New Blog Page

I will not use longer this blog page.

You can find my new blogs on: http://scug.be/blogs/nico

Nico

Be carefull with IPv6

I encountered the following with a customer, software was MDT 2010 update 1 used for LTI deployments.




At the end of the capture sequence the "Apply Windows PE" task was failing.

The log files didn't not tell much more then the screenshot. After some investigation I noticed my deploymentshare was responding with an IPv6 address.

The reason was that the traffic was going via the ISATAP router because the customer had Direct Access and UAG running.

To workaround this I disabled the IPv6 protocol during the capture process on the NIC

Remote Control Global Settings

With SCCM you can specify Remote Control Settings, unfortunately these settings are site settings so all the machines within your sites will have the same remote control settings.
So for instance, the setting that you prefer a pop-up that a user needs to allow you before you can remote control his machine...
Well this settings caused a challenge for me, as I got a group of critical kiosk machines that I want to take over remotely but I don't want that users have to allow me first.

From what I have heard within vNext we will be able to set Remote Control settings on each collection, this is awsome but for the moment with SCCM we need to workaround this.
How?

First scenario is to override the ‘Ask for permission when an administrator tries to access the client’ setting part of the Remote Tools Client Agent.
The following code is what the ConfigMgr client receives from the Management Point (T01 is the sitecode in this example):
instance of CCM_RemoteToolsConfig
{
PolicyID = "{GUID value}";
PolicyVersion = "x";
PolicySource = "SMS:T01";
PolicyRuleID = "{GUID Value}";
PolicyInstanceID = "{GUID value}";
Enabled = TRUE;
ComponentName = "SmsRemoteTools";
Type = 1;
RemoteToolsEnabled = TRUE;
AllowChat = TRUE;
AllowClientChange = FALSE;
AllowFileTransfer = TRUE;
AllowReboot = TRUE;
AllowRemoteExecute = TRUE;
AllowTakeover = TRUE;
AllowViewConfiguration = TRUE;
AlwaysVisible = FALSE;
AudibleSignal = TRUE;
CompressionType = 2;
ControlLevel = 2;
DefaultProtocol = "TCP/IP";
IndicatorType = 0;
PermissionRequired = 1;
UseIDIS = TRUE;
VisibleSignal = TRUE;
DisableToolsOnXP = TRUE;
ManageRA = TRUE;
EnableRA = TRUE;
AllowRAUnsolicitedView = TRUE;
AllowRAUnsolicitedControl = TRUE;
ManageTS = FALSE;
EnableTS = FALSE;
EnforceRAandTSSettings = TRUE;
PermittedViewers = NULL;
};
Note the PermissionRequired settings is set to 1 which states that permissions are required when running Remote Tools.
This is the value we have to overwrite by creating a new mof file.
The mof file will look like this:

#pragma namespace("\\\\.\\root\\ccm\\policy\\machine\\requestedconfig")
[CCM_Policy_PartialPolicy(true)]
instance of CCM_RemoteToolsConfig
{
// Header properties
PolicyID = "1";
PolicySource = "local";
PolicyVersion = "1";
PolicyRuleID = "1";
PolicyInstanceID = "1";
Type = 1;
// Data properties
[CCM_Policy_Override(TRUE)]
PermissionRequired = 0;
};

Watch the "PermissionRequired=0"

We save this file as for instance CustomRemoteControl.mof.

On each machine you want that the default settings gets overwritten with the new one you need need to compile this new mof file.

You can do this with:
%windir%\system32\wbem\mofcomp.exe CustomRemoteControl.mof

Upgrade to SCCM R3 (beta) - Issue with KB977384

I'm running SP2 R2 without issues and my version of the site server in the SCCM console is 4.00.6487.2000.



When trying to install the hotfix that is a prereq for R3, I got the error that my version of ConfigMgr is not valid..??



"The hotfix is not valid for this version of Configuration Manager 2007"



If I enable logging on the KB I get this version. - '4.00.6487.2700' This is indeed the version with ICP2 installed.



So more probably the International Client Packs is causing this. Installing the hotfix on a server without ICP works fine.

This is quite an issue as ICP's cannot be uninstalled.

I reported this to MSFT to make the version check a little bit more flexible.

