Log In
Or create an account ->
Imperial Library
Home
About
News
Upload
Forum
Help
Login/SignUp
Index
Title Page
Copyright Page
Contents at a Glance
Table of Contents
About This E-Book
About the Author
About the Contributing Authors
Dedication
Acknowledgments
Foreword
Reader Services
Introduction
Part I: Configuration Manager Overview and Concepts
Part II: Planning and Installation
Part III: Configuration Manager Operations
Part IV: Configuration Manager Administration
Part V: Appendixes
Lab Environment
Disclaimers and Fine Print
Part I Configuration Manager Overview and Concepts
1 Configuration Management Basics
10 Reasons to Use Configuration Manager
The Evolution of Systems Management
Hurdles in the Distributed Enterprise
Automation Challenges
Configuration “Shift and Drift”
Lack of Security and Control
Timeliness of Asset Data
Lack of Automation and Enforcement
Proliferation of Cloud Computing
Lack of Process Consistency
The Bottom Line
Systems Management Defined
Microsoft’s Strategy for Systems Management
Microsoft’s Dynamic Systems Initiative (DSI)
ITIL and MOF
Judging Your IT Organization’s Maturity
Bridging the Systems Management Gap
The Value Proposition of Configuration Manager
Summary
2 Configuration Manager Overview
A Journey Through Time: SMS to ConfigMgr Current Branch
Systems Management Server 1.x
Systems Management Server 2.0
Systems Management Server 2003
System Center Configuration Manager 2007
System Center 2012 and 2012 R2 Configuration Manager
Configuration Manager Terminology
Configuration Manager Site
Site Hierarchy
Central Administration Site
Primary Site
Secondary Site
Site Systems
Senders
Managing Content (File) Replication
Discovering Resources
Configuration Manager Agent
Configuration Manager Console
Collections for Targeting Users and Devices
Querying Client Data
Using Alerts to Respond to Problems Quickly
Using Packages
Managing Applications
Content Management
Software Update Management
Compliance Settings
Content Transfer via BITS
Measuring Software Usage
Using BranchCache and Peer Cache to Reduce WAN Consumption
Reporting
What’s New in Current Branch (Through the 1710 Release)
What’s New in Baseline Version 1511
What’s New in Version 1602
What’s New in Version 1606
What’s New in Version 1610
What’s New in Baseline Version 1702
What’s New in Baseline Version 1706
What’s New in Version 1710
Deprecated Features, Software, and Operating Systems
Summary
3 Looking Inside Configuration Manager
Understanding the ConfigMgr Architecture
External Components to ConfigMgr
ConfigMgr Communication Methods
ConfigMgr’s Internal Components
A WMI Primer
Understanding the WMI Architecture
Inside the WMI Object Model
Managing WMI
Configuration Manager and WMI
WMI on Configuration Manager Servers
The Configuration Manager Client WMI Namespace
Obtaining Hardware Inventory Through WMI
Automating the ConfigMgr Client via WMI
Interaction Between WMI and PowerShell
Inside the ConfigMgr Database
ConfigMgr Tables and Views
Using SQL Server Management Studio
Exploring the ConfigMgr Database
Status and State Messages Overview
Using Status Messages
How State Messages Work
Site-to-Site Replication
About Configuration Manager Database Replication
About Content Replication
Active Directory Integration with ConfigMgr
Implementing Schema Extensions
Tools for Extending a Schema
Extending a Schema
Summary
Part II Planning and Installation
4 Architecture Design Planning
Developing the Solution Architecture
Discovering Business Requirements
Discovering IT Requirements
Assessing Your Environment
Envisioning the Solution and Scope of Delivery
Planning for Infrastructure Dependencies
ADDS Considerations
Active Directory Certificate Services Considerations
Hierarchy Planning in ConfigMgr
About Configuration Manager Sites
Planning Your Hierarchy Structure
Planning Boundaries and Boundary Groups
Site Planning for Configuration Manager
Site Servers and Site Systems Planning
Capacity Planning for ConfigMgr Sites
Meeting Availability Requirements
Planning for Content Management
Planning for Client Deployment and Settings
Planning Client Discovery and Installation
Planning Your Client Settings
Defining the User Experience
