Installing Configuration Manager - Visual Studio Invalid license data. Reinstall is required.

This is an annoying little problem but very easy to solve. You are installing Configuration Manager (2012 or 1511) and you encounter this error.

Visual Studio 2010 Shell. Invalid license data. Reinstall is required.

Have a look at the slash.hta icon. It looks a bit funny.

This can happen if you accidentally choose Microsoft Visual Studio 2010 when you launch the wizard in the first instance (as I did).

No problem. Right click on splash.hta and choose "Open with". Now we can choose Microsoft HTML Application Host. However that doesn't work and you get the same error.

So how do we fix this? Don't worry - it's easy. We just have to change the association for the .hta file extension.

Open the Control Panel and launch Default Programs.

Find the .hta extension. See it's currently set to Visual Studio. Double-click the extension.

We're asked how we would like to open this file type. Choose HTML Application host.

Now we're back in business. See that the hta icon has changed.

Now launch splash.hta again....

...and continue with the installation.

I hope this saves you some time.

WMUG Event - Enterprise Client Management for the Modern World - 24th August 2015

My colleagues and I at Windows Management User Group will be hosting a full day of sessions at Microsoft, Cardinal Place, London on 24th August 2015. This event is free and there is an exciting schedule of sessions (listed below). We hope that you can join us.

I will present two sessions:

• Getting Started with Enterprise Mobility Suite
• Mobile Device Management with Microsoft Intune (Co-presenting with Rob Marshall)

The day is being sponsored by Secunia www.secunia.com

Please register for this free event here

Analyse your ConfigMgr data with Microsoft Power BI

Back to main menu

We can now take information from our ConfigMgr databases and analyse the data using the might of Microsoft Power BI. This announcement was made by Brad Anderson last week and he seemed pretty excited about it.

You can read the post here Getting Started with SCCM & Power BI

What is Power BI (Business Intelligence)?

"Microsoft Power BI is a collection of online services and features that enables you to find and visualize data, share discoveries, and collaborate in intuitive new ways. There are two experiences now available for Power BI: the current experience, generally referred to as Power BI for Office 365, and a new experience for Power BI, currently offered as a Public Preview." (Microsoft quote).

Let's have a look at the "new" Power BI. Brad's blog contains instructions but it took me a little while to get this working. However it's really cool and worth the effort.

The first thing you have to do is download the "Getting Started with SCCM and Power BI Workbook".

It's just an Excel spreadsheet containing pre-built queries and views. All we should have to do is configure the data source. Save it locally and open the spreadsheet.

Configure the data source (Server & database names required). The instructions then described clicking on the "Power Query" tab.

I didn't have that so I had to download Microsoft Power Query for Excel

Make sure you get the right version. The architecture of your OS doesn't matter. What is your version of Office?

Install Power Query for Excel.

 Now the Power Query tab is available. Select "Show Pane".

See the pre-configured Workbook queries on the right hand side of the workbook. Right click "Configuration Manager" and click "Refresh".

As it's the first time I'm running this I am prompted for credentials to connect to the database.

Click to Run the query.

  
Oops. That didn't look too good......

....nor this. This baffled me for a while as I know that the account I used was Sysadmin on the SQL instance. However eventually I had a brainwave. I ran Excel as Administrator and then opened the workbook. Success (although I don't know why I had to do this).

I was prompted to configure a Privacy Level.See here for full details of Privacy Levels.

Queries ran successfully. Cool. If you're following along save the Excel file. Now navigate to the Power BI site www.PowerBI.com

 Log in with your Office 365 credentials.

Click "Get Data".

Select Excel Workbook and "Connect".

Navigate and connect to the saved file......

.....and here we go. Data Analytics at our fingertips (without any serious work).

Click to Edit the Report.

See that you can simply manipulate Fields and Filters. You can also move views around as required. This is seriously cool and a very good starting point. There are 4 pre-configured Compliance sections - Mobile Device, Endpoint, Malware and Software Updates.

