book

System Center Configuration Manager Current Branch Unleashed, First Edition

by Kerrie Meyler, Gerry Hampson, Saud Al-Mishari, Greg Ramsey, Kenneth van Surksum, Michael Wiles

April 2018

Intermediate to advanced

1168 pages

37h 9m

English

Sams

Read now

Unlock full access

Part I: Configuration Manager Overview and ConceptsPart II: Planning and InstallationPart III: Configuration Manager OperationsPart IV: Configuration Manager AdministrationPart V: AppendixesLab EnvironmentDisclaimers and Fine Print
10 Reasons to Use Configuration ManagerThe Evolution of Systems ManagementHurdles in the Distributed EnterpriseAutomation ChallengesConfiguration “Shift and Drift”Lack of Security and ControlTimeliness of Asset DataLack of Automation and EnforcementProliferation of Cloud ComputingLack of Process ConsistencyThe Bottom LineSystems Management DefinedMicrosoft’s Strategy for Systems ManagementMicrosoft’s Dynamic Systems Initiative (DSI)ITIL and MOFJudging Your IT Organization’s MaturityBridging the Systems Management GapThe Value Proposition of Configuration ManagerSummary
A Journey Through Time: SMS to ConfigMgr Current BranchSystems Management Server 1.xSystems Management Server 2.0Systems Management Server 2003System Center Configuration Manager 2007System Center 2012 and 2012 R2 Configuration ManagerConfiguration Manager TerminologyConfiguration Manager SiteSite HierarchyCentral Administration SitePrimary SiteSecondary SiteSite SystemsSendersManaging Content (File) ReplicationDiscovering ResourcesConfiguration Manager AgentConfiguration Manager ConsoleCollections for Targeting Users and DevicesQuerying Client DataUsing Alerts to Respond to Problems QuicklyUsing PackagesManaging ApplicationsContent ManagementSoftware Update ManagementCompliance SettingsContent Transfer via BITSMeasuring Software UsageUsing BranchCache and Peer Cache to Reduce WAN ConsumptionReportingWhat’s New in Current Branch (Through the 1710 Release)What’s New in Baseline Version 1511What’s New in Version 1602What’s New in Version 1606What’s New in Version 1610What’s New in Baseline Version 1702What’s New in Baseline Version 1706What’s New in Version 1710Deprecated Features, Software, and Operating SystemsSummary
Understanding the ConfigMgr ArchitectureExternal Components to ConfigMgrConfigMgr Communication MethodsConfigMgr’s Internal ComponentsA WMI PrimerUnderstanding the WMI ArchitectureInside the WMI Object ModelManaging WMIConfiguration Manager and WMIWMI on Configuration Manager ServersThe Configuration Manager Client WMI NamespaceObtaining Hardware Inventory Through WMIAutomating the ConfigMgr Client via WMIInteraction Between WMI and PowerShellInside the ConfigMgr DatabaseConfigMgr Tables and ViewsUsing SQL Server Management StudioExploring the ConfigMgr DatabaseStatus and State Messages OverviewUsing Status MessagesHow State Messages WorkSite-to-Site ReplicationAbout Configuration Manager Database ReplicationAbout Content ReplicationActive Directory Integration with ConfigMgrImplementing Schema ExtensionsTools for Extending a SchemaExtending a SchemaSummary
Developing the Solution ArchitectureDiscovering Business RequirementsDiscovering IT RequirementsAssessing Your EnvironmentEnvisioning the Solution and Scope of DeliveryPlanning for Infrastructure DependenciesADDS ConsiderationsActive Directory Certificate Services ConsiderationsHierarchy Planning in ConfigMgrAbout Configuration Manager SitesPlanning Your Hierarchy StructurePlanning Boundaries and Boundary GroupsSite Planning for Configuration ManagerSite Servers and Site Systems PlanningCapacity Planning for ConfigMgr SitesMeeting Availability RequirementsPlanning for Content ManagementPlanning for Client Deployment and SettingsPlanning Client Discovery and InstallationPlanning Your Client SettingsDefining the User ExperiencePlanning for External Device ManagementPlanning for Internet-Based ClientsPlanning for Mobile Device ManagementPlanning for Continuous UpdatesServicing and Updates in Current BranchTesting and Release Management of Current Branch ReleasesPlanning for Restorability and RecoverabilityAvailability, Restorability, and RecoverabilityDetermining Your Recovery Time and Point ObjectivesPlanning for BackupSummary
