Overview

• In this video, we will review how to remove a central administration site in SCCM. We will cover the requirements for the removal and how to perform the removal.

Topics in Video

• Introduction: (0:00)
• DJam – History of CAS and Why They May Need to be Collapsed: (0:57)
• Overview of Our Current Lab Environment & Plan for the CAS Removal: (11:26)
• Reassigning Clients Before Uninstalling Second Primary Site: (14:11)
• Removing Boundaries & Site System Roles Before Uninstalling Second Primary Site: (18:30)
• Optional Step – Uninstall Client Agent Before Uninstalling Second Primary Site: (21:52)
• Uninstall Second Primary Site: (22:55)
• Removing Reporting Services Role from CAS & Reconfiguring on Standalone Primary Site: (25:36)
• Going Over Site Roles That Do Not Need to be Removed from the CAS: (32:54)
• Looking at Prerequisites to Remove the CAS: (34:26)
• Removing the CAS: (34:50)
• Unpublish CAS Object from Active Directory: (37:20)
• Reviewing Standalone Primary Site after Removal of the CAS: (38:33)
• Performing Post-Setup Tasks: (39:26)
• Overview of Potential Hash Errors if you Manage Third-Party Updates: (41:44)
• Exporting Patch My PC Publisher Settings & Certificate from CAS: (46:58)
• Importing Publisher Settings & Certificate to Standalone Primary Site: (49:52)
• Solution for Third-party Update Hash Errors After Removing the CAS: (52:24)
• Reconfiguring Boundaries and Boundary Groups: (57:02)
• Wrap-up: (59:03)​

Helpful Resources:

• Remove CAS – Configuration Manager | Microsoft Docs
• Uninstall sites – Configuration Manager | Microsoft Docs

 

Overview

• This video tutorial will describe how to configure WSUS to require SSL. This setting will ensure client scan for updates via your WSUS/SUP in Configuration Manager.

Topics in Video

• Introduction: (0:00​)
• Review SUP/WSUS server that does not require SSL: (0:45​)
• Review the SCCM and WSUS Lab Setup: (2:30​)
• Create the certificate template to create an SSL certificate for WSUS: (3:00​)
• Issue the template for enrollment: (6:06​)
• Request the SSL certificate on the WSUS server using certlm.msc: (6:17​)
• Bind the SSL certificate to the WSUS Administration website in IIS: (8:30​)
• Verify WSUS is using SSL/HTTPS: (9:03​) Configure SSL to be required on the WSUS server: (10:26​)
• Run wsusutil configuressl to configure WSUS to use SSL: (12:11​)
• Set the software update to point setting to require SSL communication to the WSUS server: (13:20​)
• Validate clients are now using SSL to scan against WSUS: (14:17​)

Helpful Resources:

• https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852346(v=ws.11)?redirectedfrom=MSDN#configure-ssl-on-the-wsus-server
• https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates#BKMK_webserver22008
• https://docs.microsoft.com/en-us/previous-versions/system-center/system-center-2012-R2/gg699362(v=technet.10)?redirectedfrom=MSDN 

 

Overview

• In this video guide, we will look in detail at what happens on the site server when ADR’s evaluation is run. This covers in detail the RuleEngine and PatchDownloader components. We will look at how these components work with Verbose, Debug, and SQL Tracing enabled.

Topics in Video

• Introduction of deep-dive automatic deployment rule video topics: (0:00​)
• How to Enable Debug and Verbose Logging and SQL Tracing in SCCM:(2:58​)
• Review the RuleEngine component in the Configuration Manager Service Manager: (6:40​)
• Run an ADR and review the logging of the RuleEngine.log: (7:45​) Review SQL Query criteria generated by RuleEngine: (10:13​)
• Review How RuleEngine determines if updates need to be downloaded to a deployment package: (13:00​)
• The PatchDownloader component used for ADRs and review PatchDownloader.log: (15:50​)
• RuleEngine creating software update groups: (20:50​)
• How deployments are created for ADRs by RuleEngine: (23:20​)
• Add to an existing software update group ADR setting in SCCM: (26:15​)

Helpful Resources:

• Track the software update deployment process – Configuration Manager | Microsoft Docs
• Log file reference – Configuration Manager | Microsoft Docs

 

Overview

• In this #ConfigMgr video guide, we will review what the site server is in a Configuration Manager site and the functions the site server performs. Docs: – Site Server and Site System: https://docs.microsoft.com/en-us/mem/… – Use the Configuration Manager Service Manager to manage site components: https://docs.microsoft.com/en-us/mem/… – Logs for Site Server: Server log files: https://docs.microsoft.com/en-us/mem/…

Download Excel Log Sheet

• Site Server Log Files
• Latest logs on ConfigMgr Docs for Server Logs Files 

Topics in Video

• Intro: (0:00)
• What is the ConfigMgr site server: (0:36)
• Functions of the Site Server SMS_EXECUTIVE Treads: (2:37)
• Review a site system: (3:40)
• Review Configuration Manager Service Manager and the threads running under SMS_EXECUTIVE service: (4:20)
• Review components and log files used by the site server: (8:30)
• How we enabled verbose and debug logging on the ConfigMgr site server: (10:45)
• Review SMS_AD_SYSTEM_DISCOVERY_AGENT | adsysdis.log: (13:00)
• What are ConfigMgr inboxes on the site server: (14:25)
• Review SMS_AD_USER_DISCOVERY_AGENT | adusrdis.log: (16:12)
• Review AD group discovery: (17:19)
• Review SMS_CLIENT_CONFIG_MANAGER used for Client Push CCM.log | Records activities for client push installation.: (18:08)
• Review SMS_COLLECTION_EVALUATOR | colleval.log | Records details about when collections are created, changed, and deleted by the Collection Evaluator.: (20:40)
• Review SMS_INVENTORY_DATA_LOADER | dataldr.log: (23:30)
• Review SMS_DISTRIBUTION_MANAGER and SMS_PACKAGE_TRANSFER_MANAGER | distmgr.log | Records details about content distribution requests. & PkgXferMgr.log – Records the actions of the SMS_Executive component that is responsible for sending content from a primary site to a remote distribution point.: (28:44)
• Review SMS_HIERARCHY_MANAGER | hman.log | Records information about site configuration changes, and about the publishing of site information in Active Directory Domain Services.: (33:25)
• Review SMS_SITE_COMPONENT_MANAGER – sitecomp.log | Records details about the maintenance of the installed site components on all site system servers on the site.: (35:00)
• Review SMS_STATE_SYSTEM | statesys.log | Records the processing of state system messages. (39:00)
• Review SMS_WSUS_CONTROL_MANAGER: (41:00)
• Review SMS_WSUS_SYNC_MANAGER: (43:30) 

Overview

• In this video guide, Cody Mathis and Justin Chalfant from Patch My PC will review common issues that can arise with third-party patch management through Cloud Management Gateway in Microsoft Configuration Manager (SCCM). We will review common issues that can arise with third-party updates such as content not distributed to CMG, CMG authentication to the SUP site system, certificates, content lookups, policy, and more.

