Microsoft has introduced new feature in System Center Configuration manager Build Version 1602  called Client Online Status .This is really cool and exciting feature which is really needed these days to know if the computer is online or offline (of course ,SCCM agent must be working and healthy which is different story).

A new status for clients is available for monitoring if a computer is online or not. A computer is considered online if it is connected to it's assigned management point. To indicate that the computer is online, the client sends ping-like messages to the management point. If the management point doesn't receive a message after 5 minutes, the client is considered offline.

How to Monitor the status of individual clients:

In the Configuration Manager console, click Assets and Compliance > Devices or choose a collection under Device Collections.

Beginning in version 1602 of Configuration Manager, the icons at the beginning of each row indicate the online status of the device:

For more detailed online status, add the client online status information to the device view by right-clicking the column header and clicking the online status fields you want to add. The columns you can add are

• Device Online Status indicates whether the client is currently online or offline. (This is the same information given by the icons).
• Last Online Time indicates when the client online status changed to online.
• Last Offline Time indicates when the status changed to offline.

Now ,coming to the subject line , wouldn’t it be nice to create Collection or SSRS Report for client online Status in Configmgr 1602 ?

If you want to create collection or SSRS Report  for Clients with online ,offline Status in 1602 and later build versions ,you must know the correct SQL views (SSRS) and wmi instance that store this information . Download the SQL views documentation for Configmgr 1602 from http://eskonr.com/2016/04/download-sccm-configmgr-1602-sql-views-documentation/

collections Uses WQL and Reports uses SQL .

For Collection , Client online Status stored in wmi namaspace : SMS_CollectionMemberClientBaselineStatus with CNIsOnline =True or False

For SSRS Report ,Client Online Status stored in view: v_CollectionMemberClientBaselineStatus with CNIsOnline=1 or 0

Once we know the wmi instance or SQL view,it is easy to create collection or SSRS Report.

To create collection ,Use the following WQL Code (subselected) for Online Clients:

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,
SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ResourceId in
(select resourceid from SMS_CollectionMemberClientBaselineStatus where SMS_CollectionMemberClientBaselineStatus.CNIsOnline = 1)

To Create SSRS Report ,Use the following SQL Code for Online Clients:

select Name,sitecode,Clientversion,LastHardwareScan,LastMPServerName,CNIsOnline,max(CNLastOfflineTime) CNLastOfflineTime ,
max(CNLastOnlineTime) CNLastOnlineTime
from v_CollectionMemberClientBaselineStatus
where CNIsOnline=1
group by Name,sitecode,Clientversion,LastHardwareScan,CNIsOnline,LastMPServerName
order by Name

Until Next!

Microsoft releasing the technical preview updates for SCCM Configmgr every month as part of ongoing commitment to quality and innovation .These technical preview updates will help to test in lab environment and report feedback to Microsoft before they made General Available (current Branch).To see these preview updates in your Configmgr console,you must have the base version of SCCM Configmgr Technical preview 4 (not applicable to current branch).These Technical Preview updates are intended for use in a lab environment. For more information about technical preview and updates, please refer https://technet.microsoft.com/library/mt595861.aspx?

Today,23rd April 2016 ,Microsoft released latest update 1604 (Note : this is only for Technical preview 4 but not for Current Branch V1602,Production version) with some exciting features .

Features/updates included in this update are:

• Improvements to Microsoft Passport for Work management: You can now deploy Passport for Work policies to domain-joined Windows 10 devices managed by the Configuration Manager client.
• Option for clients to switch to a new software update point: you can enable the option for Configuration Manager clients to switch to a new software update point when there are issues with the active software update point. For this option, you must have multiple software update points available on a primary site.
• Client settings to manage Client Cache Settings and client Peer Cache: Technical preview version 1604 introduces two new device client settings that affect the use of a client's cache. Both can be used individually but are configured on the same property sheet for client settings and combine to help you manage deployment of content to your clients in remote locations.
• Support for Passport for Work as a KSP: you can integrate with Microsoft Passport for Work which is an alternative sign-in method that uses Active Directory, or an Azure Active Directory account to replace a password, smart card, or virtual smart card.
• On-premises Device Health Attestation: Health attestation for Windows 10 devices can now be configured to communicate using the on-premises infrastructure. Administrators can specify whether reporting is done via the cloud or on-premises resources. If on-premises is selected for health attestation reporting, then a URI can be specified for the service. This enables client PCs without internet access to use enable and manage devices using health attestation.
• SmartLock setting for Android devices: A new setting, Allow SmartLock and other trust agents has been added to the Android and Samsung KNOX configuration item that lets you control the SmartLock feature on compatible Android devices.
• Manage volume-purchased apps from the Windows Store for Business : The Windows Store for Business is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console,

For more information, read the documentation Technical Preview for System Center Configuration Manager https://technet.microsoft.com/library/mt595861.aspx?

How do you get and install/upgrade the newly released update 1604 in your lab?

I am running Technical preview 4 with version update 1603 on my lab:

From the Configuration manager console ,go to Administration –>Cloud Services—>Updates and Servicing

Click on Check for updates and follow dmpdownloader.log from your Configmgr site server logs to see the progress. Make sure you have service connection point role installed and have access to internet for downloading the updates.

dmpdownloader.log will show you the progress of the download of update 1604 .

Content will be downloaded to E:\Configmgr\EasySetupPayload with Unique ID .

After a while ,download finished ,you should see the update available in the console which is ready for Install .

To install the update ,right click on the Update version 1604,select Install Update Pack

select ignore  any prerequisites else ,it will stop the installation for any warnings and you are required to check the logs to identify any warnings and restart the procedure.

Look at the new features with this update (switch software update point)

For status ,you can either look in the console (Monitoring –Site Servicing Status) or log file called CMupdate.log in E:\configmgr\logs

During the installation of update 1604 ,it does the removal of older updates by keeping its previous update and flush all older updates.

After a while , Check the CMupdate.log , you will notice ,update installation is completed ‘INFO: Successfully dropped update pack installed notification to HMan CFD box.’

Now ,click anywhere in the console (to refresh it) ,you should see a prompt ‘A new version of console is available ‘ : 5.00.8385.1000 ,Click on Ok to upgrade the Console.

After a while ,console will be opened automatically for you :

You will also notice that ,after the upgrade successful ,all the previous update versions from the console will flushed (disappear) and  evaluation period will reset to 60 days .

However , the binaries for older updates still reside in the easysetupupload folder:

Check the configuration manager console version by clicking on the left top corner ,about configuration manager

Couple of new features that can be seen in the console:

1.Option for clients to switch to a new software update point :

1. Go to Assets and Compliance > Overview > Device collections.

2. On the Home tab, in the Collection group, click Client Notification, and then click Switch to Next Software Update Point. (This option is only available on sites that have multiple software update points.)

2.Client settings to manage Client Cache Settings and client Peer Cache:

Go to Administration > Client Settings, and then create a new device client settings object or modify an existing one to support client Peer Cache settings:

For existing client Device Settings, You need to select the setting in General Tab:

3. On-premises Device Health Attestation:

In the Configuration Manager console, navigate Administration > Overview > Client settings, and then set Use on-premises Healthy Attestation Service to Yes.

Reference:

Technical Preview for System Center Configuration Manager https://technet.microsoft.com/library/mt595861.aspx?

With system Center Configuration manager Build Update 1602 (Current branch ) ,we can now monitor the Configuration manager console usage data .

In previous versions of configmgr ,there is no records in database to see who are the users connecting to SCCM console ,though this information is tracked in SMSProv.log, but no stored information for reporting.

Microsoft have made some improvements with Configmgr current branch build 1602 ,that store the information in database,WMI class about users who try to make successful connection .

After you install the Configmgr console update 1602 and try to connect to Site server (CAS or Primary Site) , if the user is having least permissions( RBA) , SMS provider start tracking the information by executing several queries against the permissions defined in RBA (like OS ,software updates,packages ,applications ,collections and many more )  ,all these information can be monitor in smsprov.log .