Configuration Manager and the NetworkNetwork Considerations for Server PlacementUsing Distribution Points and Secondary SitesUnderstanding Data FlowsCommunication Going to the ClientCommunication from the ClientDesigning Intrasite CommunicationUnderstanding SQL Server CommunicationUsing RPC CommunicationUsing SMB CommunicationUsing External CommunicationUsing Intersite CommunicationFile-Based Replication in ConfigMgrUsing SQL Server–Based ReplicationDesigning Client CommunicationUsing the Service LocationAbout Background Intelligent Transfer ServiceBITS Versions for ConfigMgr ClientsUnderstanding BranchCacheUnderstanding Peer CacheUsing Boundaries and Boundary GroupsAbout Client Communication SecurityTroubleshooting Network-Related IssuesTroubleshooting Basic Network ConnectivityTesting DNS ResolutionTroubleshooting Routers and Firewall PortsCongested or Slow Network LinksTesting MPs and DPsTroubleshooting Service Principal NamesSummary
Performing Preinstallation TasksRequired Windows and Hardware ComponentsSQL Server RequirementsActive Directory RequirementsWindows Server Update ServicesUsing the Prerequisite CheckerUsing the Prerequisite Files Downloader ToolPerforming Site Installation TasksInstalling a Central Administration SiteInstalling a Primary SiteInstalling a Secondary SiteInstallation ValidationConfiguring Site PropertiesInitial ConfigMgr ConfigurationsConnecting ConfigMgr to Cloud ServicesInstalling Optional Site SystemsTroubleshooting Site InstallationUpdating Configuration ManagerScheduling UpdatesUsing CD.LatestSummary
Deciding Whether to Upgrade or Migrate to Current BranchUpgrading to ConfigMgr Current BranchPreparing for UpgradePerforming the UpgradeMigrating to ConfigMgr Current BranchMigration, Not an UpgradePlanning the MigrationPerforming Pre-Migration ActivitiesCoexistence ConsiderationsPerforming the MigrationConfiguring the Active Source SiteConfiguring Child Sites for Data Gathering (ConfigMgr 2007 Only)Performing Migration JobsMigrating Reports and ClientsMigrating ReportsMigrating Custom ReportsClient Migration and MethodsTroubleshooting Migration IssuesSummary
Touring the ConsoleConfiguration Manager Console PanesConfiguration Manager Console BarsUsing the BackstageConfiguration Manager WorkspacesUsing Assets and ComplianceFunctions of the Software LibraryCapabilities of the Monitoring WorkspaceManaging ConfigMgr Through the Administration WorkspaceDeploying the ConsoleConsole PlacementSupported PlatformsInstallation PrerequisitesInstallation Using the Configuration Manager Setup WizardUnattended Console InstallationUsing Role-Based AdministrationHow Content Is DisplayedThe Three States of Objects InteractionConnecting to a SitePersonalizing the ConsoleThe In-Console Alert ExperienceViewing AlertsManaging AlertsConfiguring AlertsSubscribing to AlertsConfiguration Manager Service ManagerInitiating the Configuration Manager Service Manager ConsoleOperating the Configuration Manager Service Manager ConsoleUsing PowerShell with ConfigMgrSecurity ConsiderationsSMS Provider PermissionsDCOM PermissionsWMI PermissionsTroubleshooting Console IssuesConsole LoggingConnectivity IssuesCommon ProblemsSummary
