Lab: Implementing SMS 2003 SP1 Features

Transcription

1 Lab: Implementing SMS 2003 SP1 Features Objectives After completing this lab, you will be able to: Identify an SMS 2003 SP1 site. Implement SMS 2003 SP1 folders. Implement a configurable HTTP port in SMS 2003 SP1. Implement client data signing and encryption. Implement the add-on SMS 2003 Client Health Monitoring Tool to identify client health. Prerequisites Before working on this lab, one virtual computer should be running as a Microsoft Windows Server 2003 computer installed as an SMS 2003 SP1 primary site server (SP1 Server VPC). A second virtual computer is booted as a Microsoft Windows XP Professional client installed as an Advanced Client in the SMS 2003 SP1 site (SP1 Windows XP VPC). Estimated time to complete this lab: 75 minutes

2 2 Lab: Implementing SMS 2003 SP1 Features Exercise 0 Preparing the Virtual Computer Clients for the Lab In this exercise, you will update the collection membership of the All Systems collection. When you do, you will see the SMSClient computer appear twice in the membership list. This is due to Virtual PC 2004 virtualizing the SMBios serial number of the host computer, which SMS detects as being different than the original SMBios serial number. Because of this, SMS generates a new GUID for the client, which causes a new record to be generated. To update the collection membership 1. Log on as administrator with a password of password. 2. On the Start menu, click SMS Administrator Console. The sms [Systems Management Server] window appears. 3. In the console tree, expand Site Database, expand Collections, and then click All Systems. The members of the All Systems collection appear in the details pane. Notice that the site server computer (SMSServer) and the Windows XP Professional client computer (SMSClient) appear as members. 4. On the Action menu, point to All Tasks, and then click Update Collection Membership. The All Systems message box appears prompting to update subcollection membership. 5. Click OK, and then on the Action menu, click Refresh. The collection membership is updated, and the current membership of the All Systems collection is displayed. Notice that the SMSClient computer is now displayed twice. Notice also that one of the instances is listed as being Obsolete and inactive. This is the old reference of the client. 6. Update the membership of the All Windows XP Systems collection. This collection will be used later in this lab for targeting of an advertisement. Note Normally you would delete all records marked as Obsolete. However, for this lab, leave the obsolete records for use with the SMS 2003 Client Health Tool, as it can report on obsolete client records. You have now prepared your images for the lab and may proceed to Exercise 1.

3 Lab: Implementing SMS 2003 SP1 Features 3 Exercise 1 Identifying an SMS 2003 SP1 Installation In this exercise, you will verify that your site is an SMS 2003 SP1 site. To identify an SMS 2003 SP1 site installation 1. In the console tree, click Site Database, and then on the Action menu, click About Systems Management Server. The About Systems Management Server dialog box appears displaying information about the local site. 2. What version of SMS is displayed? SMS 2.50 SP1 (3174) which is SMS 2003 SP1 3. Click OK. 4. In the console tree, expand Site Database, and then click Site Hierarchy. The local site information appears in the details pane. 5. What version of SMS is installed on the local site? which is SMS 2003 SP1.

4 4 Lab: Implementing SMS 2003 SP1 Features Exercise 2 Implementing Folders Features In this exercise, you will implement the new SMS 2003 SP1 feature for SMS Administrator Console folders. To create a package 1. In the console tree, click Packages, and then on the Action menu, point to New. A new menu appears. 2. What new items can be created? A new package, a new package from definition, and a folder (new feature for SMS 2003 SP1) 3. Click Package From Definition. The Create Package from Definition Wizard dialog box appears. 4. Click Next. The Create Package from Definition Wizard Package Definition dialog box appears. 5. Click Browse. The Open dialog box appears. 6. Click C:\SMSTools\SMS Toolkit\SMS2003Toolkit2.msi, and then click Open. The Create Package from Definition Wizard Package Definition dialog box appears. Notice that SMS 2003 Toolkit 2 is listed as a package definition file. 7. Under Package definition, click SMS 2003 Toolkit 2, and then click Next. The Create Package from Definition Wizard Source files dialog box appears. 8. Click Always obtain files from a source directory, and then click Next. The Create Package from Definition Wizard Source Directory dialog box appears. 9. Click Local drive on site server, and then in the Source directory box, type C:\SMSTools\SMS Toolkit 10. Click Next. The Completing the Create Package from Definition Wizard dialog box appears.

