Innovative Technology Weblog

With System Center Update Publisher (SCUP) Microsoft provides a platform for adding 3^rdparty updates to your conventional WSUS updates. Until last week SCUP 4.5 was available for adding 3^rd party software, driver and BIOS updates to a WSUS server. With SCUP you can either use a catalog file to import multiple updates from a vendor’s website at once or just simply add your own update packages to SCUP to deploy it in your enterprise environment as they were Microsoft updates. Now, with SCUP 4.5 there were some issues which are resolved within SCUP 2011. Some of the issues include the following:

• Limited configuration options for download behavior (i.e. metadata only vs full content)
• Expired updates cannot be removed from the updates server easily
• Approval and publishing updates requires multiple steps to be taken

With SCUP 2011 you now have a so called ConfigMgr integration. This integration option can be used to regulate download behavior for an update. In general you probably want clients to download only metadata from SCCM/SCUP if only a few clients request an update. When the number of clients increase it would be better to download full content so that clients will use common distribution points instead of an internet location to download the update to avoid unnecessary bandwidth utilization. With the thresholds you can regulate this now.

Expiring and removing updates properly was a hell of a job if an update was removed from a vendor’s catalog. In SCUP 2011 you can use a new Software Update Cleanup Wizard for this. So now, expiring a software update that exists on the update server but is not in the SCUP repository is an easy job.

SCUP 2011 has a Publish tab where you can bundle updates that you want to deploy to your clients. This is a new feature that makes it somewhat easier to manage and administer the SCUP update repository.

What I like the most about SCUP is that you are able to deploy software with the WSUS functionality available. In large enterprise environments normal software distribution requires lots of steps to be taken by various departments for each individual software update. These steps include scripting, testing, configure SCCM packages, collections, advertisements, etc. New software updates like Adobe’s Flash Player are being released very rapidly. It requires that you’ll have to execute the same procedure over again to deploy it in your enterprise. Using SCUP and Adobe’s update catalog instead will save you a lot of time.

Installing drivers, BIOS, hardware utilities and firmware for instance on Dell systems is an easy job using SCUP. Minor disadvantage is that you will need the OpenManage client running on client systems to provide some necessary WMI classes. These extra classes will be used to identify the hardware peripherals. WSUS uses this information to compare with the catalog logic rules:

With SCUP you can use the logic which comes with the catalogs to deploy a software update bundle that include multiple updates at once. Compare the logic within the catalog with the queries you normally use in SCCM collections for grouping the client systems what you’ll need for targeting the software.

You can also create your own updates. As an example i’ve added the Google Chrome browser installer as a required update with Adobe Flash Player as a prerequisite .

Happy updating!!!

Douwe van de Ruit

I recently had to come up with a solution that will enable administrators to build reports for client’s bitlocker status. To do so i found a few articles on the web that pointed me in the right direction, however i didn’t found a complete howto for it so that’s a good reason for me to post a complete one.

To enable bitlocker status reporting in a centralised management environment with SCCM you need to follow some steps because bitlocker is not integrated that far (yet??) in the Windows OS. First, let’s first take a look at the status information that bitlocker provides:

• Volume name, example: C: [OSDisk]
• Disk size, example: 148,75 GB
• BitLocker Version, example: Windows 7
• Conversion Status, example: Fully Encrypted
• Percentage Encrypted, example: 100%
• Encryption Method, example: AES 128 with Diffuser
• Protection Status, example: Protection On
• Lock Status, example: Unlocked
• Identification Field, example: None
• Key Protectors (Note: multivalue), example: TPM, Numerical Password

You can check the above on clients using the commandline tool manage-bde.exe -status on Windows 7 clients. For Vista clients use cscript manage-bde.wsf -status.

Step 1. Modify and deploy SMS_DEF.MOF

We want bitlocker status information to be inventoried to SCCM. A proper way of doing that would be to add the bitlocker class to the SMS_DEF.MOF file on the management point (found in %SCCMinstallpath%\inboxes\clifiles.src\hinv). Make a copy of this file and edit with your favorite app. Add the following lines at the end of the file:

[edit] Make sure to replace any fancy double quotes with normal quotes after copying because otherwise compiling or parsing will fail. Or download this file: bitlocker_mof.

You should check the file for errors with mofcomp.exe -check SMS_DEF.MOF. To enable the MOF file on a single client run the following command on the client mofcomp -class:forceupdate %pathtofile%\SMS_DEF.MOF. Copy the edited file back to enable it on your ConfigMgr site.

Step 2. Install Bitlocker

Create and link a GPO to apply on the bitlocker clients that contain the following settings (or similair based on your own requirements):

Enter the BIOS on your client or use tools like the Dell client configuration utility to turn on TPM, clear the TPM and activate it. After doing this enable bitlocker encryption on the machine. You can use any method to achive this.

Step 3. Add Bitlocker status to WMI & run hw inventory

Although there are multiple ways of manipulating bitlocker through WMI you still need a script to read, update and store bitlocker status information in the WMI repository (see http://msdn.microsoft.com/en-us/library/aa376409.aspx). This is because Managed Object Format (MOF) files are not installed as part of the Windows SDK and therefore the included classes are not added to the WMI repository automatically by Windows itself.

[update: A handy colleague wrote a powershell version of the script for adding the bitlocker status into WMI with some nice enhancements. All credits go to Daniel Last.]

