

SDKServer=<SMS Provider computer name>

See Also

Concepts

Unattended Setup Overview


Command Line Options for Running the Configuration Manager Console

When you install the Microsoft System Center Configuration Manager 2007 console, Setup automatically creates adminconsole.msc in <Configuration Manager installation directory>\AdminUI\Bin and configures the shortcut in the Start menu to run the file. You can also use MMC to create custom .msc files that include the Configuration Manager 2007 console and other MMC snap-ins. You can modify how the console is started by adding options to the command line. Example:

C:\Program Files\ConfigMgr\AdminUI\Bin\adminconsole.msc [option]

Command Line Options

The following command line options can be used when running the Configuration Manager console.

Option | Function
sms:debugview | Adds additional Actions to each node to allow you to view the standard ConfigMgr Console View or the ConfigMgr Object Properties View. The object properties view shows more detail from the database record for the object.
sms:culture=<culture> | Forces the console to run under a specific regional option, overriding the option configured in the Control Panel when displaying regional preferences like date and time format. For information about valid culture parameters, see http://go.microsoft.com/fwlink/?LinkID=93069.
sms:providerlocale=<LocaleID> | Changes the code page used by the SMS Provider. Usually used with the sms:culture option.
sms:NamespaceView=1 | Displays a class name view useful for SDK programmers.
sms:NoRestore | Starts the console at the top Systems Center Configuration Manager node instead of the last viewed node. This option usually causes the console to start much more quickly.
sms:ResetSettings | Starts the console with the views reset to the defaults, such as column width and column order.
sms:IgnoreExtensions | Starts the console without any extensions. This is useful for debugging issues with extensions.

See Also

Other Resources

Appendixes
Using the Configuration Manager Console


Custom Error Codes for Configuration Manager 2007

Topic last updated -- November 2007

This section provides custom error codes and their descriptions for the following Configuration Manager 2007 features:

Client Custom Error Codes

Desired Configuration Custom Error Codes

Inventory Custom Error Codes

Mobile Device Management Custom Error Codes

Operating System Deployment Custom Error Codes

Remote Tools Custom Error Codes

Software Distribution Custom Error Codes

Software Updates Custom Error Codes

Error Codes in Reports

Some Configuration Manager 2007 reports display error codes in reports, rather than a description of the error. Examples include the client deployment, client assignment, and client communication reports. You might also see them in reports relating to software updates.

Solution

For information about how to map these error codes to an error description, see http://go.microsoft.com/fwlink/?LinkId=103419.

Client Custom Error Codes

Error Code | Description
CCM_ERRORCODE(0x 80040200) NAMENOTFOUND 2147746304 | Name not found
CCM_ERRORCODE(0x 80040201) BADNAMEFORMAT 2147746305 | Incorrect name format
CCM_ERRORCODE(0x 80040202) SERVICESHUTDOWN 2147746306 | Service is shutting down
CCM_ERRORCODE(0x 80040203) DATAEMPTY 2147746307 | No data supplied
CCM_ERRORCODE(0x 80040204) DATATOOLARGE 2147746308 | Data too large
CCM_ERRORCODE(0x 80040205) INVALIDPATH 2147746309 | Invalid path
CCM_ERRORCODE(0x 80040206) INVALIDFILE 2147746310 | Invalid file
CCM_ERRORCODE(0x 80040207) PARSE 2147746311 | Parsing error
CCM_ERRORCODE(0x 80040208) INVALIDCOMMAND 2147746312 | Invalid command
CCM_ERRORCODE(0x 80040209) DATATYPEMISMATCH 2147746313 | Data type mismatch
CCM_ERRORCODE(0x 80040210) INVALIDTRANSLATOR 2147746320 | Invalid Translator
CCM_ERRORCODE(0x 80040211) INVALIDADDRESS 2147746321 | Invalid Address
CCM_ERRORCODE(0x 80040212) CONTEXTCLOSED 2147746322 | Context is closed
CCM_ERRORCODE(0x 80040213) TIMEOUT 2147746323 | Timeout occurred
CCM_ERRORCODE(0x 80040214) INVALIDNAMELEN 2147746324 | Invalid name length
CCM_ERRORCODE(0x 80040215) ITEMNOTFOUND 2147746325 | Item not found
CCM_ERRORCODE(0x 80040216) INVALIDSERVICEPARAM 2147746326 | Invalid service parameter. The WMI file could be corrupt or there was a manual change to a site control file.
CCM_ERRORCODE(0x 80040217) DATACORRUPT 2147746327 | Data is corrupt
CCM_ERRORCODE(0x 80040218) INVALIDSERVICESETTING 2147746328 | Invalid service settings
CCM_ERRORCODE(0x 80040219) GLOBALSERVICENOTSET 2147746329 | Global service not set
CCM_ERRORCODE(0x 80040220) INVALIDTYPE 2147746336 | Invalid type
CCM_ERRORCODE(0x 80040221) INVALIDUSER 2147746337 | Invalid user. An operation for a user that is not logged on is in process or the user account is invalid.
CCM_ERRORCODE(0x 80040222) CANCELLED 2147746338 | Operation cancelled
CCM_ERRORCODE(0x 80040223) VERSIONMISMATCH 2147746339 | Version mismatch
CCM_ERRORCODE(0x 80040224) INVALIDMESSAGE 2147746340 | Invalid message
CCM_ERRORCODE(0x 80040225) INVALIDADDRESSTYPE 2147746341 | Invalid address type
CCM_ERRORCODE(0x 80040226) INVALIDPROTOCOL 2147746342 | Invalid protocol
CCM_ERRORCODE(0x 80040227) DISABLED 2147746343 | Functionality disabled
CCM_ERRORCODE(0x 80040228) INVALIDENDPOINT 2147746344 | Invalid endpoint
CCM_ERRORCODE(0x 80040229) GETCREDENTIALS 2147746345 | Failed to get credentials
CCM_ERRORCODE(0x 80040230) LOGONUSER 2147746352 | Error logging on as given credentials
CCM_ERRORCODE(0x 80040231) TRANSIENT 2147746353 | Transient error that could indicate a network problem.
CCM_ERRORCODE(0x 80040232) MESSAGENOTSIGNED 2147746354 | Message not signed
CCM_E_MESSAGENOTTRUSTED(0X 0x80040233) 2147746355 | Message not trusted
CCM_ERRORCODE(0x 80040234) INTERNALENDPOINT 2147746356 | Internal endpoint cannot receive a remote message
CCM_ERRORCODE(0x 80040235) PARSE_SYNTAX 2147746357 | Syntax error occurred while parsing
CCM_ERRORCODE(0x 80040236) LOWMEMORY 2147746358 | Low memory.
CCM_ERRORCODE(0x 80040237) REPLYMODE_INCOMPATIBLE 2147746359 | Reply mode incompatible
CCM_ERRORCODE(0x 80040238) PUBLIC_KEY_NOT_FOUND 2147746360 | Public key not found
CCM_ERRORCODE(0x 80040239) CLIENT_ID_NOT_FOUND 2147746361 | Client ID not found
CCM_ERRORCODE(0x 80040240) INSUFFICIENTDISKSPACE 2147746368 | Insufficient disk space
CCM_ERRORCODE(0x 80040241) DATABASE_CONNECT_FAILED 2147746369 | Failed to connect to database
CCM_ERRORCODE(0x 80040242) STORED_PROCEDURE_FAILED 2147746370 | Stored procedure failed
CCM_ERRORCODE(0x 80040243) PUBLIC_KEY_MISMATCH 2147746371 | Public key mismatch
CCM_E_BAD_HTTP_STATUS_CODE (0x 8004027E) 2147746430 | Client communication from the management point failed.
CCM_E_EMPTY_CERT_STORE (0x 80040280) 2147746432 | A valid certificate was not found in the certificate store.
CCM_E_NO_CERT_MATCHING_CRITERIA (0x 80040281) 2147746433 | No valid certificate could be found using the specified certificate selection.
CCM_E_TOO_MANY_CERTS (0x 080040282) 2147746434 | More than one valid certificate was located
CCM_E_MISSING_PRIVATEKEY (0x 080040283) 2147746435 | The selected certificate does not have a corresponding private key, which is required for successful communication.
CCM_E_MISSING_SUBJECT_NAME (0x 080040284) 2147746436 | The selected certificate does not have a Subject Name defined.
CCM_E_UNKNOWN_SEARCH_CRITERIA (0x 080040285) 2147746436 | The certificate selection criteria syntax is invalid.
CCM_E_INVALID_SMS_AUTHORITY (0x 080040286) 2147746437 | The certificate does not successfully chain to a trusted root certification authority.
CCM_E_MISSING_SITE_SIGNING_CERT (0x 080040287) 2147746438 | Cannot locate the required Configuration Manager site server signing certificate for this site.
HandleRemoteSyncSend failed (0x80040309). 2147746569 | The 'trust failed'. This happens when the client doesn't trust data from the management point.
CForwarder_Sync::Send failed (0x80040309). 2147746569 | The 'trust failed'. This happens when the client doesn't trust data from the management point.
CForwarder_Base::Send failed (0x80040309). 2147746569 | The 'trust failed' This happens when the client doesn't trust data from the management point.
CCM_E_LOCATION_MPREFRESH CCM_ERRORCODE(0x80040300) 2147746560 | Client trying to refresh management point and it is empty.
CCM_E_LOCATION_NOAD CCM_ERRORCODE(0x80040301) 2147746561 | Client is configured to only read Active Directory Domain Services and couldn’t find the requested location (site assignment, management point) data.
CCM_E_LOCATION_NOTASSIGNED CCM_ERRORCODE(0x80040302) 2147746562 | Client is trying to do something that requires being assigned to a site and it is not assigned. Only called from NAP when trying to refresh the management point.
CCM_E_LOCATION_INTERNALERROR CCM_ERRORCODE(0x80040303) 2147746563 | Internal error
CCM_E_LOCATION_BADSERVERCERT CCM_ERRORCODE(0x80040304) 2147746564 | Management point certification is corrupt from client’s perspective, which could be due to network corruption or an attacker.
CCM_E_LOCATION_BADCLIENTCERT CCM_ERRORCODE(0x80040305) 2147746565 | Client certification is corrupt from site system's perspective, which could be due to network corruption or an attacker.
CCM_E_LOCATION_MPUNREACHABLE CCM_ERRORCODE(0x80040306) 2147746566 | Client failed to connect to management point to make a location services request (MPLIST or MPKEYINFORMATION).
CCM_E_LOCATION_PROXYMPREFRESH CCM_ERRORCODE(0x80040307) 2147746567 | Client is trying to refresh proxy management point and it’s empty. May only be called from NAP when trying to refresh the proxy management point.
CCM_E_LOCATION_LOCALMPREFRESH CCM_ERRORCODE(0x80040308) 2147746568 | Client is trying to refresh local management point and it’s empty. Only called from NAP when trying to refresh proxy management point.
CCM_E_LOCATION_MESSAGEFAILED CCM_ERRORCODE(0x80040309) 2147746569 | In most cases this indicates that the in band server authorization failed on a client, usually because the trusted root key does not match the management point certificate.

Desired Configuration Management Custom Error Codes

Error Code | Description
0x80040752 E_DCM_DOTNETMISSING | Microsoft .NET Framework 2.0 or later not installed
0x80040756 E_DCM_SDM_REPORTING_FAILED 2147747670 | Client failed to report state or status.
0x80040763 E_DCM_CI_INTERNAL_FAILURE 2147747683 | WMI corruption or heap corruption
0x80040764 E_DCM_SDM_INTERNAL_FAILURE | WMI corruption, memory corruption, disk corruption
0x80040765 E_DCM_SDM_CLRHOST_LAUNCH_FAILURE | Problem with client installation or.NET Framework 2.0 installation

Inventory Custom Error Codes

Error Code | Description
0x80040900 | A valid WMI instance inventoried could not be added to the report. The __Path property may be undefined.

Mobile Device Management Custom Error Codes

Error Code | Description
-2147220846 FFFFFFFF80040292 | Unable to compute message signature for in-band authentication.
-2147220843 FFFFFFFF80040295 | Unable to find a valid client authentication certificate for registration.
11520 | Mobile device client deployment action failed. Failed to establish ActiveSync or Mobile Device Center connection to the mobile device.
11521 | Mobile device client deployment action failed. Invalid client settings file.
11522 | Mobile device client deployment action failed. Error determining running directory for DmClientXfer.exe
11523 | Mobile device client deployment action failed. Required ActiveSync libraries missing.
11524 | Mobile device client deployment action failed. Could not determine processor type of attached mobile device.
11525 | Mobile device client deployment action failed. Could not determine base operating system version of attached mobile device.
11526 | Mobile device client deployment action failed. Error determining client version for the attached mobile device.
11527 | Mobile device client deployment action failed. Error creating client settings .ini file.
11528 | Mobile device client deployment action failed. Failed to copy files to the attached mobile device.
11529 | Mobile device client deployment action failed. Failed executing the mobile device client installer program on attached mobile device.
11530 | Mobile device client deployment action may have failed. Failed reading status information from the mobile device.
11540 | Mobile device client deployment action failed. Error determining running directory for the mobile device client installer program.
11541 | Mobile device client deployment action failed. Error executing the pre-install command line.
11542 | Mobile device client deployment action failed. Error executing the post-install command line.
11550 | Mobile device client installation or upgrade failed. Error during removal of the previous client.
11551 | Mobile device client installation or upgrade failed. Invalid client settings file.
11552 | Mobile device client installation or upgrade failed. Error installing client CAB file.
11553 | Mobile device client installation or upgrade failed. Error starting client service.
11554 | Mobile device client installation or upgrade failed. Error updating client settings.
11555 | Device Client Deployment failed with unknown error.
11560 | Mobile device client verification or repair failed. Error during removal of previous client.
11561 | Mobile device client verification or repair failed. Invalid client settings file.
11562 | Mobile device client verification or repair failed. Error installing client CAB file.
11563 | Mobile device client verification or repair failed. Error starting client service.
11564 | Mobile device client verification or repair failed. Error updating client settings.
11565 | Mobile device client verification or repair failed. Error restoring required files.
11566 | Mobile device client privileged certificate installation failed.
11567 | Encountered unknown error installing the device client.
11568 | Mobile device client setup failed to launch during install.
11570 | Mobile device client removal failed. Error using unload.exe to uninstall the existing client.
11571 | Mobile device client install/upgrade failed. Error enforcing new client. Mobile device rolled back to old client (if existed before).
11572 | Mobile device client rollback failed during unsuccessful upgrade. Error enforcing old client.
11573 | Mobile device client failed to perform post cab install actions. Device client installation failed.

Operating System Deployment Custom Error Codes

Error Code | Description
0x80040001 | Could not get the client GUID
0x80040101 | Network access account is not set
0x80040102 | No content location returned for the given package
0x80040103 | Could not access package content in the DP
0x80040104 | Could not find reference program policy
0x80040105 | Could not find CCM_ClientAgentConfig raw policy
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | An invalid image capture path has been specified.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | An invalid image file name extension has been specified.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | An invalid image file name extension has been specified.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | Image capture path is too long
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | An invalid image file name extension has been specified.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | Timeout waiting for PNP to finish initialization.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Task sequence failed in Windows PE
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | An invalid network adapter index has been specified
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | Sysprep is not installed
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Sysprep is invalid
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | Invalid System Partition
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | Machine is joined to a domain
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | Machine is domain controller
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | A default management point has not been assigned for this site.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Certificates for the default management point are not available.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | Package {0} is not available on the specified distribution points.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | Invalid password for media certificate
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | The media certificate does not have an associated private key
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,6) | The certification authority’s certificate has not been set for this site.

Remote Tools Custom Error Codes

Error Code | Description
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,1) | Another remote control session is already in progress. Remote Control does not support multiple concurrent remote control sessions.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,2) | Level of access allowed is set to “No Access” in the Remote Tools client agent General tab on the site server or in the Remote Control control panel applet.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,3) | Remote Control Agent was not properly installed on the client.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,4) | No interactive session found on the client.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,5) | Remote computer screen is locked.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,6) | Failed to create the RDP session.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,8) | Remote Tools is disabled.
MAKE_HRESULT(SEVERITY_ERROR,FACILITY_ITF,9) | Failed to launch the Remote Control Agent process.

Software Distribution Custom Error Codes

Error Code Description

E_FAIL_EXECUTION_PENDING 0x80008001

The program cannot be run now from the client UI because :

A restart is in progress.

or

Software Distribution is paused because of a task sequence running

or

Another program is currently running

NOTE: This error code is only returned to the UI and is not present in status messages.

E_FAIL_DUPLICATE_REQUEST 0x80008002

The program cannot be run again from the client UI because it is already pending, an optional (initiated from the UI) run request already exists for it.

NOTE: This error code is only returned to the UI and is not present in status messages.

E_SWDIST_POLICY_NOT_FOUND 0x80002004

The software distribution policy was not found.

E_FAIL_PROGRAM_DISABLED 0x80008004

The program cannot run because it is currently disabled.

E_FAIL_INVALID_POLICY 0x80008005

This error code can be returned on the client if policy cannot be found or the policy is not valid to run or cancel the requested program.

NOTE: This error code is currently not sent in status messages.

E_FAIL_INVALID_PROGRAM 0x80008006

The requested program is not currently pending.

This error code can be returned on the client if the user attempts to continue or cancel the program that is not currently pending. It can also be returned to the task sequence manager (TSM) when TSM requests download locations for packages that are not referenced by the currently running task sequence.

NOTE: This error code is not raised in status messages by Software distribution, but could be raised by task sequence.

E_FAIL_SET_CACHEDCONTENTINUSE 0x80008008

Unable to set the CachedContentInUse flag. Failed to indicate the client cache is currently in use.

E_FAIL_WMI_ERROR 0x80008009

Failed to read data from WMI. The program could not continue because a system restart is in progress or there is already a run request for this program that requires a reboot.

E_FAIL_REQUEST_NOT_FOUND 0x80008011

Used for Task Sequence. Failed to reconnect to Task Sequence job because a request cannot be found with the given job ID.

NOTE: Not sent in status message by Software Distribution, but may be used by task sequence.

E_FAIL_ACTIVE_REQUEST_NOT_FOUND 0x80008012

There is no program currently running.

This error code is returned to task sequence when there is no run request that is currently running, but task sequence tries to get the currently running request.