Installing SCCM on Server 2008 machines

With IIS 7.0 (Server 2008) and IIS 7.5 (Server 2008 R2) there are some extra modifications you have to do to get SCCM up and running.
These are the ones I have encountered through the projects I did.

Install and enable webdav:
http://learn.iis.net/page.aspx/350/installing-and-configuring-webdav-on-iis-70/

RDC missing on Windows 2008:
http://www.windows-noob.com/forums/lofiversion/index.php/t487.html

Unable to install MP Control Manager and MP:
Check MPsetup.log, probably some webdav settings are wrongly set (true\false) and
an Authoring Rule was not created.
Allow property queries within infinite depth should be true
Allow custom properties should be false
Allow anonymous property queries should be true
Create Rule – Allow All users read to acc to all content

Install ASP to get Reporting to work.

With SQL 2005 on Server 2008:
------------------------------

http://support.microsoft.com/kb/920201
http://www.microsoft.com/downloads/details.aspx?FamilyId=FB0EE17E-96EB-4CBB-AC09-95A4DCF73077&displaylang=en

With SQL 2008 on Server 2008 no issues encountered (yet). :-)

SCCM Computer Association - keep same hostname

In a Replace Scenario, so when migrating from one machine to another one, you need to associate machines with each other in SCCM. This to make sure User Data gets restored correctly (State Migration Point). Some customers have choosen to keep the same hostname mostly because of machine names are linked to AD Security Groups.

This is an issue in the Computer Association wizard. As the wizard is expecting 2 different hostnames.



To workaround this you can enter a Dummy hostname for the new Machinne.



Now we can continue with wizard to associate machines with each other and to add the new machine to a collection where a Task Sequence is advertised.

Imagine we start to install the machine at this point, the hostname of the machine will be "SCCMDummy". So we have to do something extra.
We need to put a variable on the SCCM machine record that will make sure that OSDComputerName (SCCMDummy) will be overruled with the value that we want.
If you work with an MDT database you can put the value in the database of course.



To completely automate this you can find excellent example scripts in the SDK.

Migrate Windows 2000 machines to Windows 7

You shouldn't expect it but a lot of companies still have Windows 2000 machines running and some will ask to migrate. Migrating these machines with USMT (refresh or replace scenario) is not supported by Microsoft nevertheless it works. The supported way is to upgrade first to XP and then to Windows 7. You can already imagine how your customer will react if you will propose this migration track :-)

So, it works but there are some caveats though:

- USMT 4 will not run in a Windows 2000 shell, you can workaround this by running your scanstate command in Windows PE Shell. Short, you need to create a TS that will advertise your refresh scenario which will prestage Windows PE\Machine will reboot\Start up in Windows PE\Run scanstate\format disk\apply WIM\...

- Format Disk?? Yes. Hardlink doesn't seems to work. At least hardlink works but with this you need to wipe the disk as the MININT folder has the data on board. Well, wiping the disk was not really a success. When wiping the disk the installation of Windows 7 always failed. During the first reboot in Windows 7, the installation stopped with a fatal error probably because of NTFS issues..
When formatting the disk the installation of Windows 7 was a succes.

- SMP cannot be used as the task "Request State Store" does not work in Windows PE. So the variable %StateStorePath% needs to be specified in your USMT command.

Suppress SCCM notification for App-V

Since R2 App-V is strongly integrated into SCCM.

A most common scenario will be that for instance a user logs on and the icon of avirtual application appears automatically on his desktop, ready to stream the application.

Default, you first get a notification (balloon in system tray) that the user has to click before the icon appears on its desktop.

That's probably something you don't want to have. You probably prefer if the user logs on the icon will be available without user interaction.

As you might know you can suppress notification with SCCM on programs of SCCM packages... BUT App-V Packages do not have programs, so we cannot select this option.

