To enable bitlocker status reporting in a centralised management environment with SCCM you need to follow some steps because bitlocker is not integrated that far (yet??) in the Windows OS. First, let’s first take a look at the status information that bitlocker provides:

• Volume name, example: C: [OSDisk]
• Disk size, example: 148,75 GB
• BitLocker Version, example: Windows 7
• Conversion Status, example: Fully Encrypted
• Percentage Encrypted, example: 100%
• Encryption Method, example: AES 128 with Diffuser
• Protection Status, example: Protection On
• Lock Status, example: Unlocked
• Identification Field, example: None
• Key Protectors (Note: multivalue), example: TPM, Numerical Password

You can check the above on clients using the commandline tool manage-bde.exe -status on Windows 7 clients. For Vista clients use cscript manage-bde.wsf -status.

Step 1. Modify and deploy SMS_DEF.MOF

We want bitlocker status information to be inventoried to SCCM. A proper way of doing that would be to add the bitlocker class to the SMS_DEF.MOF file on the management point (found in %SCCMinstallpath%\inboxes\clifiles.src\hinv). Make a copy of this file and edit with your favorite app. Add the following lines at the end of the file:

#pragma namespace (“\\\\.\\root\\cimv2\\SMS“)
#pragma deleteclass(“SCCM_BitLocker”,NOFAIL)

[ SMS_Report     (TRUE),
  SMS_Group_Name ("SCCM_BitLocker"),
  SMS_Class_ID   ("CUSTOM|SCCM_BitLocker|1.0") ]
class SCCM_BitLocker : SMS_Class_Template
{
  [SMS_Report (TRUE), key ] string Drive;
  [SMS_Report (TRUE)] string DriveLabel;
  [SMS_Report (TRUE)] string Size;
  [SMS_Report (TRUE)] string BitLocker_Version;
  [SMS_Report (TRUE)] string Conversion_Status;
  [SMS_Report (TRUE)] string Percentage_Encrypted;
  [SMS_Report (TRUE)] string Encryption_Method;
  [SMS_Report (TRUE)] string Protection_Status;
  [SMS_Report (TRUE)] string Lock_Status;
  [SMS_Report (TRUE)] string Identification_Field;
  [SMS_Report (TRUE)] string Key_Protectors;
  [SMS_Report (TRUE)] string Automatic_Unlock;
  [SMS_Report (TRUE)] string ScriptLastRan;
};

You should check the file for errors with mofcomp.exe -check SMS_DEF.MOF. To enable the MOF file on a single client run the following command on the client mofcomp -class:forceupdate %pathtofile%\SMS_DEF.MOF. Copy the edited file back to enable it on your ConfigMgr site. 

Step 2. Install Bitlocker

Create and link a GPO to apply on the bitlocker clients that contain the following settings (or similair based on your own requirements):

Enter the BIOS on your client or use tools like the Dell client configuration utility to turn on TPM, clear the TPM and activate it. After doing this enable bitlocker encryption on the machine. You can use any method to achive this.

Step 3. Add Bitlocker status to WMI & run hw inventory 

Although there are multiple ways of manipulating bitlocker through WMI you still need a script to read, update and store bitlocker status information in the WMI repository (see http://msdn.microsoft.com/en-us/library/aa376409.aspx). This is because Managed Object Format (MOF) files are not installed as part of the Windows SDK and therefore the included classes are not added to the WMI repository automatically by Windows itself.

The script:

• UpdateBitlockerStatus.vbs

Run the script and after that initiate a hardware inventory on the client. After a while you will find 2 new tables and 1 new view in the SCCM site database:

Step 4. Create the Report

The most simple report would be a report of the table containing the bitlocker inventory data. By joining other tables/views with SQL queries the possibilities are endless, however i placed that out of scope of this howto . The following tables and views are provided for this:

• dbo.SCCM_BitLocker_DATA
• dbo.SCCM_BitLocker_HIST
• dbo.v_GS_SCCM_BitLocker0

I created a report in SCCM with the following query using the SQL view:

• select * from v_GS_SCCM_BitLocker0

And there it is, the Bitlocker report:

Tested on SCCM R2 with a Windows 7 Enterprise bitlocker client.

Feel free to comment on this post.

While installing SCCM.next i found out that the procedure was very similar to the way SCCM 2007 is installed. But when i started the Admin console i finally saw the “Outlook-styled” console for SCCM that is inline with consoles used for OpsMgr and VmMgr!

