sccm2012-userguide

By Callan Halls-Palmer

Callan Halls-Palmer

This Document will include guides and in-depth explanations of the different functions and administrative tasks that are available in MAKE’s Microsoft System Center 2012

Environment.

Microsoft System Center 2012 |

Contents

Page 1 Contents Page

SCCM - The basics

Page 3-11 Packaging, Distributing & Deploying Applications

Page 12-14 Task Sequences

Page 15-16 Building a Workstation

Page 17-19 Monitoring

Page 20-21 Microsoft System Center 2012 Endpoint Protection

Page 22-25 Administration & Prestaging Content

Page 26-27 Drivers

Page 28 Troubleshooting & Logs

1 | P a g e


SCCM - The Basics

Basic Information

Microsoft System Center Configuration Manager 2012 houses multiple features that can be used to make life easier when it comes to running a large amount of workstations within a network. It includes such things as asset management, software deployment, workstation builds, anti-virus protection, software updates, driver updates, user state migration and many more useful tools that can be used to improve functionality when administering multiple workstations across multiple sites.

Below is a screenshot of Configuration Manager displaying the main tabs that are used to navigate the application with a brief explanation of what each tab contains.

Navigating Configuration Manager

Using the screenshot above take some time to familiarize yourself with the layout of configuration manager, explorer all of the different components within each tab until you feel comfortable that you know where everything is (this makes it a lot easier to begin taking control of SCCM).

Device Collections

Our current configuration supports the deployment of applications, anti-virus updates, task sequences and software updates with the use of device collections. It is important that whenever deploying software to deploy it to the relevant device collection, if it doesn’t exist you need to create it in the correct location and then assign the devices that you would like to receive what you are deploying. Using WMI querying you can automatically update device collections based on location of a device in Active Directory, this is the case for the ‘Make London All Desktops’ & ‘Make London All Laptops’ Device Collections which I have previously set up (please learn about WMI Querying as it dynamically updates the Device Collections making it easier for you to manage).

Packaging, Distributing & Deploying Applications

Packaging the application

The first step to packaging the application is to do your research and find if that particular application has a deployment option or an admin image that you can create from the install files. For example, Autodesk support deployment via SCCM so they provide a deployment

2 | P a g e

Microsoft System Center 2012 |option and details that will help you further on in the process. Autodesk 3DS Max 2015 will be my example:

1. From your test machine or personal machine run Setup.exe from within the install files.

2. Once the Application installer has loaded select ‘Create Deployment’.

3. In preparation for the next part you need to create a folder for the source files on MAKELONSC01 here: \\ ’SCCM Server’ \source$\applications\Autodesk 3DS Max Design 2015\.

4. Give the deployment a name, in this example it will be ‘Autodesk 3DS Max Design 2015’.

5. You are asked for an Administrative image path, please enter the path of the folder that you created in step number 3. (\\ ’SCCM Server’ \source$\applications\Autodesk 3DS Max Design 2015).

6. Once you have finished the above the page should look like this:

7. Press next, accept the license agreement and then press next again.

3 | P a g e

Microsoft System Center 2012 |8. Fill out the Product Information and the location of the license server, press next. 9. Check the features that are being installed are correct and then select create.

(Go and grab a cup of tea because this part will take a little while).10. Press finish once it has finished creating the deployment. 11. Remote desktop on to ‘SCCM Server and navigate to the folder that you created the

deployment in, you need to create or copy and edit the install batch file. Because the batch files from the previous versions of 3DS Max are available we can copy the install.bat from the Autodesk 3DS Max Design 2014 folder and paste it into the Autodesk 3DS Max Design 2015 folder, you need to change the details of the batch file to match the new version of 3DS Max (PLEASE NOTE! This is not the process for every single application you package, this is the part that will differ with every piece of software, it just so happens that this is the support method of installation for 3DS Max 2015).

This is the install.bat taken from the source files for 3DS Max 2014, you need to change the highlighted bit to match the .ini file for 3DS Max 2015. The vray install isn’t currently available in this example but normally you would pass through to the vray install as shown in the screen shot above.

