First, thank you for visiting my blog. My name is Justin Chalfant. You can learn a little more here about me. In short, I worked at Microsoft as an engineer supporting Configuration Manager for about 5 years, and I’m currently the Founder/CEO at Patch My PC.

Topics and Order for New ConfigMgr Learners 🤓

If you are new to ConfigMgr, I would start with the videos in the Install ConfigMgr and Setting the Basics Setup first. After that, you could bounce around to topics that interest you the most. If you have a suggestion for a topic, please contact me!

Install ConfigMgr and Getting the Basics Setup

• How to install Microsoft SCCM Current Branch Step-By-Step Guide
• Microsoft SCCM Post Installation and Configuration (Boundaries, Client Settings, and more)
• Deploy the Configuration Manager Client Agent to Windows Computers in SCCM
• How to Configure Backup and Recovery for Microsoft SCCM
• How to Update an SCCM Current Branch Site In-Place Using the Updates and Servicing Feature
• Understanding Role-Based Administration (RBA) in Microsoft SCCM

Application Creation and Deployment

• How to Create, Manage, and Deploy Applications in Microsoft SCCM (EXE and MSI Installs)

Configuring Software Updates

• How to Create, Manage, and Deploy Applications in Microsoft SCCM (EXE and MSI Installs)
• How to Deploy Software Updates Using Microsoft SCCM (ADRs, Update Groups, and More)
• Windows 10 Servicing Plans and In-Place Upgrades In Microsoft SCCM
• Enabling Third-Party Software Update Catalogs in Microsoft SCCM
• How to Use Orchestration Groups For Software Updates in SCCM
• How to Rebuild or Relocate a WSUS Server that is a ConfigMgr Software Update Point (SUP)

Configuring Operating System Deployment (OSD)

• Introduction to OSD in Microsoft SCCM (WIMs, Boot Images, PXE, Drivers and More)
• Using Microsoft Deployment Toolkit (MDT) UDI as Custom OSD Frontend in Microsoft SCCM
• How to Use USMT in SCCM for User Migration (ScanState, LoadState, MigApp, MigUser, MigDocs)

PKI and Managing Internet-Based Clients

• How To Configure PKI for Microsoft SCCM to Use HTTPS/SSL Instead of HTTP
• How To Setup Cloud Management Gateway (CMG) in Microsoft SCCM to Manage Internet Clients
• Setup Internet-Based Client Management (IBCM) in Microsoft SCCM to Manage Internet Clients
• Setup a PKI Based Code-Signing Certificate for Third-Party Updates in Microsoft SCCM | Text Guide
• Cloud Management Gateway (CMG) Community Session with the Patch My PC Team
• Third-Party Software Updates in ConfigMgr when SUP/WSUS is Remote and not Running in SSL/HTTPS

Other ConfigMgr and Intune Topics

• Using CMPivot in SCCM for Real-Time Data and Taking Real-Time Action Using Scripts
• How to Enable Site Server High Availability in SCCM
• How to Set Up Co-Management in Microsoft SCCM to Connect to Microsoft Intune
• Troubleshooting Microsoft Intune Win32 Application Deployments
• How to Perform a Configuration Manager (ConfigMgr) Site Migration
• Remove a Central Administration Site in Configuration Manager (SCCM) 

Deep Dives for Various ConfigMgr Topics

My deep dive guides usually dig into particular areas of ConfigMgr to better understand specific components of the product. There is no particular order these are useful in.

• Deep Dive into Application Deployment on the Client Side in Microsoft SCCM
• Deep Dive in Microsoft SCCM Software Updates Client and Server Components
• Deep Dive Into Automatic Deployment Rule (ADR) Components (RuleEngine and PatchDownloader) in SCCM
• Deep Dive How to Configure a Shared WSUS Database for Multiple SUPs in SCCM
• Deep Dive How to Migrate a WSUS Database from WID to SQL in SCCM
• Deep Dive Maintaining the WSUS Catalog by Declining Updates for Better Update Scanning
• Deep Dive Configure a Software Update Point (WSUS) Server to Require SSL in SCCM
• Deep Dive into How the Site Server Works in Configuration Manager (SCCM)
• Deep Dive Into the Content Library, Content Location Request, DPs, IIS in Microsoft SCCM
• Deep Dive into OSD Task Sequence Client Side Troubleshooting in Microsoft SCCM
• Deep Dive Third-Party Update Considerations with Cloud Management Gateway (CMG) in SCCM
• Deep Dive Token-Based Authentication for Cloud Management Gateway in Configuration Manager