5 Lab: Implementing SMS 2003 SP1 Features Click Finish. The SMS Administrator Console window appears. 12. In the console tree, click Packages, and then on the Action menu, click Refresh. The list of packages appears in the details pane. Notice that the Microsoft Corporation SMS 2003 Toolkit 2 package is listed. 13. In the console tree, expand Packages, expand Microsoft Corporation SMS 2003 Tookit English, and then click Distribution Points. The list of distribution points for the package appears in the details pane. Notice that there are no distribution points for this package. 14. On the Action menu, point to New, and then click Distribution Points. The New Distribution Points Wizard dialog box appears. 15. Click Next. The New Distribution Points Wizard Copy Package dialog box appears. 16. Under Distribution points, click SMSServer, and then click Finish. The SMS Administrator Console window appears. In the following procedure, you will create a new folder, and then create a package in the new folder. To create a new folder for packages 1. Click Packages, and then on the Action menu, point to New. A new menu appears. 2. Click Folder. The Folder Properties dialog box appears. 3. In the Name box, type SMS Tools, and then click OK. The SMS Administrator Console appears displaying the list of package objects in the details pane. Notice that the new folder appears. 4. In the console tree, expand Packages, and then click SMS Tools. The list of packages for the SMS Tools folder appears in the details pane. Notice that there are no packages in the folder. 5. On the Action menu, point to New, and then click Package. The Package Properties dialog box appears. 6. In the Name box, type Port Configuration, and then click the Data Source tab. The Package Properties dialog box displays package source details. 7. Click This package contains source files, and then click Set. The Set Source Directory dialog box appears. 8. Click Local drive on site server, and then in the Source directory box, type C:\SMSTools\PortConfiguration

6 6 Lab: Implementing SMS 2003 SP1 Features 9. Click OK. The Package Properties dialog box displays package source details. 10. Click the Reporting tab. The Package Properties dialog box displays configuration options for creating status mif results. Notice that the default option is to package details. 11. Click Use these fields for status MIF matching, and then in the MIF file name box, type Portswitch.mif 12. Click OK. The list of packages for the SMS Tools folder appears in the details pane. Notice that the Port Configuration package appears. 13. In the console tree, expand SMS Tools, expand Port Configuration, and then click Distribution Points. The list of distribution points for the package appears in the details pane. Notice that there are no distribution points for this package. 14. On the Action menu, point to New, and then click Distribution Points. The New Distribution Points Wizard dialog box appears. 15. Click Next. The New Distribution Points Wizard Copy Package dialog box appears. 16. Under Distribution points, click SMSServer, and then click Finish. The SMS Administrator Console window appears. In the following procedure, you will move an existing package to the new folder.

7 Lab: Implementing SMS 2003 SP1 Features 7 To move an existing package to a folder 1. In the console tree, click Packages, and then on the Action menu, click Move Folder Items. The Move Folder Items dialog box appears displaying all contents of the Packages folder, including the SMS Tools folder and the SMS Toolkit package. 2. Under Folder contents, click Microsoft Corporation SMS 2003 Tookit English, and then click Browse. The Destination Folder dialog box appears allowing the selection of the folder to move the package to. Notice the default folder is Packages. 3. Under Destination Folder, expand Packages, click SMS Tools, and then click OK. The Move Folder Items dialog box appears. Notice that the SMS Toolkit package is to be moved to the Packages\SMS Tools folder. 4. Click OK. The list of objects in the Packages folder appears in the details pane. Notice that the SMS Toolkit package is no longer listed. 5. In the console tree, expand Packages, and then click SMS Tools. The list of objects in the SMS Tools folder appears in the details pane. Notice that both the SMS Toolkit and Port Configuration packages are listed.

8 8 Lab: Implementing SMS 2003 SP1 Features Exercise 3 Implementing a New HTTP Port for the Advanced Client In this exercise, you will implement the new SMS 2003 SP1 feature that allows SMS 2003 SP1 Advanced Clients to use a new HTTP port. To create a command line for the package 1. In the console tree, expand Packages, expand SMS Tools, expand Port Configuration, and then click Programs. The list of programs for the Port Configuration package appears in the details pane. Notice that there are not any programs configured. 2. On the Action menu, point to New, and then click Program. The Program Properties dialog box appears. 3. In the Name box, type Use port In the Command line box, type wscript.exe portswitch.vbs In the After running box, click Program restarts computer. The computer will not be restarted, but rather the SMS Agent Host service will be restarted. 6. Click OK. The list of programs for the Port Configuration package appears in the details pane. Notice the new program listed. In the following procedure, you will advertise the port change program to the Advanced Clients. To advertise the new HTTP communications port 1. In the console tree, click Advertisements, and then on the Action menu, point to New. A new menu appears. 2. Click Advertisement. The Advertisement Properties dialog box appears. 3. In the Name box, type Port Change 4. In the Package box, click Port Configuration. 5. In the Program box, click Use port 1337, and then click Browse. The Browse Collection dialog box appears.

9 Lab: Implementing SMS 2003 SP1 Features 9 6. Under Collections, click All Windows XP Systems, and then click OK. The Advertisement Properties dialog box appears. 7. Click OK. The SMS Administrator Console window appears. In the following procedure, you will add a new port for SMS 2003 SP1 Advanced Clients to use. To configure the site to use a new HTTP communications port 1. In the console tree, expand Site Hierarchy. The site hierarchy for the local site appears in the details pane. 2. In the console tree, click MCM, and then on the Action menu, click Properties. The MCM SMS 2003 SP1 Primary Site Site Properties dialog box appears. 3. Click the Ports tab. The MCM SMS 2003 SP1 Primary Site Site Properties dialog box appears displaying the port properties for the site. 4. What is the default port value? Port Click New. The Port Detail dialog box appears allowing the configuration of a new port. 6. In the Description box, type Port 1337 and then in the Port number box, type Click OK. The MCM SMS 2003 SP1 Primary Site Site Properties dialog box appears displaying the port properties for the site. Notice that both the default port of 80 and the new port of 1337 are listed. It is important to retain the default port number until all clients in the site (and potentially hierarchy) are configured with the new port before removing the original port. Adding a new port to the SMS site will cause the management point to be reinstalled to begin utilizing the new port. This process will take a few minutes, but you may proceed on with the remainder of this exercise. 8. Click OK.