Planning for External Device Management
Planning for Internet-Based Clients
Planning for Mobile Device Management
Planning for Continuous Updates
Servicing and Updates in Current Branch
Testing and Release Management of Current Branch Releases
Planning for Restorability and Recoverability
Availability, Restorability, and Recoverability
Determining Your Recovery Time and Point Objectives
Planning for Backup
Summary
5 Network Design
Configuration Manager and the Network
Network Considerations for Server Placement
Using Distribution Points and Secondary Sites
Understanding Data Flows
Communication Going to the Client
Communication from the Client
Designing Intrasite Communication
Understanding SQL Server Communication
Using RPC Communication
Using SMB Communication
Using External Communication
Using Intersite Communication
File-Based Replication in ConfigMgr
Using SQL Server–Based Replication
Designing Client Communication
Using the Service Location
About Background Intelligent Transfer Service
BITS Versions for ConfigMgr Clients
Understanding BranchCache
Understanding Peer Cache
Using Boundaries and Boundary Groups
About Client Communication Security
Troubleshooting Network-Related Issues
Troubleshooting Basic Network Connectivity
Testing DNS Resolution
Troubleshooting Routers and Firewall Ports
Congested or Slow Network Links
Testing MPs and DPs
Troubleshooting Service Principal Names
Summary
6 Installing and Updating System Center Configuration Manager
Performing Preinstallation Tasks
Required Windows and Hardware Components
SQL Server Requirements
Active Directory Requirements
Windows Server Update Services
Using the Prerequisite Checker
Using the Prerequisite Files Downloader Tool
Performing Site Installation Tasks
Installing a Central Administration Site
Installing a Primary Site
Installing a Secondary Site
Installation Validation
Configuring Site Properties
Initial ConfigMgr Configurations
Connecting ConfigMgr to Cloud Services
Installing Optional Site Systems
Troubleshooting Site Installation
Updating Configuration Manager
Scheduling Updates
Using CD.Latest
Summary
7 Upgrading and Migrating to ConfigMgr Current Branch
Deciding Whether to Upgrade or Migrate to Current Branch
Upgrading to ConfigMgr Current Branch
Preparing for Upgrade
Performing the Upgrade
Migrating to ConfigMgr Current Branch
Migration, Not an Upgrade
Planning the Migration
Performing Pre-Migration Activities
Coexistence Considerations
Performing the Migration
Configuring the Active Source Site
Configuring Child Sites for Data Gathering (ConfigMgr 2007 Only)
Performing Migration Jobs
Migrating Reports and Clients
Migrating Reports
Migrating Custom Reports
Client Migration and Methods
Troubleshooting Migration Issues
Summary
Part III Configuration Manager Operations
8 Using the Configuration Manager Console
Touring the Console
Configuration Manager Console Panes
Configuration Manager Console Bars
Using the Backstage
Configuration Manager Workspaces
Using Assets and Compliance
Functions of the Software Library
Capabilities of the Monitoring Workspace
Managing ConfigMgr Through the Administration Workspace
Deploying the Console
Console Placement
Supported Platforms
Installation Prerequisites
Installation Using the Configuration Manager Setup Wizard
Unattended Console Installation
Using Role-Based Administration
How Content Is Displayed
The Three States of Objects Interaction
Connecting to a Site
Personalizing the Console
The In-Console Alert Experience
Viewing Alerts
Managing Alerts
Configuring Alerts
Subscribing to Alerts
Configuration Manager Service Manager
Initiating the Configuration Manager Service Manager Console
Operating the Configuration Manager Service Manager Console
Using PowerShell with ConfigMgr
Security Considerations
SMS Provider Permissions
DCOM Permissions
WMI Permissions
Troubleshooting Console Issues
Console Logging
Connectivity Issues
Common Problems
Summary
9 Client Management
ConfigMgr Client Agent Requirements
Agent Hardware Dependencies
Supported Operating Systems for the Client Agent
Agent Software Dependencies
Other Agent Dependencies
Installing, Upgrading, and Uninstalling ConfigMgr Client Agents
