This tools wll help you to work on Server and Client remote Agent action initiate.. some think like SMS 2003 Advance Client Action Tool
http://myitforum.com/cs2/blogs/rhouchins/0613ConfigMgrTools.zip
Enjoy,
Paddy
Thursday, August 7, 2008
SCCM 2007 / ConfigMgr Client Troubleshooter Tool Download
Introducing - the ConfigMgr Client Troubleshooter!
If you attended Angie Stahl's presentation at MMS, you caught a sneak peak of the ConfigMgr Client Troubleshooter. The troubleshooter is an html application, which makes it fairly portable, and all the code can be viewed using your favorite text editor. Use the troubleshooter to help you diagnose ConfigMgr client issues. This tool has become priceless at my company, where it is used by the Service Desk and OnSite teams (as well as my team on a daily basis). There are two modes currently avaible for the troubleshooter, Single System mode and Batch Mode.
Take a look at the following figure for single system mode:
When you launch the troubleshooter, the local computer name appears in the first textbox - to query a remote computer, simply enter the desired computer name, and then click Analyze. When you click Analyze, the troubleshooter will perform several remote WMI queries to the desired system (so if you're Analyzing a system over the WAN, please be patient). ** Keep in mind that this is running in your user context, so you will only be able to query the information that you have the proper rights to query. (for example, a "standard user" does not have the rights to see the value for "Last Scan Pkg Version (WSUS)".
The following table describes the colors used in the troubleshooter:
Color
Description
Black
Not Checked - Verify information manually
Green
Good - passed checks. No issue found.
Yellow
Good, but non-standard. (e.g., Automatic updates set to "automatic" - everything will still work, but the setting is non standard.)
Red
Bad - Check Failed - Something is wrong and needs to be addressed.
BEFORE YOU BEGIN: Be sure to customize the troubleshooter (info below), and install the latest SysInternals Tools to your %windir% directory (the troubleshooter requires psservice and pskill.) Make sure you run the tools manually one time - you need to review and accept the license agreements.
To Customize the troubleshooter, edit the .hta file with your favorite text editor, and locate and modify the following lines near the beginning of the file:
Const intMaxDays =60 'display 60 days of advert historyConst intMinDiskSpace = 2 '2 gb is used as the minimum disk space requirementConst strCCMSetupSource = "\\MYSCCMServer\sccmclient" 'path to ccmsetup.exe - ccmsetup.exe will be copied to the local system for install.Const strCCMSetupArgs = "SMSSLP=mySLP FSP=myFSP" 'add proper command-line argument info for client installationConst strClientVersion = "4.00.5931.0001" ' use your "corporate standard" version number hereConst strDefaultAdvertID = "LAB20083" ' this is just a default advertisement ID, used for re-running mandatory advertisements
Additional information for some of the buttons you see on troubleshooter:
Button Name
Comments
Fix
The Fix button for each service listed in the troubleshooter will ensure that the service startup type is configured properly to run. It will also
AutoDiscover Site
Modifies WMI for the SMS Agent Host to autodiscover its assigned site, then restarts SMS Agent Host Service.
Force Site Assignment
Used to force a site assignment on a client.
Show Current Adverts
Shows advertisements currently assigned to the computer - You can see both mandatory installations, and Run Advertised Programs installations. You cannot see user-targeted advertisements.
ReRun Advertisement
Use this to re-run an existing mandatory advertisement on a client - you must specify the ADVERTISEMENTID.
Show Client Logs
Allows you to view client logs - **Note, this feature does not work properly when you' have launched the troubleshooter under alternate credentials, as this feature uses Windows Explorer.
Display Advert History
Displays advert history according to registry on target system.
Install Client
Uses the command-lines and source you specified in the .hta file to install the SCCM client.
Applicable Patches
Displays applicable patches according to most recent sw update scan.
And now, we move on to my personal favorite, Batch Mode. When you launch the troubleshooter, you'll notice a scroll bar on the right-hand side of the window. Scroll down to view the following Batch Mode options:
You probably feel by now that you're being buttoned-to-death. :) I agree - and that's one of the features that will be improved in the next version. Fortunately, depending on your role in your company, you may find that you use a lot of these buttons on a regular basis. Batch Mode is simple - add computer names to the text box - one per line, and then click the action that you would like to perform on each of those systems.