12. The uninstall.bat can be created by copying the Autodesk 3DS Max Design 2015_Uninstall.txt file from the SMS_SCCM scripts folder and pasting it back into the root of Autodesk 3DS Max Design 2015. Change the name to uninstall and change the file type from .txt to .bat.

13. Once you have prepared the Autodesk 3DS Max Design 2015 source folder for the creation of the application it should look like this:

4 | P a g e

Microsoft System Center 2012 |Creating the application in Configuration Manager

Open the configuration manager console on MAKELONSC01 and navigate to the applications panel, begin the creation of the application as shown below.

Once you are in the Create Application Wizard you need to follow these instructions to create an SCCM recognisab1le application:

1. Select the option that says ‘Manually specify the application information’, press next. 2. Enter the information about the product, product name and manufacturer are the

only ones you need to worry about.

3. Press next and then next again.4. This is the Deployment Types section, you need to make a deployment type for every

application that you create in SCCM. Press Add.5. This brings us into the Create Deployment Type Wizard, select ‘Manually specify

deployment type information’.

5 | P a g e

Microsoft System Center 2012 |6. Enter the name of the deployment type (for this example its Autodesk 3DS Max

Design 2015), press next. 7. Enter the content location, it has to be referenced as a share not a local drive

(\\ ’SCCM Server’ \source$\Applications\Autodesk 3DS Max Design 2015 ). In the Installation program field enter install.bat and in the uninstall program enter uninstall.bat (these are the batch files that you created earlier). This page should look like this, if okay press next:

8. This page lets you specify how the application is detected on client machines by SCCM, Press Add Clause and select Windows Installer which allows you to supply an MSI product code that SCCM will recognise on any client machine (if there is no MSI code you will have to install on a test machine and go into the registry to find the MSI code, failing that you will have to supply a detection method that will work on all client machines).

9. Paste the MSI product code into the Product code field, in this case you can find it in the uninstall.bat in the source folder for 3DS Max 2015, press okay and then select next.

6 | P a g e


10. You configure the User Experience on this page for when the application installs, the settings need to match the screen shot below, if so press next.

11. Press next at the Requirements page.12. Press next at the Dependencies page (depending on the size of the application this

could take a while to move to the summary tab).13. Press next on the Summary tab. 14. Press close.15. Press next on the Deployment Types page and again on the Summary page, press

close on completion.

The application will now appear in the Applications panel within the Configuration Manager Console, as shown below:

Distributing

The first step is distributing the application to the 4 Distribution Points that belong to the SCCM environment.

1. Right click on your newly created application and select Distribute Content.2. On the General page press next.3. On the Content page press next. 4. On the Content Destination page press Add and select Distribution Point from the

drop down list.5. Tick all 4 Distribution Points and then select ok.

7 | P a g e

Microsoft System Center 2012 |6. Press next at the Summary tab.7. Press next at the progress tab.8. Close once finished.

This begins the distribution process, the speed of this process is determined on the size of the application (in our case it would take a while to distribute to Beijing and Hong Kong because of the size of our application, so I have just selected the 2 London distribution points).

You can monitor the process of the distribution by selecting the Monitoring tab, expanding Distribution Status folder and then selecting the Content Status node. You will find Autodesk 3DS Max Design 2015 listed under content status and it will tell you whether it is in progress, failed or it has succeeded.

Deploying

Firstly you need to create a Device Collection for your application.

1. Navigate to the Assets and Compliance tab and expand the Device Collections node, you will see the different device collections.

8 | P a g e


2. Select the Autodesk folder under Applications, this is where we are going to create our new Device Collection for 3DS Max 2015.

3. Under the home tab at the top click on Create Device Collection.4. Specify the name for this Device Collection, in this case it will be Autodesk 3DS Max

Design 2015. 5. Click browse on the Limiting Collection field and select All Systems, click next.6. On the membership Rules page click next. 7. Press OK when the message pops up from Configuration Manager. 8. On the Summary page press next. 9. Press close on completion.

The next step is deploying the application to the Device Collection that you have just created.

1. Go into the Software Library and click on the Applications node. 2. Find the application you want to deploy, in this case its 3DS Max 2015.3. Right click it and select Deploy.4. Click browse on the Collection field. 5. Find the Device Collection that you created in the previous steps (Autodesk 3DS Max

Design 2015). 6. A message will appear warning that there are no members in that Device Collection,

just press OK and then next.