Manually Installing on Windows Computers
Manually Installing on Mac Computers
Manually Installing on UNIX and Linux Computers
Using Logon Scripts to Install on Windows Devices
Installing Using Group Policy for Windows Devices
Installing Using Software Update Point (SUP) for Windows Devices
Installing and Assigning Windows 10 Clients Using Azure AD for Authentication
Approving Clients
Pushing the Client
Automatically Upgrading the Client on Windows
Uninstalling the ConfigMgr Client Agent
Finding Potential ConfigMgr Clients in Your Network
Using Active Directory Forest Discovery
Using Active Directory Group Discovery
Using Active Directory User Discovery
Using Active Directory System Discovery
Using Heartbeat Discovery
Using Network Discovery
Manually Importing Clients into ConfigMgr
Using Azure AD User Discovery
What to Know About Client Agent Assignment
Monitoring Client Agent Health and Activity Status
Understanding Client Settings
Client Settings Priority
Configurable Client Settings
Using Remote Control
Using the Resource Explorer
Using Wake on LAN and Power Management
Using Wake on LAN
Configuring Power Management
Summary
10 Managing Compliance
Configuring Compliance Settings
Understanding Compliance Settings
Using Configuration Items
Using Configuration Baselines
Using User Data and Profiles
Using Remote Connection Profiles
Creating Configuration Items
Devices with a ConfigMgr Client
Using Devices Without a ConfigMgr Client
Creating Baselines
Deploying Baselines
Developing a Compliance Strategy
Obtaining On-Demand Results
Correcting Issues Using Remediation
Using Reporting to Track Compliance
Troubleshooting Settings Management
Summary
11 Creating and Managing Applications
ConfigMgr Applications Overview
Using the Requirement Rule Component in a DT
Understanding Detection Methods
User Device Affinity
Creating and Modifying Applications
Using a Definitive Software Library
Creating a Windows Installer (.msi)-Based Application
Viewing Application Properties
Creating Detection Methods
Creating Detection Methods for Windows Installer Applications
Adding Other Detection Methods
Using Custom Script Detection Methods
Managing and Creating Global Conditions
Device Global Conditions
User Global Conditions
Creating Custom Global Conditions
Managing Application Management, Application Configuration, and Volume License Purchases
About Mobile Application Management Policies
Creating Application Management Policies
App Configuration Policies
Apple Volume License Purchasing
Integrating Windows Store for Business
More About Managing Applications
Adding Application Dependencies
Managing Revision History
Exporting and Importing Applications
Superseding Applications
Retiring and Deleting Applications
Best Practices for Working with Applications
Support for Write Filters in Windows Embedded
Deploying PowerShell Scripts
PowerShell Script Prerequisites and Configuration
Creating, Editing, Approving, and Denying Scripts
Monitoring Scripts
Summary
12 Creating and Using Deployment Types
Creating and Using Windows Installer Deployment Types
Creating a Windows Installer–Based Deployment Type
Creating a Windows Installer Through MDM Deployment Type
Creating and Using Application Virtualization Deployment Types
Creating a Microsoft App-V 4.6 Deployment Type
Creating a Microsoft App-V 5 Deployment Type
Using App-V Virtual Environments
Creating an App-V Virtual Environment
Using Deployment Types for Mobile Devices
Using Sideloading to Distribute Applications
Using Deeplinking with DTs to Distribute Applications
Creating and Using Other Deployment Types
Creating a Script-Based Deployment Type
Creating Deployment Types for Mac OS
Creating Web Applications
Synchronizing Apps from the Windows Store for Business
Summary
13 Creating and Managing Packages and Programs
Understanding Packages and Programs
Creating a Package from a Definition File
Creating a 7-Zip Package
Advantages of Using an MSI File
Configuring Package Properties
Using the Package Properties Data Source Tab
Using the Package Properties Data Access Tab
Using the Package Properties Distribution Settings Tab
Using the Package Properties Reporting Tab
