ConfigMgr Current Branch - real world migration from ConfigMgr 2012R2

System Center Configuration Manager landing page

ConfigMgr Current Branch 1606 was released to GA this week and there has been a lot of excitement about the in-place upgrade to the latest version. I've done quite a number of upgrades from ConfigMgr 2012R2 to Current Branch so I thought that this would be a good time to describe some of the real world issues associated with this operation. Many of the ConfigMgr 2012R2 implementations we encounter are installed on Windows 2008R2 servers. This was ok at the time. However if we want to configure Windows 10 servicing we now require Windows Server 2012R2 on the Primary Site Server and Software Update Points.

Previously I've blogged about migrating using ConfigMgr's built-in migration process. See that here This works well and you can migrate from many previous versions (as far back as ConfigMgr 2007 SP2). In this case though you end up with a new site code and this isn't always the required outcome.

In this blog I'll describe the steps required to upgrade from ConfigMgr 2012R2 (installed on Windows Server 2008R2) to Current Branch 1606 (installed on Windows Server 2012R2).

ConfigMgr 1602 supports the in-place upgrade of the Operating System from Windows Server 2008R2 to Windows 2012R2. See the details here However some customers don't like in-place upgrades of the operating system and would like to start off with a freshly installed OS. To achieve this we must back up the site and restore it to a new Windows 2012R2 server. I've listed the high level steps to carry out this operation below:

Notes:

1. In this blog I'm referring to the 2008R2 server as "old" and the 2012R2 server as "new"
2. These steps are based on migrating a standalone Primary Site server configured as a Software Update Point.

Migration steps:

• If you are using VMs take a snapshot of old
• Back up the existing environment - I like to back up all the SQL databases with a SQL maintenance plan. It's also easy to back up the ConfigMgr site on old using the native ConfigMgr Site Backup maintenance task. Restart the SMS_Site_Backup component to start the backup immediately and monitor progress in the smsbkup.log file.
• Deploy new Windows 2012R2 server, fully patch and join domain - use any name for now but use the same drive configuration as old.
• Install Windowd ADK 10 - you can still use ADK 1511 (download it here) . A new ADK version 1607 has just been been released and can be downloaded here. Official ConfigMgr support for ADK 1607 has not been announced at time of writing.
• Install ConfigMgr 2012 pre-requisites on new as normal (roles and features)
• Copy source content, content library, WSUS metadata share from old to new while retaining permissions - if you are using VMs it's easier to detach the VHDs from old and attach them to new.
• Turn off old.
• Rename new box to original Primary Site Server name
• Optionally re-use the static IP address on new. It shouldn't matter as ConfigMgr uses DNS. However it can be useful to avoid recreating firewall rules.
• Re-delegate permissions on System Management container
• Install a supported SQL server version
• Install WSUS (use SQL database) and carry out the initial WSUS metadata share configuration (use a different share name than previously, do not configure WSUS)
• Stop WSUS services and detach WSUSDB
• Rename SUSDB.mdf and SUSDB.ldf
• Restore SUSDB database from old with overwrite option selected
• Copy WSUS metadata from old share location to new share location
• Start WSUS services
• Install WSUS hotfix KB3095113
• Install ConfigMgr 2012R2 and choose the recover site option, finish the wizard (we can only restore to the same ConfigMgr version)
• Carry out the ConfigMgr 2012R2 post-recovery tasks as directed - eg update account passwords
• Re-configure the Software Update Point to use port 8530/8531 instead of 80/443 - examine WCM.log for success
• Verify ConfigMgr site and component status
• Test ConfigMgr functionality
• Run TestDBUpgrade for ConfigMgr Current Branch 1511
• Perform in-place upgrade to ConfigMgr Current Branch 1511
• Back up Configuration.mof (it will be overwritten by the upgrade)
• Perform in-console upgrade to ConfigMgr Current Branch 1602 or 1606
• Optionally install MDT and re-configure integration
• Upgrade ConfigMgr clients to 1602/1606

Issues encountered

I encountered a number of issues during the process (mostly WSUS Issues).

• If there is an existing WSUS GPO you must change the port from 80 to 8530
• You may have to additionally open port 8530 between VLANs
• I was unable to open the WSUS console. The following error appeared in the event log "The WSUS administration console has encountered an unexpected error. Index was outside the bounds of the array". This was solved by adding the HTTP Activation feature (I'd forgotten that one).
• WSUS broke after KB3159706 - see TechNet forum for more details. This was solved by opening an elevated Command Prompt window, and then running "C:\Program Files\Update Services\Tools\wsusutil.exe postinstall /servicing"
• Reporting was broken - there were duplicates of all reports preceded by an underscore. This was solved by removing and re-adding the reporting point

I hope some of the information here will be helpful for you. Until next time....

Configuration Manager (CB) Upgrades - what you should not do

System Center Configuration Manager landing page

The Configuration Manager Product Group shared this information on our monthly call last night. There was no objection to me publishing it here. I hope you find it useful.

This is a list of things that you absolutely should NOT do in relation to upgrading Configuration Manager (Current Branch) to a newer version. It seems that some IT Pros are being creative in trying to resolve problems and in some cases are making them worse.

So, here we go - #4 is my personal favourite.

1. Do NOT manually clean up EasySetupPayload folder for CM update that is being downloaded/processed.
2. Do NOT manually clean up CMU without confirming the correct state and content library for the Easy Setup package.
3. Do NOT restore the CM database/CM site server if there is an error with CM update (fix the issue and "retry installation").
4. Do NOT reinstall the Service Connection Point if an update is in progress.
5. Do NOT use 1602 cd.latest to install a standalone primary site (Note: you can use this method to install a child primary to a 1602 CAS).
6. Do NOT use 1602 cd.latest to upgrade a 1511 site or R2 SP1 (or earlier) site.
7. Do NOT manually clean up any CM_Update* tables.
8. Do NOT restart CMU service during installation.
9. Do NOT keep the CMUStaging\<Guid> folder open during installation.
10. Do NOT copy files in CMUStaging.
11. Do NOT restart SMSEXEC during payload download (dmpdownloader.log shows if the package content is downloading). The Notification can get lost in that scenario.