Helpful Resources

• Integrate with Windows Update for Business – https://docs.microsoft.com/en-us/configmgr/sum/deploy-use/integrate-windows-update-for-business-windows-10
• Set up cloud management gateway for Configuration Manager – https://docs.microsoft.com/en-us/configmgr/core/clients/manage/cmg/setup-cloud-management-gateway

Overview

• In this video guide, we will review the new feature for Token-based authentication for cloud management gateway released in Configuration Manager current branch 2002 https://docs.microsoft.com/en-us/configmgr/core/plan-design/changes/whats-new-in-version-2002#token-based-authentication-for-cloud-management-gateway.

Topics in Video

• Please see youtube: https://youtu.be/e5QSv1Yna6M

Helpful Resources

• Token-based authentication for cloud management gateway – https://docs.microsoft.com/en-us/configmgr/core/plan-design/changes/whats-new-in-version-2002
• Register for token on the internal network – https://docs.microsoft.com/en-us/configmgr/core/clients/deploy/deploy-clients-cmg-token#register-on-the-internal-network 
• Create a bulk registration token – https://docs.microsoft.com/en-us/configmgr/core/clients/deploy/deploy-clients-cmg-token#create-a-bulk-registration-token
• Bulk registration token tool usage – https://docs.microsoft.com/en-us/configmgr/core/clients/deploy/deploy-clients-cmg-token#bulk-registration-token-tool-usage 

Overview

• In this video guide, we will be covering how to use a shared WSUS database for multiple software update points in SCCM. Using a shared WSUS Database is generally considered a best practice in well-connected scenarios since this offloads the vast majority of network impact if a client were to switch SUPs in SCCM.

Topics in Video

• Review the SCCM docs and why a WSUS shared DB is usually a good idea – https://youtu.be/y7w7hBSHShc?t=42
• Review why wsyncmgr syncs are faster when using shared WSUS database – https://youtu.be/y7w7hBSHShc?t=93
• Review current labs primary SUP with SQL DB, and secondary SUP using WID – https://youtu.be/y7w7hBSHShc?t=175
• Enable Debug and Verbose logging to wsyncmgr.log and wcm.log – https://youtu.be/y7w7hBSHShc?t=293
• Review how the WSUS_Configuration_Manager tread reads all available SUPs at startup and how it determines if it’s using a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=419
• Review wsyncmgr.log for multiple SUPs in a non shared WSUS Database – https://youtu.be/y7w7hBSHShc?t=508
• Remove WID WSUS role service and add SQL WSUS role service – https://youtu.be/y7w7hBSHShc?t=686
• Configure SUP-2 to use SUP-1’s WSUSContent library folder for EULA/3rd-Party Update Content – https://youtu.be/y7w7hBSHShc?t=843
• Run WSUSUTIL.exe postinstall to change WSUS to use the shared SQL Database and Shared WSUSContent folder – https://youtu.be/y7w7hBSHShc?t=1005
• Resolve IIS misconfigurations after postinstall – https://youtu.be/y7w7hBSHShc?t=1215
  • Add “\\” to the beginning of Physical path in IIS Content virtual directly
  • Change Authentication for Anonymous Authentication to use WSUS Application Pool Identity instead of local IUSR account
• Start WSUS_Configuration_Manager and validate it updates SUP-2 configuration in the active SUP list to be a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1505
• Publish a third-party update to get a WSUS catalog change and run a SUP sync to review how the sync is now treated as a single SUP sync – https://youtu.be/y7w7hBSHShc?t=1637
• Setup shared WSUS database in a new clean WSUS installation on a new SUP rather than converting an existing SUP to a shared WSUS database – https://youtu.be/y7w7hBSHShc?t=1744

Commands and Notes:

• Powershell command to see WSUS installed role services: Get-WindowsFeature -Name UpdateServices*
• Powershell command to remove WSUS WidDB: Remove-WindowsFeature -Name UpdateServices-WidDB
• Powershell command to install WSUS SQL Database Connectivity: Install-WindowsFeature -Name UpdateServices-DB
• WsusUtil command: WsusUtil.exe postinstall SQL_INSTANCE_NAME=”SCUP.CONTOSO.LOCAL” CONTENT_DIR=”\\SCCM3-DPMPSUP-1.CONTOSO.LOCAL\WSUS”
  • SQL_INSTANCE_NAME and CONTENT_DIR should be changed to for your environment details

Helpful Resources:

• Great blog post version of using a shared WSUS Database – https://blogs.technet.microsoft.com/configurationmgr/2016/10/12/how-to-implement-a-shared-susdb-for-configuration-manager-software-update-points/
• Manually switch clients to a new software update point – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#BKMK_ManuallySwitchSUPs
• Use a shared WSUS database for software update points (Installation Best Practices) – https://docs.microsoft.com/en-us/sccm/sum/plan-design/software-updates-best-practices#bkmk_shared-susdb
• Managing WSUS from the Command Line – https://docs.microsoft.com/de-de/security-updates/windowsupdateservices/18127395

Overview

• In this video guide, we will be covering how to migrate WSUS Database (SUSDB) from Windows Internal Database instance to SQL Server instance.