7. On the Content page wait for the Distribution Points to appear and then press next. 8. This is the Deployment Settings page and this is where you specify the Action and the

Purpose, the action would obviously be install for an installation and the purpose will vary depending on how you wanted to deploy the application. There are two types of purpose:

Available - This options advertises the application in the Software Center for users to manually select and install.

9 | P a g e

Microsoft System Center 2012 | Required - This option will automatically install the application as soon as

possible without any interaction.

For this example we are going to have the Purpose as available.

9. You can schedule the deployment on this page, it is best to leave the default settings, press next.

10. On the User Experience page you need to change the User Notifications field to ‘Display in Software Center, and only show notifications for computer restarts’. Leave the rest as default and press next.

11. Press next on the Alerts page. 12. Press next on the Summary page. 13. Press close on completion.

The application has now been packaged, distributed and deployed successfully to a device collection, the next step is to test that your application installs on either a test machine or your own machine.

1. Navigate to the Devices node within the Assets and Compliance tab and search for your test machine, in this case I will test it on my laptop.

2. Right click the machine and select the highlighted option:

3. Select the Device Collection that you made in one of the previous sections:

4. After completing the previous steps you will have successfully made the application available for install on the client machine.

5. On the machine that you have advertised the application to open up the Software Center, you should see your application appear in the Available Software tab within 5 -10 minutes.

10 | P a g e


6. Highlight the application and press install, the time taken to install the application varies depending on the size. In this example it will take some time because 3DS Max 2015 is an extremely large application. It is important to highlight that in both available and required deployments any previous versions of the application must be closed when the software is installing otherwise it will not install properly.

This completes the Packaging, Distributing & Deploying section of this document, this guide can be used as a reference for other pieces of software however it is important to note that every piece of software is different and there is no 1 correct way to package an application in SCCM. The basics are all here in this guide but you will have to get creative to get different pieces of software to work with SCCM, especially software that doesn’t have a deployment that is supported by SCCM such as 3DS Max 2015.

Task Sequences

Task sequences are basically the magic behind the PXE build, this builds the machine domain joined with all the applications already installed. SCCM does this by recognising the MAC address that needs to be manually entered as a device in the Assets and Compliance tab.

Creating a Task Sequence

11 | P a g e

Microsoft System Center 2012 |Navigate to the Task Sequences node within the Software Library and select which folder you want to create your task sequence in based on the location and the type of build you are creating. For this example we will create it under London > Test:

1. Select ‘Create a new custom task sequence’ and press next on the Create New Task Sequence page.

2. On the Task Sequence Information page enter a name and fill out the description which will basically state what the task sequence will do, next you need to select the boot image. Press browse and select the x64 boot image. Your page should look like this:

3. Press next on the Summary page. 4. Press close on completion. 5. The Task Sequence template has been created now you need to piece together your

build process, right click your newly created task sequence and select edit. 6. I recommend taking parts of other task sequences to create your new one. For

example, open up the ‘MAKE Standard Build - Windows 7 Pro x64’ task sequence, right click ‘Build the Windows 7 Pro x64 Machine’ and select copy.

12 | P a g e

Microsoft System Center 2012 |7. Paste it into your new task sequence, this creates the basis for your task sequence.

You will have to change certain options if you want a different OS from the task sequence that you copied or you want to add or remove applications. Copy ‘Apply All Windows Updates’ and paste it at the bottom of the task sequence.

8. The finished product after you have finished editing any options should look like this:

9. Press OK once you are satisfied.

Deploying a Task Sequence

You need to create a Device Collection before you can deploy your task sequence.

1. Navigate to the Device Collections node under the Assets and Compliance tab. 2. Expand MAKE Standard Builds, you will see that it has been organised by location so

you would normally create your Device Collection in the folder that corresponds to the location that it will be used in (in this example I have created a folder called Test).

