System Center 2012 Configuration Manager KBs April

I assume most of you have seen and heard the finally System Center 2012 is out the door, below is a link with a good post with Configuration Manager 2012 KBs that was release duringApril thet you should be aware of before you start didding deep with the product. Go read now !

New Knowledge Base articles for System Center 2012 Configuration Manager

http://blogs.technet.com/b/configurationmgr/archive/2012/04/24/new-knowledge-base-articles-for-system-center-2012-configuration-manager.aspx

Do I need a CAS ?

Well my answer is first off always NO. Thats a good starting point when dscussing when you should use a CAS or not. Simply the answer is NO NO NO ! There are a few exceptions but they are very few.

- Do you have more then 100 000 clients? Sure go for a CAS due to the supportability of 100 000 clients on a single primay !

- Political issues, if you loose go beat on the wall again untill you win.

- Building a Gloabl 24/7 organisation where you want to give your self time to work on the systems dusrint night etc might be one but not nessecary one depending on how you stand up your roles.

Almost all the old arguments for adding a primary are gone, two classical examples below.

- Delegation of duties haveing one group manageing the servers and another managing the clients, All that you now can manage with role based administration.

- Different Client Settings client in Sweden should have one setting and the German clients another, in SC12 CM now you can do Custom Client settings that you target to Collections so they are no longer site based.

As always when I do designs try to keep the hierachy as simple as possible, making it to advanced is also making it require more effort managing in most cases. Above is not all cases we will bump into but want I really want to get out here is dont just put up a CAS because you think you need one, you should have very valid reasons for standig up a CAS as it will addd more complexity to your environment. SC12 CM is really about hierachy simplification, I know it will take some time to get this out there but make amental note dont stand up a CAS just because someone said so.

System Center Friday (SWE)

Nedan finns nu aktuellt Schema för System Center Friday som vi i SCUG kör, mer info om mötena kommer, mötena kommer vara via Livemeeting och spelas in samt sedan läggas upp på vår youtube kanal.

www.youtube.com/scugse

System Center Friday – What new in SC12 Configuration Manager

Friday, 16 March 2012 at 15:00-16:00

Jörgen Nilsson och Stefan Schörling tar er igenom nyheterna i System Center 2012 Configuration Manager.

System Center Friday – SC12 Configuration Manager design considerations

Friday, 30 March 2012 at 10:00

Jörgen Nilsson och Stefan Schörling tar er igenom vad ni bör tänka på vid design av System Center 2012 Configuration Manager.

System Center Friday – SC12 Building a self-healing IT Infrastructure

Friday, 27 April 2012 at 09:00

Anders Bengtsson tar oss igenom hur man bygger en självläkande IT Infrastruktur med system Center 2012 Operations Manager och Orchestrator

System Center Friday – SC12 Configuration Manager Feature dive

Friday 11 May 10-11

Stefan Schörling och Jörgen Nilsson går igenom Settings Management / Endpoint Protection och Client Health i System Center 2012 Configuration Manager

System Center Friday – SC12 OSD med Johan Arwidmark

Friday, 18 May 2012

Johan Arwidmark tar oss igenom 1 timme operativ systems utrullning med system Center 2012 Configuration Manager. Mer info kommer.

System Center Friday – SC12 Helautomatiserad självbetjäning

Friday, 25 May 2012 at 13:00

Jonas Ullman & Patrik Sundqvist tar oss igenom hur vi bygger automation med System Center 2012 Service Manager / Orchestrator / Configuration Manager. Mer information kommer.

System Center Friday – Upgrading to SC12 Operations Manager

Friday, 1 June 2012 at 09:00

Hur går en uppgradering till System Center 2012: Operations Manager till? Vad skall man tänka på? Anders Bengtsson reder ut begreppen och går igenom möjligheterna att uppgradera till System Center 2012 Operations Manager.

Best of MMS – Sweden

Thanks to everyone that attended mine and Jörgens  session last week. As promised we will post some MBAM (Microsoft Bitlocker and Administration) Blog posts the coming weeks.

To start with here are the links that we had in our presentation. We will post more thing related to MBAM along the way so please stay tuned here for more MBAM information.

General

MBAM MP for Operations Manager
http://www.microsoft.com/download/en/details.aspx?id=26796
Bitlocker FAQ
http://technet.microsoft.com/en-us/library/ee449438(WS.10).aspx
MBAM in WinPE
http://myitforum.com/cs2/blogs/nbrady/archive/2011/09/06/how-can-i-retrieve-my-bitlocker-recovery-key-from-mbam-in-windows-pe.aspx
KBs
http://support.microsoft.com/kb/2612822

Handling of TPM

HP
http://itbloggen.se/cs/blogs/micke/archive/2010/10/18/enable-tpm-via-task-sequence-on-hp-boxes.aspx
Dell
Http://www.nullsession.com/2010/12/02/enable-tpm-in-task-sequence-with-sccm-and-cctk/
Lenovo
http://blog.coretech.dk/mip/enable-lenovo-tpm-security-chip-and-other-stuff-from-a-ts/

FEP 2010 Update Rollup 1

Update Rollup for FEP 2010 has been released so go read about it as it will enhance your FEP expericne with Config Mgr for update management. It also has some new OS uspport

TechNet Whats New ! – http://technet.microsoft.com/en-us/library/hh211541.aspx

Download – http://www.microsoft.com/download/en/details.aspx?id=26583

(Swedish) Informator Seminarie

Hej som utlovat kommer presentationen från dagens seminare på följande länk. Om ni har frågor eller andra tankar är ni välkomna att skicka e-post på adressen som står i presentationen.

Config Mgr 2012 – Overview

Handling users uninstalling FEP

If you have local administrators they might uninstall Forefront Endpoint Protection 2010 from their system, to keep track of this and automatically remediating this. Then you have the option to advertise a FEP installation to the built-in collection for FEP called “Locally Removed”.  So if a user uninstalls the client they will get it automatically again.

Don’t forget to set the advertisement to always rerun. Its also a good idea to keep track of the advertisement to make sure you don’t have clients that end up in a loop.

Note: I have seen some cases where there is an issue with clients ending up in this collection without having the client uninstalled. Usually triggering a Hardware Inventory resolves this.

Remediating FEP clients with protection disabled

As some of you might have noticed there is no Tamper protection with Forefront Endpoint Protection 2010. So how would you handle this in your environment ?

Usually the issue comes if you have your users as local administrators on their PCs they have full control over their PC.

So there are different ways to go around this. My first way to handle this is to configure a GPO that controls the Microsoft Antimalware Service. And set the Service to automatically start and only your real administrators to have the Start and Stop Rights.

My option 2 is to have a advertisement with a reoccurring script or startup script to set the service to start automatically and start the service it if its stopped. The target is the Built-in Collection

strComputer = "."
Set objWMIService = GetObject("winmgmts:\" & strComputer & "rootcimv2")

Set colServiceList = objWMIService.ExecQuery _
("Select * from Win32_Service where Name = ‘MsMpSvc’")
For Each objService in colServiceList
objService.ChangeStartMode("Automatic")
Wscript.Sleep 5000
errReturnCode = objService.StartService()
Next