E_FAIL_DEPENDENCY_NOT_RUN 0x80008013

This program cannot run because it depends on another program that has not run successfully before. This error code is returned to task sequence manager when a task sequence Install Software Action step cannot be run because the step has a child program which has not been run before.

E_FAIL_USER_REQUIRED
0x80008014

This error code is returned to task sequence manager when an “Install Software” step cannot be run because the software distribution program in this step is targeted to a user, requires user input or is set to run in user context

E_FAIL_SWD_NOT_PAUSED
0x80008015

Failed to notify caller that software distribution is paused because the paused state or paused cookie do not match.

E_FAIL_INVALID_HASH
0x80008017

The content hash string or hash versions are empty or incorrect in the software distribution policy or the hash verification failed.

E_FAIL_CANNOT_RUN_ON_INTERNET 0x80008018

The program cannot run at this time because the client is on the internet.

E_FAIL_EXECUTION_NONFATAL 0x80008100

A non fatal error has been encountered while attempting to run the program. The program execution will be retried if the retry count has not been exceeded.

E_FAIL_BAD_ENVIRONMENT_NONFATAL 0x80008103

A non fatal error occurred while preparing to run the program, for example when creating the program execution environment, making a network connection, impersonating the user, determining the file association information, or when attempting to launch the program. This program execution will be retried if the retry count has not been exceeded.

E_FAIL_PROGRAM_NOT_MONITORED 0x80008105

An error was encountered while getting the process information for the launched program and the program execution will not be monitored.

E_FAIL_BAD_ENVIRONMENT_FATAL 0x8000910A

A fatal error occurred while preparing to run the program, for example when creating the program execution environment, making a network connection, impersonating the user, determining the file association information, or when attempting to launch the program. This program execution will not be retried.

E_FAIL_EXECUTION_FATAL
0x80009101

A fatal error has been encountered while attempting to run the program. The program execution will not be retried.

E_FAIL_INVALID_PROGRAM_OBJECT 0x80009102

An error occurred while creating the execution context.

This is error code indicates that an error was encountered while creating the internal execution context object. This is most likely not due to configuration errors, but could be because of low memory conditions, COM failures or other external errors.

E_FAIL_INVALID_CMDLINE 0x80009104

The command line for this program is invalid.

E_FAIL_NO_CONTENT 0x80009106

Failed to verify the executable file is valid or to construct the associated command line.

E_FAIL_NO_SOURCE 0x80008107

Failed to access all the provided program locations. This program may retry if the maximum retry count has not been reached.

E_INVALID_CONTENT_REQUEST_HANDLE 0x80008200

This is an internal error. No content request found with the given handle.

E_NO_SPACE_IN_CACHE 0x80008201

The content download cannot be performed because there is not enough available space in cache or the disk is full.

E_CACHE_TOO_SMALL 0x80008202

The content download cannot be performed because the total size of the client cache is smaller than the size of the requested content.

E_CACHE_IN_USE 0x80008203

The client cache is currently in use by a running program or by a download in progress.

E_NO_DP_FOUND 0x80008204

NOTE: this error code is sent at least in status message 10051.

No distribution points were found for the requested content.

E_FAIL_LOCATION_REQUEST 0x80008210

Failed to get content locations.

E_FAIL_JOB_PENDING 0x80008250

The computer restart cannot be initiated because a software installation job is in progress.

E_FAIL_INACCESSIBLE_SOURCE 0x80009108

Failed to access all the provided program locations. This program will not retry.

E_FAIL_INVALID_MSI 0x80009109

Failed to verify that the given file is a valid installation package.

Software Updates Custom Error Codes

Error Code | Description
E_UPDDEPLOY_APPLY_NOT_REQUIRED CCM_ERRORCODE(0x80040708) 2147747592 | Software Updates Install not required.
E_MONITOR_RESUME_FAILURE CCM_ERRORCODE(0x80040709) 2147747593 | Failed to resume the monitoring of the process.
E_INVALID_CMDLINE CCM_ERRORCODE(0x8004070A) 2147747594 | Invalid command line
E_CREATEPROCESS_FAILURE CCM_ERRORCODE(0x8004070B) 2147747595 | Failed to create process
E_EXECUTION_TIMEOUT CCM_ERRORCODE(0x8004070C) 2147747596 | Software update execution timeout
E_UPDATE_FAILED_RESULT CCM_ERRORCODE(0x8004070D) 2147747597 | Software update failed when attempted
E_EMPTY_COMMANDLINE CCM_ERRORCODE(0x8004070E) 2147747598 | Empty command line specified
E_INVALID_INSTALLER_PATH CCM_ERRORCODE(0x8004070F) 2147747599 | Invalid updates installer path
E_COMPARE_CREATION_TIMES CCM_ERRORCODE(0x80040710) 2147747600 | Failed to compare process creation time.
E_DEPLOYMENT_NOT_ACTIVE CCM_ERRORCODE(0x80040711) 2147747601 | Software updates deployment not active yet for example, start time is in future
E_UPDDEPLOY_REBOOT_REQUIRED CCM_ERRORCODE(0x80040712) 2147747602 | A system restart is required to complete the installation.
E_NO_DETECT_RESULT CCM_ERRORCODE(0x80040713) 2147747603 | Software updates detection results not received yet.
E_UPDATES_USERINSTALL_RESTART_PENDING CCM_ERRORCODE(0x80040714) 2147747604 | User based install not allowed as system restart is pending.
E_USERINSTALL_NO_UPDATES CCM_ERRORCODE(0x80040715) 2147747605 | No applicable updates specified in user install request.
E_NOINTERFACE FFFFFFFF80004002 -2147467262 | No such interface supported
[DCOM belly up] CAgent::CreateJob failed FFFFFFFF8007000E -2147024882 | Not enough storage is available to complete this operation.
ERROR_TIMEOUT FFFFFFFF800705B4 -2147023436 | This operation returned because the timeout period expired.
[Scan fails on x64vista] OnSearchComplete 0x80240032[WU] -2145124302 | Failed to end search job [SMS] WU client failed Searching for update with error.
WU_E_PT_WINHTTP_NAME_NOT_RESOLVED Same as - ERROR_WINHTTP_NAME_NOT_RESOLVED FFFFFFFF8024402C -2145107924 | The proxy server or target server name cannot be resolved.
FFFFFFFF80040692 -2147219822 | Group Policy conflict
FFFFFFFF80040693 -2147219821 | Low WUA version
WU_E_PT_HTTP_STATUS_BAD_GATEWAY FF80244021 -2145107935 | Same as HTTP status 502. The server, while acting as a gateway or proxy, received an invalid response from the upstream server it accessed in attempting to fulfill the request.
-939523070 ERROR_OBJECT_ALREADY_EXISTS FFFFFFFFC8000402 | Object already exists
[SA fail if SWD not working] createInstance failed for UpdateServiceManager FFFFFFFF80040154 -2147221164 | Class not registered
FFFFFFFF800705B4 -2147023436 | This operation returned because the timeout period expired.
ERROR_INTERNET_TIMEOUT FFFFFFFF80072EE2 -2147012894 | Internet timeout
ERROR_WINHTTP_CANNOT_CONNECT or ERROR_INTERNET_CANNOT_CONNECT FFFFFFFF80072EFD -2147012867 | Internet cannot connect
E_INVALIDSTATE_AFTER_APPLY FFFFFFFF80040668 -2147219864 | Software update still detected as actionable after apply.
E_EXECUTION_TIMEOUT FFFFFFFF8004070C -2147219700 | Software update execution timeout
WU_E_PT_WINHTTP_NAME_NOT_RESOLVED - same as ERROR_WINHTTP_NAME_NOT_RESOLVED FFFFFFFF8024402C -2145107924 | The proxy server or target server name cannot be resolved.
ERROR_PATH_NOT_FOUND FFFFFFFF80070003 -2147024893 | The system cannot find the path specified.
ERROR_FILE_EXISTS FFFFFFFF80070050 -2147024816 | The file exists
ERROR_ACCESS_DENIED or E_ACCESS_DENIED FFFFFFFF80070005 -2147024891 | Access denied
WU_E_PT_WINHTTP_NAME_NOT_RESOLVED Same as ERROR_WINHTTP_NAME_NOT_RESOLVED FFFFFFFF8024402C -2145107924 | The proxy server or target server name cannot be resolved.
ERROR_INAVILD_ENVIROMENT FFFFFFFF8004070D -2147219699 | Software update failed when attempted.
Install Errors |
-Last Install Error FF8024402C WU_E_PT_WINHTTP_NAME_NOT_RESOLVED - same as ERROR_WINHTTP_NAME_NOT_RESOLVED 2145107924 | The proxy server or target server name cannot be resolved.
Last Install Error FF8007066F ERROR_PATCH_NOT_APPLIED -2147023249 | Can sometimes happen when Windows Installer configuration for an installed application is out of sequence for example, Windows Installer thinks it has more patches applied than is really the case (this sometimes used to happen with roaming profiles).
Last Install Error FF8007064 ERROR_INSTALL_FAILURE -2147023293 | Generic failure code from Windows Installer installs.
Last Install Error FF8007F0F4 STATUS_PREREQUISITE_FAILED -2146963212 | Generated by update.exe. People seem to be getting this when they try to install a Service Pack while on battery power.
Last Install Error FF8007F0F5 WU_E_DM_INCORRECTFILEHASH -2146963211 | The WU Agent's metadata store and the policy received by ccmexec could be out of sync.
Last Install Error FF8007F0F6 ERROR INVALID PARAMETER -2146963212 | Failed to start the installation of updates because update is not found
Scan Failures |
Last Scan Error FF80244021 WU_E_PT_HTTP_STATUS_BAD_GATEWAY -2145107935 | Possible network connectivity issues
Last Scan Error FF8024001D WU_E_INVALID_UPDATE -2145124323 | An update contains invalid metadata.
Last Scan Error FF80004002 E_NOINTERFACE -2147467262 | No such interface supported
Last Scan Error FFC8000402 RECORD TOO BIG -939523070 | This seems to be a recoverable error, and possibly due to many Scan Service Packages left around when the 2003 ITMU was used. This is NOT the case.
FF8024400A WU_E_PT_SOAPCLIENT_PARSE 1097366519818 | Needs update
Last Scan Error WU_E_SERVICE_STOP FF8024001E -2145124322 | Operation did not complete because the service or system was being shut down.
Last Scan Error FF8024400D WU_E_PT_SOAP_CLIENT -2145107955 | SOAP client found the message was malformed.
Last Scan Error FFC800042D RefreshServerUpdateInfo -939523027 | WSUS unable to update software distribution folder. Scans fail.
Last Scan Error FF80244022 WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL -2145107934 | HTTP status 503. The service is temporarily overloaded.
Last Scan Error FF80240032 WU_E_INVALID_CRITERIA -2145124302 | The search criteria string was invalid.
Last Scan Error FF80240013 WU_E_DUPLICATE_ITEM -2145124333 | Failed to add file to the FileLocationList.
Last Scan Error FF8007041D ERROR SERVICE REQUEST TIMEOUT -2147023843 | The service did not respond to the start or control request in a timely fashion.
E_FAIL_POLICY_NOT_FOUND CCM_ERRORCODE(0x80040600) 2147747328 | Scan Tool Policy not found
E_LOCATION_TIMEOUT CCM_ERRORCODE(0x80040602) 2147747330 | Out of cache space
E_SCANTOOL_POLICY_REMOVED CCM_ERRORCODE(0x80040603) 2147747331 | The ScanTool Policy has been removed so cannot complete Scan Operation.
E_SCANTOOL_NOTFOUND_INJOBQUEUE CCM_ERRORCODE(0x80040604) 2147747332 | The ScanTool was not found in the job queue.
E_FAIL_SCAN_TOOL_REMOVED CCM_ERRORCODE(0x80040605) 2147747333 | Scan Tool has been Removed
E_FAIL_OFFLINE_SCAN_HISTORY_NOT_FOUND CCM_ERRORCODE(0x80040606) 2147747334 | Scan Tool Policy not found
E_CONTENT_NOT_FOUND CCM_ERRORCODE(0x80040607) 2147747335 | Out of cache space
E_INVALID_INSTANCE_TYPE CCM_ERRORCODE(0x80040608) 2147747336 | Out of cache space
E_NO_SPACE_IN_CACHE 0x80008201 2147516929 | Out of cache space
E_CACHE_TOO_SMALL 0x80008202 2147516930 | Cache size is smaller than requested content's size.
Deployments Agent Specific Errors |
E_UPDDEPLOY_APPLY_NOT_ALLOWED CCM_ERRORCODE(0x80040700) 2147747584 | Install not allowed
E_UPDDEPLOY_DOWNLOAD_NOT_ALLOWED CCM_ERRORCODE(0x80040701) 2147747585 | Download not allowed
E_ASSIGNMENT_POLICY_NOT_FOUND CCM_ERRORCODE(0x80040702) 2147747586 | Assignment policy not available
E_ANOTHER_JOB_IN_PROGRESS CCM_ERRORCODE(0x80040703) 2147747587 | Only one job is allowed at a time
E_HARDREBOOT_PENDING CCM_ERRORCODE(0x80040704) 2147747588 | Only one job is allowed at a time.
2147747589 E_PAUSE_STATE_REQUIRED CCM_ERRORCODE(0x80040705) | Pause state required
2147747590 E_NO_ACTIVE_JOB CCM_ERRORCODE(0x80040706) | No active job exists (while reconnect called).
2147747591 E_JOB_ID_MISMATCH CCM_ERRORCODE(0x80040707) | Job Id mismatch (while reconnect called).

See Also

Concepts

Troubleshooting Desired Configuration Management Using Custom Error Codes
Troubleshooting Inventory Using Custom Error Codes
Troubleshooting Mobile Device Management Using Custom Error Codes
Troubleshooting Operating System Deployment Using Custom Error Codes
Troubleshooting Remote Tools Using Custom Error Codes
Troubleshooting Software Distribution Using Custom Error Codes

Other Resources

Troubleshooting Configuration Manager 2007
Troubleshooting Software Updates


Configuration Manager 2007 Accessibility Features

Microsoft is committed to making its products and services easier for everyone to use. The topics in this section provide information about the features, products, and services that make Configuration Manager 2007 more accessible.

For accessibility information in languages other than English, see the Microsoft International Microsoft Accessibility Web Sites (http://go.microsoft.com/fwlink/?linkid=9421).

Keyboard and Mouse Shortcuts for Configuration Manager 2007

Accessibility in Microsoft Windows

Adjusting Microsoft Products for People with Accessibility Needs

Assistive Technology Products for Windows

Microsoft Documentation in Alternative Formats

Customer Service for People Who Are Deaf or Hard-of-Hearing

Getting More Accessibility Information

See Also

Other Resources

Appendixes


Keyboard and Mouse Shortcuts for Configuration Manager 2007

The following sections describe keyboard and mouse shortcuts in both Configuration Manager 2007 and the Microsoft Management Console (MMC).

Configuration Manager Console Keyboard Shortcuts

The following table shows the keyboard shortcuts for the Configuration Manager console.

Action | Result
Application key | The Application key on your keyboard displays action menus in property pages.
F3 | Displays or hides the search panel in the results pane, which contains the Look for, in, and Find Now and Clear buttons.
CTRL+SHIFT +ARROW key or ALT+V or ALT+U | In the Sender Address Properties: Schedule Tab, press CTRL+SHIFT and press the LEFT or RIGHT ARROW keys to select blocks of time, and then press the TAB key to move to the control to set Availability. You can also press ALT+V to set the Availability drop-down menu, or press ALT+U to select the check box control for Unavailable to substitute for inoperative addresses.
CTRL+SHIFT +ARROW key or ALT+M | In the Sender Address Properties: Rate Limits Tab, press CTRL+SHIFT and press the LEFT or RIGHT ARROW keys to select blocks of time, and then press the TAB key to move to the control for Time period. Press ALT+M, and then press the UP or DOWN ARROW keys to select the control Limit (% of connection bandwidth).

Configuration Manager 2007 Help Keyboard Shortcuts

The following table lists access keys for the Configuration Manager 2007 Help Viewer.

Action | Result
ALT+O | Displays or hides the Options menu.
ALT+O+T | Displays or hides the Navigation pane.
ALT+O+B | Goes to the previous topic.
ALT+O+F | Goes to the next topic.
ALT+O+P | Displays the Print Topics dialog box.

MMC Navigation Keyboard Shortcuts

Working with the Microsoft Management Console (MMC) tree is very similar to working with folders in Windows Explorer. You navigate from item to item, expanding and collapsing branches as needed by using the + and - keys on the keyboard or by clicking and double-clicking. The following table lists the actions you can use to navigate in and between console windows.

Action | Result
TAB or F6 | Moves forward between panes in the active console window.
SHIFT+TAB or SHIFT+F6 | Moves backward between panes.
NUM + | Expands the selected item.
NUM - | Collapses the selected item.
NUM * | Expands the entire console tree below the root item in the active console window.
UP ARROW | Moves the focus up one item in a pane.
DOWN ARROW | Moves the focus down one item in a pane.
PAGE UP | Moves the focus to the top item visible in a pane.
PAGE DOWN | Moves the focus to the bottom item visible in a pane.
HOME | Moves the focus to the root of the console tree.
END | Moves the focus to the last item in the console tree.
RIGHT ARROW | Expands the selected item.
LEFT ARROW | Collapses the selected item. If the selected item does not contain exposed items, LEFT ARROW moves the focus to the top of the current branch of the console tree.

MMC Navigation Mouse Shortcuts

The following table lists the mouse actions that you can use to navigate the Microsoft Management Console (MMC) tree.

Action | Results
Click | Selects an item.
Double-click | Displays or hides items contained by the selected item. Displays properties for or opens an item.
Right-click | Displays the Action shortcut menu for the selected item.

MMC Main Window Keyboard Shortcuts

The following table lists keyboard shortcuts for the commands that you can use to perform tasks for a Microsoft Management Console (MMC) or for the main window of a console.

Action | Result
CTRL+O | Opens a saved console.
CTRL+N | Opens a new console.
CTRL+S | Saves the open console.
CTRL+M | Adds or removes a snap-in.
CTRL+W | Opens a new window.
F5 | Refreshes the selected node.
ALT+SPACEBAR | Displays the MMC menu.
ALT+F4 | Closes the active console.