**Remember, you're actively querying each system in your list, which may take some time, and also required additional administrative privileges.
The following table provides a brief description of most of the actions currently available in batch mode scan:
Button
Action
Batch Mode Scan
Performs a scan very similar to the single-mode scan, but for each system in the batch mode textbox.
Batch Policy Refresh
Performs a Machine Policy and Evaluation cycle on each system.
Batch Force DDR
Forces each system to initiate a discovery data record.
Batch Re-Discover Site
Forces the client to initiate a rediscover (requires psservice.exe, and pskill.exe).
Batch Query for Advert
Allows you to enter an AdvertisementID, then searches each system to see if that advert exists.
Rem Uninstasll Files
Deletes setup files in the %windir%\system32 directory that that's over 180 days old.
For most of the actions in Batch Mode, the information will be available to be copy/pasted into Excel. The file c:\temp\clip.txt will also be created (if c:\temp\ exists), containing the same information copied to the clipboard - this is very helpful when you're in a terminal services session (I frequently have issues with copy/paste in Terminal Services), or when the system you run the troubleshooter from does not have Excel installed.
Download 2003 Troubleshooter and the SCCM 2007 Troubleshooter now.
I hope to get a more permanent place for the .html application, so that you can help improve it!
Hot Tips!
I often use Batch Scan Mode and paste the info into Excel, and use Auto Filters to divide and conquer based on trends.
Notice that some of the SMS/SCCM properties are different for SCCM - For example, the last security patch scan date/time is a different WMI class than the one used for SMS 2003. So if you use the SMS troubleshooter on a client that has been upgraded from SMS to SCCM, you will see incorrect data for "Last Scan Package Version", as the SMS version of the tool queries a different space in WMI than the SCCM version.
Please submit bugs and feature requests to ramseyg@hotmail.com.
Remote Activation of SMS Agent on Client
Remote Activation of SMS Agent on Client
In an SMS enviroment you must have the SMS Agent running on the client or you can't do anything. In a strickly user enviroment this doesn't matter since the user can't turn it off, but if you have a user that has admin rights to his/her machine then they have the power to turn you off. Finding them is simple enough, look at the computers that haven't sent in an inventory in quite a while, heart beat or other options. The problem is getting that service restarted. Here is a vbscript that will turn the service back on for a number of computers.-------------------------Const SW_NORMAL = 1'change comps to match the number of computers in your arrayDim Comps(1) Comps(0)="computer1"Comps(1)="Computer2"for each strComputer in Comps strCommand = "net start ccmexec"Set objWMIService = GetObject("winmgmts:" _& "{impersonationLevel=impersonate}!\\" _ & strComputer & "\root\cimv2")Set objStartup = objWMIService.Get("Win32_ProcessStartup") Set objConfig = objStartup.SpawnInstance_objConfig.ShowWindow = SW_NORMALSet objProcess = objWMIService.Get("Win32_Process")intReturn = objProcess.Create (strCommand, Null, objConfig, intProcessID)'remark lines if you don't want to see the success or failure of the programIf intReturn <> 0 ThenWscript.Echo "Process could not be created." & _vbNewLine & "Command line: " & strCommand & _vbNewLine & "Return value: " & intReturnElseWscript.Echo "Process created." & _vbNewLine & "Command line: " & strCommand & _vbNewLine & "Process ID: " & intProcessID End IfNext
----------------------------This is simple but effective. You can run it manually or set it as a Scheduled Task on the server.Remember you must have admin rights on the computer to run this, so we are talking about an local admin account or domain admin.
Monday, August 4, 2008
SCCM 2007 SP1/R2 & Asset Intelligence feature
Après l’annonce de Microsoft effectuée au MMS, concernant la sortie de Configuration Manager 2007 Service Pack 1 au mois de Mai (et non Juin comme annoncé à l’origine) et de la disponibilité de SCCM 2007 R2 au mois de juillet (plus d’information ici), Dan Boldo (Program Manager, System Center Asset & License Management Team) vient d’annoncer les nouveautés apportés par SCCM SP1 concernant AI. May, 2008: AI 1.5 will ship with Configuration Manager 2007 SP1
New UI to enable product catalog customizations as well as software license entry.
