Installing and running Map 7.0 on Server 2008 R2

This blog post covers the following:

• Installing Microsoft Assessment and Planning Toolkit 7.0 (MAP)
• Performing an  Inventory of selected computers
• Collecting Performance Data from discovered computers
• Generating Reports and Proposals

There are a few Software Pre-requisites you will need, don't worry if you don't have them all as the installer provides download links during installation, the pre-reqs are:

• Microsoft .NET Framework 3.5 Service Pack 1
• Microsoft .NET 4.0 Full Profile
• Update 4.0.2 for Microsoft .NET Framework 4

Installing Microsoft Assessment and Planning Toolkit 7.0 (MAP)

First of all download MAP 7.0 from here (you only need to download the file called Microsoft_Assessment_and_Planning_Toolkit_Setup.exe for the purpose of installation)

Start the installer, tick the check-box and click next

Accept the terms of the license agreement, click next

Choose the installation folder, click next

Make your choice around CEIP, click next

Click install

This will install MAP 7.0 and a SQL Server Express Local Database

Once complete hit finish and MAP will launch.

Performing an Inventory of selected computers

You will be presented with the option of creating a new database or using an existing one upon launching MAP for the first time. Select create an inventory database, fill out the details and press ok

Press the GO button shown below to launch the inventory and assessment wizard

In my example I am going to choose only Windows Computers, but you can choose whatever you need to gather information from.

Press next

This screen has some very important options and considerations:

I will go through each method and let you decide which ones you wish to use:

Active Directory Domain Services (AD DS) - Excellent if your Active Directory is squeaky clean, otherwise you will end up with a lot of failures

Windows Networking protocols - This will utilize NetBIOS to discover computers on the network. It is usually a very successful method, however devices that are powered off will not be found

System Centre Configuration Manager - This will use your Config Manager database as the source, another excellent method

Scan IP Range - Again another solid method which can be used to scan domain and non-domain computers. However devices that are powered off will not be found

Manually enter computer names and credentials - very time consuming and laborious

Import computer names from a file - An excellent method if you happen to have a CSV of your devices handy

In my example I will choose AD DS and windows networking protocols and press next

Below fill in your domain and an account that has enough privileges to list the objects in Active directory

Press next

Below you can drill down through your AD structure and select individual OUs, in my example I have chosen the OU my servers reside in.

Press next

Now onto the windows networking protocols. Fill in your domain name

Press next

Now we need to supply credentials that can be used to interrogate the machines we find. In my example I am using a single account - the domain admin. However best practice here is to use and account that has local admin rights across the machines and NOT the domain admin. You can specify multiple accounts here if you wish. Click create to enter your credentials and hit close and next when done

On this screen you can simply set the order you wish the credentials to be tried in, order as you wish and press next, then hit finish.

The discovery will begin, once complete we proceed to step 2

Collecting Performance Data from discovered computers

This time press GO on step 2

Again I am only interested in windows machines and will set my duration to one week from today's date

Once done hit next

On the next screen I am just going to press next, but if you have a text file listing your computers you can also import it.

Hit next

As you can see the computers discovered in the first step are listed

Select all and press next

On the next screen you have the option to add more credentials to use if you wish, MAP remembers and will use the credentials we specified in step 1. Here I am going to hit next to skip past this and then finish.

Now the performance metrics will be gathered

PIC15
You can safely click close and this will still run in the background

**Note** This is using the built in windows counters to gather information and shouldn't impact servers, however if it does you can cancel the process as shown below:

Once the time you specified has elapsed you will see step 2 change to complete:

Now we need to refresh the inventory assessment and collect our reports, to do this:

Click Tools -> Refresh Inventory Assessment

Now click File -> Prepare New Reports and Proposals

Select all:

Hit next and then finish

Once complete click View-> Saved Reports and Proposals to be taken to the location on disk of those reports comprised of all the info we have gathered.

Troubleshooting

I thought I would throw this in for good measure, If you are unable to discover computers, then the 2 main causes in my experience are:

1) A firewall is blocking NetBIOS & WMI
2) The credentials you have specified are invalid

Another possibility is that WMI is corrupt on the computer, in which case you will have to rebuild the WMI repository (which I'm not going to cover here)

That's all for now,
Cheers!

Unable to install Windows Server 2012?

I had a small problem on my home server, whenever I tried to install Windows Server 2012 it would give me the error:

"We couldn't create a new partition or locate an existing one. For more information, see the Setup log files."

When trying to select the disk to install to, I did the usual Google search and tried the suggestions (Diskpart commands as expected) but nothing would shift the error.

Turns out a simple BIOS upgrade did the trick and I was on my way within minutes.

Moral of the post, upgrade the BIOS first, it might just save you a bit of time & effort :)

Cheers

Regular Expressions Helper

Yesterday I had the need to create a regular expression in Powershell and stumbled across an amazing website that allows you to:

1) Paste in the text you are working with
2) Adjust your Regex on the fly and have it highlight text that matches that expression

How cool is this!?

