WSUS and ConfigMgr 2012 HTTPS communication

When you have your ConfigMgr 2012 site fully communicating over HTTPS you may also want your Software Updates delivered over a secure channel. Well that´s possible! More info: http://technet.microsoft.com/en-us/library/bb633246.aspx When you have the WSUS component installed on the SCCM 2012 SP1 server, the same certificate that was used to secure the ´Default Web Site´ can be used to secure the WSUS Administration site from within IIS. TIP Not all the virtual directories within the WSUS Administration site need to be enabled for SSL. Only enable SSL for:

• APIRemoting30
• ClientWebService
• DSSAuthWebService
• ServerSyncWebService
• SimpleAuthWebService

Web Server Configuration   To configure WSUS for SSL communication:

1. Open Internet Information Services (IIS) Manager.
2. Expand Sites, and select the WSUS administration site (which is often the 'Default Web Site').
3. Click the Bindings action.
4. Click Add, select HTTPS, and click Edit.
5. Choose the certificate from the list. (Click View to verify the correct certificate was selected, click OK, and then click Close).
6. Select the APIRemoting30 virtual directory.
7. Double-click the SSL Settings option.
8. Enable the Require SSL option and click Apply.
9. Repeat for the ClientWebService, DSSAuthWebService, ServerSyncWebService, and SimpleAuthWebService virtual directories.

With the WSUS virtual directories correctly configured, run the following command on the WSUS server to finalize the configuration needed to support SSL: WSUSUtil.exe configuressl {FQDN.stiteservername} This utility is located in the Tools folder located within the WSUS installation folder. (By default, this is folder is C:\Program Files\Update Services\Tools).   ConfigMgr Configuration Under Administration – Overview – Site Configuration – Servers and Site System Roles choose your Software Update Point and select Properties. Now select the Require SSL communication to the WSUS server.   And as visible in the WCM.log we have SSL communication:

SCCM 2012 SP1 and SQL Server

Here is an overview of the SQL Server configurations and requirements for supported SQL Server installations for ConfigMgr 2012. Source: http://technet.microsoft.com/en-us/library/gg682077.aspx   Configurations for the SQL Server Site Database Each System Center 2012 Configuration Manager site database can be installed on either the default instance or a named instance of a SQL Server installation. The SQL Server instance can be co-located with the site system server, or on a remote computer. When you use a remote SQL Server, the instance of SQL Server used to host the site database can also be configured as a SQL Server failover cluster in a single instance cluster, or a multiple instance configuration. The site database site system role is the only System Center 2012 Configuration Manager site system role supported on an instance of a Windows Server cluster. If you use a SQL Server cluster for the site database, you must add the computer account of the site server to the Local Administrators group of each Windows Server cluster node computer.

Note

SQL Server database mirroring is not supported for the Configuration Manager site database.

  When you install a secondary site, you can use an existing instance of SQL Server or allow Setup to install and use an instance of SQL Server Express. Whichever option that you choose, SQL Server must be located on the secondary site server. The version of SQL Server Express that Setup installs depends on the version of Configuration Manager that you use:

• Configuration Manager without a service pack: SQL Server 2008 Express
• Configuration Manager with SP1: SQL Server 2012 Express

The following table lists the SQL Server versions that are supported by System Center 2012 Configuration Manager.

SQL Server version	SQL SP	SQL CU	ConfigMgr version	ConfigMgr Site type
SQL Server 2008 Standard (1) Enterprise Datacenter	SP2	Min CU9	ConfigMgr NO SP ConfigMgr SP1	CAS Primary Secondary
	SP3	Min CU4	ConfigMgr NO SP ConfigMgr SP1	CAS Primary Secondary
SQL Server 2008 R2 Standard (1) Enterprise Datacenter	SP1	Min CU6	ConfigMgr NO SP (2) ConfigMgr SP1	CAS Primary Secondary
	SP2	NO CU	ConfigMgr NO SP (2) ConfigMgr SP1	CAS Primary Secondary
SQL Server 2012 Standard (1) Enterprise	NO SP	Min CU2	ConfigMgr SP1	CAS Primary Secondary
SQL Server 2008 R2 Express	SP1	Min CU6	ConfigMgr NO SP ConfigMgr SP1	Secondary
	SP2	NO CU	ConfigMgr NO SP ConfigMgr SP1	Secondary
SQL Server 2012 Express	NO SP	Min CU2	ConfigMgr SP1	Secondary

 

1. When you use SQL Server Standard for the database at the central administration site, the hierarchy can only support up to 50,000 clients. For more information, see Site and Site System Role Scalability.
2. Configuration Manager with no service pack does not support the site database on any version of a SQL Server 2008 R2 cluster. This includes any service pack version or cumulative update version of SQL Server 2008 R2. With Configuration Manager SP1, the site database is supported on a SQL Server 2008 R2 cluster.