A good example of “do more with less” will be client settings, all settings are simplified by consolidating them in just one, simple and faste editable setting-interface:

So the interfacelifted GUI is a big change included in SCCM.next. But what about functionality and features? Well, Googling on vNext will return 3 main focus areas where Microsoft would deliver changed functionalities:

1. User centric application management  – Empowering Administrators to define intent, and end users flexible access to the right application at the right time
2. Infrastructure simplification – Simplify management infrastructure, processes and administrative overhead
3. Simplify Client Management – Daily tasks, model based configuration management and improvements over existing capabilities

User centric comes with so called user device affinity rules as you like, which can be used to define user’s devices and priorize them in a way that some deployments can depend on these affinity rules. Additionally, it will allow admins to create definitions of the relationship between the users and their applications in a way that the admins don’t have to worry about where that user is and what device it’s using .  They can trust the system that the user will have the right application at the right time in the right place suitable for the device they are on. Just a screenshot that relates to the user centric management functionality:

Just looking at the interface already shows that all administrative tasks just got easier and smarter and will achieve better overall performance in using ConfigMgr for all tasks. Infrastructure and Client Management simplifications will take more investigation to find out significant improvements as opposed to SCCM 2007. However, i do know that distribution points in SCCM.next will support scheduling and throttling. Imagining a branch office with a considerable amount of clients, you normally would create a secondary site if there was a concern about content distribution bandwidth consumption during office hours. With SCCM.next now you’re not bound to secondary sites because you can use distribution points with scheduling and throttling capabilities using the newly added ”Rate Limits” tab in distribution point settings.

By simplified client management Microsoft introduces the “Custom Client Setting”. With this feature you can create custom client agent settings which you can apply to collections containing devices, users or both. On top of the custom client settings you will still be able to configure the top-level client agent settings. The need for an extra Primary site will become unneccesary if the only reason would be driven out of other Client settings. Very nice.

To summarize some more new stuff i (quickly) found:

• added distribution groups for administrative purpose
• SCCM.next is 64 bit only
• SQL 2008 required
• added more than 300 extra SQL tables in the site database
• changed the term “Advertisements” into “Deployments”
• added Global Conditions settings which can be used to divide device types based on various parameters
• SQL Reporting service replaces standard reporting
• the “inboxes” system is still in use (and not transformed into SQL based communication as introduced before as a “wanna have”)
• “Create Report” function crashes in my test lab
• Help function returns white pixels
• SCCM 2007 DCM and Assett Intelligence nodes are integrated into a “Assets and Compliance” tab
• New System roles: Software Catalog Web Service Point, Software Catalog Web Site Point, Mobile device enrollment proxy point, Mobile device enrollment point

Nice stuff so far :-)

This time, I did not have endless time to troubleshoot. So I decided to make a quick escape through an internet service. I found TeamViewer 5 to be an easy to use replacable. For home use it’s free. It uses two simple codes to identify the session. For now, I stick with this. Because there is nothing more frustrating for a helpdesk like me than not seeing what happens on the other side, I guess…

 In today’s challenging economic environment, innovative use of new information technologies can result in improved operational efficiency and reduced costs. The combination of cost savings coupled with improved productivity and innovation is defined as “the New Efficiency.”

 Elop also announced the release of Forefront Protection 2010 for Exchange Server, which helps Exchange Server customers further safeguard business information.

 “Exchange Server 2010 customers are already reporting cost savings of up to 70 percent thanks to a simplified high-availability model and support for lower-cost storage. Customers are also seeing productivity gains of more than 20 percent with a universal inbox that delivers e-mail, voice mail, instant messaging and text messaging consistently across virtually any device,” Elop said. “Together with Windows 7 and Windows Server 2008 R2, the combined cost savings and improved productivity helps customers generate long-term business success.”

 According to a commissioned study of technology early adopters conducted by Forrester Consulting on behalf of Microsoft Corp., a customer can see a payback period of less than six months when upgrading to either Exchange Server 2010* or Windows Server 2008 R2.**

 Customers such as Bank of America Corp., Carnival Cruise Line, Global Crossing, Lifetime Products, Morgan Keegan & Co. Inc., NEC Philips, Subaru Canada Inc. and Telekom Austria Group are deploying Exchange Server 2010 and report impressive results with the new server.

 “We have increased storage eightfold at 25 percent of the cost with Exchange Server 2010 and our employees are seeing a reduction of unwanted e-mail by more than 70 percent, freeing us up to focus on more important client issues,” said Steve Derbyshire, operations director, NEC Philips.