This process is same in earlier versions of Configuration manager but the change that was added to Build Update 1602 is ,it creates additional stored procedures,tables,views to store machine Name that is trying to connect to console ,User name ,connected site code , admin console Version (all this info appear in SMSProv.log) and other important information and insert into the database by executing stored procedure (spCMUpsertConsoleUsageData )that Update Console Telemetry table with admin console machine telemetry information.

I have installed Console (CB Configmgr 1602) in PC001 and tried to connect to my Site using APAC\Eswar who has permissions defined using RBA,monitor the log (smsprov.log) for more information:

couple of screenshots from SMSprov.log:

All the information coming from client and connecting to Site server will be tracked in the database.

So,where does the information stored in database and WMI about the console usage ?

In Database ,there is view called : v_CMConsoleUsageData ,which stores information about PC ,User who connect to console ,Connected Site ,Site number,What is OS Build of the Connected PC,Console Version Installed,Client Version installed, Memory,.net framework installed version ,Console connect time and other information.

SQL Query :  select * from v_CMConsoleUsageData

After executing the Query ,I have noticed that ,the console connected time is showing in UTC instead of client connected time (Local time) .

This leads me to review the code used in stored procedure and check if any conversion syntax used and Yes ,it is using syntax to convert : (ConsoleConnectTime = GETUTCDATE()) .

So,if you want to have the console connected time but not UTC,you can either change the stored procedure (HIGHLY NOT RECOMENDED) or use the SQL CAST DATE syntax function ,something like below:

select MachineName,UserName,ConsoleConnectTime [ConsoleConnectTime (UTC)],
CAST(GetDate() - GetUtcDate() + ConsoleConnectTime AS datetime) [ConsoleConnectTime]
from v_CMConsoleUsageData

Once you know,there is view exist that store the information ,you can start working on your customized report by joining other views and create Nice SSRS Report.

For more information about SQL views in Configmgr update 1602,refer this post

Report is okay but can I create collection (user device collection probably to see who are all users connecting to site ) ? if you are interested to play with this .

WMI class (for Collection) called: SMS_ConsoleUsageData (Instance: ROOT\SMS\site_sitecode)

For some reason, I had SMS_ConsoleUsageData class with empty information,though I can generate report for console usage data as you see in above snippet.

Run wbemtest from RUN command, connect to ROOT\SMS\Site_PS1 name space. Click on Query and run the following command to see if it returns any value:

select * from SMS_ConsoleUsageData

So ,How to get this corrected ? am still trying to figure out using the stored procedures ,which might help to update the information into WMI ,but no fix yet for me. Am not sure if this is happening to all or Only for me.

So 2 things are pending (at least for me) for confirmation from this post 1) UTC time for console connected time 2)WMI results empty .

I will update this post when I find something on this UTC and WMI class.

I have been putting lot of SQL Queries ,SSRS Reports on my blog and I never explained ,how you can create such SSRS reports on your Own and I know that ,it is not easy to explain in blog post about the SQL/SSRS Reports . This is post will help you ,how to understand Configuration manager reporting and how to write your Own SSRS Reports (Advanced level) .

There are lot of books released on System Center Configuration Manager ,but there is nothing specifically for Reporting (in-depth).

The wait is Over now and Finally ,the only book that was missing since long on Configuration Manager Reporting is now available on the market I.e System Center Configuration Manager Reporting Unleashed.

This Book was written by Well known Configuration Manager MVP Garth Jones  and his export Co-authors Dan Toll and Kerrie Meyler .

The Unleashed book written by Experts is really fantastic and it has all the content what is needed for you to get complete knowledge on Configuration Reporting,RBA ,SQL views ,SSRS Report Builder and lot more.

You’ll walk through installing and configuring SSRS, using SQL views to find the data you need, writing SQL queries, creating basic and advanced reports, and using role-based administration to securely deliver those reports to the correct individuals.

Content at a Glance give you better feeling that ,it consists of of total 411 pages which is all about Reporting.

Contents at a Glance:

I highly recommend to purchase this book ,If you want to become expert in creating Custom based SSRS Reporting in Configuration manager and deliver the content to your management with in No-time .

You can purchase this book (System Center Configuration Manager Reporting Unleashed )from Amazon website ,available in both Paper back and Kindle version http://www.amazon.in/s/ref=nb_sb_noss?url=search-alias%3Daps&field-keywords=configuration+manager+reporting+unleashed

and from InformIT http://www.informit.com/store/system-center-configuration-manager-reporting-unleashed-9780672337789

Long ago ,did blog post on How to get software update compliance for specific update group per collection with drill down report to list the Required/missing ,unknown clients with some additional information like recent hardware inventory, last update scan results ,OS etc .

This report will only work for single software update group per collection ,but in Configuration Manager ,there could Multiple Software update group created as part of Patching process and it would be difficult to know the compliance status for the same collection for multiple update groups and this task become tedious if you run the same report multiple times and write down the results into file.

with the help of Configuration Manager console ,it is possible to see the Compliance % (Required, installed ,Unknown  and %) for the software update group for the deployed collection but if you want to see the same for multiple update groups and get the list of Required Clients etc ,not possible ,Thus you need SSRS Report.

Would it be nice to have SSRS Report that list the Software update compliance for multiple update groups per collection ?

This report is lying in my bucket for longer time and finally going out to public.

I have made little changes to the report (nothing major ) with respect to prompts (select multiple update groups) and drill down report changes as well.

This report allow you to select multiple Update groups and single collection as shown below . you need to action on Required(a.k.a Missing) and Unknown status.

It has 2 RDL files 1) Update compliance Status for multiple Groups per collection and 2) Linked report to know what are the client with specific Software update Status (Required ,Unknown)

First report looks like below:

Installed—>Specifies that the software update is applicable on the client computer and that the client computer already has the software update installed.

Not Required—>Specifies that the software update is not applicable on the client computer, and therefore, the software update is not required.

Required –>Specifies that the software update is applicable and required on the client computer

Unknown—> Specifies that the site server has not received a state message from the client computer,could be various reasons like scan did not run successfully,scan completed but state message did not sent successfully etc.

Click on the Arrow (blue color) to see the Required ,Unknown clients for the selected software update group:

Download the Reports from TechNet Gallery ,Upload to your Configmgr SSRS reports ,Change the Data source and Run the Report .

How to troubleshoot software update issues ,refer http://eskonr.com/2015/04/sccm-2012-troubleshoot-client-software-update-issues/

if you are working on the Java upgrade using SCCM Configmgr, you will have to cautious to apply the correct version of Java on the existing Client (can be desktop or server) to make sure the dependent applications works. For this to happen,you need to identify the clients that have JAVA installed (can be 32bit or 64bit) and deploy the Java application to the respective collection.

Inventory that comes from the client add and remove programs is stored in 2 locations in WMI SMS_G_System_ADD_REMOVE_PROGRAMS and SMS_G_System_ADD_REMOVE_PROGRAMS_64. You will have to query one of these as per the needs.

If you are using SCUP or third party patching ,you can simply create software update group and deploy it to collection (without any JAVA filter ) and client go through the software update scan and install the required updates.

In this blog post , I posted 2 Collections to list all clients in your infra that are managed by SCCM that are less than Java 8 Update 92 (is the latest version at the time of writing this blog post).

Create new collection ,Limit the collection ,select Query based ,edit and past the following the query for 32bit and 64bit Java Versions.

SCCM Collection for Java < JRE 1.8 Update 92_X86:

Both the Collection Queries excludes the windows server 2003 if you have any for safer side due to EOL for server 2003 .