10 10 Lab: Implementing SMS 2003 SP1 Features In the following procedure, you will configure hardware inventory to determine the port Advanced Clients are configured to use. To configure inventorying of the HTTP communications port 1. Use Notepad to open C:\SMS\Inboxes\Clifiles.src\hinv\sms_def.mof. Notepad displays the contents of the master sms_def.mof file. 2. On the Edit menu, click Find. The Find dialog box appears. 3. In the Find what box, type SMS Advanced Client Port and then click Find Next. Notepad displays the first occurrence of SMS Advanced Client Port in the sms_def.mof file. 4. In the Find dialog box, click Cancel. Notice that the line immediately above the highlighted reference of SMS Advanced Client Port indicates that SMS is not configured to report that data. 5. Change the FALSE to TRUE in the line above the reference to SMS Advanced Client Port. This will enable the reporting of the Advanced Client communications port during the next hardware inventory cycle. 6. Close Notepad and save the changes to the sms_def.mof file. In the following procedure, you will force the Advanced Client to check for new policies, which will include the advertisement to configure the new port, as well as the new hardware inventory policy. Note Complete this procedure from the Windows XP Advanced Client computer only. Do not start this procedure until the management point has been reinstalled due to the port change. Verify that CCMexec.exe has started on the management point before starting this procedure. To run the port configuration program and force inventory 1. Log on as administrator with a password of password. 2. In Control Panel, start Systems Management. The Systems Management Properties dialog box appears. 3. Click the Actions tab. The Systems Management Properties dialog box displays the available actions for the Advanced Client. Notice the default actions of Discovery Data Collection Cycle, Machine Policy Retrieval & Evaluation Cycle, User Policy Retrieval & Evaluation Cycle and Windows Installer Source List Update Cycle. In addition, you will notice action for hardware inventory.

11 Lab: Implementing SMS 2003 SP1 Features Click Machine Policy Retrieval & Evaluation Cycle, and then click Initiate Action. The Advanced Client will request new policies, which will include the policy related to the advertised program. A Machine Policy Retrieval & Evaluation Cycle message box appears indicating the action was initiated, and may take several minutes to complete. 5. Click OK. The Systems Management Properties dialog box appears. 6. Click OK. It will take two minutes for SMS to evaluate and implement the new policies. When that has completed, the New Program Available notification bubble appears in the System Tray. 7. In the System Tray, double-click the New Program Available icon. The Run Advertised Program window appears. Notice the Port Configuration program appears in the list. 8. Under Program Name, click Port Configuration Use port 1337, and then click Run. The Run Advertised Program window appears. 9. Click Close. 10. In Control Panel, start Systems Management. The Systems Management Properties dialog box appears. 11. Click the Actions tab. The Systems Management Properties dialog box displays the available actions for the Advanced Client. Notice the default actions of Discovery Data Collection Cycle, Machine Policy Retrieval & Evaluation Cycle, User Policy Retrieval & Evaluation Cycle and Windows Installer Source List Update Cycle. In addition, you will notice action for hardware inventory. 12. Click Hardware Inventory Cycle, and then click Initiate Action. The Advanced Client will generate a hardware inventory cycle. A Hardware Inventory Cycle message box appears indicating the action was initiated, and may take several minutes to complete. 13. Click OK. The Systems Management Properties dialog box appears. 14. Click OK.

12 12 Lab: Implementing SMS 2003 SP1 Features In the following procedure, you will use SMS to verify that the Advanced Client ran the new program to implement the new port. To verify the client ran is using the new port 1. In the console tree, expand System Status, expand Advertisement Status, and then click Port Change. The status for the Port Change advertisement appears in the details pane. Noticed that one computer received the advertisement, stated it, and successfully completed the advertised program. 2. In the details pane, click MCM, and then on the Action menu, point to Show Messages. A new menu appears. 3. Click All. The SMS Status Message Viewer for <MCM> window appears. Notice the status messages listed. Status message indicates the program was run successfully and used a status mif to report success. 4. Close the SMS Status Message Viewer for <MCM> window. 5. In the console tree, expand Collections, and then click the All Windows XP Systems collection. The members of the All Windows XP Systems collection appear in the details pane. Notice that SMSClient appears as a member. 6. In the details pane, click SMSClient, and then on the Action menu, point to All Tasks. A new menu appears. 7. Click Start Resource Explorer. The Resource Explorer window appears. 8. In the console tree, expand Hardware, and then click SMS Advanced Client Ports. The HTTP port the Advanced Client is configured to use appears in the details pane. 9. What port is the client configured to use? 1337 By sending inventory to the site, you have verified that the client is using the existing port, in this case Close Resource Explorer. The SMS Administrator Console appears.

