SMS Administrator s Reference. Systems Management Server Ron D. Crumbaker

Transcription

1 SMS 2003 Administrator s Reference Systems Management Server 2003 Ron D. Crumbaker

2

3 SMS 2003 Administrator s Reference Systems Management Server 2003

4

5 SMS 2003 Administrator s Reference Systems Management Server 2003 Ron D. Crumbaker

6 SMS 2003 Administrator s Reference: Systems Management Server 2003 Published by Wiley Publishing, Inc Crosspoint Boulevard Indianapolis, IN Copyright 2007 by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN-13: ISBN-10: Manufactured in the United States of America Library of Congress Cataloging-in-Publication Data is available from the publisher. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) , fax (978) Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., Crosspoint Blvd., Indianapolis, IN 46256, (317) , fax (317) , or online at LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: THE PUBLISHER AND THE AUTHOR MAKE NO REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COM- PLETENESS OF THE CONTENTS OF THIS WORK AND SPECIFICALLY DISCLAIM ALL WAR- RANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE. NO WARRANTY MAY BE CREATED OR EXTENDED BY SALES OR PROMOTIONAL MATERIALS. THE ADVICE AND STRATEGIES CONTAINED HEREIN MAY NOT BE SUITABLE FOR EVERY SITUATION. THIS WORK IS SOLD WITH THE UNDERSTANDING THAT THE PUBLISHER IS NOT ENGAGED IN RENDERING LEGAL, ACCOUNTING, OR OTHER PROFESSIONAL SERV- ICES. IF PROFESSIONAL ASSISTANCE IS REQUIRED, THE SERVICES OF A COMPETENT PROFES- SIONAL PERSON SHOULD BE SOUGHT. NEITHER THE PUBLISHER NOR THE AUTHOR SHALL BE LIABLE FOR DAMAGES ARISING HEREFROM. THE FACT THAT AN ORGANIZATION OR WEBSITE IS REFERRED TO IN THIS WORK AS A CITATION AND/OR A POTENTIAL SOURCE OF FURTHER INFORMATION DOES NOT MEAN THAT THE AUTHOR OR THE PUBLISHER ENDORSES THE INFORMATION THE ORGANIZATION OR WEBSITE MAY PROVIDE OR RECOM- MENDATIONS IT MAY MAKE. FURTHER, READERS SHOULD BE AWARE THAT INTERNET WEBSITES LISTED IN THIS WORK MAY HAVE CHANGED OR DISAPPEARED BETWEEN WHEN THIS WORK WAS WRITTEN AND WHEN IT IS READ. For general information on our other products and services please contact our Customer Care Department within the United States at (800) , outside the United States at (317) or fax (317) Trademarks: Wiley, the Wiley logo, Wrox, the Wrox logo, Programmer to Programmer, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

7 I dedicate this book to my lovely wife, Martha, who has stuck with me throughout this endeavor. I also want to dedicate the book to my three wonderful children, Nate, Abby Dale, and Cole Thomas. I know during this project you heard In a second or After a while I will, so I owe you some serious play time with Daddy. I love you guys so much!

8

9 About the Author Ron Crumbaker has an Electrical Engineering degree but found himself in the Information Technology field. Ron is a huge Chevrolet Camaro fan and was greatly disappointed when GM decided to pull the plug on the Camaro. Ron currently owns two Camaros, a 1967 SS350 and a 1994 Z28. Ron has three children Nate, Abby, and Cole and a wife, Martha. Ron is very active in his church and community and is an ordained deacon in a Southern Baptist Church. Ron is also the CTO for myitforum.com, Inc., and is a two-time Microsoft MVP in the Windows Server System, SMS.

10

11 Senior Acquisitions Editor Jim Minatel Development Editor Kelly Dobbs Henthorne Technical Editor Todd Meister Copy Editors Kathy Carlyle Nancy Rapoport Editorial Manager Mary Beth Wakefield Production Manager Tim Tate Credits Vice President and Executive Group Publisher Richard Swadley Vice President and Executive Publisher Joseph B. Wikert Compositor Maureen Forys, Happenstance Type-O-Rama Proofreaders Ian Golder Jen Larsen Indexer Johnna VanHoose Dinse Anniversary Logo Design Richard Pacifico