Free Products / Reports for ConfigMgr

• Free Power BI Report for Microsoft and Third-Party Updates in Configuration Manager
• Free SSRS Software Update Dashboard for Microsoft SCCM from Patch My PC

Overview

This video tutorial will look at the different options we have to deploy a Configuration Manager client to Windows computers. We’ll cover the following methods:

• Install Method 1:Client push installation
• Install Method 2: Software update-based installation
• Install Method 3: Group Policy installation
• Install Method 4: Manual installation

Topics in Video

• Introduction: (0:00)
• Reviewing Prerequisites for deploying clients to Windows Computers: (0:54)
• Best practices for deploying clients: (2:23)
• Have you extended the Active Directory Schema?: (2:30)
• Client Push Installation Method: (5:01)
• Advantages and Disadvantages of the Client Push Installation Method: (5:13)
• Overview of the current lab setup: (6:50)
• Attempting a client push installation: (7:40)
• Reviewing the ccm.log: (9:07) Creating Group Policy for Firewall Rules: (10:37)
• Running gpupdate /force on Demo Client: (12:29)
• Second attempt at client push installation: (13:23)
• Reviewing the ccm.log after the second attempt: (13:50)
• Configuring a Client Push Account: (14:07)
• Creating a local admin Group Policy: (15:24)
• Final attempt at client push installation: (17:50)
• Verifying installation of client: (18:04)
• Performing an Automatic Client Push Installation: (22:45)
• Verifying Installation of client: (27:55)
• Software Update-Based Installation: (29:05)
• Advantages and Disadvantages of Software Update-Based Installation: (29:29)
• Best Practices for Software Update-Based Installation: (30:35)
• Initiating the Software Update-Based client installation: (31:50)
• Viewing the Configuration Manager Client update in the Patch My PC Publisher: (33:37)
• Creating a policy to scan against the Software Update Point: (34:53)
• Verifying policy applied on the client machine: (40:57)
• Running a Windows Update check: (41:37)
• Verifying installation of client: (41:59)
• Configuring site assignment by creating an SCCM Site Assignment Policy: (43:55)
• Group Policy Installation Method: (47:00)
• Verifying installation of client: (54:00)
• Manual Installation Method: (56:02)
• Advantages and Disadvantages of the Manual Installation Method: (56:02)
• Initiating Manual Installation of client: (58:23)
• Verifying installation of client: (1:00:12)
• Performing manual installation when you do not have your site information published to Active Directory: (1:00:23)
• Verifying installation of client: (1:02:21)
• Wrap-up: (1:03:03)

Helpful Resources:

• Install Method 1: Client push installation
• Use software update-based client installation for Active Directory computers
• Specify Intranet Microsoft Update Service Location local policy
• Extend the Active Directory schema and publish the site so that you can run CCMSetup without command-line options
• If you install the client with client.msi properties, use SMSMP and FSP

Registry Updates

Note: A full guide for this process in the video is available on: https://www.anthonyfontanez.com/index.php/2021/09/01/configmgr-client-deployment-via-software-update/ 

• SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
  WUServer
  • WUServer
  • String
• SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
  • WUStatusServer
  • String
• SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  • UseWUServer
  • DWORD = 1
• SYSTEM\CurrentControlSet\Services\CcmExec

Command Lines and Other Examples

• ccmsetup.exe command lines options = SMSSITECODE=DM1 FSP=DEMO1.CONTOSO.LOCAL MP=DEMO1.CONTOSO.LOCAL
• gpresult /R /SCOPE COMPUTER /Z

Overview

In this video, we will be covering how to migrate from one ConfigMgr site to another. Specifically, we will look at migrating a ConfigMgr 2103 Site to another 2103 Site. This process is similar if you were migrating from a different version of ConfigMgr (Source Site) to the ConfigMgr Current Branch (Destination Site). All the same concepts would apply to those situations.