13 Lab: Implementing SMS 2003 SP1 Features 13 Exercise 4 Implementing Advanced Client Authentication and Data Encryption In this exercise, you will implement the new SMS 2003 SP1 feature for Advanced Client authentication and data encryption. To configure authentication and data encryption 1. In the console tree, expand Site Hierarchy. The site hierarchy for the local site appears in the details pane. 2. In the console tree, click MCM, and then on the Action menu, click Properties. The MCM SMS 2003 SP1 Primary Site Site Properties dialog box appears. 3. Click the Advanced tab. The MCM SMS 2003 SP1 Primary Site Site Properties dialog box appears displaying advanced properties for the site. 4. What options can be configured? Publishing identity data to Active Directory, not accepting unsigned data from SMS 2.0 SP4 and earlier sites, requiring secure key exchange between sites, signing of client data to the management point, and encrypting client data to the management point. 5. Which options are new in SMS 2003 SP1? Signing of client data to the management point and encrypting client data to the management point. 6. Under Inventory protection, click Sign data before sending to Management Point. A MCM SMS 2003 SP1 Primary Site Site dialog box appears indicating this change affects the Advanced Clients at the local site, as well as any child secondary site.

14 14 Lab: Implementing SMS 2003 SP1 Features 7. Click Yes. The MCM SMS 2003 SP1 Primary Site Site Properties dialog box appears displaying advanced properties for the site. 8. Under Inventory protection, click Encrypt data before sending to Management Point, and then click OK. The SMS Administrator Console appears. In the following procedure, you will verify the site has processed the request to enable client authentication and data encryption. To verify the client authentication and data encryption configuration 1. In the console tree, expand System Status, expand Site Status, expand MCM, and then click Component Status. The list of SMS components appears in the details pane. 2. In the details pane, click SMS_SITE_CONTROL_MANAGER, and then on the Action menu, point to Show Messages. A new menu appears. 3. Click All. The SMS Status Message Viewer for <MCM> window appears. Notice the recent messages with IDs of 2807, 2814, 2811 and These messages relate to the processing of the delta site control file, and the writing of the master site control file. Also notice for the message IDs of 2814, the description references the SMS Policy Provider. 4. Close the SMS Status Message Viewer for <MCM> window. 5. View the status messages for SMS_POLICY_PROVIDER. The SMS Status Message Viewer for <MCM> window appears. Notice there are two recent messages generated for the updating of a policy setting related to the enabling of authentication and data encryption. These are the policies that the Advanced Client will download to enable and configure client authentication and data encryption. 6. Close the SMS Status Message Viewer for <MCM> window.

15 Lab: Implementing SMS 2003 SP1 Features 15 In the following procedure, you will force the Advanced Client to check for new policies, which will include the policies to enable client authentication and data encryption. You will then verify the client is configured to provide authentication and encryption data to the management point. Note Complete this procedure from the Windows XP Advanced Client computer only. To implement client authentication and data encryption at the Advanced Client 1. In Control Panel, start Systems Management. The Systems Management Properties dialog box appears. 2. Click the Actions tab. The Systems Management Properties dialog box displays the available actions for the Advanced Client. Notice the default actions of Discovery Data Collection Cycle, Machine Policy Retrieval & Evaluation Cycle, User Policy Retrieval & Evaluation Cycle and Windows Installer Source List Update Cycle. In addition, you will notice action for hardware inventory. 3. Click Machine Policy Retrieval & Evaluation Cycle, and then click Initiate Action. The Advanced Client will request new policies, which will include the policy related to the enabling of client authentication and data encryption. A Machine Policy Retrieval & Evaluation Cycle message box appears indicating the action was initiated, and may take several minutes to complete. 4. Click OK. The Systems Management Properties dialog box appears. 5. Click OK. It will take two minutes for the Advanced Client to download and evaluate the two policies. 6. Open the C:\Windows\System32\Ccm\Logs\Ccmexec.log file. Notepad displays the contents of the CCMExec log file. 7. Search for InventoryClientAuthenticationConfig. Notepad displays the first occurrence of InventoryClientAuthenticationConfig. This is an indication that the policy was implemented to provide for client authentication. Notice a few lines below that line is a reference to Triggering DDR action for site change. This forces the Advanced Client to send a Heartbeat DDR to the management point.