MMC Console Window Keyboard Shortcuts

The following table lists keyboard shortcuts for the commands that you can use in the active console window of a Microsoft Management Console (MMC) or on the contents of a console window.

Action | Result
CTRL+P | Prints the current page or active pane.
ALT+- | Displays the window menu for the active console window.
SHIFT+F10 or ALT+A | Displays the Action shortcut menu for the selected item.
ALT+V | Displays the View menu for the active console window.
F1 | Opens the Help topic (if any) for the selected item.
F5 | Refreshes the content of all console windows.
CTRL+F10 | Maximizes the active console window.
CTRL+F5 | Restores the active console window.
ENTER | Opens or displays the Properties dialog box for the selected item.

See Also

Concepts

Accessibility in Microsoft Windows
Configuration Manager 2007 Accessibility Features


Accessibility in Microsoft Windows

When Windows platforms are Configuration Manager 2007 clients, the Windows accessibility features help users with disabilities. These features are useful for individuals who have difficulty typing or using a mouse, are blind or have low vision, or are deaf or hard-of-hearing. The accessibility features can be installed during setup.

For more information about the accessibility features in current Windows operating systems, click the associated links in the following table.

Windows Operating System | Reference
Windows Vista | http://go.microsoft.com/fwlink/?LinkId=95655
Windows Server 2003 | http://go.microsoft.com/fwlink/?LinkId=95654
Windows XP | http://go.microsoft.com/fwlink/?LinkId=95653
Windows 2000 | http://go.microsoft.com/fwlink/?LinkId=95652

See Also

Concepts

Configuration Manager 2007 Accessibility Features


Adjusting Microsoft Products for People with Accessibility Needs

Accessibility options and features are built into many Microsoft products and are useful for individuals who have difficulty typing or using a mouse, are blind or have low vision, or are deaf or hard-of-hearing.

Step-by-Step Tutorials

Microsoft offers a series of step-by-step accessibility tutorials to show you how to use the mouse or keyboard to navigate, select options, and change settings to adjust the accessibility options and settings on your computer. This information is presented in a side-by-side format so that you can see at a glance how to use the mouse, the keyboard, or a combination of both.

See the Accessibility Tutorials for Microsoft Products (http://go.microsoft.com/fwlink/?LinkId=95700) to find step-by-step tutorials that include the following:

  • Windows Vista
  • Windows XP
  • Windows 2000
  • Microsoft Internet Explorer 7
  • Microsoft Internet Explorer 6
  • Microsoft Internet Explorer 5

See Also

Concepts

Configuration Manager 2007 Accessibility Features


Assistive Technology Products for Windows

A variety of assistive technology products are available to make computers easier to use for people with disabilities.

Microsoft provides a searchable catalog of assistive technology products that run on Microsoft Windows operating systems. For more information, see the Assistive Technology Products Web site (http://go.microsoft.com/fwlink/?LinkId=9216).

Products available for the Windows operating systems include the following:

  • Programs that enlarge or alter the color of information on the screen.
  • Programs that describe information on the screen in Braille or that provide synthesized speech.
  • Hardware and software utilities that modify the functions of the mouse and keyboard.
  • Programs that enable people to type by using a mouse or their voice.
  • Word or phrase prediction software that allows people to type more quickly and with fewer keystrokes.
  • Alternative input devices, such as single switch or puff and sip devices, for people who cannot use a mouse or a keyboard.

Upgrading

If you use an assistive technology product, contact your assistive technology vendor to check compatibility with products on your computer before upgrading to Configuration Manager 2007. Your assistive technology vendor can also help you learn how to adjust your settings to optimize compatibility with your Microsoft products.

See Also

Concepts

Configuration Manager 2007 Accessibility Features


Microsoft Documentation in Alternative Formats

The Configuration Manager Documentation Library provides comprehensive information about Configuration Manager 2007, providing introductory topics, such as overviews of features and concepts, as well as in-depth technical discussions and technical reference information.

You can access the Library in the following ways:

  • If you have purchased Configuration Manager 2007 but not yet installed it, you can locate the file SMSv4.chm under the product DVD in SMSSETUP\HELP. You can also copy the SMSv4.chm file to your local hard drive and open it without installing the Configuration Manager 2007 console.
  • If you have installed Configuration Manager 2007, you can access the Library in the Configuration Manager 2007 console by pressing F1, clicking Help buttons, clicking Help on the Action menus, or clicking hyperlinks. After Configuration Manager 2007 is installed, the file SMSv4.chm is installed in %windir%\Help.
  • The entire Configuration Manager Documentation Library is available on the Web from the Microsoft System Center Configuration Manager TechCenter (http://go.microsoft.com/fwlink/?LinkID=74317).

Additional Accessibility Documentation for Microsoft Products

You can obtain accessibility documentation for Microsoft products from the Microsoft Accessibility Web site at http://go.microsoft.com/fwlink/?LinkId=95701.

You can obtain additional Microsoft publications from Recording for the Blind & Dyslexic, Inc. These documents are distributed to registered, eligible members of the distribution service on audiocassettes or floppy disks. The collection contains more than 80,000 titles, including Microsoft product documentation and books from Microsoft Press. For information about eligibility and availability of Microsoft product documentation and books from Microsoft Press, contact:

Recording for the Blind & Dyslexic, Inc.

20 Roszel Road

Princeton, NJ 08540

Phone from within the United States: (800) 221-4792

Phone from outside the United States and Canada: (609) 452-0606

Fax: (609) 987-8116

Web: Recording for the Blind & Dyslexic (http://go.microsoft.com/fwlink/?LinkId=96686).

See Also

Concepts

Configuration Manager 2007 Accessibility Features


Customer Service for People Who Are Deaf or Hard-of-Hearing

If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service.

You can contact the Microsoft Sales Information Center on a text telephone by dialing (800) 892-5234 between 6:30 A.M. and 5:30 P.M. Pacific Time, Monday through Friday, excluding holidays.

For technical assistance in the United States, you can contact Microsoft Product Support Services on a text telephone at (800) 892-5234 between 6:00 A.M. and 6:00 P.M. Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 A.M. and 8:00 P.M. Eastern Standard Time, Monday through Friday, excluding holidays. Microsoft support services are subject to the prices, terms, and conditions in place at the time the service is used.

See Also

Concepts

Configuration Manager 2007 Accessibility Features


Getting More Accessibility Information

The Microsoft Accessibility Web site (http://go.microsoft.com/fwlink/?LinkId=9212) provides information about assistive technology. The information in this site benefits people with disabilities and their friends and family members, people in outreach organizations, educators, and advocates.

A free monthly electronic newsletter is available to help you keep up to date with accessibility topics about Microsoft products. To subscribe, see http://go.microsoft.com/fwlink/?LinkId=95702.

See Also

Concepts

Configuration Manager 2007 Accessibility Features


Inbox Folders in Configuration Manager 2007

Topic last updated—November 2007

You can monitor inbox folders on a Microsoft System Center Configuration Manager 2007 site to help troubleshoot problems with different components. This article lists some of the Configuration Manager 2007 inbox folders.

You should periodically examine the Configuration Manager 2007 inbox folders for a backlog of files that wait to be processed. The inbox folders temporarily store files before they are processed to the site database or transferred to another site or site component. A backlog of files can indicate that a component is not running or is experiencing a problem. For example, when the Microsoft SQL Server database runs out of space, a backlog of files occurs until the files are processed to the site database.

Inbox Folders

\Auth

This folder and its subfolders are used by Configuration Manager 2007 sites, management points, and clients. Configuration Manager 2007 uses these folders to temporarily store hardware, software, and discovery data records (.ddr files).

\Auth\dataldr.box

This folder stores .mif files that represent hardware inventory data for Configuration Manager 2007 client computers. This folder also stores IDMIF files for custom architectures. A backlog of files can indicate problems accessing the site database. Examine the status messages for the Inventory Data Loader for possible problems. You can also examine the Dataldr.log file for errors or additional information.

\Auth\dataldr.box\process

This folder stores .mif files that are in process. A backlog of files can indicate problems accessing the site database. Examine the status messages for the Inventory Data Loader for possible problems. You can also examine the Dataldr.log file for errors or additional information.

\Auth\ddm.box

This folder temporarily stores .ddr files after a client or server agent generates a discovery record. Examine the status messages for the Discovery Data Manager (DDM) for possible problems. You can also examine the Ddm.log file for errors or additional information.

\Auth\ddm.box\BAD_DDRS

This folder stores .ddr files that are corrupted. A backlog of files can indicate a network corruption problem or a problem with the DDM. Configuration Manager 2007 automatically deletes .ddr files that are older than 25 hours. Examine the status messages for the Discover Data Manager component for possible problems. You can also examine the Ddm.log file for errors or additional information.

\Auth\sinv.box

This folder stores client software inventory files (.sic and .sid files) that are copied from the management point. A backlog of files can indicate that the Software Inventory Processor cannot connect to the site database or that too many files were received. Examine the status messages for the Software Inventory Processor for possible problems. You can also examine the Sinvproc.log file for errors or additional information.

\Auth\sinv.box\Orphans

This folder stores hardware and software inventory that cannot be processed. Inventory files that are moved to this folder are retried later. A backlog of files can indicate problems with specific clients, with management points, or with the network that could cause data corruption. Examine status messages for the Software Inventory Processor for possible problems. You can also examine the Sinvproc.log file for errors or additional information.

\Auth\statesys.box

This folder stores information related to state messages. For more information about state message backlogs, see Troubleshooting State Message Backlogs.

\Compsumm.box

This folder contains component status summary messages from child sites. A backlog of files can indicate that the Component Status Summarizer cannot process the volume of messages. Examine status messages for the Component Status Summarizer for possible problems. You can also examine the Compsumm.log file for errors or additional information.

\Dataldr.box

This folder stores .mif files that represent hardware inventory data for Configuration Manager 2007 client computers. This folder also stores IDMIF files for custom architectures. A backlog of files can indicate problems accessing the Systems Management Server (SMS) database. Examine status messages for the Inventory Data Loader for possible problems. You can also examine the Dataldr.log file for errors or additional information.

\Dataldr.box\Badmifs

This folder stores corrupted .mif files for hardware inventory or custom IDMIF files. A backlog of files can indicate a bad custom MIF file or that a client computer cannot transfer the file correctly. Configuration Manager 2007 automatically deletes all files in the \Badmifs folder that are older than 14 days. Examine status messages for the Inventory Data Loader for possible problems. You can also examine the Dataldr.log file for errors or additional information.

\Ddm.box

This folder temporarily stores discovery data records (.ddr files) after a client or server agent generates a discovery record. Examine status messages for the Discovery Data Manager (DDM) for possible problems. You can also examine the Ddm.log file for errors or additional information.

\Ddm.box\BAD_DDRS

This folder stores .ddr files that are corrupted. A backlog of files can indicate a network corruption problem or a problem with the DDM. Configuration Manager 2007 automatically deletes .ddr files that are older than 25 hours. Examine status messages for the DDM for possible problems. You can also examine the Ddm.log file for errors or additional information.

\Despoolr.box\Receive

This folder stores the data that is received from a child site or a parent site. Typically, files are processed and moved as soon as Configuration Manager 2007 receives the instruction file (.ins file). Examine status messages for the Despooler for possible problems. You can also examine the Despool.log file for errors or additional information.

\Inventry.box

This folder temporarily stores hardware inventory files from management points after clients transfer their hardware inventory to the management point. The Inventory Processor converts the .nhm file to a binary .mif file and then moves the file to the \Dataldr.box folder. Examine status messages for the Inventory Processor for possible problems. You can also examine the Invproc.log file for errors or additional information.

\OfferSum.box

This folder receives summarization messages (.sum files) for advertisements from child sites and processes the files to the site database. A backlog of files can indicate a performance problem that is caused by a large number of messages. Examine status messages for the Offer Status Summarizer for possible problems. You can also examine the Offersum.log file for errors or additional information.

\policypv.box

This folder temporarily stores policy changes for the Configuration Manager 2007 components. Whenever the policy of Configuration Manager 2007 components change, a notification file appears in this inbox, causing the policy provider to regenerate the policies. A backlog of files in the policypv.box folder indicates that the policy provider component is not running. The policy provider component might not be able to read the site control file, or the component cannot write to the database. You can examine the Policypv.log in the \Logs folder on the site server for errors or additional information.

\Replmgr.box\Incoming

This folder receives files from the SMS despooler after processing files from other SMS sites. The SMS Replication Manager determines whether the file is transaction-oriented and then verifies that the serial numbers are correct. If the file is not transaction-oriented, no additional verification is performed. The Replication Manager transfers the file to the recipient component for final processing. Examine status messages for the Replication Manager for possible problems. You can also examine the Replmgr.log file for errors or additional information.

\Replmgr.box\Outbound

This folder temporarily stores files that are destined for another site. This folder also contains three outbox subfolders that correspond to the priority of the files. For example, this folder can contain \High, \Low, and \Normal folders. When the Replication Manager detects files in one of the outbound directories, the Replication Manager waits for additional files before moving the files to the \Process subfolder and then to the \Ready subfolder. Examine status messages for the Replication Manager for possible problems. You can also examine the Replmgr.log file for errors or additional information.

\Replmgr.box\Ready

This folder stores files that are compressed for transmission to remote sites. The files are moved to the Scheduler for transmission. A backlog of files can indicate that the Scheduler is backlogged or is already processing files of the same priority. In this scenario, the Scheduler has to wait for the transmission to complete. Examine status messages for the Replication Manager for possible problems. You can also examine the Replmgr.log file for errors or additional information.

\Schedule.box

This folder stores mini-job files (.job files) that were created by the Replication Manager. The Scheduler turns the .job files into Sender jobs. A backlog of files can indicate that the Sender cannot connect to or cannot transfer data to another site. A backlog can also indicate that the Scheduler cannot process the mini-job files because files are missing from the \Schedule.box\Uid folder. Examine status messages for the Scheduler for possible problems. You can also examine the Sched.log file for errors or additional information.

\Schedule.box\Outboxes

This folder contains the outbox folders for each installed sender. In the sender's outbox folder, you can find send request files (.srq files) or send request status files (.srs files). A backlog of .srq files indicates that the sender cannot process the number of jobs scheduled for that sender or that the sender cannot connect to or transfer data to another site. Examine status messages for the Scheduler for possible problems. You can also examine the Sched.log file for errors or additional information. Also examine the sender log file (Sender.log) for any errors when it tries to communicate to the remote site.

\Schedule.box\Requests

This folder stores the initial send request files before the Scheduler transfers the files to a sender. This folder also stores send request files that are returned when the sender cannot connect to the target site. Examine status messages for the Scheduler for possible problems. You can also examine the Sched.log file for errors or additional information. Also examine the sender log file (Sender.log) for any errors when it tries to communicate to the remote site.

\Schedule.box\Tosend

This folder stores package and instruction files before they are transferred to another site. Package and instruction files start with .p00 and .i00 file name extensions, and the file name extensions increment numerically. The files are removed after the sender has copied the files to the remote site. A backlog of files can indicate that many send requests are not completed or that the Scheduler has not yet deleted the files. Examine status messages for the Scheduler for possible problems. You can also examine the Sched.log file for errors or additional information. Also examine the sender log file (Sender.log) for any errors when it tries to communicate to the remote site.

\Sinv.box

This folder stores client software inventory files (.sic and .sid files) that are copied from the management point. A backlog of files can indicate that the Software Inventory Processor cannot connect to the site database or that too many files were received. Examine status messages for the Software Inventory Processor for possible problems. You can also examine the Sinvproc.log file for errors or additional information.

\Sinv.box\BadSinv

This folder stores corrupted software inventory files. A backlog of files can indicate problems with specific clients, with management points, or with the network, causing data corruption. Make sure that there is not a backlog of zero-byte files in this folder. If zero-byte files exist, manually delete them. Examine status messages for the Software Inventory Processor for possible problems. You can also examine the Sinvproc.log file for errors or additional information.

\SiteStat.Box

This folder receives summarization messages (.sum files) for site system status from child sites before the files are processed to the SMS site database. A backlog of files can indicate a performance problem. Examine status messages for the Site System Status Summarizer for possible problems. You can also examine the Sitestat.log file for errors or additional information.

\Statmgr.box\Futureq

This folder stores status messages (.svf files) from remote systems (clients or site systems) if the date and time of the message is in the future compared to the site server's clock. The Status Manager does not process these messages until the computer clock matches the date and time when the status message was created. The date and time when the status message was created might be different from the date and time stamp of the file. A backlog of files can indicate that some site systems' clocks are not synchronized with the site server. Examine status messages for the Status Manager for possible problems. You can also examine the Statmgr.log file for errors or additional information.

\Statmgr.box\Queue

This folder receives status messages from SMS Executive components on the site server if the in-memory queue is not available. A backlog of files can indicate a problem with the Status Manager or that the component is trying to process too many messages. Examine status messages for the Status Manager for possible problems. You can also examine the Statmgr.log file for errors or additional information.

\Statmgr.box\Retry

This folder stores status messages that could not be processed to the site database. A backlog of files can indicate problems with the connection to the computer that is running SQL Server. Examine status messages for the Status Manager for possible problems. You can also examine the Statmgr.log file for errors or additional information.

\Statmgr.box\Statmsgs

This folder stores status messages from site systems and from Configuration Manager 2007 clients before the messages are processed by the Status Manager. A backlog of files can indicate a problem with the Status Manager or that the Status Manager is trying to process too many messages. Examine status messages for the Status Manager for possible problems. You can also examine the Statmgr.log file for errors or additional information.

\swmproc.box

This folder and its subfolders are used to temporarily store software metering information from Configuration Manager 2007 clients. A backlog of .sum and .sur files can indicate that the Software Metering Processor component cannot connect to the SMS database. Examine the status messages for the Software Metering Processor component for possible problems. You can also examine the Swmproc.log file for errors or additional information.

See Also

Concepts

List of Log Files in Configuration Manager 2007
Technical Reference for Configuration Manager 2007


List of Log Files in Configuration Manager 2007

Topic last updated—March 2007

All the client and site server components in Microsoft System Center Configuration Manager 2007 record process information in individual log files. You can use the information in the client and site server log files to help you troubleshoot issues that might occur in your Configuration Manager 2007 hierarchy.