Using the Package Properties Content Locations Tab
Defining Program Properties
Using the Program Properties General Tab
Using the Program Properties Requirements Tab
Using the Program Properties Environment Tab
Using the Program Properties Advanced Tab
Program Properties Windows Installer Tab
Program Properties OpsMgr Maintenance Mode Tab
Creating Packages Using the Package and Program Wizard and for UNIX and Linux Systems
Creating a Package Using the New Package Wizard
Creating Packages for UNIX and Linux Systems
Summary
14 Distributing and Deploying Applications and Packages
Creating and Managing Collections
Creating a Collection
About Direct Rules
Using Query Rules
Using Include and Exclude Rules
Updating Collections
Modifying Collection Properties
Using Maintenance Windows
Using Distribution Points
Installing Distribution Points
Using and Configuring Cloud-Based Distribution Points
Distributing Content
Configuring Network Bandwidth for Content Distribution
Monitoring Distribution Point Status
Using BranchCache and Peer Cache
Using Preferred Distribution Points
Using Content
Troubleshooting Content Distribution
Deploying Applications and Packages
Dealing with High-Risk Deployments
Simulating Deployments
Understanding the End-User Experience
Using the Old Software Center
Using the Application Catalog
Using the New Software Center
Notifications and Options for Required Deployments
Monitoring and Troubleshooting
Summary
15 Managing Software Updates
What’s New with Software Updates in ConfigMgr Current Branch
Creating Your Update Design
Planning for Software Updates
Capacity Planning
Planning Your Software Update Point Infrastructure
Using Windows Software Update Services
Configuring Components
Configuring Server-Side Components
Configuring Client-Side Components
Creating and Deploying Updates
Using the All Software Updates Node
Using Software Update Groups
Using Deployment Packages
Creating the Deployment
Using Automatic Deployment Rules
Understanding Windows 10 Servicing
Servicing Branches in ConfigMgr
About Deployment Rings
About Windows 10 Servicing Prerequisites
Using the Windows 10 Servicing Dashboard
Servicing Plans
Client Experience
Compliance Scanning
Using Notifications
Using Software Center
Installing Updates and Reporting Status
Troubleshooting Software Updates
Monitoring the Updates Process
WSUS and SUP in Software Updates
Downloading Updates
Troubleshooting Client Scanning and Update Deployment
Troubleshooting Software Updates
Using the System Center Update Publisher
Installing SCUP
Configuring SCUP
Using SCUP Catalogs
Using SCUP Publications
SCUP Updates
Using SCUP Custom Updates
Using SCUP Rules
Summary
16 Integrating Intune Hybrid into Your Configuration Manager Environment
Introducing Microsoft Intune
Hybrid Versus Standalone
Microsoft’s Enterprise Mobility + Security
Purchasing Microsoft Intune
Using the Management Portals
Using Intune Storage
User Identity Options
Cloud Identity
Synchronized Identity (Password Synchronization)
Federated Identity
Preparing Your Environment for Intune
Adding and Verifying a Custom Domain
Creating DNS Records
Adding a User Principal Name
Synchronizing Active Directory
Implementing an Alternate Login ID (Optional)
Integrating Intune with Configuration Manager
Configuring User Discovery
Creating a User Collection
Adding an Intune Subscription
Adding the Service Connection Point
Removing an Intune Subscription
Removal of Intune Extensions
Troubleshooting Intune Hybrid
Viewing Site and Component Status
Using Log Files
Viewing Intune Status
Troubleshooting Directory Synchronization
Utilizing Microsoft Support for Intune
Accessing the Microsoft TechNet Forum
Using the Configuration Manager Hybrid Diagnostics Tool
Summary
17 Managing Mobile Devices
Enabling Devices for Management
Enabling Android Devices for Management
Enabling iOS Devices for Management
Enabling Windows Phone Devices for Management
Using Windows Computers as Mobile Devices
Managing Company Devices
Device Enrollment Program (iOS Only)
Apple Configurator (iOS Only)
Device Enrollment Manager
Protecting Mobile Devices
Retiring and Wiping Mobile Devices
Resetting Passcodes
Remotely Locking a Device