Topics in Video

• Overview of WID limitation and why you want to move to SQL – https://youtu.be/Ms-5lzF9538?t=24
• Review WSUS configuration and how to validate if you are using WID for the SUSDB – https://youtu.be/Ms-5lzF9538?t=67
• Detach SUSDB from the WID instance – https://youtu.be/Ms-5lzF9538?t=187
• Copy WSUS database (SUSDB.mdf and SUSDB_log.ldf) from default WID install path and attach in SQL Instance – https://youtu.be/Ms-5lzF9538?t=355
• Run one-time re-indexing in SQL of the SUSDB since it likely was never done in the WID instance – https://youtu.be/Ms-5lzF9538?t=458
• Remove the WID Connectivity role service (UpdateServices-WidDB) – https://youtu.be/Ms-5lzF9538?t=603
• Install the SQL Server Connectivity role service (UpdateServices-DB) – https://youtu.be/Ms-5lzF9538?t=627
• Run WsusUtil postinstall command and reconfigure WSUS to use a SQL Server instead of WID – https://youtu.be/Ms-5lzF9538?t=658
• Validate WSUS console loads and shows the exact same data as before the move – https://youtu.be/Ms-5lzF9538?t=898
• Validate SCCM software update point sync works from WSUS – https://youtu.be/Ms-5lzF9538?t=908

Commands and Notes:

• Connect to WID instance in SQL Management Studio of sqlcmd (Server 2012 or Newer): \\.\pipe\MICROSOFT##WID\tsql\query
• Connect to WID instance in SQL Management Studio of sqlcmd (Server 2008 R2 or Older): \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query
• Powershell command to see WSUS installed role services: Get-WindowsFeature -Name UpdateServices*
• Powershell command to remove WSUS WidDB: Remove-WindowsFeature -Name UpdateServices-WidDB
• Powershell command to install WSUS SQL Database Connectivity: Install-WindowsFeature -Name UpdateServices-DB
• WsusUtil command: WsusUtil.exe postinstall SQL_INSTANCE_NAME=”SCUP.CONTOSO.LOCAL” CONTENT_DIR=”J:\WSUS”
  • SQL_INSTANCE_NAME and CONTENT_DIR should be changed to for your environment details

Helpful Resources:

• sqlcmd Utility – https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-2017
• Migrating the WSUS Database from WID to SQL – https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/manage/wid-to-sql-migration#migrating-the-wsus-database
• Re-index the WSUS 3.0 Database – https://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61

 

Overview

• In this video guide, we will be covering the way content is stored in distributed in Microsoft Configuration Manager. This video will go deep into how the content library on the site server works, the way content is distributed to remote DPs, how clients submit content location request, IIS, content troubleshooting and more!

Topics in Video

• Understanding the Content Library (PkgLib, DataLib, and FileLib) – https://youtu.be/A9K9_NPQL_o?t=99
• Review an applications deployment types and how the content binaries are stored in the DataLib and FileLib – https://youtu.be/A9K9_NPQL_o?t=228
• Review how content is distributed from the site servers content library to remote distribution points content library (distmgr.log and PkgXferMgr.log) – https://youtu.be/A9K9_NPQL_o?t=422
• Review boundaries and boundary groups and how that the corresponds to distribution points and client location request – https://youtu.be/A9K9_NPQL_o?t=594
• Review a content location request for an applications deployment type from a client and why it received content not found due to boundary and boundary group configurations – https://youtu.be/A9K9_NPQL_o?t=689
• Review how client location request for content come in from a management point perspective and how the management point runs a stored procedure against the database to see if the requested content is available based on the client boundary groups and distribution points the client is part of (MP_Location.log) – https://youtu.be/A9K9_NPQL_o?t=786
• Setting an applications deployment type to allow the download to fallback to the default site boundary group and any neighboring boundary groups – https://youtu.be/A9K9_NPQL_o?t=1046
• Review how the default-site-boundary-group and how other boundary group relationships work – https://youtu.be/A9K9_NPQL_o?t=1142
• Review how to allow software update group deployment to allow fallback to the default-site-boundary-group and neighboring boundary groups – https://youtu.be/A9K9_NPQL_o?t=1281
• Resolving the boundary to match the IP Range the client is located in and how a successful application deployment without fallback enabled would work – https://youtu.be/A9K9_NPQL_o?t=1442
• Copy content URL and review how IIS translates the content library files for client downloads – https://youtu.be/A9K9_NPQL_o?t=1599
• Review how to use content library explorer – https://youtu.be/A9K9_NPQL_o?t=1751

Helpful Resources:

• The content library in Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/the-content-library
• Inside the content library – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/the-content-library#inside-the-content-library
• Package library – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/the-content-library#package-library
• Data Library – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/the-content-library#data-library
• File Library – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/the-content-library#file-library
• Troubleshooting content distribution – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/the-content-library#troubleshooting
• Content Library Explorer – https://docs.microsoft.com/en-us/sccm/core/support/content-library-explorer
• Content Library Cleanup Tool – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/content-library-cleanup-tool
• Package Transfer Manager in System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/package-transfer-manager
• Learn how clients find site resources and services for System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/understand-how-clients-find-site-resources-and-services
• Content Library Transfer tool – https://docs.microsoft.com/en-us/sccm/core/support/content-library-transfer
• Flowchart – Manage content library – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/manage-content-library-flowchart
• Manage accounts to access content in System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/manage-accounts-to-access-content
• Content Ownership Tool – https://docs.microsoft.com/en-us/sccm/core/support/content-ownership-tool

 

Overview

• In this video guide, we will be doing a deep-dive into the application deployment process in SCCM from a client-side perspective. This video will cover the components involved on the SCCM client to evaluate, download, and install applications.

Topics in Video

• Review 7-Zip application with its two deployment types that we will deploy to the client – https://youtu.be/vnlMn_hEHGo?t=86
• Review client being used to install applications – https://youtu.be/vnlMn_hEHGo?t=170
• Force machine policy to see how the policy for the application deployment is processed – https://youtu.be/vnlMn_hEHGo?t=187
• Review PolicyAgent.log and Datatransferservice.log to see how the application deployment policy is downloaded – https://youtu.be/vnlMn_hEHGo?t=282
• Review where policy for the application deployment gets stored in WMI (ROOT\ccm\Policy\Machine\ActualConfig:CCM_ApplicationCIAssignment.AssignmentID=”{90D5A10E-12C4-4362-AF19-E391FD2964C4}”) using WMIExplorer.exe – https://youtu.be/vnlMn_hEHGo?t=369
• Review the ClientSDK that software center uses to pull application details from (ROOT\ccm\ClientSDK:CCM_Application.Id=”ScopeId_6541FA90-052F-476D-A7E7-C0F3B34EC1B8/Application_6a1d9353-9bca-4db6-927b-a4716de46596″) – https://youtu.be/vnlMn_hEHGo?t=464
• Review components involved in evaluating the application (Configuration Item) components involved include (DCMAgent.log, CIDownloader.log, CIStateStore.log, DataTransferService.log, CIAgentJob.log, AppIntentEval.log, CIAgent.log, CCMSDKProvider.log, SCNotify.log, SCToastNotification.log, and StateMessage.log – https://youtu.be/vnlMn_hEHGo?t=548
• Initiate installation of the application – https://youtu.be/vnlMn_hEHGo?t=987
• Review components involved in the application installation – https://youtu.be/vnlMn_hEHGo?t=1039
• Review the content location lookup request from the client for the applications deployment type needed – https://youtu.be/vnlMn_hEHGo?t=1168
• Review how AppEnfore.log actually performed the installation of the file used for the deployment type’s installation command – https://youtu.be/vnlMn_hEHGo?t=1504
• Review how the installed rule detection is performed once the installation command is completed – https://youtu.be/vnlMn_hEHGo?t=1609
• Review update instances for the application deployment in WMI after the installation – https://youtu.be/vnlMn_hEHGo?t=1670