3. Once you are in the correct location press the ‘Create Device Collection’ button on under the home tab.

4. Give your Device Collection a name, in this case I will call it MAKE-test.5. Add ‘All Systems’ as the limiting collection, press next. 6. Press next on the Membership Rules page. 7. Press OK when the Configuration Manager message pops up. 8. Press next on the Summary page. 9. Press close on completion. 10. Return to the location that you created your task sequence in.11. Right click it and select deploy. 12. Press browse in the Collection field and select the Device Collection that you just

created, press next.

13 | P a g e

Microsoft System Center 2012 |13. On the Deployment Settings page the settings should look like this before you

continue, if so press next:

14. On the Scheduling page click next. 15. On the User Experience page the settings should look like this before you continue, if

so press next:

16. On the Alerts page press next. 17. On the Distribution Points page press next. 18. On the Summary page press next. 19. Press close on completion.

The task sequence has now been created and deployed, it can now be used to PXE build a machine.

Building a Workstation

This is where the different task sequences come in to play, for example we can add the MAC address of the machine we want to build and assign it to the MAKE-test task sequence that was created in the previous section. We can then PXE boot the machine and SCCM will run through the task sequence which will in-turn install windows, join it to the domain, install all

14 | P a g e

Microsoft System Center 2012 |the applications, install the SCCM client + Endpoint and then install all of the latest Windows Updates.

1. Plug in the machine that you want to build and attempt to PXE boot, you will see the MAC address of the machine pop up. You will need to note this down (I usually take a picture with my phone).

2. Once you have the MAC address you need to go into the Configuration Manager Console and navigate to Devices under the Assets and Compliances tab.

3. Click ‘Import Computer Information’ under the home tab.

4. On the Select Source page select ‘Import Single Computer’ 5. On the Single Computer page enter the name of the computer (make-ws7-xxxx), next

enter the MAC address of the machine and then press next.

6. On the Data Preview page click next. 7. On the Choose Target Collection page select ‘Add computers to the following

collection’ and then hit browse, select that Device Collection that will build the machine the way you want it (in this example we will use the MAKE-test one that we created earlier).

15 | P a g e


8. On the Summary page press next. 9. Press close on completion. 10. After about 10 minutes turn on the workstation making sure it has a network cable

plugged into it that connects to the data network. 11. PXE boot the machine and wait for the prompt to push F12 (you will have to be quick

as it disappears quite quickly).12. If you was successful hitting F12 in time SCCM will now be pushing down the WinPE

image to the machine. 13. When the files have finished downloading you will be asked for a PXE password,

enter it: PX3N0w

14. You will then have to select the task sequence and press install, the rest is automated.

Once you have set the build process off you will have to wait about 2-3 hours for it to complete but when it is finished you have yourself a fully built machine ready to hand out.

Monitoring

The monitoring tab basically does what it says on the tin, it provides multiple monitoring functions that help you keep track of what the different components are doing and if there are any issues. It also houses the reporting function which can uses SQL to query the database and returns reports that are completely customizable.

Deployments

The deployments tab is there to help you monitor the different deployments for all of the applications that you have deployed in your SCCM environment.

16 | P a g e

Microsoft System Center 2012 |You can select a deployment and receive completion statistics and the content status of the application on the DP’s. If you click view status you get a list of clients that succeeded, still in progress, failed and requirements not met, this helps pinpoint the machine and user that didn’t receive the deployment.

Distribution Status

The distribution tab contains 2 nodes that are extremely useful monitoring tools, Content Status and Distribution Point Configuration Status.

Content Status

The content status tab helps to monitor and troubleshoot the status of content that is being distributed to the Distribution Points.

17 | P a g e


Distribution Point Configuration Status

The distribution point configuration status tab helps to monitor that health of your Distribution Points, you can begin to troubleshoot issues that you might be having with the distribution points by selecting a DP and clicking the details tab.

Endpoint Protection Status

The endpoint protection status tab gives you an overview of the level of protection across the network using the System Center 2012 Endpoint Protection Status tab. Also, you can see a list of current and historic malware that has been picked up within your network.

System Center 2012 Endpoint Protection Status

The screenshot below displays the endpoint status of all of all desktops and laptops in the London office.

18 | P a g e


Malware Detected

The screenshot below displays a list of discovered malware, the computers that were effected and whether it was remediated on all computers.