On-demand or scheduled asset catalog updates for SA customers.
Ability to import license information (both MS and 3rd party) that shows licenses utilized vs. licenses purchased.
New catalog with enhanced schema
Ci-dessous un historique de l’évolution de Asset Intelligence depuis l’achat de la société Asset Metrix, en 2006, à l’origine de cette fonctionnalité. May, 2006: AssetMetrix acquired
Offered comprehensive asset inventory and reporting services.
Comprehensive IP around Asset Intelligence (e.g. Taxonomy, Classification)
Significant Knowledge Base that had 70,000,000 software instances and over 350,000 software titles.
April , 2007: AI 1.0 ships with SMS 2003 SP3
Extends SMS inventory agent to collect additional artifact data.
New SMS reports that simplify asset & license reporting.
Semi-annual targeted updates planned with first already released.
November, 2007: AI 1.1 Ships with Configuration Manager 2007
Improved performance and reporting accuracy.
New reports on CAL utilization (user & device) for Windows Server (2000+) and Exchange (2003+).
Enhanced asset mgmt capabilities including hardware change reports and application usage reporting.
Message d'origine : http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3275994&SiteID=17
New UI to enable product catalog customizations as well as software license entry.
On-demand or scheduled asset catalog updates for SA customers.
Ability to import license information (both MS and 3rd party) that shows licenses utilized vs. licenses purchased.
New catalog with enhanced schema
Ci-dessous un historique de l’évolution de Asset Intelligence depuis l’achat de la société Asset Metrix, en 2006, à l’origine de cette fonctionnalité. May, 2006: AssetMetrix acquired
Offered comprehensive asset inventory and reporting services.
Comprehensive IP around Asset Intelligence (e.g. Taxonomy, Classification)
Significant Knowledge Base that had 70,000,000 software instances and over 350,000 software titles.
April , 2007: AI 1.0 ships with SMS 2003 SP3
Extends SMS inventory agent to collect additional artifact data.
New SMS reports that simplify asset & license reporting.
Semi-annual targeted updates planned with first already released.
November, 2007: AI 1.1 Ships with Configuration Manager 2007
Improved performance and reporting accuracy.
New reports on CAL utilization (user & device) for Windows Server (2000+) and Exchange (2003+).
Enhanced asset mgmt capabilities including hardware change reports and application usage reporting.
Message d'origine : http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3275994&SiteID=17
SMS 2003 & SCCM 2007 Schema Extention
Prepare your environment for running SMS 2003 - Schema
Warning
It is advised to follow the procedure below, before any schema modifications are made, not just sms 2003 schema extentions. There are no known issues in making the SMS 2003 schema extensions.
This being said, keep in mind that
1) Every forest only has 1 Schema partition.
2) There is no such thing as an AUTHORITATIVE RESTORE for the schema partition.
These 2 things combined spell disaster if something did go wrong. If something does go wrong with the schema extension process and the schema gets replicated to all dc's.
If this happens you have two options
1) Hire a Microsoft PSS consoltant to help clean up your Active Directory Schema mess
2) Restore a backup of the Active Directory on All domain controllers in the Forest. All domain controllers have to be disconnected from the network during this recovery.
Neither of these seem to really appealing to me.
Proper Procedure
1. Locate the server that is the schema master
1. In a command prompt type regsvr32 schmmgmt.dll (You should get a message that the dll was registered succesfully)
2. Type mmc, and add the Active Directory Schema snap-in
3. Right Click Active Directory Schema and select Operations Masters
4. Take note of the current Schema master
2. Back up the schema master.
3. Disconnect the schema master from the network and do not reestablish the connection until the end of this procedure. (This means fysically removing the cable, do not just disable the network interface since some of the tools used later in the procedure require a functional tcp/ip stack.