ConfigMgr Client Agent RequirementsAgent Hardware DependenciesSupported Operating Systems for the Client AgentAgent Software DependenciesOther Agent DependenciesInstalling, Upgrading, and Uninstalling ConfigMgr Client AgentsManually Installing on Windows ComputersManually Installing on Mac ComputersManually Installing on UNIX and Linux ComputersUsing Logon Scripts to Install on Windows DevicesInstalling Using Group Policy for Windows DevicesInstalling Using Software Update Point (SUP) for Windows DevicesInstalling and Assigning Windows 10 Clients Using Azure AD for AuthenticationApproving ClientsPushing the ClientAutomatically Upgrading the Client on WindowsUninstalling the ConfigMgr Client AgentFinding Potential ConfigMgr Clients in Your NetworkUsing Active Directory Forest DiscoveryUsing Active Directory Group DiscoveryUsing Active Directory User DiscoveryUsing Active Directory System DiscoveryUsing Heartbeat DiscoveryUsing Network DiscoveryManually Importing Clients into ConfigMgrUsing Azure AD User DiscoveryWhat to Know About Client Agent AssignmentMonitoring Client Agent Health and Activity StatusUnderstanding Client SettingsClient Settings PriorityConfigurable Client SettingsUsing Remote ControlUsing the Resource ExplorerUsing Wake on LAN and Power ManagementUsing Wake on LANConfiguring Power ManagementSummary
Configuring Compliance SettingsUnderstanding Compliance SettingsUsing Configuration ItemsUsing Configuration BaselinesUsing User Data and ProfilesUsing Remote Connection ProfilesCreating Configuration ItemsDevices with a ConfigMgr ClientUsing Devices Without a ConfigMgr ClientCreating BaselinesDeploying BaselinesDeveloping a Compliance StrategyObtaining On-Demand ResultsCorrecting Issues Using RemediationUsing Reporting to Track ComplianceTroubleshooting Settings ManagementSummary
ConfigMgr Applications OverviewUsing the Requirement Rule Component in a DTUnderstanding Detection MethodsUser Device AffinityCreating and Modifying ApplicationsUsing a Definitive Software LibraryCreating a Windows Installer (.msi)-Based ApplicationViewing Application PropertiesCreating Detection MethodsCreating Detection Methods for Windows Installer ApplicationsAdding Other Detection MethodsUsing Custom Script Detection MethodsManaging and Creating Global ConditionsDevice Global ConditionsUser Global ConditionsCreating Custom Global ConditionsManaging Application Management, Application Configuration, and Volume License PurchasesAbout Mobile Application Management PoliciesCreating Application Management PoliciesApp Configuration PoliciesApple Volume License PurchasingIntegrating Windows Store for BusinessMore About Managing ApplicationsAdding Application DependenciesManaging Revision HistoryExporting and Importing ApplicationsSuperseding ApplicationsRetiring and Deleting ApplicationsBest Practices for Working with ApplicationsSupport for Write Filters in Windows EmbeddedDeploying PowerShell ScriptsPowerShell Script Prerequisites and ConfigurationCreating, Editing, Approving, and Denying ScriptsMonitoring ScriptsSummary
Creating and Using Windows Installer Deployment TypesCreating a Windows Installer–Based Deployment TypeCreating a Windows Installer Through MDM Deployment TypeCreating and Using Application Virtualization Deployment TypesCreating a Microsoft App-V 4.6 Deployment TypeCreating a Microsoft App-V 5 Deployment TypeUsing App-V Virtual EnvironmentsCreating an App-V Virtual EnvironmentUsing Deployment Types for Mobile DevicesUsing Sideloading to Distribute ApplicationsUsing Deeplinking with DTs to Distribute ApplicationsCreating and Using Other Deployment TypesCreating a Script-Based Deployment TypeCreating Deployment Types for Mac OSCreating Web ApplicationsSynchronizing Apps from the Windows Store for BusinessSummary