If you wanted to get the clients that are lower version as per your need, make changes to the bold letters in the query below.

select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from  SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where (SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "Java%" and SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName not like "Java%Updater%" and SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName not like "JavaScript%" and SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName not like "%liveupdate%" and SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName not like "Java 8 Update 92" and SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName not like "Java%Development%") and SMS_G_System_OPERATING_SYSTEM.Caption not like "%2003%"

SCCM Collection for Java < JRE 1.8 Update 92_X64:

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS_64 on SMS_G_System_ADD_REMOVE_PROGRAMS_64.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName like "Java%" and SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName not like "Java%Updater%" and SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName not like "JavaScript%" and SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName not like "%liveupdate%" and SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName not like "Java 8 Update 92 (64-bit)" and SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName not like "Java%Development%" and SMS_G_System_OPERATING_SYSTEM.Caption not like "%2003%"

Recently ,we had an issue with SCCM Configmgr Reporting services role (Remote SQL sitting on VM was crashed ,blog post coming soon ) and we were unable to generate reports mainly for the Software update compliance status that happens every month. This post is about ,how to check the software update compliance status for the deployed software update group/Groups per collection/collections without using Configmgr Reports . The reason for posting this blog is ,fixing the Configmgr Reporting services role took more than expected time and meantime ,we need to check the status of patch compliance status and troubleshoot the non-compliant machines (servers) within the Maintenance window.

I thought the SQL Code which I used to generate the compliance status would be handy for others if they do not want to Use configmgr Reports and use SQL Code for Quick results.

If you are unable to generate compliance status using the SSRS Reports ,the only possible method is ,to depend on Monitoring node—deployments ,look for the software update deployment for particular collection and see the non-compliant machines for troubleshooting which is not easy method if you have large number of deployments and collections.

So ,to overcome this ,you can USE SQL management studio and run the query (posted below) to generate non-compliance list of clients with extra information like hardware inventory,software update scan,,Operating System ,IP address,User Name ,does it have Client etc.

This SQL Query should be helpful to quickly generate compliance Status for multiple software update groups and for multiple collections.

I recently posted a blog about ,how to generate software update compliance Status for multiple update groups per collection but this SQL query helps to generate update compliance status for multiple updates groups against multiple collections.

you can use this SQL query to create nice SSRS Report for multiple update groups per multiple collections in OneClick.

The below SQL code is for list of clients with required/Missing Status ,If you want clients with Unknown ,change the @status value to 0 ,More about Update compliance Status ,see below :

Update compliance Status:

0—Detection Status Unknown

1—Not Applicable

2—Required/Missing

3—Already Installed /Compliant

--SQL Code to Generate Update compliance Status for multiple update groups against multiple collections

Declare @Status nvarchar(255);set @Status='2';
--Status 0 for Unknown, 1 for Not Applicable,2 for Required ,3 for installed
select sys.name0 [Computer Name],sys.User_Name0 [User Name], os.caption0 [OS],
CONVERT(VARCHAR(26), ws.lasthwscan, 100) as [LastHWScan],
CONVERT(VARCHAR(26), uss.lastscantime, 100) AS 'LastSUScanTime',
CONVERT(VARCHAR(26), sys.last_logon_timestamp0, 100) AS 'Last Logon Time',
case when sys.client0='1' then 'Yes' else 'No'
end as 'Client (Yes/No)', c.IPAddress AS [IP Address]
From v_Update_ComplianceStatusAll UCS
left join v_r_system sys on ucs.resourceid=sys.resourceid
left join v_FullCollectionMembership fcm on sys.resourceid=fcm.resourceid
left join v_collection coll on coll.collectionid=fcm.collectionid
left join v_GS_OPERATING_SYSTEM os on ucs.resourceid=os.resourceid
left join v_gs_workstation_status ws on ucs.resourceid=ws.resourceid
left join v_updatescanstatus uss on ucs.ResourceId=uss.ResourceID
left join v_AuthListInfo LI on ucs.ci_id=li.ci_id
INNER JOIN (SELECT     IP1.resourceid AS rsid2, IPAddress = substring
((SELECT     (IP_Addresses0 + ', ')
FROM    v_RA_System_IPAddresses IP2
WHERE     IP2.IP_Addresses0 NOT LIKE '169%' AND IP2.IP_Addresses0 NOT LIKE '0.%' AND IP2.IP_Addresses0 NOT LIKE '%::%' AND
IP_Addresses0 NOT LIKE '192.%' AND IP1.resourceid = IP2.resourceid
ORDER BY resourceid FOR xml path('')), 1, 50000)
FROM    v_RA_System_IPAddresses IP1
GROUP BY resourceid) c ON c.rsid2 = ucs.resourceid
where li.title IN (‘SUG1’,'SUG2’,SUG3’) and coll.collectionID in ('PS10029A','PS10000D')and ucs.status=@Status
group by sys.name0,sys.User_Name0,os.Caption0,ws.LastHWScan ,uss.LastScanTime,sys.Last_Logon_Timestamp0,sys.client0,c.IPAddress
order by 1

Hope it helps !

Yesterday (22-July-2016) Microsoft released new version of SCCM Configmgr Current Branch 1606 (YY MM) with lot of new features and improvements to the existing features. You can install this update via in-console update.

You can update to latest version of SCCM Configmgr Current branch 1606 either from Configmgr 1511 or 1602 using in-console update.

This Version 1606 for SCCM Configmgr current branch is both a baseline install (which you use to install a new hierarchy), and an update which you can use to update from version 1511 or 1602.

Take a look at the checklist document for installing this update (1606) https://technet.microsoft.com/en-us/library/mt767553.aspx?f=255&MSPPError=-2147217396

As usual ,to get the Latest update (1602) in your console under administrative console—>Cloud services—>updates and Servicing ,you need to run the PowerShell script (fastring) and restart SMS executive service (only if you are on V1511 version) ,monitor dmpdownloader.log

Installing the update 1606 is a straight forward process within the console and is smooth process without any hassle. You can refer this blog post for,how to install SCCM Configmgr Updates using updates and Servicing.

To know more about ,what’s new in SCCM Configmgr Current Branch 1606 ,read https://technet.microsoft.com/en-us/library/mt752488.aspx

Configmgr Console,Site and Console Versions:

Version of Configmgr Console: 5.00.8412.1003

Version of Configmgr Site:5.00.8412.1000

Version of Configmgr Client: 5.00.8412.1006

If you unable to see SCCM Configmgr updates in console ,refer this blog post http://eskonr.com/2016/04/why-dont-i-see-sccm-configmgr-1602-updates-in-my-console/

Recommended Reading:

Updates for System Center Configuration Manager https://technet.microsoft.com/en-us/library/mt607046.aspx?f=255&MSPPError=-2147217396

What’s new in SCCM Configmgr Current Branch 1606 https://technet.microsoft.com/en-us/library/mt752488.aspx

What's changed in System Center Configuration Manager from System Center 2012 Configuration Manager  https://technet.microsoft.com/en-us/library/mt622084.aspx?f=255&MSPPError=-2147217396

Upgrade to System Center Configuration Manager https://technet.microsoft.com/en-us/library/mt627853.aspx

Microsoft released new version of SCCM Configmgr Current Branch 1606 (YY MM) with lot of new features and improvements to the existing features. You can install this update via in-console update.

With this new update ,there are also couple of newly added SQL views compared to its previous update (1602) which will help us to create reports in better way.

So ,what’s new in SCCM Configmgr CB 1606 SQL reporting ? Lets have a look at ,what are SQL views added newly and also have this SQL Views document handy for reporting ,otherwise , you may end up looking into the database for the correct information.

There are 3 SQL views added with this update version (1606) compared to its previous version 1602 ,listed below:

v_GS_ClientEvents
v_GS_OFFICE365PROPLUSCONFIGURATIONS
v_MDMDeviceCategory

Download the SQL View documentation for SCCM Configmgr Current Branch 1606 from TechNet Gallery.

For Other Configmgr version, you can download the SQL Views for Configmgr 1602,  Configmgr 1511 , Configmgr 2012 R2 SP1, Configmgr 2012

SQL Server Views in System Center 2012 Configuration Manager

A friend of mine (you know who you are) asked help (kind of) ,how to clean up the content inside ccmcache folder in better way instead of using script to deploy it as application/package/task sequence .

I would recommended to use compliance settings(configuration item/configuration baseline) to deploy the script on schedule basis (monthly once or how you want) to Clients.