4. On the schema master, insert the SMS 2003 SP2 Setup CD in the CD-ROM drive.
5. Open a command prompt, change to the CD-ROM drive, and change to the \SMSSETUP\BIN\I386 folder on the CD.
6. On the schema master, at the command prompt, type Extadsch.exe
7. After the preceding command has finished on the schema master, confirm that the preparation of the forest was successful. Review %SystemDrive%\ExtAdSch.log
8. Evaluate the information you gathered in the previous step and choose accordingly:
1. If extadsch.exe ran without errors, reconnect the schema master to the network and continue with the next step of this procedure.
2. If extadsch.exe ran but error messages provided instructions for additional steps to take, follow the instructions and then return to the confirmation process described in the previous step.
3. If extadsch.exe did not run successfully, restore the schema master from backup and investigate the corrective steps necessary so that extadsch.exe can be run successfully.
Important Note: Extending the Schema will trigger a FULL Global Catalog Synchronization between Windows 2000 Global catalog servers. Windows 2003 Global Catalog servers will use delta replication.
Happy Schema Extention,
Paddy
Warning
It is advised to follow the procedure below, before any schema modifications are made, not just sms 2003 schema extentions. There are no known issues in making the SMS 2003 schema extensions.
This being said, keep in mind that
1) Every forest only has 1 Schema partition.
2) There is no such thing as an AUTHORITATIVE RESTORE for the schema partition.
These 2 things combined spell disaster if something did go wrong. If something does go wrong with the schema extension process and the schema gets replicated to all dc's.
If this happens you have two options
1) Hire a Microsoft PSS consoltant to help clean up your Active Directory Schema mess
2) Restore a backup of the Active Directory on All domain controllers in the Forest. All domain controllers have to be disconnected from the network during this recovery.
Neither of these seem to really appealing to me.
Proper Procedure
1. Locate the server that is the schema master
1. In a command prompt type regsvr32 schmmgmt.dll (You should get a message that the dll was registered succesfully)
2. Type mmc, and add the Active Directory Schema snap-in
3. Right Click Active Directory Schema and select Operations Masters
4. Take note of the current Schema master
2. Back up the schema master.
3. Disconnect the schema master from the network and do not reestablish the connection until the end of this procedure. (This means fysically removing the cable, do not just disable the network interface since some of the tools used later in the procedure require a functional tcp/ip stack.
4. On the schema master, insert the SMS 2003 SP2 Setup CD in the CD-ROM drive.
5. Open a command prompt, change to the CD-ROM drive, and change to the \SMSSETUP\BIN\I386 folder on the CD.
6. On the schema master, at the command prompt, type Extadsch.exe
7. After the preceding command has finished on the schema master, confirm that the preparation of the forest was successful. Review %SystemDrive%\ExtAdSch.log
8. Evaluate the information you gathered in the previous step and choose accordingly:
1. If extadsch.exe ran without errors, reconnect the schema master to the network and continue with the next step of this procedure.
2. If extadsch.exe ran but error messages provided instructions for additional steps to take, follow the instructions and then return to the confirmation process described in the previous step.
3. If extadsch.exe did not run successfully, restore the schema master from backup and investigate the corrective steps necessary so that extadsch.exe can be run successfully.
Important Note: Extending the Schema will trigger a FULL Global Catalog Synchronization between Windows 2000 Global catalog servers. Windows 2003 Global Catalog servers will use delta replication.
Happy Schema Extention,
Paddy
Sccm 2007 client agent deployment using Software updates
Sccm 2007 has a new client deployment method called Software update point based client installation. The idea behind Software update point based client installation is to publish the Sccm 2007 client as a critical update, and hence its name is installed from the Software update point. Most of you will probably now that Software Update management in Sccm 2007 integrates with Wsus 3.0 Sccm 2007 relies on Wsus to synchronize the catalog and to scan clients, but that's food for another post.
Why?
Why does sccm 2007 require a new installation method? What was wrong with the previous installation methods we had in sms 2003? To be honest, not much, but they all had their drawbacks. Let's just have a look at each of the installation methods and their drawbacks before we continue and see what Software update point based installation has in store for us.
Manual installation: This installation method lacks automation and requires the end-user to be a local administrator on the machine which is obviously a big NONO security wise.