16 16 Lab: Implementing SMS 2003 SP1 Features 8. Close the Ccmexe.log file, and then open the C:\Windows\System32\Ccm\Logs\InventoryAgent.log file. Notepad displays the contents of the Inventory Agent log file. 9. Search for signed. Notepad displays the first occurrence of signed. The first reference should indicate the data is not signed. This is from previous Heartbeat DDR and inventory events. 10. Search for the most recent occurrence of signed. The most recent occurrence states the data is now signed. This is an indication that the policy was implemented to provide for client authentication. Also notice right after this is a reference to the DDR not being encrypted. Advanced Clients do not encrypt Heartbeat Discovery data, but do inventory. You will now initiate a hardware inventory cycle to verify data encryption. 11. Close Notepad, and then in Control Panel, start Systems Management. The Systems Management Properties dialog box appears. 12. Click the Actions tab. The Systems Management Properties dialog box displays the available actions for the Advanced Client. Notice the default actions of Discovery Data Collection Cycle, Machine Policy Retrieval & Evaluation Cycle, User Policy Retrieval & Evaluation Cycle and Windows Installer Source List Update Cycle. In addition, you will notice action for hardware inventory. 13. Click Hardware Inventory Cycle, and then click Initiate Action. The Advanced Client will initiate a hardware inventory collection cycle. A Hardware Inventory Cycle message box appears indicating the action was initiated, and may take several minutes to complete. 14. Click OK. The Systems Management Properties dialog box appears. 15. Click OK. It will take a moment for the Advanced Client to complete hardware inventory. 16. Open the C:\Windows\System32\Ccm\Logs\InventoryAgent.log file. Notepad displays the contents of the Inventory Agent log file. 17. Search for the most recent occurrence of HinvEndpoint. This is the most recent hardware inventory data being sent to the management point. On the same line, you will see that the data is signed and encrypted. 18. Close Notepad and then view the files in C:\Windows\System32\Ccm\Logs. Notice that a new log file is present, Encryptionhook.log. This log file simply states that encryption is supported on this platform.

17 Lab: Implementing SMS 2003 SP1 Features 17 In the following procedure, you will verify that the Advanced Client was able to send data to the SMS site after it enabled client authentication and data encryption. To verify the Advanced Client data 1. In the console tree, expand Collections, and then click All Systems. The members of the All Systems collection appear in the details pane. Notice that the Advanced Client computer, SMSClient, is listed. 2. In the details pane, click SMSClient, and then on the Action menu, click Properties. The SMSCLIENT Properties dialog box appears displaying discovery data fro the client computer. Notice that the AgentName value for Heartbeat Discovery is AgentName[1]. 3. When did the client last report Heartbeat Discovery data? Very recent, as indicated by the AgentTime[1] attribute. 4. Click Close, and then on the Action menu, point to All Tasks. A new menu appears. 5. Click Start Resource Explorer. The Resource Explorer window appears. 6. In the console tree, expand Hardware, and then click Workstation Status. 7. When did the client last report hardware inventory data? Very recently, and after the client implemented signing and encryption. 8. Close the Resource Explorer window. The SMS Administrator Console window appears. You have now verified client authentication and encryption worked successfully in your SMS 2003 SP1 site.

18 18 Lab: Implementing SMS 2003 SP1 Features Exercise 5 Implementing the SMS 2003 SP1 Client Health Tool In this exercise, you will implement the new SMS 2003 SP1 tool to evaluate SMS client health. This feature is not provided with SMS 2003 SP1, but rather is a web download that requires SMS 2003 SP1. To install the Client Health tool 1. Start C:\SMSTools\ClientHealth\SMS2003ClientHealthTool.exe. The WinZip Self-Extractor window appears. This will allow you to extract the Client Health Tool for installation. 2. In the Unzip to folder box, type C:\SMSTools\ClientHealth and then click Unzip. Three files are extracted, and then a WinZip Self-Extractor message box appears. 3. Click OK, and then close the WinZip Self-Extractor window. 4. Start C:\SMSTools\ClientHealth\SMS2003ClientHealthTool\ ClientHealthSetup.msi. The Microsoft SMS 2003 Client Health Monitoring Tool Setup window appears. 5. Click Next. The Microsoft SMS 2003 Client Health Monitoring Tool Setup License agreement dialog box appears displaying the end user license agreement. 6. Read the license agreement, click I accept the license agreement, and then click Next. The Microsoft SMS 2003 Client Health Monitoring Tool Setup Destination Folder dialog box appears displaying the default path for installation of the tool. 7. Click Next to accept the default path of C:\Program Files\Microsoft SMS Client Health. The Microsoft SMS 2003 Client Health Monitoring Tool Setup Installation dialog box appears indicating it is ready to perform the installation. 8. Click Next. The Microsoft SMS 2003 Client Health Monitoring Tool Setup Setup Complete dialog box appears indicating the installation was successfully completed. 9. Click Finish.

