Thursday 31 December 2015

Last post of 2015

I like to take this opportunity to wish all readers a happy 2016. To be able to blog and share my experience is a wonderful thing because as I write and share it also means that I am learning at the same time.

My project for next year apart from writing SCCM blogs, I hope to do some personal video recording to compliment some of the blog articles I have written over here.

With that, I wish you a happy 2016 and may you are accompanied by health and wealth always.

Thank you for reading! :)

SY

Friday 11 December 2015

SCCM and MDM etc

Personally I have a lot resistance in MDM (Mobile Device Management) because I seldom have project in MDM. However this will become an reality soon especially with CM 1511 that was released a few days back. 

If you want to have a brief overview of what MDM or EDM (Enterprise Device Management) here's the video from Channel 9:


(The rest of the series can be found in MVA) 

And here's the video for CM1151: 


Enjoy watching! :) 

SY 

Tuesday 8 December 2015

SCCM Version 1511 Is Out Today

The new SCCM version 1511 is available today which is still by the way SCCM 2016 whatever name you like to call it, this version will have better integration with mobile device management and will update Windows 10 more frequently. 

http://blogs.technet.com/b/configmgrteam/archive/2015/12/08/system-center-configuration-manager-ga.aspx

Time for me to download the evaluation and try it out myself soon. :) 

Also at the same time this blog is worth reading, this is telling you how cloud services are influencing MS products SCCM included: 

http://blogs.technet.com/b/in_the_cloud/archive/2015/12/08/the-ga-of-system-center-configuration-manager-1511.aspx

Enjoy reading. 

SY 

Wednesday 18 November 2015

SCCM 2012 SP2 and SCCM 2012 R2 SP1 CU2 is out

This new CU enhances performance issues for hybrid Intune device enrolment and DP performance as well, to know more read the below: 

http://blogs.technet.com/b/configmgrteam/archive/2015/11/10/now-available-cu2-for-sc-2012-r2-configmgr-sp1-and-sc-2012-configmgr-sp2.aspx

One thing to note, the CU that was downloaded before 13 Nov 2015 will remove some files that are necessary to MS Intune. Do take note. 

For your information. :) 

SY

Monday 16 November 2015

SQL Setup For SCCM 2012 (Part 2)

This second part of the series is really to compliment the first part I wrote. Some may not know or most of you already know, this was some notes that was taken way back in the SQL 2005 days. But it is a simple and nice overview to understand a SQL query better, and it really explains why the SQL performance is always pointing back to:

1) Processor

2) Memory

3) Disk



Although the process may differ from product to product, but this is very general overview. Usually at the 2nd phase of the query it will check for syntax, look out for the resources available and set a "cost" for the query before it really process the query.

When the processing take place it will really take a performance toll unto the server memory, disk and CPU that is why we whenever we need to setup any SQL server, we need to really take into consideration of the above three components first, and subsequently to look into the SQL statement to enjoy better performance.

Happy reading! :)

SY

Friday 6 November 2015

Did You Know 5: PXE Boot Workflow

I thought I would want to deep dive into PXE Boot workflow and present it as a pictorial format as there isn't much troubleshooting workflow out there. (At least for me) This may differ from your environment, but generically this workflow should apply most of the SCCM PXE boot environment. (UEFI and Legacy boot).


This diagram will be helpful when I shared with my fellow colleagues, so I thought this will be useful as well. Identify the phase you are stuck in, and check for possible reasons:

In "User Machine" phase, chances are: 


a) PXE boot BIOS settings are not set correctly.

b) Firewall or DHCP server are not set correctly.

In network phase, ensure that your switch has: 


a) IPHELPER configure to point from your switch to DHCP and WDS/TFTP server which in my case the DP server is holder the roles.

b) Your firewall you allow the necessary protocols like port 69 (TFTP), 4011 (PXE related ) and high port range that is required by SCCM server.

In DHCP phase, ensure that: 


a) Your DHCP server do not have port 66 & 67 if you want to do UEFI boot.

b) Port 69 (TFTP) is set.

In DP phase, ensure that: 

a) WDS services are up and running. If this service fail, the machine will have no chance to validate its details with SCCM MP.

In MP phase, ensure that: 

a) You have the SMSPXE.log file to check the connectivity between the MP is valid plus in the log you be able to check the machine validation between MP. If the machine is unable to validate, this could means that the machine detail you have imported in your SCCM console is not correct. (Mis-type a MAC address, happens all the time)

Enjoy reading and hope you guys find it useful. :)

SY

Sunday 1 November 2015

SQL Setup For SCCM 2012 (Part 1)

I am not a DB expert but I did went through great length to do a lot of research for DB setup for SCCM 2012, this is including some of the previous MS chalk talks I have attended plus of course some of the tips and tricks from various MVPs and here is the platform for me to share my findings.