Accessing Activation Lock Bypass (iOS Only)
Configuring Mobile Devices
Creating Configuration Items and Baselines
Using Custom Configuration Items
About Device Policy Refresh Intervals
Inventorying Mobile Devices
Deploying Apps
Leveraging Mobile Application Management (MAM)
Creating Mobile Device Collections
Using the Company Resource Access Workspace
Using Certificate Profiles
Using Email Profiles
Deploying VPN Profiles
Using Wi-Fi Profiles
On-Premise Mobile Device Management
Management Capabilities
Advantages and Disadvantages of On-Premise MDM
On-Premise MDM Configuration
On-Premise MDM Client Configuration
Summary
18 Conditional Access in Configuration Manager
Understanding Modern Authentication
Implementing Configuration Manager Policies
Supported Compliance Policy Settings
Creating a Compliance Policy
Deploying a Compliance Policy
Enabling Conditional Access for Exchange Online
Requirements for Exchange Online
Enabling Conditional Access for Exchange Online
Exchange Online End-User Experience
Enabling Conditional Access for SharePoint Online
Requirements for SharePoint Online
Enabling Conditional Access for SharePoint Online
The SharePoint Online End-User Experience
Enabling Conditional Access for Skype for Business Online
Requirements for Skype for Business Online
Configuring Conditional Access for Skype for Business Online
Enabling Conditional Access for Exchange On-Premises
Requirements for Exchange On-Premises
Implementing the Exchange Server Connector
Configuring Conditional Access for Exchange On-Premises
The Exchange On-Premises End User Experience
Monitoring and Troubleshooting Conditional Access
Monitoring Conditional Access Compliance
Troubleshooting Conditional Access
Summary
19 Endpoint Protection
Protection Capabilities of Microsoft’s Antimalware Platform
Using Antimalware as a Service
Understanding Microsoft’s Core Protection Technologies
Understanding Windows Antimalware Capabilities
Using Windows Defender Offline
Microsoft’s Approach to Antimalware
Prerequisites for Endpoint Protection
Planning and Considerations
Gathering Requirements for Endpoint Protection
Determining Definition Update Sources
Leveraging ConfigMgr’s Capabilities
Using System Center Endpoint Protection with Windows 10
Deployment Best Practices
Deploying and Configuring Endpoint Protection
Installing the Endpoint Protection Point Role
Delivery of Definition Updates
Working with Antimalware Policies
Installing the Endpoint Protection Client
Monitoring and Reporting in Endpoint Protection
Operational Status of Endpoint Protection Clients
Reports Available for Endpoint Protection
Integrating Report Data with Other Systems
Endpoint Protection Actions and Alerts
Overview of Endpoint Protection Alerts
Enabling Alerts for a Collection
On-Demand Actions Related to Endpoint Protection
Scripting Endpoint Protection Actions
Windows Defender Advanced Threat Protection
Windows Defender ATP Capabilities
Prerequisites for Windows Defender ATP
Configuring Windows Defender ATP Using ConfigMgr
Summary
20 Configuration Manager Queries
Introducing the Queries Node
Organizing the Query List Pane
Viewing Queries and Query Results
Creating Queries
Building Queries Using the WMI Query Language
Understanding Query Objects, Classes, and Attributes
Using the ConfigMgr Query Builder
Understanding Criterion Types, Operators, and Values
Filtering Queries with Criterion Types
Using Relational and Logical Operators
Specifying or Selecting Values
Writing Advanced Queries
Limitations of Extended WQL in ConfigMgr
Utilizing the Date and Time Functions in WQL Queries
Examples of Advanced Queries
Converting WQL to SQL
Understanding Relationships, Operations, and Joins
Querying Discovery Data
Querying Inventory Data
Using Query Results
Exporting Query Results to a Text File
Importing and Exporting Queries between Sites
Creating a Collection Based on Query Results
Using Status Message Queries for In-Depth Analysis
Viewing Status Messages
Creating Status Message Queries
Summary
21 Configuration Manager Reporting
Overview of SSRS and Configuration Manager Reporting
Using SQL Server Reporting Services
Using the ConfigMgr Reporting Point Role