Login script installation: Lacks from the same security issue as manual installation and is by consequence a NOGO.
Software Distribution based installation: Good installation method but this is often a chicken or egg kinda problem, you already need to have a software distribution mechanism out there for this to work.
Client Push Installation (Wizard): Great installation method but it has some requirements that could prove to be problematic in a real secure environment. It requires remote local admin privileges which is usually fine. But it also requires remote registry and access to the admin$ share. A secure environment should have file and print sharing disabled on desktops or laptops, or at the very least have them blocked by a personal firewall.
GPO based installation: Nice installation method with very modest requirements on the machine to be installed, but it suffers from its own drawbacks. The main problem with GPO based installation is that it is end-user driven. GPO's software installation only happens at logon or after a restart. Both events normally only happen after the end-user gave their user name and password or powered on the machine. If you have pesky users that just close their laptop lid in the evening and open it back up the next morning then your out of luck with gpo's. With todays more stable os's like Windows XP and Windows Vista It could take a pretty long time before the machine actually needs to be rebooted on the lan.
Software update based client installation: Superb installation method that mixes the benefits of GPO based installation with those of software distribution based installation. In other words it has pretty low requirements on the target machine, even lower as software distribution based installation as it does not require a software distribution solution in place and doesn't require the target machine to be in active directory. (You'll need a different way than adm templates to set the registry keys though). On top of that it offers a Schedule based installation which eliminates the end-user initiated drawback of gpo's. By the way if you install a newer version of the SCCM 2007 beta or install a Service pack after RTM you will be able to update your publication so that you can use this method to easily upgrade your existed install base to the new version.
How?
How do you get this to work? Remarkably easy actually.
STEP 1 Configure the Windows Update agent GPO:
Open a GPO
Go to Computer configuration\Windows Components\Windows Update
Configure the Configure automatic updates option, Set it to auto download and shedule the install
Choose your own schedule
Configure the Specify intranet microsoft update service location
Configure both options with the value http://Wsusserver
STEP 2 Import the SCCM-2007 adm template:
Download the adm template to configure SCCM 2007 client installation command line parameters http://www.blogcastrepository.com/files/folders/documents/entry15469.aspx
Open a GPO
In Computer Configuration Right-click on Administrative templates
Browse to the SCCM-2007 and add the template.
Go to Computer configuration\Windows Components\SCCM 2007\Software Update point client installation
Configure the command line with the parameters you want.
STEP 3 Publish the SCCM 2007 client (As documented in the SCCM 2007 help file)
To publish the Configuration Manager 2007 client to the WSUS server:
1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / – / Site Settings / Client Installation Methods.
2. Right-click Software Update Point Client Installation, and click Properties.
3. To enable client installation, select the Enable Software Update Point Client Installation check box.
4. If the client software on the Configuration Manager 2007 site server is newer than that stored on the software update point, the Upgrade Client Package Version dialog box will open. You should click Yes in this dialog box to publish the most recent version of the client software to he software update point.
5. To finish configuring the software update point client installation, click OK.
Happy Client Deployement
Paddy,
Why?
Why does sccm 2007 require a new installation method? What was wrong with the previous installation methods we had in sms 2003? To be honest, not much, but they all had their drawbacks. Let's just have a look at each of the installation methods and their drawbacks before we continue and see what Software update point based installation has in store for us.
Manual installation: This installation method lacks automation and requires the end-user to be a local administrator on the machine which is obviously a big NONO security wise.
Login script installation: Lacks from the same security issue as manual installation and is by consequence a NOGO.
Software Distribution based installation: Good installation method but this is often a chicken or egg kinda problem, you already need to have a software distribution mechanism out there for this to work.
Client Push Installation (Wizard): Great installation method but it has some requirements that could prove to be problematic in a real secure environment. It requires remote local admin privileges which is usually fine. But it also requires remote registry and access to the admin$ share. A secure environment should have file and print sharing disabled on desktops or laptops, or at the very least have them blocked by a personal firewall.