A lot of time this may not sound like SCCM to you, but trust me SCCM performance issue is closely knitted with the performance of its own database that is why I thought I spend a lot more time on this topic which is seldom shared.

Why am I writing this? Because chances are, you be like me who will be handling several systems in the company and you have little time for SCCM. Therefore you really want SCCM DB to be designed nicely to give you lesser headache.

I tried to generalise the concepts shared here so that you could use the concepts here for typical SQL server as well. But for MS products every product has specific requirement of the SQL settings. So it will be best to consult MS technet or consultants on this matter.

Before I end part 1. Here are the typical three areas professionals look at, when they deal with SQL performance. While network should not be overlooked as well however I am giving network a miss because seldom the performance related issue with SQL server is due to network.



The above areas are not in any order. 

Happy reading! :) 

SY




Wednesday 21 October 2015

Did You Know 4: SQL Server Collation

Chances are your SQL server installation should be on SQL_Latin1_General_CP1_CI_AS and not something else, because a SCCM server deployment will not pull through if you choose other than the above collation. What collation really does it that it actually is how your character data is stored and compared. 

So during the deployment of SCCM server, as I forgot to tell my customer that the SQL server collation should be the default one instead: 



In order not to re-install SQL again you could rebuild SQL server. 

WARNING: The below option will wipe all DB information, you use this rebuild option for new setup like my case, for any existing setup with data in is beyond this article. 

Here's the command line below: 



Make sure that: 

1) You have a domain admin rights ID to perform the above rebuild or else your rebuild is not going to work. 

2) Since it is a re-build, it would be better to have your SA password reset just in case that you have forget the previous SA password on the existing account or for some queer reason your existing AD account is unable to gain access to the SQL server. 

3) I cannot stress again, this should be done on a new setup DB server, to do this on a production server is risky. You better know what you are doing. 

Happy trying! :) 

Shawn Yuen

Tuesday 6 October 2015

Log File Investigation Part 7 (Software Distribution End To End Overview)

Well, I certainly didn't see myself writing up to 7 parts of log file investigation series. While there is certainly no fan base, from time to time when I pass such workflow to friends and colleagues, it certainly helped them to cut short the log file hunt. 

So I thought, why not I do it for software distribution as well? Even though I did highlight on the previous series, part 7 & 8 will be more comprehensive. Here is a typical flow of software distribution. I try to be more generic and possible the below flow might differ from environment to environment. 

Here it is: 


Don't forget to check out the rest of the log investigation series blogs as well: 


http://cmxp.blogspot.sg/2015/04/log-file-investigation-part-1.html

http://cmxp.blogspot.sg/2015/04/log-file-investigation-part-2.html

http://cmxp.blogspot.sg/2015/04/log-file-investigation-part-3.html

http://cmxp.blogspot.sg/2015/06/log-file-investigation-part-4.html

http://cmxp.blogspot.sg/2015/08/log-file-investigation-part-5-software.html

http://cmxp.blogspot.sg/2015/08/log-file-investigation-part-6-software.html

Happy reading! :) 

SY 

Thursday 1 October 2015

Did You Know 3: AD Schema Troubleshooting Flow

This is not something new and the are many methods that are circulating around the internet to troubleshoot the issue. Here are some of the personal finding and preference to resolve the issue. 

Problem: 

Upon extending the schema, you saw error code 8202 in the log file. And you realise that the AD schema extension is not complete

Steps: 

1) Make you that the AD account your are using has Enterprise Admin and Schema Admin rights. 

2) Ensure that the replication partners are all there in AD. This can be easily achieve when you go into the console of "AD sites and services" Make sure all the DC are replication partners this is to ensure that the extension is replicated across the DC

3) Ensure that the DC you are working at has the Schema master FMSO roles or else you will hit the above error as well.  Fire up the command prompt as administrator in your DC and key the following: netdom /query fmso You must ensure that the DC holds the Schema Master FMSO role. 

Conclusion:

While people have argument to say that the AD schema extension can be done on site server. Base on my personal experience it would be best to do it on a DC with Schema Master FMSO role. Make sure you go through the above checkpoint so that you won't get the error. 

Happy reading!