 Organizations including Automatic Data Processing Inc., BMW, Baker Tilly, the City of Miami, Energizer, Getronics and Pella Corp. are deploying Windows 7 and report gains in efficiency for both business users and IT. Customers report improved user productivity and easier information access, reduced costs with streamlined management, and reduced risk through better security and increased desktop control. Supporting detail is available in recent total cost of ownership studies and analyst survey reports at http://www.microsoft.com/windows/enterprise/products/windows-7/default.aspx.

 Businesses are seeing equally significant results from Windows Server 2008 R2, with customers including Continental Airlines Inc. (U.S.), Chester Zoo (U.K.), Combell Group NV (Belgium), FinPro (Finland), Wacom Europe GmbH (Germany) and Wortell (Netherlands) noting cost savings through server consolidation, reduced power consumption and improved service levels.

 “With Windows Server 2008 R2, we’ve been able to dramatically reduce costs in our IT infrastructure while simplifying management,” said Phil Morris, IT manager, North England Zoological Society/Chester Zoo. “By virtualizing our environment with Windows Server 2008 R2 Hyper-V, we have reduced the number of servers in our environment by 80 percent while maintaining the high availability our retail staff, researchers and management team need.”

 “Windows Server 2008 R2 brings many efficiencies to our customers, including enabling new virtualization scenarios,” said Bill Laing, corporate vice president for the Windows Server and Solutions Division at Microsoft. “We’ve added the next generation of hypervisor and the new ability to perform Live Migration of virtual machines. Many customers are already seeing tangible results since deploying Windows Server 2008 R2 with Hyper-V.”

 Elop said more than 45,000 partners are trained on Windows Server 2008 R2 and Exchange Server 2010, with several partners announcing new services and solutions today, including Advanced Micro Devices Inc., Avanade, Dell Inc., EMC Corp., Kaspersky Lab, Symantec Corp. and Unisys Corp.

 Exchange Server 2010 and Forefront Protection 2010 for Exchange are available now for trial at http://www.thenewefficiency.com, along with more information about Windows 7, Windows Server 2008 R2 and partner solutions.

Yesterday we had a kickoff for an Early Adopter Windows 7 Community @ Microsoft in the Netherlands.
One of the presentations was about Federated Search and how this nice option will make our work much easier.

Some people were wondering howto deploy a Federated Search Connector in an Enterprise Environment, but nobody seems to know the answer. Reason for me to find out how to do this.

As for most solutions, it is not the only or the best solution, but because I like Group Policy Preferences (GPP) so much I developed a way to deploy a search connector using GPP.

In this example I will deploy the Youtube connector.
(Look for more connectors on : http://www.sevenforums.com/tutorials/742-windows-7-search-federation-providers.html)

On an admin PC just doubleclick on the downloade file, this will install the Search Connector on your PC, in fact it will install it in your user profile.

Now we need 2 files from your profile, first look up C:\USERS\<YOUR USERNAME>\LINKS\YOUTUBE.LNK
Before you copy this file right click it, choose properties and change the targetlocation to : C:\Users\%USERNAME%\Searches\Youtube.searchConnector-ms

Now copy this file to for example your NETLOGON share.

After that copy the file C:\USERS\<YOUR USERNAME>\SEARCHES\Youtube.searchConnector-ms to the NETLOGON share.

We’ve got the files that we need to deploy it to our users.

Logon to your domain controller (or the machine that you use to manage Group Policy) and open the Group Policy Management Console.
N.B. To manage Group Policy Preferences you need a Windows Server 2008 (R2), Windows Vista or Windows 7 machine.

Open your User policy and expand the User Configuration node.
Now go to Preferences -> Windows Settings -> Files.

Add these 2 files :

If you close the file screens, the preference screen will look like this (except for my domain name )

Now the only thing you have to do is wait until the user policy is refreshed ( a user does not have to take any action and will see the search provider automaticly)
And if you cant wait, just use the good old GPUPDATE.

Thats it for now, please enjoy.

Regards,

Erik

To successfully apply quota’s to groups, you need the following things:

• Windows 2008 Domain Controllers for Group Policy Preferences
• File Server Resource Manager (available on Windows Server 2003 R2 and Server 2008)
• A single file server
• Security Groups
• Vb Scripts

• Event triggered tasks

In this situation, there are 3 quota templates defined in the File Server Resource Manager:

• Bronze (100 MB), applied to the share \\SERVER1\HOME$\BRONZE
• Silver (200 MB), applied to the share \\SERVER1\HOME$\SILVER
• Gold (500 MB), applied to the share \\SERVER1\HOME$\GOLD

Ok here we go! This how-to is pretty straight forward, so if I am going to fast plz let me know!