GPO based installation: Nice installation method with very modest requirements on the machine to be installed, but it suffers from its own drawbacks. The main problem with GPO based installation is that it is end-user driven. GPO's software installation only happens at logon or after a restart. Both events normally only happen after the end-user gave their user name and password or powered on the machine. If you have pesky users that just close their laptop lid in the evening and open it back up the next morning then your out of luck with gpo's. With todays more stable os's like Windows XP and Windows Vista It could take a pretty long time before the machine actually needs to be rebooted on the lan.
Software update based client installation: Superb installation method that mixes the benefits of GPO based installation with those of software distribution based installation. In other words it has pretty low requirements on the target machine, even lower as software distribution based installation as it does not require a software distribution solution in place and doesn't require the target machine to be in active directory. (You'll need a different way than adm templates to set the registry keys though). On top of that it offers a Schedule based installation which eliminates the end-user initiated drawback of gpo's. By the way if you install a newer version of the SCCM 2007 beta or install a Service pack after RTM you will be able to update your publication so that you can use this method to easily upgrade your existed install base to the new version.
How?
How do you get this to work? Remarkably easy actually.
STEP 1 Configure the Windows Update agent GPO:
Open a GPO
Go to Computer configuration\Windows Components\Windows Update
Configure the Configure automatic updates option, Set it to auto download and shedule the install
Choose your own schedule
Configure the Specify intranet microsoft update service location
Configure both options with the value http://Wsusserver
STEP 2 Import the SCCM-2007 adm template:
Download the adm template to configure SCCM 2007 client installation command line parameters http://www.blogcastrepository.com/files/folders/documents/entry15469.aspx
Open a GPO
In Computer Configuration Right-click on Administrative templates
Browse to the SCCM-2007 and add the template.
Go to Computer configuration\Windows Components\SCCM 2007\Software Update point client installation
Configure the command line with the parameters you want.
STEP 3 Publish the SCCM 2007 client (As documented in the SCCM 2007 help file)
To publish the Configuration Manager 2007 client to the WSUS server:
1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management /
2. Right-click Software Update Point Client Installation, and click Properties.
3. To enable client installation, select the Enable Software Update Point Client Installation check box.
4. If the client software on the Configuration Manager 2007 site server is newer than that stored on the software update point, the Upgrade Client Package Version dialog box will open. You should click Yes in this dialog box to publish the most recent version of the client software to he software update point.
5. To finish configuring the software update point client installation, click OK.
Happy Client Deployement
Paddy,
SCCM 2007 Fallback Status Point (FSP)
Function
The Fallback Status Point is a new Site System role in Configmgr 2007 that serves 2 purposes.
The initial goal of the Fallback Status Point is to serve as a contact point for Configmgr 2007 clients in native security mode that cannot contact their Management Point because of certificate problems. As we will see in Chapter X “Security and Network Access Protection” native mode requires https and client certificates for communication with the Management Point, Distribution Point, Software Update Point and the State Migration Point. This certificate requirement opens up a potential issue where a client’s certificate gets damaged, deleted or corrupted in one way or another essentially orphaning the client from the Configmgr 2007 infrastructure. The Fallback Status Point can be the lifeline for those clients as it will accept S.O.S. state messages from clients that need administrative assistance to get back in working order.
The second purpose of the Fallback Status Point is to allow for monitoring the state of a client rollout from a central location, based on a bunch of Configmgr 2007 reports. Historically the previous versions of SMS used to have a blind spot during the client rollout. System administrators could analyze some individual logs at the client side but didn’t have a full view of the entire installation process from a central location. This made follow-up during the client rollout stage of an SMS project fairly labor intensive for these sysadmins. This lack of central view made it difficult to detect clients that for instance started, and potentially completed the installation but that did not get assigned to an SMS Site. The Fallback Status Point helps system administrators in a Configmgr 2007 environment to avoid these problems. Configmgr 2007 clients send state messages to their Fallback Status Point after successful deployment another one after successful Site assignment, giving you a detailed overview of your client rollout. This functionality obviously assumes that the client knows where to find his Fallback Status Point.
A Configmgr 2007 client can find the Fallback Status Point by querying Active Directory or because a specific Fallback Status Point was defined during the installation.