Helpful Resources:

• Introduction to application management in Configuration Manager – https://docs.microsoft.com/en-us/sccm/apps/understand/introduction-to-application-management
• Application Deployment Types- https://docs.microsoft.com/en-us/sccm/apps/understand/introduction-to-application-management#deployment-type
• Create deployment types for the application – https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-applications#bkmk_create-dt
• Application requirement rules – https://docs.microsoft.com/en-us/sccm/apps/understand/introduction-to-application-management#requirements
• Deployment type content options – https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-applications#bkmk_dt-content
• Deployment type Detection Method options – https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-applications#bkmk_dt-detect
• Deploy applications with Configuration Manager – https://docs.microsoft.com/en-us/sccm/apps/deploy-use/deploy-applications
• Default application return codes – https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-applications#default-return-codes
• Supported deployment types – https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-applications#bkmk_deploy-types
• Create Windows applications in Configuration Manager – https://docs.microsoft.com/en-us/sccm/apps/get-started/creating-windows-applications
• What application types can you deploy? – https://docs.microsoft.com/en-us/sccm/apps/understand/introduction-to-application-management#what-application-types-can-you-deploy
• How applications use state-based reporting for compliance – https://docs.microsoft.com/en-us/sccm/apps/understand/introduction-to-application-management#state-based-applications
• Applications in Software Center – https://docs.microsoft.com/en-us/sccm/apps/understand/introduction-to-application-management#software-center
• Plan for and configure application management in Configuration Manager – https://docs.microsoft.com/en-us/sccm/apps/plan-design/plan-for-and-configure-application-management

Overview

• In this video guide, we will cover how you can use a code-signing certificate from an Active Directly Certificate Services infrastructure or using a public certificate authority such as DigiCert for signing third-party software updates in Microsoft System Center Configuration Manager (SCCM). Using a trusted PKI based code-signing certificate can be an alternative to using a self-signed certificate.

Topics in Video

• Create the code-signing certificate templates needed for the WSUS signing feature – https://youtu.be/lqapp8j7CHk?t=34
• Issuing the certificate template for deployment – https://youtu.be/lqapp8j7CHk?t=188
• How to request the cert from a machine – https://youtu.be/lqapp8j7CHk?t=206
• Exporting the requested certificate to a PFX file – https://youtu.be/lqapp8j7CHk?t=280
• Review the Configuration Manager 1806 option to allow ConfigMgr to manage the WSUS certificate – https://youtu.be/lqapp8j7CHk?t=327
• Importing PFX file to WSUS using the publishing service – https://youtu.be/lqapp8j7CHk?t=394
• Sync the SUP and review wsyncmgr.log to verify ConfigMgr received the imported code-signing PFX certificate- https://youtu.be/lqapp8j7CHk?t=460
• Add catalog and publish a third-party update to verify the .CAB file is signed using the PFX certificate – https://youtu.be/lqapp8j7CHk?t=536
• Switch to use a third-party code-signing certificate from DigiCert – https://youtu.be/lqapp8j7CHk?t=670
• Verify SCCM switches from using the code-signing certificate from AD CS to DigiCert’s code-signing certificate – https://youtu.be/lqapp8j7CHk?t=715

Helpful Resources:

• Publishing Service Download – https://patchmypc.com/publishing-service-setup-documentation
• System Center Updates Publisher Download – https://www.microsoft.com/en-us/download/details.aspx?id=55543
• Enable third-party updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates
• Automatically manage the WSUS signing certificate – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#automatically-manage-the-wsus-signing-certificate
• Manually manage the WSUS signing certificate – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#manually-manage-the-wsus-signing-certificate
• Manually manage the WSUS signing certificate – https://patchmypc.com/publishing-service-setup-documentation

 

Overview

In this video guide, we cover what’s actually happening on a client during OSD in Configuration Manager. This deep dive guide covers what is going on and how to troubleshoot different stages of an OSD task sequence failure on the client. This should be an excellent resource for seasoned ConfigMgr admin’s as well non-ConfigMgr admin’s who want to understand how to troubleshoot OSD errors in SCCM. Topic’s in this session include wpeinit.log, winpeshl.ini, SMSTS.LOG, DiskPartScript.txt, unattend.xml, DISM, SetupACT, NetSetup.LOG, AppEnforce.log, WUAHandler.log, UpdatesDeployment.log, CAS.log and many more components involved in OSD!

