ConfigMgr 2012 / SCCM 2012 SP1 Step by Step Guide Part 18: Software Distribution - MSI

Back to main menu

Config Mgr 2012 uses one of three detection methods to "detect" if an application is installed on a computer. 

• File system - presence of a file or folder
• Registry - presence of a registry key
• Windows Installer - presence of a Windows installer file

You must consider this before you create an Config Mgr Application. 

It is very straightforward to create an Application using MSI files. You simply tell Config Mgr where the MSI file is saved. The file is then interrogated to find the Windows Installer details.

Part 18 describes this process.

Navigate to Software Library Applications

Right Click on Application (or create a custom folder and right click that). Select Create Application.

The Create Application Wizard starts. Note that the wizard defaults to MSI type. Simply enter the location of your MSI.

Config Mgr interrogates the MSI to discover the Windows Installer information

Note that the installation switches are automatically discovered

Click Next to create the Config Mgr Application

Now distribute the content to the DP and it is ready to be deployed. 

 Select the Distribution Point

Verify that content has been distributed
Monitoring/Distribution Status/Content Status

Then deploy it to your required collection.

On the computer, when the Application Deployment Evaluation Cycle is reached, Config Mgr detects that the Windows Installer file cannot be found and the application will be installed.

Note that if the user uninstalls the application Config Mgr will detect this and re-install at the next cycle (providing of course the Config Mgr deployment is still in place to that collection)

ConfigMgr 2012 / SCCM 2012 SP1 Step by Step Guide Part 14: SQL Reporting

Back to main menu

Part 14 describes the configuration of SQL reporting in Config Mgr 2012. I will also show a sample report and how to export the report to PDF and xls files.


Navigate to Administration/Site Configuration/Servers and Site System Roles
Right click server and choose Add Site System Roles

Add Site System Roles wizard starts

Verify server name

Enter Proxy details if required - not required in this deployment. 

Select Reporting Service Point

Verify database details

Click next to add the Reporting Service Point

Reports are now available in Monitoring/Reporting

See sample report

Click on the drop down arrow to choose file format 

Sample PDF

Sample Excel file

ConfigMgr PXE Boot – which boot image is used?

If you have several boot images (x86 or x64) it’s easy to configure a task sequence to use a particular boot image.

However how do you choose the boot image that PXE provides to boot a device into Windows PE (before the task sequence is selected)?

The answer is – you can’t

PXE will always use the most recently used boot image for that architecture (as long as it still exists on the PXE enabled Distribution Point). Then, once you select a task sequence, it will use the boot image assigned to the TS if it's different.

BitLocker issue while encrypting tablet devices

I recently implemented a BitLocker solution on a customer site as follows - note that this customer did not want to deploy Microsoft BitLocker and Administration Monitoring (MBAM) at this time.

• ·         Configured TPM permissions in AD
• ·         Created BitLocker GPO and linked to appropriate OU (require PIN)
• ·         Encrypted test device (Windows 7 laptop) and verified recovery password in AD 

I was then presented with a Windows 8 Enterprise Acer W510 tablet to encrypt using the same GPO.

However BitLocker failed with the following error:

“Group policy settings require the creation of a startup PIN but a pre-boot keyboard is not available on this device. This user may not be able to provide required input to lock the volume”

Note that this is not a BitLocker issue but is a generic problem while encrypting tablet devices.

Obviously this issue occurs as the on-screen keyboard on a tablet is only available in the context of the operating system. It is not available in the pre-boot environment so the user would be unable to enter the TPM PIN. BitLocker detects this even if the tablet is connected to an external keyboard at the time.

There are two possible solutions:

    Option 1: BitLocker can be forced to encrypt the drive by using a new GP setting – however this setting is only available on Windows Server 2012 DCs. Also the user is required to use an external USB keyboard on all cold boots (or a USB numpad - they're smaller).

Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive

Enable use of BitLocker requiring keyboard input on slates

          http://technet.microsoft.com/en-us/library/jj679890.aspx#BKMK_slates

Option 2: The tablet can be encrypted without requiring a PIN. This reduces you to single authentication (ie AD) but the drive cannot be removed from the device and accessed by “caddying” on another computer. This can often be enough for compliance.

ConfigMgr 2012 / SCCM 2012 SP1 Step by Step Guide Part 27: Wake on LAN

Back to main menu

Part 27 describes the Wake on LAN functionality of Config Mgr 2012. 

Wake on LAN is easy to configure in Config Mgr  However, in reality, it can be a lot more difficult to achieve the full functionality across your entire infrastructure. It can be very frustrating to implement.

The basic steps are:

1. Configure Config Mgr
2. Ensure clients are configured correctly
3. Enable WOL for deployments

1. WOL is enabled in the Site Properties as shown

Tick the box to "Enable Wake on LAN for the site"

A dialog box appears to say that an Out of Band Management Point has not been configured. We are not concerned with AMT (Active Management Technology) at the moment so we can disregard.

Select "Use wake-up packets only". 

Select Subnet-directed broadcast or Unicast (see below for explanation of this)

2. BIOS and NIC of the client computer must support WOL. 

The BIOS may not allow WOL by default so this should be configured. 

Required NIC settings are shown below (most NICs are already configured by default)

3. WOL can then be enabled as you deploy the following to a collection

Operating System Deployments
Software Distribution
Software Updates

This example uses WOL while deploying Software Updates

Networking

The steps above are really straightforward and work really well for local subnets. However it is not as easy to achieve success on remote subnets.

Unicast uses the MAC address and IP address of the target client to route the WOL packet to the target's subnet. Config Mgr learns the IP address from the client's hardware inventory.

Subnet-directed broadcasts use the MAC address and IP subnet address of the target client. Config Mgr learns the subnet from hardware inventory.

Both these methods rely on the accuracy of the IP information in the hardware inventory. Also, in the case of Subnet-directed broadcasts, the routers between subnets must be configured to allow them.