One advantage of using compliance settings is that, you do not need use source files to implement this solution and it would be easier to discovery and remediate if any content found older than x days.

In this blog post, we will see, how to use simple PowerShell script (can get from many sources on internet) to create configuration item and configuration baseline and deploy to clients.

If you do not want to follow all the steps outlined here ,jump to end of the post, to see how you can achieve this task in just 2 to 3 steps.

How to create Configuration Item:

launch SCCM console –>go to Assets and compliance—right click on Configuration Items—create Configuration Item

Give meaning full name something like clean ccmcache content

Leave the default settings and click next

Create new compliance rule

Follow the settings as outlined below .

You need to have 2 PowerShell scripts 1) Discovery to check the count of folders that are older than x days for deletion 2) To remediate (delete) these folders if any exist older than x days

For Discovery script ,click on edit script and use the following PowerShell script.

This script will tell us ,the count of folders inside the ccmcache older than X days which will help us to clean the content.

Change the number of days that you want to delete content older than.

#discovery script
$MinDays = 14
$UIResourceMgr = New-Object -ComObject UIResource.UIResourceMgr
$Cache = $UIResourceMgr.GetCacheInfo()
($Cache.GetCacheElements() |
where-object {[datetime]$_.LastReferenceTime -lt (get-date).adddays(-$mindays)} |
Measure-object).Count

For remediation script, use the following PowerShell script to clean the content older than 14 days:

This script will clean the content (folders) older than 14 days.

#remediate script
$MinDays = 14
$UIResourceMgr = New-Object -ComObject UIResource.UIResourceMgr
$Cache = $UIResourceMgr.GetCacheInfo()
$Cache.GetCacheElements() |
where-object {[datetime]$_.LastReferenceTime -lt (get-date).adddays(-$mindays)} |
foreach {
$Cache.DeleteCacheElement($_.CacheElementID)
}

click on compliance rules and click New

Enter the name that you wish to use for the rule name and select the return value by the discovery script 0.

The setting must comply rule used ,if the content returns by the discovery script is 0 ,there is no content to clean up ,if at all the discovery script return count value other than 0 then perform the content cleanup using the remediation script.

Click Ok, Ok and Next

verify once if the settings are configured correctly below.

Click next,next,next to see the summary page:

with this ,we have completed ,how to create Configuration Item which includes all the settings like discovery ,remediation .

How to create Configuration Baseline:

Right click on Configuration Baseline and select Create configuration Baseline

Give a Name,description and click on Add Configuration Item

Select the configuration item that we created above ,add and click ok .

we are now created configuration baseline and ready to deploy to collection that you are interested in with schedule.

How to deploy Configuration Baseline to Collection:

Right click on the configuration baseline that we created earlier and click on deploy

Adjust the below settings according to your environment like collection and schedule .

Under the deployment tab ,you will see the configuration baseline deployed to collection and its compliance %

Wait the clients to receive the policy (trigger machine policy retrieval ,if you want to speed up the process) and let remediation happen..

Go to any SCCM client ,open configuration manager applet, look at configurations tab ,you will there is no ccmcache cleanup available.

As soon as you refresh the machine policy ,client will poll and get the newly created policy which will appear in configurations tab ,click on evaluate.

Evaluate will take few seconds to run the discovery script and if it find the count other than 0 ,perform the remediation script that we used .

Click on view report to see a nice html report with compliance status

After a while ,client evaluate the baseline and report the status to SCCM ,which you can see in console ,configuration baseline.

With this ,we have completed task of how to clean up content in ccmcache older than 14 days.

How to avoid following these steps and create all in 3 steps ?

To make this task easier for you ,I have exported the Configuration baseline into cab file . So all you need is ,download the cab file from here ,go to configuration baseline ,import the cab file and change the settings how you want in the PowerShell using above steps.

Below are client the logs (C:\windows\ccm\logs) which will help you to check and troubleshoot compliance setting issues:

CIDownloader.log –>Records details about configuration item definition downloads.

DcmWmiProvider.log—>Records information about reading configuration item synclets from Windows Management Instrumentation (WMI).

DCMReporting.log—>Records information about reporting policy platform results into state messages for configuration items.

CIAgent.log—>Records details about the process of remediation and compliance for compliance settings, software updates, and application management.

Since few days ,I am working on a customized Software update compliance dashboard report with some Pie charts for management to see how the patch compliance progress for each Business Unit (I say business unit means for each country).

Management are interested to see the overall patch compliance summary for each country (focused on servers ) into a nice pie chart which can be published to them either Via emails (using SSRS subscriptions or put them on Bigger screens especially for server compliance status).

This dashboard uses lot of pre-existing reports that are already published on my blog ,but there is one report (though SQL query is few lines code) which makes me to spend lot time doing lot of changes and check in the console if the results tally or not and the report is:

Top 5 or 10 missing patches for specific collection and specific update group.

The hard part for getting this report work is ,identifying the correct views to join Software update group ,compliance status . I would strongly recommended to use the SQL views documentation to create any custom SCCM reports.

After going through the SQL view documentation ,found below views that will help me to join the software update group (CI_ID) and software updates (CI_ID)

v_BundledConfigurationItems –contains information about each Update CI_ID and software update group ID

v_AuthListInfo –Contains Software update group Name, Update ID(CI_ID) .

For reporting (ONLY) ,we normally have 1 software update group that contains list of all updates (as per the requirement from IT Security team as they are the ones who decide what security patches to deploy ) that are  deployed to clients from so long to until 2 months old from current month  . Technically speaking, you cannot have more than 1000 updates in software update group which you can deploy to collection but ,in this case ,it is only used for reporting ,I can have more than 1000+ updates into 1 software update group and always make sure this SUG group is at good compliance rate for each BU .

As we move on, add the previous months patches to this Software update group and rerun the report to reflect the status for newly added updates against each country collection.

In this blog post, I will share you couple of SQL queries which are used my dashboard report ,help you to create your own dashboards.

P.S: The reason for not posting the dashboard which I created is because ,it has lot of customizations (more into collection ID’s and Software update group) per country basis and they are unique for each organization ,but I can share how the output of the dashboard look like.

Each pie chart has linked report to see the list of clients status like missing or unknown for troubleshooting purpose.

Below are couple of SQL queries that I wanted to share with you guys.

1.How to get list of top 5 or 10 missing patches against particular collection for specific software update ?

In SCCM console ,if you go to software updates node ,you can see lot of information for each update with Bulletin ID,Title ID,required,installed etc , but there is no way for you to filter against particular collection and if you want see the list of clients that needed by the patch ,no way in the console.

You either have to use default reports (if there is any such) otherwise ,create custom report.

Use the below Query in your SSRS or SQL management studio to get list of all updates from particular software update group against collection with missing count.

Declare @CollID nvarchar (255),@SUG nvarchar(255);
Set @CollID='PS100254';set @SUG='SUM_2016_July_All';
--CollID=Collection ID and SUG=Software update group Name

Select CAST(DATEPART(yyyy,ui.DatePosted) AS varchar(255)) + '-' + RIGHT('0' + CAST(DATEPART(mm, ui.DatePosted) AS VARCHAR(255)), 2) AS MonthPosted,
ui.Title, ui.ArticleID, ui.BulletinID, ui.DateRevised,
case when ui.IsDeployed='1' then 'Yes' else 'No' end as 'Deployed',
SUM (CASE WHEN ucs.status=3 or ucs.status=1 then 1 ELSE 0 END ) as 'Installed/Not Required',
sum( case When ucs.status=2 Then 1 ELSE 0 END ) as 'Required'
From v_UpdateInfo ui
JOIN v_Update_ComplianceStatus ucs on ucs.CI_ID = ui.CI_ID --AND ui.IsExpired = 0 AND ui.IsSuperseded = 0
--If you want display the expired and superdeded patches, remove the -- line in the above query
JOIN v_BundledConfigurationItems bci on ui.CI_ID = bci.BundledCI_ID
JOIN v_FullCollectionMembership fcm on ucs.ResourceID = fcm.ResourceID
join v_R_System sys on sys.ResourceID=ucs.ResourceID
where bci.CI_ID = (SELECT CI_ID FROM v_AuthListInfo where title=@SUG)
and fcm.CollectionID =@CollID
group by CAST(DATEPART(yyyy,ui.DatePosted) AS varchar(255)) + '-' + RIGHT('0' + CAST(DATEPART(mm, ui.DatePosted) AS VARCHAR(255)), 2),
ui.Title, ui.ArticleID, ui.BulletinID, ui.DateRevised, ui.IsDeployed
order by sum( case When ucs.status=2 Then 1 ELSE 0 END ) desc

If you compare the result you get from above SQL query ,the required count of clients will vary from what you see in the SCCM console software updates node and this is due the fact that ,in the console ,the software updates do not have any limitation over any collection(They apply to all clients) .But here ,we are trying to limit the software update against particular collection.