I take no credit for the site whatsoever, I am just posting here for future reference

http://gskinner.com/RegExr/

Cheers

Publishing updates through SCUP from Shavlik

This blog post will show you how to publish 3rd party updates from SCUP through to SCCM and ultimately to your clients.

If you missed it or dont have SCUP setup yet, here is another blogpost on setting up & configuring it.

 This post will cover the following

Assigning And Publishing Software Updates To WSUS

Synchronising SCCM with WSUS

Creating A Deployment Package For Your Software Updates

Verifying Installation On Client Machines

Troubleshooting

Assigning And Publishing Software Updates To WSUS

First open your SCUP console and locate a third party update you wish to deploy. Once you have one right click on it and select Assign

Below I have selected Full Content as I know I want to deploy this right away, but you have the choice of Full content, Metadata, or Automatic.
Metadata and full content are self explanitory, automatic however will not download the content until client machines request it (see my other post here for a look at the thresholds for this)

I just want to point out at this point, that assigning software updates to publications is completely optional. It serves only as a logical grouping of updates, much like updates lists in config mgr. There is nothing stopped you clicking Publish without assigning an update.

Now Select Assign Software update to a new publication, give it a name and press OK

Once done click on Publications from the bottom left and find your newly created publication. You should see that it contains your update. Now hightlight it and click Publish from the ribbon

 This will launch a wizard, be sure to tick the box at the bottom. This will resign any with a new certificate, should your old one expire in the future, very handy indeed!. Once done hit Next

Next again...

Wait for it to download and publish the update, then hit Next

Verify it was successful and click Close

In %temp% you will find scup.log, open it up and wait for the message Publish wizard complete

Now close SCUP. The update has now been sent from SCUP into your WSUS database. If you open your SCCM console you will not yet see this update, you must synchronise your SCCM server with your WSUS database first.

Synchronising SCCM with WSUS

To do this right click on All software updates and select Synchronise software updates

After a successful synchronisation you will see the update in the SCCM console!

Creating A Deployment Package For Your Software Updates

Highlight your software update and click Create Software Update Group from the ribbon

Enter a name for the SUG and click Create

Now if you expand Software Update Groups in the SCCM console you will see your SUG, right click on it and click Deploy

Now fill out the details of the Deployment wizard that launches. Here choose a Collection to target your deployment at and press Next

Fill out these details as you wish then hit Next

  

 Change the time to UTC and if you are in a lab like me or if this is a critical update change the Available time and the Deadline to As soon as possible

Next configure your user experience as you wish. Here you can specify what types of notifications they will see etc. once you are happy hit Next

Configure Ops Mgr alerts as you wish and hit Next

Configure download settings as you wish and click Next

Now to create a Deployment package, Configure yours similar to mine below, giving it a meaningful name and a suitable location. Once done hit Next

Add your Distribution Point(s) or Group(s), and hit Next

Select Download software update from the internet and click Next

Select your language and hit Next

Review the information presented in the Summary and click Next

Now the software update will filter through to any clients in the collection you targeted your deployment at.

Verifying Installation On Client Machines

Given time to filter through, on client machines you should see the update listed in the software Center as shown below and you should be able to install it manually (just to speed things up)

Troubleshooting

if you see this error in your windowsupdate.log file on your client machines:

See my previous blogpost here  and make sure you have configured your GPO correctly and distributed your certificate to your client machines

Wayne

SCUP 2011 Shared database scenario

Taken from the link below, this will keeps things consistent in your environment if you have multiple admins who may be involved with SCUP.

http://myitforum.com/cs2/blogs/rzander/archive/2011/05/30/scup-2011-with-shared-database.aspx

Wayne

Configuring SCUP 2011, Shavlik/VMware Vcenter Protect Update Catalog With PKI

In-case you were unaware VMware acquired Shavlik technologies some time last year, that means the product formally known as Shavlik SCUPdates is now known as VMware vcenter protect update catalog.

The function of this product is to provide update management of third party apps such as flash, Java etc directly from the ConfigMgr 2007/2012 console.

This blog post assumes you already have WSUS and Config Mgr 2012 running on the same server although I'm sure the process will be no different for Config Mgr 2007.

This post will guide you through the following:

• Installing SCUP & required hotfix
• Creating a certificate template for WSUS
• Requesting a certificate from the root CA
• Installing the certificate in SCUP and configuring Config Mgr integration
• Exporting the certificate with the public Key
• Importing the certificate into the correct stores
• Adding the Shavlik catalog to SCUP
• Creating a GPO to distrubte your certificate and update settings

Installing SCUP 2011 & required hotfix

First off download SCUP 2011 from here and this hotfix

Install the hotfix first which should take no more than a few seconds and then run though the SCUP 2011 install, accepting all of the defaults and skipping the hotfix (since you already did this).