DirSync installation issues

It can be a little tricky to install DirSync in a multi-domain environment. To avoid complexity I normally try to install it in the root domain. I did so recently on a customer site but still had a little difficulty.

I always insist that the account used to install DirSync is a member of Domain Admins and Enterprise Admins (although Domain Admins membership is not specifically referred to in the official documentation).

http://technet.microsoft.com/en-us/library/dn635310(v=office.15).aspx


This was the first error I encountered (after entering my Azure Global Administrator details):

"Unable to establish a connection to the authentication service".

The error suggested to me that I had a problem with Internet access. I verified that in fact I did not have Internet access. It seems that this customer disallowed Internet access to Domain Admins (disabling proxy access). Fair enough. I removed the installation account from the Domain Admins group. After all it was still a member of the Enterprise Admins group and Domain Admins group membership was not specifically called out as required.

Great. I was now able to authenticate with Azure and progress to the next dialog box. I entered the Enterprise Admin account details and I was able to progress to the final step.

Here we go - DirSync could not be configured. The error message did not make much sense either.

"The user name or password is incorrect".

I added the account back into Domain Admins and allowed the server to bypass the proxy for Internet Access.

Success. I was able to complete the installation and configuration.

Moral of the story - it seems that the DirSync installation account should be a member of both Domain Admins and Enterprise Admins, although I cannot find this documented anywhere.

SCCM 2012 - new Intune extension (email profiles)

We found a new years gift from Microsoft this morning when launching the ConfigMgr console for the first time after the Christmas break.

 

See the second Email Profiles Extension which was released in late December. The other Email Profiles Extension was released in November. This update provided increased flexibility to support Exchange ActiveSync on additional email client software (such as Lotus Notes Traveler).

This latest extension relaxes the synchronization constraints relating to schedule and the number of days to synchronize the email. 

These are the options BEFORE the extension is enabled. You must choose a setting.

Schedule.

Number of days of email to synchronize.

Now lets enable the extension.

See that you now have the option not to configure these settings.

Schedule.

Number of days of email to synchronize. 

When "Schedule" is left as "Not Configured" the user can set the schedule as to when their mobile device should synchronize email.

When "Number of days of email to synchronize" is left as "Not Configured" the user can set how far in the past they want their corporate email to be synchronized.

This latest extension helps us to empower the user and further enhances the ConfigMgr/Intune management offering.

Reference:
System Center Configuration Manager Team Blog (30th December 2014)

SCCM 2012 R2 - Possible Software Updates strategy

Back to ConfigMgr main menu

There is no absolutely correct way to implement a software updates strategy in your organization. Each organization is different and the correct way is the way that works for you. However, after several attempts at trying different approaches, I've decided on a method that delivers a robust solution and is easy to understand and manage. I've included some details below. I hope it makes sense.

Collections:
 
This can be based on customer requirements but the collections are generally desktop and server collections (rather than collections per product). Additionally larger customer sometimes want collections per Business Divisions.

There are ALWAYS pre-production and production collections.

Software Update Goups:
 
The first thing I do when I'm implementing a solution for a new customer is to create a "line-in-the sand".
There are then three phases to the process:

1. Updates released prior to that point-in-time (eg December 2014) are regarded as historical updates.
2. Monthly patch cycles afterwards are regarded as BAU (Business as Usual). 
3. Annual maintenance of Software Update Groups

1. It is important to note that there is a hard limit of 1000 updates per software update group (SUG). This makes it impossible to include all historical updates in a single SUG (eg Windows 7 currently has almost 700 updates). In this phase I create Software Update Groups as required.

A typical strategy may include the following SUGs:

Desktop
Windows 7 SUG
Windows 8 & 8.1 SUG
All Office updates SUG

Server
Windows 2003 SUG
Windows 2008 & 2008R2 SUG
Windows 2012 & Windows 2012R2 SUG

As we have drawn a "line-in-the-sand" these update groups are static and will never change. The desktop SUGs are then deployed to the desktop collections (pre-production and production) and ditto for the servers (see below for deadlines and maintenance windows). These deployments remain in place indefinitely (even after the updates have been installed). In this way new desktops and servers that are added to the environment can be fully patched very quickly.