Understanding Packages and ProgramsCreating a Package from a Definition FileCreating a 7-Zip PackageAdvantages of Using an MSI FileConfiguring Package PropertiesUsing the Package Properties Data Source TabUsing the Package Properties Data Access TabUsing the Package Properties Distribution Settings TabUsing the Package Properties Reporting TabUsing the Package Properties Content Locations TabDefining Program PropertiesUsing the Program Properties General TabUsing the Program Properties Requirements TabUsing the Program Properties Environment TabUsing the Program Properties Advanced TabProgram Properties Windows Installer TabProgram Properties OpsMgr Maintenance Mode TabCreating Packages Using the Package and Program Wizard and for UNIX and Linux SystemsCreating a Package Using the New Package WizardCreating Packages for UNIX and Linux SystemsSummary
Creating and Managing CollectionsCreating a CollectionAbout Direct RulesUsing Query RulesUsing Include and Exclude RulesUpdating CollectionsModifying Collection PropertiesUsing Maintenance WindowsUsing Distribution PointsInstalling Distribution PointsUsing and Configuring Cloud-Based Distribution PointsDistributing ContentConfiguring Network Bandwidth for Content DistributionMonitoring Distribution Point StatusUsing BranchCache and Peer CacheUsing Preferred Distribution PointsUsing ContentTroubleshooting Content DistributionDeploying Applications and PackagesDealing with High-Risk DeploymentsSimulating DeploymentsUnderstanding the End-User ExperienceUsing the Old Software CenterUsing the Application CatalogUsing the New Software CenterNotifications and Options for Required DeploymentsMonitoring and TroubleshootingSummary
What’s New with Software Updates in ConfigMgr Current BranchCreating Your Update DesignPlanning for Software UpdatesCapacity PlanningPlanning Your Software Update Point InfrastructureUsing Windows Software Update ServicesConfiguring ComponentsConfiguring Server-Side ComponentsConfiguring Client-Side ComponentsCreating and Deploying UpdatesUsing the All Software Updates NodeUsing Software Update GroupsUsing Deployment PackagesCreating the DeploymentUsing Automatic Deployment RulesUnderstanding Windows 10 ServicingServicing Branches in ConfigMgrAbout Deployment RingsAbout Windows 10 Servicing PrerequisitesUsing the Windows 10 Servicing DashboardServicing PlansClient ExperienceCompliance ScanningUsing NotificationsUsing Software CenterInstalling Updates and Reporting StatusTroubleshooting Software UpdatesMonitoring the Updates ProcessWSUS and SUP in Software UpdatesDownloading UpdatesTroubleshooting Client Scanning and Update DeploymentTroubleshooting Software UpdatesUsing the System Center Update PublisherInstalling SCUPConfiguring SCUPUsing SCUP CatalogsUsing SCUP PublicationsSCUP UpdatesUsing SCUP Custom UpdatesUsing SCUP RulesSummary
Introducing Microsoft IntuneHybrid Versus StandaloneMicrosoft’s Enterprise Mobility + SecurityPurchasing Microsoft IntuneUsing the Management PortalsUsing Intune StorageUser Identity OptionsCloud IdentitySynchronized Identity (Password Synchronization)Federated IdentityPreparing Your Environment for IntuneAdding and Verifying a Custom DomainCreating DNS RecordsAdding a User Principal NameSynchronizing Active DirectoryImplementing an Alternate Login ID (Optional)Integrating Intune with Configuration ManagerConfiguring User DiscoveryCreating a User CollectionAdding an Intune SubscriptionAdding the Service Connection PointRemoving an Intune SubscriptionRemoval of Intune ExtensionsTroubleshooting Intune HybridViewing Site and Component StatusUsing Log FilesViewing Intune StatusTroubleshooting Directory SynchronizationUtilizing Microsoft Support for IntuneAccessing the Microsoft TechNet ForumUsing the Configuration Manager Hybrid Diagnostics ToolSummary