Microsoft System Center 2012 Endpoint Protection

Built in to Microsoft System Center is Endpoint Protection which is an anti-virus solution that can be centrally managed from the SCCM server, the client is automatically installed by

19 | P a g e

Microsoft System Center 2012 |the server after the SCCM client is installed. Endpoint Protection can be found under the Assets and Compliance tab, this is where the policies are centrally managed.

Antimalware Policies

This is the component that manages the multiple antimalware policies that we have defined for our network.

Creating and Deploying Antimalware Policies

1. Navigate to the Antimalware Polices node under the Endpoint Protection folder in Assets and Compliance.

2. In the home tab click ‘Create Antimalware Policy’3. Give the policy a name and then tick all the components that you would to make

part of your policy.

4. Go through and edit all of the settings that make up your policy and then press OK. 5. Right click your newly created policy and select deploy.

20 | P a g e

Microsoft System Center 2012 |6. Select the Device Collection that you would like this antimalware policy to apply to

(All Systems, MAKE London Desktops and Laptops etc.) and then press OK.

You have now deployed a new antimalware policy to your selected Device Collection.

Endpoint Definition Updates

I have configured the Endpoint updates so that they are downloaded, packaged and deployed automatically to all client machines on a daily basis. This ensures that the policy definitions are kept up to date therefore maintaining a secure environment. This is done by creating a Deployment Package and then an Automatic Deployment Rule which makes the package run on a daily basis (the Deployment Package is shown below).

Administration

The administration tab houses multiple options for configuration, you only need to go here to make administrative changes which isn’t very often. I will explain the different nodes that you will need to use.

Boundaries & Boundary Groups

This section basically controls the IP ranges and groups that are able to receive endpoint updates, applications and software updates from the SCCM server. If you need to add an IP range for a site office or a new office you will need to follow these instructions:

1. Navigate to the Boundaries node under the Hierarchy folder in the Administration tab.

21 | P a g e


2. Under the home tab press ‘Create Boundary’.3. Enter a description for the Boundary, such as ‘Boundary IP range for X site office’.4. In the type field select IP address range. 5. Enter the starting IP address and the ending IP address. 6. You then have to go into Boundary Groups which is situated just below the

Boundaries node.

7. Under the home tab press ‘Create Boundary Group’.8. Enter a name for your boundary group (name of your site office). 9. Press Add and select the IP range that you previously created. 10. Press OK.

This completes the steps required to configure the boundary settings for a new office or site office.

Distribution Points

Distribution Points receive data that is pushed out to them from the site server and then they cache that data for use in the location that the DP is located, this can include updates or applications etc. For example, the DP in Beijing has had content distributed to it so that the users in the Beijing office can download and install applications or re-build workstations with ease. The Distribution Points node under the Administration tab is where you will find the configured DP’s, you can go into the properties of any of these DP’s and configure them so they behave in a way that is suited to your organization.

22 | P a g e

Microsoft System Center 2012 |There are various options in the properties window of a selected DP that you will need to use at some point.

Content Tab

The content tab shows you any Applications, Driver Packages or Deployment Packages that have been pushed out to that DP, from there you can validate, redistribute or remove the content from the selected distribution point. The content tab is generally the only one you will need to access or edit from within the DP properties.

Prestaging Content

This involves creating a .pkgx file which contains the application and information that allows it to be imported on a remote DP, you would use this method of distribution if the line to a remote site is too slow to send a large package. The only DP that you would need to use this setting on is ‘Remote DP’ this is because the line to this studio is severely overloaded. To prestage an application you need to follow these instructions:

1. Right click the DP and select properties.2. Under the General tab tick the box that says ‘Enable this Distribution Point for

prestage content’.

3. Navigate to the Applications node from within the Software Library. 4. Select the application that you want to prestage. 5. Right click and select ‘Create Prestage Content File’.

23 | P a g e


6. Press browse and choose a location for the .pkgx file to be created, give it a name (test.pkgx) and then press next.

7. Wait for the content to validate and then press next. 8. On the Content Locations tab press Add and select ‘SCCM Server’ & ‘Local DP’. Press

next. 9. On the Summary page press next. 10. Press close on completion.