SY 

Monday 21 September 2015

Personal Ranting: AD Schema Extension (Part 2)

The first part of this series was written to out of "frustration" because of the confrontation of your potential customers. Knowing part one should adequately should adequately allow you to answer your customer's query.

Second part is more illustrate how to perform AD schema extension while the third part "Did you know" series what will you do when you hit issues. 

The steps are fairly simple:

Permission required:

"Schema Admins" & "Enterprise Admins" rights

Tool required: 

"extadsch.exe"

Steps:
• Create "System Management" folder under "System" container in ADSI edit. 

• Grant site server access to the above folder. (Add full control plus make sure the access is applied to "This object and all descendants objects" )

• Double click "extadsch.exe"

• Log will be created at the root of the hard disk. 
To ensure that these lists are current for your version of System Center 2012 Configuration Manager, review the ConfigMgr_ad_schema.LDF file that is located in the\SMSSETUP\BIN\x64 folder of the System Center 2012 Configuration Manager installation media.

Above are fairly simple steps but often face with violent opposition. But thing is just imagine that a spreadsheet (schema) has only ten columns and requires more columns (extend schema) to hold the information to make SCCM more useful, would you want to skip this step?

Happy reading!

SY

Thursday 17 September 2015

Personal Ranting: AD Schema Extension (Part 1)

Fear always stems from doubt and disbelief. If you can understand the underlying issues, you will not have a problem in implementing the technology to your environment. Over the years as a system engineer and consultant, you will be confronted by the customers why is there a need to perform AD schema extension before SCCM installation?

When you can understand the actual rationale behind of AD schema extension you will not reject the idea the next time you deploy SCCM. But nonetheless, AD schema extension is only performed once. So if you are using SCCM 2007 and upgrade to SCCM 2012, then you do not have to perform this action again. 

What is AD schema actually?

In a nutshell, AD schema is part of AD component where it keeps the data of all the AD objects. And these objects are term under class and attributes. 

What is an attribute?

Attributes contain data that defines the information that is stored in an object or in another attribute. For example, a user account object has attributes that store user information, such as the user’s first name, last name, password, office number, and telephone number. 

What is an class?

Object definitions are categorized into groups that are called classes. Classes act as blueprints that can be used each time a new object is created. When a new object is created in the directory, the object’s class determines the attributes that are associated with the new object, including which attributes are required and which attributes are optional.

The above information is taken from: 


A one time only AD schema extension will create 14 attributes and 4 classes in AD. (18 in total) 

Attributes: 

cn=mS-SMS-Assignment-Site-Code

cn=mS-SMS-Capabilities

cn=MS-SMS-Default-MP

cn=mS-SMS-Device-Management-Point

cn=mS-SMS-Health-State

cn=MS-SMS-MP-Address

cn=MS-SMS-MP-Name

cn=MS-SMS-Ranged-IP-High

cn=MS-SMS-Ranged-IP-Low

cn=MS-SMS-Roaming-Boundaries

cn=MS-SMS-Site-Boundaries

cn=MS-SMS-Site-Code

cn=mS-SMS-Source-Forest

cn=mS-SMS-Version

Classes: 

cn=MS-SMS-Management-Point

cn=MS-SMS-Roaming-Boundary-Range

cn=MS-SMS-Server-Locator-Point

cn=MS-SMS-Site

Happy reading!

SY

Friday 11 September 2015

Did You Know 2: WSUS Maintenance

While this is actually old news, but the sites I went usually do not update the WSUS option. Especially for those SCCM to download different language windows patches, the private memory pool will be easily hit. 

Bear in mind that WSUS capacity is slightly different from SCCM. Therefore remember to setup this simple maintenance option in your site server: 


Make sure you set at least 8GB and above in KB. 

Information was taken from here: 

http://blogs.technet.com/b/configurationmgr/archive/2015/03/23/configmgr-2012-support-tip-wsus-sync-fails-with-http-503-errors.aspx

http://blog.coretech.dk/kea/house-of-cardsthe-configmgr-software-update-point-and-wsus/

Happy reading!

SY 

Monday 7 September 2015

Did You Know 1: Software Update Status

Everyday we read software updates report status, but have you ever thought, what does the status really means? Well, few days back a manager came by and ask me a question on the report status and it lead me think of giving "professional' answers that are published in technet: 

State
Description
Required
Specifies that the software update is applicable and required on the client computer. Any of the following conditions could be true when the software update state is Required:

·         The software update was not deployed to the client computer.