Topics in Video

• Introduction – (0:00)
• Reviewing Microsoft Doc on Migrating data between hierarchies in ConfigMgr – (0:39)
• Lab Overview – (1:22)
• Reviewing the requirements, concepts, and prerequisites for the ConfigMgr Site Migration – (2:09)
  
• Reviewing the objects we plan to migrate from the source site – (5:35)
• What objects can you migrate? – (7:37)
• Configuring the source hierarchy on the destination site – (8:30
• Going over the migmctrl.log – (10:48)
• Configuring the Infrastructure Administrator role on the source site – (11:28)
• Attempting another data gathering on the destination site – (13:12)
• Revisiting the migmctrl.log – (13:29)
• Configuring the Source Site Database Account – (14:01)
• One more attempt at gathering data – (16:47)
• Successful data gather – (17:15)
• Creating a Migration Job – (17:30)
• Reviewing migmctrl.log to view permission errors – (21:12)
• Taking a look at the built-in Infrastructure Administrator security role – (21:42)
• Options for how to fix the permission errors – (22:20)
• Restarting the Migration Job – (23:22)
• Creating another Migration Job – (24:33)
• Deploying application to see what it looks like to also migrate deployments to the destination site – (25:22)
• Running another Data Gather to re-evaluate the source site – (26:15)
• Creating another Migration Job – (27:02)
• Looking at the migmctrl.log after creating the Migration Job – (29:55)
• Reviewing the Object Migration Progress – (30:33)
• Digging into the objects that failed – (31:11)
• Starting the Migration Job again – (35:13)
• Digging into the remaining failed Object – (36:50)
• Let’s talk about the content source location – (39:15)
• Overview of the ConfigMgr Content Source Update Tool – (40:02)
• Wrap-up – (41:41)

Helpful Resources:

• Migrate data – Configuration Manager | Microsoft Docs
• Migration job planning – Configuration Manager | Microsoft Docs
• Migration prerequisites – Configuration Manager | Microsoft Docs
• ConfigMgr Content Source Update Tool 1.0.0 – MSEndpointMgr

Overview

• This video tutorial will describe how to configure WSUS to require SSL. This setting will ensure client scan for updates via your WSUS/SUP in Configuration Manager.

Topics in Video

• Introduction: (0:00​)
• Review SUP/WSUS server that does not require SSL: (0:45​)
• Review the SCCM and WSUS Lab Setup: (2:30​)
• Create the certificate template to create an SSL certificate for WSUS: (3:00​)
• Issue the template for enrollment: (6:06​)
• Request the SSL certificate on the WSUS server using certlm.msc: (6:17​)
• Bind the SSL certificate to the WSUS Administration website in IIS: (8:30​)
• Verify WSUS is using SSL/HTTPS: (9:03​) Configure SSL to be required on the WSUS server: (10:26​)
• Run wsusutil configuressl to configure WSUS to use SSL: (12:11​)
• Set the software update to point setting to require SSL communication to the WSUS server: (13:20​)
• Validate clients are now using SSL to scan against WSUS: (14:17​)

Helpful Resources:

• https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852346(v=ws.11)?redirectedfrom=MSDN#configure-ssl-on-the-wsus-server
• https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates#BKMK_webserver22008
• https://docs.microsoft.com/en-us/previous-versions/system-center/system-center-2012-R2/gg699362(v=technet.10)?redirectedfrom=MSDN 

Overview

• In this video guide, we will look in detail at what happens on the site server when ADR’s evaluation is run. This covers in detail the RuleEngine and PatchDownloader components. We will look at how these components work with Verbose, Debug, and SQL Tracing enabled.

Topics in Video

• Introduction of deep-dive automatic deployment rule video topics: (0:00​)
• How to Enable Debug and Verbose Logging and SQL Tracing in SCCM:(2:58​)
• Review the RuleEngine component in the Configuration Manager Service Manager: (6:40​)
• Run an ADR and review the logging of the RuleEngine.log: (7:45​) Review SQL Query criteria generated by RuleEngine: (10:13​)
• Review How RuleEngine determines if updates need to be downloaded to a deployment package: (13:00​)
• The PatchDownloader component used for ADRs and review PatchDownloader.log: (15:50​)
• RuleEngine creating software update groups: (20:50​)
• How deployments are created for ADRs by RuleEngine: (23:20​)
• Add to an existing software update group ADR setting in SCCM: (26:15​)