12

13 Acknowledgments This being my first book, I want to express my sincere thanks to Jim Minatel for sticking with me on this project and allowing me to get the book published after all the ups and downs throughout the writing process. I want to thank my development editor, Kelly Henthorne, for all her hard work bringing the writer out of me. It has been a true pleasure working with her. She is purely professional, very dedicated, and extremely hard working. I also want to thank Randy Hammer for his hard work helping me out of a jam and his contributions in a few chapters. I appreciate his hard work and dedication in assisting me on such short notice and in an extremely short time frame. Randy Hammer currently manages a team responsible for SMS administration and software packaging at VeriSign Inc. He has administered and implemented small to medium SMS sites since I also want to thank Brian Rogers and April Cook for their work assisting me with some additional thoughts and directions, and Rod Trent for getting me started writing this book and helping me find a clear direction on where to take it. You are truly a great person, and I m honored to be able to call you a friend. I would also like to thank the many people that are active on myitforum.com. Without you, SMS would not be the great product it is today. Microsoft has listened and continues to listen to what we say. We all benefit from the dedication each of you shows by posting, ing, and simply being active on the forum. I also want to thank Jesus, my Lord and Savior. Without You, I am nothing.

14

15 Contents Acknowledgments Introduction xi xxi Chapter 1: Setting Up Your Site Hierarchy 1 Overview 2 Site Hierarchy 3 SMS Server Roles 3 Connecting Child Sites to Parent Sites 4 Installing a Secondary Site 4 Attaching a Child Site to a Parent Site 11 Site Boundary Management 12 Roaming Boundaries 12 Active Directory 14 Summary 15 Chapter 2: Specifying and Managing Site System Roles 17 Management Point 18 Client Access Point 22 Distribution Point 25 Distribution Point Groups 26 Protected Distribution Points 27 Server Locator Point 29 Reporting Point 31 Summary 32 Chapter 3: Managing SMS Security 33 Security Modes 34 Advanced Security Mode 34 Standard Security Mode 34 Security Levels 35 SQL Security 35 WMI Security 35 IIS Security 35 Standard Security Mode 35

16 Contents Advanced Security Mode 36 SMS Accounts 36 Common Accounts for Both Modes 36 Providing a Secure Infrastructure 41 Configuring Connection Accounts 41 Client Connection Accounts 41 Site System Connection Accounts 42 Managing Object/Class Level Security Rights 42 Summary 51 Chapter 4: Configuring Site Settings 53 Addresses 53 Senders 59 Component Configuration 60 Software Distribution 60 Status Reporting 61 Management Point 62 Site Maintenance 63 SQL Commands 65 Summary 66 Chapter 5: Specifying Discovery Methods 67 Windows User Account Discovery 68 Windows User Group Discovery Method 70 Heartbeat Discovery Method 72 Network Discovery Method 73 Active Directory System Discovery 77 Active Directory User Discovery 79 Active Directory System Group Discovery 81 Third-Party Discovery Tools 83 Enhanced System Discovery 83 Enhanced AD User Discovery 83 Summary 83 Chapter 6: Enabling Client Agent Settings 85 What Is an Agent? 85 The Hardware Inventory Agent 86 The Software Inventory Agent 89 xiv

17 Contents The Remote Tools Client Agent 93 Advertised Programs Client Agent 98 Software Metering Client Agent 100 Site Maintenance Software Metering tasks 102 Summary 102 Chapter 7: Client Installation Methods 103 Client Push Installation 103 Client Installation through Group Policy 107 Manually Installing the Client Using CCMSetup.exe 108 Command-Line Switches 108 Installation Properties 109 Prestaging the SMS Client on a Desktop Image 111 Additional Client Deployment 111 Using ORCA to Customize client.msi 112 Summary 115 Chapter 8: Managing Collections 117 Creating a New Collection 117 Creating a Direct Membership Rule 118 Query-Based Membership Rules 120 Query-Based Membership Rule Criteria 122 Limiting Queries 125 Updating Collections 126 Replicating Collections Between Hierarchies 127 Moving a Collection 129 Deleting Objects from a Collection 130 Viewing Advertisements Targeted to a Collection 131 SMS Collection Structure and Management 132 Summary 133 Chapter 9: Creating and Distributing Packages 135 Creating a New Package from a Definition File or an MSI 136 General Package Information 136 Specifying a Data Source 137 Configuring Programs 140 Tricks 143 Summary 144 xv