19 Lab: Implementing SMS 2003 SP1 Features 19 In the following procedure, you will verify the SMS Client Health tool was installed correctly. To verify SMS Client Health installation 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. What program menu items were created as a result of installing the Microsoft SMS 2003 Client Health Monitoring Tool? Client Health Pivot Table Report, Client Health Summary Report, Client Health Tool Documentation, Configure the Client Health Monitoring Tool, and License In the following procedure, you will configure the SMS Client Health tool for your site. To configure the SMS Client Health service 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. Click Configure the Client Health Monitoring Tool. The SMS Client Health Monitoring Tool dialog box appears displaying the Site Settings tab for configuring the connection to the SMS site database and configuration of the SMS Client Health Monitoring Tool. 3. In the SMS SQL Server box, type SMSServer 4. In the SMS Database box, type SMS_MCM 5. In the Health Database box, type SMS_Health 6. Under Client Health Service credentials, click Use Local System. The account used must be an administrator account on the management point computer (to configure a registry entry and parse log files) and requires the Log on as a service right. 7. Click the Options tab. The SMS Client Health Monitoring Tool dialog box appears displaying the Options tab for configuration of the type of data to use to calculate client health, as well whether to monitor Advanced Clients in the local site or the entire hierarchy.

20 20 Lab: Implementing SMS 2003 SP1 Features 8. Verify that Heartbeat discovery is selected, and then select both Software inventory and Hardware inventory. 9. Configure the number of days for each of the three data types to a value of Under Scope of health check, verify that All Advanced Clients in Hierarchy is selected. 11. Click the Schedule tab. The SMS Client Health Monitoring Tool dialog box appears displaying the Schedule tab for configuration of various data methods for collection, identification and reporting of health status. 12. Click Collect Pulse Information from management points. When configured, this enables the management point to log client policy assignment requests, and then collect this data to identify if the clients are actively querying the management point for policies. The default is to query the management logs on a daily basis at 1am. 13. Click Ping clients, and then verify that Only ping unhealthy clients is selected. Pinging clients is the first interactive test to see if a client that the SMS Client Health service thinks is unhealthy is on the network or not. The default configuration for ping is daily at 2pm. 14. Click Update SMS site database with inactive client information. If a client is determined to be unhealthy, this option causes the SMS site database to be updated to reflect the client health. It uses the new Active attribute (set to 0 for unhealthy). 15. Click Remove aged data and then verify the number of days is set to 31. This aging process will remove any client health data older than the value specified. 16. Click Apply. A SMS Client Health Monitoring Tool message box appears indicating the updated configuration requires that the SMS Client Health Service be restarted. 17. Click OK. The SMS Client Health Monitoring Tool dialog box appears. 18. Click OK.

21 Lab: Implementing SMS 2003 SP1 Features 21 In the following procedure, you will verify the SMS Client Health service is running. To verify SMS Client Health Monitoring Tool service 1. Use Services to display the list of services installed. 2. What service does the SMS Client Health tool use? SMS_Client_Health 3. What account is the SMS Client Health service using? Either the Local System account or a specific user account configured by the administrator. 4. Close the Services window. In the following procedure, you will force the SMS Client Health service to check on client status. To force the SMS Client Health service to check client health 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. Click Configure the Client Health Monitoring Tool. The SMS Client Health Monitoring Tool dialog box appears displaying the Site Settings tab for configuring the connection to the SMS site database and configuration of the SMS Client Health Monitoring Tool. 3. Click the Schedule tab. The SMS Client Health Monitoring Tool dialog box appears displaying the Schedule tab for configuration of various data methods for collection, identification and reporting of health status. 4. After Collect Pulse Information from management points, click Run Now. This forces the SMS Client Health service to poll the default management point in the site for client polling information. 5. Leave the SMS Client Health Monitoring Tool dialog box open, and then open C:\Program Files\Microsoft SMS Client Health\Logs\Chservice.log. Notepad displays the contents of the SMS Client Health service log.

22 22 Lab: Implementing SMS 2003 SP1 Features 6. Search for Starting MP Notepad displays the first occurrence of starting MP. This is the first line to indicate a MP poll check has started. Notice the following entries in the log: Starting an MP policy request collection cycle Syncing of data with the SMS database Removing aged data from the database Listing of the number of suspected unhealthy clients Enabled logging of the policy assignment requests from Advanced Clients to the management point. This configured the Registry entry used to log Advanced Client policy assignment checks. Summarized data Updated the Client Health Summary Report Marked any inactive clients in the database Notice that there are two suspected unhealthy clients. 7. Close Notepad. The SMS Client Health Monitoring Tool dialog box appears. 8. After Ping clients, click Run Now. This forces the SMS Client Health service to ping the suspected unhealthy clients to see if they are online or not. From here, notice the following events occurring: 9. Close the SMS Client Health Monitoring Tool dialog box, and then open C:\Program Files\Microsoft SMS Client Health\Logs\Chservice.log. Notepad displays the contents of the SMS Client Health service log. Notice the entries in the log file. 10. Search for pinging Notepad displays the first occurrence of pinging. Notice that the suspected unhealthy clients are listed in the log file, and the status of the ping process. Both computers should be listed as Online CCMExec Running, BITS Installed. 11. Close Notepad. At this point, the Microsoft SMS 2003 Client Health Monitoring Tool has determined the site server and Advanced Client computers are unhealthy and inactive. You now will use the standard Client Health tool reporting features to see why the clients are listed as being listed as unhealthy.