Microsoft will try to make most of these more resilient in release 1606.

I hope this helps. Until next time......

Configuration Manager (Current Branch) Upgrade - Prerequisite check details

System Center Configuration Manager landing page

When you are carrying out a Configuration Manager upgrade did you ever wonder what "Run Prerequisite Check" actually means?

I did so I had a look. This is the list of prerequisite checks while upgrading from ConfigMgr CB 1511 to 1602. It's quite a comprehensive list.

[Passed]:Prerequisite check starting

[Passed]:Verifies that the logged on user account has administrative rights on the site system computer.

[Passed]:Verifies that the user running Setup has local administrator rights on the central administration site server.

[Passed]:Checks if the user account running Setup has sysadmin rights on the SQL Server for the CAS.

[Passed]:Check Server Service (LanmanServer) is running.

[Passed]:Verifies that the computer specified for installation is a member of a Windows domain.

[Passed]:Verify that the Active Directory domain functional level is Windows Server 2003 or later.

[Passed]:Checks that the site server computer has sufficient available disk space to install the site server.

[Passed]:Checks if a system restart is pending.

[Passed]:Checking unsupported Read-Only Domain Controller on site server.

[Passed]:Checking Site Server FQDN Length.

[Passed]:Verifies that the Microsoft Core XML Services (MSXML) version 6.0 or later libraries are installed.

[Passed]:Determines if the Windows Server 2003-based schannel hotfix is installed on the site server.

[Passed]:Verifies that the Microsoft Remote Differential Compression (RDC) library is registered on the computer specified for Configuration Manager site server installation.

[Passed]:Checking Windows Installer Version >= 4.5.

[Passed]:Checks if the target site server computer already has existing Configuration Manager server components installed.

[Passed]:Checks if the Windows Firewall is disabled or if a relevant Windows Firewall exception exists for SQL Server.

[Passed]:Check SQL Server service running account.

[Passed]:Check to see if the selected SQL Server instance is already in use by another Configuration Manager site

[Passed]:Verifies that the site server's database collation matches the database collation of its parent site.

[Passed]:Verifies that the Microsoft .NET Framework version 3.5 is installed on Configuration Manager central administration site servers, primary site servers, and secondary site servers.

[Passed]:Checks whether the User State Migration Tool (USMT) component of Windows Assessment and Deployment Kit (ADK) for Windows 8.1 is installed.

[Passed]:Checks if the FQDN provided for the site system uses the primary DNS hostname for the computer.

[Passed]:Checks if the specified site code is already in use by another site in your hierarchy.

[Passed]:Check the parent Central Administration Site has the same version.

[Passed]:Verifies that the SQL Server instance and Configuration Manager site database (if present) are configured to use a supported collation.

[Passed]:Verifies that the site server is processing critical inboxes in a timely fashion, and that inboxes do not contain files older than one day.

[Passed]:Verifies that all distribution points in the site have the latest version of software distribution packages.

[Passed]:Verifies that the SQL Server database collation settings of the tempdb database and site database to be upgraded are the same.

[Passed]:Share Name in Package has invalid character: #.

[Passed]:Verifies that SUM is not using any virtual locations for active SUPs.

[Passed]:Verifies that no active source hierarchy is currently configured for migration.

[Passed]:Verifies that all site servers in the hierarchy meet the Configuration Manager minimum version that is required for upgrade.

[Passed]:Active MP Replica detected

[Passed]:Verifies that the replication status of the parent site is Replication Active (corresponds to status=125).

[Passed]:Checking that the site system role 'Out of band service point' is not deployed.

[Passed]:Checking whether the site system role 'System Health Validator' exists in the hierarchy.

[Passed]:Checking whether there are Software Updates that are enabled for NAP

[Passed]:Pre-requisite rule to verify database consistency

[Passed]:Verifies that the user account running Configuration Manager Setup has been granted sysadmin SQL Server role permissions on the SQL Server instance selected for site database installation. SQL Server sysadmin role permissions are required in order to create the site database and configure necessary database role and login permissions for Configuration Manager sites.

[Passed]:Verifies that the user account running Configuration Manager Setup has been granted sysadmin SQL Server role permissions on the SQL Server instance selected for reference site database installation. SQL Server sysadmin role permissions are required in order to modify the site database.

[Passed]:Verifies that the site server computer account has administrative rights on the SQL Server and management point.

[Passed]:Verifies that the version of Microsoft SQL Server installed on the computer selected to host the site database meets the minimum requirements.

[Passed]:Checking the site SQL Server is not Express Edition.

[Passed]:Checking the site SQL Server Tcp is enabled and set to Static port.

[Passed]:Checks if the SQL Server hosting the Configuration Manager site database is using a case-insensitive collation.

[Passed]:Check that the specified FQDN for the SQL Server computer is valid.

[Passed]:Check target SDK machine is not Windows Cluster Node.

[Passed]:Checks whether the Windows Deployment Tools component of Windows Assessment and Deployment Kit (ADK) for Windows 8.1 is installed.

[Passed]:Checks whether the Windows Preinstallation Environment component of Windows Assessment and Deployment Kit (ADK) for Windows 8.1 is installed.

[Passed]:Checks if SMS Provider machine has same domain as site server.

[Passed]:Prerequisite check complete with no warnings or failures

Until next time.....