Notable Reporting Point Information
Understanding Configuration Manager Data
Using Discovery Classes
Using Hardware Inventory Classes
ConfigMgr Software Inventory Classes
Using Software Update Inventory Classes
About Software Metering Inventory Classes
About Status Message Classes
About State Messages Classes
Using Collection Data Classes
Introducing Transact-SQL
Introducing SQL Server Management Studio
Basic SQL Sections in a Query
Using Operators
Building a Report Design
About Report Series
Creating Consistent Reports
Building a Basic Report
Tools for Creating Reports
Getting Started with SSDT-BI
Creating a Basic Report
Creating a Data Source
Creating a Dataset
Accessing the Toolbox
Adding a Table to a Report
Previewing a Report
Publishing a Report
Advanced Reporting Concepts
Summary
22 Operating System Deployment
What’s New with OSD in Current Branch
OSD Deployment Scenarios
Tools Used with OSD
Using Sysprep to Assist with Imaging
Incorporating the Windows ADK
Using the User State Migration Tool
Planning for OSD
Using the Console
Using Drivers and Driver Packages
Using Operating System Images
Using Operating System Upgrade Packages
Using Boot Images
Using Task Sequences
Using Tasks and Variables in a Task Sequence
Using Tasks
Using Variables
Site System Roles for OSD
Using Distribution Points
Using State Migration Points
Getting Ready for Deployment
Distributing the Content
Deploying the Task Sequence
Creating the TS Media
Creating Stand-alone Media
Creating Bootable Media
Creating Capture Media
Creating Prestaged Media
Troubleshooting OSD Deployments
Monitoring OSD
Boot Image Command-Line Support
Using OSD Log Files
Understanding the PXE Boot Process
Updating Your OS Images
Summary
Part IV Configuration Manager Administration
23 Security and Delegation in Configuration Manager
Planning for Security and Delegation
Security Planning Overview
A Security Primer
Designing Your Hierarchy for Security
Planning for Secure Administration
ConfigMgr Security Solutions
About Role-Based Administration in ConfigMgr
Managing Administrative Users
Security Roles
Creating Custom Roles
Using Security Scopes
Associating Security Scopes and Collections with Individual Roles
Using Administrative Security Reports
Securing Administrative Access to ConfigMgr
Securing Access at the Active Directory Level
Securing Site System Local Administration
The Just Enough Administration (JEA) Security Feature
Securing Access at the Database Level
Auditing ConfigMgr Administrative Actions
Securing the ConfigMgr Infrastructure
Securing Site Systems
About ConfigMgr Cryptographic Controls
Securing Network Communications
ConfigMgr Content Security
Securing ConfigMgr Accounts
Summary
24 Backup, Recovery, and Maintenance
Implementing Configuration Manager Backup
Configuring the Backup Site Server Maintenance Task
Using SQL Backup
Additional Files to Back Up
Recovering Configuration Manager Sites
Selecting Recovery Options
Restoring a Failed Site
Maintaining a Configuration Manager Site
Configuring Built-in Maintenance Tasks
Optimizing SQL Server
Maintaining Windows Server Update Services
Using ConfigMgr Site Maintenance Options
Monitoring Configuration Manager
Monitoring Site Replication
Using System Center Operations Manager
Summary
Part V Appendixes
A Configuration Manager Log Files
Viewing Log Files
Configuring Logging
Server-Side Logging Levels
MP/Client and Console Logging Levels
Client Logs
Server Logs
Site Server Logs
Server Installation and Update Logs
Site System Logs
Cloud Management Gateway Logs in Azure
B Co-Managing Microsoft Intune and ConfigMgr
Modern Management in Windows 10
Defining Co-Management
Why Co-Management?
Choosing Where to Start with Co-Management
Configuring Co-Management in ConfigMgr
Co-Management Prerequisites
Enabling Devices for Co-Management
Moving Workloads from ConfigMgr to Intune
C Reference URLs
General Resources
Microsoft’s Configuration Manager Resources
Other Configuration Manager Resources
Blogs
Public Forums
Utilities
D Available Online
Configuration Manager Reporting
Live Links
Extending Hardware Inventory—Online Only
Index
E (Online Only) Extending Hardware Inventory
← Prev
Back
Next →
← Prev
Back
Next →