·         The software update was installed on the client computer. However, the most recent state message has not yet been inserted into the database on the site server. The client computer rescans for the update after the installation has finished. There might be a delay of up to two minutes before the client sends the updated state to the management point that then forwards the updated state to the site server.

·         The software update was installed on the client computer. However, the software update installation requires a computer restart before the update is completed.

·         The software update was deployed to the client computer but has not yet been installed.
Not Required
Specifies that the software update is not applicable on the client computer. Therefore, the software update is not required.
Installed
Specifies that the software update is applicable on the client computer and that the client computer already has the software update installed.
Unknown
Specifies that the site server has not received a state message from the client computer, typically because one of the following:

·         The client computer did not successfully scan for software updates compliance.

·         The scan finished successfully on the client computer. However, the state message has not yet been processed on the site server, possibly because of a state message backlog.

·         The scan finished successfully on the client computer, but the state message has not been received from the child site.

·         The scan finished successfully on the client computer, but the state message file was corrupted in some
way and could not be processed.

I hope you find this useful! :) 

Happy reading! 

SY

Tuesday 1 September 2015

Introducing "Did you know?" series

Apart from labs, I will be sharing my working experiences here, while some of the articles posted here may not be new, but some recap and what stuff REALLY works will be posted here. 

Most of the articles posted here have been tried by myself personally during my course of my work. Let me adjust my notes and I will put it up here slowly. 

Happy reading! 

SY 

Monday 31 August 2015

Log File Investigation Part 6 (Software Update End To End Log Investigation)

I actually enjoy mapping out the process because I feel that apart from giving me a better understanding of the software update process it will help the front end personnel to troubleshoot their patching more effectively.  


I have shared the above logs file mapping with my colleagues and so far they felt that it is easier for them as they know which log file to target at and to analyse. Of course, if you know which log file to read or have your own preference you don't to follow the above chart. 

Don't forget my earlier series as well: 






Happy investigating! :) 

SY

Wednesday 26 August 2015

Log File Investigation Part 5 (Software Update End To End Overview)

Having 4 parts of the earlier investigation series, I was thinking how improve it, surely there must be something that can be improved. Looking back at the previous blogs, we are looking at on the spot log file troubleshooting. 

While there is nothing wrong with that, an example of windows patches deployment, we take a look at UpdateDeployment.log to see if we have deployment issue. While there is nothing wrong with this approach, I was thinking why not me map out the end to end work flow. 

Surely this will help us greatly in which log file. The below workflow is basically base on my understanding from reading the below technet article;

There was some sort of flowchart in SCCM 2007 but not for SCCM 2012. In this series, I will begin with Software Updates workflow: 


You will see 2 grouped clusters, one cluster is from the server end while the other will be on the client end, in the future series I will map the process with all the necessary log files so that it will be easier for the administrator to jump into which log file to look. (More importantly, save time) 

Don't forget my earlier log investigation series: 





Happy reading! :) 

SY

Monday 24 August 2015

Sorting Out Client Version Numbers

With SCCM 2012 coming out with the latest version of SCCM 2012 R2 SP1 CU1, I think it is timely to see what are the version and build of the clients. Usually we be stumbled by the version of client the machine is using. Apart from my previous blog post that you could use CM Service Extension

Or you could use the link here which maintains a nice version table. 

Enjoy! 


SY

Wednesday 19 August 2015

Configuration Manager 2016 Technical Preview 3

One month plus and here's another Tech Preview. You could go to MS eval center to try out the features: 

https://www.microsoft.com/en-us/evalcenter 

The main feature of the updates are found here: 

http://blogs.technet.com/b/configmgrteam/archive/2015/08/19/now-available-system-center-configuration-manager-technical-preview-3.aspx

Guess they finally decided to make SCCM HA ready. 

Have fun trying :) 

SY

Friday 31 July 2015

Configuration Manager Service Extension

This is actually not a new thing, it was available for download since last year. But with the upcoming of many product updates, it will be pretty tough for administrators to keep up with the pace, so this nice little extension tool comes in handy to check on the latest news for SCCM.

The tool can be downloaded from here. It is free of course.  And there is the page long user guide over here. Installation process is very straightforward, you need a few clicks and you are good to go. Since the application will be installed in the SCCM console, you could installed in your client machine console instead of your production server console.

Below screenshots were take from Windows 7 machine:


Go to Administration pane, and you will see "Site Servicing", you will see recent news about SCCM. By the you will need internet connection to see all this news feeds. 