By default, client and server component logging is turned on in Configuration Manager 2007.

Client Log Files

The Configuration Manager 2007 client logs are located in one of the following locations:

  • On computers that serve as management points, the client logs are located in the SMS_CCM\Logs folder.
  • On all other computers, the client log files are located in the %Windir%\System32\CCM\Logs folder or the %Windir%\SysWOW64\CCM\Logs.

The following table lists and describes the client log files.

Log File Name | Description
CAS | Content Access service. Maintains the local package cache.
CcmExec.log | Records activities of the client and the SMS Agent Host service.
CertificateMaintenance.log | Maintains certificates for Active Directory directory service and management points.
ClientIDManagerStartup.log | Creates and maintains the client GUID.
ClientLocation.log | Site assignment tasks.
ContentTransferManager.log | Schedules the Background Intelligent Transfer Service (BITS) or the Server Message Block (SMB) to download or to access SMS packages.
DataTransferService.log | Records all BITS communication for policy or package access.
Execmgr.log | Records advertisements that run.
FileBITS.log | Records all SMB package access tasks.
Fsinvprovider.log (renamed to FileSystemFile.log in all SMS 2003 Service Packs) | Windows Management Instrumentation (WMI) provider for software inventory and file collection.
InventoryAgent.log | Creates discovery data records (DDRs) and hardware and software inventory records.
LocationServices.log | Finds management points and distribution points.
Mifprovider.log | The WMI provider for .MIF files.
Mtrmgr.log | Monitors all software metering processes.
PolicyAgent.log | Requests policies by using the Data Transfer service.
PolicyAgentProvider.log | Records policy changes.
PolicyEvaluator.log | Records new policy settings.
RemoteControl.log | Logs when the remote control component (WUSER32) starts.
Scheduler.log | Records schedule tasks for all client operations.
Smscliui.log | Records usage of the Systems Management tool in Control Panel.
StatusAgent.log | Logs status messages that are created by the client components.
SWMTRReportGen.log | Generates a usage data report that is collected by the metering agent. (This data is logged in Mtrmgr.log.)

Site Server Log Files

Most Configuration Manager 2007 site server log files are located in the <InstallationPath>\LOGS folder. Because Configuration Manager 2007 relies heavily on Microsoft Internet Information Services (IIS), you can review the IIS log file for additional errors that relate to client access to the IIS server. The IIS log file is located in the %Windir%\System32\logfiles\W3SVC1 folder on the IIS server.

The following table lists and describes the site server log files.

Log File Name | Description
Ccm.log | Client Configuration Manager tasks.
Cidm.log | Records changes to the client settings by the Client Install Data Manager (CIDM).
Colleval.log | Logs when collections are created, changed, and deleted by the Collection Evaluator.
Compsumm.log | Records Component Status Summarizer tasks.
Cscnfsvc.log | Records Courier Sender confirmation service tasks.
Dataldr.log | Processes Management Information Format (MIF) files and hardware inventory in the Configuration Manager 2007 database.
Ddm.log | Saves DDR information to the Configuration Manager 2007 database by the Discovery Data Manager.
Despool.log | Records incoming site-to-site communication transfers.
Distmgr.log | Records package creation, compression, delta replication, and information updates.
Hman.log | Records site configuration changes, and publishes site information in Active Directory Domain Services.
Inboxast.log | Records files that are moved from the management point to the corresponding SMS\INBOXES folder.
Inboxmgr.log | Records file maintenance.
Invproc.log | Records the processing of delta MIF files for the Dataloader component from client inventory files.
Mpcontrol.log | Records the registration of the management point with WINS. Records the availability of the management point every 10 minutes.
Mpfdm.log | Management point component that moves client files to the corresponding SMS\INBOXES folder.
MPMSI.log | Management point .msi installation log.
MPSetup.log | Records the management point installation wrapper process.
Ntsvrdis.log | Configuration Manager 2007 server discovery.
Offermgr.log | Records advertisement updates.
Offersum.log | Records summarization of advertisement status messages.
Policypv.log | Records updates to the client policies to reflect changes to client settings or advertisements.
Replmgr.log | Records the replication of files between the site server components and the Scheduler component.
Rsetup.log | Reporting point setup log.
Sched.log | Records site-to-site job and package replication.
Sender.log | Records files that are sent to other child and parent sites.
Sinvproc.log | Records client software inventory data processing to the site database in Microsoft SQL Server.
Sitecomp.log | Records maintenance of the installed site components.
Sitectrl.log | Records site setting changes to the Sitectrl.ct0 file.
Sitestat.log | Records the monitoring process of all site systems.
Smsdbmon.log | Records database changes.
Smsexec.log | Records processing of all site server component threads.
Smsprov.log | Records WMI provider access to the site database.
SMSReportingInstall.log | Records the Reporting Point installation. This component starts the installation tasks and processes configuration changes.
Srvacct.log | Records the maintenance of accounts when the site uses standard security.
Statmgr.log | Writes all status messages to the database.
Swmproc.log | Processes metering files and maintains settings.

The Admin UI log files are located in <InstallationPath>\AdminUI\. The following table lists and describes the Admin UI log files.

Log File Name | Description
RepairWizard.log | Records errors, warnings, and information about the process of running the Repair Wizard.
ResourceExplorer.log | Records errors, warnings, and information about running the Resource Explorer.
SMSAdminUI.log | Records the local Configuration Manager 2007 console tasks when you connect to Configuration Manager 2007 sites.

Management Point Log Files

If management points are installed in the site hierarchy, management point log files are stored in the SMS_CCM\LOGS folder on the management point computer. The following table lists and describes the management point log files.

Log File Name | Description
MP_Ddr.log | Records the conversion of XML.ddr records from clients, and copies them to the site server.
MP_GetAuth.log | Records the status of the site management points.
MP_GetPolicy.log | Records policy information.
MP_Hinv.log | Converts XML hardware inventory records from clients and copies the files to the site server.
MP_Location.log | Records location manager tasks.
MP_Policy.log | Records policy communication.
MP_Relay.log | Copies files that are collected from the client.
MP_Retry.log | Records the hardware inventory retry processes.
MP_Sinv.log | Converts XML hardware inventory records from clients and copies them to the site server.
MP_Status.log | Converts XML.svf status message files from clients and copies them to the site server.

Mobile Device Management Log Files

If mobile device management is enabled in the site hierarchy, mobile device management point log files are generally stored in the <ConfigMgrInstallPath>\LOGS folder on the mobile device management point computer. The following table lists and describes the mobile device management point log files.

Mobile Device Management Point Logs

Log File Name | Description
DmClientHealth.log | Records the GUIDs of all the mobile device clients that are communicating with the Device Management Point.
DmClientRegistration.log | Records registration requests from and responses to the mobile device client in Native mode.
DmpDatastore.log | Records all the site database connections and queries made by the Device Management Point.
DmpDiscovery.log | Records all the discovery data from the mobile device clients on the Device Management Point.
DmpFileCollection.log | Records mobile device file collection data from mobile device clients on the Device Management Point.
DmpHardware.log | Records hardware inventory data from mobile device clients on the Device Management Point.
DmpIsapi.log | Records mobile device communication data from device clients on the Device Management Point.
dmpMSI.log | Records the MSI data for Device Management Point setup.
DMPSetup.log | Records the mobile device management setup process.
DmpSoftware.log | Records mobile device software distribution data from mobile device clients on the Device Management Point.
DmpStatus.log | Records mobile device status messages data from mobile device clients on the Device Management Point.
FspIsapi.log | Records Fallback Status Point communication data from mobile device clients and client computers on the Fallback Status Point.

Mobile Device Management Client Logs

For the locations of log files on managed mobile devices and on computers that are used to deploy the mobile device client, see How to Configure Logging for Windows Mobile and Windows CE Devices. The following table lists and describes the mobile device management client log files.

Log File Name | Description
DmCertEnroll.log | Records certificate enrollment data on mobile device clients.
DMCertResp.htm (in \temp) | Records HTML response from the certificate server when the mobile device Enroller program requests a client authentication certificate on mobile device clients.
DmClientSetup.log | Records client setup data on mobile device clients.
DmClientXfer.log | Records client transfer data for Windows Mobile Device Center and ActiveSync deployments.
DmCommonInstaller.log | Records client transfer file installation for setting up mobile device client transfer files on client computers.
DmInstaller.log | Records whether DMInstaller correctly calls DmClientSetup and whether DmClientSetup exits with success or failure on mobile device clients.
DmInvExtension.log | Records Inventory Extension file installation for setting up Inventory Extension files on client computers.
DmSvc.log | Records mobile device management service data on mobile device clients.

Operating System Deployment Log Files

The following table lists and describes the operating system deployment log files.

Log File Name Description

CCMSetup.log

Provides information about client-based operating system actions.

CreateTSMedia.log

Provides information about task sequence media when it is created. This log is generated on the computer running the Configuration Manager 2007 administrator console.

DriverCatalog.log

Provides information about device drivers that have been imported into the driver catalog.

MP_ClientIDManager.log

Provides information about the Configuration Manager 2007 management point when it responds to Configuration Manager 2007 client ID requests from boot media or PXE. This log is generated on the Configuration Manager 2007 management point.

MP_DriverManager.log

Provides information about the Configuration Manager 2007 management point when it responds to a request from the Auto Apply Driver task sequence action. This log is generated on the Configuration Manager 2007 management point.

MP_Location.log

Provides information about the Configuration Manager 2007 management point when it responds to request state store or release state store requests from the state migration point. This log is generated on the Configuration Manager 2007 management point.

Pxecontrol.log

Provides information about the PXE Control Manager.

PXEMsi.log

Provides information about the PXE service point and is generated when the PXE service point site server has been created.

PXESetup.log

Provides information about the PXE service point and is generated when the PXE service point site server has been created.

Setupact.log

Setupapi.log

Setuperr.log

Provide information about Windows Sysprep and setup logs.

SmpIsapi.log

Provides information about the state migration point Configuration Manager 2007 client request responses.

Smpmgr.log

Provides information about the results of state migration point health checks and configuration changes.

SmpMSI.log

Provides information about the state migration point and is generated when the state migration point site server has been created.

Smsprov.log

Provides information about the SMS provider.

Smspxe.log

Provides information about the Configuration Manager 2007 PXE service point.

SMSSMPSetup.log

Provides information about the state migration point and is generated when the state migration point site server has been created.

Smsts.log

General location for all operating system deployment and task sequence log events.

Log file location:

  • If task sequence completes when running in the full operating system with a Configuration Manager 2007 client installed on the computer: <CCM Install Dir>\logs
  • If task sequence completes when running in the full operating system with no Configuration Manager 2007 client installed on the computer: %temp%\SMSTSLOG
  • If task sequence completes when running in WindowsPE: <largest fixed partition>\SMSTSLOG
Note
<CCM Install Dir> is %windir%\system32\ccm\logs for most Configuration Manager 2007 clients and is <Configuration Manager 2007 installation drive>\SMS_CCM for the Configuration Manager 2007 site server. For 64-bit operating systems, it is %windir%\SysWOW64\ccm\logs.

TaskSequenceProvider.log

Provides information about task sequences when they are imported, exported, or edited.

USMT Log loadstate.log

Provides information about the User State Migration Tool (USMT) regarding the restore of user state data.

USMT Log scanstate.log

Provides information about the USMT regarding the capture of user state data.

Network Access Protection Log Files

By default, client log files related to Network Access Protection are found in %windir%\CCM\Logs. For client computers that are also management points, the log files are found in %ProgramFiles%\SMS_CCM\Logs.

The following table lists and describes the Network Access Protection log files.

Log File Name Description

Ccmcca.log

Logs the processing of compliance evaluation based on Configuration Manager NAP policy processing and contains the processing of remediation for each software update required for compliance.

CIAgent.log

Tracks the process of remediation and compliance. However, the software updates log file, Updateshandler.log, provides more informative details on installing the software updates required for compliance.

locationservices.log

Used by other Configuration Manager features (for example, information about the client's assigned site) but also contains information specific to Network Access Protection when the client is in remediation. It records the names of the required remediation servers (management point, software update point, and distribution points that host content required for compliance), which are also sent in the client statement of health.

SDMAgent.log

Shared with the Configuration Manager feature desired configuration management and contains the tracking process of remediation and compliance. However, the software updates log file, Updateshandler.log, provides more informative details about installing the software updates required for compliance.

SMSSha.log

The main log file for the Configuration Manager Network Access Protection client and contains a merged statement of health information from the two Configuration Manager components: location services (LS) and the configuration compliance agent (CCA).

This log file also contains information about the interactions between the Configuration Manager System Health Agent and the operating system NAP agent, and also between the Configuration Manager System Health Agent and both the configuration compliance agent and the location services. It provides information about whether the NAP agent successfully initialized, the statement of health data, and the statement of health response.

The System Health Validator point log files are located in %systemdrive%\SMSSHV\SMS_SHV\Logs, and they are listed and described in the following table.

Log File Name | Description
Ccmperf.log | Contains information about the initialization of the System Health Validator point performance counters.
SmsSHV.log | The main log file for the System Health Validator point; logs the basic operations of the System Health Validator service, such as the initialization progress.
SmsSHVADCacheClient.log | Contains information about retrieving Configuration Manager health state references from Active Directory Domain Services.
SmsSHVCacheStore.log | Contains information about the cache store used to hold the Configuration Manager NAP health state references retrieved from Active Directory Domain Services, such as reading from the store and purging entries from the local cache store file. The cache store is not configurable.
SmsSHVRegistrySettings.log | Records any dynamic changes to the System Health Validator component configuration while the service is running.
SmsSHVQuarValidator.log | Records client statement of health information and processing operations. To obtain full information, change the registry key LogLevel from 1 to 0 in the following location: HKLM\SOFTWARE\Microsoft\SMSSHV\Logging\@GLOBAL

Setup information for the System Health Validator point can be found in a setup log file, described in the following table, on the computer running the Network Policy Server.

Log File Name | Description
<ConfigMgrInstallationPath>\Logs\SMSSHVSetup.log | Records the success or failure (with failure reason) of installing the System Health Validator point.

Desired Configuration Management Log Files

By default, the Configuration Manager 2007 client computer log files are found in %windir%\System32\CCM\Logs or in %windir%\SysWOW64\CCM\Logs. For client computers that are also management points, the client log files are located in the SMS_CCM\Logs folder. The following table lists and describes these log files.

Log File Name | Description
ciagent.log | Provides information about downloading, storing, and accessing assigned configuration baselines.
dcmagent.log | Provides high-level information about the evaluation of assigned configuration baselines and desired configuration management processes.
discovery.log | Provides detailed information about the Service Modeling Language (SML) processes.
sdmagent.log | Provides information about downloading, storing, and accessing configuration item content.
sdmdiscagent.log | Provides high-level information about the evaluation process for the objects and settings configured in the referenced configuration items.

Wake On LAN Log Files

The Configuration Manager 2007 site server log files related to Wake On LAN are located in the folder <ConfigMgrInstallationPath>\Logs on the site server. There are no client-side log files for Wake On LAN. The following table lists and describes the Wake On LAN log files.

Log File Name | Description
Wolmgr.log | Contains information about wake-up procedures such as when to wake up advertisements or deployments that are configured for Wake On LAN.
WolCmgr.log | Contains information about which clients need to be sent wake-up packets, the number of wake-up packets sent, and the number of wake-up packets retried.

Software Updates Site Server Log Files

The Configuration Manager 2007 site server log files are found, by default, in <InstallationPath>\Logs. The following table lists and describes the software updates site server log files.

Log File Name Description

ciamgr.log

Provides information about the addition, deletion, and modification of software update configuration items.

distmgr.log

Provides information about the replication of software update deployment packages.

objreplmgr.log

Provides information about the replication of software updates notification files from a parent to child sites.

PatchDownloader.log

Provides information about the process for downloading software updates from the update source specified in the software updates metadata to the download destination on the site server.

Note
On 64-bit operating systems and on 32-bit operating systems with no Configuration Manager 2007 installed, PatchDownloader.log is created in the server logs directory. On 32-bit operating systems, if the Configuration Manager 2007 client is installed, PatchDownloader.log is created in the client logs directory.

replmgr.log

Provides information about the process for replicating files between sites.

smsdbmon.log

Provides information about when software update configuration items are inserted, updated, or deleted from the site server database and creates notification files for software updates components.

SUPSetup

Provides information about the software update point installation. When the software update point installation completes, Installation was successful is written to this log file.

WCM.log

Provides information about the software update point configuration and connecting to the Windows Server Update Services (WSUS) server for subscribed update categories, classifications, and languages.

WSUSCtrl.log

Provides information about the configuration, database connectivity, and health of the WSUS server for the site.

wsyncmgr.log

Provides information about the software updates synchronization process.

WSUS Server Log Files

By default, the log files for WSUS running on the software update point site system role are found in %ProgramFiles%\Update Services\LogFiles. The following table lists and describes the WSUS server log files.

Log File Name | Description
Change.log | Provides information about the WSUS server database information that has changed.
SoftwareDistribution.log | Provides information about the software updates that are synchronized from the configured update source to the WSUS server database.

Software Updates Client Computer Log Files

By default, the Configuration Manager 2007 client computer log files are found in %windir%\CCM\Logs. For client computers that are also management points, the log files are found in %ProgramFiles%\SMS_CCM\Logs. The following table lists and describes the software updates client computer log files.

Log File Name Description

CAS.log

Provides information about the process of downloading software updates to the local cache and cache management.

CIAgent.log

Provides information about processing configuration items, including software updates.

LocationServices.log

Provides information about the location of the WSUS server when a scan is initiated on the client.

PatchDownloader.log

Provides information about the process for downloading software updates from the update source to the download destination on the site server.

This log is only on the client computer configured as the synchronization host for the Inventory Tool for Microsoft Updates.

PolicyAgent.log

Provides information about the process for downloading, compiling, and deleting policies on client computers.

PolicyEvaluator

Provides information about the process for evaluating policies on client computers, including policies from software updates.

RebootCoordinator.log

Provides information about the process for coordinating system restarts on client computers after software update installations.

ScanAgent.log

Provides information about the scan requests for software updates, what tool is requested for the scan, the WSUS location, and so on.

ScanWrapper

Provides information about the prerequisite checks and the scan process initialization for the Inventory Tool for Microsoft Updates on Systems Management Server (SMS) 2003 clients.