Enabling Devices for ManagementEnabling Android Devices for ManagementEnabling iOS Devices for ManagementEnabling Windows Phone Devices for ManagementUsing Windows Computers as Mobile DevicesManaging Company DevicesDevice Enrollment Program (iOS Only)Apple Configurator (iOS Only)Device Enrollment ManagerProtecting Mobile DevicesRetiring and Wiping Mobile DevicesResetting PasscodesRemotely Locking a DeviceAccessing Activation Lock Bypass (iOS Only)Configuring Mobile DevicesCreating Configuration Items and BaselinesUsing Custom Configuration ItemsAbout Device Policy Refresh IntervalsInventorying Mobile DevicesDeploying AppsLeveraging Mobile Application Management (MAM)Creating Mobile Device CollectionsUsing the Company Resource Access WorkspaceUsing Certificate ProfilesUsing Email ProfilesDeploying VPN ProfilesUsing Wi-Fi ProfilesOn-Premise Mobile Device ManagementManagement CapabilitiesAdvantages and Disadvantages of On-Premise MDMOn-Premise MDM ConfigurationOn-Premise MDM Client ConfigurationSummary
Understanding Modern AuthenticationImplementing Configuration Manager PoliciesSupported Compliance Policy SettingsCreating a Compliance PolicyDeploying a Compliance PolicyEnabling Conditional Access for Exchange OnlineRequirements for Exchange OnlineEnabling Conditional Access for Exchange OnlineExchange Online End-User ExperienceEnabling Conditional Access for SharePoint OnlineRequirements for SharePoint OnlineEnabling Conditional Access for SharePoint OnlineThe SharePoint Online End-User ExperienceEnabling Conditional Access for Skype for Business OnlineRequirements for Skype for Business OnlineConfiguring Conditional Access for Skype for Business OnlineEnabling Conditional Access for Exchange On-PremisesRequirements for Exchange On-PremisesImplementing the Exchange Server ConnectorConfiguring Conditional Access for Exchange On-PremisesThe Exchange On-Premises End User ExperienceMonitoring and Troubleshooting Conditional AccessMonitoring Conditional Access ComplianceTroubleshooting Conditional AccessSummary
Protection Capabilities of Microsoft’s Antimalware PlatformUsing Antimalware as a ServiceUnderstanding Microsoft’s Core Protection TechnologiesUnderstanding Windows Antimalware CapabilitiesUsing Windows Defender OfflineMicrosoft’s Approach to AntimalwarePrerequisites for Endpoint ProtectionPlanning and ConsiderationsGathering Requirements for Endpoint ProtectionDetermining Definition Update SourcesLeveraging ConfigMgr’s CapabilitiesUsing System Center Endpoint Protection with Windows 10Deployment Best PracticesDeploying and Configuring Endpoint ProtectionInstalling the Endpoint Protection Point RoleDelivery of Definition UpdatesWorking with Antimalware PoliciesInstalling the Endpoint Protection ClientMonitoring and Reporting in Endpoint ProtectionOperational Status of Endpoint Protection ClientsReports Available for Endpoint ProtectionIntegrating Report Data with Other SystemsEndpoint Protection Actions and AlertsOverview of Endpoint Protection AlertsEnabling Alerts for a CollectionOn-Demand Actions Related to Endpoint ProtectionScripting Endpoint Protection ActionsWindows Defender Advanced Threat ProtectionWindows Defender ATP CapabilitiesPrerequisites for Windows Defender ATPConfiguring Windows Defender ATP Using ConfigMgrSummary
Introducing the Queries NodeOrganizing the Query List PaneViewing Queries and Query ResultsCreating QueriesBuilding Queries Using the WMI Query LanguageUnderstanding Query Objects, Classes, and AttributesUsing the ConfigMgr Query BuilderUnderstanding Criterion Types, Operators, and ValuesFiltering Queries with Criterion TypesUsing Relational and Logical OperatorsSpecifying or Selecting ValuesWriting Advanced QueriesLimitations of Extended WQL in ConfigMgrUtilizing the Date and Time Functions in WQL QueriesExamples of Advanced QueriesConverting WQL to SQLUnderstanding Relationships, Operations, and JoinsQuerying Discovery DataQuerying Inventory DataUsing Query ResultsExporting Query Results to a Text FileImporting and Exporting Queries between SitesCreating a Collection Based on Query ResultsUsing Status Message Queries for In-Depth AnalysisViewing Status MessagesCreating Status Message QueriesSummary