Releases field will let you see what are the latest releases of CU and SP


Site versions will be helpful as it translate the base version of your SCCM to "readable" format. Sometimes you see "Access Denied" in the fields, you could actually overcome the issues by running the console as administrator to resolve this issue.

Client targeting particularly useful as it helps you to create a query base on the latest CU or SP news.  

Click on 'Create Query' base on the KB article as shown above.

Go to Monitor pane, and you should see your query created, this actually helps you to ensure that your environment clients are patched with the latest SCCM  updates.
Then of course, who can miss the technical blog from SCCM team? :) 





Hope you guys find this tool useful! :) 

SY

Saturday 18 July 2015

Port Query Tool

During a start of an implementation project, you would probably ask your client have you turn on the necessary ports? Chances are they would have told you they have their ports turned on. Then in the midst of implementing see weird errors or for some weird reasons some of the components are unable to install. (Especially your Distribution Point) 

So in order to appear smart in front of the customer, you could use this port query tool (Free download from Microsoft) and check the relevant ports, I have amended the XML file so that it will easier to select which query to choose from. 

The original download can be found here: 


The modified version of the port query tool: 


Gives you a drop down list and see where you want to start your query from. Example, if you have some issue with AD, you can copy the tool in SCCM site server and run against your AD as show above. 






The port query results will show that which port number that the site server has issues communicating with. 

This will be useful proof to show to the network team and get them to turn off the firewall rules etc. 

You can download the files here: 



For the list of ports SCCM use, you can find the it in my previous blog here

Have fun! :) 

SY

Sunday 12 July 2015

Using PowerShell To Check The OS Architecture

This post was actually inspired by the previous post: 


I was thinking using Powershell instead, the previous batch file serves the purpose, check for that particular folder and wah la you got your program installed. But I want to tap on Powershell's advance feature to ensure that the machine is really on 64 bit OS to install. 

So here goes: 

$OSArchitecture = (Get-WmiObject -Class Win32_OperatingSystem | Select-Object OSArchitecture -ErrorAction Stop).OSArchitecture
if ($OSArchitecture -eq '64-bit')
{& path:\a.exe}
else
{& path:\b.exe}

The idea is to use Powershell to check on the OS architecture. The strings behind Win32_OperatingSystem can be found here

You will need to change the variable yourself for the software path. 

Afterwards you can deploy the a batch file to invoke the above Powershell script to install the programs. Make sure you add in the required installation parameters as well. 

In case you do not know how to use a batch file to run Powershell scripts you can take a look of my previous posts on simple scripting to get the job done: 




Enjoy!

SY

Wednesday 1 July 2015

Using Batch File To Check The OS Architecture

Today is a interesting day, whereby client wanted to deploy 2 versions Java (32 and 64 bits) to client machines.


One of the easier method is to use "Platform requirements" under Package:







and the other deployment method, choose "Requirements" under Application deployment to allow the package to detect the OS architecture of the client to install the appropriate version of the software.


The above method works fine, if you deploy just a 32 bit application, or you could exclude the OS versions. But you what if you have specific requirements that you need to deploy the 32 and 64 bits applications to respective OS? Well you could deploy two times or you use the following batch file to deploy: 

=====================================
@echo off
SET LogLoc=C:\LOGS
SET AppName=JAVA83_Install

IF NOT EXIST "%LogLoc%" (
MKDIR "%LogLoc%"
ECHO %DATE% %TIME% - %LogLoc% created >> %LogLoc%\%AppName%.log
) ELSE (
ECHO %DATE% %TIME% - %AppName% started >> %LogLoc%\%AppName%.log
)

IF EXIST "C:\Program Files (x86)" ("amd64/03-Java83.exe" /s) else ("x86/03-Java83.exe" /s)

ECHO %DATE% %TIME% - checking processor architecture - %CPUArch% >> %LogLoc%\%AppName%.log
ECHO %DATE% %TIME% - Starting JAVA 8 U31 Installation on %computername% >> %LogLoc%\%AppName%.log
SET ErrorCode=%ERRORLEVEL%
ECHO %DATE% %TIME% - Exit Code is - %ErrorCode% >> %LogLoc%\%AppName%.log
ECHO %DATE% %TIME% - Exiting Installation >> %LogLoc%\%AppName%.log
Exit %ErrorCode%

pause

=====================================

Copy and paste the above batch command, save as "CMD" or "BAT" . Change the files location and application name on the highlighted portion and deploy it under "Package" and you are good to go. 

This lead me to think, can I use Powershell to achieve it instead? :) 

Give you guys a update soon, hope you guys like it. 

Have fun. 

SY