ConfigMgr 0xc0000359 error code on Generation 2 UEFI machine

I came across a strange issue today whilst working with a colleague I met on a project.

He was trying to build a new x64 generation 2 virtual machine using ConfigMgr 2012 R2 but it was failing with the following error:

File: \Windows\System32\boot\Winload.efi
Status: 0xc0000359

We noticed that upon hitting F12 to boot the machine was pulling down the x86 boot image. At this point the machine was unknown to ConfigMgr, and our unknown computers collection had 2 task sequences advertised - Windows 8.1 x64 and x86

So we disabled the x86 task sequence and voila! it booted from the x64 wim, We then re-enabled it and it booted from the x86 wim.
Not happy with this behaviour I dug a little deeper......

SMSPXE.log told us the deploymentID it had selected ended in 20017 and this gave me an idea, we turned to Deployments under the Monitoring workspace in the ConfigMgr console and viewed the DeploymentIDs of our 2 task sequences.

We noticed that the x86 one ended in 20017 and the x64 ended in 20016, it seemed that the newer DeploymentID of the two was taking precedence....

 

 



So we deleted the x64 deployment and recreated it, which then gave it a higher DeploymentID than the x86 task sequence (below)

We tried it again and it pulled down the x64 wim file this time! Result!

To be sure this was the cause we then did the same with the x86 task sequence (deleted and re-deployed it) and sure enough it pulled down the x86 wim file.

So long story short: Deploy your x64 task sequence last if you are deploying more than one task sequence to a collection

Cheers

Wayne

How to automatically clean your disk at the start of your task sequence

As you may know cleaning an encrypted disk is often required before starting an image via ConfigMgr.  This presents problems in that the disk is not accessible for a package to be stored upon it and often means we have to manually run diskpart to clean the disk.
I wasn't happy with this and with the current 8.1 deployment I am working I thought there must be a way around it....

So I came up with the following powershell 1 liner to handle this issue:

Powershell.exe Get-Disk | % {Clear-Disk -Number $_.Number -RemoveData -RemoveOEM -Confirm:$False}

Shown below in the screenshot

The only downside with this is that you have to add the following optional components to your boot images so they will become around 100mb larger:

WinPE-StorageWMI
WinPE-NetFx
WinPE-PowerShell

Cheers
Wayne

*Please be aware, this will clean ALL disks in the machine*

Windows 7 Restarts at Capture step ConfigMgr 2012 R2

The title says it all, I am currently building and capturing a Windows 7 Enterprise x64 image at a customer site using ConfigMgr 2012 R2.
When the Task sequences gets up to the capture step it spontaneously reboots and I end up with a 0kb .wim file, not much use...

The logs however show the following:

See the reboot pending?. Add a reboot in between your Prepare OS and Capture the reference machine steps and you may find you have a bit more luck with it ;)

(Also despite what it may look like I had full network connectivity at this point)

Possibly a bug with R2, I'm not sure but either way its a suitable workaround

Cheers
Wayne

SCCM 2007 Migration failure due to site system named LOCALHOST

This post covers an issue I encountered during a migration and how to fix it.

If you are performing a Configuration Manager 2007 to 2012 Migration and have a site system in the console with the name LOCALHOST that holds the ConfigMgr site server database role as shown:

You will see the following error in the Migmctrl.log file when attempting to gather data from the source hierarchy in your 2012 environment:

To fix this you must run ConfigMgr setup from the 2007 Site server:

When the wizard launches be sure to select Perform Site Maintenance or reset the Site

On the desired action page select Modify SQL Server Configuration

On the SQL Server Configuration page change LOCALHOST to the name of the ConfigMgr 2007 server.

Allow the wizard to complete and review the log file when given the opportunity. You should now see in the console that the ConfigMgr site server database role is now held by the correct site system and not LOCALHOST.