  SQL Server Requirements The following are required configurations for each database server with a full SQL Server installation, and on each SQL Server Express installation that you manually configure for secondary sites. You do not have to configure SQL Server Express for a secondary site if SQL Server Express is installed by Configuration Manager.

Configuration	More Information
Database collation	At each site, both the instance of SQL Server that is used for the site database and the site database must use the following collation: SQL_Latin1_General_CP1_CI_AS.
SQL Server features	Only the Database Engine Services feature is required for each site server. (Configuration Manager database replication does not require the SQL Server replication feature.)
Windows Authentication	Configuration Manager requires Windows authentication to validate connections to the database.
SQL Server instance	You must use a dedicated instance of SQL Server for each site.
SQL Server memory	When you use a database server that is co-located with the site server, limit the memory for SQL Server to 50 to 80 percent of the available addressable system memory. When you use a dedicated SQL Server, limit the memory for SQL Server to 80 to 90 percent of the available addressable system memory. Configuration Manager requires SQL Server to reserve a minimum of 8 gigabytes (GB) of memory in the buffer pool used by an instance of SQL Server for the central administration site and primary site and a minimum of 4 gigabytes (GB) for the secondary site. This memory is reserved by using the Minimum server memory setting under Server Memory Options and is configured by using SQL Server Management Studio. For more information about how to set a fixed amount of memory, see How to: Set a Fixed Amount of Memory (SQL Server Management Studio).

  SQL Server Optional Configuration The following configurations either support multiple choices or are optional on each database server with a full SQL Server installation.

Configuration	More Information
SQL Server service	On each database server, you can configure the SQL Server service to run by using a domain local account or the local system account of the computer that is running SQL Server. Use a domain user account as a SQL Server best practice. This kind of account can be more secure than the local system account but might require you to manually register the Service Principle Name (SPN) for the account. Use the local system account of the computer that is running SQL Server to simplify the configuration process. When you use the local system account, Configuration Manager automatically registers the SPN for the SQL Server service. Be aware that using the local system account for the SQL Server service is not a SQL Server best practice. For information about SQL Server best practices, see the product documentation for the version of Microsoft SQL Server that you are using. For information about SPN configurations for Configuration Manager, see How to Manage the SPN for SQL Server Site Database Servers. For information about how to change the account that is used by the SQL Service, see How to: Change the Service Startup Account for SQL Server (SQL Server Configuration Manager).
SQL Server Reporting Services	Required to install a reporting services point that lets you run reports.
SQL Server ports	For communication to the SQL Server database engine, and for intersite replication, you can use the default SQL Server port configurations or specify custom ports: Intersite communications use the SQL Server Service Broker, which by default uses port TCP 4022. Intrasite communication between the SQL Server database engine and various Configuration Manager site system roles by default use port TCP 1433. The following site system roles communicate directly with the SQL Server database: Management point SMS Provider computer Reporting Services point Site server When a SQL Server hosts a database from more than one site, each database must use a separate instance of SQL Server, and each instance must be configured to use a unique set of ports.   Configuration Manager does not support dynamic ports. Because SQL Server named instances by default use dynamic ports for connections to the database engine, when you use a named instance, you must manually configure the static port that you want to use for intrasite communication.   If you have a firewall enabled on the computer that is running SQL Server, make sure that it is configured to allow the ports that are being used by your deployment and at any locations on the network between computers that communicate with the SQL Server. For an example of how to configure SQL Server to use a specific port, see How to: Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager) in the SQL Server TechNet library.

Microsoft System Center 2012 Endpoint Protection Cookbook

Hi, I have done a book review on the Microsoft System Center 2012 Endpoint Protection Cookbook which I wanted to share with you. The auther, Andrew Plue, has done a great job on explaining the latest and greatest anti-virus and anti-malware product of Microsoft, Endpoint Protection. The book was published by Packt Publishing and can be found here! [caption id="attachment_949" align="alignnone" width="243"] Microsoft Forefront EndPoint Protection 2010 Cookbook[/caption] Have fun with it, I did!

Mobile devices in SCCM 2012 B2 First Look

Hi,

with the introduction of SCCM 2012 Microsoft Mobile Device Management in ConfigMgr is enhanced. Up until now the management of mobile devices was done by Mobile Device Management 2008 (MDM), SCCM 2007 R3 and/or Exchange 2007/2010.

Now an Exchange administrator has to manage mobile devices like Windows Moblie 6.0/6.1/6.5, WindowsCE 6.0, Nokia Symbian, Apple iPhone, Android, Windows 7 Phone etc. devices. With the new functionality in SCCM 2012 this is shifted towards the SCCM administrator, so we have 1 console to administer desktops, servers and mobile devices. Cool!