2. A Desktop Automatic Deployment Rule (ADR) downloads all desktop updates released in the last month and deploys them to the pre-production desktop collection.
A Server Automatic Deployment Rule (ADR) downloads all server updates released in the last month and deploys them to the pre-production desktop collection. 
I schedule the ADRs to run on the 3rd Sunday of every month. As you will know Microsoft normally release updates on the 2nd Tuesday of every month. I delay my ADRs by almost a week to allow Microsoft to withdraw any updates that may have caused problems in customer environments. Each ADR is configured to create a new SUG each month and to deploy with a deadline of 3 days in the future (the newly created SUG has to be renamed to something sensible). After a period of pre-production testing the SUGs are then deployed to production.

3. Annual Maintenance: At the end of each year the 12 monthly SUGs are consolidated into an annual SUG - and the process starts again.

Deadlines and Maintenance Windows:

I do not use maintenance windows for desktops (unless under specific circumstances). When I deploy SUGs to desktop collections I normally schedule the deadline to be 3 or 4 days in the future (and show all notifications). I find that the default notification and restart settings are more than suitable.
Servers require maintenance windows. It could be that you split your server estate into multiple collections so that you can define different maintenance windows. This structure will always be driven by customer requirements.

Out-of-Band updates:

Microsoft sometimes release very critical updates out of band (ie not on patch Tuesday). I create an Out-of-Band SUG which is deployed to each pre-production and production collection. The deployment deadline is in the past so that the updates are installed almost immediately. Server restarts will be controlled by the maintenance windows.

Other items worth a mention:

• Don't choose all products in Software Update properties (unless, of course, you need them all - which is doubtful).
• It's quite valid to deploy a Windows 2012 Server update to a Windows 2008 Server for example. The update will not be downloaded or installed and will not create any issue.
• SUG deployments should remain in place. Don't remove them.
• Note that you can use a single deployment package for all updates (the 1000 update rule only applies to SUGs).
• If you get into the habit of configuring this solution with PowerShell you will be able to re-create it quickly time and time again.

I hope all this has been helpful. It works for me.

Linux Management with ConfigMgr - Issues I've encountered

Back to ConfigMgr main menu

Back to Linux menu

I encountered a couple of issues while carrying out this work. I hope that they can save you some troubleshooting time.

1. Extracting client installation files.

The "ConfigMgr Clients for Linux.exe" file is 62MB.

This file extracts into the client installation files that you require. 

 You must extract this file using an x64 OS.

You will receive this error if you try to extract using x86 OS.


2. Software Distribution.

I encountered error 10006 while deploying an RPM package to a Linux Server (I was trying to deploy Teamviewer for Linux). After quite a lot of troubleshooting I finally tried to manually install the software on the server and found that the installation failed due to missing prerequisite files. Clearly my ConfigMgr deployment would never have worked and it's very difficult to determine the cause from log files. 

ConfigMgr 2012/ SCCM 2012 - add boundary for Direct Access clients

Back to ConfigMgr main menu

Many of us have seen the problem. We have configured our laptops to use Direct Access and we never see them again. The ConfigMgr 2012 client is installed but has never received it's policy or reported correctly.

This is the dreaded ConfigMgr client that has never received policy.

Only two actions.

What is the problem? The problem is that ConfigMgr is not allowed to send a policy to these devices as they do not belong to any of the known boundaries. The good news it that this is easy to fix. We have to configure an IPv6 boundary.

It's easy to get the information we need. Open the properties of one of your Direct Access clients.

See the IPv6 Prefixes.

Create a boundary for each IPv6 prefix.

New boundaries.

Restart the SMS Agent Host on the client to speed things up. Now examine the PolicyAgent.log file.

We see activity.

The policy is now being downloaded to the client.

Success - healthy client

See here for additional tip for finding your IPv6 Prefix.