Topics in Video

• Review the Task Sequence being used for OSD – https://youtu.be/htkEBRxID4U?t=45
• Review custom pause task sequence step from Gary Blok – https://youtu.be/htkEBRxID4U?t=94
• Review step to copy CMTrace.exe from WinPE to Full OS – https://youtu.be/htkEBRxID4U?t=208
• PXE boot client and review SMSPXE.log – https://youtu.be/htkEBRxID4U?t=292
• Review the wpeinit.log for WinPE initiation – https://youtu.be/htkEBRxID4U?t=353
• Review winpeshl.ini and how the task sequence launches in WinPE – https://youtu.be/htkEBRxID4U?t=433
• Review X: drive and how WinPE Loads into memory – https://youtu.be/htkEBRxID4U?t=448
• Review %temp%\SMSTSLog\smsts.log and initial policy download – https://youtu.be/htkEBRxID4U?t=490
• Start the task sequence on the client – https://youtu.be/htkEBRxID4U?t=574
• Review how the task sequence generates X:\WINDOWS\TEMP\DiskPartScript.txt – https://youtu.be/htkEBRxID4U?t=640
• Review Apply Operating System step – https://youtu.be/htkEBRxID4U?t=736
• Review C:\Windows\panther\unattend\unattend.xml file – https://youtu.be/htkEBRxID4U?t=825
• Review unattend.xml after the Apply Windows Settings Step – https://youtu.be/htkEBRxID4U?t=862
• Review unattend.xml after the Apply Network Settings Step – https://youtu.be/htkEBRxID4U?t=929
• Review how DISM injects driver packages offline – https://youtu.be/htkEBRxID4U?t=1018
• Review Setup Windows and Configuration Manager Step – https://youtu.be/htkEBRxID4U?t=1113
• Delete C:\windows\Setup\scripts\DisableCMDRequest.TAG to enable “Shift+F10” command line support in OOBE – https://youtu.be/htkEBRxID4U?t=1128
• Review the C:\windows\Setup\scripts\SetupComplete.cmd used to re-launch the task sequence after OOBE – https://youtu.be/htkEBRxID4U?t=1207
• Open CMD in OOBE with “Shift+F10” and review the C:\Windows\Panther\SetupACT.log – https://youtu.be/htkEBRxID4U?t=1236
• Review the SMSTS.log and CCMSetup.log for the Setup Windows and Configuration Manager step in the full OS – https://youtu.be/htkEBRxID4U?t=1312
• Review Install Application step – https://youtu.be/htkEBRxID4U?t=1415
• Review C:\Windows\debug\NetSetup.LOG for domain join log file and troubleshooting domain join – https://youtu.be/htkEBRxID4U?t=1478
• Review application install logs SMSTS.log, AppEnforce.log, CAS.log, AppDiscovery.log, DataTransferService.log – https://youtu.be/htkEBRxID4U?t=1540
• Review Package Install logs SMSTS.log, ExecMgr.log, CAS.log, DataTransferService.log, ClientLocation.log – https://youtu.be/htkEBRxID4U?t=1716
• Review Install Updates step of task sequence – https://youtu.be/htkEBRxID4U?t=1764
• Troubleshooting Software Updates in OSD using logs WUAHandler.log, UpdatesHandler.log, ScanAgent, UpdatesDeployment.log, DataTransferService.log, CAS.log – https://youtu.be/htkEBRxID4U?t=1795
• OSD Imaging Complete and Wrapping Up – https://youtu.be/htkEBRxID4U?t=2100

Helpful Resources:

• Patch My PC Third-Party Update Catalog – https://patchmypc.net/third-party-patch-management-sccm-scup-catalog
• Install a new version of Windows on a new computer (bare metal) with System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/osd/deploy-use/install-new-windows-version-new-computer-bare-metal
• Prepare a boot image – https://docs.microsoft.com/en-us/sccm/osd/deploy-use/install-new-windows-version-new-computer-bare-metal#BKMK_Configure
• Use PXE to deploy Windows over the network with Configuration Manager – https://docs.microsoft.com/en-us/sccm/osd/deploy-use/use-pxe-to-deploy-windows-over-the-network
• Deploy the task sequence – https://docs.microsoft.com/en-us/sccm/osd/deploy-use/use-pxe-to-deploy-windows-over-the-network#BKMK_Deploy
• Manage operating system images with System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/osd/get-started/manage-operating-system-images
• Manage drivers in System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/osd/get-started/manage-drivers
• Create a task sequence to install an operating system in System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/osd/deploy-use/create-a-task-sequence-to-install-an-operating-system
• Example task sequence to install an existing operating system image – https://docs.microsoft.com/en-us/sccm/osd/deploy-use/create-a-task-sequence-to-install-an-operating-system#BKMK_InstallExistingOSImageTSExample
• Monitor operating system deployments in System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/osd/deploy-use/monitor-operating-system-deployments

Overview In this video guide, we will walk through the process of enabling third-party software updates in the SCCM technical preview 1806. Topics in Video

• Review code-signing HTTPS WSUS requirements – https://youtu.be/dCj4P2PdDNg?t=39
• Enable third-party Updates in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=79
• Enable HP Catalog – https://youtu.be/dCj4P2PdDNg?t=173
• Force Sync of HP Catalog – https://youtu.be/dCj4P2PdDNg?t=246
• Enable HP Vendor and Products in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=417
• Download Published Update in SCCM Console – https://youtu.be/dCj4P2PdDNg?t=605
• Configure Third-Party Updates with SUP in HTTP Mode – https://youtu.be/dCj4P2PdDNg?t=720
• Generate WSUS Self-Signed Cert Using Patch My PC Publishing Service – https://youtu.be/dCj4P2PdDNg?t=761
• Import Patch My PC Update Catalog in the Catalog in SCCM – https://youtu.be/dCj4P2PdDNg?t=840

Resources for This Guide:

• Download Patch My PC Publishing Service to Generate Self-Signed Certificate – https://patchmypc.net/publishing-service-setup-documentation
• Setup Guide for Exporting Code-Signing Cert and Deploying to Client – https://patchmypc.net/publishing-service-setup-documentation

 

Overview

• In this video, we will cover how to set up our free software update compliance dashboard reports for Microsoft System Center Configuration Manager (SCCM). Learn more about the reports and download the installer from https://patchmypc.net/reports

Topics in Video

• Gary Simmons blog with guides of software update report creation for Microsoft SCCM
• Download the MSI to install the software update reports: https://youtu.be/b2V6dDJazwY?t=32
• Install the publishing service: https://youtu.be/b2V6dDJazwY?t=64
• Install the reporting dashboard: https://youtu.be/b2V6dDJazwY?t=74
• Review the available dashboard reports: https://youtu.be/b2V6dDJazwY?t=178

 

Overview

• In this video guide, we will be performing a deep dive in the software updates feature in Microsoft SCCM. This will include client and server-side components. Some topics covered are client policy, scanning, WMI, StateMessages, StateMgr, Summarization and more!

Topics in Video

• Start the Client Used to Run Updates Against – https://youtu.be/_tz2rTARzvw?t=92
• Force Client Policy and Review Download of Policy and Deployment in WMI – https://youtu.be/_tz2rTARzvw?t=166
• Initiate an Evaluate Software Updates Deployment – https://youtu.be/_tz2rTARzvw?t=369
• Review Client Scanning of Updates – https://youtu.be/_tz2rTARzvw?t=460
• Review Update Compliance for Targeted Updates in the Scan – https://youtu.be/_tz2rTARzvw?t=506
• Review Software Updates Classes in WMI – https://youtu.be/_tz2rTARzvw?t=559
• Review the StateMessages on the Client and How It Sends to MP – https://youtu.be/_tz2rTARzvw?t=723
• Show the State Message XML on the Site Server – https://youtu.be/_tz2rTARzvw?t=776
• Show Software Update Summarization – https://youtu.be/_tz2rTARzvw?t=1060
• Review Software Update Content Request  – https://youtu.be/_tz2rTARzvw?t=1299
• Review Software Update Installation Components – https://youtu.be/_tz2rTARzvw?t=1371