Back in the 2012 environment, retry the data gather and you should have a little more success :)

Wayne

SCCM Task Sequence Error "The requested software cannot be located"

Another day another task sequence......

If you get the following error when trying to run a task sequence from within the OS:

Followed by this type of error in the execmgr.log file:

Then the problem most certainly lies with a package your task sequence is referencing, to test simply delete the steps from your task sequence that reference a package (backup your TS first!)

Delete them one by one and you will eventually find the culprit :)

Or run through the task sequence and check each package has a DP assigned to it and has been updated recently

Cheers

SCCM Task Sequence - Exclude Model from Step

Just a quick one for future reference:

To exlcude a model from a step in a task sequence use the following syntax:

SELECT * From Win32_ComputerSystem WHERE NOT Model Like "%Model%"

slightly different to what you would expect and may catch you out ;)

Cheers

change the Bitlocker cipher strength - SCCM Task sequence

Here is a fantastic blog post that explains how to change the Bitlocker cipher strength during your SCCM task sequence, very handy to know! :)

http://blogs.technet.com/b/configurationmgr/archive/2010/08/10/how-to-change-the-default-bitlocker-encryption-method-and-cipher-strength-when-using-the-enable-bitlocker-task-in-configmgr-2007.aspx

Setting Up Bitlocker Using SCCM & Group Policy (and optionally HP SSM)

This is a step by step of how I setup Bitlocker in my TEST environment; please use it only as a reference if you get stuck and as always before beginning RTFM! :)

Step 1 – Update the Schema / Verify you have the correct Schema

All of my DC’s were either running 2008 R2 or were higher than the minimum of server 2003 SP1.
If you have a mixture of DC’s like me, you will be fine as server 2008 DC’s already have the schema extensions in place for bitlocker. If have an all server 2003 environment then update the Schema using the official documentation found here:
http://technet.microsoft.com/en-us/library/dd875529(WS.10).aspx

Its also worth noting that BitLocker does not impose any requirements on domain or forest functional levels. However, domain controllers running operating systems earlier than Windows Server 2003 with SP1 should be removed from mixed-functional-level environments (or upgraded), because backed up BitLocker and TPM information will not be protected on those domain controllers.

If you wish to verify that you have the correct schema extensions in place (as I did) then hop onto a DC as a domain admin/schema admin and crack open ADSI edit.
Right at very root of ADSI edit click right click and select “connect to” then under the naming context select the schema as below

Browse through the schema and you should see 6 attributes (only 5 are in the shot below)

These are:
CN=ms-FVE-KeyPackage
CN=ms-FVE-RecoveryGuid
CN=ms-FVE-RecoveryInformation
CN=ms-FVE-RecoveryPassword
CN=ms-FVE-VolumeGuid
CN=ms-TPM-OwnerInformation

Step 2 – Run Add-TPMSelfWriteACE.vbs to allow recovery passwords to be stored in AD

For the next step hop back onto a DC as domain admin and run the script Add-TPMSelfWriteACE.vbs and verify that you get a “success” message. The sample deployment scripts for bitlocker (including this one) can be found here:
http://archive.msdn.microsoft.com/bdedeploy/Release/ProjectReleases.aspx?ReleaseId=3205
If you are not sure how to run these scripts please seek help from a colleague.

Step 3 – Verify the ACE has been added

To do this I suggest using a domain admin account again and drilling down deep into your AD structure and finding a random computer object (this is just to prove that the ACE has been inherited)
If you right click on your computer, properties and under security click effective permissions and enter “SELF” you should see these 2 attributes:
Create msFVE-RecoveryInformation Objects
Delete msFVE-RecoveryInformation Objects
This will allow computers to read and write their recovery passwords to and from AD.