18 Contents Chapter 10: Creating Advertisements 145 Stop! Consider Change Management 145 Creating a Basic Advertisement 146 The Include Members of Subcollections Checkbox 147 Scheduling Advertisements 148 Expiring an Advertisement 152 Setting the Priority of an Advertisement 152 Advanced Client Options 153 Organizing Advertisements 154 Summary 155 Chapter 11: Configuring Software Metering Rules 157 Software Metering Rules Properties Dialog Box 157 Disabling a Software Metering Rule 159 Viewing Software Usage Reports 159 Default Reports for Software Metering 160 Verify Software Metering Is Installed 162 Summary 162 Chapter 12: Providing Console and Web-Based Reporting 163 Reports 163 The Report Viewer 164 Create a Reporting Point 164 Creating and Running Reports 164 Report Types 165 Filtering 165 Running a Report 166 Cloning a Report 166 Report Prompts 167 Exporting and Importing Reports 167 Report SQL Statement Dialog Box 168 Creating Reports 168 Scheduling Reports 169 Dashboards 170 Creating Dashboards 171 SQL Versus WQL 173 Providing Custom Consoles 175 Providing Access to Web Reports 176 Summary 176 xvi

19 Contents Chapter 13: Managing Software Updates 177 Installing the ITMU 178 Synchronizing the WSUSScan.cab 187 Distribute Software Updates Wizard 187 Verifying the Results of the ITMU 193 Reports 193 Status Messages 193 Summary 194 Chapter 14: Troubleshooting 197 Preventing Problems 197 Do I Really Need to Do All That? 200 Understand the Structure of the SMS Client and Server 200 The SMS Client Folder Structure 200 The Folder Structure for the SMS Site Server 200 Other Site System Folders 202 SMS Status Messages 202 Drilling into a Problem in the Site Status View 203 Viewing Status Messages with SMS 2003 Web Reports 206 Client Status Messages 208 SMS 2003 Logs, Where Troubleshooting Begins 214 SMS Site Server Logs 215 Management Point Logs 218 The Legacy Client Logs 219 The Advanced Client Logs 220 Monitoring Client Health 223 Repairing Client Issues 224 Intersite Communication Issues 224 Summary 226 Chapter 15: Using Third-Party Solutions E 228 Macrovision Corporation 229 Intrinsic Technologies 229 PS SOFT 229 Vintela 229 ianywhere 229 xvii

20 Contents SMSView 230 SMS 2003 Monster MOF 231 SMS 2003 Web Remote Tools 233 Corey Becht s Right Click Tools 245 myitforum Code Repository 246 Microsoft SMS Toolkit The IIS Lockdown 2.1 Template 247 URLScan 2.5 Template 248 Policy Spy 248 SMS Trace 248 Advanced Client and Management Point Cleaner 249 Advanced Client Spy 250 Policy Verifier 251 Send Schedule 252 Management Point Spy 252 Set Preferred Distribution Point and CAP 252 Delete Certificate 253 Patch Management Evaluation 253 Delete Group Class 254 Transfer SMS ID 254 Package Loader 255 Management Point Troubleshooter 255 Client Site Assignment Verifier 256 Site Boundary Tool 256 Create Secondary Site Tool 258 Create SMS Address Tool 259 Microsoft SMS SDK 260 Summary 263 Chapter 16: Scripting SMS Tools Needed to Script SMS Where to Start Scripting 266 Creating Collections 267 Creating Sub-Collections 267 Adding a System to a Collection 268 Removing a System from a Collection 269 AddColl Code 269 Creating a Package and Program 274 Updating the Distribution Points 277 Refreshing Distribution Points 278 xviii

21 Contents Advanced Client Scripting 278 Software Inventory 278 Hardware Inventory 279 Finding the Assigned Site 279 Setting the Assigned Site 279 Refreshing Machine Policies 280 1E Client Health Script 280 Building Right-Click Tools 290 Summary 297 Chapter 17: Where Is SMS Going? 299 SMS 2003 R2 299 SMS 2003 R2 Features 300 SMS 2003 R2 Setup 301 Inventory Tool For Custom Updates 302 Custom Updates Publishing Tool 306 Scan Tool For Vulnerability Assessment 310 Device Management Feature Pack 315 OS Deployment Feature Pack 317 Systems Center Configuration Manager Operating System Deployment 320 Network Access Protection 320 Software Distribution 320 Software Update Management 320 Desired Configuration Management 321 Device Management 321 Software Inventory and Metering 321 Hardware Inventory 321 Remote Control 321 Wake on LAN 321 Vulnerability Assessment 321 Software Development Kit 321 Backup and Recovery 321 Other Key SCCM 2007 Points 322 Summary 323 Appendix A: SMS 2003 Setup 325 Index 335 xix