As you might have concluded by reading the function description of the Fallback Status Point this is not a mandatory Site System role. Although this role is not really required, it is strongly advised to install one, and depending on your setup the necessity for one might be greater than for other setups. If you plan to use Internet Based Client Management or plan to use Native Security Mode than having a Fallback Status Point is not a luxury.
Type of network traffic
Because Fallback Status Points serve, amongst other things, as the lifeline for clients with certificate problems, and are most notorious for their function in an internet based scenario, it should come as no surprise that the communication protocol of choice is http.
Scalability & Availability
Another interesting question is the placement of your Fallback Status Point(s). There are two approaches to this. The first one is to just put a Fallback Status Point in your Central Site at the top of your hierarchy. Given the fact that the amount of network traffic to the Fallback Status Point is fairly limited, and mainly happens during the initial client rollout, this approach is one approach that should work pretty well in most environments. Another approach that is worthwhile to investigate is to put Fallback Status Points in accordance with your administrative model. In other words, put a Fallback Status Point in every location where you have administrative personnel that will follow-up on client rollout and client health. This makes it easy for Site Administrators to keep an eye on their own environment’s client health and rollout.
Note: The Fallback Status Point cannot be installed on a system that already has a Site System role installed that requires https for its communication protocol.
The above note might influence your Fallback Status Point decision quite a bit. This obviously only impacts sites that operate in Native Security Mode, but you might still want to consider it in your designs to minimize the impact of security mode upgrades in the future. The reason that they cannot be co-located is that Configmgr 2007 installs all Site System roles in the same website. Configmgr 2007 has the option of installing in a different website than the default website, but this is a site wide setting, meaning that all Site Systems would then install their websites in this new “SMSWEB” website, which doesn’t solve our http/https problem. Although you could have separate virtual directories with different http/https settings this is generally not accepted as a good security practice. Conclusion, the Fallback Status Point is generally best installed on a machine separate from the Management Point, Software Update Point or Distribution Point which might increase the cost of having the Fallback Status Point locations based on your administrative model.
Security
Because the Fallback Status Point is most important in internet based client management, and is most likely to be installed in a demilitarized zone, it deserves some extra security attention. The Fallback Status Point is the only Site System in Native Security mode that allows anonymous http connections to be mode. Although all other Site Systems are fairly well-protected using https and by requiring mutual authentication based on client certificates, the Fallback Status Point, because of its function cannot have these stringent security requirements in place. This leaves the Fallback Status Point open for attack.
To mitigate the impact of any potential attack Configmgr 2007 has implemented two ways of mitigation. The first one was covered in the configuration section, this is the throttling of the amount of messages you are willing to accept for this Fallback Status Point. The default settings are rather loose, but you could easily trim these numbers down to something that is more in accordance with your environment. The second way of mitigating the impact of an attack on your Fallback Status Point is to make sure that the firewall blocks all traffic from the Fallback Status Point to the intranet. By configuring the option Allow only site server initiated data transfers from this site system as explained in the adding a Site System section, you can make sure that the Fallback Status Point operates in a pull-only mode. So even if the Fallback Status Point would rollover during an attack it cannot be used as a jumphost to attack the rest of the Configmgr 2007 infrastructure. With these two security precautions configured the Fallback Status Point becomes an uninteresting target for most hackers.
The Fallback Status Point is a new Site System role in Configmgr 2007 that serves 2 purposes.
The initial goal of the Fallback Status Point is to serve as a contact point for Configmgr 2007 clients in native security mode that cannot contact their Management Point because of certificate problems. As we will see in Chapter X “Security and Network Access Protection” native mode requires https and client certificates for communication with the Management Point, Distribution Point, Software Update Point and the State Migration Point. This certificate requirement opens up a potential issue where a client’s certificate gets damaged, deleted or corrupted in one way or another essentially orphaning the client from the Configmgr 2007 infrastructure. The Fallback Status Point can be the lifeline for those clients as it will accept S.O.S. state messages from clients that need administrative assistance to get back in working order.