23 Lab: Implementing SMS 2003 SP1 Features 23 In the following procedure, you will view the report of the SMS Client Health Monitoring Tool client status. Note Complete this procedure from the SMS site server. To report on the existing client health status 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. Click Client Health Summary Report. Internet Explorer starts and displays the SMS Client Health Summary page. This report lists the status of clients in the site. Notice that you have two clients in the site and both are listed as being unhealthy. 3. What data is present from the clients? Heartbeat discovery and hardware inventory data. 4. What data is missing from the clients that prevent them from being listed as healthy? Software inventory data 5. Are there any obsolete clients reported? If you did not delete the obsolete records, then you should have two obsolete clients listed. 6. Close the SMS Client Health window. In the following procedure, you will view the client health information generated by the SMS Client Health Monitoring Tool by using the Client Health Pivot Table Report. Note Complete this procedure from the SMS site server. To view the SMS Client Health Pivot Table Report 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. Click Client Health Pivot Table Report. Microsoft Excel starts, and the Microsoft Excel ClientHealthPivot.xls window appears. Notice that the spreadsheet displays sample data. You will need to update the pivot table to display the data from the local site.

24 24 Lab: Implementing SMS 2003 SP1 Features 3. Click cell C17, and then on the Data menu, click PivotTable and PivotChart Report Wizard. The PivotTable and PivotChart Wizard Step 3 of 3 dialog box appears. 4. Click Back. The PivotTable and PivotChart Wizard Step 2 of 3 dialog box appears. 5. Click Get Data. Microsoft Query attempts to connect to the data source for a couple of minutes. When complete, a Microsoft SQL Server Login message box appears indicating it failed to connect to the SQL Server. 6. Click OK. The SQL Server Login dialog box appears prompting for information on how to connect to the SQL Server. 7. In the Server box, type smsserver and then click Options. The SQL Server Login dialog box expands and displays additional configuration options for connecting to SQL Server. 8. In the Database box, click sms_health, and then click OK. A Microsoft Query message box appears indicating the query could not be edited by the query wizard. 9. Click OK. The Microsoft Query window appears with a Microsoft Query message box indicating there was an invalid object name in the default query. This is expected and will not prevent the updating of the pivot table as you will modify the query in this procedure. 10. Click OK. A Microsoft Query window appears. 11. On the View menu, click SQL. A SQL dialog box appears displaying the default SQL statement. 12. In the query statement, replace the SMS_CLIENTHEALTH_DB reference to sms_health and then click OK. The Microsoft Query window appears displaying data for the current data set, which is the SMS Client Health database. 13. On the File menu, click Return Data to Microsoft Office Excel. The PivotTable and PivotChart Wizard Step 2 of 3 dialog box appears. 14. Click Next. The PivotTable and PivotChart Wizard Step 3 of 3 dialog box appears. 15. Click Finish. The Microsoft Excel - ClientHealthPivot.xls window appears. Notice that the spreadsheet displays data from the local site and its current client health. The data displayed should be the same as the data displayed in the Client Health Summary Report viewed earlier, just in a different format. 16. Under Classification, notice the entry for Unhealthy. The LastPingResult column displays the results of the most recent ping test results for unhealthy clients. Notice that for our two unhealthy clients, the data is listed as Online CCMExec Running, BITS Installed.

25 Lab: Implementing SMS 2003 SP1 Features Under the Grand Total column, double-click the number of clients classified as unhealthy (should be 2). A new worksheet is created that displays the results of each computer that is listed as unhealthy. Notice that the displayed data includes the computer name, site code, dates of last data reporting, and dates for last ping and policy polling functions. 18. Below the spreadsheet, click Sheet 1 to return to the main worksheet. 19. On the File menu, click Save. Saving the current configuration of the spreadsheet will allow it to be updated after generating new client health data, and not having to modify the data source again. 20. On the File menu, click Exit. In the following procedure, you will configure software inventory as it was missing from the site, and thus caused the client health report to reflect unhealthy status for the clients. To configure software inventory 1. In the console tree, expand MCM, expand Site Settings, and then click Client Agents. The list of client agents for the local site appears in the details pane. 2. In the details pane, click Software Inventory Client Agent, and then on the Action menu, click Properties. The Software Inventory Client Agent Properties dialog box appears. 3. Click Enable software inventory on clients, and then click the Inventory Collection tab. The Software Inventory Client Agent Properties dialog box displays the collection rules for the Software Inventory Client Agent. 4. Under File types, click *.exe and then click Properties. The Inventory File Properties dialog box appears displaying the rule for scanning executable files. 5. Are there any new configuration options for software inventory rules? Yes you can now have software inventory automatically exclude files in the Windows directory (disabled by default). 6. Click Exclude files in the Windows directory, and then click Set. The Path Properties dialog box appears allowing configuration of the paths to scan.