You can use this SQL query in multiple ways as you  need.For example ,if someone want to see the list of updates that are still needed by specific collection(BU) ,you can simply comment Software update group and choose only collection ,you can also do the other way.

To get top 5 or 10 missing updates ,simply use TOP 5 or TOP 10 . Full SQL Query is below:

Declare @CollID nvarchar (255),@SUG nvarchar(255);
Set @CollID='PS100254';set @SUG='SUM_2016_July_All';
--CollID=Collection ID and SUG=Software update group Name

Select top 5 CAST(DATEPART(yyyy,ui.DatePosted) AS varchar(255)) + '-' + RIGHT('0' + CAST(DATEPART(mm, ui.DatePosted) AS VARCHAR(255)), 2) AS MonthPosted,
ui.Title, ui.ArticleID, ui.BulletinID, ui.DateRevised,
case when ui.IsDeployed='1' then 'Yes' else 'No' end as 'Deployed',
--SUM (CASE WHEN ucs.status=3 or ucs.status=1 then 1 ELSE 0 END ) as 'Installed/Not Required',
sum( case When ucs.status=2 Then 1 ELSE 0 END ) as 'Required'
From v_UpdateInfo ui
JOIN v_Update_ComplianceStatus ucs on ucs.CI_ID = ui.CI_ID --AND ui.IsExpired = 0 AND ui.IsSuperseded = 0
--If you want display the expired and superdeded patches, remove the -- line in the above query
JOIN v_BundledConfigurationItems bci on ui.CI_ID = bci.BundledCI_ID
JOIN v_FullCollectionMembership fcm on ucs.ResourceID = fcm.ResourceID
join v_R_System sys on sys.ResourceID=ucs.ResourceID
where bci.CI_ID = (SELECT CI_ID FROM v_AuthListInfo where title=@SUG)
and fcm.CollectionID =@CollID
group by CAST(DATEPART(yyyy,ui.DatePosted) AS varchar(255)) + '-' + RIGHT('0' + CAST(DATEPART(mm, ui.DatePosted) AS VARCHAR(255)), 2),
ui.Title, ui.ArticleID, ui.BulletinID, ui.DateRevised, ui.IsDeployed
order by sum( case When ucs.status=2 Then 1 ELSE 0 END ) desc

Now that, we have count of all updates for specific update group for specific collection with required client count ,but how to get the list of clients needed need specific update ?

This is mainly needed if you want to create linked SSRS report to see the list of clients for specific update for troubleshooting purpose.

SQL Query to list the clients required by specific software update ?

Declare @CollID nvarchar (255),@SUG nvarchar(255),@title nvarchar(255);
Set @CollID='PS100254';set @SUG=''SUM_2016_July_All'';
set @title='Security Update for Windows Server 2008 R2 x64 Edition (KB2992611)'
--CollID=Collection ID , SUG=Software update group Name and Title= Name of Software update title

Select sys.Name0,sys.User_Name0,os.Caption0 [OS],ws.LastHWScan,uss.LastScanTime [Last SUScan],os.LastBootUpTime0
From v_UpdateInfo ui
JOIN v_Update_ComplianceStatus ucs on ucs.CI_ID = ui.CI_ID
JOIN v_BundledConfigurationItems bci on ui.CI_ID = bci.BundledCI_ID
JOIN v_FullCollectionMembership fcm on ucs.ResourceID = fcm.ResourceID
join v_R_System sys on sys.ResourceID=ucs.ResourceID
join v_GS_OPERATING_SYSTEM OS on os.ResourceID=ucs.ResourceID
join v_GS_WORKSTATION_STATUS WS on ws.ResourceID=ucs.ResourceID
right join v_UpdateScanStatus uss on uss.ResourceID=ucs.ResourceID
where bci.CI_ID = (SELECT CI_ID FROM v_AuthListInfo where title=@SUG)
and fcm.CollectionID =@CollID
AND UCS.Status='2'
and ui.Title=@title
group by
sys.Name0,sys.User_Name0,os.Caption0,ws.LastHWScan,os.LastBootUpTime0,uss.LastScanTime
order by 1

Hope these SQL queries are helpful to you .

Other day,I was looking at the client health dashboard which I published long ago https://gallery.technet.microsoft.com/SCCM-Configmgr-2012-SSRS-2863c240 . From the dashboard report ,noticed that couple of clients were having software update scan issues .

If client fail to perform success software update scan ,it is out of patching window and client will never send or receive any software updates that you deploy from SCCM. You always need to make sure your clients are performing the successful software update scan as per the schedule you configure in SCCM client agent settings. Software update troubleshooting guide http://eskonr.com/2015/04/sccm-2012-troubleshoot-client-software-update-issues/

So ,the report had couple of clients with software update scan failures with lasterrorcode –2147012894 which leads to me take a look at one client (XXXXXXX) and see what's happening on that.

If you want to see, how your clients are performing software update scan (without dashboard) ,run the below SQL query in management studio.

This query will help you to get list of client that have issues with software update scan (software update scan not success).

--SQL code list clients with software update scan failures

select distinct sys.name0 [Computer Name],os.caption0 [OS],convert(nvarchar(26),ws.lasthwscan,100) as [LastHWScan],convert(nvarchar(26),sys.Last_Logon_Timestamp0,100) [Last Loggedon time Stamp],
sys.user_name0 [Last User Name] ,uss.lasterrorcode,uss.lastscanpackagelocation from v_r_system sys
inner join v_gs_operating_system os on os.resourceid=sys.resourceid
inner join v_GS_WORKSTATION_STATUS ws on ws.resourceid=sys.resourceid
inner join v_updatescanstatus uss on uss.ResourceId=sys.ResourceID
where uss.lasterrorcode!='0'
order by uss.lasterrorcode

Login to the problem client (it can be workstation or server ) ,open WUAHandler.log located in C:\widows\ccm\logs ,notice the below error.

OnSearchComplete - Failed to end search job. Error = 0x80072ee2.

Scan failed with error = 0x80072ee2.

0x80072ee2—>The operation timed out

The above log (Error) do not give much information  ,so this leads me to look at windowsupdate.log located in C:\windows folder

This log has several entries related to proxy request ,send and download file failed etc.

2016-09-01    12:45:14:216     820    ce0    Misc    WARNING: SendRequest failed with hr = 80072ee2. Proxy List used: <10.133.48.48:8080> Bypass List used : <(null)> Auth Schemes used : <>

2016-09-01    12:45:14:216     820    ce0    Misc    FATAL: SOAP/WinHttp - SendRequest: SendRequestUsingProxy failed. error 0x80072ee2

2016-09-01    12:45:14:216     820    ce0    PT      + Last proxy send request failed with hr = 0x80072EE2, HTTP status code = 0

Problematic Client is healthy and able to send inventory and receive other deployments like applications etc but software update scan is failing all the time.

if you look at the above log snippet, it is failing to download the cab files from WSUS server . It looks like ,client has some issues downloading the content ,so how do I check what is causing the problem for content download ?

From Windowsupdate.log snippet, client is trying to access the URL http://SCCMServerName.domain:8530/ClientWebService/WusServerVersion.xml which is failed due to proxy settings.