Notes From Justin

• Helpful Logs for Software Updates
  • PolicyAgent.log – Records requests for policies made by using the Data Transfer Service.
  • PolicyEvaluator.log – Records details about the evaluation of policies on client computers, including policies from software updates.
  • LocationServices.log – Records the client activity for locating management points, software update points, and distribution points.
  • UpdatesHandler.log – Records details about software update compliance scanning and about the download and installation of software updates on the client.
  • RebootCoordinator.log – Records details about the coordination of system restarts on client computers after software update installations.
  • WUAHandler.log – Records details about the Windows Update Agent on the client when it searches for software updates.
  • UpdatesStore.log – Records details about compliance status for the software updates that were assessed during the compliance scan cycle.
  • ScanAgent.log – Records details about scan requests for software updates, the WSUS location, and related actions.
  • StateMessage.log – Records details about software update state messages that are created and sent to the management point.
  • UpdatesDeployment.log – Records details about deployments on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.
  • statesys.log – Records the processing of state system messages. This log also shows the software update summarization task that run.
• Helpful WMI Namespace and Classes
  • ROOT\ccm\Policy\Machine\ActualConfig:CCM_UpdateCIAssignment – This shows that we have the policy for the SUG Deployment ID
  • ROOT\ccm\ScanAgent:CCM_SUPLocationList – Shows SUP SCCM is set to use for scanning
  • ROOT\ccm\SoftwareUpdates\DeploymentAgent:CCM_TargetedUpdateEx1 – Shows all software updates targetting the device and the relevant information about the updates
  • ROOT\ccm\SoftwareUpdates\DeploymentAgent:CCM_AssignmentCompliance – Shows the different software update group deployments targetting the device and their compliance
  • ROOT\ccm\StateMsg:CCM_StateMsg – Shows all the state messages logged in WMI
• Windows Update Log File PowerShell CMDlet
  • get-windowsupdatelog

Helpful Resources:

• Software Updates Log Files in SCCM – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/log-files#BKMK_SU_NAPLog
• Windows Update Agent Log – https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/log-files#BKMK_WULog
• WMIExplorer Download – https://git.io/wmie2
• Scan for software updates compliance process – https://docs.microsoft.com/en-us/sccm/sum/understand/software-updates-introduction#scan-for-software-updates-compliance-process
• Software update deployment process – https://docs.microsoft.com/en-us/sccm/sum/understand/software-updates-introduction#BKMK_DeploymentProcess
• Capacity planning recommendations for software updates – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#capacity-planning-recommendations-for-software-updates
• Restart options for Windows 10 clients after software update installation – https://docs.microsoft.com/en-us/sccm/sum/plan-design/plan-for-software-updates#BKMK_RestartOptions

 * Updates * 

• Do NOT remove the “all” in the language script (Decline-Windows10Languages.ps1) as I did in the video at 25:14. This change is not required or recommended.
• It’s recommended to first run the script with the -Whatif switch or option in the config.ini to see what will be declined.
• Update: in the latest script, you can use a config.ini file rather than a bunch of PowerShell parameters. Here’s the config.ini I’m now using instead of parameters.
  • Here’s what the updated script folder structure looks like
    • 

 

 

 

Overview

In this video guide, we will walk through the process of maintaining our WSUS catalog to reduce the catalog size and client scanning issues. In this guide, we will cover ensuring the IIS AppPool for WSUS is improved, indexing the SUSDB, setting up a task to run a script to automatically decline any superseded updates, change the wsyncmgr purge of expired updates from 7 days to 0. and compare the initial catalog download size on a client.

There’s a lot of good WSUS maintenance scripts out there now. In my video, I used Bryan Dam’s script. See the resources below for a lot of great information that will be helpful in addition to what I cover.

Creating a Scheduled Task to Automate the Declining of Updates

• Scheduled Task Options for Bryan Dam’s WSUS Scripts
  • Program: powershell.exe
  • Argument: -NoLogo -NoProfile -NonInteractive -ExecutionPolicy ByPass -command <PATH>\Invoke-DGASoftwareUpdateMaintenance.ps1
  • Download config.ini that I am now using in the updated release of the script

Topics in Video

• Review SUP Products that are Enabled – https://youtu.be/wqBaTp855sk?t=117
• Review WSUS Catalog for Un-Maintained WSUS Catalog – https://youtu.be/wqBaTp855sk?t=171
• Review All Software Updates in SCCM Console – https://youtu.be/wqBaTp855sk?t=295
• Perform Update Scan on Client to Un-Maintained WSUS Catalog – https://youtu.be/wqBaTp855sk?t=343
• Review Catalog Download Size on Client (13.5MB) – https://youtu.be/wqBaTp855sk?t=567
• Optimize WSUS IIS AppPool Settings – https://youtu.be/wqBaTp855sk?t=730
• Indexing SUSDB – https://youtu.be/wqBaTp855sk?t=797
• Creating the two WSUS SUSDB Indexes to Improve Speed when Declining Updates – https://youtu.be/wqBaTp855sk?t=881
• Adding Scheduled Task for Declining Updates to Run Bryan Dam’s Script – https://youtu.be/wqBaTp855sk?t=946
• Changing wsyncmgr Expired Purge Time From 7 days to 0 Days  – https://youtu.be/wqBaTp855sk?t=1765
• Perform Update Scan on Client to Maintained WSUS Catalog (2MB) – https://youtu.be/wqBaTp855sk?t=1896

Resources for This Guide:

• The complete guide to Microsoft WSUS and Configuration Manager SUP maintenance – https://blogs.technet.microsoft.com/configurationmgr/2016/01/26/the-complete-guide-to-microsoft-wsus-and-configuration-manager-sup-maintenance/
• Bryan Dam’s Script | Software Update Maintenance Script Updated: All the WSUSness – https://damgoodadmin.com/2018/04/17/software-update-maintenance-script-updated-all-the-wsusness/
• Johan Arwidmark | Fixing WSUS – When the Best Defense is a Good Offense | This post links out to many additional posts about WSUS optimization – https://deploymentresearch.com/Research/Post/665/Fixing-WSUS-When-the-Best-Defense-is-a-Good-Offense
• Enhancing WSUS database cleanup performance SQL script – https://stevethompsonmvp.wordpress.com/2018/05/01/enhancing-wsus-database-cleanup-performance-sql-script/
• WSUS Reindex SUSDB Script – https://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61
• Script to Change wsyncmgr Purge of Expired Updates From 7 Days to 0 Days – https://setupconfigmgr.com/wp-content/uploads/2018/06/Adjust-WSync_UpdateCleanupAge.zip

Overview

• In this video guide, we will review how line-of-business (LOB) and Win32 applications get installed through Microsoft Intune. We will be covering what logs are used and where application installation information is stored in the registry.