1: Create the required QUOTA templates in FSRM (BRONZE, SILVER, GOLD)

2: Create a HOME$ share on a fileserver (in this example SERVER1)

3: For every QUOTA template, create a separate subfolder with the Quota name (BRONZE, SILVER and GOLD).

4: Apply the QUOTA templates on the in step 3 created folders (BRONZE -> BRONZE. SILVER -> SILVER etc)

5: Create three security Groups (in this example BRONZE, SILVER and GOLD)

6: Create a folder redirection policy for Desktop and Documents and configure it as show in the pictures below:

(pictures only show the BRONZE part, also add the SILVER and GOLD Groups\locations)

 

For example:

In company X, a drive mapping to a certain UNC share is based upon Group Membership.

There are 2 Groups that map the letter P. If the user is member of the Group Sales, he gets the mapping \\server1\sales. If the user is member of the Group Reception, he gets the mapping \\server1\reception.

 

What happens if the user is member of these 2 groups? Well that depends on the scripting capabilities of the IT department (or the way Group Policy Preferences is used).

I can tell you that something is not right…

 

What would you do?

At the moment, you depend on the user to report this so an administrator can remove the user from the other group.

1: Create the Task

Open the Event viewer on the Windows 2008 Domain Controller, and look for the event “4732″. (this is the event generated when a user is added to a domain local group).
This event can be found in the Security container. Right click the event and select “Attach Task To This Event…”

You are prompted to fill in a wizard. The only part of the wizard that requires some kind of input is the “Action” part. It doesn’t really matter what you do here, because we will change it later.

After the wizard is complete, open the task scheduler (start, type in task and press enter).
You can see the following is added:

2: Export the Task

From within Task Scheduler, export the task (as an XML file).

3: Modify the Task so it only reacts on specific 4732 events.

Currently the trigger is activated with every “Local Group membership change”.
We don’t need that!!! To fix this, we need to edit the exported XML with notepad and change the following text:

<Triggers>

    <EventTrigger>

      <Enabled>true</Enabled>

      <Subscription>&lt;QueryList&gt;&lt;Query Id=”0″ Path=”Security”&gt;&lt;Select Path=”Security”&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4732]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>

    </EventTrigger>

  </Triggers>

to: 

<Triggers>

    <EventTrigger>

      <Enabled>true</Enabled>

      <Subscription>&lt;QueryList&gt;&lt;Query Id=”0″ Path=”Security”&gt;&lt;Select Path=”Security”&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4732]] and *[EventData[Data[@Name="TargetUserName"]=”SALES”]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>

                </EventTrigger>

   </Triggers> 

By adding this line, the scheduled task is only responding to event 4732 if the value TargetUserName equals SALES (in this case this is the Local Security Group Name).

*[EventData[Data[@Name="TargetUserName"]=”SALES”]]

For example: If you would like to filter on certain users, you can use “MemberName” instead of “TargetUserName”).

 If you look at the XML view of an event, you will see how the filter works (open an event -> details -> XML view).

4: Modify the Task so we can use certain data from the event

 Now we can add some lines to use the data from the event to pass along to the action we will configure later. First we have to determine which information we want to use.
This is the Event in XML view (for me the only interesting part is the EventData section):

<Eventxmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
 <EventData>

                <Data Name=”MemberName”>CN=Benno Zelders,DC=TEST,DC=lan</Data>

                <Data Name=”MemberSid”>S-1-5-21-4012033790-4084158397-284283626-1332</Data>

                <Data Name=”TargetUserName”>SALES</Data>

                <Data Name=”TargetDomainName”>TEST</Data>

                <Data Name=”TargetSid”>S-1-5-21-4012033790-4084158397-284283626-1333</Data>

                <Data Name=”SubjectUserSid”>S-1-5-21-4012033790-4084158397-284283626-1206</Data>

                <Data Name=”SubjectUserName”>administrator</Data>

                <Data Name=”SubjectDomainName”>TEST</Data>

                <Data Name=”SubjectLogonId”>0×55193</Data>

                <Data Name=”PrivilegeList”>-</Data>

 </EventData>

</Event>

I personally find it very useful to use <Data Name=”MemberName”>, because it shows which user is added to the group. To allow the eventdata parameter to pass along to the action, we need to add the following lines to the XML just before the </EventTrigger> line:

<ValueQueries>
<Value name=”MemberName”>Event/EventData/Data[@Name='MemberName']</Value>
</ValueQueries>

 The end result of the <Triggers> part of the XML is:

<Triggers>

<EventTrigger>

<Enabled>true</Enabled>  

<Subscription>&lt;QueryList&gt;&lt;Query Id=”0″ Path=”Security”&gt;&lt;Select Path=”Security”&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4732]] and *[EventData[Data[@Name="TargetUserName"]=”SALES”]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>

 <ValueQueries>
 <Value name=”MemberName”>Event/EventData/Data[@Name='MemberName']</Value>

</ValueQueries>
</EventTrigger>

</Triggers>

Now we can use the $(MemberName) variable in an action!.