Creating a certificate template for WSUS

Once installed connect up to your root CA and open the certsrv MMC snap-in (typing certsrv.msc from run is the quickest way to find it)

Now right click on certificate templates and click Manage

In the new window that opens, find the computer template, right click and Duplicate Template

In the dialog box that launches select Windows Server 2003 Enterprise

On the general tab enter a name, up the validity period if you wish (I did since this is in my testlab) and tick the box Publish certificate in Active Directory

On the request handling tab change the minimum key size to 2048 and tick Allow private key to be exported

On the subject Name tab select Common name for the subject name format, and leave DNS name ticked

Then on the extensions tab, highlight Application Policies and click edit. Remove both the client and server authentication and press ok

Now on the security tab add the computer account of your SCCM server and give it read and enroll acess and press ok

 Now back in the certsrv console right click on Certificate Templates and select New-> Certificate Template to issue

 Select your WSUS Certificate from the list and press Finish


Requesting a certificate from the root CA

Back on your SCCM/SCUP/WSUS server open the certificates mmc snap-in, when asked choose computer account and local computer. Once open right click on personal and click All Tasks-> Request New Certificate

Press Next

You should see your certificate template in the list, select it and press Enroll

Once complete it should give you a nice healthy green tick, press Finish

Now right click on the certificate and click All Tasks ->Export

Hit Next...

Tick Yes, export the private key

Leave defaults as shown below

Enter a password to protect the certificate and press Next

Select a location to save it and hit Next

Now click Finish

 Installing the certificate in SCUP and configuring Config Mgr integration

Launch the SCUP console as administrator for this part, if you don't you WILL get an error at some point during this process.

Once open click the ribbon icon top left and select Options

On the update server tab tick Enable publishing to an update server, select Connect to a local update server, click browse and select your exported certificate, press Test Connection and then input your certificate password. Once done Click OK.

**NOTE**
I found a bug with this dialog box,  even if you have local update server selected but have removed the values from the remote update server box it will display red exclamation marks and OK will be greyed out until you put something in the box, so watch out for that one!

Now select the ConfigMgr Server tab and tick Enable Configuration Manager Integration, enter the details as shown below and press ok once done.

The threshold values you see define how many clients must have requested a package and how big it can be. This ONLY applies when you select automatic as your publication type for updates (as opposed to metadata or full content)

It is also a very good idea to go into advanced options and select the checkbox Add timestamp when signing updates (requires Internet connectivity) to allow software updates to remain usable after their signing certificate expires. The updates will remain valid as long as they were signed and time stamped when the signing certificate is valid. By default, software updates cannot be deployed after their signing certificate expires.

 Exporting the certificate with the public Key

Now, still on your SCCM/SCUP/WSUS server switch back to your certificate console and refresh, you will see a new WSUS node on the left hand side, you if you expand it you will see the certificate we imported. Right click on it, All Tasks -> Export

This will launch the export wizard, click Next

Select No, do not export the private key

Select as shown below, and press Next

Click browse and give the certificate a name and location, then click Next

Click Finish

Keep this certificate safe, we need to distribute it to our clients in order that they trust the updates SCUP has signed with it.

Importing the certificate into the correct stores

Now you need to import this certificate into 2 stores. Still in the certificate console right click on trusted publishers -> All Tasks -> Import

Press Next

Browse to the location of the certificate we just exported and click Next

Verify the location is as shown and click Next

Click Finish

If you are NOT using PKI you need to do the same for trusted root certification authorities. If you are using PKI then you can skip this step as your Root CA is already trusted by your SCUP/WSUS server and the clients

Same again, right click -> All tasks -> Import

Click Next

Browse to the location of the certificate we just exported and click Next

Verify the location is as shown and click Next

Click Finish

Adding the Shavlik catalog to SCUP

First you need to download your Shavlik cab file straight from Shavlik/VMware.

Then this part is as easy as opening the console, clicking import and selecting your cab file and pressing next

Wait for the cab file to import and click Next

Verify it was successful and click Close

Creating a GPO to distrubte your certificate and update settings

The last thing you need to do is distribute the certificate that was used to sign your updates to your client machines. The easiest way to do this is to create a GPO.

Inside the GPO you need to import your certificate into trusted publishers as shown below:

In addition to importing the certificate, your clients also need to trust signed updates coming from a location other than Microsoft. Here is the location to enable this. Computer Configuration -> Administrative Templates -> Windows Components ->Windows Update.

In the details pane, click Allow signed content from intranet Microsoft update service location, and click Enabled.

Link the GPO to an OU containing your machines and that's it for this post!

I will post some more around using the console and no doubt some other bits as soon as I can.

EDIT: 2nd post here on how to publish 3rd party updates from SCUP through to SCCM clients

Cheers

Wayne