At this point some scripting will be required.
With following script you suppress notifications for App-V packages.

strSMSServer = "."
strPackageID = "XYZ00001"
strProgramName = "[Virtual application]"

Set objLocator = CreateObject("WbemScripting.SWbemLocator")
Set objSCCM = objLocator.ConnectServer(strSMSServer, "root\sms")
Set Providers = objSCCM.ExecQuery("SELECT * From SMS_ProviderLocation WHERE ProviderForLocalSite = true")
For Each Provider in Providers
If Provider.ProviderForLocalSite = True Then
Set objSCCM = objLocator.ConnectServer(Provider.Machine, "root\sms\site_" & Provider.SiteCode)
' strSMSSiteCode = Loc.Sitecode
End If
Next

Set objProgram = objSCCM.Get("SMS_Program.PackageID='" & strPackageID & "',ProgramName='" & strProgramName & "'")

ProgramFlags = objProgram.ProgramFlags
WScript.Echo "Flags for " & strPackageID & ":" & strProgramName & " currently set to " & ProgramFlags
WScript.Echo "Adding 0x00000400 (COUNTDOWN. The countdown dialog is not displayed)" ' see ConfigMgr SDK for details ("SMS_Program Server WMI Class")
ProgramFlags = ProgramFlags + 1024
WScript.Echo "Set flag to: " & ProgramFlags
objProgram.ProgramFlags = ProgramFlags
objProgram.Put_


Enjoy!

Conigurations in bootstrap.ini are not applying

I've seen recently a lot of posts on forums of people that are having issues with their bootstrap.ini.

In other words if they change something to the ini file it does not get applied.

Well for once an for all, as bootstrap.ini gets executed in a very early stage during WinPe it's required that you create a new WinPe Installation CD each time you added some changes to bootstrap.ini.

So -> Change bootstrap.ini = New WinPE Installation CD

MDT Wait for correct IP Address

It can happen when executing an LTI deployment that you get an error that your Deployment Share is not available.

If you hit F8 to open a DOS box and you notice you don't have an IP address (yet).

I have a trick how you can extend a bit the time for MDT to acquire an IP address.

I saw this already with several customers if they had some latency on their network cause by DHCP, network components,...

What you have to do is the following:

You mount your current boot image with imagex. (/mountrw)

Go to startnet.cmd and edit

Once you open the file in notepad the only contents will be the command:
wpeinit

Change the file to contain the following:
wpeutil InitializeNetwork
ping localhost (You could ping the WDS server too)
wpeinit

Save you changes of the cmd file.

Unmount the image and save your changes of the image. (/unmount /commit)

Burn this updated image to a new Installation CD or publish this image back to your WDS.

Your network issue should be solved now.

Dynamically install drivers with MDT 2010

MDT 2010 has some nice new features, one of them are Selection Profiles.

Like Michael describes on his blog Selection Profiles can be used for several things into MDT.

http://blogs.technet.com/mniehaus/archive/2009/07/12/mdt-2010-new-feature-18-selection-profiles.aspx

Another nice thing to use Selection Profiles for is to install drivers on a dynamic basis.

Create a driver folder structure into MDT. Then create a Selection Profile and call it like the respectively model names. You can read the model name out of WMI by executing:
CMD -> WMIC
CSProduct Get Name

In CustomSettings.ini you just add:
DriverSelectionProfile=%model%

OR

If you don't want to create a Selection Profile for each model you can create a rule that checks the dirver structure:

DriverGroups001=%Model%

(remark: if you build your Driver structure you need to call the folders like the WMI product name - cf. like we did with Selection Profiles)

MDT Database connections wit MDT 2010

If you encounter issues connecting to the MDT database, do the following for troubleshooting.

Put following files into one folder:

ztigather.xml
ztigather.wsf
customsettings.ini (where you specifiy the connection to the DB)
ztiutility.vbs
ZTIDataAcess.vbs

Execute following command from a host that needs to connect to the DB.
cscript ztigather.wsf /debug:true

Most common issues are SQL permission or Named Pipes that isn't enabled in SQL.

MDT 2010 Beta 2

Available at the Microsoft Connect site.

From now on you have everything to test Windows 7 Deployments via SCCM.

Don't forget to install SP2 (also beta) of SCCM as well!

Nico

OSD wipes the disk instead of formatting

Hi,

Did you ever noticed that if you change the advertisment distribution setting of your task sequence to "Access content directly..." your disk gets wiped instead of formatted?

The reason because of this is that MDT sets by default an argument on the "Format and Parition Disk" Task.

That argument looks like "_SMSTSDownloadOnDemand equals TRUE", if you remove this also your disk will be formatted when accessing the DP directly instead of downloading the content from the DP.