From other working client, found the below URL succeeded but not on the problem client  ,so I ran the below URL on non-working client and it surely have issues with proxy.

http://SCCMServerName.domain:8530/ClientWebService/WusServerVersion.xml

I ran the same URL on working client and got below results:

How do I fix the proxy issues on the problem client and get the rid of software update scan issues ?

There is a registry key on the client machine which you will have to change to get it working. What is the registry ?

Login to working client that is reporting to the same SCCM site( WSUS) ,open the registry and export for the below registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

Save it on desktop ,copy it to the problematic client and run it (double click on it ).

Once the registry key is imported ,Open services.msc from RUN command ,restart windows update service.

follow windowsupdate.log and WUAHandler.log

After few min ,I noticed that, scan still failed with error code ,but this time it is different : OnSearchComplete - Failed to end search job. Error = 0x80244010.

0x80244010.—> The number of round trips to the server exceeded the maximum limit.

After a while ,it will try (you don’t have to do any) again to sync and sync will get Successfully completed .

If the sync is not running ,initiate software update scan cycle and monitor WUAHandler.log

Now go back to your site server ,run the SQL query ,you will see problematic client will no longer appear.

Summary:

For software update scan issues with error code:0x80072ee2

login to the working client ,export the registry key ,import into the problem client ,restart windows update service ,wait for a while ,monitor the logs.

References :

http://eskonr.com/2015/04/sccm-2012-troubleshoot-client-software-update-issues/

http://s9org.blogspot.sg/2015/03/software-updates-are-not-getting.html

https://blogs.technet.microsoft.com/sus/2008/09/18/wsus-clients-fail-with-warning-syncserverupdatesinternal-failed-0x80244010/

Since few days ,have been working on case with Microsoft on client issue wherein ,some clients stuck at downloading the policies/jobs and remain in Queued state without any reason and they never get deployments.

When you deploy the software update group to collection ,you will have to put a special attention to configuration setting in download settings : “If software updates are not available on preferred distribution point or remote distribution point,download content from Microsoft updates”

This is a new feature in Configuration manager 2012 SP1 that allows clients to fall back and use Windows Update to download the content. The client will only download content for the updates you have approved and deployed to client.

This is good option to select when the content is not available on Distribution point or client has some issues (possibly network)downloading the content from distribution point and client will direct to Microsoft update,download the content and install it.

But ,what happens when client do not have access to the internet (Microsoft update) and content is not available on the DP ? Here the problem comes.

If you check the option “if updates not available on DP, download from Microsoft Updates”, when the local/remote DP’s content location is not available, clients fallback to download from Microsoft Update, however, if it also fails at downloading from MU with some Internet connection issue, the DTS job (DataTransferService) keeps retrying the download the content and increments the Active job count on each failure until reaching the Active Job limit of 50 and  it never gets decremented.

DataTransferService.log shows

Downloading from http://wsus.ds.download.windowsupdate.com:80/c/msdownload/update/software/secu/2016/07 without proxy encountered error: BITS error: 'The operation timed out

Context: 'The error occurred while the remote file was being processed.

QUEUE: Active job count incremented, value = 50

DTSJob {97A264D2-B234-4ED7-B1D9-257F80920063} in state 'Queued'.

If the client exhausts the Active Job limit, the clients get stuck and never receive any policy unless you reset the active job limit .

Though we have successfully distributed the content to DP’s (can see from the console and reports) and hundreds of clients in the same subnet/region are successfully downloaded /installed but not all clients.

So the only possible fix is: Restart SMS agent host on the problematic clients. This process will reset the active job limit and start downloading the policies and content without any further changes on the site server ,but make sure to deselect the setting if your clients do not have access to internet.

I am not sure with the selected settings above (download content from Microsoft update ),if this issue appear in Configuration manager current branch or is it only appear in Configmgr 2012  .

This issue is filed as bug in Microsoft connect and is active Status . https://connect.microsoft.com/ConfigurationManagervnext/feedback/details/956321/css-configmgr-2012-r2-dts-does-not-decrement-active-bits-job-counter-when-it-fails-to-download-content-from-the-mu-location

There is no updated information yet on this issue from product team but can we see this issue fix in next cumulative update for Configmgr 2012 ?

I wrote a blog post year ago on how to get count of MS Office Editions with versions installed across my environment using SCCM Configmgr. This report consists of 2 reports .1st report is ,to get count of Microsoft Editions for ex: how many are office 2003, 2007 ,2010 and 2013 and 2nd report is actually drilled report linked to 1st report to give list of all MS Office editions (what are the editions of office 2003 ,2007,2010 and 2013) with its client count .

Many of my blog viewers have requested through comments and some of them are via social networking sites ,that they want drill down the 2nd report to see the list of clients with each office edition and version.

Having drilled report to see the list of clients will certainly help to investigate and upgrade them to latest version of Microsoft office.

You can always create collection for office editions but having a report like this would help to export them to excel and other SSRS supported formats.

This request is pending from very long ,it was lying in my to-do list and finally going out through this blog post.

So what all you need to get this report (Count of MS office editions ) implemented in your SCCM site ?

Download the 3 reports from the TechNet Gallery ,upload the reports into your SSRS folder (make sure they all in same folder),change the data source for each report and you are good to run.

Note: This report will list only Microsoft Office 2003,2007,2010 and 2013 but not office 365. If you need office 365, you may have to wait for next update ,otherwise you can edit the RDL file and customize it.

How does the report look like ?

1. Count of MS Office editions

2. List MS Office editions for selected version (ex: 2003)

3. List of Clients by specific MS Office edition and version

Hope it helps.

Microsoft releasing the technical preview updates for SCCM Configmgr every month as part of ongoing commitment to quality and innovation .These technical preview updates will help to test in lab environment and report feedback to Microsoft before they made General Available (current Branch).To see these preview updates in your Configmgr console,you must have the base version of SCCM Configmgr Technical preview 5 (not applicable to current branch).These Technical Preview updates are intended for use in a lab environment. For more information about technical preview and updates, please refer https://technet.microsoft.com/library/mt595861.aspx?

Today,28th September 2016 ,Microsoft released latest technical preview update 1609 (YYMM) (Note : this is only for base version Technical preview 5 but not for Current Branch V1606,Production version) with some exciting features .

To use the technical preview you must first install a baseline version of the technical preview build. After installing a baseline version, you then use in-console updates to bring your installation up to date with the most recent preview version. Typically, new versions of the Technical Preview are available each month.Only the version included with System Center Technical Preview 5 can be used for a baseline install.

Features/updates included in this update are:

• Windows 10 Upgrade Analytics – Assess and analyze device readiness and compatibility with Windows 10 to allow smoother upgrades.  This is done through integration with Windows Upgrade Analytics.
• Office 365 Client Management Dashboard – Use the Office 365 client management dashboard to track Office 365 updates and deployments.
• Deploy Office 365 apps to clients – We have added a new Office 365 Servicing node in the Software Library where you can deploy Office 365 apps to clients.
• Improvements for BIOS to UEFI conversion – An OS deployment task sequence can now be customized with a new variable, TSUEFIDrive, so that the Restart Computer step will prepare the drive for transition to UEFI. See the documentation for additional details on the necessary customizations.
• Improvement to Endpoint Protection antimalware policy settings – You can now specify the level at which the Endpoint Protection Cloud Protection Service will block suspicious files.
• Boundary Group Improvements – Improvements have been made to boundary groups to allow more granular control of fallback behavior, and greater clarity of what distribution points are used.

For more information, read the documentation Technical Preview for System Center Configuration Manager https://technet.microsoft.com/library/mt595861.aspx?

Happy exploring new features..

Recently ,I worked on on a SCCM project and as initial step ,it was mandatory to bring all the desktops and servers (where ever it was missing) into SCCM with Client installed.

Though ,there are different client installation methods available to install SCCM Client , one of the  most widely used client installation method is Client startup script deployed via group policy.

Jason Sandys (MVP) created nice Client Startup Script (group policy) that install configmgr client agent during the system initial boot up.

If you want to achieve good client success rate ,would strongly recommend to look into script and get it implemented .