The second purpose of the Fallback Status Point is to allow for monitoring the state of a client rollout from a central location, based on a bunch of Configmgr 2007 reports. Historically the previous versions of SMS used to have a blind spot during the client rollout. System administrators could analyze some individual logs at the client side but didn’t have a full view of the entire installation process from a central location. This made follow-up during the client rollout stage of an SMS project fairly labor intensive for these sysadmins. This lack of central view made it difficult to detect clients that for instance started, and potentially completed the installation but that did not get assigned to an SMS Site. The Fallback Status Point helps system administrators in a Configmgr 2007 environment to avoid these problems. Configmgr 2007 clients send state messages to their Fallback Status Point after successful deployment another one after successful Site assignment, giving you a detailed overview of your client rollout. This functionality obviously assumes that the client knows where to find his Fallback Status Point.
A Configmgr 2007 client can find the Fallback Status Point by querying Active Directory or because a specific Fallback Status Point was defined during the installation.
As you might have concluded by reading the function description of the Fallback Status Point this is not a mandatory Site System role. Although this role is not really required, it is strongly advised to install one, and depending on your setup the necessity for one might be greater than for other setups. If you plan to use Internet Based Client Management or plan to use Native Security Mode than having a Fallback Status Point is not a luxury.
Type of network traffic
Because Fallback Status Points serve, amongst other things, as the lifeline for clients with certificate problems, and are most notorious for their function in an internet based scenario, it should come as no surprise that the communication protocol of choice is http.
Scalability & Availability
Another interesting question is the placement of your Fallback Status Point(s). There are two approaches to this. The first one is to just put a Fallback Status Point in your Central Site at the top of your hierarchy. Given the fact that the amount of network traffic to the Fallback Status Point is fairly limited, and mainly happens during the initial client rollout, this approach is one approach that should work pretty well in most environments. Another approach that is worthwhile to investigate is to put Fallback Status Points in accordance with your administrative model. In other words, put a Fallback Status Point in every location where you have administrative personnel that will follow-up on client rollout and client health. This makes it easy for Site Administrators to keep an eye on their own environment’s client health and rollout.
Note: The Fallback Status Point cannot be installed on a system that already has a Site System role installed that requires https for its communication protocol.
The above note might influence your Fallback Status Point decision quite a bit. This obviously only impacts sites that operate in Native Security Mode, but you might still want to consider it in your designs to minimize the impact of security mode upgrades in the future. The reason that they cannot be co-located is that Configmgr 2007 installs all Site System roles in the same website. Configmgr 2007 has the option of installing in a different website than the default website, but this is a site wide setting, meaning that all Site Systems would then install their websites in this new “SMSWEB” website, which doesn’t solve our http/https problem. Although you could have separate virtual directories with different http/https settings this is generally not accepted as a good security practice. Conclusion, the Fallback Status Point is generally best installed on a machine separate from the Management Point, Software Update Point or Distribution Point which might increase the cost of having the Fallback Status Point locations based on your administrative model.
Security
Because the Fallback Status Point is most important in internet based client management, and is most likely to be installed in a demilitarized zone, it deserves some extra security attention. The Fallback Status Point is the only Site System in Native Security mode that allows anonymous http connections to be mode. Although all other Site Systems are fairly well-protected using https and by requiring mutual authentication based on client certificates, the Fallback Status Point, because of its function cannot have these stringent security requirements in place. This leaves the Fallback Status Point open for attack.
To mitigate the impact of any potential attack Configmgr 2007 has implemented two ways of mitigation. The first one was covered in the configuration section, this is the throttling of the amount of messages you are willing to accept for this Fallback Status Point. The default settings are rather loose, but you could easily trim these numbers down to something that is more in accordance with your environment. The second way of mitigating the impact of an attack on your Fallback Status Point is to make sure that the firewall blocks all traffic from the Fallback Status Point to the intranet. By configuring the option Allow only site server initiated data transfers from this site system as explained in the adding a Site System section, you can make sure that the Fallback Status Point operates in a pull-only mode. So even if the Fallback Status Point would rollover during an attack it cannot be used as a jumphost to attack the rest of the Configmgr 2007 infrastructure. With these two security precautions configured the Fallback Status Point becomes an uninteresting target for most hackers.
Subscribe to:
Posts (Atom)