SdmAgent.log

Provides information about the process for verifying and decompressing packages that contain configuration item information for software updates.

ServiceWindowManager.log

Provides information about the process for evaluating configured maintenance windows.

smscliUI.log

Provides information about the Configuration Manager Control Panel user interactions, such as initiating a Software Updates Scan Cycle from the Configuration Manager Properties dialog box, opening the Program Download Monitor, and so on.

SmsWusHandler

Provides information about the scan process for the Inventory Tool for Microsoft Updates on SMS 2003 client computers.

StateMessage.log

Provides information about when software updates state messages are created and sent to the management point.

UpdatesDeployment.log

Provides information about the deployment on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.

UpdatesHandler.log

Provides information about software update compliance scanning and about the download and installation of software updates on the client.

UpdatesStore.log

Provides information about the compliance status for the software updates that were assessed during the compliance scan cycle.

WUAHandler.log

Provides information about when the Windows Update Agent on the client searches for software updates.

WUSSyncXML.log

Provides information about the Inventory Tool for the Microsoft Updates synchronization process.

This log is only on the client computer configured as the synchronization host for the Inventory Tool for Microsoft Updates.

Windows Update Agent Log File

By default, the Windows Update Agent log file is found on the Configuration Manager Client computer in %windir%. The following table provides the log file name and description.

Log File Name | Description
WindowsUpdate.log | Provides information about when the Windows Update Agent connects to the WSUS server and retrieves the software updates for compliance assessment and whether there are updates to the agent components.

Out of Band Management Log Files

Applies only to Configuration Manager 2007 SP1.

These log files are found in the following locations:

  • On the out of band service point site system server.
  • On any computer that runs the out of band management console from the Configuration Manager console.
  • On client computers that are running the Configuration Manager 2007 SP1 client and that are managed out of band.

The following sections lists and describes the log files related to out of band management in Configuration Manager 2007 SP1.

Out of Band Service Point Log Files

The Configuration Manager 2007 SP1 log files listed in the following table are located in the folder <ConfigMgrInstallationPath>\Logs on the site system server selected to host the out of band service point role.

Log File Name More Information

AMTSPSetup.log

Shows the success or failure (with failure reason) of installing the out of band service point.

Amtopmgr.log

Shows the activities of the out of band service point relating to discovery of management controllers, provisioning, and power control commands.

Amtproxymgr.log

Shows the activities of the site server relating to provisioning, which include the following:

  • Publishing provisioned computers to Active Directory Domain Services.
  • Registering the service principal name of provisioned computers in Active Directory Domain Services.
  • Requesting the Web server certificate from the issuing certification authority.

Shows the activities of sending instruction files to the out of band service point, which include the following:

  • Discovery of management controllers.
  • Provisioning.
  • Power control commands.

Shows the activities related to out of band management site replication.

Out of Band Management Console Log Files

The Configuration Manager 2007 SP1 log file listed in the following table is located in the folder <ConfigMgrInstallationPath>\AdminUI\AdminUILog on any computer that runs the out of band management console from the Configuration Manager console.

Log File Name | More Information
Oobconsole.log | Shows activities related to running the out of band management console.

Out of Band Client Computer Log Files

The Configuration Manager 2007 SP1 log file listed in the following table is located in the folder %windir%\System32\CCM\Logs on workstation computers that are running the Configuration Manager 2007 SP1 client and that are managed out of band.

Log File Name | More Information
Oobmgmt.log | Shows out of band management activities performed on workstation computers, including the provisioning state of the management controller.

See Also

Tasks

How to Enable Logging for a Component


Example Configuration Manager Deployment Scenarios

Topic last updated—November 2007

The topics in this section provide example scenarios of how to plan and deploy new Configuration Manager 2007 installations and upgrades of existing SMS 2003 Service Pack 2 or later sites.

Scenario Personas

The scenarios provided are based on the Configuration Manager deployment activities of the following personas representing the IT organization of Woodgrove National Bank.

Don Richardson will be the project manager for deploying Configuration Manager in Woodgrove Bank’s production network. Don’s supervisors have given him the authority required to complete the deployment process successfully.

Don’s first step in planning to deploy Configuration Manager is to assemble his planning team. The planning team consists of a representative of corporate management and technical staff including Ray Chow (Enterprise Systems Administrator), Carlos Carvallo (Network Administrator), and Kevin Cook (Enterprise Security Administrator).

  • Don Richardson (Windows Server Administrator) is the primary employee responsible for deploying Configuration Manager. Don is responsible for ensuring that the correct hardware and software is installed and configured to support the new Configuration Manager environment. This includes ensuring that the hardware and software meet the supported configuration requirements and ensuring the installation of any necessary prerequisites on applicable server platforms.
  • Ray Chow (Enterprise Systems Administrator) will be most involved in the approval of the Configuration Manager planning and deployment processes, including ensuring that the necessary public key infrastructure (PKI) is in place to support the most secure environment possible.
  • Carlos Carvallo (Network Administrator) will be involved to ensure that the necessary Active Directory schema extensions, Group Policy Objects (GPO) are properly configured, and necessary firewall configuration changes are made.
  • Kevin Cook (Enterprise Security Administrator) would be most involved in ensuring that the planning and deployment process is implemented properly to ensure the most secure operating conditions possible, as well as maximum uptime and minimum loss of data.

A help desk administrator will also be involved to ensure that the end-user perspective is considered during planning.

In This Section

Example Configuration Manager Installation Scenario

Example Configuration Manager Upgrade Scenario

See Also

Concepts

Example Configuration Manager Deployment Checklists

Other Resources

Appendixes


Example Configuration Manager Installation Scenario

Topic last updated—November 2007

This topic provides sample scenarios for planning and deploying a new installation of Configuration Manager.

Preplanning for New Configuration Manager Installations

The following scenario demonstrates how customers can complete the necessary preplanning phase before beginning the planning or deployment phases for new Configuration Manager installations.

In this example, Don, the project manager of Woodgrove Bank, assigned individual roles and responsibilities to all team members during the planning team’s project kickoff meeting to discuss the project and its goals. They also set business objectives, technical objectives, and project milestones.

Process Reference

The planning team analyzes Woodgrove Bank’s technical needs and identifies their business objectives for deploying Configuration Manager.

Don meets with key members to ensure a thorough understanding of Woodgrove Bank’s network and computing environment and that it was properly documented.

Don develops a test lab closely resembling the production environment by using the supporting documentation.

Configuration Manager Preplanning Phase

Configuration Manager Preplanning Worksheets

Planning for New Configuration Manager Installations

The following scenario demonstrates how customers can complete the necessary planning steps before beginning the deployment phase of new Configuration Manager installations.

During the planning phase, Don’s team had the following major goals:

  • Complete the required planning documentation requirements.
  • Define and validate a proposed hierarchy design. This design must include planning for the Configuration Manager features to support the business and technical goals defined in the preplanning phase, as well as the hardware and software requirements for the proposed design.
  • Identify and coordinate with installation and support teams who are required to complete the deployment process but are not part of the planning team.
  • Prepare an overall project deployment plan and schedule.

Process Reference

Don completes the documentation requirements for the Configuration Manager specific planning to begin the hierarchy-planning process.

Configuration Manager Planning Checklist

Configuration Manager Planning Worksheets

Don’s team learns more about Configuration Manager through the online documentation to aid in their planning.

The team decides on the initial hierarchy design and the features they require to support their business and technical objectives, as defined in the preplanning phase.

Fundamentals of Configuration Manager 2007

What Do You Want To Do?

Configuration Manager Planning and Deployment Overview

Configuration Manager Single Site Planning and Deployment

Configuration Manager Tasks for Planning a Single Site

Choose Between Primary Sites, Secondary Sites, and Branch Distribution Points

Configuration Manager Tasks for Planning Multiple Sites

Don decides to deploy Configuration Manager native mode sites to create the most secure management environment possible after discussing the different site mode options for Configuration Manager with key players on his team.

Configuration Manager Site Modes

Choose between Native Mode and Mixed Mode

Don’s team identified needed hardware and software upgrades as part of their planning by comparing their existing infrastructure to the infrastructure required to support their Configuration Manager site hierarchy plan.

Configuration Manager Supported Configurations

Prerequisites for Installing Configuration Manager

Don identifies the administrators external to the planning team that are needed to assist in the deployment process and begins early coordination with them. He begins discussions on the following:

  • Extending the Active Directory schema for Configuration Manager.
  • Ensuring that the required SQL Server instances would be available and configured properly to support the deployment goals.
  • The necessary prerequisites were met for deploying a native mode site.

Extending the Active Directory Schema for Configuration Manager

Configuration Manager Site Database Overview

Prerequisites for Native Mode

The last step in the planning phase for Don’s team is to create a schedule and a detailed deployment project plan for their proposed Configuration Manager 2007 hierarchy deployment.

Configuration Manager Planning Phase

Deploying a New Configuration Manager Installation

The following scenario demonstrates how customers can complete the necessary deployment phase of new Configuration Manager installations.

The planning team’s goal for deploying Configuration Manager in their production environment was to perform a swift and successful deployment with minimum interruption to Woodgrove Bank’s users.

Process Reference

Don’s team learns more about Configuration Manager deployment processes by reading the online documentation to begin the hierarchy deployment process.

Configuration Manager Tasks for Deploying a Single Site

Configuration Manager Tasks for Deploying Multiple Sites

Configuration Manager Deployment Checklist

Don tests and validates the deployment plan in the test lab using the simple Setup option.

The results of the test lab deployment are analyzed for any necessary changes or refinement to the deployment plan.

Test lab created during the preplanning phase.

Simple Setup Overview

How to Deploy a Site Using Simple Setup

Because native mode was selected as the site mode for their new installation, Don ensures that Ray deployed the necessary PKI infrastructure required before beginning the production deployment.

Deploying the PKI Certificates Required for Native Mode

Administrator Checklist: Deploying the PKI Requirements for Native Mode

Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority

After refining the deployment plan with test lab deployment results, Don begins the deployment by conducting a small pilot project using the custom setup option.

Using the documentation previously created during the planning phase and the results of the pilot project, Don creates a checklist to follow when installing a new site.

During the production environment deployment, Don closely monitors help desk call activity to ensure that users are not adversely affected during the deployment.

A small, controlled segment of the production network.

Custom Setup Overview

How to Deploy a Site Using Custom Setup

Example Configuration Manager Installation Checklist

See Also

Concepts

Example Configuration Manager Deployment Scenarios
Example Configuration Manager Installation Checklist

Other Resources

Appendixes


Example Configuration Manager Upgrade Scenario

Topic last updated—November 2007

This topic provides sample scenarios for planning and upgrading existing SMS 2003 installations to Configuration Manager 2007.

Preplanning for Upgrading to Configuration Manager

The following scenario demonstrates how customers can complete the necessary preplanning phase before beginning the planning or deployment phases when upgrading from SMS 2003 to Configuration Manager 2007.

During the planning team’s project kickoff meeting to discuss the project and its goals, Don assigned individual roles and responsibilities to all team members. Business objectives, technical objectives, and project milestones for upgrading to Configuration Manager were also set.

Process Reference

The planning team analyzes Woodgrove Bank’s technical needs and identifies the business objectives for upgrading from SMS 2003 to Configuration Manager.

Don meets with Ray and Carlos to ensure that he has a thorough understanding of Woodgrove Bank’s network environment, computing environment, and the existing SMS 2003 hierarchy configuration.

Don uses the supporting documentation to develop a test lab that closely resembles the production environment, in preparation for upgrade testing after documenting the network environment, computing environment, and existing SMS 2003 hierarchy configuration.

Configuration Manager Preplanning Phase

Configuration Manager Preplanning Worksheets

Planning for a Configuration Manager 2007 Upgrade

The following scenario demonstrates how customers can complete the necessary planning steps before beginning the Configuration Manager 2007 upgrade process.

During the planning phase, Don’s team had the following major goals:

  • Complete the required planning documentation requirements.
  • Define and validate a proposed hierarchy design. This design must include planning for the Configuration Manager features that will be implemented to support the business and technical goals defined in the preplanning phase as well as determining the hardware and software requirements for the proposed design.
  • Identify and coordinate with installation and support teams who will be required to complete the deployment process but who are not part of the planning team.
  • Prepare an overall project deployment plan and schedule.

Process Reference

To begin the hierarchy process, Don completes the documentation requirements for the Configuration Manager–specific planning.

Configuration Manager Planning Checklist

Configuration Manager Planning Worksheets

Don’s team begins learning more about Configuration Manager by reading the online documentation.

During their planning, they decide on the initial hierarchy design and the Configuration Manager features they will use to support their business and technical objectives as defined in the preplanning phase.

Fundamentals of Configuration Manager 2007

What Do You Want To Do?

Configuration Manager Single Site Planning and Deployment

Configuration Manager Tasks for Planning a Single Site

Configuration Manager Tasks for Planning Multiple Sites

The planning team plans the upgrade for the existing SMS 2003 site hierarchy.

Planning to Upgrade to Configuration Manager

Considerations for Upgrading Sites

Don decides that native mode sites would best support their security goals after discussing the different Configuration Manager site mode options with Carlos and Kevin.

Configuration Manager Site Modes

Choose between Native Mode and Mixed Mode

Don identifies and communicates with the administrators external to the planning team, who will assist in the deployment process on the following topics:

  • Extending the Active Directory schema for Configuration Manager.
  • Ensuring that the required SQL Server instances would be available and configured properly to support the upgrade goals.
  • Ensuring the necessary prerequisites were met for deploying a native mode site.

Extending the Active Directory Schema for Configuration Manager

Configuration Manager Site Database Overview

SQL Server Preparation for Setup

Prerequisites for Native Mode

Comparing their existing infrastructure to the infrastructure required to support their Configuration Manager site hierarchy plan, Don’s team identifies needed hardware and software upgrades as part of their planning.

Configuration Manager Supported Configurations

Prerequisites for Installing Configuration Manager

Creating a schedule and detailing upgrade project plan for their proposed Configuration Manager 2007 hierarchy deployment.

Configuration Manager Planning Phase

Deploying Configuration Manager to Upgrade Existing SMS 2003 Site Installations

The following scenario demonstrates how customers can complete the necessary deployment phase of the Configuration Manager upgrade process.

The planning team’s goal for deploying Configuration Manager in their production environment was to perform a swift and successful upgrade of their existing SMS 2003 site hierarchy and clients with minimum interruption to Woodgrove Bank’s users and network environment.

Process Reference

Don’s team begins learning more about the Configuration Manager upgrade processes by reading the online documentation.

Configuration Manager Tasks for Deploying a Single Site

Configuration Manager Tasks for Deploying Multiple Sites

Configuration Manager Upgrade and Interoperability Planning and Deployment

Don validates the upgrade plan in the test lab.

The results of the test lab deployment are analyzed for any necessary changes or refinement to the upgrade plan.

Test lab created during the preplanning phase.

Because native mode was selected as the site mode for their new installation, Don ensures that Ray has deployed the necessary PKI infrastructure required before beginning the production deployment.

Deploying the PKI Certificates Required for Native Mode

Administrator Checklist: Deploying the PKI Requirements for Native Mode

Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority

Even though the Active Directory schema was already extended for SMS 2003, Don determines that it would be necessary to extend the Active Directory schema for Configuration Manager.

Decide If You Should Extend the Active Directory Schema

How to Extend the Active Directory Schema for Configuration Manager

Ensuring the upgrade process will go as smoothly as possible, Don verifies that all existing SMS 2003 sites have secure key exchange enabled.

Best Practices for Securing Communications

How to Require Secure Key Exchange Between Sites

Refining the deployment plan with test lab deployment results, as part of an upgrade pilot project, Don begins the upgrade process by upgrading the existing SMS 2003 central site to Configuration Manager and selects client computers.

Using the documentation previously created during the planning phase and the results of the pilot project, Don creates a checklist to follow when upgrading the remainder of the SMS 2003 sites, Administrator consoles, and clients in the production environment.

A small, controlled segment of the production network.

Custom Setup Overview

Configuration Manager In-Place Upgrade

Example Configuration Manager Upgrade Checklist

After upgrading the SMS 2003 central site to Configuration Manager, site health is verified and the site is configured, as necessary. New site systems are also added and configured as necessary.

Configuration Manager Post-Upgrade Considerations

Configuration Manager Site System Planning

How to Configure Site Systems

How to Configure Site System Roles

The newly upgraded Configuration Manager site is configured to operate in native mode.

Note
SMS 2003 sites cannot be upgraded to Configuration Manager and configured to operate in native mode at the same time

Administrator Checklist: Migrating a Site to Native Mode

Don’s team decides on the best method to upgrade the remaining sites in the hierarchy after using the in-place upgrade method to upgrade the central site.

They decide to perform side-by-side upgrades for sites that would use new hardware and decommission the existing SMS 2003 sites at those locations.

Decide If You Should Perform an In-Place or Side-By-Side Upgrade

Configuration Manager Tasks for Decommissioning Sites and Hierarchies

Using a top-down approach, each of the remaining SMS 2003 sites, administrator consoles, and their assigned clients are upgraded to Configuration Manager.

During the upgrade process, Don closely monitors help desk call activity to ensure that users are not adversely affected during the upgrade.

Configuration Manager Tasks for Upgrade and Interoperability

Tasks for Configuration Manager Client Deployment

See Also

Concepts

Example Configuration Manager Deployment Scenarios
Example Configuration Manager Upgrade Checklist

Other Resources

Appendixes


Example Configuration Manager Deployment Checklists

Topic last updated—November 2007

The topics in this section provide examples of customer-generated installation and upgrade checklists. These examples can be used as a guide when creating customized installation and upgrade checklists suited for your network and computing environment.

In This Section

Example Configuration Manager Installation Checklist

Example Configuration Manager Upgrade Checklist

See Also

Concepts

Example Configuration Manager Deployment Scenarios

Other Resources

Appendixes


Example Configuration Manager Installation Checklist

Topic last updated—November 2007

The following installation checklist is an example of a customer-generated installation checklist corresponding to the Example Configuration Manager Installation Scenario.

This checklist is provided for example purposes only. We recommend that you create a similar installation checklist to assist you in deploying Configuration Manager in your specific environment and according to your individual deployment tasks and requirements.

