Security & Management : SCCM

Configuration Manager 2007 R2+App-V Compare App-V Only

daniel — Sun, 19 Apr 2009 23:56:00 GMT

Configuration Manager 2007 R2 with App-V VS App-V Only

	R2+App-V	App-V Only	Remarks
Virtual Package Preparation	App-V Sequencer	App-V Sequencer
Virtual Package Upgrade	App-V Sequencer+R2 Console	App-V Sequencer+App-V Console
Virtual Package Management	R2 Console	App-V Console
Virtual Package Storage	R2 Distribution Point and Branch Distribution Point	App-V Streaming Server with Scripting (Content Replication)	R2+AppV is better for Branch Office and Large Deployment Scenarios
Virtual Package Assignment	By Active Directory User or User Group or R2 Managed Computer or R2 Managed Computer Group	By Active Directory User Group	R2+App-V is better for Virtual Package Targeting and Management
Virtual Package Access Control	R2 Console-Access Control for Streamed Applications for both Online and Offine. No Access Control for Pushed Applications, but it supports Workgroup Computers	App-V Console-Access Control for Streamed Applications for both Online and Offline, But It doesn't support Workgroup Computers	R2+App-V is better for Domain Joined and Workgroup joined Computers
Virtual Package Delivery	Network Streaming or Schedule Based Pushing (Local Streaming)	Network Streaming	R2+App-V is better for Laptop Users through Pushing Delivery
Virtual Package Removal	Remove from Computer Group or Specific Computer	Remove from User Group or Specific User	App-V Only is better for Dynamic User Based Virtual Package Removal

Configuration Manager 2007 R2 with App-V Integration Clarification

daniel — Thu, 16 Apr 2009 11:06:00 GMT

- Required Components

o App-V Sequencer for Virtualize the Application and Package Upgrade

o App-V Client

o Configuration Manager 2007 R2 Infrastructure

o No MSI Utility required

- Preparation Tasks

o In Configuration Manager, Create a new package from definition file-<Tools\VirtualApp\AppVirMgmtClient.sms> with the default option.

o Rollout this App-V Client Package.

o Enable Virtual Application Package Advertisement in Advertised Programs Client Agent.

o Enable BITS Option in Distribution Point Properties, uncheck the anonymous option.

o Enable the Virtual Application Streaming Option in Distribution Point Properties.

- Operation Tasks

o In Configuration Manager, Create a new “Virtual Application Package” and Browse to the Virtualized Application Package shared folder.

o Specify the Destination shared folder for store the Virtualized Application Package.

o Add the distribution point.

o Control the User Access by the Access Accounts option. (Streaming Only)

o For Upgrade the existing Virtual Application Package with the Patch or Service Pack, just follow the normal procedure to update the existing Virtual Application Package (and Update the Version for each Application) and Save it by using App-V Sequencer. And then copy all of the updated XML file, SFT file, SPRJ file, OSD files and Icon folder into a new folder under the Virtual Applications Source Shared Folder.

o In Configuration Manager, Right click the existing Virtual Application Package and click “Update Package”, and Browse to the updated Virtual Application Package by UNC Path. The Delta Package Update will start automatically on the Virtual Application Package Destination Folder, Distribution Point.

o Re-run the Advertisement to update the delta to Configuration Manager Client Cache (Pushing) and App-V Client Cache (Pushing and Streaming).

- Scenarios

o Streaming

§ Create a new Advertisement and choose the “Streaming from Distribution Point” Option

§ Target the Advertisement to the Collection

§ When the Advertisement execute, Configuration Manager client will call the App-V Client to register the Virtual Applications (Start Menu, File Association, Icons). And the Configuration Manager Client will use the “OverrideURL” Registry automatically for update the Virtual Application SFT File Location to the Distribution Point.

§ When the User Launch the Virtual Applications, App-V Client will use the Distribution Point for the Streaming Source. After the Feature Block 1 Streamed into the App-V Client Cache, the Application can be used. And the Feature Block 2 will be streamed into App-V Client Cache automatically in the background. Nothing will be stored in the Configuration Manager Client Cache.

§ If the User doesn’t have the “Read” Permission for this Virtualized Application Package, A Logon Window will appear and ask for the user name and password for access to the Virtual Application Package on the Distribution Point.

§ Once the Complete Virtualized Application Package streamed into the App-V Client Cache, the authorized user can use this Application in Offline mode. And the Unauthorized user cannot use this Application in Offline mode and the Application launch will fail.

§ To Remove the Virtual Application Cache, just delete the Advertisement in Configuration Manager.

o Streaming-Conclusion

§ The Virtual Application Package will Stream into every client’s App-V Client cache when the authorized user try to launch the Virtual Application on their desktop.

§ Virtual Applications Usage can be assigned by Package Access Account in Configuration Manager.