The scripts (use only one):

• VBS version: UpdateBitlockerStatus.vbs
• Powershell verion: Bitlocker_Status.ps1 Bitlocker_Status_v1.1.ps1 [update]

Run the script and after that initiate a hardware inventory on the client. Note that the powershell version of the script already triggers a hardware inventory. Additionally, the powershell script need to be run with the powershell execution policy to be set to RemoteSigned. Do this using the following cmdlet: Set-ExecutionPolicy RemoteSigned

[edit] You could trigger the inventory in the vbscript by adding this line: WshShell.Run “WMIC /namespace:\\root\ccm path sms_client CALL TriggerSchedule “&Chr(34) & “{00000000-0000-0000-0000-000000000001}” & Chr(34) & ” /NOINTERACTIVE”,,true

After a while you will find 2 new tables and 1 new view in the SCCM site database:

Step 4. Create the Report

I created a report in SCCM with the following query:

SELECT     v_R_System.Name0 AS Computername, v_GS_SCCM_BitLocker0.Bitlocker_Status0 AS [Bitlocker Status],
v_GS_SCCM_BitLocker0.BitLocker_Version0 AS [Bitlocker Versie], v_GS_SCCM_BitLocker0.Conversion_Status0 AS [Converstion Status],
v_GS_SCCM_BitLocker0.Drive0 AS Drive, v_GS_SCCM_BitLocker0.DriveLabel0 AS DriveLabel, v_GS_SCCM_BitLocker0.Encryption_Method0 AS [Encryption Method],
v_GS_SCCM_BitLocker0.Identification_Field0 AS [Identification Field], v_GS_SCCM_BitLocker0.Key_Protectors0 AS [Key Protectors],
v_GS_SCCM_BitLocker0.Percentage_Encrypted0 AS [Percentage Encrypted], v_GS_SCCM_BitLocker0.Protection_Status0 AS [Protection Status],
v_GS_SCCM_BitLocker0.ScriptLastRun0 AS [Script Last Run]
FROM         v_GS_SCCM_BitLocker0 INNER JOIN
v_R_System ON v_GS_SCCM_BitLocker0.ResourceID = v_R_System.ResourceID

And there it is, the Bitlocker report (note: old screenshot based another query but more or less similar):

Tested on SCCM R2 with a Windows 7 Enterprise bitlocker client.

Feel free to comment on this post.

Regards,
Douwe van de Ruit

Hi i’m Douwe van de Ruit, a new blogger at buit.org and right now i have some nice things to share about the upcoming System Center Configuration Manager.next. Microsoft released Beta 1 last Tuesday so i downloaded it from the Microsoft connect site and kicked it in a virtual testlab to dig through the new features and changes. I will show some new features from which i have great expectations. I will stick to the headlines only because covering all newly or changed features will be to much for a blogpost.

While installing SCCM.next i found out that the procedure was very similar to the way SCCM 2007 is installed. But when i started the Admin console i finally saw the “Outlook-styled” console for SCCM that is inline with consoles used for OpsMgr and VmMgr!

A good example of “do more with less” will be client settings, all settings are simplified by consolidating them in just one, simple and faste editable setting-interface:

So the interfacelifted GUI is a big change included in SCCM.next. But what about functionality and features? Well, Googling on vNext will return 3 main focus areas where Microsoft would deliver changed functionalities:

1. User centric application management  – Empowering Administrators to define intent, and end users flexible access to the right application at the right time
2. Infrastructure simplification – Simplify management infrastructure, processes and administrative overhead
3. Simplify Client Management – Daily tasks, model based configuration management and improvements over existing capabilities

User centric comes with so called user device affinity rules as you like, which can be used to define user’s devices and priorize them in a way that some deployments can depend on these affinity rules. Additionally, it will allow admins to create definitions of the relationship between the users and their applications in a way that the admins don’t have to worry about where that user is and what device it’s using .  They can trust the system that the user will have the right application at the right time in the right place suitable for the device they are on. Just a screenshot that relates to the user centric management functionality:

Just looking at the interface already shows that all administrative tasks just got easier and smarter and will achieve better overall performance in using ConfigMgr for all tasks. Infrastructure and Client Management simplifications will take more investigation to find out significant improvements as opposed to SCCM 2007. However, i do know that distribution points in SCCM.next will support scheduling and throttling. Imagining a branch office with a considerable amount of clients, you normally would create a secondary site if there was a concern about content distribution bandwidth consumption during office hours. With SCCM.next now you’re not bound to secondary sites because you can use distribution points with scheduling and throttling capabilities using the newly added ”Rate Limits” tab in distribution point settings.

By simplified client management Microsoft introduces the “Custom Client Setting”. With this feature you can create custom client agent settings which you can apply to collections containing devices, users or both. On top of the custom client settings you will still be able to configure the top-level client agent settings. The need for an extra Primary site will become unneccesary if the only reason would be driven out of other Client settings. Very nice.

To summarize some more new stuff i (quickly) found:

• added distribution groups for administrative purpose
• SCCM.next is 64 bit only
• SQL 2008 required
• added more than 300 extra SQL tables in the site database
• changed the term “Advertisements” into “Deployments”
• added Global Conditions settings which can be used to divide device types based on various parameters
• SQL Reporting service replaces standard reporting
• the “inboxes” system is still in use (and not transformed into SQL based communication as introduced before as a “wanna have”)
• “Create Report” function crashes in my test lab
• Help function returns white pixels
• SCCM 2007 DCM and Assett Intelligence nodes are integrated into a “Assets and Compliance” tab
• New System roles: Software Catalog Web Service Point, Software Catalog Web Site Point, Mobile device enrollment proxy point, Mobile device enrollment point

Nice stuff so far :-)