Helpful Resources:

• Track the software update deployment process – Configuration Manager | Microsoft Docs
• Log file reference – Configuration Manager | Microsoft Docs

Overview

• In this #ConfigMgr video guide, we will review what the site server is in a Configuration Manager site and the functions the site server performs. Docs: – Site Server and Site System: https://docs.microsoft.com/en-us/mem/… – Use the Configuration Manager Service Manager to manage site components: https://docs.microsoft.com/en-us/mem/… – Logs for Site Server: Server log files: https://docs.microsoft.com/en-us/mem/…

Download Excel Log Sheet

• Site Server Log Files
• Latest logs on ConfigMgr Docs for Server Logs Files 

Topics in Video

• Intro: (0:00)
• What is the ConfigMgr site server: (0:36)
• Functions of the Site Server SMS_EXECUTIVE Treads: (2:37)
• Review a site system: (3:40)
• Review Configuration Manager Service Manager and the threads running under SMS_EXECUTIVE service: (4:20)
• Review components and log files used by the site server: (8:30)
• How we enabled verbose and debug logging on the ConfigMgr site server: (10:45)
• Review SMS_AD_SYSTEM_DISCOVERY_AGENT | adsysdis.log: (13:00)
• What are ConfigMgr inboxes on the site server: (14:25)
• Review SMS_AD_USER_DISCOVERY_AGENT | adusrdis.log: (16:12)
• Review AD group discovery: (17:19)
• Review SMS_CLIENT_CONFIG_MANAGER used for Client Push CCM.log | Records activities for client push installation.: (18:08)
• Review SMS_COLLECTION_EVALUATOR | colleval.log | Records details about when collections are created, changed, and deleted by the Collection Evaluator.: (20:40)
• Review SMS_INVENTORY_DATA_LOADER | dataldr.log: (23:30)
• Review SMS_DISTRIBUTION_MANAGER and SMS_PACKAGE_TRANSFER_MANAGER | distmgr.log | Records details about content distribution requests. & PkgXferMgr.log – Records the actions of the SMS_Executive component that is responsible for sending content from a primary site to a remote distribution point.: (28:44)
• Review SMS_HIERARCHY_MANAGER | hman.log | Records information about site configuration changes, and about the publishing of site information in Active Directory Domain Services.: (33:25)
• Review SMS_SITE_COMPONENT_MANAGER – sitecomp.log | Records details about the maintenance of the installed site components on all site system servers on the site.: (35:00)
• Review SMS_STATE_SYSTEM | statesys.log | Records the processing of state system messages. (39:00)
• Review SMS_WSUS_CONTROL_MANAGER: (41:00)
• Review SMS_WSUS_SYNC_MANAGER: (43:30) 

Overview

• This guide covers considerations for third-party software updates in Configuration Manager when using a remote software update point (SUP) that is not configured for SSL.

Topics in Video

• Intro: (0:00​)
• Review remote site system running SUP in HTTP mode: (1:30​)
• Enable third-party updates and Configuration Manager managed the certificate: (2:15​)
• wsyncmgr.log error Warning: Remote WSUS connection is not HTTPS. This prevents software update point from getting the signing certificate for third-party updates.: (2:50​)
• Review the SMS_ISVUPDATES_SYNCAGENT.log: (3:45​)
• Stage the content for selected categories automatically: (6:00​)
• SMS_ISVUPDATES_SYNCAGENT.log syncing catalog: (7:15​)
• SMS_ISVUPDATES_SYNCAGENT.log: error NO_SIGNING_CERT: (8:00​)
• Create a WSUS Signing Certificate using Patch My PC’s Publisher: (11:00​)
• Export and Deploy WSUS Signing Certificate using a GPO: (14:15​)

Helpful Resources:

• What is the WSUS Signing Certificate and How to Create It – https://patchmypc.com/wsus-signing-certificate-options-for-third-party-updates-in-configuration-manager
• Download Publisher – https://patchmypc.com/docs
• How to Deploy the WSUS Signing Certificate for Third-Party Software Updates – https://patchmypc.com/how-to-deploy-the-wsus-signing-certificate-for-third-party-software-updates