26 26 Lab: Implementing SMS 2003 SP1 Features 7. Click Variable or path name, and then in the Location box, type %programfiles% This configures the inventory agent to only scan the Program Files folder (and its subfolders) for programs and not the entire hard disk. 8. Click OK. The Inventoried File Properties dialog box the current files and paths information for scanning. 9. Click OK. The Software Inventory Client Agent Properties dialog box displays the collection rules for the Software Inventory Client Agent. 10. Click OK. The SMS Administrator Console window appears. In the following procedure, you will force the Advanced Client to check for new policies, which will include the policies to enable software inventory. This will then generate a software inventory collection cycle for the client. Note Complete this procedure from the Windows XP Advanced Client computer only. To generate software inventory data 1. In Control Panel, start Systems Management. The Systems Management Properties dialog box appears. 2. Click the Actions tab. The Systems Management Properties dialog box displays the available actions for the Advanced Client. Notice the default actions of Discovery Data Collection Cycle, Machine Policy Retrieval & Evaluation Cycle, User Policy Retrieval & Evaluation Cycle and Windows Installer Source List Update Cycle. In addition, you will notice action for hardware inventory. 3. Click Machine Policy Retrieval & Evaluation Cycle, and then click Initiate Action. The Advanced Client will request new policies, which will include the policy related to software inventory. A Machine Policy Retrieval & Evaluation Cycle message box appears indicating the action was initiated, and may take several minutes to complete. 4. Click OK. The Systems Management Properties dialog box appears. 5. Click OK. It will take two minutes for the Advanced Client to download and evaluate the policy. When it is complete, software inventory data will be collected automatically and sent to the SMS site.

27 Lab: Implementing SMS 2003 SP1 Features 27 In the following procedure, you will force the SMS Client Health service to check on client status after enabling software inventory for the site and forcing the SMS 2003 Advanced Client to generate software inventory data. To force the SMS Client Health service to check client health 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. Click Configure the Client Health Monitoring Tool. The SMS Client Health Monitoring Tool dialog box appears displaying the Site Settings tab for configuring the connection to the SMS site database and configuration of the SMS Client Health Service. 3. Click the Schedule tab. The SMS Client Health Monitoring Tool dialog box appears displaying the Schedule tab for configuration of various data methods for collection, identification and reporting of health status. 4. After Collect Pulse Information from management points, click Run Now. This forces the SMS Client Health service to poll the default management point in the site for client polling information. 5. After Ping clients, click Run Now. This forces the SMS Client Health service to ping the suspected unhealthy clients. 6. Click OK. Note It will take a few minutes for the poll check and ping test to complete. Remain here for a couple of minutes before moving onto the next procedure. In the following procedure, you will view the report of the SMS Client Health Monitoring Tool client status. Note Complete this procedure from the SMS site server. To report on the existing client health status 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. Click Client Health Summary Report. Internet Explorer starts and displays the SMS Client Health Summary page. This report lists the status of clients in the site. Notice that you have two clients in the site and now only one is listed as being unhealthy.

28 28 Lab: Implementing SMS 2003 SP1 Features 3. What data is present from both of the clients? Heartbeat discovery and hardware inventory data. 4. What data is missing from one of the clients that prevent them from being listed as healthy? Software inventory data 5. Close the SMS Client Health window. In the following procedure, you will view the client health information generated by the SMS Client Health Monitoring Tool by using the Client Health Pivot Table Report now that the client has sent software inventory data to the site. To view the SMS Client Health Pivot Table Report 1. On the Start menu, point to All Programs, point to Microsoft SMS 2003 Client Health Monitoring Tool. A new menu appears. 2. Click Client Health Pivot Table Report. Microsoft Excel starts, and the Microsoft Excel ClientHealthPivot.xls window appears. Notice that the spreadsheet displays data from the site that was saved when you last ran the tool. 3. On the PivotTable toolbar s PivotTable menu, click Refresh Data. A Refresh Data message box appears indicating refreshing data imports data to Excel. 4. Click OK. The Microsoft Excel - ClientHealthPivot.xls window appears. Notice that the spreadsheet displays data from the local site and its current client health. The data displayed should be the same as the data displayed in the most recent Client Health Summary Report viewed earlier, just in a different format. 5. Under Classification, double-click Healthy. The LastPingResult column displays the results of the most recent ping test results for the one healthy client. Notice that our value is blank as the client is healthy. 6. Under the Grand Total column, double-click the number of clients classified as healthy (should be 1). A new worksheet is created that displays the results of each computer that is listed as healthy. Notice that the displayed data includes the computer name, site code, dates of last data reporting, and dates for last ping and policy polling functions. 7. Below the spreadsheet, click Sheet 1 to return to the main worksheet.

29 Lab: Implementing SMS 2003 SP1 Features On the File menu, click Save. Saving the current configuration of the spreadsheet will allow it to be updated after generating new client health data, and not having to modify the data source again. 9. On the File menu, click Exit. If you wanted to make both your clients healthy, you can force the Advanced Client on the site server to retrieve policies, which will force a software inventory cycle. After software inventory has been reported, you can force the SMS Client Health tool to check for client status, and then generate new reports. You have now explored some of the new features to SMS 2003 SP1, including creating folders in the SMS Administrator Console to group like items, enable a new port for Advanced Client to SMS site interactions, enabling Advanced Client authentication and data encryption, and used the Client Health tool to identify unhealthy systems, and why they are unhealthy.

30