Overview of SSRS and Configuration Manager ReportingUsing SQL Server Reporting ServicesUsing the ConfigMgr Reporting Point RoleNotable Reporting Point InformationUnderstanding Configuration Manager DataUsing Discovery ClassesUsing Hardware Inventory ClassesConfigMgr Software Inventory ClassesUsing Software Update Inventory ClassesAbout Software Metering Inventory ClassesAbout Status Message ClassesAbout State Messages ClassesUsing Collection Data ClassesIntroducing Transact-SQLIntroducing SQL Server Management StudioBasic SQL Sections in a QueryUsing OperatorsBuilding a Report DesignAbout Report SeriesCreating Consistent ReportsBuilding a Basic ReportTools for Creating ReportsGetting Started with SSDT-BICreating a Basic ReportCreating a Data SourceCreating a DatasetAccessing the ToolboxAdding a Table to a ReportPreviewing a ReportPublishing a ReportAdvanced Reporting ConceptsSummary
What’s New with OSD in Current BranchOSD Deployment ScenariosTools Used with OSDUsing Sysprep to Assist with ImagingIncorporating the Windows ADKUsing the User State Migration ToolPlanning for OSDUsing the ConsoleUsing Drivers and Driver PackagesUsing Operating System ImagesUsing Operating System Upgrade PackagesUsing Boot ImagesUsing Task SequencesUsing Tasks and Variables in a Task SequenceUsing TasksUsing VariablesSite System Roles for OSDUsing Distribution PointsUsing State Migration PointsGetting Ready for DeploymentDistributing the ContentDeploying the Task SequenceCreating the TS MediaCreating Stand-alone MediaCreating Bootable MediaCreating Capture MediaCreating Prestaged MediaTroubleshooting OSD DeploymentsMonitoring OSDBoot Image Command-Line SupportUsing OSD Log FilesUnderstanding the PXE Boot ProcessUpdating Your OS ImagesSummary
Planning for Security and DelegationSecurity Planning OverviewA Security PrimerDesigning Your Hierarchy for SecurityPlanning for Secure AdministrationConfigMgr Security SolutionsAbout Role-Based Administration in ConfigMgrManaging Administrative UsersSecurity RolesCreating Custom RolesUsing Security ScopesAssociating Security Scopes and Collections with Individual RolesUsing Administrative Security ReportsSecuring Administrative Access to ConfigMgrSecuring Access at the Active Directory LevelSecuring Site System Local AdministrationThe Just Enough Administration (JEA) Security FeatureSecuring Access at the Database LevelAuditing ConfigMgr Administrative ActionsSecuring the ConfigMgr InfrastructureSecuring Site SystemsAbout ConfigMgr Cryptographic ControlsSecuring Network CommunicationsConfigMgr Content SecuritySecuring ConfigMgr AccountsSummary
Implementing Configuration Manager BackupConfiguring the Backup Site Server Maintenance TaskUsing SQL BackupAdditional Files to Back UpRecovering Configuration Manager SitesSelecting Recovery OptionsRestoring a Failed SiteMaintaining a Configuration Manager SiteConfiguring Built-in Maintenance TasksOptimizing SQL ServerMaintaining Windows Server Update ServicesUsing ConfigMgr Site Maintenance OptionsMonitoring Configuration ManagerMonitoring Site ReplicationUsing System Center Operations ManagerSummary
Viewing Log FilesConfiguring LoggingServer-Side Logging LevelsMP/Client and Console Logging LevelsClient LogsServer LogsSite Server LogsServer Installation and Update LogsSite System LogsCloud Management Gateway Logs in Azure
Modern Management in Windows 10Defining Co-ManagementWhy Co-Management?Choosing Where to Start with Co-ManagementConfiguring Co-Management in ConfigMgrCo-Management PrerequisitesEnabling Devices for Co-ManagementMoving Workloads from ConfigMgr to Intune
General ResourcesMicrosoft’s Configuration Manager ResourcesOther Configuration Manager ResourcesBlogsPublic ForumsUtilities
Configuration Manager ReportingLive LinksExtending Hardware Inventory—Online Only