Example Checklist

Task | Expected Result | Installation Details
Verify hardware meets installation requirements. | Hardware meets at least the minimum supported configuration. Reference: Configuration Manager Supported Configurations. |
Verify that the installed operating system(s) meet installation requirements. | Operating system(s) meet at least the minimum supported configuration. Reference: Configuration Manager Supported Configurations. |
Install all required software and services. | Prerequisite software has been installed. Reference: Prerequisites for Installing Configuration Manager. |
Install latest Operating System software updates. | All critical updates are installed. Reference: Microsoft Update. |
Install latest SQL Server software updates. | All critical updates are installed. Reference: Microsoft Update. |
Configure SQL Server to properly host the site database. | SQL Server properly prepared for site database installation. Reference: SQL Server Preparation for Setup. |
Ensure disk space is available for site server installation. | 5 GB of disk space available for site server installation. Reference: Configuration Manager Supported Configurations. |
Ensure disk space is available for site database installation. | Estimated disk space requirement (estimated 3 MB per client). |
Configure site system computers with the appropriate permissions to allow site system installation. | Permissions properly configured on all computers that will host site system roles. (Primary site server computer account requires local administrative rights on remote management point and SQL Server site database servers.) |
Extend the Active Directory schema (if applicable). | Active Directory schema has been extended for Configuration Manager, and the primary site server computer account has been granted full control to the System Management container and all of its child objects. Reference: Extending the Active Directory Schema for Configuration Manager. |
Run Prerequisite Checker on site systems. | Run from the splash screen independently of Setup Wizard on proposed site system computers. Reference: About the Setup Prerequisite Checker. |
Resolve any Prerequisite Checker errors (if applicable). | No errors are found on site systems. Reference: Setup Prerequisite Checks. |
Download updated client installation prerequisite files (if the site server will not have Internet connectivity). | Updated client installation prerequisite files downloaded successfully. Reference: Prerequisite Component Update Checker. |
Restart site system machines. | No files are flagged as pending restart before beginning the installation process. |
Run Configuration Manager Setup Wizard to install site server. | Successful site installation. Reference: Custom Setup Overview. |
Perform post-installation checks | Site is functioning normally and configured for use. Reference: Configuration Manager Post Setup Considerations. |

See Also

Concepts

Example Configuration Manager Deployment Checklists
Example Configuration Manager Deployment Scenarios

Other Resources

Appendixes


Example Configuration Manager Upgrade Checklist

Topic last updated—November 2007

This topic provides an example of a customer-generated upgrade checklist corresponding to the scenario described in Example Configuration Manager Upgrade Scenario.

Note
This checklist is provided for example purposes only. It is recommended that you create a similar upgrade checklist to assist you in upgrading SMS 2003 sites to Configuration Manager 2007 in your specific environment and according to your individual upgrade requirements and tasks.

Example Checklist

Task Expected Result Installation Details

Verify that hardware meets installation requirements.

Hardware meets at least the minimum supported configuration.

Reference: Configuration Manager Supported Configurations.

Verify that installed operating system(s) meet installation requirements.

Operating system(s) meet at least the minimum supported configuration.

Reference: Configuration Manager Supported Configurations.

Install all required software and services.

Prerequisite software has been installed.

Reference: Prerequisites for Installing Configuration Manager.

Install the latest Operating System software updates.

All critical updates are installed.

Reference: Microsoft Update.

Install the latest SQL Server software updates.

All critical updates are installed.

Reference: Microsoft Update.

Ensure there is adequate disk space for site server installation.

Hard disk free space available for site server upgrade.

Reference: Configuration Manager Supported Configurations.

Disk space requirements for site database upgrade (estimated 2 MB additional space per client).

Estimated additional disk space requirement (estimated 2 MB per client).

Configure SQL Server properly to host the site database.

SQL Server is properly prepared for the SMS 2003 site database upgrade.

Reference: SQL Server Preparation for Setup.

Test the existing SMS 2003 site database using the testdbupgrade Setup command-line option.

The site database upgrade test is successful.

Reference: How to Test the Site Database Upgrade Process.

Configure SMS 2003 sites to require secure key exchange before beginning the upgrade process.

Note
If the Active Directory schema has not been extended (either for SMS 2003 or Configuration Manager) or the site is not configured to publish site data to Active Directory Domain Services, you must manually exchange public keys between sites when secure key exchange is required.

Secure key exchange successfully enabled for all sites to be upgraded.

Reference: Site Properties Advanced tab.

About the Secure Key Exchange Parameters

How to Manually Exchange Public Keys Between Sites

Configure any new site system computers with the appropriate permissions to allow site system installation.

Permissions properly configured on all computers that will host site system roles. The primary site server computer account requires local administrative rights on remote management point and SQL Server site database servers.

Reference: Configuration Manager Site System Planning.

Apply Active Directory schema extensions (if applicable).

Active Directory schema has been extended for Configuration Manager.

Reference: Decide If You Should Extend the Active Directory Schema

Extending the Active Directory Schema for Configuration Manager

Run the Setup Prerequisite Checker on site systems.

Run from the splash screen independently of Setup Wizard on site system computers.

Reference: About the Setup Prerequisite Checker.

Resolve any errors or warnings identified by the Setup Prerequisite Checker (if applicable).

All prerequisite check errors and warnings resolved.

Reference: Setup Prerequisite Checks.

Manually download updated client installation prerequisite files (if the site servers to be upgraded will not have Internet connectivity).

Updated client installation prerequisite files downloaded successfully and stored where the site servers will be able to access them during site setup.

Reference: Prerequisite Component Update Checker.

Restart site system computers.

No files are flagged as pending restart before beginning the installation process.

Use the Configuration Manager Setup Wizard to upgrade the central site server.

Successful site installation.

Reference: Custom Setup Overview

Configuration Manager In-Place Upgrade

Verify that all site systems have been upgraded (uninstalled and reinstalled) successfully.

If applicable: Ensure the existing SMS 2003 version of the ITMU is successfully upgraded to support SMS 2003 clients in the hierarchy.

Site systems upgraded successfully, and site status is green.

Reference: Site Status Home Page.

Use Configuration Manager Setup to upgrade child primary and secondary sites.

All sites successfully upgraded.

Reference: Custom Setup Overview

Configuration Manager 2007 Upgrade Checklist

Configuration Manager In-Place Upgrade

Configuration Manager Side-By-Side Upgrade

Upgrading Secondary Sites

Install new site systems as necessary.

If applicable: Install WSUS 3.0, and configure software update point synchronization to support software updates for SMS 2003 clients as they are upgraded to the Configuration Manager client version.

All required site systems installed and configured successfully.

Reference: How to Configure Site Systems

How to Configure Site System Roles

Run Configuration Manager Setup Wizard to upgrade existing SMS 2003 Administrator consoles.

Administrator consoles upgraded successfully.

Reference: Custom Setup Overview

How to Upgrade an SMS 2003 Administrator Console

Select a client deployment method to upgrade, and if necessary, re-assign clients to new sites.

All clients successfully upgraded.

Reference: Tasks for Installing Configuration Manager Clients

Perform post-upgrade checks.

The upgraded site is functioning normally and configured for use.

Reference: Configuration Manager Post Setup Considerations.

See Also

Concepts

Example Configuration Manager Deployment Checklists
Example Configuration Manager Deployment Scenarios

Other Resources

Appendixes


State Messages in Configuration Manager 2007

State messages are sent by Configuration Manager 2007 clients to fallback status point or management point site systems to report the current state of Configuration Manager 2007 client operations. Reports can be created and used to view state messages sent by Configuration Manager 2007 clients.

Each Configuration Manager 2007 feature that uses state messages is identified by the topic type of the state message. The state message topic types listed in the following table can be used to define the Configuration Manager 2007 feature that a state message relates to.

Topic Type | Description
200 | NAP
300 | SUM_ASSIGNMENT_COMPLIANCE
301 | SUM_ASSIGNMENT_ENFORCEMENT
302 | SUM_ASSIGNMENT_EVALUATION
400 | SUM_CI_DETECTION
401 | SUM_CI_COMPLIANCE
402 | SUM_CI_ENFORCEMENT
403 | DCM_CI_SCAN
500 | SUM_UPDATE_DETECTION
501 | SUM_UPDATE_SOURCE_SCAN
700 | RESYNC_STATE_MSG
701 | SYSTEM_HEARTBEAT
702 | DDM ClientKeyData change
800 | CLIENT_DEPLOYMENT
900 | BRANCH_DP
1000 | CLIENT_FRAMEWORK_COMM
1001 | CLIENT_FRAMEWORK_LOCAL
1002 | DEVICE_CLIENT_FRAMEWORK_COMM
1003 | DEVICE_CLIENT_FRAMEWORK_LOCAL
1004 | DEVICE_CLIENT_FRAMEWORK_CERTIFICATE
1100 | CLIENT_FRAMEWORK_MODEREADINESS
1500 | CAL_TRACK_UT
1501 | CAL_TRACK_UL
1502 | CAL_TRACK_MT
1503 | CAL_TRACK_ML

State Messages Sent by Configuration Manager Clients

The following table lists the ID number and description for state messages sent by Configuration Manager clients. State message IDs are used to define specific state messages for each topic type. The state message description describes the state message sent by clients.

Topic Type | State Message ID | State Message Description
300 | 0 | Compliance state unknown
300 | 1 | Compliant
300 | 2 | Non-compliant
300 | 3 | Conflict detected
301 | 0 | Enforcement state unknown
301 | 1 | Installing update(s)
301 | 2 | Waiting for restart
301 | 3 | Waiting for another installation to complete
301 | 4 | Successfully installed update(s)
301 | 5 | Pending system restart
301 | 6 | Failed to install update(s)
301 | 7 | Downloading update(s)
301 | 8 | Downloaded update(s)
301 | 9 | Failed to download update(s)
301 | 10 | Waiting for maintenance window before installing
302 | 0 | Evaluation state unknown
302 | 1 | Evaluation activated
302 | 2 | Evaluation succeeded
302 | 3 | Evaluation failed
400 | 0 | Detection state unknown
400 | 1 | Not Required
400 | 2 | Not Detected
400 | 3 | Detected
401 | 0 | Compliance state unknown
401 | 1 | Compliant
401 | 2 | Non-Compliant
401 | 3 | Conflict Detected
401 | 4 | Error
402 | 0 | Enforcement state unknown
402 | 1 | Enforcement started
402 | 2 | Enforcement waiting for content
402 | 3 | Waiting for another installation to complete
402 | 4 | Waiting for maintenance window before installing
402 | 5 | Restart required before installing
402 | 6 | General failure
402 | 7 | Pending installation
402 | 8 | Installing update
402 | 9 | Pending system restart
402 | 10 | Successfully installed update
402 | 11 | Failed to install update
402 | 12 | Downloading update
402 | 13 | Downloaded update
402 | 14 | Failed to download update
500 | 0 | Detection state unknown
500 | 1 | Update is not required
500 | 2 | Update is required
500 | 3 | Update is installed
501 | 0 | Scan state unknown
501 | 1 | Scan is waiting for content
501 | 2 | Scan is running
501 | 3 | Scan completed
501 | 4 | Scan is pending retry
501 | 5 | Scan failed
501 | 6 | Scan completed with errors
501 | 7 | SMS 2003 client
800 | 100 | Client deployment started
800 | 301 | Unknown client deployment failure.
800 | 302 | Failed to create the ccmsetup service
800 | 303 | Failed to delete the ccmsetup service
800 | 304 | Cannot install over embedded operating system with File Based Write Filter (FBWF) enabled on system drive
800 | 305 | Native security mode is not valid on Windows 2000
800 | 306 | Failed to start ccmsetup download process
800 | 307 | Non-valid ccmsetup command line
800 | 308 | Failed to download file over WINHTTP at address
800 | 309 | Failed to download files through BITS at address
800 | 310 | Failed to install BITS version
800 | 311 | Can't verify that prerequisite file is MS signed
800 | 312 | Failed to copy file because disk is full
800 | 313 | Client.msi installation failed with MSI error
800 | 314 | Failed to load ccmsetup.xml manifest file
800 | 315 | Failed to obtain client certificate
800 | 316 | Prerequisite file is not MS signed
800 | 317 | Reboot required to continue installation
800 | 318 | Can't install the client on the MP because the MP and client versions don't match
800 | 319 | Operating system or service pack not supported
800 | 400 | Client deployment succeeded
800 | 500 | Client assignment started
800 | 601 | Unknown client assignment failure
800 | 602 | The following site code is invalid
800 | 603 | Failed to assign to MP
800 | 604 | Failed to discover default management point
800 | 605 | Failed to download site signing certificate
800 | 606 | Failed to auto discover site code
800 | 607 | Site assignment failed; client version higher than site version
800 | 608 | Failed to get Site Version from Active Directory Domain Services and SLP
800 | 609 | Failed to get client version
800 | 700 | Client assignment succeeded
1000 | 1 | Client successfully communicating with management point
1000 | 2 | Client failing to communicate with management point
1001 | 1 | Client successfully retrieving certificate from local certificate store
1001 | 2 | Client failing to retrieve certificate from local certificate store
1100 | 1 | Client not ready for native mode
1100 | 2 | Client ready for native mode