§ Virtual Applications Usage control are enforced even offline (disconnected).

o Pushing

§ Create a new Advertisement and choose the “Download from Distribution Point” Option

§ Target the Advertisement to the Collection

§ When the Advertisement execute, Configuration Manager client will download the Virtual Application Package and Store into the Configuration Manager Client Cache, and call the App-V Client to register the Virtual Applications (Start Menu, File Association, Icons). And the Configuration Manager Client will use the “OverrideURL” Registry automatically for update the Virtual Application SFT File Location to the Local Configuration Manager Client Cache.

§ When the User Launch the Virtual Applications, App-V Client will use the Local Configuration Manager Client Cache for the Streaming Source. After the Feature Block 1 Streamed into the App-V Client Cache, the Application can be used. And the Feature Block 2 will be streamed into App-V Client Cache automatically in the background.

§ Any users can use this Virtual Application on that computer online or offline.

§ To Remove the Virtual Application Cache, just delete the Advertisement in Configuration Manager.

o Pushing-Conclusion

§ The Virtual Application Package will Push into every client’s Configuration Manager Client cache when the advertisement execute and Stream into App-V Client cache locally when the user try to launch the Virtual Application on their desktop.

§ Virtual Applications Usage cannot be assigned by Package Access Account in Configuration Manager.

§ Virtual Applications Usage control cannot be enforced.

Using SCCM DCM to verify the GPO compliance (Part 2)

daniel — Thu, 03 Apr 2008 23:07:00 GMT

From the Community request. Here are the GPO Compliance Baseline configuraton without CP Studio.

Create a new GPO and import the Security Template or use the existing GPO with the imported Security Template.
Select the GPO in the Group Policy Tab, Click Properties.
Remember the Unique name of the GPO. Click Cancel Twice.
In SCCM Console, Click Desired Configuration Management.
Right Click Configuration Item and create a new general configuration item.
In the Settings Tab of the Wizard. Click New. And choose WQL Query.
Follow the Screenshot for the configuration. (Attached.)
Modify the guidName value to be your Security Template GPO Guid.
Complete the Configuration Item creation and create a new Configuration Baseline with this Configuration Item.

Using SCCM DCM to verify the GPO compliance (Part 1)

daniel — Mon, 31 Mar 2008 00:31:00 GMT

In some cases, we may want to use SCCM DCM to verify that the SCCM Client applied the specified GPO or not. It is a very difficult task because you may not sure that what you should use to query this information from the client machines or Active Directory. And SCCM DCM does not provide the feature for you to import the GPO/Security Template for the compliance checking.

I tried to use Active Directory Query and Registry, but the result is not very well. Finally, I use WMI Query to query the client machine and build the Configuration Baseline Successfully.

Here are the steps to create the Baseline for GPO compliance checking with Silect Software CP Studio.

Create a new GPO and import the Security Template or use the existing GPO with the imported Security Template.
Select the GPO in the Group Policy Tab, Click Properties.
Remember the Unique name of the GPO. Click Cancel Twice.
Start the CP Studio on the SCCM Site Server, Click New to start the Golden Master Configuration Baseline Creation Wizard. Click Next
In the Enter Machine Credentials Page, Choose Use machine on network and specify the Master computer that applied the GPO. Click Next
In the Operating System Requirements Page, Click Next.
In the Application Requirements Page, Click Next.
In the Application Detail Requirements Page, Choose WMI Queries and click Add WMI Query button.
In the Define custom WMI queries windows, choose RSOP, RSOP_GPO in Available namespaces/classes area. Click Retrieve.
In the Available records area, choose the GPO that you want to be the configuration baseline. Make sure that the guidName is correct.
In the Query definition area, Enable the enable checkbox and guidName checkbox. Highlight the enable checkbox and click Add button. Click OK.
In the Application Detail Requirements Page, Make sure that the new created WMI query is selected. Click Next.
In the Baseline Properties Page, Specify the Display Name, Description and Save location for that new created baseline. Click Finish.
Import the Configuration Baseline into SCCM DCM and Assign the Baseline to the collection.

System Center Partner Solutions

daniel — Sun, 23 Mar 2008 13:47:00 GMT

I just completed some PoC for the customers in the last afew months. And these PoC included the solutions from the System Center partners, such as 1E, Jalasoft, AVIcode, excSoftware and Silect Software.

And i want to share my experience on these great partner solutions with all of you.

Operations Manager:

-AVIcode Intercept Studio/SEViewer.

It is a great partner solution for monitor Microsoft .NET in Operations Manager. It enables Operations Manager to monitor .NET Executable Applications, ASP.NET Application and ASP.NET Web Service.etc. We also work with AVIcode to enable the monitoring capability for .NET Remoting. Other than Health monitoring for the .NET Application, AVIcode Intercept Studio/SEViewer also monitor the Job Failure, SLA Performance Violation and missing page.etc. Administrator use the Intercept Studio UI to configure monitoring and performance thresolds for each Application. The AVIcode .NET Enterprise Management Pack also integrate the SEViewer with Operations Manager. We can create and configure the .NET Application Health Model and Distributed Application within Operations Manager, and use Distributed Application Designer to create the Service Model. It is very useful for the Developer who require the tool to detect the issue within their codes and the Administrator who require to monitor the health and Performance of the .NET Applications.