Topics in Video

• Please see youtube: https://www.youtube.com/watch?v=RxjTYNd8gEk 

Helpful Resources

• Add a Windows line-of-business app to Microsoft Intune – https://docs.microsoft.com/en-us/mem/intune/apps/lob-apps-windows
• Intune Standalone – Win32 app management – https://docs.microsoft.com/en-us/mem/intune/apps/apps-win32-app-management 

 

Overview

• In this video guide, we will be covering how to setup Co-management in Microsoft SCCM. Co-management will allow you to use the full Configuration Manager client as well as the Microsoft Intune MDM.

Topics in Video

• Overview of Co-management in SCCM and Microsoft Intune – https://youtu.be/rTapalSHv6U?t=21
• The first scenario overview, using Azure AD Join Only (Cloud Domain Join) –  https://youtu.be/rTapalSHv6U?t=62
• The second scenario overview, using On-Prem domain join and auto-register in Azure Hybrid AD and MDM – https://youtu.be/rTapalSHv6U?t=86
• Validate Azure AD and Intune enrollment is enabled in the online portal – https://youtu.be/rTapalSHv6U?t=113
• Covering CMG prerequisites for the option to Install the SCCM Agent from an Azure AD only scenario – https://youtu.be/rTapalSHv6U?t=252
• Add the co-management subscription into the SCCM console – https://youtu.be/rTapalSHv6U?t=358
• Uploading the CCMSetup.msi to auto-deploy through Intune to install the SCCM agent through CMG – https://youtu.be/rTapalSHv6U?t=496
• Enroll a device into Azure AD from OOBE to have it auto-enroll into MDM/Intune – https://youtu.be/rTapalSHv6U?t=676
• Validate the device enrolled in MDM and the SCCM Client auto started and review the CCMSetup download from CMG over the internet – https://youtu.be/rTapalSHv6U?t=758
• Review ClientIDStartupManager to review how the Azure AD Authentication is used to be approved within the SCCM environment – https://youtu.be/rTapalSHv6U?t=871
• Validate in the Configuration Manager Control Panel applet the co-management is showing enabled – https://youtu.be/rTapalSHv6U?t=947
• Review the scenario for registering on-prem domain joined devices to register into Hybrid Azure AD and auto-MDM enroll in Intune – https://youtu.be/rTapalSHv6U?t=1043
• Install Azure AD Connect and Configure the OU for the user/device sync we need for the lab – https://youtu.be/rTapalSHv6U?t=1093
• Validate a valid public UPN suffix is configured in Active Directory Domain and Trust and configure the on-prem users that will be used to auto-enroll devices with the public UPN in AD Users and Computers – https://youtu.be/rTapalSHv6U?t=1171
• Set GPO to have devices auto-enroll into MDM/Intune when the device registered into Azure AD- https://youtu.be/rTapalSHv6U?t=1568
• Run dsregcmd /status to see if the device is registered with Azure AD – https://youtu.be/rTapalSHv6U?t=1687
• Configure devices to auto Azure Hybrid AD Join in Azure AD Connect – https://youtu.be/rTapalSHv6U?t=1731
• Validate on-prem domain joined SCCM client switched to be co-managed after auto-enrolling into Intune – https://youtu.be/rTapalSHv6U?t=1928
• Validate both devices are showing in Intune and the SCCM console with co-management capabilities – https://youtu.be/rTapalSHv6U?t=1997
• Deploy device reset to both co-managed devices – https://youtu.be/rTapalSHv6U?t=2099

Helpful Resources:

• Tutorial: Configure hybrid Azure Active Directory join for managed domains – https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains
• Enable Windows 10 automatic MDM enrollment – https://docs.microsoft.com/en-us/intune/windows-enroll#enable-windows-10-automatic-enrollment
• Co-management for Windows 10 devices – https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-overview
• Enroll a Windows 10 device automatically using Group Policy – https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy
• Prerequisites for co-management – https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-prepare#prerequisites
• Auto-Pilot for new Windows 10 Devices – https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-prepare#new-windows-10-devices

Overview

• In this video guide, we will be covering how to configure site server high availability in Microsoft System Center Configuration Manager Current Branch. We will cover the prerequisites to install a passive site server, how to perform the installation, and how to fail over to the passive server.

Topics in Video

• Review Basic’s of the Site Server and what actions it performs and impacts of it being down – https://youtu.be/PsHsBseqkD0?t=27
• Basic’s of High Availability of the Site Server – https://youtu.be/PsHsBseqkD0?t=134
• Review the lab setup and the current site server and site systems in the environment – https://youtu.be/PsHsBseqkD0?t=267
• Add the computer account of the new Passive site server to the Site Servers AD Security Group so it has permissions to the Systems Management container – https://youtu.be/PsHsBseqkD0?t=430
• Add the Computer Account or Security Group of the new passive site server to the Local Admins on the SQL Server and SysAdmin rights to the SQL Instance – https://youtu.be/PsHsBseqkD0?t=518
• Install .NET 3.5 SP1 on the new passive site server – https://youtu.be/PsHsBseqkD0?t=669
• Install WSUS (API’s) on the new passive site server – https://youtu.be/PsHsBseqkD0?t=728
  • Install-WindowsFeature -Name UpdateServices-API
  • Get-WindowsFeature -Name UpdateServices*
• Install Remote Differential Compression role – https://youtu.be/PsHsBseqkD0?t=815
  • Install-WindowsFeature RDC
• Install the Windows 10 ADK (WinPE, Deployment Tools, and USMT) – https://youtu.be/PsHsBseqkD0?t=860
• Add Site Servers AD Security Group that contains Site Server Computer Accounts to Local Administrators on the new passive site server – https://youtu.be/PsHsBseqkD0?t=933
• Move ContentLibrary from a local path on the active site server to a remote network share – https://youtu.be/PsHsBseqkD0?t=1009
• Go through the wizard in the console to add a new “Site System Server” and choose the “Site server in passive mode” – https://youtu.be/PsHsBseqkD0?t=1309
• Review the site server prerequisites check in the “Site Server Status” node in the console – https://youtu.be/PsHsBseqkD0?t=1450
• Review C:\ConfigMgrSetup.log on new passive site server once core setup is started – https://youtu.be/PsHsBseqkD0?t=1654
• After core setup is complete review sitecomp.log on passive site server to see components under SMS_EXECUTIVE getting registered – https://youtu.be/PsHsBseqkD0?t=1688
• Installing the SMS_Provider on the new passive site server so the console could still connect is the active site server goes down – https://youtu.be/PsHsBseqkD0?t=1778
• Review process to promote site server in passive mode to active mode – https://youtu.be/PsHsBseqkD0?t=2053