22

23 Introduction Microsoft has really come a long way with management of systems within the corporate world. Micro - soft Systems Management 2003 delivers a centralized management tool to support all of your computers, workstations, servers, and other devices with the help of third-party solutions. This book is designed to help the average SMS administrator manage the ever-increasing demands for operation excellence at the desktop and server levels by leveraging the highly extensive nature of the SMS product. Whom This Book Is For This book is intended for any SMS administrator and will provide information that is relevant and timely for administrators of nearly all levels. In the book, I assume you have a planned or pre-existing SMS environment and will not cover common architecture and design concepts that are found in many other titles and from Microsoft. What This Book Covers This book is based on Systems Management Server 2003 with Service Pack 1 installed. Microsoft has since released Service Pack 2 for SMS 2003, and these new changes are discussed within this book. How This Book Is Structured The approach for this title is simple: Features and tasks are broken down into 17 separate chapters, and each chapter includes an outline for what is to be accomplished. These items are covered with information provided about all tasks or functionality required, tools, and scripts needed to accomplish the task and the results. A common programming and testing environment is used through the text and examples to allow users to familiarize themselves more quickly as they advance through the chapters. What You Need to Use This Book You will need a Windows 2000 Server or greater with SMS 2003 SP1 installed. Everything else needed is discussed in the book. It is recommended that you have all the latest security patches installed on the server operating system.

24 Introduction Conventions To help you get the most from the text and keep track of what s happening, I ve used a number of conventions throughout the book. Tips, hints, tricks, and asides to the current discussion are offset and placed in italics like this. As for styles in the text: I italicize new terms and important words when I introduce them. I show keyboard strokes like this: Ctrl+A. I show filenames, URLs, and code within the text like so: persistence.properties. I present code in two different ways: In code examples I highlight new and important code with a gray background. The gray highlighting is not used for code that s less important in the present context, or has been shown before. Source Code As you work through the examples in this book, you may choose either to type in all the code manually or to use the source code files that accompany the book. All of the source code used in this book is available for download at Once at the site, simply locate the book s title (either by using the Search box or by using one of the title lists) and click the Download Code link on the book s detail page to obtain all the source code for the book. Because many books have similar titles, you may find it easiest to search by ISBN; this book s ISBN is Once you download the code, just decompress it with your favorite compression tool. Alternately, you can go to the main Wrox code download page at to see the code available for this book and all other Wrox books. Errata We make every effort to ensure that there are no errors in the text or in the code. However, no one is perfect, and mistakes do occur. If you find an error in one of our books, like a spelling mistake or faulty piece of code, we would be very grateful for your feedback. By sending in errata you may save another reader hours of frustration and at the same time you will be helping us provide even higher quality information. To find the errata page for this book, go to and locate the title using the Search box or one of the title lists. Then, on the book details page, click the Book Errata link. On this page you can view all errata that has been submitted for this book and posted by Wrox editors. A complete book xxii

25 Introduction list including links to each book s errata is also available at booklist.shtml. If you don t spot your error on the Book Errata page, go to techsupport.shtml and complete the form there to send us the error you have found. We ll check the information and, if appropriate, post a message to the book s errata page and fix the problem in subsequent editions of the book. p2p.wrox.com For author and peer discussion, join the P2P forums at p2p.wrox.com. The forums are a Web-based system for you to post messages relating to Wrox books and related technologies and interact with other readers and technology users. The forums offer a subscription feature to you topics of interest of your choosing when new posts are made to the forums. Wrox authors, editors, other industry experts, and your fellow readers are present on these forums. At you will find a number of different forums that will help you not only as you read this book, but also as you develop your own applications. To join the forums, just follow these steps: 1. Go to p2p.wrox.com and click the Register link. 2. Read the terms of use and click Agree. 3. Complete the required information to join as well as any optional information you wish to provide and click Submit. 4. You will receive an with information describing how to verify your account and complete the joining process. You can read messages in the forums without joining P2P but in order to post your own messages, you must join. Once you join, you can post new messages and respond to messages other users post. You can read messages at any time on the Web. If you would like to have new messages from a particular forum ed to you, click the Subscribe to this Forum icon by the forum name in the forum listing. For more information about how to use the Wrox P2P, be sure to read the P2P FAQs for answers to questions about how the forum software works as well as many common questions specific to P2P and Wrox books. To read the FAQs, click the FAQ link on any P2P page. xxiii