You can download the script from his blog post http://blog.configmgrftw.com/configmgr-client-startup-script/ .It has pdf document with all the instructions ,how to edit the xml file to make necessary changes.

In this blog post, I will show you, how to implement Jason Sandys client start script in your environment starting from creation of SCCM client folder ,creation of group policy ,deploying the group policy and tracking the results incase of any failures. Hope this blog can help to start with.

1. Login to your SCCM server ,create a folder called SCCMClient in D:drive( any other)

2. Copy the SCCM Client installation source files from your SCCM installed directory to above created folder (SCCMClient).

Copy the client installation files to SCCMClient folder

3.Create folder called hotfix in SCCMClient folder to place the hotfixes if at all any. (If you do not have any hotfixes to install ,you can simply ignore this step) .This step is needed to install the hotfixes along with SCCM client . If you are running on configmgr R2 SP1 CU3, then you need copy CU3 hotfix files into it.

4. Since am running on SCCM 2012 R2 SP1 CU3 (KB3135680) ,go to your hotfix folder (D:\Program Files\Microsoft Configuration Manager\hotfix\KB3135680\Client) ,identify the correct KB (latest cumulative update) ,client folder, copy the folder into hotfix folder.

Copy above 2 folders into hotfix folder

5. Now we need to share this folder so that ,it can be accessed during the client install at system boot up time.

Right click on the folder properties ,Go to sharing tab ,advance sharing

Client on Permissions ,give full control to every one

Click Ok ,Ok ,Ok

Note the share folder path which is need to input into the control file (xml) later.

6. Now ,we will create another folder inside the SCCMClient to store the error logs for the client that fail for some reason so we can investigate at later times.

Create a folder called Errorlogs

7. With this ,we have finished with folder creation and copied all necessary files . Now lets edit the start up script file and move onto group policy creation.

Go to the downloaded script folder ,edit ConfigMgrStartup.xml using notepad and make necessary changes as said in the PDF document .

This xml file is used supply the input parameters need for vbscript during the client installation.

You are required to make couple of changes as listed below (mandatory).

Parameters to edit are:

AgentVersion—Client with less than this version will initiate SCCM client install

ClientLocation—Client installation folder what we created above initiate ccmsetup from specified.

ErrorLocation –to store the error logs (computername.log) incase of any SCCM client failure

AutoHotfix –if you have any hotfix to install ,will added to the ccmsetup.exe command line else ,you can ignore this .

SMSMP---Management Point

For all the location paths, I would recommend to use FQDN instead of hostname.

My xml file looks like this:

<?xml version="1.0"?>
<Startup>
<Option Name="LocalAdmin" >eskonr/localadmin</Option>
<Option Name="SiteCode" >P01</Option>
<Option Name="CacheSize">10120</Option>
<Option Name="AgentVersion">5.00.8239.1403</Option>
<Option Name="MinimumInterval">0</Option>
<Option Name="ClientLocation">\\SGCM01.apac.eskonr.com\SCCMClient</Option>
<Option Name="MaxLogFile">2048</Option>
<Option Name="ErrorLocation">\\SGCM01.apac.eskonr.com\SCCMClient\Errorlogs</Option>
<Option Name="AutoHotfix">\\SGCM01.apac.eskonr.com\SCCMClient\Hotfix</Option>
<Option Name="Delay" >5</Option>
<InstallProperty Name="FSP">SGCM01.apac.eskonr.com</InstallProperty>
<InstallProperty Name="SMSMP">SGCM01.apac.eskonr.com</InstallProperty>
<CCMSetupParameter Name="BITSPriority">HIGH</CCMSetupParameter>
<CCMSetupParameter Name="noservice" />
<ServiceCheck Name="BITS" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="winmgmt" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="wuauserv" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="lanmanserver" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="RpcSs" State="Running" StartMode="Auto" Enforce="True" />
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="EnableDCOM" Expected="Y" Enforce="True" Type="REG_SZ"/>
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="EnableRemoteConnect" Expected="Y" Enforce="False" Type="REG_SZ"/>
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="LegacyAuthenticationLevel" Expected="2" Enforce="False" Type="REG_DWORD"/>
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="LegacyImpersonationLevel" Expected="2" Enforce="False" Type="REG_DWORD"/>
</Startup>

save the xml file .

we are now ready to implement the client start up script using Group policy.

if you are not authorized/permission issues to create group policy ,take the below scripts and handover to Active Directory guy to create start up script for you.

8.Login to the domain controller ,Go to Group Policy Management console ,create new Group policy and called it ‘Install Configmgr Client 2012’

Right on the GPO you created above and click on edit

Drill down to Policies –windows settings –scripts (startup/ Shutdown) ,double click on startup

Click on Show files

Now we need to place the vbscript and xml file in the startup folder

If you have issues with access denied when trying to place the files, you may have to open the actual folder (C:\windows etc) on your domain controller to place the files.

Go back to the startup script properties and click add and browse to select vb script

select ConfigMgrStartup1.75.vbs

In the script parameters ,type in /Config:ConfigMgrStartup.xml

Click ok

Click ok and close the Group Policy Management Editor .

we are now ready to link the GPO to any OU that you want the computers receive Configmgr client during the system boot up.

For troubleshooting ,script will create log file with name Scriptfilename.log (ConfigMgrStartup1.75.vbs.log) in C:\windows\temp folder and for some reason ,the client did not install ,it will copy the log file to errorlog location with computer name as log file.

Hope it helps.

For those of you who didn’t make it to Microsoft Ignite 2016 (September 26–30, 2016, Atlanta, GA ) this year or who attended and they want to recall it ,Microsoft have uploaded some of the sessions (for now ) to YouTube channel and they upload most of them for offline watching.

All the previous years ,Microsoft used to upload the videos on channel 9 but for this year ,they have made it available on YouTube channel.

These sessions are created as playlist based its content type security ,mobility ,deployment,developer etc.

Watch videos on YouTube: https://www.youtube.com/channel/UCrhJmfAGQ5K81XQ8_od1iTg/playlists

Get the session catalog from https://myignite.microsoft.com/sessions

Go through the videos  and for sure ,you will take lot of interesting stuff from it .

Recently  I was going through some of the Microsoft Ignite 2016 sessions that are related to windows 10,Intune ,MBAM ,UE-V ,Power BI ,Server 2016 and configuration manager which are uploaded to YouTube. During my surfing ,I found lot of videos on these technologies .

So ,in this blog post, I will share the sessions that are related to Configuration Manager ,Windows 10, Intune, MBAM ,UE-V and Power BI which will help you to go through and take notes for future reference.

Hope you will find them useful too.

Join Windows 10 in Azure AD in five easy steps

https://www.youtube.com/watch?v=-CorjRbc7ME

Troubleshoot Windows 10 deployment: top 10 tips and tricks

https://www.youtube.com/watch?v=PZOtTzQjeeM

Dig deeply into BranchCache: learning from the experts

https://www.youtube.com/watch?v=ak25IoIli8s

Get an independent insiders view of desktop virtualization and session remoting:

https://www.youtube.com/watch?v=Nt9U9T7dSrU

Join your Windows 10 devices to Azure AD for anywhere, anytime productivity

https://www.youtube.com/watch?v=MkPG4JhzvII

Discover how App-V and UE-V align with an Evergreen Windows 10

https://www.youtube.com/watch?v=v-QthxIGAlQ

Get your LOB application data into Microsoft Power BI

https://www.youtube.com/watch?v=pbdw6xBl0Vc

Delight users and IT with modern identity experiences on Windows 10

https://www.youtube.com/watch?v=cnpauXwB0DE

Ask us almost anything about Windows 10

https://www.youtube.com/watch?v=2HE6JYsUGN4

Learn the top 10 reasons why you'll like Windows Server 2016

https://www.youtube.com/watch?v=r2-wl1RFM3U

Upgrade, upgrade, upgrade! Say goodbye to clean installs of Windows 10

https://www.youtube.com/watch?v=wZUi_YPsvos

Implement Windows as a Service: how Microsoft IT does it

https://www.youtube.com/watch?v=fRB9_qvauQM

Discover Windows 10 Internals

https://www.youtube.com/watch?v=Qz2bRdwS4O4

Simplify OS deployments with Windows Provisioning

https://www.youtube.com/watch?v=R8IMxWJ65bs

Conduct a successful pilot deployment of Microsoft Intune

https://www.youtube.com/watch?v=ZfHhXYLGYe0

Implement Windows as a Service: how Microsoft IT does it

https://www.youtube.com/watch?v=fRB9_qvauQM

Deploy and manage BitLocker using MBAM

https://www.youtube.com/watch?v=huSiZdLcyKk

Meetup: Learn how to start a user group

https://www.youtube.com/watch?v=N_DPby9P5ZM

Deploy Microsoft Office 365 Client using Configuration Manager

https://www.youtube.com/watch?v=GzZ2haV15nY

See what's new in mobile application management with Microsoft Intune

https://www.youtube.com/watch?v=5T3F8BELCtE

Windows 10 Under the Hood updates with Michael Niehaus

https://www.youtube.com/watch?v=rPVlW7_gnps

Understand and troubleshoot power management and modern standby in Surface and Windows 10

https://www.youtube.com/watch?v=au64NQGZS-4

Case of the unexplained: Windows troubleshooting with Mark Russinovich

https://www.youtube.com/watch?v=sAUeC2LiF5s

Secure Android devices and apps with Microsoft Intune

https://www.youtube.com/watch?v=CxpZTg33grM

Manage and secure iOS and Mac devices in your organization with Microsoft Intune

https://www.youtube.com/watch?v=-kx7ZRXQlxY

Understand settings roaming solutions in Windows

https://www.youtube.com/watch?v=OG58JBMliH8

Explore Windows 10 in education: innovations for using and deploying in schools

https://www.youtube.com/watch?v=fs46MzF3VDc

Enhance Windows 10 security and management with ConfigMgr, Intune, and new cloud services

https://www.youtube.com/watch?v=UDYm-5jb_kg

Ask the experts - Windows10 deployment, servicing, and provisioning

https://www.youtube.com/watch?v=pRNkNd3VU8Q

Upgrade to Windows 10: in depth

https://www.youtube.com/watch?v=eMV7OMMJ8kM

Cert Exam Prep: Exam 70-698: Installing and Configuring Windows 10

https://www.youtube.com/watch?v=KRp69ZkNARI

Prepare for Windows 10 and UEFI

https://www.youtube.com/watch?v=XOeCi9nQW5o

Customize the start menu in Windows 10

https://www.youtube.com/watch?v=T8cHQ5jZuuY

Learn what's new with OSD in System Center Configuration Manager and Microsoft Deployment Toolkit

https://www.youtube.com/watch?v=oYz9BGb2ysM

Use simplified provisioning tools to get Windows 10 up and running in schools

https://www.youtube.com/watch?v=qbEbBodR7Uc

Master Windows 10 Deployments – Expert Level

https://www.youtube.com/watch?v=jULZkDUG6Rs

Deploy and manage Office in complex scenarios with Configuration Manager

https://www.youtube.com/watch?v=59nxWjFFeWg

Secure access to Office 365, SaaS, and on-premises apps and files with Azure AD and Intune

https://www.youtube.com/watch?v=s_t0Sy7O6KM

Manage your mobile devices and apps with System Center Configuration Manager and Microsoft Intune

https://www.youtube.com/watch?v=_OpbL8zPZDA

Meet Windows Server 2016 and System Center 2016!

https://www.youtube.com/watch?v=0LviCzsudGY

Enhance Windows 10 deployment: what's new with Windows 10 deployment?

https://www.youtube.com/watch?v=tCMijTbWNEI

Until next !

Working on fine tuning collections to get the clients (DEV,UAT,PROD etc)  from Active Directory based on OU for reporting purpose .Reporting can be either application deployment or software update compliance or anything that you want .In my case, all the OU’s in Active Directory are created based on BU( Business Unit) and business unit most likely with country name in OU.

Lets take example of OU structure like below in my Active Directory.

With the above OU structure ,I want to create collection that list all computers from PROD/DR OU for each Business Unit (Hong kong,Singapore,India etc) . Parent OU can be DBS,CT,CX or anything under each Business Unit.

So to get all computers from PROD/DR OU for Hong Kong Business Unit ,we will use wildcard character (%) with like operator in WQL Query .

ESKONR.INTRANET.ASIA/HK/LI/INFRASERVERS/%PROD%

The above Query will list all PROD clients from OU ‘HK/LI/infraservers’

If you want to list all PROD computers from HK OU irrespective of what Child OU they are in, but should be in PROD OU ,use the following condition.

ESKONR.INTRANET.ASIA/HK/%PROD%

If you want to combine PROD and DR Clients into 1 collection ,you can use OR condition by creating 2 criteria's like below.

ESKONR.INTRANET.ASIA/HK/%PROD%

OR

ESKONR.INTRANET.ASIA/HK/%DR%

So ,How to achieve this using collection ?

Create new Device Collection ,Name the collection ,limit the collection to All Systems  ,Add rule and select Query rule ,name the collection again ,select Edit Query statement

Click on Criteria ,select start Burst icon ,click Select

select Attribute class as System Resource and Attribute  as

Click Ok ,select Operator as like and Value is your domain name/HK/LI/%PROD%

Click Ok ,Ok ,Ok and accept the default steps you see the screen.

Below is sample collection criteria used in my lab:

List all servers from PROD and DR OU excluding server 2003 operating system as my lab is running 1 server 2003 OS.

You can still it customize this query as per your needs but all you need is ,how to wild card operator .

Hope it helps!

Great news for all us who are in SCCM Configmgr world. Microsoft just released 3 baseline builds  for SCCM configmgr 1606 in October 2016 i.e Current branch ,LTSB and Tech review  which means, you no longer need to use old baseline build V1511 to upgrade /Install your SCCM hierarchy from SCCM 2012 and install the Current branch updates using updates and servicing method.

In previous days ,If you want to migrate /Install new version of SCCM Configmgr current branch (V1606 for now) ,you must use the baseline build V1511 with supported ADK version of V1507 or V1511 and then install the current branch (1606) updates using updates and servicing method and then update the ADK version to V1607 to support windows 10 new builds.

But from now onwards,you can now upgrade Configuration Manager 2012/R2 directly to version 1606 of the current branch and start taking advantage of new management features, faster and easier updates, support for new Windows releases, and more.

This baseline can be used only to install New sites but not to upgrade from sites like V1511 and for that, you must use In console updates.

Below are 3 different branches of SCCM configmgr with build 1606 released .

1. Current Branch of SCCM

2. LTSB of SCCM

3.Tech Preview of SCCM

Each version has its own limitations and to know more about these limitations and which branch version you should use, please read https://docs.microsoft.com/en-us/sccm/core/understand/which-branch-should-i-use

How to download SCCM configmgr Current branch build version (1606) ?

This build version (1606) can be downloaded from Volume Licensing Service Center (search for “System Center Config”), from Microsoft Evaluation Center and MSDN ,evolution of System Center 2016 (SCCM Version 1606 is now  is now included with System Center 2016 for download.)

The setup process of Configuration Manager (version 1606) allows you to choose to install either the current branch or LTSB.

Volume licensing:

Microsoft Evaluation Center (SC_Configmgr_SCEP_1606.exe):

System Center 2016 :

References:

· https://blogs.technet.microsoft.com/enterprisemobility/2016/10/12/configuration-manager-a-progress-update-on-the-current-branch-and-a-new-servicing-branch/

· Introduction to the Long-Term Servicing Branch of System Center Configuration Manager

· Licensing and branches for System Center Configuration Manager

· Which branch of Configuration Manager should I use?

· Supported Configurations for the Long-Term Servicing Branch of System Center Configuration Manager

· Install and Upgrade for the Long-Term Servicing Branch

· Upgrade the Long-Term Servicing Branch to the Current Branch