See Also

Concepts

About Reports for Configuration Manager Clients

Other Resources

Appendixes


Microsoft System Center Configuration Manager

Topic last updated—May 2008

Term | Definition
Active Directory Security Group Discovery method | A Configuration Manager discovery method that searches for security group resources by polling the closest Active Directory domain controller.
Active Directory System Discovery method | A Configuration Manager discovery method that searches for system resources by polling the closest Active Directory domain controller.
Active Directory System Group Discovery method | A Configuration Manager discovery method that searches for system group resources by polling the closest Active Directory domain controller.
Active Directory User Discovery method | A Configuration Manager discovery method that searches for computer user resources by polling the closest Active Directory domain controller.
Active Management Technololgy (AMT) | An Intel networking management technology that is supported by Configuration Manager out of band management, which enables a Configuration Manager administrator to manage desktop computers independently from the Configuration Manager client or the computer operating system.
active software update point | The software update point for a site that interacts with Windows Server Update Services (WSUS) to configure software updates settings and manage software updates synchronization. There is only one active software update point configured for a site.
Advanced Client | An SMS 2003 client type, supported on Windows 2000 or later operating systems, that can be assigned to a Configuration Manager mixed mode site.
advertise | To make a program, software update deployment, or task sequence available to clients via a collection.
advertisement | A Configuration Manager object that the site server sends as a notification to the management points, specifying that a program, software update deployment, or task sequence is available for clients.
Asset Intelligence | A Configuration Manager feature that allows administrators to inventory and manage software license usage throughout their enterprise.
Asset Intelligence Knowledge Base | A part of the Asset Intelligence feature that is used to produce new reports that identify and categorize deployed hardware and software assets.
assigned management point | The default management point at the assigned primary site for the Configuration Manager client.
assigned program | A program that has been advertised to a Configuration Manager collection and that clients are required to run.
assigned site | A site to which a Configuration Manager client is currently assigned.
backup snapshot | A snapshot of a site’s data, created by the Backup Configuration Manager Site Server task or by another backup utility, used during a site recovery process to restore the site’s data.
binary delta replication | The copying of only the changed portions of a Configuration Manager package or program file rather than the entire file when an update has been made.
boundary | An IP subnet, IP address range, IPv6 prefix or Active Directory site that is used to define the scope of administrative control for a Configuration Manager site. Boundaries are used by the site to determine which distribution points are closest for retrieving content and used by the client to determine which site it should be assigned to.
branch distribution point | A Configuration Manager site system that has the role of storing package source files and is designed to be located in a distributed location with limited network bandwidth or a limited number of clients.
central site | The primary site at the top of the Configuration Manager hierarchy, to which all other sites in the system report their inventory, site configurations, software metering data, and status.
collection-limited query | A query scoped to include only resources that are in a specified collection.
component server | A Configuration Manager site system role that is filled by any site system running a component installed by Configuration Manager Site Component Manager. The only site system that is not a component server is the distribution point.
Configuration Manager health state reference | A reference that is published to Active Directory to refer to Configuration Manager NAP policy and stored for the System Health Validator (SHV) to use in determining policy compliance.
Configuration Manager hierarchy | A collection of one or, typically, more Configuration Manager sites bound together via child-parent relationships. The site at the top of the hierarchy is known as the central site.
Configuration Manager site | A collection of clients and Configuration Manager site systems that are bounded by a group of subnets, such as IP subnets or an Active Directory site, and which are specified by a Configuration Manager administrator as a site.
Configuration Manager site database | A Microsoft SQL Server database that stores Configuration Manager site data, such as discovery data, configuration data, status messages, and inventory data. Every primary site has a Configuration Manager site database. The server supporting the Configuration Manager site database is automatically assigned the site database server role.
Configuration Manager software distribution | A Configuration Manager feature that automatically distributes software programs to Configuration Manager client computers.
Configuration Manager software inventory | A Configuration Manager feature that automatically gathers information about software on clients in a Configuration Manager site.
Configuration Manager software metering | The Configuration Manager feature that monitors software usage on client computers.
Courier Sender | A Configuration Manager communication mechanism that enables you to create and send package information to another Configuration Manager site through non-network channels.
data discovery record (DDR) | The file format (.ddr) and the actual file that is used by Configuration Manager to report discovery data to a Configuration Manager site database.
DCM Digest | A predefined XML schema used by Configuration Manager 2007 that is used with the desired configuration management feature to create and validate configuration baselines and configuration items.
DDR | See Other Term: data discovery record (DDR)
default management point | The active management point for a site, which could also be an IP address of a Network Load Balancing (NLB) cluster that combines several management points.
delta inventory file | A file generated after Configuration Manager performs a complete inventory, containing only hardware or software properties that were added, removed, or changed since the previous inventory cycle.
delta replication | The copying of only the changed Configuration Manager package or program file rather than the entire package or program when an update has been made.
desired configuration management | A Configuration Manager feature that provides a set of tools and resources for assessing and tracking configuration compliance of client computers in the enterprise.
device management point | A Configuration Manager site system that communicates with mobile device clients and that must be hosted on a Configuration Manager management point.
direct membership rule | A collection membership rule that targets an individual resource, such as a user, user group, or a Configuration Manager client.
discovery data | A set of properties collected by a discovery method that reflects the attributes of a Configuration Manager resource.
distribution point | A site system that has the role of storing package source files. Clients contact distribution points to obtain source files when they run advertised programs, advertised task sequences, or deployed software updates.
distribution point group | A set of distribution points that you can manage as a single entity.
fallback status point | A Configuration Manager site system that gathers state messages from clients that cannot install properly, cannot assign to a Configuration Manager site, or cannot communicate securely with their assigned management point.
global roaming | The capability of roaming to lower level sites, higher level sites, and sibling sites. This roaming method requires Active Directory Domain Services and the Configuration Manager Active Directory schema extensions.
Heartbeat Discovery method | A Configuration Manager discovery method that is used to update data discovery records (DDRs) for each Configuration Manager client on a set schedule to ensure that they remain current in the site database.
hierarchy branch | A group of Configuration Manager sites, interconnected via child/parent site connections, that report up to the same primary site.
IDMIF file | A type of Management Information Format (MIF) file that can be used to add new architectures or updates to existing architectures in the Configuration Manager site database to accommodate custom hardware inventory properties.
Internet-based client management | A feature in Configuration Manager that allows you to manage computers that have the Configuration Manager client agent but do not connect into the network through a VPN or dial-up connection.
Internet-based site system | A site system role that allows connections from clients when they are managed over the Internet.
Internet-based software update point | The software update point for a site that accepts communication from only client computers on the Internet. There can be only one active Internet-based software update point.
maintenance window | A period of time, defined by administrators, when changes can be made on the systems that are members of a Configuration Manager collection.
Managed Object Format (MOF) | The file type, based on the Interface Definition Language (IDL), that describes management information. The MOF syntax is a way to describe object definitions in textual form.
management controller | The hardware and firmware component on desktop motherboards that supports out of band management in Configuration Manager 2007 SP1.
Management Information Format (MIF) file | The file type (.mif) that can be used to modify the Configuration Manager database by creating architectures, object classes, and attributes.
management point | The Configuration Manager site system role that serves as the primary point of contact between Configuration Manager clients and the Configuration Manager site server.
membership rule | The criteria by which Configuration Manager evaluates whether a resource belongs to a particular collection. A membership rule can be a query, or it can explicitly specify a resource.
MIF file | See Other Term: Management Information Format (MIF) file
mixed mode | An operational mode of Configuration Manager 2007 that provides backward compatibility with SMS 2003 sites and provides a basic level of security for organizations that cannot meet the PKI requirements for native mode.
MOF | See Other Term: Managed Object Format (MOF)
NAP-capable client | A Windows-based client that supports Network Access Protection.
native mode | A security-based operational mode setting in Configuration Manager, where the site server signs all policies and where site systems require mutually authenticated SSL connections to client computers.
Network Discovery method | The Configuration Manager discovery method that enables the Configuration Manager administrator to discover any network resources that are IP addressable.
NOIDMIF file | A custom Management Information Format (MIF) file that Configuration Manager administrators can use to modify or append object classes and properties to existing client inventory data.
operating system deployment | A Configuration Manager feature that allows you to create operating system images and deploy those images to target computers.
out of band management | A feature in Configuration Manager 2007 SP1 that allows computers to be managed outside standard management channels by connecting to a supported management controller. This management channel is independent from the Configuration Manager client and the operating system.
out of band service point | A Configuration Manager 2007 SP1 site system that has the role of provisioning computers for out of band management.
package | A Configuration Manager object that contains the files and instructions for distributing software, software updates, boot images, operating sytem images, and drivers to Configuration Manager client computers.
package definition file | An ASCII text file that contains predefined software distribution objects, such as programs and packages to be used for software deployment.
package refresh | A Configuration Manager software distribution operation in which the compressed package source files are redistributed to distribution points to repair a package.
package source directory | A directory containing Configuration Manager package source files that are used for package distribution.
package source file | In a Configuration Manager package, the software file or files that are being deployed to clients.
package update | A Configuration Manager software distribution operation in which updated package source files are recompressed, the package version is incremented, and then the package is redistributed to distribution points.
preferred sender | The sender specified in the package properties to use when sending the package to a child site.
primary site | A Configuration Manager site that is configured to store its information in a SQL Server database.
protected distribution point | A Configuration Manager distribution point that has boundaries configured to prevent clients outside the boundaries from retrieving packages.
proxy management point | A secondary Configuration Manager site management point that services the Configuration Manager clients that are within its boundaries.
PXE service point | A Configuration Manager site system that initiates a PXE operating system deployment process. The PXE service point responds to network PXE boot requests and determines the appropriate actions to take.
remediation server | A server that is used to update the computer state by providing software updates, new antivirus signatures, additional intrusion detection signatures, and so on.
Report Viewer | A reporting tool, accessible through the Configuration Manager console, that uses your Web browser as a report viewer.
reporting point | A Configuration Manager site system that hosts the Report Viewer component for Web-based reporting functionality.
Reporting Services point | The site system server role for SQL Reporting Services integration.
resident management point | The default Configuration Manager management point of the site in which a globally roaming client is currently located.
Resource Explorer | A Configuration Manager console feature that displays the hardware and software inventory that has been collected from clients.
secondary site | A Configuration Manager site that does not require a dedicated SQL Server database, is always a child of a primary site, and is administered solely through its parent or through another primary site above it in the Configuration Manager site hierarchy.
security context | The Configuration Manager security attributes or rules that are currently in effect.
send request file | A Configuration Manager file with instructions that a sender uses to connect to and transfer data to a destination.
server locator point | A Configuration Manager site system that completes site assignment and can locate management points for Configuration Manager clients when clients cannot retrieve that information from Active Directory Domain Services or other mechanisms.
service component | A Configuration Manager program that runs as a service that can be started and stopped through the Services icon in Control Panel or the Computer Management administrative tool.
site assignment | The process of including selected resources in a Configuration Manager site.
site assignment rules | A group of site boundaries that a Configuration Manager administrator defines for a Configuration Manager site.
site code | A three-character code that Configuration Manager uses to uniquely identify a Configuration Manager site. The site code is specified during the site installation and cannot be changed after installation.
site control file | An ASCII text file that contains the settings of a Configuration Manager site.
site database server | A Configuration Manager site system role assigned to the computer that hosts the Configuration Manager site database (a SQL Server database). The computer might or might not be the site server.
site server | The Configuration Manager site sytem role assigned to the server on which Configuration Manager Setup has been run successfully. When Configuration Manager is installed on a computer, that computer is automatically assigned the site server role. Every Configuration Manager site has one site server.
site system | A server that provides Configuration Manager functionality to a Configuration Manager site.
SMS Executive | The primary Configuration Manager service, which accesses and updates the database and manages many different process threads.
SMS Installer | An SMS tool that enables you to create customized, self-extracting, software installation files.
SMS Provider | A WMI provider that allows both read and write access to the Configuration Manager 2007 site database.
software metering | A Configuration Manager feature that monitors program usage on client computers.
software update point | A Configuration Manager site role that is configured on a computer running WSUS.
stand-alone site | A Configuration Manager site with no parent sites and no child sites and which is always displayed as a central site on the site properties.
standard distribution point | A Configuration Manager distribution point that has the role of storing package source files and has not been specifically designated as a branch distribution point.
Standard Sender | A Configuration Manager communication mechanism that enables you to create and send package information to another Configuration Manager site over standard network channels.
state message | A message type used to identify at what stage a Configuration Manager client process succeeded, failed, or stopped.
state migration point | A Configuration Manager site system role that stores user state data while a computer is being migrated to a new operating system.
status filter rule | A filtering rule that controls how status messages are reported and viewed.
status message | A message generated by a Configuration Manager component and viewed in the Status Message Viewer. Status messages differ from operating system events in that they represent the flow of activity within a Configuration Manager site.
status message threshold | The limit that defines when the summary status for a component or site system should indicate OK, Warning, or Critical status.
Status Message Viewer | A tool in the Configuration Manager console that is used to browse the status messages in the Configuration Manager site database.
status summarizer | Consolidates the data generated by Configuration Manager status messages into a succinct view of the status of a component, a server, a package, or an advertisement.
status summary | A data set that is generated by the Configuration Manager status summarizer.
System Health Validator point | The site system role assigned to the Network Policy Servers for a Configuration Manager 2007 site.
task sequence | The mechanism in Configuration Manager for performing multiple steps or tasks on a client computer at the command-line level without requiring user intervention.
thread component | A Configuration Manager program that runs as a thread of the SMS Executive service component. A thread component can be started and stopped through the SMS Service Manager.
trusted root key | An encryption key used in Configuration Manager to help clients identify valid management points.
unmanaged client | A client that is not communicating with its assigned site in the Configuration Manager hierarchy and therefore cannot receive policy or upload inventory data.
wake-up packet | A packet sent by Configuration Manager's primary site server when using Wake On LAN to bring targeted computers out of a sleep state so that they can perform a management function, such as installing a mandatory software update.


Configuration Manager Icons

Icon | Icon Name | Description
Advertisement Icon | Advertisement icon | Specifies a normal advertisement.
Central Site Icon | Central Site icon | Specifies a Configuration Manager central site.
Configuration Manager client icon | Client icon | Indicates the Configuration Manager client computer.
Client Agent Icon | Client Agent icon | Specifies a Configuration Manager client agent.
Collection Icon | Collection icon | Specifies a collection that can be modified at the current site.
Critical Icon | Critical icon | Indicates that the specified item is critical in importance. In the user interface, this is used to indicate an item or object that is required.
Delete Icon | Delete icon | Specifies that the selected item will be deleted.
Deployment Contains Expired Updated Icon | Deployment contains expired update icon | Specifies that at least one software update in the deployment is expired.
Deployment Icon | Deployment contains superseded update icon | Specifies that at least one software update in the deployment has been superseded by another update.
Software Normal Deployment Icon | Deployment icon | Specifies a normal deployment.
Software Normal Deployment Package Icon | Deployment package icon | Specifies a normal deployment package that was created at the current site.
Software Distribution Normal Template Icon | Deployment template icon | Specifies a normal deployment template.
Detail Icon | Detail icon | Opens a dialog box containing additional detail about the select object.
Device Advertisement Icon | Device Advertisement icon | Specifies an advertisement to a device.
Software Update Icon | Expired software update icon | Specifies that the software update is expired and should not be deployed.
Invalid Software Update Icon | Invalid software update icon | Specifies that the software update is invalid. This usually occurs when the update file is missing for the software update. To resolve this issue, download the software update to a deployment package.
Lock Icon | Lock icon | Specifies that the object is locked.
locked collection icon | Locked Collection icon | Specifies that the collection is locked and cannot be changed. This is usually seen at a child site when the collection has been created at a parent site.
Software Deployment Locked Icon | Locked Deployment icon | Specifies that the deployment is locked. This occurs when a deployment is created at a site higher in the Configuration Manager hierarchy and propagated down. Deployments can be modified only from the site from where it was created.
Software Deployment Locked Icon | Locked deployment package icon | Specifies that the deployment package is locked. This occurs when a deployment package is created at a site higher in the Configuration Manager hierarchy and propagated down. Deployment packages can be modified only from the site from where it was created.
Software Update Locked Icon | Locked software update icon | Specifies that the software update is locked. This occurs when a software update is created at a site higher in the Configuration Manager hierarchy and propagated down. Software updates can be modified only from the site where it was created.
Software Update List Locked Icon | Locked update list icon | Specifies that the update list is locked. This occurs when an update list is created at a site higher in the Configuration Manager hierarchy and propagated down. Update lists can be modified only from the site from where it was created.
Move Down Icon | Move Item Down icon | Moves the selected item down one space in the list.
Move Up Icon | Move Item Up icon | Moves the selected item up one space in the list.
New Icon | New icon | Opens a dialog to create a new object.
Install New Program Icon | New Install Program icon | Specifies a new install program.
Run New Program Icon | New Run Program icon | Specifies a new run program.
Package Icon | Package icon | Specifies a normal package.
Primary Site Icon | Primary Site icon | Specifies a Configuration Manager primary site.
Program Icon | Program icon | Specifies a normal program.
Properties Icon | Properties icon | Opens a dialog box containing properties of the selected item, usually allowing the user to modify those properties.
Query Icon | Query icon | Specifies a Configuration Manager query.
Secondary Site Icon | Secondary Site icon | Specifies a Configuration Manager secondary site.
Normal Update Software Icon | Software update icon | Specifies a normal software update.
Sort Down Arrow Icon | Sorting Down Arrow icon | Sorts the accompanying list in descending order according to the specified column.
Sort Up Arrow Icon | Sorting Up Arrow icon | Sorts the accompanying list in ascending order according to the specified column.
Supersede Software Update Icon | Superseded software update icon | Specifies a software update that has been superseded by another update.
System Site Icon | System Site icon | Specifies a Configuration Manager system site.
Security Shield Icon | UAC Security Shield icon | Specifies that the object is UAC (LUA) security enabled.
Uninterpreted Configuration Icon | Uninterpreted configuration item icon | A configuration item imported into desired configuration management that cannot be interpreted by the Configuration Manager console. Consequently its properties cannot be viewed or edited in the console.
Normal Update List Icon | Update list icon | Specifies a normal update list that was created at the current site.
Warning Icon | Warning icon | Indicates a warning associated with the accompanying object. This is often used to call particular attention to text in the user interface.

See Also

Concepts

Icon Glossary for Software Updates


Windows Me

The information for this page has been moved to the following location: Accessibility in Microsoft Windows


Install the Configuration Manager Client (Mixed Mode)

You must carefully plan how you will deploy the Microsoft System Center Configuration Manager 2007 client software to computers. You can use any of the following deployment methods:

  • Software-update-point-based installation
  • Client Push Installation
  • Manual installation
  • Group Policy installation
  • Logon script installation
  • Imaging
  • If you are upgrading from Systems Management Server 2003, you can also deploy the new Configuration Manager Client to the SMS 2003 clients using software distribution.

All of the client methods have different dependencies, requirements, and security concerns. Choose the client installation method that best fits your environment and business requirements.

For more information, see the following:

  • Determine the Configuration Manager Client Installation Method to Use
  • Tasks for Installing Configuration Manager Clients

Installing a Test Client

There is no single recommended way to deploy clients, but the following method is suitable for testing basic client functions.

On the test client, run the following command from a command prompt:

\\<site server>\SMS_<site code>\client\ccmsetup.exe /mp:<management point> SMSSITECODE=<site code> FSP = <fallback status point>

If you need a server locator point, include the following property: SMSSLP = <server locator point>.

Use the following table if you need more information about replacing the placeholder values.

When specifying a server, you can use a fully qualified domain name (FQDN), a short name (host name or NetBIOS name), or an IP address.

<placeholder value> | Description
<site server> | The computer from where you ran Configuration Manager 2007 Setup.
<site code> | The three-character site code.
<management point> | The computer you configured with the management point role.
<fallback status point> | The computer you configured with the fallback status point role.
<server locator point> | The computer you configured with the server locator point role.

Example

To install a client by running CCMSetup with the following values:

  • A site server named SJC003
  • A site code of SJC
  • A management point named SJC020
  • A fallback status point named SJC021

Type: \\SJC003\SMS_SJC\Client\CCMSetup.exe /mp:SJC020 smssitecode=SJC FSP=SJC021

To install the same client if it must use a server locator point that is named SJC025:

Type: \\SJC003\SMS_SJC\Client\CCMSetup.exe /mp:SJC020 smssitecode=SJC FSP=SJC021 SMSSLP = SJC025

Additional Information for Client Deployment

Client deployment documentation: Planning and Deploying Clients for Configuration Manager 2007.

Administrator checklist for client deployment: Administrator Checklist: Deploying Configuration Manager Clients.

Troubleshooting: Troubleshooting Configuration Manager Client Deployment.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push
How to Install Configuration Manager Clients Using Software Update Point Based Installation
How to Upgrade Clients Using Software Distribution in Configuration Manager
How to Install Configuration Manager Clients Using Computer Imaging

Concepts

How to Install Configuration Manager Clients Manually
How to Install Configuration Manager Clients Using Group Policy
How to Install Configuration Manager Clients Using Logon Scripts
About Configuration Manager Client Installation Properties
Determine the Configuration Manager Client Installation Method to Use


Configure Your Client Agents

Client agents are System Center Configuration Manager 2007 components that run on top of the base client components.

If you install only the Configuration Manager Client without enabling any client agents, Configuration Manager 2007 cannot manage the client. Every client agent that you enable lets you use a different feature of Configuration Manager 2007. You can configure the client agents to suit your environment.

Did you install Configuration Manager 2007 using simple Setup, or custom Setup?

  • If you installed Configuration Manager 2007 with the simple Setup option, some client agents were enabled by default.
  • If you installed Configuration Manager 2007 with the custom Setup option, you had the opportunity to select which client agents you wanted to enable.

How to Enable and Configure Client Agents

Use the following procedure to enable and configure client agents. For a description of each client agent, see the following section.

To enable and configure client agents:

  1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site code> - <site name> / Site Settings / Client Agents.

  2. Right-click the client agent you want to configure, and then click Properties.

  3. Enable and configure the client agent. For more information, see the Help topic for each property page.

  4. Click OK.

Client Agents

The client agents available in Configuration Manager 2007 are listed in the following table.

Client Agent Description

Computer Client Agent Properties

Configures how often client computers retrieve the policy that gives them the rest of their configuration settings.

For example, after you configure the other client agent settings, Configuration Manager puts those settings into policy and sends them to the management point and client computers poll for them on the schedule you configure.

This agent also controls settings that are shared by several Configuration Manager features, such as how often users are prompted with reminders and what customized organization names users see with the reminders.

Device Client Agent Properties

Configures all of the properties specific to mobile device clients.

Mobile device clients have settings for software distribution, software inventory, hardware inventory, and file collection.

This agent also controls the polling interval used by mobile device clients.

Hardware Inventory Client Agent

Enables and configures the agent that collects a wide variety of information about the client computer.

Information about the computer hardware is most commonly collected, but you can inventory any information stored in the Windows Management Instrumentation repository of the computer, such as registry keys.

You can configure how often the client computer checks its inventory and sends the information to the site.

Software Inventory Client Agent

Enables and configures which files Configuration Manager inventories and collects.

Copies of collected files are stored in the Configuration Manager database.

Advertised Programs Client Agent

Enables and configures the software distribution feature.