5: Import the “Modified XML” in task scheduler

First we have to delete the original task from the task scheduler.

After this is done, we can import the modified XML by right clicking folder “Event Viewer Tasks” and select “Import Task”

6: Create the action using the variable

First remove the action created in the wizard (open the task, go to “Actions” and remove the existing action.  Now we can create the action to automatically remove the user from the “RECEPTION” group after he is added to the “SALES” group.  (Click New and select “Start a program”). This can be accomplished running a command by using the Active Directory extensions for powershell from QUEST (to automatically load the Quest snap-in, see this page).

 
Program/script:    Powershell.exe
Add arguments:    -command Remove-QADGroupMember –identity RECEPTION –member ‘$(MemberName)’

And click ok twice.

Now the user is automatically removed from the group RECEPTION after it is added to the SALES group. (if it doesn’t work, check the “Run with highest privileges” option in the tab “General”. UAC can block this action).

Of course this can be fine-tuned, but you get the idea right? Now it is possible to create all sort of tasks that use data passed through from an event!

Regards,
Benno Zelders

Today I noticed on my transcript that I’ve passed the exam. Nice timing from Microsoft, cause last 2 weeks I’ve passed every Server 2008 exam for my MCITP Admin and MCITP Enterprise Admin.

On the 9th and 10th of june 2009, I visited the Citrix iForum Benelux 2009:

iForum is the event where virtualisation, networking and application delivery meet.

The 9th of june offered two workshops of which I attend the one hosted by CDG: ‘Optimizing your datacenter with Citrix and Novell Platespin’. Products covered where Novell Platespin Recon and Migrate, CItrix XenApp, XenServer, XenDesktop and Provisioning Server. The workshop featured a nice package of demo’s on screen. I think a Provisioning Server brings some very nice features to the Citrix productline. The main worry of every Citrix admin (how do I keep my XenApp servers identical? ) isn’t much of a challenge anymore with provisioning server, which streams a single read-only vDisk to every XenApp server via PXE. A major downside is obviously the load on the network at boot time.

After the workshop I checked into my hotel and prepared for an interesing evening programm fully loaded with “networkiwork related consumptions… Accompanied by a live performance of the greatest rock band The Netherlands have ever produced: Golden Earring (still going strong despite of being in their sixties).  

The 10th of june was the “real” conference day; lots of workshops to choose from. With a very interesing opening keynote by Mark Templeton (CEO Citrix), introduced (in Double Dutch, quite understandable for native dutch speakers) by Rob van der Hoeven (Area Vice President Benelux). Mark Templeton presented his vision on tomorrows workspace and the direction Citrix is heading to provide solutions to the challenges of the (near) future.  Introducing Dazzle as an iTunes-like portal where enduser can “shop” their own applicationset which can also incorporate 3rd party webapplications etc. Citrix Reciever for iPhone (windows mobile coming soon) bringing the amount of citrix clients down to (the power of) 1. Futhermore, introducing XenClient: a hypervisor solution for the desktop allowing endusers to switch easily between their own private OS and the controlled environment of the corporate desktop also availble for MAC. This promises to be a very interesting product indeed, especially because of its pricing: FREE Also free of charge is the use of XenServer, which is now the preferred platform for hosting XenApp and incorporated some interesting features like XenMotion (vMotion) at no additional costs… Since results of virualized XenApp environments on other (vmware) products varied, XenServer is definately the way to go!

 My workshop program for the day:

1. Keynote: Mark Templeton, CEO & President of Citrix Systems Inc. & Rob van der Hoeven, Area Vice President Citrix Systems Benelux
2. Virtualize your XenApp: how to maximize XenApp server potential by Martijn Bosschaart
3. Meet the Experts – Ask the hard questions! by Thomas Zell, Derek Thorslund, Simon Frost, Rob Sanders and Jan-Frans Lemmens
4. LUNCH
5. Citrix Receiver: the new framework to manage your Citrix clients by Simon Frost
6. Best Practices XenApp by Rob Sanders
7. XenServer 5 – what the other virtualisation guys don’t want you to know by Peter Bats
8. Closing keynote