Step 4 – Configuring Group Policy To automate saving Recovery Passwords & TPM info To AD

Below is the Group policy I set for our Bitlocker test environment, set yours up the same (You can always come back later and tweak it, but for now let’s just get it working ;) )

Now Apply this to a test OU with a single computer in it and let’s start with SCCM

Step 5 – Setting Your Disk In The SCCM Tasksequence

The first step is to partition the disk correctly. Copy / create a new task sequence and edit your “Partition Disk” step as follows ensuring that BDE is the boot partition

Ensure that BDE is the Boot Partition, it is 1536mb in size (or bigger if you wish) and that you set a variable called BDEPART

Ensure that OS partition has a variable set called OSPART, the partition can be whatever size you like (I just set mine to use 100% of the remaining space)

Now open your “Apply Operating System” step and set the destination to a “Logical drive letter stored in a variable” and set the Variable name to OSPART as below:

Step 6 – Setting up the enable bitlocker Step

Within your Task sequence add the “Enable Bitlocker” step and configure it as shown below:

Step 7 – Setup HP SSM (optional)

The machine I was testing on was a HP 2730p so I decided to go down the route of using a utility from the HP SSM called “BiosConfigUtility.exe”
Download the HP SSM from here:
http://h20331.www2.hp.com/hpsub/cache/284133-0-0-225-121.html?jumpid=ex_R2845_vanityim/gossm/ka011106
I booted up my 2730p and ran the following:

BiosConfigUtility.exe /Advanced /GetConfig:GetConfig2730p.txt

This created me a text file showing all of the current settings and more importantly what their names are. I then began to construct my task sequence, the finished article is below but I will go through each step:

Step 8 – The BiosConfigUtility Steps

I placed a restart in between each step since we are editing Bios settings (just to be on the safe side). During my testing I found (from the smsts.log file) that the “Enable Bitlocker” step would not work unless I set the restart to boot into full OS as shown below:

So I set all of the restarts to do this and haven’t yet changed any of them back so they may work from the boot image they may not, when I get chance I will test and edit this post.
Anyway, setting the bios password.
This step runs a batch file that contains the following:

xcopy /S /E /R /I /Q /Y "%~dp0"*.* "%systemroot%\temp\HPSSM" >NUL
"%systemroot%\temp\HPSSM\BiosConfigUtility.EXE" /NewSetupPassword:MyBiosPassword
rd "%systemroot%\temp\HPSSM" /s /q
exit /b

Obviously that’s not my password but you get the idea.

The next step “HP 2730p – Full TPM Setup” was originally all of the TPM settings in “GetConfig.txt” set to enabled but I found that the TPM wasn't enabling so I put it in a step of its own. Below is my batch file that applies this config:

xcopy /S /E /R /I /Q /Y "%~dp0"*.* "%systemroot%\temp\HPSSM" >NUL
"%systemroot%\temp\HPSSM\BiosConfigUtility.EXE" /CurSetupPassword:MyBiosPassword /Advanced /SetConfig:FullTPMConfig2730p.txt
rd "%systemroot%\temp\HPSSM" /s /q
exit /b

And below are the contents of “FullTPMConfig2730p.txt”

English
Embedded Security Device
*Device available
Device hidden
Embedded Security Activation Policy
F1 to Boot
Allow user to reject
*No prompts
OS Management of TPM
*Enable
Disable
OS management of Embedded Security Device
*Enable
Disable
Reset of TPM from OS
*Enable
Disable
Reset of Embedded Security Device through OS
*Enable
Disable
Always Prompt for HP SpareKey Enrollment
*Disable
Enable
HP SpareKey
*Disable
Enable

The next step is to take ownership of the TPM, I did this using the manage-bde.exe tool. Create a batch file as follows:

manage-bde -tpm -TakeOwnership MyTPMPassword
exit /b

Again not my password so put something better in there.