26

27 SMS 2003 Administrator s Reference Systems Management Server 2003

28

29 Setting Up Your Site Hierarchy In this book, I ll discuss the steps you need to take to ensure that Systems Management Server (SMS) 2003 is administrated successfully to provide powerful management across the enterprise. My main focus will be SMS 2003 with Service Pack 1, but I will cover SP2 features as well. I ll guide you through the inner workings of SMS 2003 and help you gain control of all aspects of systems management. This book organizes SMS 2003 into sections that are paired with each SMS feature and administrative task. Each section includes a brief description of the feature or reason for the administrative task and explains where SMS 2003 can be used to fill the void. I will discuss ways to improve SMS 2003 by site reconfigurations, the use of scripts, SMS Admin Console extensions, and thirdparty tools to extend SMS 2003 and enhance your ability to administer an SMS 2003 site hierarchy. Desktop management has improved considerably over the past few years, and with SMS 2003 Microsoft has risen to the challenge. Although SMS 2003 has many features that help it deliver an end-to-end solution for desktop management, some standard practices are required to ensure that it is utilized to its fullest potential. This book will help you discover these techniques so you can successfully administer an SMS 2003 environment. SMS 2003 Administrator s Reference is designed to provide a comprehensive introduction and overview of administrating SMS By using real-world examples, this book will help you become more competent in the basic skills necessary for administrating SMS 2003 and it will show you how to use advanced SMS functions to administer your SMS environment. SMS 2003 offers solutions for key issues in management throughout the enterprise, including: Hardware/software inventory Software distribution Software metering Remote tools Microsoft update management

30 Chapter 1: Setting Up Your Site Hierarchy Overview SMS 2003 is a packaged solution that offers powerful desktop administration tools for managing computer hardware and software, distributing software, and troubleshooting remotely. In this chapter, I briefly introduce you to the key features of SMS 2003 and describe the components that make up an SMS 2003 hierarchy. SMS 2003 provides various components and tools to help organizations monitor asset management, distribute software to clients within the network, track hardware and software changes, conduct remote administration, and create reports and queries based on the information collected within the SMS environment. Software distribution, remote tools, software metering, security update distribution, hardware inventory, and software inventory are key features of SMS SMS 2003 can generate reports quickly and easily so you can monitor your environment and perform software updates, ensure licensing compliance, and schedule hardware replacement. SMS 2003 provides administrators the ability to quickly distribute software to every client within the SMS hierarchy or to a single client. Software distribution can be distributed based on a schedule, or it can be set to install during log in. SMS 2003 has software metering that actually works. It allows administrators to track when a program was last used and how long it was open. By tracking software usage, administrators can make sure they have only the software packages that are actually needed so they won t overbudget. With SMS Remote Tools, the SMS 2003 administrator or help desk personnel can troubleshoot and remotely support clients across the SMS hierarchy. With remote support, the administrator can provide assistance without physically going to a client s location, just as if he were sitting at the client s location. The latest viruses and software flaws have made the ability to easily administer extremely important. With SMS 2003, you can use the built-in tools to install software updates so that your clients Microsoft security and third-party software is always up-to-date. With the release of the Inventory tool for Microsoft updates, you can quickly manage critical updates for Microsoft Windows, Microsoft Office, Microsoft SQL Server, Microsoft Exchange Server, Microsoft Internet Information Services, and many other Microsoft software packages. Dell provides a tool to allow Dell system administrators to keep drivers and BIOSs up-to-date. Other computer manufacturers are working with Microsoft to provide tools for their systems as well. SMS 2003 provides rich reporting through default queries and reports or through customized queries and reports. Many reports and queries are built into SMS 2003 by default, but SMS 2003 provides a simple way to add customized reports and queries. SMS 2003 can deploy Microsoft operating system upgrades using the OS Deployment tool, which is provided as an add-on to SMS The OS Deployment tool allows you to quickly and easily upgrade your client s OS without losing any of the customizations the clients had on their workstations. These and many other SMS 2003 features are discussed in the following chapters. 2