Transferring the file

1. Copy the .pkgx file and paste it on your desktop.2. Open Newforma and go into the IT project. 3. Click on Info Exchange. 4. Select ‘New File Transfer’.5. Put in your MAKE email address and enter a subject like .pkgx file. 6. Select the ‘files to transfer*’ tab and click ‘Add Files’. 7. Find the .pkgx file you pasted on your desktop and select it. 8. Press Transfer and await confirmation that the file has been sent.

Importing the file.

1. Log in to the remote DP. 2. Open up Internet Explorer. 3. Navigate to FTP Site and log in with your details. 4. You will see an email that you have received a file from Newforma, click on the

email and click on the link that will let you download the file from the Info Exchange server.

5. Once the file has downloaded on to the remote DP copy it into C:\ you need to extract & import it using the extractcontent.exe command line tool (this can be found on ‘SCCM Server’ here: C:\Extract Content Command Line Tool\extractcontent.exe). Copy the command line tool into C:\.

6. Log on to the remote DP and open up an Administrative Command Prompt.7. “cd” to C:\ and run the following commands (*=name of .pkgx file):

“extractcontent.exe /P:C:\*.pkgx /C /I” “extractcontent.exe /P:C:\*.pkgx”

8. You can monitor the progress of the export by opening the PrestageContent.log on the remote DP which can be found here: C:\SMS_DP$\sms\logs\PrestageContent.log

9. After about 30 minutes you will be able to monitor the progress of the distribution by navigating to the Content Status node under the Monitoring tab on the site server.

24 | P a g e


Drivers

Keeping your drivers up to date in your SCCM environment is extremely important. You need to keep your boot images and your task sequences equipped with compatible drivers for new workstations and laptops.

Downloading Drivers

There is a built in utility by HP that allows you to download driver packages for certain workstations (HPZ400) without leaving the server, so you can download and import right from the ‘SCCM Server’. Downloading drivers for Dell machines means that you have to go out and download the driver packages from the internet.

Importing Drivers

It is easy to import drivers with the HP & Dell utilities, just select which publisher you want and then run through the wizard.

Adding drivers to Boot Images

Sometimes you will need to add drivers to the boot image for you to be able to boot into WinPE on newer machines.

25 | P a g e

Microsoft System Center 2012 |1. Navigate to the Boot Images node from within the Software Library tab.

26 | P a g e


2. Right click Boot Image (x64) and select properties. 3. Click the Drivers tab. 4. Select the Add Drivers button 5. Select the driver that you want to inject into the boot image, press OK. 6. Press OK when you have finished adding drivers. 7. Right click the boot image and click on ‘Update Distribution Points’. 8. Run through the update process.

Troubleshooting & Logs

It is important you are able to effectively troubleshoot problems with SCCM which requires an understanding of PowerShell and scripting as well as being able to read the various different log files that are created by SCCM.

PowerShell & VBS Scripts

In C:\ there is a folder called ‘Scripts’ which houses various scripts that I have put together while troubleshooting problems within the environment. It’s also the location where I store the .pkgx files before they are copied down to my local machine. Gain a better understanding of what each script does before you start using them as you can do some real damage if you go changing things and running scripts blindly.

SQL Management Studio

Sometimes the log files do not tell you enough so you will need to go into the SQL Management Studio to find out if there are any issues with any of the packages (PLEASE BE CAREFUL IN HERE, MAKE SURE YOU DO NOT EDIT ANYTHING UNTIL YOU KNOW WHAT YOU’RE DOING!). It is important that you learn how to run Queries to find what you are looking for more effectively.

27 | P a g e

Microsoft System Center 2012 |Viewing & Understanding Logs

SCCM is constantly writing log files, they are your best friend when it comes to getting to the bottom of a problem. The log files are located on MAKELONSC01 here: \\ ’SCCM Server’ \ SMS_M01\Logs and the best viewing tool to use is CMTrace. CMTrace will automatically highlight any errors in the log file in red and any warnings in yellow so learn what each log file represents so you know where to look in the event of an error.

28 | P a g e

sccm2012-userguide

Documents

contents page page

applications page

basics page

workstation page

drivers page

monitoring page

task sequences page

software deployment