-Jalasoft Xian Io Network Manager.

To monitor Network Device, such as Switches, Routers, Load Balancer and Firewall in Operations Manager, You need to spend so much effort to configure the SNMP collection and alert generation. And you may not get the expected or good result by this manual configuration task. Jalasoft Xian Io Network Manager included the predefined rules and wizards to configure the monitoring for the network devices. Once the Xian Io Network Manager discovered the devices in the network, you can apply the monitoring template or rules to the device, and the monitoring is started. The Rules and Templates can be customize to fit the business requirement by using the Xian Io Network Manager UI. It also included the Management Pack to allow Operations Manager to build the service model that contain the Jalasoft monitored network devices.

-excSoftware

excSoftware developed the Virtual Agent to collect the data by using Syslog, SNMP and CLI from the non Windows devices and applications, such as Linux, Unix, Lotus Domino, Apache.etc. These data will forward to Operations Manager and generate the events and alerts for the administrator to check the health status of the non Windows Devices and Applications. And It covered many non Windows Devices and Applications.

Configuration Manager:

-1E SMSNomad.

1E released so many add on for SMS and Configuration Manager. SMSNomad is one of the add on. In SMS 2003, It enabled the SMS Advanced Client Workstation to be the Local Distribution Point. This reduce the required Server machine in the Small Branch Office. SMSNomad also enables the multicast functionality in SMS and Configuration Manager Software Distribution. It is a great add on for reduce the network traffic of software distribution and Speed up the Software Distribution.

-Silect Software.

To author Operations Manager Management Pack and Configuration Manager Configuration Baseline easily, Silect Software released the MP Studio and CP Studio to help the administrator to author the MP and the Configuration Baseline. For Configuration Baseline, CP Studio included the "Master Image" Capture function to capture the OS and Application Configuration on the Master Machine, And convert to the Configuration Baseline automatically. It also supports to capture the Active Directory data on the machine for the configuration baseline. It reduced the effort to author the configuration items and configuration baselines in Configuration Manager DCM.

I will share the experience of another Partner Solutions with all of you in the future.

System Center Configuration Manager Beta Exam

daniel — Wed, 28 Nov 2007 23:42:00 GMT

Invitation

You are invited to take beta exam 70-401: TS: Microsoft System Center Configuration Manager 2007, Configuring. If you pass the beta exam, the exam credit will be added to your transcript and you will not need to take the exam in its released form.

By participating in beta exams, you have the opportunity to provide the Microsoft Certification program with feedback about exam content, which is integral to development of exams in their released version. We depend on the contributions of experienced IT professionals and developers as we continually improve exam content and maintain the value of Microsoft certifications.

71-401: TS: Microsoft System Center Configuration Manager 2007, Configuring counts as credit towards the following certification(s).

• Microsoft Certified Technology Specialist (MCTS): System Center Configuration Manager 2007, Configuration

Availability

Registration begins: November 21, 2007
Beta exam period runs: November 28, 2007– December 18, 2007
Receiving this invitation does not guarantee you a seat in the beta; we recommend that you register immediately. Beta exams have limited availability and are operated under a first-come-first-served basis. Once all beta slots are filled, no additional seats will be offered.
Testing is held at Prometric testing centers worldwide, although this exam may not be available in all countries (see Regional Restrictions). All testing centers will have the capability to offer this exam in its live version.
Regional Restrictions: India, Pakistan, China

Registration Information

You must register at least 24 hours prior to taking the exam.
Please use the following promotional code when registering for the exam: B401
Receiving this invitation does not guarantee you a seat in the beta; we recommend that you register immediately.

To register in North America, please call:

• Prometric: (800) 755-EXAM (800-755-3926)

Outside the U.S./Canada, please contact:

• Prometric: http://www.register.prometric.com/ClientInformation.asp

Test Information and Support

You are invited to take this beta exam at no charge.
You will be given four hours to complete the beta exam. Please plan accordingly.
Find exam preparation information: http://www.microsoft.com/learning/exams/70-401.mspx

RTM'ed

daniel — Sun, 26 Aug 2007 07:57:00 GMT

Configuration Manager 2007 and Virtual Machine Manager 2007

JUST RTM'ed...

Let's Celebrate~

Systems Management Server v4 Open Beta

daniel — Fri, 17 Feb 2006 02:54:00 GMT

Systems Management Server v4 Open Beta program: Apply now and be the first to participate in the SMS v4 Open Beta currently planned to start in late February of 2006!

Program Start Date	1/29/2006
Program End Date
Nomination Start Date	2/15/2006
Nomination End Date

Go to http://connect.microsoft.com/, and click on “Available Programs” for details.