The topology needed for mobile device management consists of:

• Web proxy for enrollment
• Service point for enrollment
• Management point
• Distribution point
• Software catalog if needed
• SCCM site in HTTPs mode (Native mode)
• Exchange connector

Then we have 2 options for mobile device management:

1. Simple or light management
2. Full or indepth management

What can we do with it?
Well here's an overview:

Mobile device management overview

(EAS = Exchange ActiveSync, WM = Windows Mobile)

Device information is collected through the Exchange connector.

For a device enrollment the proces for WinCE and WM 6.0 is the same as in SCCM 2007, WM 6.0/6.5 and Nokia have the capability of over-the-air enrollment via HTTPs.

Registered mobile devices are added to the SCCM site and deliver inventory information. This information is provided in the console like any other resource with can be accessed with the Resource Explorer.
This also means that mobile device settings can be evaluated. Things like baseline settings and monitoring are at hand in 1 console, nice.

Finally there is a possibility for a Remote Wipe. This comes in handy when a user loses his or her mobile device. Simple devices are wiped with the next policy and indepth devices are wiped with a next e-mail sync.
This simplifies the proces of mobile device security.

So mobile device management in SCCM 2012 is a nice feature for the Configuration Management administrator as well for the Exchange administrator.

Using Application Catalog in SCCM 2012 Beta 2

Hi,

in the last post (here) we set up the Application Catalog Website. But it is still empty.

As stated before we can now provide software to users, and be able to approve requests.

Let's deploy some applications.
- XML Notepad, free to use for users;
- Google Chrome, needs approval from a manager.

I have setup the 2 applications.

Application Catalog in SCCM2012

Now we need to deploy them.

Application Deployment - Request needed

Application Deployment - Request needed

That's one:



Application Deployment - Request needed

Now the other. No need for administrator approval!

Application Deployment - No Request needed

That's two ;-)

Application Deployment - No Request needed

Oke so the Applications have been added, how does this look like from a user perspective?

The user goes to the Software Center.

SCCM2012 client start menu

Software Center

Software Center

All empty?! But wait there is an option 'Track my application requests' or 'Find additional applications from the Application Catalog'.

Application Catalog Website

Now i can request Google Chrome or install XML Notepad. Nice :-)

Configuration Manager 2012 Beta 2 First Look

Hi,

Microsoft has released Beta 2 of System Center Configuration Manager 2012.
The anticipated release is Q4 of 2011, and this is a first look.

Let's start with: I'm impressed!

Being a Beta means there are a couple of things that needs some attention:

• The database can only be SQL 2008 SP1 with CU10 or higher (no support for SP2 or R2 yet!)
• x64 OS (finally ConfigMgr is on the same platform as the rest of the System Center Family)
• Ow and RAM, it needs a lot! The minimum is 2GB, but bear in mind 'the minimum'. Running this one in a lab environment with SQL on the same machine, go for 4-6GB.

Then there are the Prerequisites:

• .NET 3.5.1
• .NET 4.0
• RDC (Remote Differential Compression)
• BITS (Background Intelligence Transfer Service)
• IIS Role Service --> IIS 6 WMI Compability

And WSUS 3.0 SP1 if you want to manage Software Updates with SCCM 2012 (and you want that, don't you?).
One thing that directly caught my attention, no more need for WebDAV, nice.

After the installation fire up the Console:

SCCM 2012 UI

Wow!

SCCM 2012 Ribbon

First thing that is cool, the ribbon is fully integrated throughout the product. It takes some time to get used to it, but it saves a lot of 'right-clicks'. Very handy.

So now what?

Clicking through the console you can see the shift towards User Centric Management. This means putting the User first then the Systems. And that's eventually what it is all about.
We need to support Users in their jobs, providing them with the right tools to do their work.

Also there is Role-Based Security, no more full console with no rights. If you are assigned a role, you will just see what you need to see, uh cool and handy!

Role-Based Access Control (RBAC)

Efficient Application Management.

Sounds cool, but what is it? It means that a single application can now be deployed with multiple deployment methods!
So let's say you have an application XYZ. You want to deploy this application to your Baseline desktop PC's as a native application,  stream it as an App-v program to your Laptops and make it available as an Remote Desktop Application when an user logs on to a server. All from 1 application, nice!

To uninstall applications SCCM 2012 now uses 'retirement', the application can also be 'reinstated'.

Retired Application

Reporting.

Reporting is taken out of SCCM 2012 and is done by SQL 2008 by means of Reporting Services. This is how it should be. Of course in SCCM 2007 it was also possible, but in SCCM 2012 the Reporting Point does no longer exists.
And, of course, there are standard more reports ;-)
(411 in SCCM 2012 B2 to 389 in SCCM2007R3)

Reports

This was the very first peek in SCCM 2012 B2, more to come!