Desired Configuration Management Client Agent

Enables the client agent that evaluates whether computers are in compliance with configuration baselines that are assigned to them.

You can also configure the default compliance evaluation schedule for assigned configuration baselines.

Remote Tools Client Agent

Enables Configuration Manager remote control and configures Configuration Manager integration with Remote Assistance.

Network Access Protection Client Agent

Enables Configuration Manager Network Access Protection, which allows you to configure how client computers are evaluated for compliance with software updates. If client computers are not in compliance with the configured policies, for example, if they do not have specified software updates, a Network Policy Server on Windows Server® 2008 can prevent the client computers from accessing network resources until they complete remediation measures.

Configuring this client agent without proper planning and deployment can prevent your client computers from accessing the network.

Software Metering Client Agent

Enables the agent that monitors which software is run and how often and configures how often software metering data is collected.

Software Updates Client Agent

Enables the agent that scans for and installs software updates on client computers.

This agent allows you to configure how often clients are reevaluated for software updates that were previously installed.

Before you can use the software update feature, you must also install Windows Server Update Services and configure a software update point.

There is no client agent for operating system deployment.

See Also

Concepts

Understanding Configuration Manager Clients
Understanding Configuration Manager Features
Choose Which Configuration Manager Features You Need


Windows 2000

The information for this page has been moved to the following location: Accessibility in Microsoft Windows


Help Not Available

The Help topic that you requested is not available.

Help us improve the documentation - send feedback to smsdocs@microsoft.com.


MMC Navigation Keyboard Shortcuts

The information for this page has been moved to the following location: Keyboard and Mouse Shortcuts for Configuration Manager 2007


MMC Console Window Keyboard Shortcuts

The information for this page has been moved to the following location: Keyboard and Mouse Shortcuts for Configuration Manager 2007


Virtual Application Packages Node Properties

This page is no longer applicable to Configuration Manager 2007 R2.

In This Section

Virtual Application Packages Node Properties - General Tab

See Also

Other Resources

Virtual Application Packages Property Pages


Windows Vista

The information for this page has been moved to the following location: Accessibility in Microsoft Windows


Configuration Manager Console Keyboard Shortcuts

The information for this page has been moved to the following location: Keyboard and Mouse Shortcuts for Configuration Manager 2007


Install the Configuration Manager Client (Native Mode)

You must carefully plan how you will deploy the Configuration Manager 2007 client software to computers. You can use any of the following client deployment methods:

  • Software-update-point-based installation
  • Client push installation
  • Manual installation
  • Group Policy installation
  • Logon script installation
  • Imaging

If you are upgrading from Systems Management Server 2003, you can also deploy the new Configuration Manager Client to the SMS 2003 clients using software distribution.

All of the client methods have different dependencies, requirements, and security concerns. Choose the client installation method that best fits your environment and business requirements.

For more information, see the following:

  • Determine the Configuration Manager Client Installation Method to Use
  • Tasks for Installing Configuration Manager Clients

Installing a Test Client

There is no single recommended way to deploy clients, but the following method is suitable for testing basic client functions.

On the test client, run the following command from a command prompt:

\\<site server>\SMS_<site code>\client\ccmsetup.exe /mp=<management point> SMSSITECODE=<site code> FSP = <fallback status point>

If you need a server locator point, include the following properties: /NATIVE: crlandfallback and SMSSLP = <server locator point>.

Use the following table if you need more information about replacing the placeholder values.

When specifying a server, you can use a fully qualified domain name (FQDN), a short name (host name or NetBIOS name), or an IP address.

<placeholder value> | Description
<site server> | The computer from where you ran Configuration Manager 2007 Setup.
<site code> | The three-character site code.
<management point> | The computer you configured with the management point role.
<fallback status point> | The computer you configured with the fallback status point role.
<server locator point> | The computer you configured with the server locator point role.

If your client cannot locate site information from Active Directory Domain Services, consider including the installation property SMSSIGNCERT= <Full path and filename>. For more information, see Decide How to Deploy the Site Server Signing Certificate to Clients (Native Mode).

Example

To install a client by running CCMSetup with the following values:

  • A site server named SJC003
  • A site code of SJC
  • A management point named SJC020
  • A fallback status point named SJC021

Type: \\SJC003\SMS_SJC\Client\CCMSetup.exe /mp:SJC020 smssitecode=SJC FSP=SJC021

To install the same client if it must use a server locator point that is named SJC025:

Type: \\SJC003\SMS_SJC\Client\CCMSetup.exe /NATIVE: crlandfallback /mp:SJC020 smssitecode=SJC FSP=SJC021 SMSSLP = SJC025

Additional Information for Client Deployment

Client deployment documentation: Planning and Deploying Clients for Configuration Manager 2007.

Administrator checklist for client deployment: Administrator Checklist: Deploying Configuration Manager Clients.

Troubleshooting: Troubleshooting Configuration Manager Client Deployment.

See Also

Tasks

How to Install Configuration Manager Clients Using Client Push
How to Install Configuration Manager Clients Using Software Update Point Based Installation
How to Upgrade Clients Using Software Distribution in Configuration Manager
How to Install Configuration Manager Clients Using Computer Imaging
How to Configure Request Ports for the Configuration Manager Client

Concepts

How to Install Configuration Manager Clients Manually
How to Install Configuration Manager Clients Using Group Policy
How to Install Configuration Manager Clients Using Logon Scripts
About Configuration Manager Client Installation Properties
Determine the Configuration Manager Client Installation Method to Use


MMC Navigation Mouse Shortcuts

The information for this page has been moved to the following location: Keyboard and Mouse Shortcuts for Configuration Manager 2007


Deploy Authentication Certificates to All Clients and the Management Point

In Configuration Manager 2007 native mode, all clients (client computers and mobile device clients), must have a client authentication certificate to authenticate the client to the following servers:

  • Management point
  • Proxy management point
  • Standard distribution point
  • Software update point
  • State migration point

Additionally, deploy a client authentication certificate to the management point and state migration point. This certificate is required even if these site systems do not have a Configuration Manager 2007 client installed on them.

Configuration Manager 2007 does not request the client certificates from a public key infrastructure (PKI) or install them on any of the computers or mobile devices you want to manage with Configuration Manager 2007. These must be deployed externally to Configuration Manager 2007.

Important
If you do not install the client authentication certificates on the computers and mobile devices prior to deploying Configuration Manager 2007 client software, the clients will not be able to communicate with the site.

For more information about deploying the client authentication certificates, see the following:

  • Deploying the Client Computer Certificates to Clients and the Management Point
  • Deploying Certificates to Mobile Device Clients

See Also

Tasks

How to Determine Whether Client Computers Are Ready for Native Mode
How to Identify Client Certificate Issues in Native Mode

Concepts

Certificate Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Configure your Fallback Status Point and Reporting Point

Fallback Status Point

The fallback status point is an optional but recommended site system role that helps you manage clients and identify any client-related problems. For example, if the site is in native mode and certificate issues are preventing communication, the fallback status point accepts unauthenticated communication so it can accept messages from clients to help you identify and remedy the problem.

Deploy the fallback status point before you deploy your clients so that you can assign the fallback status point to the clients as soon as they are installed.

The computer hosting the fallback status point role must have Internet Information Services (IIS) installed.

For more information, see the following:

  • About the Fallback Status Point in Configuration Manager
  • Determine If You Should Install a Fallback Status Point for Configuration Manager Clients

Reporting Point

A reporting point is an optional but recommended site server role that hosts files used by Configuration Manager 2007 so that you can see information in reports about the clients you are managing.

The computer hosting the reporting point role must have IIS installed.

For more information, see the following:

  • About Reporting Points
  • Reporting Overview

See Also

Tasks

How to Configure the Fallback Status Point in Configuration Manager
How to Create a Fallback Status Point in Configuration Manager
How to Identify Client Certificate Issues in Native Mode

Concepts

Reporting Configuration Checklist


Deploy a Web Server Certificate to Your Site Systems

In Configuration Manager 2007 native mode, many site system roles that run Internet Information Services, such as the management point, require a Web server authentication certificate to authenticate these servers to the client, and to encrypt all data transferred between them using Secure Sockets Layer (SSL).

Configuration Manager 2007 does not request the certificates from a public key infrastructure or install certificates on any of the site systems. These must be deployed externally to Configuration Manager 2007.

Important
If you do not install the Web server authentication certificate on the management point prior to deploying Configuration Manager 2007 clients, the clients will not be able to communicate with the site.

For more information about deploying the Web server certificates, see Deploying the Web Server Certificates to Site System Servers.

See Also

Concepts

Overview of Configuration Manager Cryptographic Controls
Certificate Requirements for Native Mode

Other Resources

Deploying the PKI Certificates Required for Native Mode


Virtual Application Packages Home Page

Topic last updated—January 2008

This page is no longer applicable to Configuration Manager 2007 R2

The Virtual Application Packages console tree node in Configuration Manager 2007 displays information about the virtual application packages that have been imported for use with Configuration Manager 2007. The Virtual Application Packages console tree node and subnodes are located in the console tree as follows:

System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Virtual Application Packages.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

When you click the Virtual Application Packages console tree node or subnodes, the Configuration Manager console contains the following elements:

Look for

Filters the contents that are displayed in the results pane based on a keyword in a specific column.

in

Searches a specific column for the text that was entered in the Look for text box. The default value for this item is All Columns.

Find Now

Initiates the filter.

Clear

Clears the filter and displays all possible results.

The Virtual Application Packages console tree node in Configuration Manager 2007, when highlighted, displays the following information about each virtual application package by default:

  • Name: Specifies the name of the virtual application package.
  • Manufacturer: Specifies the publisher of the virtual application package, as given in the virtual application package properties. You can also specify this information when you import a new virtual application package on the Package Information page.
  • Version: Specifies the version of the virtual application package, as given in the virtual application package properties.
  • Language: Displays the language specified for the virtual application package.
  • Package ID: Specifies the ID assigned by Configuration Manager 2007 to the selected virtual application package.

Selected<Virtual Application Package Name>

The <virtual application package name> console tree nodes display the individual virtual application packages that are defined in the virtual application packages list. Information specific to each virtual application package can be modified at this location. This data is sorted for each package by access accounts, distribution points, and programs. The following information is displayed for each virtual application package:

  • Access Accounts: Specifies the virtual application package access accounts that have been set for the given virtual application package. Additional data for each account can be seen by right-clicking the account and then clicking Properties. For more information, see Access Account Properties: General Tab.
    • Name: Specifies the name of the access account. If a Windows User Access Account is displayed, it will be in the following form: domain\username.
    • Type: Specifies the type of account, either a Generic Access Account or Windows User Access Account.
  • Access: Specifies the access permissions of the displayed access account for this package.
  • Distribution Points: Specifies the distribution points to which this virtual application package has been copied so that it can be available for download by client computers. Additional data for each distribution point can be seen by right-clicking the distribution point and then clicking Properties. For more information, see Distribution Point Properties: General Tab.
    • Name: Specifies the name of the distribution point.
    • Site: Specifies the site code and name of the site on which the distribution point is located.
    • Type: Specifies the site system type for the distribution point.

Actions for the Virtual Application Packages Node

The actions described in the following table are available from the Virtual Application Packages console tree node.

Action Description

New

Provides the following options:

  • Virtual Package: Opens the New Virtual Application Package Wizard, where you can manually create a new virtual application package. For more information about importing virtual application packages, see How to Import Virtual Application Packages into Configuration Manager.
  • Folder: Creates a new folder beneath the Packages node.
  • Search Folder: Opens the Search Folder Criterion dialog box, where you can design a query to search package folders on the site. For more information, see Search Folder Criteria Dialog Box.

Distribute

Provides the following distribution option:

  • Software: Opens the Distribute Software Wizard, where you can distribute virtual application packages to client computers. For more information, see Distribute Software Wizard.

Transfer Site Settings

Opens the Transfer Site Settings Wizard, where you can transfer site settings or virtual application packages and collection properties from a source site to one or more distribution points. For more information, see Transfer Site Settings Wizard.

Copy Packages

Opens the Copy Packages Wizard, where you can copy one or more virtual application packages from one distribution point to another. For more information, see Copy Packages Wizard.

View

Provides the following view options:

  • Add/Remove columns: Specifies which columns display in the results pane. Select the column name from the Available columns window, and click Add to add the column to the displayed columns. Select the column name from the Displayed columns window, and click Remove to remove the columns from the displayed columns. Click Restore Defaults to display the default columns. Click OK to save changes.
  • Export List: Creates a text file containing the names of each virtual application package.
  • Hide Search Bar: Hides the search bar.
  • Customize: Specifies which items are displayed in the Configuration Manager 2007 console window.

Properties

Opens the Virtual Packages Properties dialog box, where general virtual application package information and class security rights can be set on the object.

<Virtual Application Package Name>

The actions described in the following table are available from the <package name> console tree node.

Action Description

Update Distribution Points

Updates all sites and distribution points with the latest version of the virtual application package.

Manage Distribution Points

Opens the Manage Distribution Points Wizard, where you can manage the package on distribution points. For more information, see Manage Distribution Points Wizard.

Distribute

Provides the following distribution options:

  • Software: Opens the Distribute Software Wizard, where you can distribute software packages to client computers. For more information, see Distribute Software Wizard.
  • Software to Device: Opens the Distribute Software to Device Wizard, where you can distribute software to client devices.

Transfer Site Settings

Opens the Transfer Site Settings Wizard, which you can use to transfer Configuration Manager 2007 site settings or virtual application package properties from a source site to one or more destination sites.

Move Items

Opens the Move Items dialog box, allowing you to select the folder within the Packages node to which you can move the selected virtual application package. After the virtual application package has been moved, refresh the console tree to view the relocated virtual application package.

Cut

Cuts the selected package in preparation to move it to a folder in the Package node. The cut package is not removed or relocated until it is pasted in a new location. The new location must be a folder within the node, not another package.

Paste

Pastes a previously cut package in a new location within the Package node.

Delete

Opens the Delete Package Wizard, where you can view the results of deleting this package and then choose whether to remove it. For more information, see Delete Package Wizard.

Export List

Exports the data in the results pane to a Text or Unicode Text file that is tab or comma delimited.

Properties

Opens the Virtual Application Package Name Properties dialog box, where package properties and other information specific to this virtual application package can be set for the object. For more information, see Package Name Properties.

Access Accounts

The actions described in the following table are available from the Access Accounts console tree node.

Action Description

New

Provides the following options:

  • Generic Access Account: Creates a package access account mapped to a generic Windows access account. For more information, see Windows Account Dialog Box.
  • Windows User Access Account: Creates a package access account mapped to a specific Windows user access account. For more information, see Windows Account Dialog Box.

Delete

Removes the virtual application package access account and associated security rights. The Windows account to which the package access account is mapped is not affected.

Properties

Opens the Access Account Properties dialog box, where security rights can be set for individual access accounts on the object.

For more information, see Access Account Properties: General Tab.

Distribution Points

The actions described in the following table are available from the Distribution Points console tree node.

Action | Description
New Distribution Points | Opens the New Distribution Points Wizard, where you can copy the virtual application package to a new distribution point for client download. For more information, see New Distribution Points Wizard.
Update Distribution Points | Updates all sites and distribution points with the latest version of the virtual application package.
Manage Distribution Points | Opens the Manage Distribution Points Wizard, where you can manage the virtual application package on distribution points. For more information, see Manage Distribution Points Wizard.
Refresh Distribution Point | Resends the package to the selected distribution point.
Delete | Removes the package from the selected distribution point and deletes the point from the list of distribution points associated with the package. For more information, see How to Remove a Package from a Distribution Point.
Properties | Opens the Distribution Points Properties dialog box, where general distribution point information is displayed. For more information about this dialog box, see Distribution Point Properties: General Tab.

See Also

Other Resources

Software Distribution Home Pages


MMC Main Window Keyboard Shortcuts

The information for this page has been moved to the following location: Keyboard and Mouse Shortcuts for Configuration Manager 2007


Virtual Application Packages Node Properties - General Tab

Topic last updated—January 2008

This page is no longer applicable to Configuration Manager 2007 R2

This tab displays the name of the node. No other configurable options are available on this tab.

Note
The information in this topic applies only to Configuration Manager 2007 R2.

See Also

Other Resources

Virtual Application Packages Property Pages


Configure Your Management Point

You must have a management point to transfer information between Configuration Manager 2007 clients and Configuration Manager 2007 servers. Without a management point, you cannot manage any clients.

Did you install Configuration Manager 2007 using simple Setup, or custom Setup?

  • If you used the simple Setup option, you already installed the management point role on the computer where you ran Setup and no additional configuration is required.
  • If you used the custom Setup option, you had to choose whether to install the management point role on the site server, on a remote computer, or not install a management point at all. If you need to install a management point, see How to Install a Management Point.

The computer running the management point role must be running Internet Information Services.

For intranet clients, you must either designate one computer as the default management point or configure several computers with the management point role and then configure them into a Network Load Balancing (NLB) cluster virtual server.

Note
NLB clusters allow for better performance and fault tolerance, but they are most appropriate for large and complex sites.

If you use a default management point, you can configure additional management points, but clients do not communicate with them, unless they are configured for Internet-based client management.

If you need to manage clients when they are on the Internet, you can configure the default management point or an additional management point to support connections over the Internet.

If you need to support mobile device clients, you must enable that setting on your management point. For more information, see How to Enable a Mobile Device Management Point.

See Also

Tasks

How to Configure the Default Management Point for a Site
How to Configure Network Load Balancing for Configuration Manager Site Systems
How to Configure a Management Point for Internet-Based Client Connections


How to Run a Query Special

Topic last updated -- November 2007

Run query special no longer applies in Microsoft System Center Configuration Manager 2007. In previous versions, run query special was included because large queries sometimes caused the console to stop responding. Queries are now run immediately when the query is selected. The Run query option has also been removed.


Windows Server 2003

The information for this page has been moved to the following location: Accessibility in Microsoft Windows


Run Query Special Dialog Box

Topic last updated -- November 2007

Run query special no longer applies in Microsoft System Center Configuration Manager 2007. In previous versions, run query special was included because large queries sometimes caused the console to stop responding. Queries are now run immediately when the query is selected. The Run query option has also been removed.


Windows XP Professional and Home

The information for this page has been moved to the following location: Accessibility in Microsoft Windows