If you access the contect direcly you decrease the installation time significantly.

Nico

PXE issues - Part 2

Issue:
You get an IP address from your DHCP server but the system get stuck with contacting your PXE point, in the end you get a Vista boot error.

Solution:

Distribute always 64 bit to PXE point as well even for 32 bit machines


Almost all new computers these days are x64 capable even though you may only deploy a 32-bit operating system onto it. If the computer is x64 capable, then you must have an x64 boot image on the PXE Service Point, even if you are only planning to use a 32-bit boot image. The reason is that the PXE Service Point extracts certain files from the boot image that must be used in the very early stages of the PXE boot process. In this early stage, x64 files must be used on x64 capable hardware. Later in the process the PXE Service Point will determine that you want to use a 32-bit boot image and will revert to the 32-bit only code. But if you don't have the x64 boot image present on the PXE Service Point, it can't get past the early stages on x64 capable hardware.

SCCM and PXE troubles

Hi,

I suppose a lot of you have also troubles with WDS and SCCM.

Here you have a nice post, describing the issues I encountered.

http://social.technet.microsoft.com/Forums/en-US/configmgrosd/thread/fb096553-22f8-4fe7-b326-a6bc7c126cb3

SCCM migration issues

Hello,

It's been a long time that I have posted something because I was very busy prerparing a SCCM migration by one of my clients.

The goal:

Upgrade SMS 2003 SP3 hierarchy.
One of the primaries was located on a VM Ware and this one needed to be migrated to a physical 64-bit machine.

Most issues I had was located on this primary.

I did first an in-place upgrade of the VM Ware.

The upgrade wizard failed all the time with fatal errors during the installation of the INBOX_MANAGER. After investigating for hours (I needed Microsoft support for this) we noticed that there were corrupt ct2 files in the hman inbox.
We removed the corrupt files and executed a site reset hoping that the wizard should continue installing the failed components.

Originally we thought SMS was working, but after a while I noticed all my clients had error 401 in their ccmexec.log. The complete SMS console was green so no issues following SMS. After some investigation again we discovered that IIS was running in 5.0 compatibility mode. Normally SCCM should change this but probably because of the failure of the wizard this task was skipped.

When trying to remove the limited status of IIS we noticed that the after IISRESET the option was always checked again. After some hours we discovered that the service "Internet Printing" was preventing IIS to stop this compatibility mode.
When removing the Internet Printing everything worked.

So far the in-place upgrade of the VM Ware...

The next weekend I had to move the VM Ware to physicall hardware.

I took an SMS backup with the "backup site" task.
When trying to restore this data with Site Repair wizard... gues what... FATAL ERROR.
After some attempts I gave it up and restored the SQL database manually.
The restore of the SMS data luckily succeeded via the Site Repair Wizard.

All SCCM stuff was working, only OSD was suddenly very slow.
This patch resolved the OSD issue:

http://support.microsoft.com/kb/955955

So this was a short description of my SCCM rumbles ;-)
The misery someone can have in case the wizard are failing...

Holiday!!

Finally a well deserved holiday

3 weeks west coast in the VS

USMT - custom.xml sample

I needed to capture something out of the user profiles located under the hidden folders
local settings\application data\...
By default USMT skips these folders.
It took me a while to find this out, so it can might be interesstinf for one of you guys...

Here you have the sample. To make sure that this xml gets applied you need to add this /i:custom.xml as well in the loadstate and the scanstate command.




-
Lotus Notes
-
%CSIDL_LOCAL_APPDATA%\Lotus\Notes\Data

-
-
-
MigXmlHelper.DoesObjectExist("File","%CSIDL_LOCAL_APPDATA%\Lotus\Notes\Data")


-
-
-
# %CSIDL_LOCAL_APPDATA%\Lotus\Notes\Data\*



-
-
# %CSIDL_LOCAL_APPDATA%\Lotus\Notes\Data\*

Move of blog

Hello

Just to inform you that this blog will be moved soon to

http://myitforum.com/cs2/blogs/nsienaert/default.aspx

People of ITForum asked me to create my blog on their domain.
What's a big honour off course!

Hope to see you guys there!

Nico