Helpful Resources:

• Site Server Failure Impacts – https://docs.microsoft.com/en-us/sccm/core/servers/manage/site-failure-impacts#site-server
• High availability options for Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/high-availability-options
• High Availability Prerequisites – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/site-server-high-availability#prerequisites
• High Availability Limitations – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/site-server-high-availability#limitations
• High Availability Site server promotion – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/site-server-high-availability#site-server-promotion
• High availability for sites and hierarchies – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/high-availability-options#bkmk_snh
• Use a site server in passive mode – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/high-availability-options#use-a-site-server-in-passive-mode
• Site server high availability in Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/site-server-high-availability
• What’s new in 1810 – Hierarchy support for site server high availability – https://docs.microsoft.com/en-us/sccm/core/plan-design/changes/whats-new-in-version-1810#hierarchy-support-for-site-server-high-availability
• Prepare to use SQL Server Always On availability groups with Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/sql-server-alwayson-for-a-highly-available-site-database
• Configure SQL Server Always On availability groups for Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/configure-aoag
• Use a SQL Server cluster for the System Center Configuration Manager site database – https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/use-a-sql-server-cluster-for-the-site-database
• SQL AlwaysOn High Availability step by step Part 1 | External YouTube Guide – https://www.youtube.com/watch?v=XR1S3feedzU

Overview

• In this video guide, we will be reviewing how to use CMPivot in SCCM to query entities in real-time and take action on results using the Scripts feature in SCCM. CMPivot is a new in-console utility that now provides access to real-time state of devices in your environment. It immediately runs a query on all currently connected devices in the target collection and returns the results. Then filter and group this data in the tool. By providing real-time data from online clients, you can more quickly answer business questions, troubleshoot issues, and respond to security incidents. (From MS Docs)

Topics in Video

• A quick overview of CMPivot – https://youtu.be/bnZlapKHIh8?t=95
• CMPivot operators in Kusto – https://youtu.be/bnZlapKHIh8?t=219
• Running CMPivot against a collection – https://youtu.be/bnZlapKHIh8?t=253
• Query InstalledSoftware, Filter to Google Chrome, Add version filter, list in piechart – https://youtu.be/bnZlapKHIh8?t=353
• Query local Administrators – https://youtu.be/bnZlapKHIh8?t=649
• Query 32-bit operating systems – https://youtu.be/bnZlapKHIh8?t=714
• Query running process – https://youtu.be/bnZlapKHIh8?t=786
• Query where SMB1 is enabled – https://youtu.be/bnZlapKHIh8?t=813
• Query AutoStartSoftware where it’s from the user registry, and a specific startup process name – https://youtu.be/bnZlapKHIh8?t=878
• Review pre-built scripts we will use to take action on CMPivot results – https://youtu.be/bnZlapKHIh8?t=966
• Use CMPivot registry query to find where the EnableJavaUpdate registry value = 1 then use a Script to set the EnableJavaUpdate value to 0 – https://youtu.be/bnZlapKHIh8?t=988
• Review the process flow for CMPivot queries and scripts (BgbServer > CcmNotificationAgent > Scripts > StateMessage > statesys) – https://youtu.be/bnZlapKHIh8?t=1150
• Query where the Google Homepage RegValue != to an expected homepage value and use a script to set the Google Homepage to the expected value – https://youtu.be/bnZlapKHIh8?t=1343
• Query all Java 8 Installations, exclude (64-bit) Java 8 installations, run scripts to uninstall all Java 8 (32-bit installations) – https://youtu.be/bnZlapKHIh8?t=1784

Helpful Resources:

• CMPivot for real-time data in Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/servers/manage/cmpivot
• Kusto Query Language – https://docs.microsoft.com/en-us/azure/kusto/query/
• Troubleshooting CMPivot – https://docs.microsoft.com/en-us/sccm/core/servers/manage/cmpivot-tsg
• Create and run PowerShell scripts from the Configuration Manager console – https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-deploy-scripts
• CMPivot operators – https://docs.microsoft.com/en-us/sccm/core/servers/manage/cmpivot#bkmk_cmpivot-operators
• CMPivot and PowerShell Resource Files – CMPivot Resource Files

 

Overview

• This guide covers considerations for third-party software updates in Configuration Manager when using a remote software update point (SUP) that is not configured for SSL.

Topics in Video

• Intro: (0:00​)
• Review remote site system running SUP in HTTP mode: (1:30​)
• Enable third-party updates and Configuration Manager managed the certificate: (2:15​)
• wsyncmgr.log error Warning: Remote WSUS connection is not HTTPS. This prevents software update point from getting the signing certificate for third-party updates.: (2:50​)
• Review the SMS_ISVUPDATES_SYNCAGENT.log: (3:45​)
• Stage the content for selected categories automatically: (6:00​)
• SMS_ISVUPDATES_SYNCAGENT.log syncing catalog: (7:15​)
• SMS_ISVUPDATES_SYNCAGENT.log: error NO_SIGNING_CERT: (8:00​)
• Create a WSUS Signing Certificate using Patch My PC’s Publisher: (11:00​)
• Export and Deploy WSUS Signing Certificate using a GPO: (14:15​)

Helpful Resources:

• What is the WSUS Signing Certificate and How to Create It – https://patchmypc.com/wsus-signing-certificate-options-for-third-party-updates-in-configuration-manager
• Download Publisher – https://patchmypc.com/docs
• How to Deploy the WSUS Signing Certificate for Third-Party Software Updates – https://patchmypc.com/how-to-deploy-the-wsus-signing-certificate-for-third-party-software-updates

Overview

Here’s a playback of the community session with the Patch My PC team about Cloud Management Gateway in Configuration Manager. In this session, we cover common configurations and possible issues with CMG including:

– CMG server authentication certificate
– CMG trusted root certificate to clients
– Server authentication certificate issued by public provider
– Server authentication certificate issued from enterprise PKI
– Client authentication certificate
– Client trusted root certificate to CMG
– CRL checking
– Q&A