The final Step is to Enable the TPM, as I said I tried this in the Full setup step but it didn’t work, perhaps If I take ownership of the TPM then apply the settings it will work. Anyway for now this is what I have so again to enable the TPM create a txt file called “EnableTPM.txt” containing this:

English
Activate Embedded Security On Next Boot
*Enable

And apply it using this batch file:

xcopy /S /E /R /I /Q /Y "%~dp0"*.* "%systemroot%\temp\HPSSM" >NUL
"%systemroot%\temp\HPSSM\BiosConfigUtility.EXE" /CurSetupPassword:MyBiosPassword /Advanced /SetConfig:EnableTPM.txt
rd "%systemroot%\temp\HPSSM" /s /q
exit /b

That’s it for those steps, now update your DP’s and PXE boot your machine. Good Luck!
P.S Im sure I could cut down those steps now but this worked for me last thing on Friday so I’m blogging it over the weekend, I will update this once I have cleaned up a bit :)

Grab a cup of Coffee, wait for your image to apply and move onto the next step.....

Step 9 – Verifying your Recovery Password and TPM info have been stored in AD

If you skipped the HP SSM Steps carry on here.
Now we have a machine with Bit locker installed the first thing I did was to run

manage-bde.exe -status

from a command prompt as admin and check that the drive was indeed encrypting:

As you can see that looks promising (apart from the AES 128, I will be changing that in group policy later)
So that’s our machine encrypting lets check AD…..
If you run the active directory snap-in as domain admin you should see the bitlocker recovery tab with the current password stored in there as below:

If you do not see this tab you will need to run:

regsvr32.exe BdeAducExt.dll

on your workstation and then re-open the active directory snap-in as domain admin.
The last step is to verify the TPM Owner info is being stored in AD, I did this by opening the computer object in ADSI edit and checking that the attribute msTPM-OwnerInformation had a hash of my password in there:

And I also ran the script Get-TPMOwnerInfo.vbs from the machine in question and verified that I got back the hash as expected

That’s pretty much it, one more thing to note is that you will see this now in Active Directory to enable you to search for bitlocker recovery passwords

And as always test test and test some more, this is only a very rough guide but it works which is the main thing, I still have lots of testing and tweaking to do myself before implementing but I will be putting all of my findings up here for future reference.
Also Thanks to this guy:
http://weikingteh.wordpress.com/2011/02/23/enabling-bitlocker-with-configuration-manager-sccm-operating-system-deployment-osd
For getting me started with partitioning the disk correctly,
Cheers!

SCCM Task Sequence Backup and Versioning

Here is a great little script to automate backing up and versioning your SCCM Task sequences, Handy if you are tweaking a lot / have a lot of people editing your TS's
http://mdtcustomizations.codeplex.com/releases/view/65824

SCCM Collection based on executable name

Just a quick one to remind myself how to create a collection of computers that have a specific executable. Create a new collection and insert the following query:

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SoftwareFile on SMS_G_System_SoftwareFile.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SoftwareFile.FileName = "vpngui.exe"

change the executable name to one of your choice, all done! :)

Pre installing drivers during imaging

Recently I was faced with a challenge of how to pre install drivers for our universal USB docking stations so that a freshly imaged machine can just be handed out to a user without having to go through a manual install of the drivers beforehand.

The way I accomplished this was to use a utility found in the WDK (Microsoft Windows Driver Kit) called DpInst.exe

Here is the documentation for it:

WDK Documentation

At a high level all you basically have to do is get the drivers together in a folder with the correct version of DpInst (x86 / x64), build an XML file (called DPInst.xml) and then run it with a few switches to have it install the drivers for you. Then when a standard domain user comes along and plugs in the hardware it will automatically install it without asking for admin rights!

All you then have to do is build a package and include it in your SCCM task sequence to fully automate this tedious process :)

Thanks

Task Sequence has failed with the error code (0x80070070).

If you get this error during a task sequence simply hit F8 to bring up a command window (if you have command support enabled on your boot media) and use diskpart to clean the disk. The following commands should do it:

Diskpart
List disk
Sel disk X
clean
exit

Cheers